omnish 2.1.6 → 2.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnish",
-  "version": "2.1.6",
+  "version": "2.1.7",
   "description": "omnish — allowlisted inbox → your real shell (WhatsApp, Telegram, Discord, Slack, and 20+ channels). No AI.",
   "license": "MIT",
   "type": "module",
@@ -25,6 +25,8 @@
   "homepage": "https://omnish.dev",
   "files": [
     "dist",
+    "scripts/baileys-version.cjs",
+    "scripts/check-baileys-dep.mjs",
     "scripts/check-native-modules.mjs",
     "scripts/check-node-version.cjs",
     "scripts/node-version.cjs",
@@ -81,7 +83,7 @@
   "scripts": {
     "reinstall": "rm -rf node_modules && pnpm install",
     "preinstall": "node scripts/check-node-version.cjs",
-    "postinstall": "node scripts/check-native-modules.mjs && node scripts/fix-node-pty-perms.mjs",
+    "postinstall": "node scripts/check-baileys-dep.mjs && node scripts/check-native-modules.mjs && node scripts/fix-node-pty-perms.mjs",
     "build": "node scripts/build-bundle.mjs",
     "build:doc-index": "node scripts/build-doc-index.mjs",
     "typecheck": "tsc --noEmit",

package/scripts/baileys-version.cjs

@@ -0,0 +1,65 @@
+/**
+ * Baileys version policy for CVE-2026-48063 (GHSA-qvv5-jq5g-4cgg).
+ * Safe: 6.7.22+ or 7.0.0-rc12+ (handles rc.9 vs rc13 naming).
+ */
+"use strict";
+
+/** Minimum pinned Baileys for omnish publishes. */
+var EXPECTED_BAILEYS_PIN = "7.0.0-rc13";
+
+/**
+ * Parse 7.0.0-rcN or 7.0.0-rc.N into N, or null if not an RC.
+ * @param {string} version
+ * @returns {number | null}
+ */
+function parseBaileysRcNumber(version) {
+  var m = /^7\.0\.0-rc\.?(\d+)/.exec(String(version).trim());
+  if (!m) {
+    return null;
+  }
+  return Number(m[1]);
+}
+
+/**
+ * @param {string} version Installed or declared Baileys version.
+ * @returns {boolean}
+ */
+function isBaileysVersionSafe(version) {
+  var v = String(version).trim();
+
+  var rc = parseBaileysRcNumber(v);
+  if (rc !== null) {
+    return rc >= 12;
+  }
+
+  var m6 = /^6\.(\d+)\.(\d+)/.exec(v);
+  if (m6) {
+    var minor = Number(m6[1]);
+    var patch = Number(m6[2]);
+    if (minor > 7) {
+      return true;
+    }
+    if (minor === 7 && patch >= 22) {
+      return true;
+    }
+    return false;
+  }
+
+  var m7 = /^7\.(\d+)\.(\d+)/.exec(v);
+  if (m7) {
+    var majorMinor = Number(m7[1]);
+    var patch7 = Number(m7[2]);
+    if (majorMinor > 0) {
+      return true;
+    }
+    return patch7 > 0;
+  }
+
+  return false;
+}
+
+module.exports = {
+  EXPECTED_BAILEYS_PIN,
+  parseBaileysRcNumber,
+  isBaileysVersionSafe,
+};

package/scripts/check-baileys-dep.mjs

@@ -0,0 +1,28 @@
+/**
+ * Postinstall guard: fail if installed Baileys is vulnerable (CVE-2026-48063).
+ */
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const { isBaileysVersionSafe } = require("./baileys-version.cjs");
+
+let version;
+try {
+  version = require("@whiskeysockets/baileys/package.json").version;
+} catch {
+  process.exit(0);
+}
+
+if (!isBaileysVersionSafe(version)) {
+  console.error(
+    `omnish: vulnerable @whiskeysockets/baileys@${version} is installed.`,
+  );
+  console.error(
+    "  CVE-2026-48063 (message spoofing) affects this version. See:",
+  );
+  console.error(
+    "  https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg",
+  );
+  console.error("  Fix: npm install -g omnish@latest");
+  process.exit(1);
+}