whalibmob 5.29.4 → 5.29.5

package/lib/Registration.js

@@ -986,18 +986,38 @@ function tryLoadAndroidMaterial(device) {
  * Silently ignoring WA_OS is how you end up watching an Android registration go
  * out under an iOS User-Agent and not knowing why.
  */
+// A session's device identity, frozen for the whole registration.
+//
+// createNewStore captures the device when the session is created and writes it
+// to disk with everything else, so a session always arrives here already
+// carrying one. From that point it is frozen: /exist, /code, /register and
+// every retry read this same identity, and no request can describe one handset
+// while a sibling request in the same flow describes another.
+//
+// The bug this closes: the gate here used to be `registered || codePending`, so
+// the very first /code of a session ignored the stored device and re-read it
+// from the environment. /exist had already gone out as the stored device — an
+// Android/Samsung, say, loaded from the session file — and /code then went out
+// as the environment default (iOS/iPhone). One number, two phones, in one flow.
+// That is precisely the shape a "download the official app" block screen looks
+// for, and it was reproducible from the logs. See
+// test/registration-device-consistency.test.js.
+//
+// WA_OS / WA_BUSINESS therefore choose the device only for a session that does
+// not have one yet — which in practice means never, since createNewStore always
+// sets it. To change the platform of an existing session, start it over: delete
+// the session file, and the next createNewStore picks up the current WA_OS.
 function deviceForRegistration(store, opts) {
   const env    = getDeviceConfig();
   const stored = store && store.device;
-  const settled = !!(store && (store.registered || store.codePending));
-  if (!settled || !stored) return env;
+  if (!stored || !stored.os) return env;
 
   const say = (opts && opts.onProgress) || (m => _whaDbg('[DBG] REG ' + m));
 
   if (stored.os !== env.os) {
     say('note: this session was started as ' + stored.os + ', so it stays ' + stored.os +
-        ' — WA_OS=' + env.os + ' does not apply to a number that is already part-way ' +
-        'through registering. Delete the session file to start it over as ' + env.os + '.');
+        ' — WA_OS=' + env.os + ' does not apply to a number that already has a ' +
+        'device. Delete the session file to start it over as ' + env.os + '.');
   }
 
   // The same rule for the variant: an account is created as Business or as
@@ -1007,13 +1027,36 @@ function deviceForRegistration(store, opts) {
   if (!!stored.business !== !!env.business) {
     say('note: this session was started as ' + (stored.business ? 'Business' : 'consumer') +
         ', so it stays that — WA_BUSINESS=' + (env.business ? '1' : '0') +
-        ' does not apply to a number that is already part-way through registering. ' +
+        ' does not apply to a number that already has a device. ' +
         'Delete the session file to start it over.');
   }
 
   return stored;
 }
 
+// The device identity a request is about to go out with, logged so /exist and
+// /code can be compared side by side. Gated behind the debug channel — it costs
+// nothing when debug is off, and when a registration misbehaves it is the first
+// thing worth seeing. The User-Agent is built the same way the real request
+// builds it, so what this prints is what actually goes on the wire.
+function logDeviceIdentity(tag, store, waVersion) {
+  const stored = store && store.device;
+  const d      = stored || getDeviceConfig();
+  const ver    = waVersion || (store && store.version) || '';
+  let ua = '';
+  try { ua = registrationHeaders(d, ver)['User-Agent']; } catch (_) {}
+  _whaDbg('[DBG] DEVICE_IDENTITY ' + tag +
+    ' os=' + d.os +
+    ' osVersion=' + d.osVersion +
+    ' manufacturer=' + (d.manufacturer || '-') +
+    ' model=' + (d.model || d.modelId || '-') +
+    ' modelId=' + (d.modelId || '-') +
+    ' business=' + !!d.business +
+    ' waVersion=' + (ver || '-') +
+    ' source=' + (stored ? 'store.device (frozen)' : 'getDeviceConfig() (env/default)') +
+    ' ua="' + ua + '"');
+}
+
 /**
  * Have the Android token material ready, fetching the APK if it is not.
  *
@@ -1983,6 +2026,7 @@ async function assertRegistrationKeys(store, waVersion) {
 
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
+      logDeviceIdentity('before /exist', store, waVersion);
       const result = await sendRequest('/exist', store, waVersion, false, null);
       // reason === 'incorrect' → keys not found → fresh
       if (result && result.reason === 'incorrect') {
@@ -2087,6 +2131,7 @@ async function requestSmsCode(store, method, opts) {
       const verifyScreen = currentVerifyScreen(store);
       await sendFunnelLog(store, waVersion, verifyScreen, 'request_code', 'request_code_attempt');
 
+      logDeviceIdentity('before /code', store, waVersion);
       const result = await sendRequest('/code', store, waVersion, true, extra);
 
       const status = result.status;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.4",
+  "version": "5.29.5",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",