whalibmob 5.10.0 → 5.10.3

package/README.md

@@ -1449,6 +1449,25 @@ client.on('account_restriction', (r) => {
 > client-side shortens it; the only thing that helps is not sending more
 > unanswered first messages while it is on.
 
+> [!WARNING]
+> **Some servers answer this query in Argo, not JSON.** Argo is Meta's binary
+> GraphQL encoding, and this library cannot read it. When that happens
+> `fetchReachoutTimelock()` throws with `err.mexFormat === 'argo'` and the raw
+> bytes on `err.mexPayload`.
+>
+> Do not add a `format` attribute to the query in the hope of getting JSON — it
+> was tried against a live server, which responded by dropping the stanza
+> entirely. An answer in a format you cannot read still beats no answer.
+>
+> It never guesses. Reporting "not restricted" from an answer nobody decoded
+> would have you send more messages and make the restriction longer, so an
+> unreadable reply is an error rather than an all-clear.
+>
+> The `account_restriction` event is unaffected: the server *announces* a
+> restriction starting and lifting, and those announcements arrive as readable
+> JSON on a different route. Keep a listener attached and you will still be
+> told, with the countdown, without ever calling the query.
+
 ### What Is Automatic vs What You Need to Do
 
 **Everything in the "Automatic" column requires zero code from you.**
@@ -3247,6 +3266,39 @@ For the numbers without the countdown:
 wa> /restriction --once
 ```
 
+To check the display without waiting to be restricted, `--demo` counts down a
+made-up restriction. Nothing is sent, nothing is asked of the server, and
+nothing is left behind when it ends:
+
+```sh
+wa> /restriction --demo
+  ──────────────────────────────────────────────────
+  status                RESTRICTED  (demo — not real)
+  reason                too many people you messaged blocked or reported you
+  remaining             05:00:00
+  ──────────────────────────────────────────────────
+  press any key to stop watching
+  restricted — 04:59:57 remaining
+```
+
+`--demo 90` uses ninety seconds instead of the default five hours, which is
+short enough to watch it reach zero and stop on its own.
+
+If your server encodes this answer in Argo, the command says so rather than
+guessing — and points you at the announcements, which stay readable:
+
+```sh
+wa> /restriction
+checking account restriction...
+error: mex query 23983697327930364: the server answered in "argo" rather than JSON, which this library cannot read (10 bytes: 0402300c000002010303)
+
+  The query itself worked — your server encodes this answer in a binary
+  format this library cannot read yet, so the countdown cannot be polled.
+
+  You will still be told about a restriction: the server announces one when
+  it starts and when it lifts, and those announcements do arrive readable.
+```
+
 An account that is fine says so and returns immediately:
 
 ```sh
@@ -3764,6 +3816,7 @@ wa> /quit
 | `/appstate --snapshot` | Re-read all app state from scratch |
 | `/restriction` | Account restriction status with a live countdown |
 | `/restriction --once` | Restriction status without the countdown |
+| `/restriction --demo [seconds]` | Fake countdown, to check the display |
 | `/limit` | Alias for `/restriction` |
 | `/ephemeral <jid> <seconds>` | Set disappearing messages timer for a chat |
 | `/ephemeral-default <seconds>` | Set global default ephemeral timer for new chats |

package/cli.js

@@ -478,6 +478,7 @@ const HELP = `
     /appstate  --snapshot                    re-read all of it from scratch
     /restriction                             account restriction + live countdown
     /restriction --once                      just the numbers, no countdown
+    /restriction --demo [seconds]            fake countdown to check the display
     /ephemeral         <jid> <seconds>        set disappearing timer for chat
     /ephemeral-default <seconds>             set default timer for ALL new chats
     /block     <jid>                         block contact
@@ -1479,10 +1480,62 @@ async function handleLine(line) {
 
       case '/restriction':
       case '/limit': {
+        // --demo feeds a made-up restriction into this session and counts it
+        // down, so the display can be checked without waiting to be restricted.
+        // Nothing is sent and nothing is asked of the server.
+        const demoAt = p.indexOf('--demo');
+        if (demoAt !== -1) {
+          const secs = parseInt(p[demoAt + 1], 10) || 5 * 3600;
+          const { parseTimelockPayload } = require('./lib/ReachoutTimelock');
+          if (!_client) { fail('/restriction --demo needs a client; use /connect first'); break; }
+          const fake = parseTimelockPayload({
+            is_active: true,
+            time_enforcement_ends: String(Math.floor(Date.now() / 1000) + secs),
+            enforcement_type: 'BIZ_QUALITY'
+          });
+          const shown = _client._setReachoutTimelock(fake, 'demo');
+          hr();
+          kv('status',    'RESTRICTED  (demo — not real)');
+          kv('reason',    shown.reason);
+          kv('remaining', shown.remaining);
+          hr();
+          _rl && _rl.pause();
+          await countdown(_client, shown);
+          _rl && _rl.resume();
+          // Leave nothing behind that a later check could mistake for real.
+          _client._reachoutTimelock = null;
+          out('  demo over — nothing was recorded');
+          break;
+        }
+
         requireConn();
         const watch = !p.includes('--once');
         out('checking account restriction...');
-        const st = await _client.fetchReachoutTimelock();
+        let st;
+        try {
+          st = await _client.fetchReachoutTimelock();
+        } catch (e) {
+          fail(e.message);
+          if (e.mexFormat) {
+            out('');
+            out('  The query itself worked — your server encodes this answer in a binary');
+            out('  format this library cannot read yet, so the countdown cannot be polled.');
+            out('');
+            out('  You will still be told about a restriction: the server announces one when');
+            out('  it starts and when it lifts, and those announcements do arrive readable.');
+            out('  Leave the session connected and watch for:');
+            out('    ACCOUNT RESTRICTED — <reason>, HH:MM:SS remaining');
+            out('');
+            out('  The payload above is worth keeping. Run this again while the account IS');
+            out('  restricted: the two payloads differ only where the answer differs, which');
+            out('  is what makes this format readable without its schema.');
+          } else {
+            out('');
+            out('  If the reply is sketched above, paste that line when reporting this —');
+            out('  it is the server\'s actual answer. Run with --debug for the raw stanza.');
+          }
+          break;
+        }
         hr();
         if (!st.active) {
           kv('status', 'not restricted — you can start new chats');

package/lib/Client.js

@@ -177,6 +177,39 @@ function findChildDeep(node, desc) {
   return null;
 }
 
+// A one-line sketch of a stanza, for an error message that has to be useful to
+// somebody who cannot see the wire. Shows the tag tree and a short preview of
+// any content, so an unexpected reply can be reported rather than guessed at.
+function describeNodeBriefly(node, depth) {
+  if (!node) return '(nothing)';
+  depth = depth || 0;
+  const attrs = Object.entries(node.attrs || {})
+    .map(([k, v]) => k + '=' + String(v))
+    .join(' ');
+  let out = '<' + node.description + (attrs ? ' ' + attrs : '');
+
+  if (Array.isArray(node.content)) {
+    if (depth >= 3) return out + ' …>';
+    const kids = node.content
+      .filter(c => c && c.description)
+      .map(c => describeNodeBriefly(c, depth + 1));
+    return out + '>' + kids.join('');
+  }
+
+  const buf = getNodeContent(node);
+  if (buf && buf.length) {
+    const text = buf.toString('utf8');
+    // Printable content is far more use than hex; fall back to hex when it is
+    // not text at all.
+    const printable = /^[\x09\x0a\x0d\x20-\x7e]*$/.test(text);
+    const shown = printable
+      ? JSON.stringify(text.length > 120 ? text.slice(0, 120) + '…' : text)
+      : '0x' + buf.slice(0, 40).toString('hex') + (buf.length > 40 ? '…' : '');
+    return out + '>' + buf.length + 'B ' + shown;
+  }
+  return out + '/>';
+}
+
 function getNodeContent(node) {
   if (!node) return null;
   if (Buffer.isBuffer(node.content)) return node.content;
@@ -4926,37 +4959,90 @@ class WhalibmobClient extends EventEmitter {
    * caller concludes the account is fine.
    */
   async _mexQuery(queryId, variables, dataPath) {
+    const body = Buffer.from(JSON.stringify({ variables: variables || {} }), 'utf8');
+
+    // The <query> node carries the query id and nothing else.
+    //
+    // Asking for a format here was tried and is wrong: a `format="json"`
+    // attribute makes the server drop the stanza on the floor — no reply at
+    // all, where without it there is at least an answer. It does not ignore
+    // what it does not recognise, so nothing speculative belongs on this node.
     const resp = await this._sendIq(new BinaryNode('iq', {
       id:    this._genMsgId(),
       to:    's.whatsapp.net',
       type:  'get',
       xmlns: 'w:mex'
-    }, [
-      new BinaryNode('query', { query_id: String(queryId) },
-        Buffer.from(JSON.stringify({ variables: variables || {} }), 'utf8'))
-    ]));
+    }, [new BinaryNode('query', { query_id: String(queryId) }, body)]));
 
     if (!resp) throw new Error('mex query ' + queryId + ': no reply from server (IQ timed out)');
-    if (resp.attrs && resp.attrs.type === 'error') {
-      const errNode = findChild(resp, 'error');
-      const code    = errNode && errNode.attrs && errNode.attrs.code;
+
+    // An <error> child is the refusal whether or not the iq is typed as one.
+    const errNode = (resp.attrs && resp.attrs.type === 'error')
+      ? findChildDeep(resp, 'error') : findChild(resp, 'error');
+    if (errNode) {
+      const a    = errNode.attrs || {};
+      const code = a.code ? String(a.code) : null;
+      const text = a.text ? String(a.text) : null;
       throw new Error('mex query ' + queryId + ': server rejected the request' +
-        (code ? ' (' + code + ')' : ''));
+        (code ? ' (' + code + (text ? ' ' + text : '') + ')' : ''));
     }
 
-    const resultNode = findChild(resp, 'result');
-    const buf        = resultNode ? getNodeContent(resultNode) : null;
-    if (!buf) throw new Error('mex query ' + queryId + ': reply carried no result');
+    // The JSON normally sits in <result>, but not every build wraps it the same
+    // way, so take it from wherever in the reply it turns up rather than from
+    // one fixed path.
+    const json = this._mexJsonFrom(resp);
+    if (json) {
+      if (json.errors && json.errors.length) {
+        throw new Error('mex query ' + queryId + ': ' +
+          json.errors.map(e => (e && e.message) || 'unknown error').join(', '));
+      }
+      return dataPath ? (json.data && json.data[dataPath]) : json.data;
+    }
 
-    let json;
-    try { json = JSON.parse(buf.toString('utf8')); }
-    catch (_) { throw new Error('mex query ' + queryId + ': reply was not JSON'); }
+    // The query itself worked — this is purely about how the answer was
+    // encoded, and saying so is the difference between a fixable report and a
+    // shrug.
+    const resultNode = findChildDeep(resp, 'result');
+    const format     = resultNode && resultNode.attrs && resultNode.attrs.format;
+    if (format && String(format).toLowerCase() !== 'json') {
+      const raw = getNodeContent(resultNode);
+      const err = new Error('mex query ' + queryId + ': the server answered in "' +
+        format + '" rather than JSON, which this library cannot read' +
+        (raw ? ' (' + raw.length + ' bytes: ' + raw.toString('hex') + ')' : ''));
+      err.mexFormat  = String(format);
+      err.mexPayload = raw || null;
+      _whaDbg('[DBG] MEX_REPLY_FORMAT ' + format + ' — cannot decode');
+      throw err;
+    }
 
-    if (json.errors && json.errors.length) {
-      throw new Error('mex query ' + queryId + ': ' +
-        json.errors.map(e => (e && e.message) || 'unknown error').join(', '));
+    _whaDbg('[DBG] MEX_REPLY_UNPARSED ' + JSON.stringify(describeNodeBriefly(resp)));
+    throw new Error('mex query ' + queryId + ': the reply carried no JSON — ' +
+      describeNodeBriefly(resp));
+  }
+
+  // Walk the reply for the first node whose content parses as a JSON object.
+  //
+  // Content arrives as bytes for a long payload and as a plain string when the
+  // encoder had a token for it, so both are tried.
+  _mexJsonFrom(node) {
+    if (!node) return null;
+    const raw = getNodeContent(node);
+    if (raw && raw.length) {
+      const text = raw.toString('utf8').trim();
+      if (text.startsWith('{') || text.startsWith('[')) {
+        try {
+          const parsed = JSON.parse(text);
+          if (parsed && typeof parsed === 'object') return parsed;
+        } catch (_) { /* not this node */ }
+      }
+    }
+    if (Array.isArray(node.content)) {
+      for (const child of node.content) {
+        const found = this._mexJsonFrom(child);
+        if (found) return found;
+      }
     }
-    return dataPath ? (json.data && json.data[dataPath]) : json.data;
+    return null;
   }
 
   /**

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "whalibmob",
-  "version": "5.10.0",
+  "version": "5.10.3",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
-  "author": "Kunboruto50",
+  "author": "Kunboruto20",
   "main": "index.js",
   "bin": {
     "wa": "./cli.js"