omnish 2.1.6 → 2.1.8

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.1.8] - 2026-07-11
+
+### Changed
+
+- **Self-service install on old Node:** bootstrap script ships in the npm tarball; preinstall errors lead with `curl -fsSL https://unpkg.com/omnish@<version>/contrib/install-omnish.sh | bash` (no private GitHub raw URL). EBADENGINE flood is called out as ignorable noise.
+- **`contrib/install-omnish.sh`:** Debian/Ubuntu VPS uses NodeSource first (replaces apt Node 12), installs `build-essential` for native modules, prints next steps after install.
+- **Docs/README:** install section split into “already on Node 22” vs “old Node — run bootstrap”.
+
+## [2.1.7] - 2026-07-11
+
+### Added
+
+- **Baileys postinstall guard:** fail install when `@whiskeysockets/baileys` is below the CVE-2026-48063 patched minimum (`scripts/check-baileys-dep.mjs`, `scripts/baileys-version.cjs`).
+- **Publish audit tooling:** `scripts/verify-publish-manifest.mjs` (CI pre-publish Baileys pin check) and `scripts/audit-npm-baileys-versions.mjs` (registry audit / deprecate old versions).
+
+### Changed
+
+- **Release CI:** verify packed manifest and Baileys version tests before npm publish.
+- **Docs:** troubleshooting for Baileys `rc.9` vs `prebuild-install` install warnings; maintainer release notes for Baileys audit.
+
+### Security
+
+- **npm registry:** deprecated omnish `1.1.1`–`1.5.2` (declared vulnerable Baileys `7.0.0-rc.9`).
+
 ## [2.1.6] - 2026-07-11
 
 ### Fixed
@@ -77,6 +101,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Documentation and formatting updates across chat components and feature docs.
 
+[2.1.8]: https://github.com/labKnowledge/omnish/compare/v2.1.7...v2.1.8
+[2.1.7]: https://github.com/labKnowledge/omnish/compare/v2.1.6...v2.1.7
 [2.1.6]: https://github.com/labKnowledge/omnish/compare/v2.1.5...v2.1.6
 [2.1.5]: https://github.com/labKnowledge/omnish/compare/v2.1.4...v2.1.5
 [2.1.4]: https://github.com/labKnowledge/omnish/compare/v2.1.3...v2.1.4

package/README.md

@@ -109,11 +109,9 @@ Names are alphanumeric plus `_`/`-`, max 32 characters; several names are reserv
 
 ## Install from npm
 
-**Requires Node.js 22.13+** (`node -v`). If install fails on version, see [Quick start — Installation](docs/guides/quick-start.md#installation) or run:
+**Requires Node.js 22.13+** (`node -v`).
 
-```bash
-curl -fsSL https://raw.githubusercontent.com/labKnowledge/omnish/main/contrib/install-omnish.sh | bash
-```
+### Already on Node 22.13+
 
 ```bash
 npm install -g omnish
@@ -122,6 +120,16 @@ omnish allow +YOUR_E164
 omnish run
 ```
 
+### Old Node (VPS with apt Node 12, etc.)
+
+`npm install -g omnish` will fail on Node below 22.13 — that is expected. **Run the bootstrap installer instead** (upgrades Node, installs build tools on Debian/Ubuntu, then `npm install -g omnish`):
+
+```bash
+curl -fsSL https://unpkg.com/omnish/contrib/install-omnish.sh | bash
+```
+
+The script is published in the npm package (no GitHub clone required). If `npm install -g omnish` failed, the error message prints the same one-liner with your package version.
+
 **Single phone:** omnish runs on a PC or server; you link it like WhatsApp Web (one QR scan on your phone). See [Quick start — One phone with WhatsApp](docs/guides/quick-start.md#one-phone-with-whatsapp).
 
 **npm 11+ install warnings:** You may see advisory `allow-scripts` notices for native dependencies (`node-pty`, `better-sqlite3`, etc.). Install still succeeds; omnish pre-declares these in `allowScripts`. The `prebuild-install` deprecation warning comes from upstream native modules and is harmless.

package/contrib/install-omnish.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# Bootstrap omnish install: ensure Node 22.13+, then npm install -g omnish.
+# Served from npm (unpkg) — see scripts/node-version.cjs readBootstrapInstallScriptUrl().
+set -euo pipefail
+
+OMNISH_NPM_SPEC="${OMNISH_NPM_SPEC:-omnish}"
+NODE_MAJOR="${OMNISH_NODE_MAJOR:-22}"
+NVM_INSTALL_URL="${NVM_INSTALL_URL:-https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh}"
+
+need() {
+  command -v "$1" >/dev/null 2>&1 || {
+    echo "error: required command not found: $1" >&2
+    exit 1
+  }
+}
+
+is_debian_ubuntu() {
+  [[ -f /etc/debian_version ]] && command -v apt-get >/dev/null 2>&1
+}
+
+node_version_ok() {
+  node -e "
+const [maj, min] = process.versions.node.split('.').map(Number);
+const ok = maj > 22 || (maj === 22 && min >= 13);
+process.exit(ok ? 0 : 1);
+" 2>/dev/null
+}
+
+current_node() {
+  if command -v node >/dev/null 2>&1; then
+    node -v
+  else
+    echo "(not installed)"
+  fi
+}
+
+install_omnish() {
+  need npm
+  echo ""
+  echo "Installing ${OMNISH_NPM_SPEC} with Node $(node -v) …"
+  npm install -g "${OMNISH_NPM_SPEC}"
+  echo ""
+  echo "Done. Next steps:"
+  echo "  omnish --version"
+  echo "  omnish link          # WhatsApp QR or --tg for Telegram"
+  echo "  omnish allow +E164   # your phone number"
+  echo "  omnish start"
+}
+
+ensure_build_deps() {
+  if ! is_debian_ubuntu; then
+    return 0
+  fi
+  echo "Installing build tools for native modules (better-sqlite3, node-pty) …"
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update -qq
+  apt-get install -y build-essential python3 curl ca-certificates
+}
+
+load_nvm() {
+  if [[ -s "${NVM_DIR:-$HOME/.nvm}/nvm.sh" ]]; then
+    # shellcheck source=/dev/null
+    . "${NVM_DIR:-$HOME/.nvm}/nvm.sh"
+    return 0
+  fi
+  return 1
+}
+
+try_nvm() {
+  if load_nvm; then
+    echo "Using nvm to install Node ${NODE_MAJOR} and set default …"
+    nvm install "${NODE_MAJOR}"
+    nvm alias default "${NODE_MAJOR}"
+    nvm use default
+    return 0
+  fi
+  return 1
+}
+
+try_fnm() {
+  if command -v fnm >/dev/null 2>&1; then
+    echo "Using fnm to install Node ${NODE_MAJOR} and set default …"
+    fnm install "${NODE_MAJOR}"
+    fnm default "${NODE_MAJOR}"
+    eval "$(fnm env)"
+    return 0
+  fi
+  return 1
+}
+
+try_nodesource() {
+  if ! is_debian_ubuntu; then
+    return 1
+  fi
+  need curl
+  echo "Using NodeSource to install Node ${NODE_MAJOR}.x (replaces old apt node) …"
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash -
+  apt-get install -y nodejs
+  hash -r 2>/dev/null || true
+  return 0
+}
+
+install_nvm() {
+  need curl
+  echo "nvm not found — installing nvm …"
+  curl -fsSL "${NVM_INSTALL_URL}" | bash
+  load_nvm || {
+    echo "error: nvm install finished but nvm.sh is missing. Open a new shell and re-run this script." >&2
+    exit 1
+  }
+  nvm install "${NODE_MAJOR}"
+  nvm alias default "${NODE_MAJOR}"
+  nvm use default
+}
+
+print_manual_help() {
+  cat <<EOF
+
+omnish needs Node.js 22.13 or newer.
+You have: $(current_node)
+
+Automatic upgrade failed. Pick one path:
+
+  Debian/Ubuntu VPS (replaces old apt node, e.g. v12):
+    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash -
+    apt-get install -y nodejs build-essential python3
+    node -v
+    npm install -g ${OMNISH_NPM_SPEC}
+
+  nvm:
+    curl -o- ${NVM_INSTALL_URL} | bash
+    # restart shell
+    nvm install ${NODE_MAJOR}
+    nvm alias default ${NODE_MAJOR}
+    npm install -g ${OMNISH_NPM_SPEC}
+
+  Official installers:
+    https://nodejs.org/en/download
+
+EOF
+}
+
+main() {
+  echo "omnish installer — Node $(current_node) (need 22.13+)"
+
+  if command -v node >/dev/null 2>&1 && node_version_ok; then
+    install_omnish
+    exit 0
+  fi
+
+  # Debian/Ubuntu VPS (common: distro Node 12 from apt) — NodeSource first.
+  if is_debian_ubuntu; then
+    ensure_build_deps
+    if try_nodesource && node_version_ok; then
+      install_omnish
+      exit 0
+    fi
+  fi
+
+  if try_nvm || try_fnm; then
+    if node_version_ok; then
+      install_omnish
+      exit 0
+    fi
+  fi
+
+  if try_nodesource && node_version_ok; then
+    install_omnish
+    exit 0
+  fi
+
+  if [[ "$(uname -s)" != "MINGW"* && "$(uname -s)" != "MSYS"* && "$(uname -s)" != "CYGWIN"* ]]; then
+    if install_nvm; then
+      if node_version_ok; then
+        install_omnish
+        exit 0
+      fi
+    fi
+  fi
+
+  print_manual_help
+  exit 1
+}
+
+main "$@"