Major update bash install etc

main.py

@@ -1,9 +1,9 @@
 """
-Master Bot (Telethon) - Eval Userbot Edition
-- Users upload a valid .session file to register an assistant.
-- Assistant responds to '.val', '!val', or '/val' with Python evaluation.
-- Eval is STRICTLY limited to outgoing messages (the session owner).
-- Logs sent to LOG_CHANNEL_ID on silent mode errors.
+Master Bot (Telethon) - Eval & Plugin Userbot Edition
+- Upload a .session file to register an assistant.
+- Assistants respond to .val, .bash, /install, /promote, /demote, /help
+- Commands are restricted to the owner, the userbot account itself, and promoted users.
+- Dynamic plugin loading via /install.
 """
 
 import os
@@ -15,36 +15,39 @@ import inspect
 import sys
 import traceback
 import json
+import importlib.util
 from io import StringIO, BytesIO
 from datetime import datetime
 from typing import Dict, Any, Optional
 
+import telethon
 from telethon import TelegramClient, events, Button
 from telethon.utils import get_display_name
 
-# Used for Formatting Eval Code, if installed
 try:
     import black
 except ImportError:
     black = None
 
 # ---------------- CONFIG - EDIT THESE ----------------
-API_ID = 22138159           # <-- Replace with your API_ID
-API_HASH = "3fe4592e4cad72f366b6c564505f2d57" # <-- Replace with your API_HASH
+API_ID = 22138159
+API_HASH = "3fe4592e4cad72f366b6c564505f2d57"
 
 MASTER_BOT_SESSION = "master.session"
 DB_PATH = "masterbot.db"
 SESSIONS_DIR = "sessions"
+PLUGINS_DIR = "plugins"
 
 SUPER_ADMIN_ID = 7205748624
 LOG_CHANNEL_ID = -1002524453831
 
-CLIENT_IDLE_TIMEOUT = 60 * 60  # 1 hour
+CLIENT_IDLE_TIMEOUT = 60 * 60
 CLEANUP_INTERVAL = 15 * 60
 MAX_ACTIVE_CLIENTS = 60
 # ---------------- END CONFIG ----------------
 
 os.makedirs(SESSIONS_DIR, exist_ok=True)
+os.makedirs(PLUGINS_DIR, exist_ok=True)
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("masterbot")
 
@@ -129,7 +132,7 @@ def init_db():
         bot_username TEXT NOT NULL UNIQUE,
         token_encrypted BLOB NOT NULL,
         active INTEGER NOT NULL DEFAULT 1,
-        reply_text TEXT, -- Kept for legacy DB compatibility
+        reply_text TEXT,
         created_at TEXT NOT NULL
     );
     """)
@@ -140,6 +143,14 @@ def init_db():
         banned_at TEXT
     );
     """)
+    # New table for promoted users
+    cur.execute("""
+    CREATE TABLE IF NOT EXISTS sudoers (
+        bot_username TEXT NOT NULL,
+        user_id INTEGER NOT NULL,
+        UNIQUE(bot_username, user_id)
+    );
+    """)
     conn.commit()
     return conn
 
@@ -194,6 +205,22 @@ def db_is_banned(user_id: int) -> bool:
     cur.execute("SELECT 1 FROM bans WHERE user_id = ?", (user_id,))
     return cur.fetchone() is not None
 
+# Sudo Utilities
+def db_add_sudo(bot_username: str, user_id: int):
+    cur = db.cursor()
+    cur.execute("INSERT OR IGNORE INTO sudoers (bot_username, user_id) VALUES (?, ?)", (bot_username, user_id))
+    db.commit()
+
+def db_remove_sudo(bot_username: str, user_id: int):
+    cur = db.cursor()
+    cur.execute("DELETE FROM sudoers WHERE bot_username = ? AND user_id = ?", (bot_username, user_id))
+    db.commit()
+
+def db_get_sudos(bot_username: str):
+    cur = db.cursor()
+    cur.execute("SELECT user_id FROM sudoers WHERE bot_username = ?", (bot_username,))
+    return [row[0] for row in cur.fetchall()]
+
 def session_path_for_username(username: str) -> str:
     safe = username.replace("@", "")
     return os.path.join(SESSIONS_DIR, f"{safe}.session")
@@ -207,7 +234,7 @@ async def send_to_log_channel(text: str, file=None, parse_mode=None):
     except Exception:
         logger.exception("Failed to send log to channel")
 
-# ---------------- Assistant lifecycle & EVAL HANDLER ----------------
+# ---------------- Assistant lifecycle & COMMAND HANDLERS ----------------
 async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
     sess_path = session_path_for_username(bot_username)
     if not os.path.exists(sess_path):
@@ -220,19 +247,30 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
         if not await client.is_user_authorized():
             await client.disconnect()
             return False
+        me = await client.get_me()
+        bot_id = me.id
     except Exception as e:
         logger.exception("Failed to start assistant client for %s: %s", bot_username, e)
         return False
 
-    # Eval Handler - STRICTLY outgoing to prevent RCE by strangers
+    # Authorization check function
+    async def is_auth(event):
+        sender_id = event.sender_id
+        if sender_id == owner_id: return True # Master owner
+        if sender_id == bot_id: return True # The userbot itself
+        if sender_id in db_get_sudos(bot_username): return True # Promoted users
+        return False
+
+    # 1. VAL SCRIPT (Eval)
     @client.on(events.NewMessage(pattern=r"^[.\/!]val(?:\s|$)"))
     async def eval_handler(event):
+        if not await is_auth(event): return
+        
         try:
             cmd = event.text.split(maxsplit=1)[1]
         except IndexError:
             return await eor(event, "Please provide code to evaluate.")
-        
-        # Update last used state
+            
         async with assistant_lock:
             if bot_username in assistant_clients:
                 assistant_clients[bot_username]["last_used"] = time.time()
@@ -243,11 +281,10 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
 
         async def get_():
             try:
-                cm = cmd.split(maxsplit=1)[1]
+                return cmd.split(maxsplit=1)[1]
             except IndexError:
                 await eor(event, "->> Wrong Format <<-")
-                cm = None
-            return cm
+                return None
 
         if spli[0] in ["-s", "--silent"]:
             await event.delete()
@@ -260,10 +297,8 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
         elif spli[0] in ["-ga", "--args"]:
             mode = "g-args"
             
-        if mode:
-            cmd = await get_()
-        if not cmd:
-            return
+        if mode: cmd = await get_()
+        if not cmd: return
             
         if not mode == "silent" and not xx:
             xx = await eor(event, "Running...")
@@ -271,12 +306,10 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
         if black:
             try:
                 cmd = black.format_str(cmd, mode=black.Mode())
-            except BaseException:
-                pass
+            except BaseException: pass
                 
         reply_to_id = event.reply_to_msg_id or event
-        old_stderr = sys.stderr
-        old_stdout = sys.stdout
+        old_stderr, old_stdout = sys.stderr, sys.stdout
         redirected_output = sys.stdout = StringIO()
         redirected_error = sys.stderr = StringIO()
         stdout, stderr, exc, timeg = None, None, None, None
@@ -291,8 +324,7 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
         tima = time.time() - tima
         stdout = redirected_output.getvalue()
         stderr = redirected_error.getvalue()
-        sys.stdout = old_stdout
-        sys.stderr = old_stderr
+        sys.stdout, sys.stderr = old_stdout, old_stderr
         
         if value:
             try:
@@ -321,31 +353,158 @@ async def create_and_start_assistant(bot_username: str, owner_id: int) -> bool:
         tmt = tima * 1000
         timef = time_formatter(tmt)
         timeform = timef if not timef == "0s" else f"{tmt:.3f}ms"
-        final_output = "__►__ **EVAL** (__in {}__)\n```python\n{}``` \n\n __►__ **OUTPUT**: \n```\n{}``` \n".format(
-            timeform,
-            cmd,
-            evaluation,
-        )
+        final_output = "__►__ **EVAL** (__in {}__)\n```python\n{}``` \n\n __►__ **OUTPUT**: \n```\n{}``` \n".format(timeform, cmd, evaluation)
         
         if len(final_output) > 4096:
             final_output = evaluation
             with BytesIO(str.encode(final_output)) as out_file:
                 out_file.name = "eval.txt"
-                await client.send_file(
-                    event.chat_id,
-                    out_file,
-                    force_document=True,
-                    allow_cache=False,
-                    caption=f"```{cmd}```" if len(cmd) < 998 else None,
-                    reply_to=reply_to_id,
-                )
-            if xx:
-                return await xx.delete()
+                await client.send_file(event.chat_id, out_file, force_document=True, allow_cache=False, caption=f"```{cmd}```" if len(cmd) < 998 else None, reply_to=reply_to_id)
+            if xx: return await xx.delete()
             return
             
-        if xx:
-            await eor(xx, final_output)
+        if xx: await eor(xx, final_output)
+
+    # 2. BASH SCRIPT (Shell Execution)
+    @client.on(events.NewMessage(pattern=r"^[.\/!]bash(?:\s|$)"))
+    async def bash_handler(event):
+        if not await is_auth(event): return
+        
+        try:
+            cmd = event.text.split(maxsplit=1)[1]
+        except IndexError:
+            return await eor(event, "Please provide a shell command to execute.")
+            
+        xx = await eor(event, "`Executing bash command...`")
+        
+        try:
+            process = await asyncio.create_subprocess_shell(
+                cmd,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE
+            )
+            stdout, stderr = await process.communicate()
+            
+            output = stdout.decode().strip() or stderr.decode().strip() or "Command executed successfully with no output."
+            
+            final_output = f"**► BASH**\n```bash\n{cmd}```\n\n**► OUTPUT**\n```\n{output}```"
+            
+            if len(final_output) > 4000:
+                with BytesIO(output.encode()) as out_file:
+                    out_file.name = "bash_output.txt"
+                await client.send_file(event.chat_id, out_file, caption=f"`{cmd}`")
+                await xx.delete()
+            else:
+                await eor(xx, final_output)
+                
+        except Exception as e:
+            err = traceback.format_exc()
+            await eor(xx, f"**► BASH ERROR**\n```bash\n{cmd}```\n\n**► ERROR**\n```\n{err}```")
+            await send_to_log_channel(f"Bash Error on {bot_username}: {str(e)}")
+
+    # 3. INSTALL PLUGIN
+    @client.on(events.NewMessage(pattern=r"^[.\/!]install$"))
+    async def install_handler(event):
+        if not await is_auth(event): return
+        
+        if not event.is_reply:
+            example = (
+                "**How to use /install:**\n\n"
+                "1. Reply to a `.py` file containing Telethon code.\n"
+                "2. The file will be downloaded and its code loaded dynamically.\n\n"
+                "**Example Plugin:**\n"
+                "```python\n"
+                "@client.on(events.NewMessage(pattern='/ping'))\n"
+                "async def ping(event):\n"
+                "    await event.reply('Pong!')\n"
+                "```"
+            )
+            return await eor(event, example)
+            
+        reply = await event.get_reply_message()
+        if not reply.file or not reply.file.name.endswith('.py'):
+            return await eor(event, "Please reply to a valid `.py` Python script.")
+            
+        xx = await eor(event, "`Installing plugin...`")
+        
+        plugin_name = reply.file.name
+        bot_plugin_dir = os.path.join(PLUGINS_DIR, bot_username.replace("@", ""))
+        os.makedirs(bot_plugin_dir, exist_ok=True)
+        
+        file_path = os.path.join(bot_plugin_dir, plugin_name)
+        await reply.download_media(file=file_path)
+        
+        try:
+            # We inject 'client', 'events', and 'telethon' into the script's global namespace
+            # so the decorators in the raw script will attach directly to this specific assistant.
+            with open(file_path, "r", encoding="utf-8") as f:
+                code_str = f.read()
+                
+            exec_globals = {
+                "client": client,
+                "events": events,
+                "telethon": telethon,
+                "asyncio": asyncio,
+                "os": os,
+                "sys": sys
+            }
+            exec(code_str, exec_globals)
+            await eor(xx, f"✅ **Successfully installed module:** `{plugin_name}`")
+        except Exception as e:
+            err = traceback.format_exc()
+            await eor(xx, f"❌ **Failed to install {plugin_name}**\n\n```python\n{err}```")
+            if os.path.exists(file_path): os.remove(file_path)
+
+    # 4. PROMOTE / DEMOTE
+    @client.on(events.NewMessage(pattern=r"^[.\/!]promote(?:\s|$)"))
+    async def promote_handler(event):
+        if event.sender_id != owner_id and event.sender_id != bot_id:
+            return await eor(event, "Only the owner can promote users.")
+            
+        try:
+            target = event.text.split(maxsplit=1)[1]
+            entity = await client.get_entity(target)
+            db_add_sudo(bot_username, entity.id)
+            await eor(event, f"✅ Successfully promoted `{entity.first_name}` to sudo.")
+        except IndexError:
+            await eor(event, "Provide a username or user ID.")
+        except Exception as e:
+            await eor(event, f"Error: {str(e)}")
+
+    @client.on(events.NewMessage(pattern=r"^[.\/!]demote(?:\s|$)"))
+    async def demote_handler(event):
+        if event.sender_id != owner_id and event.sender_id != bot_id:
+            return await eor(event, "Only the owner can demote users.")
+            
+        try:
+            target = event.text.split(maxsplit=1)[1]
+            entity = await client.get_entity(target)
+            db_remove_sudo(bot_username, entity.id)
+            await eor(event, f"❌ Successfully demoted `{entity.first_name}`.")
+        except IndexError:
+            await eor(event, "Provide a username or user ID.")
+        except Exception as e:
+            await eor(event, f"Error: {str(e)}")
+
+    # 5. HELP COMMAND
+    @client.on(events.NewMessage(pattern=r"^[.\/!]help$"))
+    async def help_handler(event):
+        if not await is_auth(event): return
+        
+        help_text = (
+            f"🤖 **{bot_username} Assistant Help Menu**\n\n"
+            "**Core Commands:**\n"
+            "🔹 `.val <code>` - Evaluate Python code.\n"
+            "🔹 `.bash <code>` - Execute shell/terminal commands.\n"
+            "🔹 `/install` - Reply to a `.py` file to load custom code.\n\n"
+            "**Admin Commands (Owner Only):**\n"
+            "🔹 `/promote <id/username>` - Allow a user to use this bot's commands.\n"
+            "🔹 `/demote <id/username>` - Revoke user's access.\n\n"
+            "*(Note: Telegram user accounts cannot send inline buttons, which is why this is a text menu!)*"
+        )
+        await eor(event, help_text)
 
+    # --- Start Assistant Registration ---
     async with assistant_lock:
         if len(assistant_clients) >= MAX_ACTIVE_CLIENTS:
             await client.disconnect()
@@ -444,7 +603,7 @@ async def generic_handler(event):
             
             if success:
                 db_set_active(bot_username, True)
-                await msg.edit(f"✅ Registered {bot_username} successfully!\nYou can now use `.val` or `!val` from that account to run code.")
+                await msg.edit(f"✅ Registered {bot_username} successfully!\nYou can now use `.val`, `.bash` and `/help` from that account.")
                 await send_to_log_channel(f"Master: User {uid} registered {bot_username}.")
             else:
                 await msg.edit("Session valid, but failed to start client.")
@@ -529,4 +688,3 @@ async def main():
 
 if __name__ == "__main__":
     asyncio.run(main())
-