whalibmob 5.5.65 → 5.5.67

package/cli.js

@@ -7,15 +7,39 @@
 // process.env is fully populated when modules read it at load time.
 try { require('dotenv').config(); } catch (_) {}
 
-// Suppress internal [DBG] lines — keep console clean for users
+// ─── Wire trace ───────────────────────────────────────────────────────────────
+// Full protocol tracing prints every stanza this client sends and receives.
+// It is opt-in: an interactive session asks once at startup. `--debug` turns it
+// on without asking (for scripts and pipes), `--no-debug` / `--quiet` / `-q` /
+// WA_DEBUG=0 turn it off without asking.
+const TRACE_FORCE_ON = process.argv.includes('--debug') || process.env.WA_DEBUG === '1';
+const TRACE_FORCE_OFF = (
+  process.argv.includes('--no-debug') ||
+  process.argv.includes('--quiet') ||
+  process.argv.includes('-q') ||
+  process.env.WA_DEBUG === '0'
+);
+// `--trace-bytes` additionally dumps the raw encoded bytes of every stanza.
+const TRACE_BYTES = process.argv.includes('--trace-bytes');
+
+// Consume the trace flags so the command parser below never sees them and
+// reports e.g. `--no-debug` as an unknown command.
+const _TRACE_FLAGS = ['--debug', '--no-debug', '--quiet', '-q', '--trace-bytes'];
+process.argv = process.argv.filter(a => !_TRACE_FLAGS.includes(a));
+
+// Console starts clean: internal [DBG] lines are swallowed unless tracing is
+// switched on, which restores this stream.
 const _origStderrWrite = process.stderr.write.bind(process.stderr);
-process.stderr.write = function(chunk, enc, cb) {
-  if (typeof chunk === 'string' && chunk.startsWith('[DBG]')) {
-    if (typeof enc === 'function') enc(); else if (typeof cb === 'function') cb();
-    return true;
-  }
-  return _origStderrWrite(chunk, enc, cb);
-};
+function installDbgSuppression() {
+  process.stderr.write = function(chunk, enc, cb) {
+    if (typeof chunk === 'string' && chunk.startsWith('[DBG]')) {
+      if (typeof enc === 'function') enc(); else if (typeof cb === 'function') cb();
+      return true;
+    }
+    return _origStderrWrite(chunk, enc, cb);
+  };
+}
+installDbgSuppression();
 
 const path     = require('path');
 const fs       = require('fs');
@@ -37,6 +61,153 @@ const {
 
 const { assertMeId, initAuthCreds } = require('./lib/auth-utils');
 
+// ─── Wire trace implementation ────────────────────────────────────────────────
+// Everything below is CLI-only instrumentation; the library is untouched.
+//
+// Two hooks cover the whole protocol surface:
+//   * NoiseSocket.prototype.sendNode  — every stanza leaving this client
+//   * NoiseSocket.prototype.emit      — the 'node' event, every stanza arriving
+// They are patched on the prototype rather than on an instance so the trace
+// survives reconnects and covers frames sent during the handshake, before any
+// client-level event has fired. https.request is wrapped as well, because SMS
+// registration runs over HTTP and never touches the socket.
+let _wireTraceOn = false;
+function enableWireTrace() {
+  if (_wireTraceOn) return;
+  _wireTraceOn = true;
+  // Tracing is the point now — let [DBG] through again.
+  process.stderr.write = _origStderrWrite;
+  const { NoiseSocket } = require('./lib/noise');
+  const { configureLogger } = require('./lib/logger');
+  const https = require('https');
+
+  const C = process.stdout.isTTY
+    ? { out:'\x1b[36m', in:'\x1b[32m', http:'\x1b[35m', dim:'\x1b[2m', tag:'\x1b[33m', off:'\x1b[0m' }
+    : { out:'', in:'', http:'', dim:'', tag:'', off:'' };
+
+  // pino writes newline-delimited JSON to stdout. That is the right shape for a
+  // log collector and the wrong one for someone watching a live session, so
+  // reformat its lines on the way out. Anything that is not a pino record is
+  // passed through byte-for-byte.
+  const stamp = () => new Date().toISOString().slice(11, 23);
+  const trace = (s) => _origStderrWrite(s + '\n');
+
+  // Route the library's internal [DBG] stream through pino at full verbosity.
+  // pino writes newline-delimited JSON straight to fd 1 via sonic-boom, which
+  // bypasses process.stdout — so rather than trying to reformat its output we
+  // intercept at pino's own logMethod hook, render the record ourselves and let
+  // pino emit nothing. The library still logs through pino; only the rendering
+  // is ours.
+  const LEVEL_NAME = { 10: 'TRACE', 20: 'DEBUG', 30: 'INFO ', 40: 'WARN ', 50: 'ERROR', 60: 'FATAL' };
+  configureLogger({
+    level: 'trace',
+    hooks: {
+      logMethod(args, _method, level) {
+        const msg = args.map(a => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ');
+        trace(`${C.dim}${stamp()} ${LEVEL_NAME[level] || level}${C.off} ${msg}`);
+      }
+    }
+  });
+
+  const isPrintable = (buf) => buf.length > 0 && buf.every(b => b === 9 || b === 10 || b === 13 || (b >= 32 && b < 127));
+
+  // JIDs decode to objects, byte fields to Buffers — render both readably.
+  function attrValue(v) {
+    if (v === null || v === undefined) return '';
+    if (Buffer.isBuffer(v)) return isPrintable(v) ? v.toString('utf8') : '0x' + v.toString('hex');
+    if (typeof v === 'object') {
+      if (v.user !== undefined) {
+        const dev = v.device ? ':' + v.device : '';
+        return `${v.user || ''}${dev}@${v.server || ''}`;
+      }
+      return JSON.stringify(v);
+    }
+    return String(v);
+  }
+
+  function renderContent(content, pad) {
+    if (content === null || content === undefined) return null;
+    if (Array.isArray(content)) return content.map(n => nodeToXml(n, pad)).join('\n');
+    if (Buffer.isBuffer(content)) {
+      if (isPrintable(content)) return pad + content.toString('utf8');
+      const hex = content.toString('hex');
+      const shown = hex.length > 512 ? hex.slice(0, 512) + '…' : hex;
+      return `${pad}${C.dim}[${content.length} bytes] ${shown}${C.off}`;
+    }
+    return pad + String(content);
+  }
+
+  function nodeToXml(node, pad) {
+    pad = pad || '';
+    if (!node || !node.description) return pad + String(node);
+    const attrs = Object.entries(node.attrs || {})
+      .map(([k, v]) => ` ${C.tag}${k}${C.off}="${attrValue(v)}"`).join('');
+    const tag = node.description;
+    const body = renderContent(node.content, pad + '  ');
+    if (body === null) return `${pad}<${tag}${attrs}/>`;
+    return `${pad}<${tag}${attrs}>\n${body}\n${pad}</${tag}>`;
+  }
+
+  function logStanza(dir, node) {
+    const colour = dir === 'OUT' ? C.out : C.in;
+    const arrow  = dir === 'OUT' ? '──▶ SENT' : '◀── RECV';
+    trace(`\n${colour}${stamp()} ${arrow}${C.off}`);
+    trace(nodeToXml(node, '  '));
+    if (TRACE_BYTES) {
+      try {
+        const { encodeNode } = require('./lib/BinaryNode');
+        const raw = encodeNode(node);
+        trace(`  ${C.dim}raw ${raw.length}B: ${raw.toString('hex')}${C.off}`);
+      } catch (_) {}
+    }
+  }
+
+  const origSendNode = NoiseSocket.prototype.sendNode;
+  NoiseSocket.prototype.sendNode = function (node) {
+    try { logStanza('OUT', node); } catch (_) {}
+    return origSendNode.call(this, node);
+  };
+
+  const origEmit = NoiseSocket.prototype.emit;
+  NoiseSocket.prototype.emit = function (event, ...args) {
+    try {
+      if (event === 'node')       logStanza('IN', args[0]);
+      else if (event === 'open')  trace(`\n${C.in}${stamp()} ◀── HANDSHAKE COMPLETE — channel secured${C.off}`);
+      else if (event === 'error') trace(`\n${C.in}${stamp()} ◀── SOCKET ERROR: ${args[0] && args[0].message}${C.off}`);
+      else if (event === 'close') trace(`\n${C.in}${stamp()} ◀── SOCKET CLOSED${C.off}`);
+    } catch (_) {}
+    return origEmit.apply(this, [event, ...args]);
+  };
+
+  // Registration (SMS request / code verify) goes over HTTPS, not the socket.
+  const origRequest = https.request;
+  https.request = function (...args) {
+    const opts = typeof args[0] === 'string' ? { href: args[0] } : (args[0] || {});
+    const host = opts.hostname || opts.host || opts.href || '?';
+    const target = `${opts.method || 'GET'} ${host}${opts.path || ''}`;
+    trace(`\n${C.http}${stamp()} ──▶ HTTP ${target}${C.off}`);
+    if (opts.headers) {
+      for (const [k, v] of Object.entries(opts.headers)) {
+        trace(`  ${C.tag}${k}${C.off}: ${v}`);
+      }
+    }
+    const req = origRequest.apply(this, args);
+    const origWrite = req.write.bind(req);
+    req.write = function (chunk, ...rest) {
+      try { trace(`  ${C.dim}body: ${Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk}${C.off}`); } catch (_) {}
+      return origWrite(chunk, ...rest);
+    };
+    req.on('response', (res) => {
+      trace(`\n${C.http}${stamp()} ◀── HTTP ${res.statusCode} from ${host}${C.off}`);
+      let body = '';
+      res.on('data', d => { if (body.length < 8192) body += d.toString('utf8'); });
+      res.on('end', () => { if (body) trace(`  ${C.dim}${body}${C.off}`); });
+    });
+    return req;
+  };
+
+}
+
 // Read the version straight from package.json so it can never drift out of sync
 // with the published package.  npm always ships package.json in the tarball,
 // regardless of the "files" list, so this resolves for installed users too.
@@ -1444,12 +1615,51 @@ options:
   --method          sms | voice | wa_old | email  (default: sms)
   --email <address> email address (required when --method email)
 
+debug:
+  an interactive session asks once whether to trace the protocol.
+  answer y to print every stanza sent and received, n to keep it quiet.
+
+  --debug           trace without asking  (same as WA_DEBUG=1)
+  --no-debug, -q    stay quiet without asking  (same as WA_DEBUG=0)
+  --trace-bytes     also dump the raw encoded bytes of every stanza
+
 after connecting, type /help for all available commands.
 `.trim();
 
+function announceTrace() {
+  out('debug full ON — every stanza sent and received will be printed' +
+      (TRACE_BYTES ? ', with raw frame bytes' : '') + '.\n');
+}
+
+// Ask once, at startup, whether to trace the protocol. Commands that never
+// touch the network skip the question entirely. A non-interactive stdin (a
+// pipe, a script) is treated as "no" rather than hanging on a prompt that
+// nobody is there to answer.
+function askDebugMode(cmd) {
+  if (TRACE_FORCE_ON)  { enableWireTrace(); announceTrace(); return Promise.resolve(); }
+  if (TRACE_FORCE_OFF) return Promise.resolve();
+  const OFFLINE = ['version', '--version', '-v', 'help', '--help', '-h'];
+  if (cmd && OFFLINE.includes(cmd)) return Promise.resolve();
+  if (!process.stdin.isTTY) return Promise.resolve();
+
+  return new Promise(resolve => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question('do you want debug full?  [y/N] ', (answer) => {
+      rl.close();
+      if (/^y(es)?$/i.test(String(answer).trim())) {
+        enableWireTrace();
+        announceTrace();
+      }
+      resolve();
+    });
+  });
+}
+
 async function main() {
   const { cmd, sub, flags, pos } = parseArgs(process.argv);
 
+  await askDebugMode(cmd);
+
   _sessDir = flags.session || defaultSessionDir();
 
   if (!cmd) {

package/lib/messages/MessageSender.js

@@ -839,10 +839,22 @@ class MessageSender {
 
     // Determine addressing mode for this group (lid = modern groups, pn = legacy)
     const groupAddressingMode = this._client._groupAddressingMode.get(groupJid) || 'lid';
-    // For LID-mode groups, sender identity is own LID JID; otherwise own PN JID
-    const senderIdentity = (groupAddressingMode === 'lid' && this._client._myLid)
-      ? this._client._myLid
-      : ownJid;
+    // A stanza addressed with addressing_mode='lid' must carry participants in
+    // LID space only. Mixing @s.whatsapp.net targets into it is exactly what
+    // DeviceManager warns about, and the server answers it with ack 479.
+    const useLid = groupAddressingMode === 'lid';
+    if (useLid && !this._client._myLid) {
+      throw new Error(
+        'Cannot send to ' + groupJid + ': group is LID-addressed but our own LID ' +
+        'is unknown (the server did not supply lid= on <success>). ' +
+        'Reconnect so the LID is re-issued.'
+      );
+    }
+    const myLidUser = useLid ? phoneFromJid(this._client._myLid) : null;
+    // For LID-mode groups, sender identity is own LID JID; otherwise own PN JID.
+    // Normalised to the bare user so it matches the participant targets below.
+    const selfJid = useLid ? `${myLidUser}@lid` : ownJid;
+    const senderIdentity = selfJid;
 
     const rawSKDM   = await this._signal.buildSKDM(groupJid, senderIdentity);
     const skdmMsg   = encodeSenderKeyDistributionMessage(groupJid, rawSKDM);
@@ -856,9 +868,16 @@ class MessageSender {
         const isLid = jid.endsWith('@lid');
         const raw   = phoneFromJid(jid);
         if (isLid) {
-          const pn = this._client._lidToPn && this._client._lidToPn.get(raw);
-          if (pn) return pn;
-          // No PN mapping yet — track for LID-direct session ensure
+          // In a LID-addressed group, resolve LID members through the LID path
+          // even when we know their phone number — swapping in the PN would put
+          // an @s.whatsapp.net target into a @lid stanza.
+          if (!useLid) {
+            const pn = this._client._lidToPn && this._client._lidToPn.get(raw);
+            if (pn) return pn;
+          }
+          // We are a member of the group ourselves, so our own devices come out
+          // of this same walk — Baileys likewise derives every group target
+          // from the participant list and never appends own devices separately.
           lidMembersWithoutPn.push(jid);
           return null;
         }
@@ -879,15 +898,31 @@ class MessageSender {
       this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal)
     ]);
 
-    const allTargets = [...memberDevices, ...lidDevices, ...ownDevices];
+    // Own devices come back as @s.whatsapp.net — re-express them in LID space
+    // so every target in a LID stanza shares one address family.  In LID mode
+    // the participant walk above already covered us, so this only fills the gap
+    // for legacy pn-addressed groups.
+    const ownTargets = useLid ? [] : ownDevices;
 
-    const phashTargets = allTargets.includes(ownJid)
-      ? allTargets
-      : [ownJid, ...allTargets];
+    // Dedupe: a device reached through more than one path must still appear
+    // exactly once in <participants>.
+    const allTargets = [...new Set([...memberDevices, ...lidDevices, ...ownTargets])];
 
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
-    const skdmRecipients  = allTargets.filter(jid => !existingSkdmMap[jid]);
+    // Same exclusions Baileys applies when choosing SenderKey recipients:
+    // hosted (bot-side) users and device 99, which is a server placeholder
+    // rather than a real endpoint, must never receive a distribution.
+    const isSkdmEligible = (jid) => {
+      const s = String(jid);
+      if (s.endsWith('@hosted') || s.endsWith('@hosted.lid')) return false;
+      const base  = s.replace(/@.*$/, '');
+      const colon = base.indexOf(':');
+      return !(colon >= 0 && parseInt(base.slice(colon + 1), 10) === 99);
+    };
+    const skdmRecipients = allTargets.filter(
+      jid => !existingSkdmMap[jid] && isSkdmEligible(jid)
+    );
 
     // Acquire mutex for all group encryption — SKDM fanout and senderKey encrypt
     // share the same Signal session state and must not run concurrently.
@@ -901,22 +936,34 @@ class MessageSender {
       skmsgCiphertext = await this._signal.senderKeyEncrypt(groupJid, senderIdentity, plaintext);
     });
 
-    const phash = phashTargets.length > 0 ? computePhash(phashTargets) : null;
-
     const skdmHasPkmsg = skdmEncrypted.some(e => e.type === 'pkmsg');
     const advBytes     = skdmHasPkmsg ? _buildOrGetAdvIdentity(this._client._store) : null;
+    // No device-identity is expected here. ADVSignedDeviceIdentity is issued
+    // when a companion device is paired, to prove the companion's identity key
+    // was authorised by the primary. This client registers over SMS as the
+    // primary device, so its identity key IS the account identity and there is
+    // nothing to attach — advBytes stays null and that is correct.
 
     const msgContent = [];
     if (advBytes) {
       msgContent.push(new BinaryNode('device-identity', {}, advBytes));
     }
     if (skdmEncrypted.length > 0) {
-      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, null));
+      // Baileys applies the same extra attrs — mediatype included — to the
+      // SenderKey participant nodes as to the skmsg, so an image sent to a
+      // group carries mediatype on both. Passing null here left the SKDM
+      // <enc> nodes unlabelled.
+      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, mediaSubtype));
     }
     const skmsgAttrs = { type: 'skmsg', v: '2' };
     if (mediaSubtype) skmsgAttrs.mediatype = mediaSubtype;
     msgContent.push(new BinaryNode('enc', skmsgAttrs, Buffer.isBuffer(skmsgCiphertext) ? skmsgCiphertext : Buffer.from(skmsgCiphertext)));
 
+    // No phash on group stanzas. Baileys computes a participant hash only on
+    // the 1:1 path; a group message carries id/to/type/addressing_mode and
+    // nothing else. Sending a hash the server did not ask for — over a
+    // participant set it derives itself from the group — is a way to have the
+    // stanza rejected outright.
     const stanzaAttrs = {
       to: jidStrToObj(groupJid),
       id: msgId,
@@ -924,7 +971,6 @@ class MessageSender {
       addressing_mode: groupAddressingMode,
       t:   String(msNow())
     };
-    if (phash) stanzaAttrs.phash = phash;
     if (options.edit) stanzaAttrs.edit = String(options.edit);
 
     const msgNode = new BinaryNode('message', stanzaAttrs, msgContent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.65",
+  "version": "5.5.67",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",