whalibmob 5.12.13 → 5.12.15

package/README.md

@@ -300,6 +300,10 @@ WA_OS=android WA_DEVICE=samsung-s24-ultra wa registration --request-code 9196348
 Set `WA_OS=android` in a `.env` file instead and the plain command is enough.
 `--debug` prints every request and reply, which is worth having the first time.
 
+The variables only matter for the command that *creates* the session. What a
+session registered as is written into it, so the confirmation step and every
+later connect follow the session, not whatever the shell carries at the time.
+
 The CLI sends the code request, prints the result, and then **stays open** in the interactive shell. You will see:
 
 ```
@@ -1342,6 +1346,28 @@ registered  session saved to /home/user/.waSession/919634847671.json
 now run: /connect 919634847671
 ```
 
+**Registering as Android from the shell** works the same way, but `WA_OS` has to
+be set when the shell *starts* — the `wa>` prompt is already inside a running
+process, and nothing typed at it can change the environment that process was
+launched with:
+
+```sh
+WA_OS=android WA_DEVICE=samsung-s24-ultra wa
+```
+```sh
+wa> /reg code 919634847671
+no Android token material yet — fetching the WhatsApp APK from Google Play
+  ...
+  status  sent
+wa> /reg confirm 919634847671 123456
+```
+
+A `.env` file with `WA_OS=android` in the directory you start from does the same
+and saves the typing. Either way it only matters for the command that *creates*
+the session: what a session registered as is written into it, and every later
+step — the confirmation, a reconnect from a different shell tomorrow — follows
+the session rather than the environment.
+
 ---
 
 ### Connection Commands (in-shell)

package/lib/Registration.js

@@ -137,7 +137,7 @@ function socksProxyUrl() {
   return process.env.TOR_PROXY || process.env.SOCKS_PROXY || '';
 }
 
-async function httpPostViaSocks(path, body, waVersion, proxyUrl, authHeader) {
+async function httpPostViaSocks(path, body, waVersion, proxyUrl, authHeader, device) {
   const proxy = parseSocksProxy(proxyUrl);
   const dHost = 'v.whatsapp.net';
   const dPort = 443;
@@ -164,7 +164,7 @@ async function httpPostViaSocks(path, body, waVersion, proxyUrl, authHeader) {
     tlsSocket.once('error', rej);
   });
 
-  const headers  = registrationHeaders(getDeviceConfig(), waVersion);
+  const headers  = registrationHeaders(device || getDeviceConfig(), waVersion);
   const reqLines = [
     `POST /v2${path} HTTP/1.1`,
     `Host: ${dHost}`,
@@ -590,9 +590,9 @@ function tryLoadAndroidMaterial() {
  * A no-op on iOS, and WA_NO_APK_DOWNLOAD=1 turns it off for anyone who would
  * rather a hundred megabytes were never fetched without being asked for.
  */
-async function ensureAndroidMaterial(opts) {
+async function ensureAndroidMaterial(opts, device) {
   opts = opts || {};
-  const device = getDeviceConfig();
+  device = device || getDeviceConfig();
   if (device.os !== 'android') return null;
 
   try {
@@ -676,8 +676,8 @@ function loadAndroidMaterial() {
   return _androidMaterial;
 }
 
-function computeToken(waVersion, national) {
-  const device = getDeviceConfig();
+function computeToken(waVersion, national, device) {
+  device = device || getDeviceConfig();
   if (device.os === 'android') {
     return AndroidApk.computeToken(loadAndroidMaterial(), national);
   }
@@ -817,8 +817,8 @@ function toBase64Url(buf) {
 async function buildPayload(store, waVersion, useToken, extraPairs) {
   const { cc, national } = parsePhone(store.phoneNumber);
   const meta   = getCountryMeta(cc);
-  const token  = useToken ? computeToken(waVersion, national) : null;
   const device = store.device || getDeviceConfig();
+  const token  = useToken ? computeToken(waVersion, national, device) : null;
   // Android formats fdid lowercase, iOS uppercase (matches the native clients).
   const fdid   = device.os === 'android'
     ? store.fdid.toLowerCase()
@@ -874,14 +874,14 @@ function encryptPayload(plaintext) {
 
 // ---------- HTTP ----------
 
-function httpPost(path, body, waVersion, authHeader) {
+function httpPost(path, body, waVersion, authHeader, device) {
   const proxy = socksProxyUrl();
-  if (proxy) return httpPostViaSocks(path, body, waVersion, proxy, authHeader);
+  if (proxy) return httpPostViaSocks(path, body, waVersion, proxy, authHeader, device);
 
   return new Promise((resolve, reject) => {
     const bodyBuf = Buffer.from(body, 'utf8');
     const headers = Object.assign(
-      registrationHeaders(getDeviceConfig(), waVersion),
+      registrationHeaders(device || getDeviceConfig(), waVersion),
       { 'Content-Length': bodyBuf.length }
     );
     // Attestation cert-chain / App Attest header (Android cert chain, iOS
@@ -943,7 +943,7 @@ async function sendEncrypted(path, plaintext, store, waVersion) {
 
   _whaDbg('[DBG] REG → ' + path + ' (' + body.length + ' bytes' +
     (bodyAtt.bodyAttestation ? ', attested' : '') + ')');
-  const result = await httpPost(path, body, waVersion, bodyAtt.authorizationHeader);
+  const result = await httpPost(path, body, waVersion, bodyAtt.authorizationHeader, device);
   _whaDbg('[DBG] REG ← ' + path + ' ' +
     (result && result.status ? result.status : JSON.stringify(result).slice(0, 120)) +
     (result && result.reason ? ' reason=' + result.reason : ''));
@@ -1193,7 +1193,7 @@ async function handle2FA(store, waVersion, opts) {
 // ---------- Public API ----------
 
 async function checkIfRegistered(store) {
-  const waVersion = await fetchWaVersion(getDeviceConfig());
+  const waVersion = await fetchWaVersion(store.device || getDeviceConfig());
   return sendRequest('/exist', store, waVersion, false, null);
 }
 
@@ -1333,8 +1333,12 @@ async function requestSmsCode(store, method, opts) {
   opts   = opts   || {};
   // Before the version is read, since on Android the version comes out of the
   // APK this fetches.
-  await ensureAndroidMaterial(opts);
-  const _device   = getDeviceConfig();
+  // What a session registered as is settled when it is created, so it is the
+  // store that decides — not whatever WA_OS the shell happens to carry now. A
+  // confirmation run from a shell without the variables would otherwise sign an
+  // Android registration with an iOS token.
+  const _device   = store.device || getDeviceConfig();
+  await ensureAndroidMaterial(opts, _device);
   const waVersion = await fetchWaVersion(_device);
   store.version = waVersion;
   store.device  = _device;
@@ -1455,8 +1459,12 @@ async function verifyCode(store, code, opts) {
   opts = opts || {};
   // Normally already there from the code request, but a confirmation can be run
   // from a fresh shell that never made one.
-  await ensureAndroidMaterial(opts);
-  const _device   = getDeviceConfig();
+  // What a session registered as is settled when it is created, so it is the
+  // store that decides — not whatever WA_OS the shell happens to carry now. A
+  // confirmation run from a shell without the variables would otherwise sign an
+  // Android registration with an iOS token.
+  const _device   = store.device || getDeviceConfig();
+  await ensureAndroidMaterial(opts, _device);
   const waVersion = await fetchWaVersion(_device);
   store.version = waVersion;
   store.device  = _device;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.12.13",
+  "version": "5.12.15",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",