omnish 2.1.6 → 2.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnish",
-  "version": "2.1.6",
+  "version": "2.1.8",
   "description": "omnish — allowlisted inbox → your real shell (WhatsApp, Telegram, Discord, Slack, and 20+ channels). No AI.",
   "license": "MIT",
   "type": "module",
@@ -17,18 +17,21 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/eligapris/omnish.git"
+    "url": "git+https://github.com/labKnowledge/omnish.git"
   },
   "bugs": {
-    "url": "https://github.com/eligapris/omnish/issues"
+    "url": "https://github.com/labKnowledge/omnish/issues"
   },
   "homepage": "https://omnish.dev",
   "files": [
     "dist",
+    "scripts/baileys-version.cjs",
+    "scripts/check-baileys-dep.mjs",
     "scripts/check-native-modules.mjs",
     "scripts/check-node-version.cjs",
     "scripts/node-version.cjs",
     "scripts/fix-node-pty-perms.mjs",
+    "contrib/install-omnish.sh",
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
@@ -81,7 +84,7 @@
   "scripts": {
     "reinstall": "rm -rf node_modules && pnpm install",
     "preinstall": "node scripts/check-node-version.cjs",
-    "postinstall": "node scripts/check-native-modules.mjs && node scripts/fix-node-pty-perms.mjs",
+    "postinstall": "node scripts/check-baileys-dep.mjs && node scripts/check-native-modules.mjs && node scripts/fix-node-pty-perms.mjs",
     "build": "node scripts/build-bundle.mjs",
     "build:doc-index": "node scripts/build-doc-index.mjs",
     "typecheck": "tsc --noEmit",

package/scripts/baileys-version.cjs

@@ -0,0 +1,65 @@
+/**
+ * Baileys version policy for CVE-2026-48063 (GHSA-qvv5-jq5g-4cgg).
+ * Safe: 6.7.22+ or 7.0.0-rc12+ (handles rc.9 vs rc13 naming).
+ */
+"use strict";
+
+/** Minimum pinned Baileys for omnish publishes. */
+var EXPECTED_BAILEYS_PIN = "7.0.0-rc13";
+
+/**
+ * Parse 7.0.0-rcN or 7.0.0-rc.N into N, or null if not an RC.
+ * @param {string} version
+ * @returns {number | null}
+ */
+function parseBaileysRcNumber(version) {
+  var m = /^7\.0\.0-rc\.?(\d+)/.exec(String(version).trim());
+  if (!m) {
+    return null;
+  }
+  return Number(m[1]);
+}
+
+/**
+ * @param {string} version Installed or declared Baileys version.
+ * @returns {boolean}
+ */
+function isBaileysVersionSafe(version) {
+  var v = String(version).trim();
+
+  var rc = parseBaileysRcNumber(v);
+  if (rc !== null) {
+    return rc >= 12;
+  }
+
+  var m6 = /^6\.(\d+)\.(\d+)/.exec(v);
+  if (m6) {
+    var minor = Number(m6[1]);
+    var patch = Number(m6[2]);
+    if (minor > 7) {
+      return true;
+    }
+    if (minor === 7 && patch >= 22) {
+      return true;
+    }
+    return false;
+  }
+
+  var m7 = /^7\.(\d+)\.(\d+)/.exec(v);
+  if (m7) {
+    var majorMinor = Number(m7[1]);
+    var patch7 = Number(m7[2]);
+    if (majorMinor > 0) {
+      return true;
+    }
+    return patch7 > 0;
+  }
+
+  return false;
+}
+
+module.exports = {
+  EXPECTED_BAILEYS_PIN,
+  parseBaileysRcNumber,
+  isBaileysVersionSafe,
+};

package/scripts/check-baileys-dep.mjs

@@ -0,0 +1,28 @@
+/**
+ * Postinstall guard: fail if installed Baileys is vulnerable (CVE-2026-48063).
+ */
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const { isBaileysVersionSafe } = require("./baileys-version.cjs");
+
+let version;
+try {
+  version = require("@whiskeysockets/baileys/package.json").version;
+} catch {
+  process.exit(0);
+}
+
+if (!isBaileysVersionSafe(version)) {
+  console.error(
+    `omnish: vulnerable @whiskeysockets/baileys@${version} is installed.`,
+  );
+  console.error(
+    "  CVE-2026-48063 (message spoofing) affects this version. See:",
+  );
+  console.error(
+    "  https://github.com/WhiskeySockets/Baileys/security/advisories/GHSA-qvv5-jq5g-4cgg",
+  );
+  console.error("  Fix: npm install -g omnish@latest");
+  process.exit(1);
+}

package/scripts/node-version.cjs

@@ -11,18 +11,30 @@ var path = require("path");
 var DEFAULT_ENGINES_NODE = ">=22.13";
 var RECOMMENDED_NODE = "22";
 
-function readEnginesNode() {
+function readPackageJson() {
   try {
-    var pkg = JSON.parse(
+    return JSON.parse(
       fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8"),
     );
-    if (pkg.engines && typeof pkg.engines.node === "string") {
-      return pkg.engines.node;
-    }
-    return DEFAULT_ENGINES_NODE;
   } catch (err) {
-    return DEFAULT_ENGINES_NODE;
+    return null;
+  }
+}
+
+function readEnginesNode() {
+  var pkg = readPackageJson();
+  if (pkg && pkg.engines && typeof pkg.engines.node === "string") {
+    return pkg.engines.node;
   }
+  return DEFAULT_ENGINES_NODE;
+}
+
+/** Public bootstrap script URL (served from npm via unpkg — works without GitHub access). */
+function readBootstrapInstallScriptUrl() {
+  var pkg = readPackageJson();
+  var name = (pkg && pkg.name) || "omnish";
+  var version = (pkg && pkg.version) || "latest";
+  return "https://unpkg.com/" + name + "@" + version + "/contrib/install-omnish.sh";
 }
 
 function parseSemver(version) {
@@ -124,101 +136,75 @@ function formatNodeUpgradeHelp(result, platform) {
   if (platform === undefined) {
     platform = os.platform();
   }
+  var bootstrap = readBootstrapInstallScriptUrl();
   var lines = [];
   var c = shellComment(platform);
   lines.push("");
-  lines.push("=== omnish: upgrade Node to 22.13+ (you have " + result.current + ") ===");
+  lines.push(
+    "=== omnish: Node " + result.required + " required (you have " + result.current + ") ===",
+  );
+  lines.push("");
+  lines.push("npm install -g omnish cannot finish on this Node version.");
+  lines.push(
+    "(EBADENGINE warnings above are expected on old Node — ignore them; the blocker is below.)",
+  );
   lines.push("");
-  if (platform !== "win32" && platform !== "darwin") {
-    lines.push("QUICK FIX — Debian/Ubuntu VPS (replaces old apt Node 12):");
-    lines.push("  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -");
-    lines.push("  apt-get install -y nodejs");
-    lines.push("  node -v");
-    lines.push("  npm i -g omnish");
-    lines.push("");
-  }
-  lines.push("omnish needs a newer Node.js to install and run.");
-  lines.push("  Required : Node " + result.required + " (see package.json engines)");
-  lines.push("  You have : " + result.current);
-  lines.push("  Recommend: Node " + result.recommended + " (matches .nvmrc in the repo)");
+  lines.push("RUN THIS INSTEAD — upgrades Node 22+ and installs omnish:");
+  lines.push("  curl -fsSL " + bootstrap + " | bash");
   lines.push("");
-  lines.push("Why: omnish ships native addons (better-sqlite3, node-pty) and depends on");
-  lines.push("packages that require Node 22+. Older Node cannot install or run omnish.");
+  lines.push("Required: Node " + result.required + "  |  You have: " + result.current);
+  lines.push("Recommend: Node " + result.recommended + " (matches .nvmrc in the repo)");
   lines.push("");
-  lines.push("Pick one upgrade path, then re-run:");
-  lines.push("  npm i -g omnish");
+  lines.push("Why: native addons (better-sqlite3, node-pty) and deps need Node 22+.");
   lines.push("");
 
   if (platform === "win32") {
-    lines.push("Windows — nvm-windows (recommended if you use nvm):");
+    lines.push("Windows — nvm-windows:");
     lines.push("  nvm i 22");
     lines.push("  nvm use 22");
     lines.push("  node -v");
     lines.push("  npm i -g omnish");
     lines.push("");
-    lines.push("Windows — official installer / winget:");
+    lines.push("Windows — winget:");
     lines.push("  winget install OpenJS.NodeJS.LTS");
     lines.push("  node -v");
     lines.push("  npm i -g omnish");
     lines.push("");
-    lines.push("If npm still uses an old Node, open a new terminal after upgrading.");
+    lines.push("If npm still uses old Node, open a new terminal after upgrading.");
     return lines.join("\n");
   }
 
   if (platform === "darwin") {
-    lines.push("macOS — nvm (install + set default + install omnish):");
-    lines.push(c + " install nvm: https://github.com/nvm-sh/nvm#installing-and-updating");
-    lines.push(
-      "  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash",
-    );
-    lines.push(c + " restart your shell, then:");
-    lines.push("  nvm i 22");
-    lines.push("  nvm alias default 22");
-    lines.push("  node -v");
-    lines.push("  npm i -g omnish");
-    lines.push("");
-    lines.push("macOS — Homebrew:");
+    lines.push("macOS — Homebrew (fastest):");
     lines.push("  brew install node@22");
     lines.push("  brew link --overwrite --force node@22");
     lines.push("  node -v");
     lines.push("  npm i -g omnish");
     lines.push("");
-    lines.push("macOS — fnm:");
-    lines.push("  fnm use --install-if-missing 22");
-    lines.push("  fnm default 22");
+    lines.push("macOS — nvm:");
+    lines.push(c + " https://github.com/nvm-sh/nvm#installing-and-updating");
+    lines.push(
+      "  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash",
+    );
+    lines.push(c + " restart shell, then:");
+    lines.push("  nvm i 22");
+    lines.push("  nvm alias default 22");
     lines.push("  npm i -g omnish");
     return lines.join("\n");
   }
 
-  lines.push("Linux VPS / server — Debian or Ubuntu (replaces old apt node, e.g. v12):");
+  lines.push("Linux VPS — Debian/Ubuntu (replaces old apt Node, e.g. v12):");
   lines.push("  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -");
-  lines.push("  apt-get install -y nodejs");
+  lines.push("  apt-get install -y nodejs build-essential python3");
   lines.push("  node -v");
   lines.push("  npm i -g omnish");
   lines.push("");
-  lines.push("Linux — nvm (install + set default + install omnish):");
-  lines.push(c + " install nvm: https://github.com/nvm-sh/nvm#installing-and-updating");
+  lines.push("Linux — nvm:");
   lines.push(
     "  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash",
   );
-  lines.push(c + " restart your shell, then:");
-  lines.push("  nvm i 22");
-  lines.push("  nvm alias default 22");
-  lines.push("  node -v");
-  lines.push("  npm i -g omnish");
-  lines.push("");
-  lines.push("Linux — fnm:");
-  lines.push("  fnm use --install-if-missing 22");
-  lines.push("  fnm default 22");
-  lines.push("  npm i -g omnish");
-  lines.push("");
-  lines.push("Linux — official builds:");
-  lines.push("  https://nodejs.org/en/download  (pick 22.x)");
-  lines.push("");
-  lines.push("One-liner bootstrap (tries nvm/fnm, then installs omnish):");
-  lines.push(
-    "  curl -fsSL https://raw.githubusercontent.com/labKnowledge/omnish/main/contrib/install-omnish.sh | bash",
-  );
+  lines.push(c + " restart shell:");
+  lines.push("  nvm i 22 && nvm alias default 22 && npm i -g omnish");
   return lines.join("\n");
 }
 
@@ -250,4 +236,5 @@ module.exports = {
   checkNodeVersion: checkNodeVersion,
   formatNodeUpgradeHelp: formatNodeUpgradeHelp,
   formatNativeModuleNodeHint: formatNativeModuleNodeHint,
+  readBootstrapInstallScriptUrl: readBootstrapInstallScriptUrl,
 };