How the code fits together

Levix is one Node.js process (needs Node 24 or newer) with no external services: the database is SQLite through Node's built-in node:sqlite module, the media tooling is the bundled ffmpeg-static binary, and the upstream dependency for WhatsApp is @whiskeysockets/baileys. This page reflects the current sources, not the README.

• bin/levix.js — the CLI entry: levix (panel + bot, opens the browser, --data <dir> and --no-open), levix headless, levix where, levix reset-password, levix domain [name].
• src/index.js — banners, then two bootstraps: bootstrapCore() creates the database, sealed vault and WhatsApp session; bootstrapPanel() starts Express. levix headless runs only the first.
• app.cjs — the panel's Express app: EJS doors for first-run (setup), login and QR, express-session with a bounded in-memory store, per-peer login throttling, the static assets from public/, and the dashboard shell.
• src/bootstrap — core.js (database + secret vault + session startup policy), panel.js (mounts routes), events.cjs (event wiring).
• src/core — session.js (Baileys lifecycle: connect, restart, unlink — an unlink wipes every account-scoped store, sticker library included), connection.js (retry classes and the pause-when-offline policy), socket.js, events.js, proxy.js (the WhatsApp proxy agents).
• scheduler.cjs — node-cron jobs: sending scheduled messages and promoting/trimming the media cache on a 3-day retention window.
• src/handlers — command.handler.js scans src/commands (a manifest replaces the scan in packaged builds), indexes names and aliases and dispatches: permission gate → middleware → execute. Most replies edit the original message in place; an explicit exemption list keeps answer-style commands as separate messages. message.handler.js and group.handler.js cover the non-command traffic.
• src/middleware — permissions.middleware.js (owner/bot-admin rosters + group admin checks), antispam, blacklist, forward-tracking.
• src/commands — every command is one CommonJS module (see the next page). group/ holds the group sub-commands.
• src/services — the AI stack: aiAgent.cjs (the one live-edited reply), aiRouter.cjs and aiProviders.cjs (gemini, an OpenAI-compatible adapter, anthropic), aiTools.cjs (web search, page reading, memory and role tools with per-tool auth in aiToolAuth.cjs), modelRegistry.cjs and llmDiscovery.cjs (model discovery), autoDelete.cjs and settingsTransfer.cjs.
• src/routes — dashboard.api.esm.js (the panel's REST surface under /dashboard/api) and stickers.api.esm.js.
• src/db — db.cjs wraps node:sqlite; store.cjs holds every query. src/utils/storage.cjs and .esm.js are the sync/async doors commands use.
• src/stickers — the Sticker Studio: library.cjs owns the catalog and deduplicated blobs under <data>/stickers/, with conversion helpers beside it.
• src/panel — the panel's own plumbing: session-store.cjs (bounded, expiring sessions), login-throttle.cjs, password-reset.cjs (one-time WhatsApp codes), session-auth.cjs, feedback.cjs.
• src/diagnostics — crashReports.cjs (sanitize and hold reports locally until reviewed), sanitize.cjs, device.cjs.
• frontend/ — a React 19 + Vite + Tailwind app (frontend/src/views/*.tsx). npm run build:frontend compiles it into public/dashboard.js and public/dashboard.css, which views/dashboard.ejs loads; public/ui-boot.js reads language and theme preferences before first paint.
• tests/ — real tests run by tests/run.mjs (each *.test.mjs in its own process, tmp data dir). scripts/ has the packaging (SEA executable via build-sea.mjs, tarball/Docker validators); deploy/levix.service is the hardened systemd unit the installer writes.