whatsapp_notifier 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee672e407c457abf3eb532be1e0b5bfe85df1ab20f29ac70f21613ff9c72085c
-  data.tar.gz: 321c228c35c0acfd7026571ae28997d9e58a0b326c6e49bec4962bfe714d54e2
+  metadata.gz: 819dcc600d0048b4dfc4c8af3536b6fc72c370f369eab26b9535da151693527c
+  data.tar.gz: f471a271b9fe8b855c4125993bf0e83b305f27f4e7ca748d685e27c6f5741081
 SHA512:
-  metadata.gz: 542cca0d3f0d17794d101e2771a924130b05442593ee45785050ad15925bdb8d6c4ed176cfc5928506d61166d7ad1151047d30337427d8618e5e69d8068e9245
-  data.tar.gz: 00cf38f2acd2c0b53eae892cf7bb35dec22303cb6d6a74c768b93585c6852b7df2c49eb4334d1906c654697fb98302a80d7778e172514887c235f9018b265cc5
+  metadata.gz: b7333fa14a494d7bdb1365888087a8c42befe27401b01845bc2cd257a7f2fbf010cdfae1a7fe944cfc104d71add24ec8a92fccaef6c7771e6cc5dce80dbbba93
+  data.tar.gz: 483341fc7e694da4c720eb805dace1279db52bb90c1fa195e227b1ff849b566aa8bca9ed9a616a28ea7165de73c0955a1d1343da12085cb8d10663bd9a5af7a2

data/lib/whatsapp_notifier/client.rb

@@ -55,6 +55,10 @@ module WhatsAppNotifier
       provider_for(provider || @configuration.provider).fetch_history(chat_id: chat_id, limit: limit, metadata: metadata)
     end
 
+    def resolve_lid(lid:, metadata: {}, provider: nil)
+      provider_for(provider || @configuration.provider).resolve_lid(lid: lid, metadata: metadata)
+    end
+
     def logout(metadata: {}, provider: nil)
       provider_for(provider || @configuration.provider).logout(metadata: metadata)
     end

data/lib/whatsapp_notifier/providers/web_automation.rb

@@ -118,6 +118,16 @@ module WhatsAppNotifier
         adapter.fetch_history(chat_id: chat_id, limit: limit, metadata: metadata)
       end
 
+      # Privacy-id resolution (v0.9.3) — same optional-capability guard.
+      def resolve_lid(lid:, metadata: {})
+        raise ConfigurationError, "web automation provider is disabled" unless configuration.web_automation_enabled
+
+        adapter = configuration.web_adapter
+        raise ConfigurationError, "web_adapter does not support @lid resolution (upgrade to a resolve_lid-capable adapter)" unless adapter.respond_to?(:resolve_lid)
+
+        adapter.resolve_lid(lid: lid, metadata: metadata)
+      end
+
       def logout(metadata: {})
         raise ConfigurationError, "web automation provider is disabled" unless configuration.web_automation_enabled
 

data/lib/whatsapp_notifier/services/web_automation/history.test.ts

@@ -16,6 +16,7 @@ import {
     historyResponse,
     findMessage,
     refetchResponse,
+    lidResolveResponse,
     type GatedClient,
     type HistoryDeps,
     type RefetchDeps
@@ -258,6 +259,44 @@ test('replayHistory resolves fromMe @lid counterparties to the requested chat id
     expect(resolveLidAlias('h1', LID)).toBe(CUST); // learned → live fromMe capture resolves too
 });
 
+// The other half of the same hole (0.9.3): only the fromMe leg was resolved,
+// so the CUSTOMER's own messages in an @lid-keyed chat were replayed carrying
+// the raw privacy id at `from`. The host strips the suffix and stores the
+// digits as a phone — the very thing the live leg now refuses to do.
+test('replayHistory resolves inbound @lid senders too, not just the fromMe leg', async () => {
+    const LID = '125417440686124@lid';
+    const history = await replayHistory('h1b', chatWith([
+        msg({ from: LID, body: 'customer says hi', id: { _serialized: 'c1' }, timestamp: 1 })
+    ]), 50, CUST);
+
+    expect(history.length).toBe(1);
+    expect(history[0].from).toBe(CUST);        // NOT 125417440686124@c.us
+    expect(history[0].senderLid).toBe(LID);
+    expect(resolveLidAlias('h1b', LID)).toBe(CUST);
+});
+
+test('replayHistory skips an inbound @lid it cannot resolve rather than forwarding the privacy id', async () => {
+    const LID = '125417440686124@lid';
+    // No requested chat id and no learned alias → nothing to resolve with.
+    const history = await replayHistory('h1c', chatWith([
+        msg({ from: LID, body: 'unmatchable', id: { _serialized: 'c1' }, timestamp: 1 })
+    ]), 50);
+
+    expect(history).toEqual([]);
+});
+
+test('replayHistory ignores a requested chat id that is really the privacy id itself', async () => {
+    const LID = '125417440686124@lid';
+    // A caller that passed the LID's own digits as the "phone" must not have
+    // that laundered into a resolution.
+    const history = await replayHistory('h1d', chatWith([
+        msg({ from: LID, body: 'nope', id: { _serialized: 'c1' }, timestamp: 1 })
+    ]), 50, '125417440686124@c.us');
+
+    expect(history).toEqual([]);
+    expect(resolveLidAlias('h1d', LID)).toBeUndefined();
+});
+
 test('replayHistory falls back to the learned alias map and skips unresolvable fromMe @lid items', async () => {
     const LID = '125417440686124@lid';
 
@@ -326,6 +365,56 @@ test('both routes enforce X-WA-Token before touching any client', async () => {
     expect(deps.getClientCalls).toBe(0);
 });
 
+// ── GET /contacts/lid/:userId (0.9.3) ──
+
+test('lidResolveResponse enforces the token and the pairing gate before any lookup', async () => {
+    const deps = depsWith(readyClient(), { hasPaired: () => { throw new Error('gate must not run'); } });
+    const denied = await lidResolveResponse('1', '125417440686124', 'wrong', 'expected', deps);
+    expect(denied.status).toBe(401);
+    expect(deps.getClientCalls).toBe(0);
+
+    const unpaired = depsWith(readyClient(), { hasPaired: () => false });
+    expect((await lidResolveResponse('1', '125417440686124', undefined, undefined, unpaired)).status).toBe(401);
+    expect(unpaired.getClientCalls).toBe(0);
+});
+
+test('lidResolveResponse rejects a missing lid with a 422 before the gate', async () => {
+    const deps = depsWith(readyClient(), { hasPaired: () => { throw new Error('gate must not run'); } });
+    const res = await lidResolveResponse('1', undefined, undefined, undefined, deps);
+    expect(res.status).toBe(422);
+});
+
+test('lidResolveResponse answers the phone behind a privacy id and learns the alias', async () => {
+    const LID = '125417440686124@lid';
+    const data = readyClient({
+        client: { getContactLidAndPhone: async () => [ { lid: LID, pn: CUST } ] }
+    });
+
+    // Bare digits are accepted and normalized to the @lid shape.
+    const res = await lidResolveResponse('lr1', '125417440686124', undefined, undefined, depsWith(data));
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, lid: LID, pn: CUST });
+    expect(resolveLidAlias('lr1', LID)).toBe(CUST);
+    expect(data.lastUsed).toBeGreaterThan(0);
+});
+
+test('lidResolveResponse answers pn: null (not 404) when the privacy id has no phone behind it', async () => {
+    const data = readyClient({
+        client: {
+            getContactLidAndPhone: async () => [ { lid: '125417440686124@lid', pn: null } ],
+            // The fallback reports only the LID's own digits — must not be laundered.
+            getContactById: async () => ({ id: { _serialized: '125417440686124@lid', user: '125417440686124' } })
+        }
+    });
+
+    const res = await lidResolveResponse('lr2', '125417440686124@lid', undefined, undefined, depsWith(data));
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ success: true, lid: '125417440686124@lid', pn: null });
+    expect(resolveLidAlias('lr2', '125417440686124@lid')).toBeUndefined();
+});
+
 test('both routes accept a matching token and stay open when none is configured', async () => {
     const deps = depsWith(readyClient());
 
@@ -460,7 +549,10 @@ test('historyResponse resolves fromMe @lid items in an @lid-keyed chat to the re
     const payload = await res.json();
     expect(payload.messages).toEqual([{
         from: OPERATOR, to: CUST, fromMe: true, body: 'No still not',
-        messageId: 'op1', timestamp: 1717000000, type: 'chat'
+        messageId: 'op1', timestamp: 1717000000, type: 'chat',
+        // 0.9.3 wire: the privacy id the counterparty was resolved FROM, so
+        // the host can tell a repaired LID chat from an ordinary phone chat.
+        senderLid: LID
     }]);
     expect(resolveLidAlias('h9', LID)).toBe(CUST);
 });

data/lib/whatsapp_notifier/services/web_automation/history.ts

@@ -15,7 +15,10 @@ import {
     shouldCapture,
     normalizeInbound,
     resolveLidAlias,
-    rememberLidAlias
+    rememberLidAlias,
+    isUsablePhoneFor,
+    resolveLidToPhone,
+    jidDigits
 } from './inbound';
 import { verifyMediaToken, MediaResolution, sanitizeId } from './media';
 
@@ -120,11 +123,21 @@ export async function replayHistory(
     for (const m of (Array.isArray(msgs) ? msgs : [])) {
         if (!shouldCapture(userId, m)) continue;
         const inbound = normalizeInbound(m, m.hasMedia ? historyMediaInfo() : undefined);
-        if (inbound.fromMe && inbound.to && inbound.to.endsWith('@lid')) {
-            const resolved = requestedChatId || resolveLidAlias(userId, inbound.to);
+        // BOTH legs need resolving. The fromMe leg carries the @lid at `to`;
+        // the customer's own messages in the same chat carry it at `from` —
+        // that half used to be replayed with the raw privacy id, which the
+        // host then stored as if it were a phone number. Same rule for both:
+        // resolve or skip, never forward an @lid.
+        const lidKey = inbound.fromMe ? 'to' : 'from';
+        const rawCounterparty = inbound[lidKey];
+        if (rawCounterparty && rawCounterparty.endsWith('@lid')) {
+            const resolved = (requestedChatId && isUsablePhoneFor(rawCounterparty, requestedChatId))
+                ? requestedChatId
+                : resolveLidAlias(userId, rawCounterparty);
             if (!resolved) continue;
-            if (requestedChatId) rememberLidAlias(userId, inbound.to, requestedChatId);
-            inbound.to = resolved;
+            rememberLidAlias(userId, rawCounterparty, resolved);
+            inbound[lidKey] = resolved;
+            inbound.senderLid = rawCounterparty;
         }
         out.push(inbound);
     }
@@ -236,6 +249,49 @@ export async function historyResponse(
     }
 }
 
+// ── Privacy-id resolution (GET /contacts/lid/:userId?lid=…) ──
+//
+// Exposes the same resolver the capture pipeline uses, for ONE privacy id, so
+// a host can repair threads it already keyed on an unresolved @lid (rows it
+// stored back when the inbound leg fabricated a phone out of the LID's own
+// digits). Read-only: it looks a contact up, learns the alias, and answers
+// with the phone — it never touches a message or a queue.
+//
+// Same X-WA-Token + paired-and-ready gate as /chats and /history: an @lid →
+// phone mapping identifies a real person and must not be readable by anyone
+// who can reach the port.
+export async function lidResolveResponse(
+    userId: string,
+    lidParam: string | undefined,
+    token: string | undefined,
+    expectedToken: string | undefined,
+    deps: SessionGateDeps
+): Promise<Response> {
+    if (!verifyMediaToken(token, expectedToken)) return deny(401, 'unauthorized');
+
+    // Accept bare digits or a full id, and normalize to the `<digits>@lid`
+    // shape the resolver expects. sanitizeId is media.ts's traversal/garbage
+    // guard — the value reaches a puppeteer lookup.
+    const digits = jidDigits(sanitizeId(String(lidParam || '')));
+    if (!digits) return deny(422, '`lid` is required');
+    const lid = `${digits}@lid`;
+
+    const gate = await gatePairedReady(userId, deps);
+    if (gate instanceof Response) return gate;
+
+    try {
+        const pn = await resolveLidToPhone(userId, lid, gate.client);
+        gate.lastUsed = Date.now();
+        // A miss is a 200 with pn: null, not a 404 — "this privacy id has no
+        // recoverable phone" is a real answer the repair task acts on, and it
+        // must be told apart from "the request was wrong".
+        return Response.json({ success: true, lid, pn });
+    } catch (error: any) {
+        console.error(`@lid resolve error for user ${userId}:`, error);
+        return deny(500, (error && error.message) || String(error));
+    }
+}
+
 // ── On-demand media re-download (POST /media/:userId/refetch) ──
 //
 // WhatsApp's tap-to-download model. Eager capture only keeps RECENT media

data/lib/whatsapp_notifier/services/web_automation/inbound.test.ts

@@ -22,6 +22,8 @@ import {
     normalizeInbound,
     processInbound,
     resetInboundState,
+    isUsablePhoneFor,
+    resolveLidToPhone,
     type ChatResolver,
     type InboundMsg
 } from './inbound';
@@ -333,6 +335,94 @@ test('processInbound resolves an @lid sender, then downloads for the kept messag
     expect(loadTargets('pi2').has(LID_FROM)).toBe(true);    // alias allowlisted for backfill
 });
 
+// ── The inbound @lid leg must never invent a phone number (0.9.3) ──
+//
+// Prod evidence 2026-08-13: CMS inbox rows titled `128539848396…`, an id no
+// customer record could ever match. For an @lid sender the contact object's
+// `id.user` IS the privacy id's digits, and the inbound leg trusted it
+// unconditionally — minting `<lid>@c.us` and forwarding it as a phone. The
+// fromMe leg had carried the guard since 0.8.x; only this leg was missing it.
+test('processInbound never mints a phone out of the @lid digits when the contact has no number', async () => {
+    const m = mediaMsg({
+        from: LID_FROM,
+        // Exactly what an @lid contact reports: no `number`, and an `id` whose
+        // `user` is the LID itself.
+        getContact: async () => ({
+            pushname: 'Asha',
+            id: { _serialized: LID_FROM, user: '125417440686124' }
+        })
+    });
+
+    await processInbound('lidguard', m, { resolveMedia: resolveMediaForMessage });
+
+    // Dropped, NOT forwarded as 125417440686124@c.us.
+    expect(drainInbound('lidguard')).toEqual([]);
+    // And the poison never reached the persisted alias map.
+    expect(resolveLidAlias('lidguard', LID_FROM)).toBeUndefined();
+});
+
+test('processInbound resolves an @lid sender through getContactLidAndPhone when the contact carries no phone', async () => {
+    useMediaRoot('media-lid-pn-api');
+    let asked: string[] = [];
+    const m = mediaMsg({
+        from: LID_FROM,
+        getContact: async () => ({ pushname: 'Asha', id: { _serialized: LID_FROM, user: '125417440686124' } }),
+        client: {
+            getContactLidAndPhone: async (ids: string[]) => {
+                asked = ids;
+                return [ { lid: LID_FROM, pn: CUST } ];
+            }
+        }
+    });
+
+    await processInbound('lidpn', m, { resolveMedia: resolveMediaForMessage });
+
+    const drained = drainInbound('lidpn');
+    expect(asked).toEqual([ LID_FROM ]);
+    expect(drained.length).toBe(1);
+    expect(drained[0].from).toBe(CUST);          // the real phone, from the 1.34.7 API
+    expect(drained[0].senderLid).toBe(LID_FROM); // and the id it came from
+    expect(resolveLidAlias('lidpn', LID_FROM)).toBe(CUST); // learned for the fromMe leg
+});
+
+test('isUsablePhoneFor rejects a self-referential or non-phone resolution', () => {
+    expect(isUsablePhoneFor(LID_FROM, CUST)).toBe(true);
+    expect(isUsablePhoneFor(LID_FROM, '125417440686124@c.us')).toBe(false); // the LID's own digits
+    expect(isUsablePhoneFor(LID_FROM, LID_FROM)).toBe(false);               // still an @lid
+    expect(isUsablePhoneFor(LID_FROM, '@c.us')).toBe(false);                // no digits
+});
+
+test('rememberLidAlias refuses to persist a self-referential alias', () => {
+    rememberLidAlias('poison', LID_FROM, '125417440686124@c.us');
+
+    expect(resolveLidAlias('poison', LID_FROM)).toBeUndefined();
+    expect(existsSync(join(dirFor('poison'), 'lid_aliases.json'))).toBe(false);
+});
+
+test('loadLidAliases drops a poisoned entry written by an older version', () => {
+    // A service already poisoned in production: the file on disk maps the LID
+    // to its own digits. It must not survive the read.
+    rememberLidAlias('healed', LID_FROM, CUST);          // one good entry, persisted
+    const file = join(dirFor('healed'), 'lid_aliases.json');
+    const onDisk = JSON.parse(readFileSync(file, 'utf8'));
+    onDisk['999888777666@lid'] = '999888777666@c.us';    // the poison
+    require('fs').writeFileSync(file, JSON.stringify(onDisk));
+    resetInboundState();
+    configureInbound(dirFor);
+
+    expect(resolveLidAlias('healed', LID_FROM)).toBe(CUST);          // good one kept
+    expect(resolveLidAlias('healed', '999888777666@lid')).toBeUndefined(); // poison ignored
+});
+
+test('resolveLidToPhone prefers the learned alias over any live lookup', async () => {
+    rememberLidAlias('order', LID_FROM, CUST);
+    let lookups = 0;
+    const client = { getContactLidAndPhone: async () => { lookups += 1; return []; } };
+
+    expect(await resolveLidToPhone('order', LID_FROM, client)).toBe(CUST);
+    expect(lookups).toBe(0); // no puppeteer roundtrip when the map already knows
+});
+
 test('processInbound keeps an @c.us message when the contact lookup fails', async () => {
     useMediaRoot('media-contact-fail');
     const m = msg({ getContact: async () => { throw new Error('boom'); } });

data/lib/whatsapp_notifier/services/web_automation/inbound.ts

@@ -37,6 +37,11 @@ export interface InboundMsg {
     // on. Inbound payloads keep the exact pre-0.8.0 shape.
     fromMe?: boolean;
     to?: string;
+    // 0.9.3. Present ONLY when the chat was keyed by a privacy id, carrying the
+    // raw `<digits>@lid` the phone/counterparty above was resolved FROM. Hosts
+    // that don't know the key ignore it; ours uses it to tell a resolved LID
+    // chat apart from an ordinary phone chat when auditing a thread's origin.
+    senderLid?: string;
 }
 
 // Media verdict merged into the payload by captureInbound — structurally
@@ -88,7 +93,13 @@ export function loadLidAliases(userId: string): Map<string, string> {
             const obj = JSON.parse(readFileSync(p, 'utf8'));
             if (obj && typeof obj === 'object' && !Array.isArray(obj)) {
                 for (const [lid, phone] of Object.entries(obj)) {
-                    if (typeof phone === 'string') map.set(lid, phone);
+                    // Self-referential entries written by earlier versions
+                    // (<lid> → <lid>@c.us) are dropped on the way in, so a
+                    // service that has already been poisoned recovers on its
+                    // next start instead of needing the file edited by hand.
+                    // The purge reaches disk on the next rememberLidAlias
+                    // write, which persists the whole map.
+                    if (typeof phone === 'string' && isUsablePhoneFor(lid, phone)) map.set(lid, phone);
                 }
             }
         }
@@ -117,6 +128,29 @@ export function loadTargets(userId: string): Set<string> {
     return set;
 }
 
+// The digits of a jid's user part, for comparing a privacy id against a
+// candidate phone number.
+export function jidDigits(jid: string): string {
+    return String(jid || '').split('@')[0].replace(/\D/g, '');
+}
+
+// THE invariant of the whole @lid layer: a resolution is only usable when it
+// is a phone chat id AND its digits are not simply the privacy id's own digits
+// wearing a @c.us suffix.
+//
+// A @lid contact frequently reports `contact.id.user` (and sometimes
+// `contact.number`) as the LID itself. Accepting that mints a phone number
+// that has never existed: the host opens a thread keyed on it, no customer
+// record can ever match, the operator sees an unreadable row of digits, and
+// the alias map learns <lid> → <lid>@c.us — permanently routing the operator's
+// own replies into that phantom thread. Every resolution path funnels through
+// this check, so the class cannot come back one caller at a time.
+export function isUsablePhoneFor(lid: string, resolved: string): boolean {
+    if (!resolved || !resolved.endsWith('@c.us')) return false;
+    const digits = jidDigits(resolved);
+    return digits.length > 0 && digits !== jidDigits(lid);
+}
+
 // After an @lid is resolved to a phone @c.us, two things are remembered:
 //
 // 1. The @lid → phone mapping itself (persisted, see lidAliases): the fromMe
@@ -129,8 +163,13 @@ export function loadTargets(userId: string): Set<string> {
 //    re-open that chat, permanently losing any disconnect-window replies.
 //    Duplicate captures across the @c.us/@lid pair are fine: the contract is
 //    at-least-once and the host dedupes on messageId.
+//
+// A resolution that fails isUsablePhoneFor is never stored: a poisoned alias
+// outlives the process (it is persisted) and would keep re-infecting every
+// later message in the chat.
 export function rememberLidAlias(userId: string, rawFrom: string, resolvedFrom: string) {
     if (!rawFrom.endsWith('@lid')) return;
+    if (!isUsablePhoneFor(rawFrom, resolvedFrom)) return;
     const aliases = loadLidAliases(userId);
     if (aliases.get(rawFrom) !== resolvedFrom) {
         aliases.set(rawFrom, resolvedFrom);
@@ -304,17 +343,21 @@ export async function processInbound(userId: string, msg: any, deps: CaptureDeps
 
     // Resolve the sender BEFORE downloading media. Newer WhatsApp delivers
     // the reply's `from` as an @lid privacy id with no phone number, which
-    // the host can't match; if the contact can't supply the real phone the
-    // message is dropped — and a dropped message must not have cost a
-    // download that leaves up to 25MB of unreferenced bytes on disk.
+    // the host can't match; if no phone can be recovered the message is
+    // dropped — and a dropped message must not have cost a download that
+    // leaves up to 25MB of unreferenced bytes on disk.
     const rawFrom: string = msg.from || '';
     let from = rawFrom;
     if (rawFrom.endsWith('@lid')) {
-        const num = contact && (contact.number || (contact.id && contact.id.user));
-        if (num) from = `${String(num).replace(/\D/g, '')}@c.us`;
-        // Still an @lid => no phone to match or scope by. Drop it rather than
-        // forward an unmatchable, unpurgeable plaintext body.
-        if (from.endsWith('@lid')) return;
+        const resolved = await resolveLidToPhone(userId, rawFrom, msg.client, contact);
+        // No phone behind the privacy id => nothing to match or scope by.
+        // Drop it rather than forward an unmatchable counterparty — or, worse,
+        // the privacy id's own digits dressed up as a phone number.
+        if (!resolved) {
+            console.log(`Dropping inbound message from unresolved @lid chat for ${userId}`);
+            return;
+        }
+        from = resolved;
     }
 
     // Only a kept message earns the download. Every resolver failure mode
@@ -332,7 +375,10 @@ export async function processInbound(userId: string, msg: any, deps: CaptureDeps
     if (rawFrom.endsWith('@lid')) {
         // Known recipient replying from a privacy-number chat: allowlist the
         // @lid chat id too, so the reconnect backfill can re-open this chat.
+        // (resolveLidToPhone already learned the alias; this is the allowlist
+        // half, and re-learning an identical mapping is a no-op.)
         rememberLidAlias(userId, rawFrom, from);
+        inbound.senderLid = rawFrom;
     }
 
     enqueueInbound(userId, inbound);
@@ -359,15 +405,16 @@ async function processOwnMessage(userId: string, msg: any, deps: CaptureDeps) {
     // operator-phone message in such a chat used to hit an unconditional
     // drop while the customer's side flowed — half the conversation lost.
     // Resolve it instead, BEFORE any media download (a dropped message must
-    // not have cost one): the alias map the inbound leg learns first, then
-    // one guarded live lookup. Only when both fail is the message dropped —
-    // now the rare case, not every @lid-keyed chat.
+    // not have cost one), through the same resolver the inbound leg uses.
+    // Only when every path fails is the message dropped — the rare case, not
+    // every @lid-keyed chat.
     if (rawTo.endsWith('@lid')) {
-        to = resolveLidAlias(userId, rawTo) || await resolveOwnLidCounterparty(userId, rawTo, msg) || '';
-        if (!to) {
+        const resolved = await resolveLidToPhone(userId, rawTo, msg.client);
+        if (!resolved) {
             console.log(`Dropping fromMe message to unresolved @lid chat for ${userId}`);
             return;
         }
+        to = resolved;
     }
 
     // Same kept-message-earns-the-download rule as inbound: every resolver
@@ -391,37 +438,101 @@ async function processOwnMessage(userId: string, msg: any, deps: CaptureDeps) {
     // chat the alias call ALSO allowlists the @lid id itself — the id the
     // chat is actually reachable by (see rememberLidAlias).
     rememberTarget(userId, to);
-    if (rawTo.endsWith('@lid')) rememberLidAlias(userId, rawTo, to);
+    if (rawTo.endsWith('@lid')) {
+        rememberLidAlias(userId, rawTo, to);
+        inbound.senderLid = rawTo;
+    }
 
     enqueueInbound(userId, inbound);
     if (deps.push) deps.push(userId, inbound);
 }
 
-// Live fallback for a fromMe @lid counterparty with no learned alias yet
-// (e.g. right after a restart, before the customer writes again). Every wwebjs
-// Message carries its Client, and client.getContactById(<@lid>) is the exact
-// call the inbound leg's msg.getContact() makes for @lid senders — the one
-// path proven to yield the real phone in production. One roundtrip, guarded;
-// a hit is fed into rememberLidAlias so the next fromMe message resolves from
-// the map. contact.id.user is trusted only when the contact id itself is
-// phone-keyed — an @lid contact id would otherwise mint a bogus "phone" out
-// of the privacy id's own digits.
-async function resolveOwnLidCounterparty(userId: string, rawTo: string, msg: any): Promise<string | null> {
-    try {
-        const client = msg.client;
-        if (!client || typeof client.getContactById !== 'function') return null;
-        const contact = await client.getContactById(rawTo);
-        const num = contact && (contact.number ||
-            (contact.id && String(contact.id._serialized || '').endsWith('@c.us') && contact.id.user));
-        const digits = num ? String(num).replace(/\D/g, '') : '';
-        if (!digits) return null;
-        const resolved = `${digits}@c.us`;
-        rememberLidAlias(userId, rawTo, resolved);
-        return resolved;
-    } catch (e) {
-        console.error(`fromMe @lid contact lookup failed for ${userId}`, e);
-        return null;
+// A contact's phone chat id, or null. contact.number is the contact's own
+// phone; contact.id.user is trusted ONLY when the contact id is itself
+// phone-keyed, because for an @lid contact that field IS the privacy id.
+// Both answers still face isUsablePhoneFor at the call site.
+function phoneFromContact(contact: any): string | null {
+    if (!contact) return null;
+    const serialized = String((contact.id && contact.id._serialized) || '');
+    const num = contact.number ||
+        (serialized.endsWith('@c.us') && contact.id && contact.id.user);
+    const digits = num ? String(num).replace(/\D/g, '') : '';
+    return digits ? `${digits}@c.us` : null;
+}
+
+// One live lookup of the phone behind a privacy id, newest API first:
+//
+//   getContactLidAndPhone  — whatsapp-web.js 1.34.7's purpose-built LID↔PN
+//                            resolver (WWebJS.enforceLidAndPnRetrieval). This
+//                            is the authoritative answer and the reason a
+//                            phone can now be recovered even when the contact
+//                            object carries nothing but the LID.
+//   getContactById         — the older path, kept as the fallback for a client
+//                            that predates the API or returns no mapping.
+//
+// Every failure is swallowed: a lookup that cannot answer must degrade to
+// "unresolved" (the message is then dropped), never throw into the pipeline.
+async function lookupPhoneForLid(client: any, lid: string): Promise<string | null> {
+    if (!client) return null;
+
+    if (typeof client.getContactLidAndPhone === 'function') {
+        try {
+            const rows = await client.getContactLidAndPhone([ lid ]);
+            const pn = Array.isArray(rows) && rows[0] && rows[0].pn;
+            const digits = jidDigits(String(pn || ''));
+            if (digits) return `${digits}@c.us`;
+        } catch (e) {
+            console.error(`getContactLidAndPhone failed for ${lid}`, e);
+        }
+    }
+
+    if (typeof client.getContactById === 'function') {
+        try {
+            return phoneFromContact(await client.getContactById(lid));
+        } catch (e) {
+            console.error(`@lid contact lookup failed for ${lid}`, e);
+        }
+    }
+
+    return null;
+}
+
+// THE single @lid → phone resolver, shared by the inbound leg, the operator
+// (fromMe) leg and history replay. It exists because those three grew separate
+// copies and they drifted: the fromMe copy guarded against trusting an @lid
+// contact id, the inbound copy did not, and so every privacy-keyed chat that
+// arrived customer-first was threaded onto a fabricated phone number.
+//
+// Order is cheapest-and-most-trusted first:
+//   1. the learned alias map — free, already proven for this chat;
+//   2. the contact object the caller already fetched — free, no extra roundtrip;
+//   3. one live lookup — a puppeteer roundtrip, so last.
+//
+// Anything that survives isUsablePhoneFor is learned for next time. A null
+// return means "no phone behind this privacy id", and every caller drops the
+// message rather than forward a counterparty the host can never match.
+export async function resolveLidToPhone(
+    userId: string,
+    lid: string,
+    client?: any,
+    contact?: any
+): Promise<string | null> {
+    const learned = resolveLidAlias(userId, lid);
+    if (learned && isUsablePhoneFor(lid, learned)) return learned;
+
+    const fromContact = phoneFromContact(contact);
+    if (fromContact && isUsablePhoneFor(lid, fromContact)) {
+        rememberLidAlias(userId, lid, fromContact);
+        return fromContact;
+    }
+
+    const looked = await lookupPhoneForLid(client, lid);
+    if (looked && isUsablePhoneFor(lid, looked)) {
+        rememberLidAlias(userId, lid, looked);
+        return looked;
     }
+
+    return null;
 }
 
 // Minimal slice of whatsapp-web.js Client that backfill needs — a seam so the

data/lib/whatsapp_notifier/services/web_automation/index.ts

@@ -24,7 +24,7 @@ import {
     clearInbound,
     processInbound
 } from './inbound';
-import { chatsResponse, historyResponse, refetchResponse, HistoryDeps, RefetchDeps } from './history';
+import { chatsResponse, historyResponse, refetchResponse, lidResolveResponse, HistoryDeps, RefetchDeps } from './history';
 import {
     configureMedia,
     resolveMediaForMessage,
@@ -689,6 +689,18 @@ app.post('/history/:userId', async (c) =>
         historyDeps
     ));
 
+// GET /contacts/lid/:userId?lid=… — resolve one privacy id to the phone behind
+// it, for a host repairing threads it keyed on an unresolved @lid. Token-gated
+// and paired+ready gated like /chats (see history.ts).
+app.get('/contacts/lid/:userId', (c) =>
+    lidResolveResponse(
+        c.req.param('userId'),
+        c.req.query('lid'),
+        c.req.header('X-WA-Token'),
+        WEBHOOK_TOKEN,
+        historyDeps
+    ));
+
 // POST /media/:userId/refetch { messageId, chatId } — WhatsApp tap-to-download.
 // The host calls this when an operator opens an evicted/expired media bubble:
 // re-pull THAT message's bytes on demand, store them (cap re-enforced), and

data/lib/whatsapp_notifier/version.rb

@@ -1,4 +1,4 @@
 module WhatsAppNotifier
-  VERSION = "0.9.2"
+  VERSION = "0.9.3"
 
 end

data/lib/whatsapp_notifier/web_adapter.rb

@@ -34,7 +34,12 @@ module WhatsAppNotifier
       media_size: %w[mediaSize media_size],
       sender_name: %w[senderName sender_name],
       to: %w[to],
-      from_me: %w[fromMe from_me]
+      from_me: %w[fromMe from_me],
+      # 0.9.3: the `<digits>@lid` privacy id the counterparty above was
+      # RESOLVED FROM, present only for a privacy-keyed chat. The phone in
+      # from/to is always a real phone — this says where it came from, so a
+      # host can audit a thread's origin. Never a value to thread on.
+      sender_lid: %w[senderLid sender_lid]
     }.freeze
 
     def self.default_base_url
@@ -183,6 +188,27 @@ module WhatsAppNotifier
       Array(response["messages"]).map { |m| map_inbound_message(m) }
     end
 
+    # Resolves ONE WhatsApp privacy id (`@lid`) to the phone number behind it,
+    # returning the bare digits or nil when nothing is recoverable.
+    #
+    # Hosts need this to repair conversations they keyed on an unresolved
+    # privacy id — rows written when the service still fabricated a "phone"
+    # out of the LID's own digits (fixed in 0.9.3). Live capture resolves on
+    # its own; this is the backward-looking half.
+    #
+    # nil is a real answer ("no phone behind this id"), not an error: the
+    # service replies 200 with pn: null, and only a transport/gate failure
+    # raises.
+    def resolve_lid(lid:, metadata: {})
+      user_id = user_id_from(metadata)
+      digits = lid.to_s.split("@").first.to_s.gsub(/\D/, "")
+      return nil if digits.empty?
+
+      response = request(:get, "/contacts/lid/#{user_id}?lid=#{digits}")
+      resolved = response["pn"].to_s.split("@").first.to_s.gsub(/\D/, "")
+      resolved.empty? ? nil : resolved
+    end
+
     # Logs the user out of WhatsApp and clears their saved session on the service.
     def logout(metadata: {})
       user_id = user_id_from(metadata)

data/lib/whatsapp_notifier.rb

@@ -97,6 +97,10 @@ module WhatsAppNotifier
       client.fetch_history(chat_id: chat_id, limit: limit, provider: provider, metadata: metadata)
     end
 
+    def resolve_lid(lid:, provider: nil, metadata: {})
+      client.resolve_lid(lid: lid, provider: provider, metadata: metadata)
+    end
+
     def logout(provider: nil, metadata: {})
       client.logout(provider: provider, metadata: metadata)
     end

data/spec/client_spec.rb

@@ -91,7 +91,7 @@ RSpec.describe WhatsAppNotifier::Client do
     end
   end
 
-  it "delegates list_chats and fetch_history to the provider" do
+  it "delegates list_chats, fetch_history and resolve_lid to the provider" do
     Dir.mktmpdir do |dir|
       config.provider = :web_automation
       config.web_automation_enabled = true
@@ -101,7 +101,8 @@ RSpec.describe WhatsAppNotifier::Client do
         fetch_qr_code: "qr",
         connection_status: { state: "AUTHENTICATED", authenticated: true },
         list_chats: [{ id: "919@c.us", name: "Asha", last_message_at: 9 }],
-        fetch_history: [{ from: "919@c.us", body: "old", message_id: "h1" }]
+        fetch_history: [{ from: "919@c.us", body: "old", message_id: "h1" }],
+        resolve_lid: "919882536803"
       )
       config.web_adapter = adapter
       client = described_class.new(configuration: config)
@@ -110,6 +111,8 @@ RSpec.describe WhatsAppNotifier::Client do
         .to eq([{ id: "919@c.us", name: "Asha", last_message_at: 9 }])
       expect(client.fetch_history(chat_id: "919@c.us", provider: :web_automation, metadata: { user_id: 1 }))
         .to eq([{ from: "919@c.us", body: "old", message_id: "h1" }])
+      expect(client.resolve_lid(lid: "125417440686124@lid", provider: :web_automation, metadata: { user_id: 1 }))
+        .to eq("919882536803")
       # The default page size survives the delegation chain untouched.
       expect(adapter).to have_received(:fetch_history).with(chat_id: "919@c.us", limit: 50, metadata: { user_id: 1 })
     end

data/spec/providers/web_automation_spec.rb

@@ -249,11 +249,13 @@ RSpec.describe WhatsAppNotifier::Providers::WebAutomation do
       adapter = double(
         fetch_qr_code: "qr", connection_status: {},
         list_chats: [{ id: "919@c.us", name: "Asha", last_message_at: 9 }],
-        fetch_history: [{ from: "919@c.us", body: "old", message_id: "h1" }]
+        fetch_history: [{ from: "919@c.us", body: "old", message_id: "h1" }],
+        resolve_lid: "919882536803"
       )
       config = build_config(path: File.join(dir, "session.json"), adapter: adapter)
       provider = described_class.new(configuration: config)
 
+      expect(provider.resolve_lid(lid: "125417440686124@lid", metadata: { user_id: 1 })).to eq("919882536803")
       expect(provider.list_chats(metadata: { user_id: 1 })).to eq([{ id: "919@c.us", name: "Asha", last_message_at: 9 }])
       expect(provider.fetch_history(chat_id: "919@c.us", limit: 20, metadata: { user_id: 1 }))
         .to eq([{ from: "919@c.us", body: "old", message_id: "h1" }])
@@ -282,6 +284,7 @@ RSpec.describe WhatsAppNotifier::Providers::WebAutomation do
 
       expect { provider.list_chats }.to raise_error(WhatsAppNotifier::ConfigurationError, /disabled/)
       expect { provider.fetch_history(chat_id: "919@c.us") }.to raise_error(WhatsAppNotifier::ConfigurationError, /disabled/)
+      expect { provider.resolve_lid(lid: "1@lid") }.to raise_error(WhatsAppNotifier::ConfigurationError, /disabled/)
     end
   end
 
@@ -293,6 +296,7 @@ RSpec.describe WhatsAppNotifier::Providers::WebAutomation do
 
       expect { provider.list_chats }.to raise_error(WhatsAppNotifier::ConfigurationError, /chat listing/)
       expect { provider.fetch_history(chat_id: "919@c.us") }.to raise_error(WhatsAppNotifier::ConfigurationError, /history replay/)
+      expect { provider.resolve_lid(lid: "1@lid") }.to raise_error(WhatsAppNotifier::ConfigurationError, /@lid resolution/)
     end
   end
 

data/spec/web_adapter_spec.rb

@@ -454,6 +454,37 @@ RSpec.describe WhatsAppNotifier::WebAdapter do
       .to raise_error(/service request failed \(401\): User not authenticated/)
   end
 
+  # Privacy-id resolution (0.9.3): the half a host needs to repair threads it
+  # already keyed on an unresolved @lid.
+  it "resolves a privacy id to bare phone digits" do
+    allow(ENV).to receive(:[]).and_call_original
+    allow(ENV).to receive(:[]).with("WHATSAPP_WEBHOOK_TOKEN").and_return("sekrit")
+    response = http_success(body: { "success" => true, "lid" => "125417440686124@lid", "pn" => "919882536803@c.us" })
+    captured = nil
+    http = double("http")
+    allow(http).to receive(:request) { |req| captured = req; response }
+    allow(Net::HTTP).to receive(:start) { |*_args, **_kwargs, &blk| blk.call(http) }
+
+    expect(adapter.resolve_lid(lid: "125417440686124@lid", metadata: { user_id: "u-1" }))
+      .to eq("919882536803")
+    expect(captured).to be_a(Net::HTTP::Get)
+    expect(captured.path).to eq("/contacts/lid/u-1?lid=125417440686124")
+    expect(captured["X-WA-Token"]).to eq("sekrit")
+  end
+
+  it "returns nil when the privacy id has no phone behind it" do
+    allow(Net::HTTP).to receive(:start)
+      .and_return(http_success(body: { "success" => true, "lid" => "1@lid", "pn" => nil }))
+
+    expect(adapter.resolve_lid(lid: "125417440686124", metadata: {})).to be_nil
+  end
+
+  it "does not call the service for a lid with no digits" do
+    expect(Net::HTTP).not_to receive(:start)
+
+    expect(adapter.resolve_lid(lid: "@lid", metadata: {})).to be_nil
+  end
+
   it "fetches history with the token, posting the chat id and clamped limit" do
     allow(ENV).to receive(:[]).and_call_original
     allow(ENV).to receive(:[]).with("WHATSAPP_WEBHOOK_TOKEN").and_return("sekrit")

data/spec/whatsapp_notifier_spec.rb

@@ -99,6 +99,7 @@ RSpec.describe WhatsAppNotifier do
     allow(fake_client).to receive(:refetch_media).and_return(mime: "image/jpeg", filename: nil, size: 5, status: "available")
     allow(fake_client).to receive(:list_chats).and_return([{ id: "919@c.us", name: "Asha", last_message_at: 9 }])
     allow(fake_client).to receive(:fetch_history).and_return([{ from: "919@c.us", body: "old", message_id: "h1" }])
+    allow(fake_client).to receive(:resolve_lid).and_return("919882536803")
     allow(fake_client).to receive(:logout).and_return(success: true)
     described_class.instance_variable_set(:@client, fake_client)
 
@@ -111,6 +112,7 @@ RSpec.describe WhatsAppNotifier do
     expect(described_class.refetch_media(message_id: "m1", chat_id: "919@c.us", provider: :web_automation, metadata: { user_id: 1 })).to include(status: "available")
     expect(described_class.list_chats(provider: :web_automation, metadata: { user_id: 1 })).to eq([{ id: "919@c.us", name: "Asha", last_message_at: 9 }])
     expect(described_class.fetch_history(chat_id: "919@c.us", limit: 20, provider: :web_automation, metadata: { user_id: 1 })).to eq([{ from: "919@c.us", body: "old", message_id: "h1" }])
+    expect(described_class.resolve_lid(lid: "125417440686124@lid", provider: :web_automation, metadata: { user_id: 1 })).to eq("919882536803")
     expect(described_class.logout(provider: :web_automation, metadata: { user_id: 1 })).to eq(success: true)
     expect(fake_client).to have_received(:fetch_media).with(message_id: "m1", provider: :web_automation, metadata: { user_id: 1 })
     expect(fake_client).to have_received(:delete_media).with(message_id: "m1", provider: :web_automation, metadata: { user_id: 1 })

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: whatsapp_notifier
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - Kshitiz Sinha