whalibmob 5.29.4 → 5.29.6

package/README.md

@@ -1866,9 +1866,19 @@ requesting sms code for +919634847671...
   status  sent
 ```
 
-It happens once. Every later registration reads the file. `WA_NO_APK_DOWNLOAD=1`
-turns the fetch off if you would rather it never pulled a hundred megabytes
-unasked, and `wa apk-material` below does the same job by hand.
+It happens once. Every later registration reads the file — from the session
+directory you are using, wherever that is. `WA_NO_APK_DOWNLOAD=1` turns the
+fetch off if you would rather it never pulled a hundred megabytes unasked, and
+`wa apk-material` below does the same job by hand.
+
+> [!NOTE]
+> The download goes through the Aurora OSS token dispenser, a free third-party
+> service that mints an anonymous Play account. It refuses with **HTTP 403**
+> when it is rate limiting and **5xx** when it is having a bad minute, so the
+> request is retried a few times with a growing wait before giving up.
+> `WA_PLAY_RETRY_DELAY_MS` sets that wait (default `2000`, doubling each time).
+> If it still refuses, nothing is wrong with your setup — pass an APK path to
+> `wa apk-material` instead, which is the same thing without the middleman.
 
 The rest of this section is what happens behind that one command, and how to
 drive each part yourself.

package/cli.js

@@ -2833,6 +2833,16 @@ async function main() {
   // first question land in the wrong prompt.
   _sessDir = await askSessionDir(cmd, flags.session);
 
+  // One source of truth for the rest of the run. The library resolves the files
+  // that belong to the installation rather than to a number — the Android token
+  // material above all — through SessionPaths.defaultBaseDir(), which reads
+  // WA_SESSION_DIR. The CLI, though, can arrive at its directory three other
+  // ways: --session, the folder remembered from the setup prompt, or the home
+  // default. Without publishing the answer here, `wa apk-material` wrote into
+  // the resolved directory while registration went looking in ~/.waSession and
+  // reported no material at all.
+  process.env.WA_SESSION_DIR = _sessDir;
+
   await askDebugMode(cmd);
   await askDonation(cmd);
 

package/lib/PlayStore.js

@@ -158,19 +158,68 @@ function _request(url, opts) {
 
 // ─── Auth ─────────────────────────────────────────────────────────────────────
 
+// How often the dispenser is asked before giving up, and how long between tries.
+//
+// The dispenser is a free service shared by everyone who uses it, and the way it
+// sheds load is to refuse — 403 when it is rate limiting, 5xx when it is having
+// a bad minute. Both are usually over in seconds, so one refusal is not an
+// answer worth reporting to the caller. The waits grow so a dispenser that is
+// genuinely busy is not hammered: roughly 2s, then 4s, then 8s.
+const DISPENSER_ATTEMPTS   = 4;
+const DISPENSER_BASE_DELAY = 2000;
+
+// The wait, overridable. Someone behind a dispenser that is having a long day
+// may want to wait longer between tries, and the test suite wants not to wait
+// at all. 0 is valid and means retry immediately.
+function _dispenserDelay() {
+  const n = Number(process.env.WA_PLAY_RETRY_DELAY_MS);
+  return Number.isFinite(n) && n >= 0 ? n : DISPENSER_BASE_DELAY;
+}
+
+// Worth asking again, or not. A refusal that says "too many, come back" is; a
+// 400 saying the request itself is malformed never will be, and retrying it
+// only makes the caller wait three times as long for the same error.
+function _dispenserRetryable(status) {
+  return status === 403 || status === 408 || status === 429 || status >= 500;
+}
+
+const _sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
 async function fetchAnonymousAuth() {
   const body = JSON.stringify(DEVICE_PROFILE);
-  const res  = await _request(AURORA_DISPENSER_URL, {
-    method:  'POST',
-    headers: {
-      'Content-Type':   'application/json',
-      'User-Agent':     AURORA_USER_AGENT,
-      'Content-Length': Buffer.byteLength(body)
-    },
-    body
-  });
+  const headers = {
+    'Content-Type':   'application/json',
+    'User-Agent':     AURORA_USER_AGENT,
+    'Content-Length': Buffer.byteLength(body)
+  };
+
+  let res = null;
+  let lastErr = null;
+  for (let attempt = 1; attempt <= DISPENSER_ATTEMPTS; attempt++) {
+    try {
+      res = await _request(AURORA_DISPENSER_URL, { method: 'POST', headers, body });
+      lastErr = null;
+      if (res.status === 200) break;
+      if (!_dispenserRetryable(res.status) || attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser HTTP ' + res.status + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    } catch (e) {
+      // A dropped connection or a timeout is the same kind of transient as a
+      // 5xx, so it is retried on the same schedule rather than thrown at once.
+      lastErr = e;
+      res = null;
+      if (attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser ' + (e && e.message) + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    }
+    await _sleep(_dispenserDelay() * Math.pow(2, attempt - 1));
+  }
+
+  if (lastErr) throw lastErr;
+
   if (res.status !== 200) {
     throw new Error('the Aurora token dispenser answered HTTP ' + res.status +
+      ' after ' + DISPENSER_ATTEMPTS + ' attempts' +
       ' — it is a free third-party service and this is what it does when it is ' +
       'down or rate limiting. Nothing is wrong with your setup; either try again ' +
       'later or pass an APK path instead.');
@@ -384,3 +433,9 @@ module.exports = {
   AURORA_DISPENSER_URL,
   PERSONAL_PACKAGE
 };
+
+// Dispenser retry internals, exposed for tests. Not part of the public API.
+module.exports._retry = {
+  dispenserRetryable: _dispenserRetryable,
+  DISPENSER_ATTEMPTS
+};

package/lib/Registration.js

@@ -957,7 +957,27 @@ function androidMaterialPath(device) {
   const name = (device && device.business)
     ? 'android-apk-material-business.json'
     : 'android-apk-material.json';
-  return path.join(os.homedir(), '.waSession', name);
+
+  // The session directory, wherever it actually is — not a hardcoded
+  // ~/.waSession. `wa apk-material` writes the file into the directory the CLI
+  // resolved (--session, WA_SESSION_DIR, or the one remembered from the setup
+  // prompt), while this read it from the home default and reported "no
+  // material" for anything else. Anyone who moved their sessions had to set
+  // WA_ANDROID_APK_MATERIAL by hand to make registration find a file that was
+  // already there. SessionPaths.defaultBaseDir() is the same resolver the
+  // writer goes through, and SHARED_FILES there already names both of these as
+  // belonging to the base directory.
+  const { defaultBaseDir } = require('./SessionPaths');
+  const primary = path.join(defaultBaseDir(), name);
+
+  // Material extracted before the directory could be moved still sits in
+  // ~/.waSession. If the configured directory has none but the old default
+  // does, read that rather than claiming there is no material at all.
+  if (!fs.existsSync(primary)) {
+    const legacy = path.join(os.homedir(), '.waSession', name);
+    if (legacy !== primary && fs.existsSync(legacy)) return legacy;
+  }
+  return primary;
 }
 
 const _androidMaterial = {};
@@ -986,18 +1006,38 @@ function tryLoadAndroidMaterial(device) {
  * Silently ignoring WA_OS is how you end up watching an Android registration go
  * out under an iOS User-Agent and not knowing why.
  */
+// A session's device identity, frozen for the whole registration.
+//
+// createNewStore captures the device when the session is created and writes it
+// to disk with everything else, so a session always arrives here already
+// carrying one. From that point it is frozen: /exist, /code, /register and
+// every retry read this same identity, and no request can describe one handset
+// while a sibling request in the same flow describes another.
+//
+// The bug this closes: the gate here used to be `registered || codePending`, so
+// the very first /code of a session ignored the stored device and re-read it
+// from the environment. /exist had already gone out as the stored device — an
+// Android/Samsung, say, loaded from the session file — and /code then went out
+// as the environment default (iOS/iPhone). One number, two phones, in one flow.
+// That is precisely the shape a "download the official app" block screen looks
+// for, and it was reproducible from the logs. See
+// test/registration-device-consistency.test.js.
+//
+// WA_OS / WA_BUSINESS therefore choose the device only for a session that does
+// not have one yet — which in practice means never, since createNewStore always
+// sets it. To change the platform of an existing session, start it over: delete
+// the session file, and the next createNewStore picks up the current WA_OS.
 function deviceForRegistration(store, opts) {
   const env    = getDeviceConfig();
   const stored = store && store.device;
-  const settled = !!(store && (store.registered || store.codePending));
-  if (!settled || !stored) return env;
+  if (!stored || !stored.os) return env;
 
   const say = (opts && opts.onProgress) || (m => _whaDbg('[DBG] REG ' + m));
 
   if (stored.os !== env.os) {
     say('note: this session was started as ' + stored.os + ', so it stays ' + stored.os +
-        ' — WA_OS=' + env.os + ' does not apply to a number that is already part-way ' +
-        'through registering. Delete the session file to start it over as ' + env.os + '.');
+        ' — WA_OS=' + env.os + ' does not apply to a number that already has a ' +
+        'device. Delete the session file to start it over as ' + env.os + '.');
   }
 
   // The same rule for the variant: an account is created as Business or as
@@ -1007,13 +1047,36 @@ function deviceForRegistration(store, opts) {
   if (!!stored.business !== !!env.business) {
     say('note: this session was started as ' + (stored.business ? 'Business' : 'consumer') +
         ', so it stays that — WA_BUSINESS=' + (env.business ? '1' : '0') +
-        ' does not apply to a number that is already part-way through registering. ' +
+        ' does not apply to a number that already has a device. ' +
         'Delete the session file to start it over.');
   }
 
   return stored;
 }
 
+// The device identity a request is about to go out with, logged so /exist and
+// /code can be compared side by side. Gated behind the debug channel — it costs
+// nothing when debug is off, and when a registration misbehaves it is the first
+// thing worth seeing. The User-Agent is built the same way the real request
+// builds it, so what this prints is what actually goes on the wire.
+function logDeviceIdentity(tag, store, waVersion) {
+  const stored = store && store.device;
+  const d      = stored || getDeviceConfig();
+  const ver    = waVersion || (store && store.version) || '';
+  let ua = '';
+  try { ua = registrationHeaders(d, ver)['User-Agent']; } catch (_) {}
+  _whaDbg('[DBG] DEVICE_IDENTITY ' + tag +
+    ' os=' + d.os +
+    ' osVersion=' + d.osVersion +
+    ' manufacturer=' + (d.manufacturer || '-') +
+    ' model=' + (d.model || d.modelId || '-') +
+    ' modelId=' + (d.modelId || '-') +
+    ' business=' + !!d.business +
+    ' waVersion=' + (ver || '-') +
+    ' source=' + (stored ? 'store.device (frozen)' : 'getDeviceConfig() (env/default)') +
+    ' ua="' + ua + '"');
+}
+
 /**
  * Have the Android token material ready, fetching the APK if it is not.
  *
@@ -1983,6 +2046,7 @@ async function assertRegistrationKeys(store, waVersion) {
 
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
+      logDeviceIdentity('before /exist', store, waVersion);
       const result = await sendRequest('/exist', store, waVersion, false, null);
       // reason === 'incorrect' → keys not found → fresh
       if (result && result.reason === 'incorrect') {
@@ -2087,6 +2151,7 @@ async function requestSmsCode(store, method, opts) {
       const verifyScreen = currentVerifyScreen(store);
       await sendFunnelLog(store, waVersion, verifyScreen, 'request_code', 'request_code_attempt');
 
+      logDeviceIdentity('before /code', store, waVersion);
       const result = await sendRequest('/code', store, waVersion, true, extra);
 
       const status = result.status;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.4",
+  "version": "5.29.6",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",