whalibmob 5.5.60 → 5.5.62

package/.env.example

@@ -0,0 +1,78 @@
+# whalibmob — example environment configuration
+#
+# Copy this file to `.env` in your project root and uncomment what you need:
+#
+#     cp node_modules/whalibmob/.env.example .env
+#
+# The CLI loads `.env` from the current working directory automatically.
+# If you use the library programmatically, call `require('dotenv').config()`
+# yourself before creating a client.
+#
+# Every variable below is OPTIONAL — with an empty .env the library runs with
+# the defaults shown next to each entry.
+
+
+# ─── Device profile ──────────────────────────────────────────────────────────
+# Which platform to identify as during registration and connection.
+# Values: ios | android
+# WA_OS=ios
+
+# Named predefined device profile. Takes priority over the individual
+# WA_DEVICE_* variables below.
+#
+#   ios      iphone15pro, iphone15, iphone14, iphone14pro, iphone13, iphone12
+#   android  samsung-s24-ultra, samsung-s24, samsung-s23, samsung-s23-ultra,
+#            samsung-a55, pixel8pro, pixel8, pixel7, pixel7a, xiaomi14,
+#            xiaomi13, oneplus12, oneplus11, oppo-find-x7, realme-gt5
+#
+# Default: iphone15pro when WA_OS=ios, samsungs24ultra when WA_OS=android
+# WA_DEVICE=iphone15pro
+
+
+# ─── Custom device profile ───────────────────────────────────────────────────
+# Only used when WA_DEVICE does not match a predefined profile. Any value left
+# unset falls back to the default profile for the selected WA_OS.
+# The defaults shown here are the iOS ones (iPhone 15 Pro).
+
+# Device display name — e.g. "iPhone 15 Pro", "Samsung Galaxy S24 Ultra"
+# WA_DEVICE_MODEL=iPhone 15 Pro
+
+# Apple | Samsung | Google | Xiaomi | OnePlus …
+# WA_DEVICE_MANUFACTURER=Apple
+
+# OS version string — e.g. 17.4.1 for iOS, 14 for Android
+# WA_DEVICE_OS_VERSION=17.4.1
+
+# OS build number — e.g. 21E236 for iOS, UP1A.231005.007 for Android
+# WA_DEVICE_BUILD=21E236
+
+# Internal model identifier — e.g. iPhone16,1 for iOS, SM-S928B for Android
+# WA_DEVICE_MODEL_ID=iPhone16,1
+
+
+# ─── WhatsApp version ────────────────────────────────────────────────────────
+# Pin the WhatsApp client version. When set, the live version lookup is skipped
+# entirely. Leave unset to fetch the current version automatically (recommended).
+# WA_VERSION=2.24.10.75
+
+# Override the static registration token. Leave unset to use the built-in token
+# for the selected platform — only change this if you know what you are doing.
+# WA_STATIC_TOKEN=
+
+
+# ─── Proxy ───────────────────────────────────────────────────────────────────
+# Route registration traffic through a SOCKS5 proxy, given as host:port.
+# TOR_PROXY takes precedence over SOCKS_PROXY when both are set.
+# Default Tor SOCKS port is 9050.
+# TOR_PROXY=127.0.0.1:9050
+# SOCKS_PROXY=127.0.0.1:1080
+
+
+# ─── Frida attestation bridge ────────────────────────────────────────────────
+# Host running the Frida attestation helper (see the frida/ directory).
+# Leave unset to disable the bridge.
+# WA_FRIDA_HOST=127.0.0.1
+
+# Port the helper listens on.
+# Default: 1119 (WhatsApp consumer; the Business build listens on 1120)
+# WA_FRIDA_PORT=1119

package/cli.js

@@ -37,7 +37,12 @@ const {
 
 const { assertMeId, initAuthCreds } = require('./lib/auth-utils');
 
-const VERSION = '5.5.59';
+// Read the version straight from package.json so it can never drift out of sync
+// with the published package.  npm always ships package.json in the tarball,
+// regardless of the "files" list, so this resolves for installed users too.
+const VERSION = (() => {
+  try { return require('./package.json').version; } catch (_) { return 'unknown'; }
+})();
 
 // ─── output helpers ───────────────────────────────────────────────────────────
 

package/lib/Client.js

@@ -762,7 +762,17 @@ class WhalibmobClient extends EventEmitter {
         this._sendReadReceipt(id, fromRaw, partRaw);
       })
       .catch(err => {
+        _whaDbg('[DBG] GROUP_ERR id=' + id + ' from=' + from +
+          ' participant=' + participant + ' err=' + (err && err.message));
         this.emit('decrypt_error', { id, from, participant, err });
+        // Ask the sender to re-send with a fresh SenderKey distribution.
+        // Without this a group we joined after the sender distributed its key
+        // — or any group whose SKDM we missed — stays permanently
+        // undecryptable, failing every message with "No session found to
+        // decrypt message".  The DM path already does this; groups need it
+        // just as much, and the retry must be addressed to the participant
+        // that actually encrypted the message, not to the group JID.
+        this._sendRetryRequest(id, node);
       });
   }
 
@@ -1244,6 +1254,15 @@ class WhalibmobClient extends EventEmitter {
     if (!this._socket || !this._connected) return;
     const mcId = this._genMsgId();
     _whaDbg('[DBG] SEND media_conn IQ id=' + mcId);
+    // Match the reply by request id.  The server echoes back only `from`, `id`
+    // and `type='result'` — it does NOT repeat the `xmlns` of the request, so
+    // keying off xmlns alone would never fire and every upload would stall
+    // until the 15 s "Timeout waiting for media connection".
+    this._pendingIqs.set(mcId, (resp) => {
+      this._onMediaConnectionResult(resp);
+    });
+    // Don't leak the handler if the server never answers.
+    setTimeout(() => this._pendingIqs.delete(mcId), 20000);
     this._socket.sendNode(new BinaryNode('iq', {
       id:    mcId,
       to:    's.whatsapp.net',
@@ -1254,7 +1273,17 @@ class WhalibmobClient extends EventEmitter {
 
   _onMediaConnectionResult(node) {
     const connNode = findChild(node, 'media_conn');
-    if (!connNode) return;
+    if (!connNode) {
+      // Server answered but refused (or the IQ handler timed out and passed
+      // nothing).  Surface it so the waiter fails fast with a real reason
+      // instead of sitting out the full media-connection timeout.
+      const reason = (node && node.attrs && node.attrs.type === 'error')
+        ? ('server returned IQ error' + (node.attrs.code ? ' ' + node.attrs.code : ''))
+        : 'no media_conn node in server reply';
+      _whaDbg('[DBG] media_conn failed: ' + reason);
+      this.emit('media_conn_error', new Error('Media connection refused: ' + reason));
+      return;
+    }
     const auth  = (connNode.attrs && connNode.attrs.auth) || '';
     const ttl   = connNode.attrs && connNode.attrs.ttl ? parseInt(connNode.attrs.ttl, 10) : 300;
     const hosts = [];
@@ -1473,15 +1502,25 @@ class WhalibmobClient extends EventEmitter {
     ]);
 
     const response = await this._sendIq(node);
-    if (!response) return [];
-
-    // Response content is a list of <group> nodes
-    const children = Array.isArray(response.content) ? response.content : [];
-    const groups = children
+    if (!response) {
+      throw new Error('fetchAllGroups: no reply from server (IQ timed out)');
+    }
+    if (response.attrs && response.attrs.type === 'error') {
+      const errNode = findChild(response, 'error');
+      const code    = errNode && errNode.attrs && errNode.attrs.code;
+      throw new Error('fetchAllGroups: server returned error' + (code ? ' ' + code : ''));
+    }
+
+    // The server wraps the list in a <groups> node: iq > groups > group[].
+    // Fall back to scanning the iq body directly in case a server build ever
+    // returns them unwrapped.
+    const groupsNode = findChild(response, 'groups');
+    const container  = groupsNode || response;
+    const children   = Array.isArray(container.content) ? container.content : [];
+    return children
       .filter(n => n && n.description === 'group')
       .map(n => this._parseGroupNode(n))
       .filter(Boolean);
-    return groups;
   }
 
   // ─── Group member helpers ─────────────────────────────────────────────────

package/lib/messages/MessageSender.js

@@ -813,11 +813,28 @@ class MessageSender {
     // Auto-fetch group metadata if member cache is empty (first send to this group)
     let members = this._client._getGroupMembers(groupJid);
     if (members.length === 0 && typeof this._client.getGroupMetadata === 'function') {
+      _whaDbg('[DBG] GROUP_SEND auto-fetch metadata for ' + groupJid);
+      let metaErr = null;
       try {
-        _whaDbg('[DBG] GROUP_SEND auto-fetch metadata for ' + groupJid);
         await this._client.getGroupMetadata(groupJid);
         members = this._client._getGroupMembers(groupJid);
-      } catch (_) {}
+      } catch (err) {
+        metaErr = err;
+        _whaDbg('[DBG] GROUP_SEND metadata fetch failed: ' + (err && err.message));
+      }
+      // Without the participant list we cannot establish Signal sessions with
+      // the members, so the SenderKey distribution would reach nobody and the
+      // stanza would carry an <enc type='skmsg'> that no one can decrypt.  The
+      // server rejects exactly that shape with ack error 479.  Fail here with a
+      // reason the caller can act on instead of emitting a doomed stanza.
+      if (members.length === 0) {
+        throw new Error(
+          'Cannot send to ' + groupJid + ': group metadata unavailable' +
+          (metaErr ? ' (' + metaErr.message + ')' : '') +
+          ' — no Signal session can be established with the members. ' +
+          'Check that the account is still a participant of this group.'
+        );
+      }
     }
 
     // Determine addressing mode for this group (lid = modern groups, pn = legacy)
@@ -1153,20 +1170,39 @@ class MessageSender {
   }
 
   async _fetchMediaConn() {
+    if (!this._client || !this._client._connected) {
+      throw new Error('Cannot fetch media connection: not connected');
+    }
     return new Promise((resolve, reject) => {
-      const timeout = setTimeout(() => {
+      const cleanup = () => {
+        clearTimeout(timeout);
         this._client.removeListener('media_conn', onConn);
+        this._client.removeListener('media_conn_error', onErr);
+      };
+      const timeout = setTimeout(() => {
+        cleanup();
         reject(new Error('Timeout waiting for media connection'));
       }, 15000);
       const onConn = ({ hosts, auth, ttl }) => {
-        clearTimeout(timeout);
-        if (hosts && hosts.length) {
-          this.setMediaConnection(hosts, auth, ttl, Date.now());
+        cleanup();
+        if (!hosts || !hosts.length) {
+          return reject(new Error('Media connection returned no upload hosts'));
         }
+        this.setMediaConnection(hosts, auth, ttl, Date.now());
         resolve();
       };
+      const onErr = (err) => {
+        cleanup();
+        reject(err instanceof Error ? err : new Error(String(err)));
+      };
       this._client.once('media_conn', onConn);
-      try { this._client._requestMediaConnection(); } catch (_) {}
+      this._client.once('media_conn_error', onErr);
+      try {
+        this._client._requestMediaConnection();
+      } catch (err) {
+        cleanup();
+        reject(err);
+      }
     });
   }
 }

package/lib/signal/WaSignalGroup/group_cipher.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { decrypt, encrypt } = require('libsignal/src/crypto');
+const { decrypt, encrypt } = require('../libsignal/crypto');
 const { SenderKeyMessage } = require('./sender-key-message');
 const { SenderKeyRecord } = require('./sender-key-record');
 

package/lib/signal/WaSignalGroup/keyhelper.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
-const { generateKeyPair } = require('libsignal/src/curve');
+const { generateKeyPair } = require('../libsignal/curve');
 
 function generateSenderKey() {
     return crypto.randomBytes(32);

package/lib/signal/WaSignalGroup/sender-chain-key.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { calculateMAC } = require('libsignal/src/crypto');
+const { calculateMAC } = require('../libsignal/crypto');
 const { SenderMessageKey } = require('./sender-message-key');
 
 class SenderChainKey {

package/lib/signal/WaSignalGroup/sender-key-message.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { calculateSignature, verifySignature } = require('libsignal/src/curve');
+const { calculateSignature, verifySignature } = require('../libsignal/curve');
 const { CiphertextMessage } = require('./ciphertext-message');
 
 // ─── Minimal protobuf encode/decode for SenderKeyMessage ─────────────────────

package/lib/signal/WaSignalGroup/sender-message-key.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { deriveSecrets } = require('libsignal/src/crypto');
+const { deriveSecrets } = require('../libsignal/crypto');
 
 class SenderMessageKey {
     constructor(iteration, seed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.60",
+  "version": "5.5.62",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",