Levix Self-Hosted WhatsApp Bot

Levix is an MIT-licensed, self-hosted WhatsApp bot for people managing their own chats and groups. It combines commands, an AI agent, moderation, schedules, and a browser control panel. Its companion website provides downloads, documentation, feedback, and backend services used by installations.

The problem

A personal bot needs more than a message handler. It has to keep a WhatsApp session, store settings and schedules, enforce permissions for group actions, and give the operator a way to configure it. Installation and support also need a public entry point. Levix pairs the local bot with a separate product site while keeping chat operations on the host chosen by the operator.

Key features

• Connects to WhatsApp through Baileys and exposes connection controls in a React panel.
• Runs commands for AI assistance, translation, media, reminders, and group utilities.
• Applies group moderation rules for links, spam, words, and media, with configurable policies.
• Creates and manages static or animated WebP stickers and owner-scoped packs.
• Stores scheduled messages and delivery history, including recurring jobs and manual retries.
• Offers a Kotlin Android host that runs the bot stack on the device.
• Provides a product website with download links, documentation, and a feedback form.
• Uses website API routes for recovery email relay and crash-report intake.

Technical architecture

The Node.js bot keeps session state, schedules, and settings in built-in SQLite. Baileys handles WhatsApp connectivity; Express serves authenticated panel routes, and Socket.IO sends live updates to the React interface. The Android app embeds a Node runtime and displays the panel through a WebView bridge. The separate Next.js website fetches release data from GitHub. Its server routes forward feedback to Telegram, send recovery messages through SMTP, and store recovery and crash-report state in SQLite. The bot and website are separate repositories serving one product.

Engineering highlights

• AI tool calls are authorized against the sender resolved from the incoming WhatsApp message, rather than instructions returned by a model or page.
• Secret material in local bot storage is sealed with AES-256-GCM.
• URL-fetch paths block private and local network targets, including redirects.
• SQLite migrations keep local data compatible as the bot changes.
• The website persists recovery limits and single-use tokens across restarts; its crash intake validates reports before storage.