levix-bot 3.3.0-rc.2 → 4.0.0-beta

package/src/domain/command.js

@@ -7,13 +7,12 @@
 //
 // The bot itself never needs root. This command may, and says so when it does.
 
-import readline from "node:readline/promises";
 import { createRequire } from "node:module";
-
-import { createSystem } from "./system.js";
-import { inspect, classify, checkDns } from "./detect.js";
-import * as nginx from "./nginx.js";
+import readline from "node:readline/promises";
 import * as caddy from "./caddy.js";
+import { checkDns, classify, inspect } from "./detect.js";
+import * as nginx from "./nginx.js";
+import { createSystem } from "./system.js";
 
 const require = createRequire(import.meta.url);
 const settings = require("../config/settings.cjs");
@@ -29,15 +28,15 @@ const DOMAIN_PATTERN = /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-)
 
 /** Short, reliable guidance per panel. No panel APIs — just where to click. */
 const PANEL_HINTS = {
-  "CloudPanel": 'Sites → Add Site → Reverse Proxy, then "SSL/TLS → Let\'s Encrypt".',
-  "Plesk": "Domains → Hosting & DNS → Apache & nginx Settings → additional nginx directives.",
+  CloudPanel: 'Sites → Add Site → Reverse Proxy, then "SSL/TLS → Let\'s Encrypt".',
+  Plesk: "Domains → Hosting & DNS → Apache & nginx Settings → additional nginx directives.",
   "cPanel / WHM": "WHM → Apache → Reverse Proxy (or ProxyPass in an include file).",
-  "CyberPanel": "Websites → Manage → vHost Conf, then Issue SSL.",
-  "aaPanel": "Website → Settings → Reverse proxy, then Let's Encrypt under SSL.",
-  "HestiaCP": "Web → Edit domain → Proxy Template, then enable Let's Encrypt.",
-  "ISPConfig": "Sites → Options → nginx Directives.",
-  "Coolify": "Add a service pointing at the host port, and let Coolify terminate TLS.",
-  "Dokploy": "Create an application/domain entry pointing at the host port.",
+  CyberPanel: "Websites → Manage → vHost Conf, then Issue SSL.",
+  aaPanel: "Website → Settings → Reverse proxy, then Let's Encrypt under SSL.",
+  HestiaCP: "Web → Edit domain → Proxy Template, then enable Let's Encrypt.",
+  ISPConfig: "Sites → Options → nginx Directives.",
+  Coolify: "Add a service pointing at the host port, and let Coolify terminate TLS.",
+  Dokploy: "Create an application/domain entry pointing at the host port.",
   "Virtualmin / Webmin": "Services → Configure Website → Edit Directives.",
 };
 
@@ -108,7 +107,11 @@ export async function runDomainCommand({ domain = null, assumeYes = false, syste
     cross("No domain given. Try: levix domain bot.example.com");
     return 1;
   }
-  name = name.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+  name = name
+    .trim()
+    .toLowerCase()
+    .replace(/^https?:\/\//, "")
+    .replace(/\/.*$/, "");
 
   if (!DOMAIN_PATTERN.test(name)) {
     cross(`"${name}" doesn't look like a domain name.`);
@@ -189,7 +192,9 @@ function printFindings(report) {
   line(`  Found: ${found.length ? found.join(", ") : "no web server"}`);
   for (const port of [80, 443]) {
     const state = report.ports[port];
-    line(`  Port ${port}: ${state.taken ? `in use by ${state.process || "an unknown process"}` : "free"}`);
+    line(
+      `  Port ${port}: ${state.taken ? `in use by ${state.process || "an unknown process"}` : "free"}`,
+    );
   }
   line();
 }
@@ -223,7 +228,7 @@ async function confirmDns(sys, name, { assumeYes }) {
   cross(
     dnsCheck.status === "unresolved"
       ? `${name} does not resolve yet.`
-      : `${name} resolves to ${dnsCheck.resolved.v4.join(", ") || dnsCheck.resolved.v6.join(", ")}, not to this server.`
+      : `${name} resolves to ${dnsCheck.resolved.v4.join(", ") || dnsCheck.resolved.v6.join(", ")}, not to this server.`,
   );
   line();
   line("  Add this DNS record:");
@@ -264,7 +269,12 @@ async function configureNginx(sys, { name, port, report, assumeYes }) {
   if (!applied.ok) {
     cross("nginx rejected the configuration — nothing was reloaded.");
     line();
-    line(applied.error.split("\n").map((l) => `    ${l}`).join("\n"));
+    line(
+      applied.error
+        .split("\n")
+        .map((l) => `    ${l}`)
+        .join("\n"),
+    );
     line();
     line("  The previous state has been restored.");
     return 1;
@@ -284,7 +294,13 @@ async function configureNginx(sys, { name, port, report, assumeYes }) {
       } else {
         cross("certbot failed — the site is up over HTTP.");
         line();
-        line(cert.error.split("\n").slice(0, 8).map((l) => `    ${l}`).join("\n"));
+        line(
+          cert.error
+            .split("\n")
+            .slice(0, 8)
+            .map((l) => `    ${l}`)
+            .join("\n"),
+        );
         line();
       }
     }
@@ -348,7 +364,12 @@ async function configureCaddy(sys, { name, port, report, assumeYes, install }) {
   if (!applied.ok) {
     cross("Caddy rejected the configuration — nothing was reloaded.");
     line();
-    line(applied.error.split("\n").map((l) => `    ${l}`).join("\n"));
+    line(
+      applied.error
+        .split("\n")
+        .map((l) => `    ${l}`)
+        .join("\n"),
+    );
     line();
     return 1;
   }

package/src/domain/detect.js

@@ -170,4 +170,4 @@ export async function checkDns(system, domain) {
   return { status: matches ? "ok" : "elsewhere", resolved, mine };
 }
 
-export { PANELS, KNOWN_WEB_SERVERS };
+export { KNOWN_WEB_SERVERS, PANELS };

package/src/domain/system.js

@@ -11,8 +11,8 @@
 // The default implementation is the real one. Tests pass their own.
 
 import { spawnSync } from "node:child_process";
-import fs from "node:fs";
 import dns from "node:dns/promises";
+import fs from "node:fs";
 
 /**
  * @typedef {object} System
@@ -135,10 +135,7 @@ export function parseListeners(output) {
     if (!Number.isFinite(port)) continue;
 
     // users:(("nginx",pid=123,fd=6))  |  123/nginx: master
-    const owner =
-      /users:\(\("([^"]+)"/.exec(line)?.[1] ||
-      /\d+\/([\w.-]+)/.exec(line)?.[1] ||
-      null;
+    const owner = /users:\(\("([^"]+)"/.exec(line)?.[1] || /\d+\/([\w.-]+)/.exec(line)?.[1] || null;
 
     found.push({ port, process: owner });
   }

package/src/handlers/command.handler.js

@@ -1,11 +1,8 @@
 import { readdirSync } from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
 import { createRequire } from "module";
-import {
-  checkCommandPermission,
-  checkBotAdmin,
-} from "../middleware/permissions.middleware.js";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { checkBotAdmin, checkCommandPermission } from "../middleware/permissions.middleware.js";
 import { sendBotMessage } from "../utils/sendBotMessage.esm.js";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -65,7 +62,7 @@ function wrapSockWithReply(sock, originalMsg, editInPlace = false) {
   return new Proxy(sock, {
     get(target, prop, receiver) {
       if (prop === "sendMessage") {
-        return async function (jid, content, options) {
+        return async (jid, content, options) => {
           // Try to edit the trigger message in place for the first eligible
           // text reply. We can only edit messages we sent ourselves.
           const eligibleForEdit =
@@ -109,16 +106,13 @@ function wrapSockWithReply(sock, originalMsg, editInPlace = false) {
  * override when there is one, otherwise what the command file declared.
  */
 function indexAliases(command) {
-  const aliases = runtimeConfig.getAliases(
-    command.name,
-    command.__declaredAliases || []
-  );
+  const aliases = runtimeConfig.getAliases(command.name, command.__declaredAliases || []);
 
   for (const alias of aliases) {
     const existing = commands.get(alias);
     if (existing && existing.name !== command.name) {
       logger.warn(
-        `[Commands] Alias conflict: ${alias} already maps to ${existing.name}, ignoring for ${command.name}`
+        `[Commands] Alias conflict: ${alias} already maps to ${existing.name}, ignoring for ${command.name}`,
       );
       continue;
     }
@@ -141,9 +135,7 @@ export function rebuildCommandIndex() {
   for (const command of commandList.values()) {
     indexAliases(command);
   }
-  logger.info(
-    `[Commands] Index rebuilt: ${commandList.size} commands, ${commands.size} entries`
-  );
+  logger.info(`[Commands] Index rebuilt: ${commandList.size} commands, ${commands.size} entries`);
 }
 
 /**
@@ -201,9 +193,7 @@ export async function loadCommands() {
       if (entry.isDirectory()) {
         // Load commands from subdirectories (e.g., group/)
         const subDirPath = join(commandsPath, entry.name);
-        const subFiles = readdirSync(subDirPath).filter((file) =>
-          file.endsWith(".cjs")
-        );
+        const subFiles = readdirSync(subDirPath).filter((file) => file.endsWith(".cjs"));
 
         for (const file of subFiles) {
           registerCommandFile(join(subDirPath, file), entry.name);
@@ -215,7 +205,7 @@ export async function loadCommands() {
   }
 
   logger.info(
-    `[Commands] Loaded ${commandList.size} commands (${commands.size} entries with aliases)`
+    `[Commands] Loaded ${commandList.size} commands (${commands.size} entries with aliases)`,
   );
 }
 
@@ -252,13 +242,11 @@ function registerCommand(command, label, category) {
     command.__category = category || "general";
     // What the FILE declares, kept aside so a dashboard override can be
     // cleared back to it later (command.aliases itself is what we index).
-    command.__declaredAliases = Array.isArray(command.aliases)
-      ? [...command.aliases]
-      : [];
+    command.__declaredAliases = Array.isArray(command.aliases) ? [...command.aliases] : [];
     commands.set(command.name, command);
     commandList.set(command.name, command);
     logger.info(
-      `[Commands] Loaded command: ${command.name}${category ? ` (from ${category}/)` : ""}`
+      `[Commands] Loaded command: ${command.name}${category ? ` (from ${category}/)` : ""}`,
     );
 
     indexAliases(command);
@@ -295,7 +283,7 @@ export async function handleCommand(sock, msg, body) {
       sock,
       msg.key.remoteJid,
       { text: "⛔ الأمر ده متوقف حاليًا." },
-      { replyTo: msg }
+      { replyTo: msg },
     );
     return true;
   }
@@ -314,7 +302,7 @@ export async function handleCommand(sock, msg, body) {
           sock,
           msg.key.remoteJid,
           { text: "⚠️ هذا الأمر يعمل في المجموعات فقط." },
-          { replyTo: msg }
+          { replyTo: msg },
         );
         return true;
       }
@@ -323,7 +311,7 @@ export async function handleCommand(sock, msg, body) {
           sock,
           msg.key.remoteJid,
           { text: "⚠️ هذا الأمر يعمل في المحادثات الخاصة فقط." },
-          { replyTo: msg }
+          { replyTo: msg },
         );
         return true;
       }
@@ -331,22 +319,16 @@ export async function handleCommand(sock, msg, body) {
       // Group sub-commands are keyed "group:<name>" everywhere — defaults.cjs,
       // the dashboard, and `!group kick`. Use the same key here so running
       // `!kick` directly is gated exactly like running `!group kick`.
-      const permissionKey =
-        command.__category === "group" ? `group:${command.name}` : command.name;
-
-      const permissionCheck = checkCommandPermission(
-        permissionKey,
-        msg,
-        groupMetadata,
-        sock
-      );
+      const permissionKey = command.__category === "group" ? `group:${command.name}` : command.name;
+
+      const permissionCheck = checkCommandPermission(permissionKey, msg, groupMetadata, sock);
 
       if (!permissionCheck.hasPermission) {
         await sendBotMessage(
           sock,
           msg.key.remoteJid,
           { text: permissionCheck.reason },
-          { replyTo: msg }
+          { replyTo: msg },
         );
         return true;
       }
@@ -356,7 +338,7 @@ export async function handleCommand(sock, msg, body) {
           sock,
           msg.key.remoteJid,
           { text: "⚠️ هذا الأمر يتطلب أن تكون مشرفًا." },
-          { replyTo: msg }
+          { replyTo: msg },
         );
         return true;
       }
@@ -366,7 +348,7 @@ export async function handleCommand(sock, msg, body) {
           sock,
           msg.key.remoteJid,
           { text: "⚠️ يجب أن أكون مشرفًا لتنفيذ هذا الأمر." },
-          { replyTo: msg }
+          { replyTo: msg },
         );
         return true;
       }
@@ -392,10 +374,7 @@ export async function handleCommand(sock, msg, body) {
     await command.execute(proxiedSock, msg, args, body, groupMetadata, ctx);
     return true;
   } catch (error) {
-    logger.error(
-      { err: error, command: invokedName },
-      "Error executing command"
-    );
+    logger.error({ err: error, command: invokedName }, "Error executing command");
     // Surface the error name to the user instead of silently re-throwing.
     try {
       await sendBotMessage(
@@ -406,7 +385,7 @@ export async function handleCommand(sock, msg, body) {
             error.message || "غير معروف"
           }`,
         },
-        { replyTo: msg }
+        { replyTo: msg },
       );
     } catch {}
     throw error;

package/src/handlers/group.handler.js

@@ -1,16 +1,16 @@
-import { createRequire } from 'module';
-import { delay } from '@whiskeysockets/baileys';
-import { getGroupSettings } from '../utils/storage.esm.js';
+import { delay } from "@whiskeysockets/baileys";
+import { createRequire } from "module";
+import { getGroupSettings } from "../utils/storage.esm.js";
 
 const require = createRequire(import.meta.url);
-const logger = require('../utils/logger.cjs');
+const logger = require("../utils/logger.cjs");
 
 // Handle group participant updates (join/leave)
 export async function handleGroupParticipantsUpdate(sock, update) {
   const { id, participants, action } = update;
-  logger.info({ update }, 'Received group participants update');
+  logger.info({ update }, "Received group participants update");
 
-  if (action !== 'add') {
+  if (action !== "add") {
     logger.info(`[Group] ${action} action for ${id}`);
     return;
   }
@@ -29,7 +29,7 @@ export async function handleGroupParticipantsUpdate(sock, update) {
       const randomIndex = Math.floor(Math.random() * welcomeConfig.messages.length);
       const welcomeMessage = welcomeConfig.messages[randomIndex];
 
-      const finalMessage = welcomeMessage.replace(/\${user}/g, `@${participant.split('@')[0]}`);
+      const finalMessage = welcomeMessage.replace(/\${user}/g, `@${participant.split("@")[0]}`);
 
       await delay(1000);
       await sock.sendMessage(id, {
@@ -38,16 +38,16 @@ export async function handleGroupParticipantsUpdate(sock, update) {
       });
     }
   } catch (error) {
-    logger.error({ err: error, update }, 'Error in group-participants.update event');
+    logger.error({ err: error, update }, "Error in group-participants.update event");
   }
 }
 
 // Handle group join requests
 export async function handleGroupJoinRequests(sock, events) {
-  logger.info({ events }, 'Received group join request update');
+  logger.info({ events }, "Received group join request update");
 
   for (const request of events) {
-    if (request.type !== 'request') continue;
+    if (request.type !== "request") continue;
 
     const groupId = request.jid;
     const participantId = request.from;
@@ -58,16 +58,16 @@ export async function handleGroupJoinRequests(sock, events) {
       if (settings?.join_requests?.auto_approve_enabled) {
         logger.info(`[Auto-Approve] Approving ${participantId} for group ${groupId}`);
 
-        await sock.groupRequestUpdate(groupId, participantId, 'approve');
+        await sock.groupRequestUpdate(groupId, participantId, "approve");
 
         await delay(500);
         await sock.sendMessage(groupId, {
-          text: `✅ تم قبول طلب انضمام @${participantId.split('@')[0]} تلقائيًا.`,
+          text: `✅ تم قبول طلب انضمام @${participantId.split("@")[0]} تلقائيًا.`,
           mentions: [participantId],
         });
       }
     } catch (error) {
-      logger.error({ err: error, request }, 'Error in auto-approve event');
+      logger.error({ err: error, request }, "Error in auto-approve event");
     }
   }
 }

package/src/handlers/message.handler.js

@@ -1,14 +1,15 @@
 import { createRequire } from "module";
-import { handleCommand } from "./command.handler.js";
 import { handleAntiSpam } from "../middleware/antispam.middleware.js";
 import { checkBlacklist } from "../middleware/blacklist.middleware.js";
 import { trackForwardedMessage } from "../middleware/forward-tracking.middleware.js";
-import { updateUserLastSeen, saveUserMetadata } from "../utils/storage.esm.js";
-import { rememberMessage } from "../utils/recentMessageCache.esm.js";
 import normalizeJid from "../utils/normalizeJid.esm.js";
+import { rememberMessage } from "../utils/recentMessageCache.esm.js";
+import { saveUserMetadata, updateUserLastSeen } from "../utils/storage.esm.js";
+import { handleCommand } from "./command.handler.js";
 
 const require = createRequire(import.meta.url);
 const logger = require("../utils/logger.cjs");
+const { visibleText } = require("../utils/messageContent.cjs");
 
 // Envelopes that carry no user-visible content: message revokes and edits
 // (protocolMessage), reactions, poll votes, the undecrypted edit envelope, and
@@ -74,22 +75,12 @@ export async function handleIncomingMessage(sock, m) {
   // Parse message context. Crucially we ALSO consider media captions —
   // otherwise sending an image with caption "!gemini حلل ده" is invisible
   // to the command handler and the user sees nothing happen.
-  const body =
-    msg.message?.conversation ||
-    msg.message?.extendedTextMessage?.text ||
-    msg.message?.imageMessage?.caption ||
-    msg.message?.videoMessage?.caption ||
-    msg.message?.documentMessage?.caption ||
-    "";
+  const body = visibleText(msg.message);
   const isGroup = msg.key.remoteJid.endsWith("@g.us");
 
   // Update user metadata (last seen)
   const senderId = normalizeJid(msg.key.participant || msg.key.remoteJid);
-  if (
-    senderId &&
-    !senderId.includes("@broadcast") &&
-    !senderId.includes("@newsletter")
-  ) {
+  if (senderId && !senderId.includes("@broadcast") && !senderId.includes("@newsletter")) {
     try {
       saveUserMetadata({
         jid: senderId,
@@ -130,16 +121,15 @@ async function handleGroupModeration(sock, msg) {
   try {
     const { handleAntiLink } = require("../commands/group/antilink.cjs");
     const { handleMediaControl } = require("../commands/group/media.cjs");
+    const { handleForbiddenWords } = require("../commands/mod.cjs");
+
+    const wordActionTaken = await handleForbiddenWords(sock, msg);
+    if (wordActionTaken) return;
 
     const linkActionTaken = await handleAntiLink(sock, msg, {}, normalizeJid);
     if (linkActionTaken) return;
 
-    const mediaActionTaken = await handleMediaControl(
-      sock,
-      msg,
-      {},
-      normalizeJid
-    );
+    const mediaActionTaken = await handleMediaControl(sock, msg, {}, normalizeJid);
     if (mediaActionTaken) return;
 
     await handleAntiSpam(sock, msg);

package/src/index.js

@@ -16,8 +16,8 @@
 import os from "node:os";
 import { createRequire } from "module";
 import { bootstrapCore } from "./bootstrap/core.js";
-import { flushStore } from "./db/store.esm.js";
 import brand from "./config/brand.esm.js";
+import { flushStore } from "./db/store.esm.js";
 
 const require = createRequire(import.meta.url);
 const qrcodeTerminal = require("qrcode-terminal");
@@ -141,7 +141,9 @@ async function startHeadless() {
         line("  ✓ WhatsApp connected");
         break;
       case "reconnecting":
-        line(`  … WhatsApp disconnected, reconnecting (attempt ${payload.attempt}/${payload.maxAttempts})`);
+        line(
+          `  … WhatsApp disconnected, reconnecting (attempt ${payload.attempt}/${payload.maxAttempts})`,
+        );
         break;
       case "logged_out":
       case "retry_exhausted":
@@ -245,7 +247,7 @@ async function startWithPanel({ open }) {
     line(
       opened
         ? `  Opening ${brand.name} in your browser...`
-        : `  Open that link yourself (${reason}).`
+        : `  Open that link yourself (${reason}).`,
     );
   }
 
@@ -337,7 +339,9 @@ function installShutdownHandlers() {
     else await finish();
   };
 
-  ["SIGTERM", "SIGINT"].forEach((signal) => process.on(signal, () => shutdown(signal)));
+  ["SIGTERM", "SIGINT"].forEach((signal) => {
+    process.on(signal, () => shutdown(signal));
+  });
 }
 
 export default start;

package/src/middleware/antispam.middleware.js

@@ -1,22 +1,38 @@
-import { createRequire } from 'module';
-import { getGroupSettings } from '../utils/storage.esm.js';
-import normalizeJid from '../utils/normalizeJid.esm.js';
+import { createRequire } from "module";
 import {
-  isOwnerJid,
+  getSenderCandidates,
   isAdminInGroup,
-} from '../utils/permissions.esm.js';
+  isBotAdminUser,
+  isOwnerJid,
+  sameUser,
+} from "../utils/permissions.esm.js";
+import { getGroupSettings, getPnForLid } from "../utils/storage.esm.js";
 
 const require = createRequire(import.meta.url);
-const logger = require('../utils/logger.cjs');
+const logger = require("../utils/logger.cjs");
 
 const userMessageTimestamps = new Map();
 
+function stableSenderId(candidates) {
+  const phoneJid = candidates.find((jid) => jid.endsWith("@s.whatsapp.net"));
+  if (phoneJid) return phoneJid;
+  for (const candidate of candidates) {
+    try {
+      const mapped = getPnForLid(candidate);
+      if (mapped) return mapped;
+    } catch {}
+  }
+  return candidates[0] || null;
+}
+
 // Handle anti-spam detection and action
 export async function handleAntiSpam(sock, msg) {
   const groupId = msg.key.remoteJid;
-  if (!groupId.endsWith('@g.us')) return;
+  if (!groupId.endsWith("@g.us")) return;
 
-  const senderId = normalizeJid(msg.key.participant);
+  const senderCandidates = getSenderCandidates(msg, sock);
+  const senderId = senderCandidates[0];
+  if (!senderId) return;
   const settings = getGroupSettings(groupId);
   const spamConfig = settings?.antispam;
 
@@ -25,44 +41,51 @@ export async function handleAntiSpam(sock, msg) {
   // Owners and admins are immune. The legacy owner mirror it used to import was
   // only ever populated with the bot's own JID, so real operators were
   // counted as spammers — the centralized check fixes that.
-  const isOwner = isOwnerJid(senderId);
   const groupMetadata = await sock.groupMetadata(groupId);
-  const isSenderAdmin = isAdminInGroup(groupMetadata, senderId);
+  const protectedSender = senderCandidates.some(
+    (candidate) =>
+      isOwnerJid(candidate) ||
+      isBotAdminUser(candidate) ||
+      isAdminInGroup(groupMetadata, candidate) ||
+      [sock.user?.id, sock.user?.lid].filter(Boolean).some((botId) => sameUser(candidate, botId)),
+  );
 
-  if (isOwner || isSenderAdmin) return;
+  if (protectedSender) return;
 
   // Track message timestamps
   const now = Date.now();
-  if (!userMessageTimestamps.has(senderId)) {
-    userMessageTimestamps.set(senderId, []);
+  const timeWindow = (spamConfig.time_window || 10) * 1000;
+  for (const [key, entry] of userMessageTimestamps) {
+    if (now - entry.lastSeen > timeWindow) userMessageTimestamps.delete(key);
   }
-
-  const userTimestamps = userMessageTimestamps.get(senderId);
+  const identity = stableSenderId(senderCandidates);
+  const bucketKey = `${groupId}::${identity}`;
+  const bucket = userMessageTimestamps.get(bucketKey) || { timestamps: [], lastSeen: now };
+  const userTimestamps = bucket.timestamps;
   userTimestamps.push(now);
 
   // Filter timestamps within time window
-  const timeWindow = (spamConfig.time_window || 10) * 1000;
   const recentTimestamps = userTimestamps.filter((ts) => now - ts < timeWindow);
-  userMessageTimestamps.set(senderId, recentTimestamps);
+  userMessageTimestamps.set(bucketKey, { timestamps: recentTimestamps, lastSeen: now });
 
   // Check if user exceeded message count
   if (recentTimestamps.length > (spamConfig.message_count || 5)) {
-    logger.warn({ user: senderId, group: groupId }, 'Spam detected, taking action.');
+    logger.warn({ user: senderId, group: groupId }, "Spam detected, taking action.");
 
     // Take action based on config
-    if (spamConfig.action === 'KICK') {
+    if (spamConfig.action === "KICK") {
       await sock.sendMessage(groupId, {
-        text: `🚫 تم حذف @${senderId.split('@')[0]} بسبب الإزعاج (Spam).`,
+        text: `🚫 تم حذف @${senderId.split("@")[0]} بسبب الإزعاج (Spam).`,
         mentions: [senderId],
       });
-      await sock.groupParticipantsUpdate(groupId, [senderId], 'remove');
+      await sock.groupParticipantsUpdate(groupId, [senderId], "remove");
     } else {
       await sock.sendMessage(groupId, {
-        text: `⚠️ تحذير لـ @${senderId.split('@')[0]}! الرجاء عدم إرسال رسائل مزعجة.`,
+        text: `⚠️ تحذير لـ @${senderId.split("@")[0]}! الرجاء عدم إرسال رسائل مزعجة.`,
         mentions: [senderId],
       });
     }
 
-    userMessageTimestamps.delete(senderId);
+    userMessageTimestamps.delete(bucketKey);
   }
 }

package/src/middleware/blacklist.middleware.js

@@ -1,22 +1,27 @@
-import { createRequire } from 'module';
-import { getGroupSettings } from '../utils/storage.esm.js';
-import normalizeJid from '../utils/normalizeJid.esm.js';
+import { createRequire } from "module";
+import { getSenderCandidates, isAdminInGroup, sameUser } from "../utils/permissions.esm.js";
+import { getGroupSettings } from "../utils/storage.esm.js";
 
 const require = createRequire(import.meta.url);
-const logger = require('../utils/logger.cjs');
+const logger = require("../utils/logger.cjs");
 
 // Check if user is blacklisted in the group
 export async function checkBlacklist(sock, msg) {
   const groupId = msg.key.remoteJid;
-  if (!groupId.endsWith('@g.us')) return false;
+  if (!groupId.endsWith("@g.us")) return false;
 
-  const senderId = normalizeJid(msg.key.participant || msg.key.remoteJid);
+  const senderCandidates = getSenderCandidates(msg, sock);
+  const senderId = senderCandidates[0];
+  if (!senderId) return false;
   const settings = getGroupSettings(groupId);
+  const listed = (settings?.blacklist || []).some((entry) =>
+    senderCandidates.some((candidate) => sameUser(entry, candidate)),
+  );
 
-  if (settings?.blacklist?.includes(senderId)) {
+  if (listed) {
     const groupMetadata = await sock.groupMetadata(groupId);
-    const isSenderAdmin = groupMetadata.participants.some(
-      (p) => p.admin && p.id === senderId
+    const isSenderAdmin = senderCandidates.some((candidate) =>
+      isAdminInGroup(groupMetadata, candidate),
     );
 
     if (!isSenderAdmin) {