miaw-core 1.12.0 → 1.12.2

package/dist/utils/proxy-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-agent.d.ts","sourceRoot":"","sources":["../../src/utils/proxy-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,OAAO,EAAE,KAAK,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,KAAK,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAkCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,GAAG,MAAM,GAC3B,OAAO,CAAC,WAAW,CAAC,CAmCtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,CAkBjE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAQzE"}
+{"version":3,"file":"proxy-agent.d.ts","sourceRoot":"","sources":["../../src/utils/proxy-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,OAAO,EAAE,KAAK,CAAC;IACf,sEAAsE;IACtE,UAAU,EAAE,KAAK,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAkCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,GAAG,MAAM,GAC3B,OAAO,CAAC,WAAW,CAAC,CAmCtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,MAAM,CA2BjE;AAoBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAQzE"}

package/dist/utils/proxy-agent.js

@@ -99,13 +99,34 @@ export function maskProxyUrl(config) {
         }
         if (parsed.password) {
             parsed.password = "****";
+            return parsed.toString();
         }
-        return parsed.toString();
+        // Parsed, but with nothing in userinfo - which does not mean there are no
+        // credentials, only that the URL is not shaped the way it reads.
+        // "user:pw@host:8080" with the scheme left off parses as the *scheme*
+        // "user:", stranding the password in the path where nothing masks it, so
+        // this used to return the secret verbatim. A scheme-less form is an easy
+        // mistake to make given that the TXT list format is itself scheme-less.
+        return redactUserinfo(parsed.toString());
     }
     catch {
-        return raw;
+        // Not parseable at all, and it may still carry credentials.
+        return redactUserinfo(raw);
     }
 }
+/**
+ * Last-resort credential redaction for a string `new URL()` could not make
+ * sense of.
+ *
+ * Replaces whatever sits in userinfo position - between an optional scheme
+ * and the "@" that ends it. A string with no "@" has no userinfo by URL
+ * syntax and is returned untouched: there is no password in it to hide, and
+ * mangling it would remove exactly the detail that explains why it was
+ * rejected.
+ */
+function redactUserinfo(raw) {
+    return raw.replace(/^([a-z][a-z0-9+.-]*:\/{0,2})?([^/@]*?:)[^/@]*@/i, (_match, scheme = "", user = "") => `${scheme}${user}****@`);
+}
 /**
  * Validates a proxy configuration.
  * Checks that the URL is parseable and uses a supported protocol.

package/dist/utils/proxy-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-agent.js","sourceRoot":"","sources":["../../src/utils/proxy-agent.ts"],"names":[],"mappings":"AAgCA,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC,CAAC;AAEpE;;;GAGG;AACH,SAAS,aAAa,CAAC,MAA4B;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;IAE5C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,gBAAgB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,IAAI,OAAc,CAAC;IACnB,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAU,OAAO,CAAC;IAElC,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,kBAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,kBAAkB,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU;QACV,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,kBAAkB,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,MAA4B;IACvD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"proxy-agent.js","sourceRoot":"","sources":["../../src/utils/proxy-agent.ts"],"names":[],"mappings":"AAgCA,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC;AACF,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC3C,MAAM,mBAAmB,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC,CAAC;AAEpE;;;GAGG;AACH,SAAS,aAAa,CAAC,MAA4B;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA4B;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;IAE5C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,gBAAgB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,IAAI,OAAc,CAAC;IACnB,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAU,OAAO,CAAC;IAElC,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,kBAA2B,CAAC;IAChC,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,kBAAkB,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,OAAO;QACP,UAAU;QACV,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,kBAAkB,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,MAA4B;IACvD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;YACzB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAED,0EAA0E;QAC1E,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,OAAO,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAChB,iDAAiD,EACjD,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,OAAO,CAC5D,CAAC;AACJ,CAAC;AAGD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/docs/CLI.md

@@ -170,6 +170,10 @@ npx miaw-cli instance status
 npx miaw-cli instance status my-bot
 ```
 
+Like `instance ls`, this accepts an instance that exists only as a proxy pin
+and reports it as `[not created]` — pinning before `instance create` is the
+supported workflow, so you can always ask what you just pinned.
+
 #### Create Instance
 
 ```bash
@@ -955,23 +959,44 @@ npx miaw-cli proxy test-all --proxy-file ./proxies.txt || exit 1
 **Output:**
 
 ```
-🔍 Testing 4 proxies via https://web.whatsapp.com/ (5 at a time) ...
+🔍 Testing 3 proxies via https://web.whatsapp.com/ (5 at a time) ...
 
-┌────────┬──────────────────────────────────┬──────────┬─────────┬──────────────────────┐
-│ Status │ Proxy                            │ Protocol │ Latency │ Detail               │
-├────────┼──────────────────────────────────┼──────────┼─────────┼──────────────────────┤
-│ OK     │ http://eu1.example.com:8080      │ http     │ 188ms   │ HTTP 200             │
-│ OK     │ socks5://us1.example.com:1080    │ socks5   │ 412ms   │ HTTP 200 (dl direct)    │
-│ FAIL   │ http://dead.example.com:8080     │ http     │ -       │ ECONNREFUSED         │
-└────────┴──────────────────────────────────┴──────────┴─────────┴──────────────────────┘
+┌─────────┬──────────────────────────────────┬───────────┬──────────┬──────────────────────────────┐
+│ Status  │ Proxy                            │ Protocol  │ Latency  │ Detail                       │
+├─────────┼──────────────────────────────────┼───────────┼──────────┼──────────────────────────────┤
+│ OK      │ eu1.example.com:8080             │ http      │ 188ms    │ HTTP 200                     │
+│ OK      │ us1.example.com:1080             │ socks5    │ 412ms    │ HTTP 200 (dl direct)         │
+│ FAIL    │ dead.example.com:8080            │ http      │ -        │ ECONNREFUSED                 │
+└─────────┴──────────────────────────────────┴───────────┴──────────┴──────────────────────────────┘
 
 ⚠️  2/3 proxies reachable (median 300ms)
 ```
 
+With `--ip`, an Exit IP column is added — the column is only rendered when you
+ask for it, since each entry costs an extra request to the echo service:
+
+```bash
+npx miaw-cli proxy test-all --proxy-file ./proxies.txt --ip
+```
+
+```
+┌─────────┬─────────────────────┬───────────┬──────────┬────────────────┬──────────┐
+│ Status  │ Proxy               │ Protocol  │ Latency  │ Exit IP        │ Detail   │
+├─────────┼─────────────────────┼───────────┼──────────┼────────────────┼──────────┤
+│ OK      │ 198.51.100.23:5829  │ http      │ 975ms    │ 198.51.100.23  │ HTTP 200 │
+│ OK      │ 203.0.113.7:7809    │ http      │ 1223ms   │ 203.0.113.7    │ HTTP 200 │
+└─────────┴─────────────────────┴───────────┴──────────┴────────────────┴──────────┘
+```
+
 **Notes:**
 
 - Results are sorted fastest-first with failures last.
 - Exits non-zero if **any** proxy fails.
+- The Proxy column shows `host:port`, not the masked URL. Vendors issue one
+  long username across a whole pool, so the masked URLs are identical on every
+  row; `host:port` is the part that differs, and it carries no credentials.
+  An over-long endpoint keeps its **tail** (`…pool.example.com:19001`) because
+  a per-session port is often the only thing distinguishing two entries.
 
 ### Contact Operations
 

package/docs/DEPLOYMENT_V1.12.0.md

@@ -1,4 +1,4 @@
-# Deploying v1.12.0 (Baileys rc14)
+# Deploying v1.12.x (Baileys rc14)
 
 **Audience:** whoever operates miaw-core deployments.
 
@@ -73,9 +73,9 @@ npm ls @whiskeysockets/baileys
 
 ## 3. Not on the npm registry
 
-At time of writing, the newest miaw-core on npm is **1.10.0**. Both 1.11.0 and
-1.12.0 exist only in git and are **not published**, and the repository carries
-no version tags.
+At time of writing, the newest miaw-core on npm is **1.10.0**. Everything since
+— 1.11.0, 1.12.0 and 1.12.1 — exists only in git and is **not published**, and
+the repository carries no version tags.
 
 This matters if you deploy from the registry: `npm install miaw-core` will give
 you 1.10.0 and none of this. Deploy from git (or publish first). Consumers
@@ -148,11 +148,10 @@ rollback — that is the only thing to check before reverting.
 
 Stated plainly so it is not discovered later:
 
-- The full CLI integration suite was last run **without a live WhatsApp
-  session**, so it confirms test counts, not live behaviour. Fifteen known
-  pre-existing failures are catalogued in [FOLLOW_UPS.md](./FOLLOW_UPS.md) §9;
-  they were proven pre-existing by re-running against rc13 and getting a
-  byte-identical failure set.
+- The full CLI integration suite **has now been run against a live session**
+  (2026-09-02): 13/13 suites, 276 passed, 2 skipped, **0 failed**. The fifteen
+  failures previously catalogued in [FOLLOW_UPS.md](./FOLLOW_UPS.md) §9 were
+  all fixed in v1.12.1.
 - View-once **receipt** under the Android identity is unverified — see §4.
 - Live verification needs a QR pairing. `npm run test:cli` reports all-green
   when disconnected because connection-dependent tests return early; trust the
@@ -160,4 +159,4 @@ Stated plainly so it is not discovered later:
 
 ---
 
-_Last updated: 2026-09-02 (miaw-core v1.12.0, Baileys 7.0.0-rc14)._
+_Last updated: 2026-09-02 (miaw-core v1.12.1, Baileys 7.0.0-rc14)._

package/docs/FOLLOW_UPS.md

@@ -214,9 +214,24 @@ output. Worth a sweep for consistency rather than one-off additions.
 
 ---
 
-## 9. Fifteen pre-existing CLI integration failures, surfaced by the first live run
-
-**Severity:** medium (they are real defects; none is new).
+## 9. Fifteen pre-existing CLI integration failures, surfaced by the first live run — RESOLVED
+
+**Severity:** medium (they were real defects; none was new).
+
+> **Closed 2026-09-02 (v1.12.1).** All fifteen are fixed. A live run now
+> reports **13/13 suites, 276 passed, 2 skipped, 0 failed**, and the suite time
+> fell from 745s to 189s because the catalog commands no longer wait out a 60s
+> query timeout. See CHANGELOG v1.12.1. The analysis below is kept because it
+> explains *why* each one happened, and three of the four causes are patterns
+> worth not repeating:
+>
+> - `--json` was broken on seven commands and nobody noticed, because the
+>   corruption is invisible unless you pipe the output to a parser.
+> - `label list --json` was never broken at all — its failure was console
+>   output from the timing-out catalog tests bleeding into an active capture.
+>   Two of the fifteen were one bug wearing two hats.
+> - The `load messages` tests asserted `true` unconditionally, so they could
+>   not tell "no history" from "broken".
 
 Until 2026-09-02 no session on disk authenticated, so every connection-dependent
 CLI test short-circuited via `if (!isConnected()) return;` and reported as
@@ -318,3 +333,34 @@ socket that can reject; the second needs the dispatch to be exercised. Adding
 mock-backed unit tests for the clusters above would raise the number without
 catching that class of bug. Prefer the CLI integration and manual suites for
 anything whose failure mode is "the real socket says no".
+
+---
+
+## 11. The test account's `.env.test` invalidates ~5 manual-runner results
+
+**Severity:** low (environment, not code — but it makes every run read as
+partly broken).
+
+`TEST_CONTACT_PHONE_A` and `TEST_CONTACT_PHONE_B` are both set to the test
+bot's **own** number. `warnOnDegenerateConfig()` detects this and says so on
+connect, and the live run on 2026-09-02 confirmed exactly the failures it
+predicts:
+
+| Entry | Why it fails |
+|---|---|
+| `checkNumbers()` | WhatsApp deduplicates a batch check of one repeated number |
+| `addParticipants()` | cannot add yourself to a group you are already in |
+| `promoteToAdmin()` / `demoteFromAdmin()` | same participant problem |
+| `blockContact()` | WhatsApp refuses a self-block (`forbidden`) |
+
+Fix by pointing `TEST_CONTACT_PHONE_B` at a second real number. Until then,
+read those five as environment noise rather than defects.
+
+Separately, the account belongs to **no community**, so the community entries
+have no valid JID. `getCommunityInfo()` now reports **skipped** rather than
+failed in that case (it used to hard-fail), but the community admin path stays
+genuinely unexercised live until a community exists. The unit suite covers it;
+`tests/unit/group-community-admin.test.ts` includes the group/community
+cross-wire assertions.
+
+_Recorded 2026-09-02 after the first fully-live run of v1.12.0._

package/docs/PROXY.md

@@ -321,7 +321,11 @@ Random, biased by each entry's `weight` (default `1`). **A weight of `0` drains
 
 WhatsApp treats a session's source IP as part of its trust signal. If `bot-3` connects from Frankfurt on Monday and São Paulo on Tuesday, you have manufactured an account-takeover signature against your own account. The observable results are re-pairing prompts, 401/440 disconnect loops, and eventually a ban.
 
-`deterministic` hashes the `instanceId` to a stable entry, so a given session keeps a stable egress IP for its lifetime while N instances still spread across N proxies.
+`deterministic` hashes the `instanceId` to a stable entry, so a given session keeps a stable egress IP for its lifetime while instances still spread across the pool.
+
+> **It spreads, it does not deal.** Hashing is stateless, so two instances can land on the same proxy — with 10 instances over a 10-proxy pool, expect roughly 6-7 distinct egress IPs, not 10. That is inherent: a rotator that guaranteed one proxy per instance would need to know about every other instance, and would then have to remap live sessions whenever the set changed, which is the churn this strategy exists to avoid.
+>
+> If you need a guaranteed 1:1 mapping — and [IP separation for multi-instance](#ip-separation-for-multi-instance) is a reason you might — assign it explicitly rather than by hashing: pin each instance with [`instance set-proxy`](#pinning-a-proxy-to-an-instance-cli), or build the assignment map yourself. Size the pool above the instance count either way.
 
 > **Rotation is for distributing instances across proxies. It is never for rotating a live session's IP.**
 

package/eslint.config.js

@@ -7,6 +7,18 @@ export default tseslint.config(
     {
         ignores: ["dist/**", "node_modules/**", "coverage/**", "*.js"],
     },
+    {
+        // The published CLI executable is plain ESM JavaScript, not TypeScript,
+        // so it is not covered by the TS block below and needs Node's globals
+        // declared explicitly.
+        files: ["bin/**/*.mjs"],
+        languageOptions: {
+            globals: { console: "readonly", process: "readonly" },
+        },
+        rules: {
+            "no-console": "off",
+        },
+    },
     {
         files: ["src/**/*.ts", "tests/**/*.ts", "examples/**/*.ts", "bin/**/*.ts"],
         rules: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "miaw-core",
-  "version": "1.12.0",
+  "version": "1.12.2",
   "description": "Simplified WhatsApp API wrapper for Baileys - Multiple Instance of Awesome WhatsApp",
   "type": "module",
   "main": "dist/index.js",
@@ -13,7 +13,7 @@
     }
   },
   "bin": {
-    "miaw-cli": "./bin/miaw-cli.ts"
+    "miaw-cli": "./bin/miaw-cli.mjs"
   },
   "keywords": [
     "whatsapp",
@@ -32,6 +32,7 @@
     "@hapi/boom": "^10.0.1",
     "@whiskeysockets/baileys": "7.0.0-rc14",
     "cli-table3": "^0.6.5",
+    "dotenv": "^16.4.5",
     "https-proxy-agent": "^8.0.0",
     "pino": "^8.19.0",
     "qrcode-terminal": "^0.12.0",
@@ -48,7 +49,6 @@
     "@typescript-eslint/eslint-plugin": "^8.51.0",
     "@typescript-eslint/parser": "^8.51.0",
     "babel-jest": "^30.2.0",
-    "dotenv": "^16.4.5",
     "eslint": "^9.39.2",
     "jest": "^29.7.0",
     "ts-jest": "^29.1.2",

package/proxies.txt

@@ -0,0 +1,16 @@
+# Webshare proxy pool - LIVE CREDENTIALS. Ignored via /proxies.txt in .gitignore.
+# Saved 2026-09-03. Vendor: webshare.io (plan 13791773), 10 static residential HTTP.
+# Refresh: curl -o proxies.txt "<webshare download url>"  (the url itself is a secret)
+# Use:     npx miaw-cli proxy test-all --proxy-file ./proxies.txt --ip
+#          or set MIAW_PROXY_FILE=./proxies.txt
+
+209.166.23.193:5354:mbmkuoqxstaticresidential:i9h6jrarzm6e
+82.23.91.50:7809:mbmkuoqxstaticresidential:i9h6jrarzm6e
+138.226.65.190:7381:mbmkuoqxstaticresidential:i9h6jrarzm6e
+130.180.228.105:6389:mbmkuoqxstaticresidential:i9h6jrarzm6e
+72.1.136.247:7138:mbmkuoqxstaticresidential:i9h6jrarzm6e
+9.142.198.183:5850:mbmkuoqxstaticresidential:i9h6jrarzm6e
+179.198.17.248:6367:mbmkuoqxstaticresidential:i9h6jrarzm6e
+31.98.14.152:5829:mbmkuoqxstaticresidential:i9h6jrarzm6e
+147.79.22.195:7911:mbmkuoqxstaticresidential:i9h6jrarzm6e
+103.243.147.25:6004:mbmkuoqxstaticresidential:i9h6jrarzm6e

package/bin/miaw-cli.ts

@@ -1,278 +0,0 @@
-#!/usr/bin/env node
-/**
- * miaw-cli - WhatsApp Command-Line Interface
- *
- * Usage:
- *   miaw-cli                    # Start interactive REPL
- *   miaw-cli <command> [args]   # Run one-shot command
- *
- * Examples:
- *   miaw-cli get groups
- *   miaw-cli send text 6281234567890 "Hello"
- *   miaw-cli instance status
- */
-
-import * as dotenv from "dotenv";
-import { runRepl } from "../src/cli/repl.js";
-import { runCommand } from "../src/cli/commands/index.js";
-import { initializeCLICleanup } from "../src/cli/utils/cleanup.js";
-import { getErrorMessage } from "../src/utils/type-guards.js";
-import {
-  configFromResolved,
-  describeProxySource,
-  resolveProxyForInstance,
-  type ProxyResolutionBase,
-} from "../src/cli/utils/proxy-resolver.js";
-import { maskProxyUrl } from "../src/utils/proxy-agent.js";
-import {
-  parseProxyStrategy,
-} from "../src/cli/utils/proxy-config.js";
-
-// Initialize CLI cleanup handlers for graceful shutdown
-initializeCLICleanup();
-
-// Load environment variables
-dotenv.config();
-dotenv.config({ path: ".env.test" });
-
-// Default configuration
-const DEFAULT_INSTANCE_ID = process.env.MIAW_INSTANCE_ID || "default";
-const DEFAULT_SESSION_PATH = process.env.MIAW_SESSION_PATH || "./sessions-cli";
-// Proxy credentials belong in .env, not in shell history.
-const DEFAULT_PROXY = process.env.MIAW_PROXY || undefined;
-const DEFAULT_PROXY_FILE = process.env.MIAW_PROXY_FILE || undefined;
-const DEFAULT_PROXY_STRATEGY_ENV = process.env.MIAW_PROXY_STRATEGY || undefined;
-
-/**
- * Global flags that never take a value. Listed explicitly because the parser is
- * positional: without this an `--ip`-style flag consumes the command name.
- */
-const BOOLEAN_FLAGS = new Set(["json", "debug", "help", "version", "ip", "from-file", "force"]);
-
-/**
- * Parse CLI arguments
- */
-function parseArgs(args: string[]): {
-  command: string;
-  args: string[];
-  flags: { [key: string]: string | boolean };
-} {
-  const flags: { [key: string]: string | boolean } = {};
-  const commandArgs: string[] = [];
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      const flagName = arg.slice(2);
-      // Value-less flags must never swallow the next token. `--json instance ls`
-      // otherwise parsed as json="instance", leaving the command empty and
-      // reporting "Unknown command: ls" - even though --json is documented as a
-      // global option, i.e. valid before the command.
-      if (BOOLEAN_FLAGS.has(flagName)) {
-        flags[flagName] = true;
-        continue;
-      }
-      const nextArg = args[i + 1];
-      if (nextArg && !nextArg.startsWith("--")) {
-        flags[flagName] = nextArg;
-        i++;
-      } else {
-        flags[flagName] = true;
-      }
-    } else {
-      commandArgs.push(arg);
-    }
-  }
-
-  const command = commandArgs[0] || "";
-  const remainingArgs = commandArgs.slice(1);
-
-  return { command, args: remainingArgs, flags };
-}
-
-/**
- * Show help message
- */
-function showHelp() {
-  console.log(`
-╔════════════════════════════════════════════════════════════════════════╗
-║                     miaw-cli - WhatsApp CLI Tool                       ║
-╚════════════════════════════════════════════════════════════════════════╝
-
-USAGE:
-  miaw-cli                                    Start interactive REPL mode
-  miaw-cli <command> [args]                   Run one-shot command
-
-GLOBAL FLAGS:
-  --instance-id <id>                          Instance ID (default: "default")
-  --session-path <path>                       Session directory
-  --proxy <url>                               Proxy URL (http/https/socks4/socks4a/socks5/socks5h)
-  --proxy-file <path>                         Proxy list file (.txt one-per-line, or .json array)
-  --proxy-strategy <strategy>                 Pick from --proxy-file: round-robin | random |
-                                              weighted | deterministic (default: deterministic)
-  --json                                      Output as JSON
-  --debug                                     Enable verbose logging
-
-COMMANDS:
-  instance    Manage instances (ls, status, create, delete, connect, disconnect,
-              logout, set-proxy, unset-proxy)
-  get         Fetch data (profile, contacts, groups, chats, messages, labels)
-  load        Load older messages from history
-  send        Send messages (text, image, document)
-  group       Group management (list, info, participants, invite, settings)
-  check       Check if phone numbers are on WhatsApp
-  contact     Contact management (list, info, business, picture, add, remove)
-  profile     Profile management (picture, name, status)
-  label       Label management - WhatsApp Business (list, chats, add, chat)
-  catalog     Catalog management - WhatsApp Business (list, collections, product)
-  proxy       Inspect and test proxies (list, test, test-all) - no connection needed
-
-COMMON OPTIONS:
-  --limit N                                   Limit number of results
-  --filter TEXT                               Filter by name/phone (case-insensitive)
-
-EXAMPLES:
-  miaw-cli get contacts --limit 10 --filter john
-  miaw-cli send text 6281234567890 "Hello"
-  miaw-cli group participants add 120363xxx@g.us 628xxx
-  miaw-cli contact add 6281234567890 "John Doe"
-  miaw-cli proxy test socks5://proxy.example.com:1080
-  miaw-cli --instance-id bot-3 --proxy-file ./proxies.txt get groups
-  miaw-cli instance set-proxy bot-3 --label eu     Pin a proxy, no credentials stored
-  miaw-cli --instance-id bot-3 get groups          Uses bot-3's pinned proxy, no flags
-
-PROXY PRECEDENCE (highest first):
-  --proxy / MIAW_PROXY  >  pinned in <session-path>/instances.json
-                        >  --proxy-file  >  direct
-  A pin applies on the instance's NEXT connect. Never change a live session's
-  egress IP - WhatsApp reads that as account takeover.
-
-REPL MODE:
-  Run 'miaw-cli' without arguments to start interactive mode.
-  In REPL, use 'help <command>' for detailed help on each command.
-
-For detailed documentation: https://github.com/biji-dev/miaw-core/blob/main/docs/CLI.md
-`);
-}
-
-/**
- * Main entry point
- */
-async function main() {
-  const args = process.argv.slice(2);
-
-  // Show help if requested
-  if (args.includes("--help") || args.includes("-h")) {
-    showHelp();
-    process.exit(0);
-  }
-
-  const { command, args: commandArgs, flags } = parseArgs(args);
-
-  // Extract global flags
-  const instanceId = (flags["instance-id"] as string) || DEFAULT_INSTANCE_ID;
-  const sessionPath = (flags["session-path"] as string) || DEFAULT_SESSION_PATH;
-  const jsonOutput = flags.json === true;
-  const debugMode = flags.debug === true;
-
-  // Extract proxy flags (CLI flag wins over the MIAW_PROXY* env fallbacks)
-  const explicitProxy = (flags.proxy as string | undefined) || DEFAULT_PROXY;
-  const proxyFile = (flags["proxy-file"] as string | undefined) || DEFAULT_PROXY_FILE;
-
-  let proxyStrategy;
-  try {
-    proxyStrategy = parseProxyStrategy(
-      (flags["proxy-strategy"] as string | undefined) || DEFAULT_PROXY_STRATEGY_ENV
-    );
-  } catch (error: unknown) {
-    console.error(`❌ ${getErrorMessage(error)}`);
-    process.exit(1);
-  }
-
-  // Precedence lives in one place - see src/cli/utils/proxy-resolver.ts:
-  //   --proxy  >  pin in instances.json  >  --proxy-file  >  direct
-  // Selection is keyed on this instanceId, and commands targeting a *different*
-  // instance re-resolve rather than reusing what the process started with.
-  const proxyBase: ProxyResolutionBase = {
-    sessionPath,
-    debug: debugMode,
-    ...(explicitProxy && { explicitProxy }),
-    ...(proxyFile && { proxyFile }),
-    proxyStrategy,
-  };
-
-  // A failure here is reported but does NOT exit. A bad pin would otherwise
-  // lock the operator out of `instance unset-proxy` and `instance ls` - the
-  // commands that repair it. The config instead carries `proxyError`, and
-  // createClient() refuses to build a client, so nothing connects direct.
-  let clientConfig;
-  let resolvedProxy;
-  try {
-    // Resolve once, then build the config from that result: resolving twice
-    // would print every override warning twice.
-    resolvedProxy = await resolveProxyForInstance(proxyBase, instanceId);
-    clientConfig = configFromResolved(proxyBase, instanceId, resolvedProxy);
-  } catch (error: unknown) {
-    const reason = getErrorMessage(error);
-    console.error(`❌ ${reason}`);
-    console.error(
-      `   Commands needing a connection will refuse until this is fixed; ` +
-        `"instance unset-proxy ${instanceId}" removes the pin.`
-    );
-    resolvedProxy = { source: "none" as const };
-    clientConfig = {
-      ...configFromResolved(proxyBase, instanceId, resolvedProxy),
-      proxyError: reason,
-    };
-  }
-
-  const proxyUrl = clientConfig.proxy;
-
-  // No command provided - start REPL
-  if (!command) {
-    console.log(`\n🚀 Starting miaw-cli REPL...`);
-    console.log(`📂 Instance: ${instanceId}`);
-    console.log(`📂 Session: ${sessionPath}`);
-    if (proxyUrl) {
-      console.log(
-        `🌐 Proxy: ${maskProxyUrl(proxyUrl)} (${describeProxySource(resolvedProxy.source)})`
-      );
-    }
-    console.log(`🔧 Debug: ${debugMode ? "ON" : "OFF"}\n`);
-
-    try {
-      await runRepl(clientConfig);
-    } catch (error: unknown) {
-      console.error("❌ REPL error:", getErrorMessage(error));
-      process.exit(1);
-    }
-    return;
-  }
-
-  // Run one-shot command
-  try {
-    const success = await runCommand(command, commandArgs, {
-      clientConfig,
-      jsonOutput,
-      flags,
-      ...(proxyFile && { proxyFile }),
-      proxyStrategy,
-    });
-
-    if (!success) {
-      process.exit(1);
-    }
-  } catch (error: unknown) {
-    console.error("❌ Command error:", getErrorMessage(error));
-    if (debugMode && error instanceof Error) {
-      console.error(error.stack);
-    }
-    process.exit(1);
-  }
-}
-
-// Run the CLI
-main().catch((error) => {
-  console.error("Fatal error:", error);
-  process.exit(1);
-});