levix-bot 2.0.0

package/src/bootstrap/core.js

@@ -0,0 +1,74 @@
+// Everything Levix needs to be a WhatsApp bot.
+//
+// Database, settings, commands, the WhatsApp socket, the scheduler. No HTTP,
+// no Express, no socket.io — those live in bootstrap/panel.js and are entirely
+// optional. `levix headless` runs this file and nothing else, which is what
+// makes "no panel port is opened" a fact rather than a promise.
+
+import { createRequire } from "module";
+import { createWhatsAppSocket } from "../core/socket.js";
+import { setupEventListeners } from "../core/events.js";
+import { loadCommands, getLoadedCommands } from "../handlers/command.handler.js";
+import { initStore } from "../db/store.esm.js";
+
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+const { sink } = require("./events.cjs");
+const { acquireSingleInstanceLock } = require("../config/lock.cjs");
+const { ensureDataDir } = require("../config/paths.cjs");
+const store = require("../db/store.cjs");
+const { initializeScheduledJobs } = require("../../scheduler.cjs");
+
+/**
+ * Start the bot.
+ *
+ * @param {object} [options]
+ * @param {(sock: object, controls: object) => void} [options.onSocket]
+ *   Called with every socket, including the ones a reconnect produces — the
+ *   panel uses it to keep its "unlink" button pointed at the live connection.
+ * @returns {Promise<{ sock: object, commandCount: number, wasPaired: boolean }>}
+ */
+export async function bootstrapCore({ onSocket } = {}) {
+  // Claim the data directory before anything touches the WhatsApp session. A
+  // second copy has to fail here, not after it has written to the auth rows
+  // the first one is using.
+  acquireSingleInstanceLock();
+
+  // Temp media the commands write while answering lives with the rest of the
+  // bot's state, not next to the code.
+  ensureDataDir("media");
+
+  // Whether this install has ever been paired decides what the terminal says
+  // next, so read it before the socket has a chance to create credentials.
+  const wasPaired = store.hasCredentials();
+
+  await initStore();
+  await loadCommands();
+
+  const sock = await connect({ onSocket });
+
+  return { sock, commandCount: getLoadedCommands().size, wasPaired };
+}
+
+async function connect({ onSocket, isReconnect = false } = {}) {
+  const { sock, saveCreds, clearAll } = await createWhatsAppSocket();
+
+  setupEventListeners(
+    sock,
+    saveCreds,
+    clearAll,
+    // The bot reports into the hub; whoever is listening decides what that
+    // means — a socket.io broadcast, a line in the terminal, or nothing.
+    sink,
+    initializeScheduledJobs,
+    async () => {
+      logger.info("[Reconnect] Attempting to reconnect to WhatsApp...");
+      await connect({ onSocket, isReconnect: true });
+    }
+  );
+
+  if (onSocket) onSocket(sock, { clearAll, isReconnect });
+
+  logger.info("WhatsApp socket initialized successfully");
+  return sock;
+}

package/src/bootstrap/events.cjs

@@ -0,0 +1,43 @@
+// The seam between the bot and whatever is watching it.
+//
+// The connection handler already reports its state by calling `io.emit(...)`.
+// That was fine while socket.io was the only listener, but headless mode has
+// no socket.io and still needs to know when a QR arrives or the pairing
+// succeeds — and the panel may attach long after the bot has started.
+//
+// So the bot emits into this hub instead, and listeners attach to it:
+//
+//   panel     -> forwards every event to socket.io
+//   headless  -> prints the ones a person waiting at a terminal cares about
+//
+// `sink` is shaped like the socket.io server object because that is what
+// `setupEventListeners` is handed. Nothing in src/core had to change.
+
+const listeners = new Set();
+
+/** Attach a listener. Returns a function that detaches it. */
+function attach(listener) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+function emit(event, payload) {
+  for (const listener of listeners) {
+    try {
+      listener(event, payload);
+    } catch {
+      // A broken listener must never take the bot down with it.
+    }
+  }
+}
+
+// The `io`-shaped object handed to the WhatsApp event wiring. `use` and `on`
+// are no-ops: only the panel's real socket.io server implements those, and it
+// wires them itself.
+const sink = {
+  emit,
+  use() {},
+  on() {},
+};
+
+module.exports = { sink, attach, emit };

package/src/bootstrap/panel.js

@@ -0,0 +1,97 @@
+// The web control panel: Express, sessions, EJS, socket.io, the routes.
+//
+// Loaded only when the panel is wanted. `levix headless` never imports this
+// file, so none of it is ever constructed — no app, no server, no socket.io
+// namespace, and nothing bound to a port.
+
+import { createRequire } from "module";
+
+const require = createRequire(import.meta.url);
+const logger = require("../utils/logger.cjs");
+const settings = require("../config/settings.cjs");
+const { attach } = require("./events.cjs");
+
+/**
+ * Start the panel and bind its port.
+ *
+ * @param {object} options
+ * @param {object} options.core - what bootstrapCore() returned
+ * @returns {Promise<{ port: number, host: string, server: object }>}
+ */
+export async function bootstrapPanel({ core } = {}) {
+  // Required here, not at the top of the module: requiring app.cjs constructs
+  // the Express app and the socket.io server, and headless mode must not.
+  const {
+    app,
+    server,
+    io,
+    dashboardJson,
+    requireLoginApi,
+    noStore,
+    installFinalHandlers,
+  } = require("../../app.cjs");
+
+  const { default: dashboardApiRoutes, setBotInstance, setBotControls } =
+    await import("../routes/dashboard.api.esm.js");
+
+  // Same session as the control panel: these routes hand back groups, debts
+  // and warnings with people's numbers in them.
+  app.use("/dashboard/api", requireLoginApi, noStore, dashboardJson, dashboardApiRoutes);
+  logger.info("Dashboard API routes registered");
+
+  // Everything the bot reports goes out to the browsers watching the panel.
+  attach((event, payload) => io.emit(event, payload));
+
+  if (core?.sock) {
+    setBotInstance(core.sock);
+    setBotControls({ clearAll: core.clearAll });
+  }
+
+  // After every route is registered — the 404 and the error handler have to be
+  // last, or they swallow what comes after them.
+  installFinalHandlers();
+
+  const port = settings.get("port");
+  const host = resolveBindAddress();
+
+  await new Promise((resolve, reject) => {
+    // "EADDRINUSE" plus a stack trace is not an answer anyone can act on, and
+    // the overwhelmingly likely cause is a second copy of the bot.
+    server.once("error", (error) => {
+      if (error.code === "EADDRINUSE") {
+        const friendly = new Error(
+          `Port ${port} is already taken.\n\n` +
+            `  Levix is probably already running — open http://localhost:${port}/ and\n` +
+            `  check. If something else owns the port, change it in the control panel\n` +
+            `  under Settings -> Server, or start with a different one.`
+        );
+        friendly.code = "EADDRINUSE";
+        return reject(friendly);
+      }
+      reject(error);
+    });
+    server.listen(port, host, resolve);
+  });
+
+  return { port, host, server, setBotInstance, setBotControls };
+}
+
+/**
+ * Which address the panel binds to.
+ *
+ * The default is every interface, because that is what a Docker publish and a
+ * "open it from my phone on the same wifi" both need. Once `levix domain` has
+ * actually put a reverse proxy in front, it sets this to 127.0.0.1 so nobody
+ * can reach the panel by its raw port and skip the TLS in front of it.
+ */
+export function resolveBindAddress() {
+  const configured = settings.get("bind_address");
+  return configured || "0.0.0.0";
+}
+
+/** The address a person should type, given how this install is reachable. */
+export function panelUrl({ port, firstRun = false } = {}) {
+  const domain = settings.get("public_domain");
+  const base = domain ? `https://${domain}` : `http://localhost:${port}`;
+  return firstRun ? `${base}/setup` : base;
+}

package/src/cli.js

@@ -0,0 +1,153 @@
+// The `levix` command.
+//
+// Kept here rather than in bin/levix.js so the packaged executable can use the
+// same entry point: bin/ is a two-line wrapper, and scripts/build-sea.mjs
+// bundles this file. Every branch imports what it needs and nothing else —
+// `levix where` must not start a database, let alone WhatsApp.
+
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const pkg = require("../package.json");
+
+const MIN_MAJOR = 24;
+
+function checkNode() {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (major >= MIN_MAJOR) return;
+
+  console.error(
+    [
+      "",
+      `  ${pkg.name} needs Node ${MIN_MAJOR} or newer (you have ${process.versions.node}).`,
+      "",
+      "  It stores everything in SQLite, which Node ships with itself from",
+      `  version ${MIN_MAJOR} on — that is what makes the install a single command`,
+      "  with nothing to compile.",
+      "",
+      "  Get it from https://nodejs.org (pick the LTS build).",
+      "",
+    ].join("\n")
+  );
+  process.exit(1);
+}
+
+function help() {
+  console.log(
+    [
+      "",
+      `  ${pkg.name} ${pkg.version} — ${pkg.description}`,
+      "",
+      "  Usage",
+      "    levix                    start Levix with the web panel",
+      "    levix headless           start Levix with no web UI at all",
+      "    levix where              print the data directory",
+      "    levix reset-password     reset the panel password",
+      "    levix domain [name]      point a domain at Levix (may need sudo)",
+      "",
+      "  Options",
+      "    --data <dir>             keep the database and files somewhere else",
+      "    --headless               same as the headless command",
+      "    --no-open                don't open a browser on start",
+      "    --version, --help",
+      "",
+      "  Everything else is configured from the control panel itself,",
+      "  which prints its address when the bot starts.",
+      "",
+    ].join("\n")
+  );
+}
+
+// The command is the first argument that isn't a flag or a flag's value.
+// `levix --data /var/lib/levix where` has to run `where`, not start the bot —
+// which is exactly how someone debugging a systemd install types it.
+const FLAGS_WITH_VALUES = new Set(["--data"]);
+
+export function parseArgv(argv) {
+  const flags = new Set();
+  const positional = [];
+
+  for (let i = 2; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (FLAGS_WITH_VALUES.has(arg)) {
+      i += 1; // skip its value
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      flags.add(arg.split("=")[0]);
+      continue;
+    }
+    positional.push(arg);
+  }
+
+  return { command: positional[0] ?? null, positional, flags };
+}
+
+export async function main(argv = process.argv) {
+  const { command, positional, flags } = parseArgv(argv);
+
+  if (flags.has("--help") || flags.has("-h") || command === "help") {
+    help();
+    return 0;
+  }
+
+  if (flags.has("--version") || flags.has("-v")) {
+    console.log(pkg.version);
+    return 0;
+  }
+
+  checkNode();
+
+  switch (command) {
+    case "where": {
+      const { DATA_DIR } = await import("./config/paths.cjs");
+      console.log(DATA_DIR);
+      return 0;
+    }
+
+    case "reset-password": {
+      const store = (await import("./db/store.cjs")).default;
+      const { close } = await import("./db/db.cjs");
+      store.deleteBotSetting("auth:password");
+      close();
+      console.log(
+        "\n  Password cleared. Start the bot and open the panel to choose a new one.\n"
+      );
+      return 0;
+    }
+
+    case "domain": {
+      const { runDomainCommand } = await import("./domain/command.js");
+      return runDomainCommand({
+        domain: positional[1] ?? null,
+        assumeYes: flags.has("--yes") || flags.has("-y"),
+      });
+    }
+
+    case "headless":
+    case null:
+    case undefined: {
+      const { start } = await import("./index.js");
+      await start({
+        headless: command === "headless" || flags.has("--headless"),
+        open: !flags.has("--no-open"),
+      });
+      // The bot keeps the process alive on its own from here.
+      return null;
+    }
+
+    default:
+      console.error(`\n  Unknown command: ${command}\n`);
+      help();
+      return 1;
+  }
+}
+
+/** Entry point for bin/levix.js and for the packaged executable. */
+export async function run(argv = process.argv) {
+  const code = await main(argv);
+  // `null` means "the bot is running now" — exiting would kill it.
+  if (code !== null) process.exit(code);
+}
+
+export default run;

package/src/commands/autoschedule.cjs

@@ -0,0 +1,84 @@
+const {
+  scheduleNewJob,
+  saveScheduledJob,
+} = require("../../scheduler.cjs");
+const { v4: uuidv4 } = require("uuid"); // Use UUID for unique IDs
+const { defaultTimezone } = require("../utils/datetime.cjs");
+
+module.exports = {
+  name: "autoschedule",
+  description: "Schedules a recurring message (daily, weekly).",
+  usage: "autoschedule daily <HH:mm> <الرسالة>\nautoschedule weekly <اليوم> <HH:mm> <الرسالة>",
+  chat: "all",
+
+  async execute(sock, msg, args) {
+    const creatorJid = msg.key.participant || msg.key.remoteJid;
+    const targetJid = msg.key.remoteJid;
+
+    const type = args[0]?.toLowerCase();
+    const time = args[1];
+    const message = args.slice(2).join(" ");
+
+    if (!type || !time || !message) {
+      return await sock.sendMessage(creatorJid, {
+        text: "الصيغة غير صحيحة. استخدم:\n`!autoschedule daily HH:mm رسالتك`\n`!autoschedule weekly day HH:mm رسالتك`",
+      });
+    }
+
+    // من غير الفحص ده أي كتابة غلط ("abc:xyz") بتتحوّل لكرون باظ يتخزّن في
+    // الملف، وبعدين كل تشغيل للبوت بيقع وهو بيحاول يجدوله.
+    const timeMatch = /^(\d{1,2}):(\d{2})$/.exec(String(time).trim());
+    const hour = timeMatch && Number(timeMatch[1]);
+    const minute = timeMatch && Number(timeMatch[2]);
+
+    if (!timeMatch || hour > 23 || minute > 59) {
+      return await sock.sendMessage(creatorJid, {
+        text: "الوقت غير صالح. استخدم صيغة `HH:mm` (مثال: `09:30`).",
+      });
+    }
+
+    let cronString = "";
+
+    if (type === "daily") {
+      cronString = `${minute} ${hour} * * *`;
+    } else if (type === "weekly") {
+      // This part can be enhanced later to support specific days like 'monday'
+      // For now, let's keep it simple. Example: !autoschedule weekly 1 10:30 "..." for Monday 10:30
+      const dayOfWeek = args[1];
+      const weeklyTime = args[2];
+      const weeklyMessage = args.slice(3).join(" ");
+      // ... logic to build weekly cron string ...
+      return await sock.sendMessage(creatorJid, {
+        text: "جدولة أسبوعية قيد التطوير.",
+      });
+    } else {
+      return await sock.sendMessage(creatorJid, {
+        text: "النوع غير مدعوم. استخدم: `daily`",
+      });
+    }
+
+    const newJob = {
+      id: uuidv4(),
+      type: "recurring",
+      cronString: cronString,
+      message: message,
+      targetJid: targetJid,
+      creatorJid: creatorJid,
+      status: "active",
+    };
+
+    // الجدولة الأول: جوب مش قادرين نجدوله ما يتخزّنش في الملف أصلاً.
+    if (!scheduleNewJob(sock, newJob)) {
+      return await sock.sendMessage(creatorJid, {
+        text: "معرفتش أجدول الرسالة دي. راجع الوقت وجرب تاني.",
+      });
+    }
+
+    saveScheduledJob(newJob);
+
+    await sock.sendMessage(creatorJid, {
+      text: `✅ تم جدولة رسالة يومية بنجاح في الساعة ${time} (${defaultTimezone()})`,
+    });
+  },
+};
+// Note: You need to run `npm install uuid` for this command.

package/src/commands/blacklist.cjs

@@ -0,0 +1,116 @@
+// file: /commands/blacklist.js (Corrected Logic)
+const { getGroupSettings, saveGroupSettings } = require("../utils/storage.cjs");
+const logger = require("../utils/logger.cjs");
+const normalizeJid = require("../utils/normalizeJid.esm.js").default;
+
+module.exports = {
+  name: "blacklist",
+  aliases: ["unblacklist", "block", "unblock"], // We keep aliases here for a reason
+  description: "Manages the group's user blacklist.",
+  usage: "blacklist [add|remove|list] [@عضو|رقم]",
+  chat: "group",
+  userAdminRequired: true,
+
+  async execute(sock, msg, args, body, groupMetadata) {
+    const groupId = msg.key.remoteJid;
+    const command = body.slice(1).trim().split(/ +/)[0].toLowerCase();
+
+    // --- New, smarter action parser ---
+    let action;
+    // Explicit sub-command like !blacklist list
+    if (args[0] && ["add", "remove", "list"].includes(args[0].toLowerCase())) {
+      action = args[0].toLowerCase();
+      args.shift(); // Remove the action from args, so the rest are the target
+    }
+    // Action inferred from alias like !block or !unblock
+    else if (["blacklist", "block"].includes(command)) {
+      action = "add";
+    } else if (["unblacklist", "unblock"].includes(command)) {
+      action = "remove";
+    } else {
+      action = "list"; // Default action is to list
+    }
+
+    try {
+      const settings = getGroupSettings(groupId);
+      if (!settings.blacklist) settings.blacklist = [];
+
+      // For list action, no target is needed
+      if (action === "list") {
+        if (settings.blacklist.length === 0)
+          return await sock.sendMessage(groupId, {
+            text: "القائمة السوداء فارغة حاليًا.",
+          });
+
+        let listReply = "*🚫 قائمة المستخدمين المحظورين من البوت:*\n\n";
+        settings.blacklist.forEach((jid) => {
+          listReply += `» @${jid.split("@")[0]}\n`;
+        });
+        return await sock.sendMessage(groupId, {
+          text: listReply,
+          mentions: settings.blacklist,
+        });
+      }
+
+      // For add/remove actions, a target is required
+      const targetJid =
+        msg.message?.extendedTextMessage?.contextInfo?.mentionedJid?.[0] ||
+        (args[0] ? `${args[0].replace(/\D/g, "")}@s.whatsapp.net` : null);
+
+      if (!targetJid)
+        return await sock.sendMessage(groupId, {
+          text: `لتنفيذ هذا الإجراء، قم بعمل منشن للعضو أو كتابة رقمه.`,
+        });
+
+      const normalizedTargetJid = normalizeJid(targetJid);
+
+      if (action === "add") {
+        const targetUser = groupMetadata.participants.find(
+          (p) => p.id === normalizedTargetJid
+        );
+        if (targetUser?.admin)
+          return await sock.sendMessage(groupId, {
+            text: "لا يمكن حظر المشرفين.",
+          });
+        if (settings.blacklist.includes(normalizedTargetJid))
+          return await sock.sendMessage(groupId, {
+            text: `العضو @${normalizedTargetJid.split("@")[0]} محظور بالفعل.`,
+            mentions: [normalizedTargetJid],
+          });
+
+        settings.blacklist.push(normalizedTargetJid);
+        await sock.sendMessage(groupId, {
+          text: `🚫 تم إضافة @${
+            normalizedTargetJid.split("@")[0]
+          } إلى القائمة السوداء بنجاح.`,
+          mentions: [normalizedTargetJid],
+        });
+      } else if (action === "remove") {
+        if (!settings.blacklist.includes(normalizedTargetJid))
+          return await sock.sendMessage(groupId, {
+            text: `العضو @${
+              normalizedTargetJid.split("@")[0]
+            } ليس في القائمة السوداء أصلاً.`,
+            mentions: [normalizedTargetJid],
+          });
+
+        settings.blacklist = settings.blacklist.filter(
+          (jid) => jid !== normalizedTargetJid
+        );
+        await sock.sendMessage(groupId, {
+          text: `✅ تم إزالة @${
+            normalizedTargetJid.split("@")[0]
+          } من القائمة السوداء.`,
+          mentions: [normalizedTargetJid],
+        });
+      }
+
+      saveGroupSettings(groupId, settings);
+    } catch (error) {
+      logger.error(
+        { err: error, command: "blacklist" },
+        "Error in !blacklist command"
+      );
+    }
+  },
+};

package/src/commands/block.cjs

@@ -0,0 +1,70 @@
+// file: /commands/block.js (Upgraded with private chat context)
+const logger = require("../utils/logger.cjs");
+const { isOwnerJidSync } = require("../utils/permissions.cjs");
+const normalizeJid = require("../utils/normalizeJid.esm.js");
+
+module.exports = {
+  name: "block",
+  description: "Blocks a user from contacting the bot on WhatsApp.",
+  usage: "block [@عضو|رقم]   (أو رد على رسالته)",
+  chat: "all",
+
+  async execute(sock, msg, args) {
+    const remoteJid = msg.key.remoteJid;
+    const isGroup = remoteJid.endsWith("@g.us");
+    let targetJid;
+
+    // --- NEW: Smart Target Identification ---
+    // Case 1: The command is '!block' with no arguments in a private chat
+    if (!isGroup && args.length === 0) {
+      targetJid = remoteJid;
+    }
+    // Case 2: A target is specified (mention, reply, or number)
+    else {
+      const mentionedJid =
+        msg.message?.extendedTextMessage?.contextInfo?.mentionedJid?.[0];
+      const repliedToJid =
+        msg.message?.extendedTextMessage?.contextInfo?.participant;
+      const numberArg = args[0];
+
+      if (mentionedJid) {
+        targetJid = mentionedJid;
+      } else if (repliedToJid) {
+        targetJid = repliedToJid;
+      } else if (numberArg) {
+        targetJid = `${numberArg.replace(/\D/g, "")}@s.whatsapp.net`;
+      } else {
+        return await sock.sendMessage(remoteJid, {
+          text: "لكي يعمل هذا الأمر، استخدمه في شات خاص بدون وسائط، أو قم بعمل منشن/رد/كتابة رقم المستخدم.",
+        });
+      }
+    }
+
+    const normalizedTargetJid = normalizeJid(targetJid);
+
+    // Safety Check
+    if (isOwnerJidSync(normalizedTargetJid)) {
+      return await sock.sendMessage(remoteJid, {
+        text: "لا يمكنك حظر مالك البوت.",
+      });
+    }
+
+    try {
+      // ✅ --- THE FIX IS HERE ---
+      await sock.updateBlockStatus(normalizedTargetJid, "block");
+
+      // const successMsg = `🚫 تم حظر @${
+      //   normalizedTargetJid.split("@")[0]
+      // } بنجاح.`;
+      // await sock.sendMessage(remoteJid, {
+      //   text: successMsg,
+      //   mentions: [normalizedTargetJid],
+      // });
+    } catch (error) {
+      logger.error({ err: error, command: "block" }, "Error in !block command");
+      await sock.sendMessage(remoteJid, {
+        text: "حدث خطأ أثناء محاولة حظر المستخدم.",
+      });
+    }
+  },
+};