whalibmob 5.29.1 → 5.29.2

package/README.md

@@ -3284,7 +3284,7 @@ connect()
 | `presence` | `{ from, available }` | Contact came online or went offline |
 | `group_update` | `{ type, groupJid, actor, participants, subject, timestamp }` | Member added / removed / promoted / demoted, subject or settings changed |
 | `notification` | node object | Group or contact update notification |
-| `call` | `{ from }` | Incoming call event |
+| `call` | `{ from, id, status, tag, creator, creatorAlt, groupJid, platform, version, reason, ts, node }` | A call stanza. `id` is what `rejectCall()` needs, `creator` is who placed the call (it differs from `from` in a group), and `status` is the stage: `offer`, `offer_notice`, `ringing`, `accept`, `preaccept`, `transport`, `terminate`, `reject` or `unknown` |
 | `chat_read` | `{ jid, read, remote?, synced? }` | Chat marked read (`read: true`) or unread (`read: false`) |
 | `chat_muted` | `{ jid, muted, until, remote?, synced? }` | Chat muted or unmuted; `until` is epoch ms (−1 = indefinite) |
 | `chat_pinned` | `{ jid, pinned, remote?, synced? }` | Chat pinned or unpinned |
@@ -3322,9 +3322,21 @@ The message object contains:
   ts:          number,   // Unix timestamp (seconds)
   node:        object,   // raw XML node — node.attrs.sender_pn holds the real phone JID
   decoded:     object,   // structured payload — shape depends on message type (see below)
+  fromMe:      boolean,  // you sent this from another of your own devices
+  chat:        string,   // the conversation — equals from unless fromMe is true
 }
 ```
 
+> [!NOTE]
+> When you send a message from your phone, WhatsApp echoes a copy of it to every
+> other device on the account, wrapped in a `DeviceSentMessage`. On that copy
+> `from` is **your own JID** — it names the sender, not the chat. Use `chat`,
+> which is the conversation whichever direction the message went, and `fromMe`
+> to tell the two apart. The envelope's own fields are on
+> `decoded.deviceSentMeta` (`destinationJid`, `phash`) if you need them raw.
+> These messages are not answered with a read receipt: nothing was read by
+> receiving your own message back.
+
 > [!NOTE]
 > WhatsApp Multi-Device uses **LID JIDs** internally. The `from` field may be a LID like
 > `112345678901234@s.whatsapp.net` rather than the real phone number. To get the actual

package/index.d.ts

@@ -271,9 +271,23 @@ export interface DecodedBase {
   ephemeral?: boolean;
   /** The message is the new text of an edit. */
   edited?: boolean;
+  /**
+   * Present only on a message this account sent from one of its other devices.
+   * The stanza names us as the sender, so the chat it belongs to is written
+   * here and nowhere else.
+   */
+  deviceSentMeta?: DeviceSentMeta;
   [key: string]: any;
 }
 
+/** What a `DeviceSentMessage` envelope said about the message inside it. */
+export interface DeviceSentMeta {
+  /** The chat the message was originally addressed to. */
+  destinationJid?: Jid;
+  /** Hash of the participant list the sending device used, when it set one. */
+  phash?: string;
+}
+
 export interface DecodedText extends DecodedBase {
   type: 'text';
   text: string;
@@ -335,6 +349,39 @@ export type DecodedMessage =
   | DecodedProtocol
   | DecodedBase;
 
+/** The stage a call is at, from the child tag inside the `<call>` stanza. */
+export type CallStatus =
+  | 'offer' | 'offer_notice' | 'ringing' | 'accept'
+  | 'preaccept' | 'transport' | 'terminate' | 'reject' | 'unknown';
+
+/** The payload of the `call` event. */
+export interface CallEvent {
+  /** Who the stanza came from. Equals `creator` on a one-to-one call. */
+  from: Jid;
+  /** The call id — what `rejectCall` needs. `null` on a stanza that names none. */
+  id: string | null;
+  /** `'ringing'` is the `relaylatency` stanza, under the name it has always had. */
+  status: CallStatus;
+  /** The child tag verbatim, so a stage not in `CallStatus` is still readable. */
+  tag: string;
+  /** The account that placed the call. Differs from `from` in a group. */
+  creator: Jid;
+  /** The creator's other name — phone JID for a LID creator, and the reverse. */
+  creatorAlt: Jid | null;
+  /** The group the call is in, when it is a group call. */
+  groupJid: Jid | null;
+  /** The caller's platform, on the stanzas that carry it. */
+  platform: string | null;
+  /** The caller's client version, on the stanzas that carry it. */
+  version: string | null;
+  /** Why the call ended, on a `terminate`. */
+  reason: string | null;
+  /** Unix timestamp, seconds. */
+  ts: number;
+  /** Raw binary node. */
+  node: any;
+}
+
 /**
  * The payload of the `message` event.
  *
@@ -361,6 +408,17 @@ export interface IncomingMessage {
   text?: string | null;
   /** `true` on a group message. */
   isGroup?: boolean;
+  /**
+   * `true` when this account sent the message from another of its devices and
+   * the server echoed it back here.
+   */
+  fromMe?: boolean;
+  /**
+   * The conversation the message belongs to, whichever direction it went. Same
+   * as `from` for anything we received; for one of our own messages it is who
+   * we sent it to, which `from` cannot say.
+   */
+  chat?: Jid;
 }
 
 // ────────────────────────────────────────────────────────────────────────────
@@ -695,7 +753,7 @@ export interface WhalibmobEvents {
   message: (msg: IncomingMessage) => void;
   receipt: (r: { type: string; id: string; from: Jid }) => void;
   presence: (p: { from: Jid; available: boolean }) => void;
-  call: (c: { from: Jid; id: string | null; status: 'offer' | 'ringing' | 'terminate' | 'unknown'; node: any }) => void;
+  call: (c: CallEvent) => void;
   notification: (node: any) => void;
   decrypt_error: (e: { id: string; from: Jid; participant?: Jid; err: Error }) => void;
   session_refresh: (e: { node: any }) => void;
@@ -936,7 +994,7 @@ export declare class WhalibmobClient extends EventEmitter {
 
   /**
    * Refuse one incoming call. Only reachable when the client was built with
-   * `autoRejectCalls: false`; the id and caller come off the `call` event.
+   * `autoRejectCalls: false`; pass the `id` and `creator` off the `call` event.
    */
   rejectCall(callId: string, from: Jid): boolean;
 

package/lib/Client.js

@@ -166,6 +166,23 @@ const PRIVACY_WIRE_TO_KEY = {
   stickers:     'stickers'
 };
 
+// The stage a call is at, keyed by the child tag the server puts inside <call>.
+//
+// These are the eight the protocol uses; anything else is reported as
+// 'unknown' with the tag itself alongside, so a new one is visible rather than
+// silently dropped. `relaylatency` keeps the name it has always been announced
+// under here — it is the stanza that arrives while the phone is ringing.
+const CALL_STATUS = {
+  offer:        'offer',
+  offer_notice: 'offer_notice',
+  relaylatency: 'ringing',
+  accept:       'accept',
+  preaccept:    'preaccept',
+  transport:    'transport',
+  terminate:    'terminate',
+  reject:       'reject'
+};
+
 // Reduce a JID to its bare user. Blocking, and anything else that names an
 // account rather than one of its devices, wants this form.
 function toNonAdJid(input) {
@@ -2830,7 +2847,10 @@ class WhalibmobClient extends EventEmitter {
 
     this._sendMessageAck(id, fromRaw, partRaw);
     this._sendDeliveryReceipt(id, fromRaw, partRaw);
-    this.emit('message', { id, from, participant, ts, text, node });
+    this.emit('message', {
+      id, from, participant, ts, text, node,
+      fromMe: false, chat: from
+    });
     this._sendReadReceipt(id, fromRaw, partRaw);
   }
 
@@ -3111,8 +3131,24 @@ class WhalibmobClient extends EventEmitter {
         // If we had asked the phone to resend this one, it has answered.
         this._resolvePlaceholderResend(id);
 
-        this.emit('message', { id, from, participant, ts, decoded, node });
-        this._sendReadReceipt(id, fromRaw, partRaw);
+        // A DeviceSentMessage is one we sent ourselves from another device. The
+        // stanza's `from` is our own JID, so it says who but never where: the
+        // chat is named inside the envelope and nowhere else. Both are put on
+        // the event — `chat` is the conversation whichever direction the message
+        // went, so a handler can answer without having to know which case it is
+        // looking at.
+        const dsm  = decoded && decoded.deviceSentMeta;
+        const dest = dsm && dsm.destinationJid ? String(dsm.destinationJid) : null;
+        this.emit('message', {
+          id, from, participant, ts, decoded, node,
+          fromMe: !!dest,
+          chat:   dest || from
+        });
+
+        // Nothing is read by receiving our own message back. A read receipt for
+        // it would be addressed to ourselves and marks the chat read on every
+        // other device — which is not what happened.
+        if (!dest) this._sendReadReceipt(id, fromRaw, partRaw);
 
         // ── pkmsg = peer opened a new Signal session (identity/device change) ──
         // Re-issue our tcToken to them so the fresh session carries a valid
@@ -3153,7 +3189,10 @@ class WhalibmobClient extends EventEmitter {
           }
           return;
         }
-        this.emit('message', { id, from, participant, ts, decoded, isGroup: true, node });
+        this.emit('message', {
+          id, from, participant, ts, decoded, isGroup: true, node,
+          fromMe: false, chat: from
+        });
         this._sendReadReceipt(id, fromRaw, partRaw);
       })
       .catch(err => {
@@ -4185,7 +4224,8 @@ class WhalibmobClient extends EventEmitter {
     // A <call> can also be the answer to something we asked for — creating a
     // call link, for one. Those come back on the same tag with the id we sent,
     // so they have to be handed to the waiting caller and not treated as an
-    // incoming call to reject.
+    // incoming call to reject. A reply to us is not a server push and gets no
+    // ack, which is why this stays ahead of everything below.
     if (attrs.id) {
       const handler = this._pendingIqs.get(attrs.id);
       if (handler) {
@@ -4195,23 +4235,63 @@ class WhalibmobClient extends EventEmitter {
       }
     }
 
+    // The server expects to hear that the stanza arrived, for a call exactly as
+    // it does for a message or a notification. Nothing here acknowledged one, so
+    // every incoming call was re-delivered on the next connection — and it goes
+    // out first, before the shape below is looked at, because an unrecognised
+    // call is still a call that reached us.
+    this._sendStanzaAck(node);
+
     // What the stanza actually says, rather than the raw node alone: which call
     // it is, and what stage it is at. A caller deciding whether to reject needs
     // both, and digging them out of the node is not its job.
-    const offer  = findChild(node, 'offer');
-    const relay  = findChild(node, 'relaylatency');
-    const term   = findChild(node, 'terminate');
-    const callId = (offer && offer.attrs && offer.attrs.call_id) ||
-                   (term  && term.attrs  && term.attrs.call_id)  || null;
-    const status = offer ? 'offer' : (term ? 'terminate' : (relay ? 'ringing' : 'unknown'));
-
-    this.emit('call', { from: attrs.from || '', id: callId, status, node });
+    //
+    // All of it lives on the single child, not on the <call> itself, and under
+    // hyphenated names: `call-id` and `call-creator`. This read `call_id` off
+    // the child, which no stanza has ever carried — so the id was always null,
+    // the event announced a call nobody could identify, and the automatic
+    // refusal below was skipped for every call that ever came in. Both spellings
+    // are in the binary token table and only the hyphenated ones are real.
+    const children = Array.isArray(node.content)
+      ? node.content.filter(c => c && c.description) : [];
+    const child  = children.length === 1 ? children[0] : null;
+    const cattrs = (child && child.attrs) || {};
+    const tag    = child ? child.description : '';
+
+    const from   = attrs.from ? String(attrs.from) : '';
+    const callId = cattrs['call-id'] ? String(cattrs['call-id']) : null;
+    // The creator is the account that placed the call. On a one-to-one call it
+    // is the same as the stanza's `from`; in a group they differ, and the
+    // refusal has to name the creator.
+    const creator = cattrs['call-creator'] ? String(cattrs['call-creator']) : from;
+    const status  = CALL_STATUS[tag] || 'unknown';
+
+    // The caller's other name. A LID creator carries its phone number, a phone
+    // creator its LID — whichever side the stanza did not use to address it.
+    const creatorAlt = creator.endsWith('@lid')
+      ? (cattrs.caller_pn  ? String(cattrs.caller_pn)  : null)
+      : (cattrs.caller_lid ? String(cattrs.caller_lid) : null);
+
+    this.emit('call', {
+      from,
+      id:      callId,
+      status,
+      tag,
+      creator,
+      creatorAlt,
+      groupJid: cattrs['group-jid'] ? String(cattrs['group-jid']) : null,
+      platform: attrs.platform ? String(attrs.platform) : null,
+      version:  attrs.version  ? String(attrs.version)  : null,
+      reason:   cattrs.reason  ? String(cattrs.reason)  : null,
+      ts:       attrs.t ? parseInt(attrs.t, 10) : 0,
+      node
+    });
 
     // Reject every incoming call, unless the caller asked to decide for itself.
     // Turning this off does not answer calls — nothing here can — it only stops
     // the automatic refusal, so a caller can reject some and let the rest ring.
     if (this._autoRejectCalls && callId && status === 'offer') {
-      this.rejectCall(callId, attrs.from || '');
+      this.rejectCall(callId, creator);
     }
   }
 
@@ -4220,21 +4300,50 @@ class WhalibmobClient extends EventEmitter {
    *
    * Only needed when the client was built with `autoRejectCalls: false`; with
    * the default every call is refused before this could be reached. The call id
-   * and the caller both come off the `call` event.
+   * and the caller both come off the `call` event — `id` and `creator`.
    *
    * @param {string} callId  the `id` from the call event
-   * @param {string} from    the `from` from the call event
+   * @param {string} from    the `creator` from the call event
    * @returns {boolean} whether the refusal could be sent
    */
   rejectCall(callId, from) {
     if (!callId || !this._socket || !this._connected) return false;
+    // Both ends are named without their device: a call belongs to an account,
+    // not to the device that happened to place it.
+    const creator = toNonAdJid(String(from || ''));
+    const ownJid  = toNonAdJid(this._ownJidFor(creator));
     this._socket.sendNode(new BinaryNode('call', {
-      to: from || '',
-      id: this._genMsgId()
-    }, [new BinaryNode('reject', { call_id: callId, call_creator: from || '' }, null)]));
+      id:   this._genMsgId(),
+      from: jidStrToObj(ownJid),
+      to:   jidStrToObj(creator)
+    }, [new BinaryNode('reject', {
+      'call-id':      callId,
+      'call-creator': jidStrToObj(creator),
+      count:          '0'
+    }, null)]));
     return true;
   }
 
+  // The acknowledgement a server push gets, whatever tag it came in on.
+  //
+  // Mirrors the one whatsmeow sends: the stanza's own tag as the class, its id,
+  // and back to whoever sent it, carrying `participant` and `recipient` through
+  // when the stanza named them. `type` rides along for everything but a message,
+  // where it means something else entirely.
+  _sendStanzaAck(node) {
+    if (!this._socket || !this._connected) return;
+    const attrs = node.attrs || {};
+    const ack   = {
+      id:    attrs.id || '',
+      class: node.description,
+      to:    attrs.from || 's.whatsapp.net'
+    };
+    if (attrs.participant) ack.participant = attrs.participant;
+    if (attrs.recipient)   ack.recipient   = attrs.recipient;
+    if (attrs.type && node.description !== 'message') ack.type = String(attrs.type);
+    this._socket.sendNode(new BinaryNode('ack', ack, null));
+  }
+
   // ─── Auth failure (server forces logout during active session) ──────────────
 
   // <failure> ends the connection, but not every reason means the session died.

package/lib/messages/MessageSender.js

@@ -1026,13 +1026,13 @@ class MessageSender {
     // set than the server's.
     //
     // It is not put on the stanza: phash belongs on a group message, not a 1:1
-    // one. It is carried inside the (encrypted)
-    // DeviceSentMessage for our own devices, and compared against the phash the
-    // server echoes back on the ack so a drifted device cache gets flushed.
+    // one. It is kept only to be compared against the phash the server echoes
+    // back on the ack, so a drifted device cache gets flushed — see the check
+    // after the dispatch below.
     const phash = computePhash([...otherJids, ownPrimaryJid, ...ownLinkedJids]);
 
     const dsmBuf = ownLinkedJids.length > 0
-      ? encodeDeviceSentMessage(toJid, plaintext, phash)
+      ? encodeDeviceSentMessage(toJid, plaintext)
       : null;
 
     // Acquire mutex before touching Signal sessions — concurrent sends on the

package/lib/proto/MessageProto.js

@@ -353,14 +353,32 @@ function encodeMessage(type, payload) {
 // Used when sending to own linked devices — wraps the original message so other
 // devices know where the message was originally addressed (destinationJid).
 // DeviceSentMessage { destinationJid=1, message=2, phash=3 }
-
-function encodeDeviceSentMessage(destinationJid, messageBuf, phash) {
+//
+// The envelope is not the whole outer Message. Whatever messageContextInfo the
+// message carries is copied up beside the envelope as well, because that is
+// where a recipient reads it from: it is a field of Message, and once the
+// message is buried inside a DeviceSentMessage the copy inside it is a level
+// too deep for anything that does not know to go looking. A poll echoed to our
+// own devices reached them without a message secret, so none of them could ever
+// decrypt a vote on it. whatsmeow (`MessageContextInfo: message.MessageContextInfo`
+// in marshalMessage) and Baileys both duplicate it for the same reason.
+//
+// phash is left unset, as it is by every other implementation: it describes the
+// participant list, the server checks that against the hash on the stanza, and
+// no client has ever read it back out of here.
+function encodeDeviceSentMessage(destinationJid, messageBuf) {
   const inner = Buffer.concat([
     field(1, WIRE_LEN, str(destinationJid)),
-    field(2, WIRE_LEN, messageBuf),
-    phash ? field(3, WIRE_LEN, str(phash)) : Buffer.alloc(0)
+    field(2, WIRE_LEN, messageBuf)
   ]);
-  return field(31, WIRE_LEN, inner);
+
+  let contextInfo = Buffer.alloc(0);
+  try {
+    const mci = _decodeFields(messageBuf)[35];
+    if (Buffer.isBuffer(mci) && mci.length) contextInfo = field(35, WIRE_LEN, mci);
+  } catch (_) { /* nothing to lift */ }
+
+  return Buffer.concat([field(31, WIRE_LEN, inner), contextInfo]);
 }
 
 // ─── ProtocolMessage (field 12 of Message) ───────────────────────────────────
@@ -733,6 +751,9 @@ function decodeMessageContainer(buf, depth) {
     // still belongs to what comes out, which is why both are read first and
     // carried onto the result — unwrapping used to return straight out of here
     // and lose them.
+    // What a DeviceSentMessage envelope said about itself, kept for the caller.
+    let deviceSentMeta = null;
+
     if (level < MAX_WRAPPER_DEPTH) {
       for (const w of MESSAGE_WRAPPERS) {
         const inner = _unwrap(f[w.field], w.inner);
@@ -744,6 +765,24 @@ function decodeMessageContainer(buf, depth) {
         if (!decoded || decoded.type === 'unknown') continue;
         msgResult = decoded;
         if (w.flag) envelopeFlags = Object.assign({}, envelopeFlags, { [w.flag]: true });
+        // A DeviceSentMessage is a message this account sent from one of its
+        // other devices, echoed back to us. The stanza's `from` is therefore our
+        // own JID and names nothing: the conversation it belongs to is only ever
+        // written here, in the envelope. It was being opened and thrown away, so
+        // a message sent from the phone arrived with no way to tell which chat
+        // it was in. whatsmeow keeps the same two fields as Info.DeviceSentMeta.
+        if (w.field === 31) {
+          try {
+            const env  = _decodeFields(f[31]);
+            const dest = _str(env[1]);
+            const ph   = _str(env[3]);
+            if (dest || ph) {
+              deviceSentMeta = {};
+              if (dest) deviceSentMeta.destinationJid = dest;
+              if (ph)   deviceSentMeta.phash          = ph;
+            }
+          } catch (_) { /* the envelope named nothing */ }
+        }
         break;
       }
     }
@@ -1017,6 +1056,9 @@ function decodeMessageContainer(buf, depth) {
     // this level only fills in what is still missing.
     if (msgResult) {
       if (envelopeFlags) msgResult = Object.assign({}, msgResult, envelopeFlags);
+      if (deviceSentMeta && !msgResult.deviceSentMeta) {
+        msgResult = Object.assign({}, msgResult, { deviceSentMeta });
+      }
       if (messageSecret && !msgResult.messageSecret) {
         msgResult = Object.assign({}, msgResult, { messageSecret });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.1",
+  "version": "5.29.2",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",