whalibmob 5.5.66 → 5.5.68

package/cli.js

@@ -7,15 +7,39 @@
 // process.env is fully populated when modules read it at load time.
 try { require('dotenv').config(); } catch (_) {}
 
-// Suppress internal [DBG] lines — keep console clean for users
+// ─── Wire trace ───────────────────────────────────────────────────────────────
+// Full protocol tracing prints every stanza this client sends and receives.
+// It is opt-in: an interactive session asks once at startup. `--debug` turns it
+// on without asking (for scripts and pipes), `--no-debug` / `--quiet` / `-q` /
+// WA_DEBUG=0 turn it off without asking.
+const TRACE_FORCE_ON = process.argv.includes('--debug') || process.env.WA_DEBUG === '1';
+const TRACE_FORCE_OFF = (
+  process.argv.includes('--no-debug') ||
+  process.argv.includes('--quiet') ||
+  process.argv.includes('-q') ||
+  process.env.WA_DEBUG === '0'
+);
+// `--trace-bytes` additionally dumps the raw encoded bytes of every stanza.
+const TRACE_BYTES = process.argv.includes('--trace-bytes');
+
+// Consume the trace flags so the command parser below never sees them and
+// reports e.g. `--no-debug` as an unknown command.
+const _TRACE_FLAGS = ['--debug', '--no-debug', '--quiet', '-q', '--trace-bytes'];
+process.argv = process.argv.filter(a => !_TRACE_FLAGS.includes(a));
+
+// Console starts clean: internal [DBG] lines are swallowed unless tracing is
+// switched on, which restores this stream.
 const _origStderrWrite = process.stderr.write.bind(process.stderr);
-process.stderr.write = function(chunk, enc, cb) {
-  if (typeof chunk === 'string' && chunk.startsWith('[DBG]')) {
-    if (typeof enc === 'function') enc(); else if (typeof cb === 'function') cb();
-    return true;
-  }
-  return _origStderrWrite(chunk, enc, cb);
-};
+function installDbgSuppression() {
+  process.stderr.write = function(chunk, enc, cb) {
+    if (typeof chunk === 'string' && chunk.startsWith('[DBG]')) {
+      if (typeof enc === 'function') enc(); else if (typeof cb === 'function') cb();
+      return true;
+    }
+    return _origStderrWrite(chunk, enc, cb);
+  };
+}
+installDbgSuppression();
 
 const path     = require('path');
 const fs       = require('fs');
@@ -37,6 +61,165 @@ const {
 
 const { assertMeId, initAuthCreds } = require('./lib/auth-utils');
 
+// ─── Wire trace implementation ────────────────────────────────────────────────
+// Everything below is CLI-only instrumentation; the library is untouched.
+//
+// Two hooks cover the whole protocol surface:
+//   * NoiseSocket.prototype.sendNode  — every stanza leaving this client
+//   * NoiseSocket.prototype.emit      — the 'node' event, every stanza arriving
+// They are patched on the prototype rather than on an instance so the trace
+// survives reconnects and covers frames sent during the handshake, before any
+// client-level event has fired. https.request is wrapped as well, because SMS
+// registration runs over HTTP and never touches the socket.
+let _wireTraceOn = false;
+function enableWireTrace() {
+  if (_wireTraceOn) return;
+  _wireTraceOn = true;
+  // Tracing is the point now — let [DBG] through again.
+  process.stderr.write = _origStderrWrite;
+  const { NoiseSocket } = require('./lib/noise');
+  const { configureLogger } = require('./lib/logger');
+  const https = require('https');
+
+  const C = process.stdout.isTTY
+    ? { out:'\x1b[36m', in:'\x1b[32m', http:'\x1b[35m', dim:'\x1b[2m', tag:'\x1b[33m', off:'\x1b[0m' }
+    : { out:'', in:'', http:'', dim:'', tag:'', off:'' };
+
+  // pino writes newline-delimited JSON to stdout. That is the right shape for a
+  // log collector and the wrong one for someone watching a live session, so
+  // reformat its lines on the way out. Anything that is not a pino record is
+  // passed through byte-for-byte.
+  const stamp = () => new Date().toISOString().slice(11, 23);
+  // Traffic arrives while readline owns the bottom line, so writing straight
+  // out overwrites the prompt and leaves the two interleaved. Clear the line
+  // first and redraw the prompt after, the same way the CLI's own event
+  // handlers do.
+  const trace = (s) => {
+    const live = _rl && process.stdout.isTTY;
+    if (live) {
+      readline.cursorTo(process.stdout, 0);
+      readline.clearLine(process.stdout, 0);
+    }
+    _origStderrWrite(s + '\n');
+    if (live) _rl.prompt(true);
+  };
+
+  // Route the library's internal [DBG] stream through pino at full verbosity.
+  // pino writes newline-delimited JSON straight to fd 1 via sonic-boom, which
+  // bypasses process.stdout — so rather than trying to reformat its output we
+  // intercept at pino's own logMethod hook, render the record ourselves and let
+  // pino emit nothing. The library still logs through pino; only the rendering
+  // is ours.
+  const LEVEL_NAME = { 10: 'TRACE', 20: 'DEBUG', 30: 'INFO ', 40: 'WARN ', 50: 'ERROR', 60: 'FATAL' };
+  configureLogger({
+    level: 'trace',
+    hooks: {
+      logMethod(args, _method, level) {
+        const msg = args.map(a => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ');
+        trace(`${C.dim}${stamp()} ${LEVEL_NAME[level] || level}${C.off} ${msg}`);
+      }
+    }
+  });
+
+  const isPrintable = (buf) => buf.length > 0 && buf.every(b => b === 9 || b === 10 || b === 13 || (b >= 32 && b < 127));
+
+  // JIDs decode to objects, byte fields to Buffers — render both readably.
+  function attrValue(v) {
+    if (v === null || v === undefined) return '';
+    if (Buffer.isBuffer(v)) return isPrintable(v) ? v.toString('utf8') : '0x' + v.toString('hex');
+    if (typeof v === 'object') {
+      if (v.user !== undefined) {
+        const dev = v.device ? ':' + v.device : '';
+        return `${v.user || ''}${dev}@${v.server || ''}`;
+      }
+      return JSON.stringify(v);
+    }
+    return String(v);
+  }
+
+  function renderContent(content, pad) {
+    if (content === null || content === undefined) return null;
+    if (Array.isArray(content)) return content.map(n => nodeToXml(n, pad)).join('\n');
+    if (Buffer.isBuffer(content)) {
+      if (isPrintable(content)) return pad + content.toString('utf8');
+      const hex = content.toString('hex');
+      const shown = hex.length > 512 ? hex.slice(0, 512) + '…' : hex;
+      return `${pad}${C.dim}[${content.length} bytes] ${shown}${C.off}`;
+    }
+    return pad + String(content);
+  }
+
+  function nodeToXml(node, pad) {
+    pad = pad || '';
+    if (!node || !node.description) return pad + String(node);
+    const attrs = Object.entries(node.attrs || {})
+      .map(([k, v]) => ` ${C.tag}${k}${C.off}="${attrValue(v)}"`).join('');
+    const tag = node.description;
+    const body = renderContent(node.content, pad + '  ');
+    if (body === null) return `${pad}<${tag}${attrs}/>`;
+    return `${pad}<${tag}${attrs}>\n${body}\n${pad}</${tag}>`;
+  }
+
+  function logStanza(dir, node) {
+    const colour = dir === 'OUT' ? C.out : C.in;
+    const arrow  = dir === 'OUT' ? '──▶ SENT' : '◀── RECV';
+    trace(`\n${colour}${stamp()} ${arrow}${C.off}`);
+    trace(nodeToXml(node, '  '));
+    if (TRACE_BYTES) {
+      try {
+        const { encodeNode } = require('./lib/BinaryNode');
+        const raw = encodeNode(node);
+        trace(`  ${C.dim}raw ${raw.length}B: ${raw.toString('hex')}${C.off}`);
+      } catch (_) {}
+    }
+  }
+
+  const origSendNode = NoiseSocket.prototype.sendNode;
+  NoiseSocket.prototype.sendNode = function (node) {
+    try { logStanza('OUT', node); } catch (_) {}
+    return origSendNode.call(this, node);
+  };
+
+  const origEmit = NoiseSocket.prototype.emit;
+  NoiseSocket.prototype.emit = function (event, ...args) {
+    try {
+      if (event === 'node')       logStanza('IN', args[0]);
+      else if (event === 'open')  trace(`\n${C.in}${stamp()} ◀── HANDSHAKE COMPLETE — channel secured${C.off}`);
+      else if (event === 'error') trace(`\n${C.in}${stamp()} ◀── SOCKET ERROR: ${args[0] && args[0].message}${C.off}`);
+      else if (event === 'close') trace(`\n${C.in}${stamp()} ◀── SOCKET CLOSED${C.off}`);
+    } catch (_) {}
+    return origEmit.apply(this, [event, ...args]);
+  };
+
+  // Registration (SMS request / code verify) goes over HTTPS, not the socket.
+  const origRequest = https.request;
+  https.request = function (...args) {
+    const opts = typeof args[0] === 'string' ? { href: args[0] } : (args[0] || {});
+    const host = opts.hostname || opts.host || opts.href || '?';
+    const target = `${opts.method || 'GET'} ${host}${opts.path || ''}`;
+    trace(`\n${C.http}${stamp()} ──▶ HTTP ${target}${C.off}`);
+    if (opts.headers) {
+      for (const [k, v] of Object.entries(opts.headers)) {
+        trace(`  ${C.tag}${k}${C.off}: ${v}`);
+      }
+    }
+    const req = origRequest.apply(this, args);
+    const origWrite = req.write.bind(req);
+    req.write = function (chunk, ...rest) {
+      try { trace(`  ${C.dim}body: ${Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk}${C.off}`); } catch (_) {}
+      return origWrite(chunk, ...rest);
+    };
+    req.on('response', (res) => {
+      trace(`\n${C.http}${stamp()} ◀── HTTP ${res.statusCode} from ${host}${C.off}`);
+      let body = '';
+      res.on('data', d => { if (body.length < 8192) body += d.toString('utf8'); });
+      res.on('end', () => { if (body) trace(`  ${C.dim}${body}${C.off}`); });
+    });
+    return req;
+  };
+
+}
+
 // Read the version straight from package.json so it can never drift out of sync
 // with the published package.  npm always ships package.json in the tarball,
 // regardless of the "files" list, so this resolves for installed users too.
@@ -1444,12 +1627,51 @@ options:
   --method          sms | voice | wa_old | email  (default: sms)
   --email <address> email address (required when --method email)
 
+debug:
+  an interactive session asks once whether to trace the protocol.
+  answer y to print every stanza sent and received, n to keep it quiet.
+
+  --debug           trace without asking  (same as WA_DEBUG=1)
+  --no-debug, -q    stay quiet without asking  (same as WA_DEBUG=0)
+  --trace-bytes     also dump the raw encoded bytes of every stanza
+
 after connecting, type /help for all available commands.
 `.trim();
 
+function announceTrace() {
+  out('debug full ON — every stanza sent and received will be printed' +
+      (TRACE_BYTES ? ', with raw frame bytes' : '') + '.\n');
+}
+
+// Ask once, at startup, whether to trace the protocol. Commands that never
+// touch the network skip the question entirely. A non-interactive stdin (a
+// pipe, a script) is treated as "no" rather than hanging on a prompt that
+// nobody is there to answer.
+function askDebugMode(cmd) {
+  if (TRACE_FORCE_ON)  { enableWireTrace(); announceTrace(); return Promise.resolve(); }
+  if (TRACE_FORCE_OFF) return Promise.resolve();
+  const OFFLINE = ['version', '--version', '-v', 'help', '--help', '-h'];
+  if (cmd && OFFLINE.includes(cmd)) return Promise.resolve();
+  if (!process.stdin.isTTY) return Promise.resolve();
+
+  return new Promise(resolve => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question('do you want debug full?  [y/N] ', (answer) => {
+      rl.close();
+      if (/^y(es)?$/i.test(String(answer).trim())) {
+        enableWireTrace();
+        announceTrace();
+      }
+      resolve();
+    });
+  });
+}
+
 async function main() {
   const { cmd, sub, flags, pos } = parseArgs(process.argv);
 
+  await askDebugMode(cmd);
+
   _sessDir = flags.session || defaultSessionDir();
 
   if (!cmd) {

package/lib/Registration.js

@@ -424,7 +424,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'manage_call_permission',     'false',
       'clicked_education_link',     'false',
       'aid',                        '',
-      'push_code',                  ''
+      'push_code',                  store.pushCode || ''
     ];
   }
 
@@ -434,7 +434,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
     'sim_mcc',           meta.mcc,
     'sim_mnc',           meta.mnc,
     'jailbroken',        '0',
-    'push_code',         '',
+    'push_code',         store.pushCode || '',
     'cellular_strength', '1'
   ];
 }

package/lib/Store.js

@@ -64,6 +64,11 @@ function createNewStore(phoneNumber) {
   // Registration.js): advertising id (UUID) and the 20-byte backup token.
   const advertisingId  = uuidv4();
   const backupToken    = crypto.randomBytes(20);
+  // Push-notification token sent as `push_code` on /code. The server validates
+  // its shape and rejects an empty value with bad_param/bad_format, so it has
+  // to be a real 32-hex-character token. Generated once and persisted, because
+  // the value must stay the same across the /code and /register pair.
+  const pushCode       = crypto.randomBytes(16).toString('hex');
 
   const device  = getDeviceConfig();
   const version = device.os === 'android' ? ANDROID_VERSION_FALLBACK : IOS_VERSION_FALLBACK;
@@ -86,6 +91,7 @@ function createNewStore(phoneNumber) {
     identityId,
     advertisingId,
     backupToken,
+    pushCode,
     registered:    false,
     codePending:   false,  // true after /code request, cleared on successful /register
     name:          'User',
@@ -140,6 +146,7 @@ function storeToJson(store) {
     identityId:     store.identityId.toString('base64'),
     advertisingId:  store.advertisingId || null,
     backupToken:    store.backupToken ? store.backupToken.toString('base64') : null,
+    pushCode:       store.pushCode || null,
     registered:     !!store.registered,
     codePending:    store.codePending || false,
     name,
@@ -182,6 +189,7 @@ function storeFromJson(obj) {
     // enriched /code request always has stable values.
     advertisingId:  obj.advertisingId || uuidv4(),
     backupToken:    obj.backupToken ? Buffer.from(obj.backupToken, 'base64') : crypto.randomBytes(20),
+    pushCode:       obj.pushCode || crypto.randomBytes(16).toString('hex'),
     registered:     !!obj.registered,
     codePending:    obj.codePending || false,
     name,

package/lib/messages/MessageSender.js

@@ -862,14 +862,6 @@ class MessageSender {
     // Resolve member phones for session/device queries.
     // For LID members without a PN mapping, keep the raw LID user part so
     // bulkEnsureSessionsForLid can still acquire sessions for them.
-    // "40778226909:2@s.whatsapp.net" → "<ourLid>:2@lid" — keep the device
-    // suffix, swap identity and domain.
-    const ownJidToLid = (jid) => {
-      const base   = String(jid).replace(/@(?:s\.whatsapp\.net|lid)$/, '');
-      const colon  = base.indexOf(':');
-      return myLidUser + (colon >= 0 ? base.slice(colon) : '') + '@lid';
-    };
-
     const lidMembersWithoutPn = [];
     const memberPhones = [...new Set(
       members.map(jid => {
@@ -883,10 +875,10 @@ class MessageSender {
             const pn = this._client._lidToPn && this._client._lidToPn.get(raw);
             if (pn) return pn;
           }
-          // Our own LID is a member too — ensureOwnDeviceSessions already
-          // covers those devices, so listing it here would encrypt the SKDM
-          // for ourselves twice and emit duplicate <to> entries.
-          if (raw !== myLidUser) lidMembersWithoutPn.push(jid);
+          // We are a member of the group ourselves, so our own devices come out
+          // of this same walk — Baileys likewise derives every group target
+          // from the participant list and never appends own devices separately.
+          lidMembersWithoutPn.push(jid);
           return null;
         }
         return raw;
@@ -907,20 +899,30 @@ class MessageSender {
     ]);
 
     // Own devices come back as @s.whatsapp.net — re-express them in LID space
-    // so every target in a LID stanza shares one address family.
-    const ownTargets = useLid ? ownDevices.map(ownJidToLid) : ownDevices;
+    // so every target in a LID stanza shares one address family.  In LID mode
+    // the participant walk above already covered us, so this only fills the gap
+    // for legacy pn-addressed groups.
+    const ownTargets = useLid ? [] : ownDevices;
 
     // Dedupe: a device reached through more than one path must still appear
     // exactly once in <participants>.
     const allTargets = [...new Set([...memberDevices, ...lidDevices, ...ownTargets])];
 
-    const phashTargets = allTargets.includes(selfJid)
-      ? allTargets
-      : [selfJid, ...allTargets];
-
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
-    const skdmRecipients  = allTargets.filter(jid => !existingSkdmMap[jid]);
+    // Same exclusions Baileys applies when choosing SenderKey recipients:
+    // hosted (bot-side) users and device 99, which is a server placeholder
+    // rather than a real endpoint, must never receive a distribution.
+    const isSkdmEligible = (jid) => {
+      const s = String(jid);
+      if (s.endsWith('@hosted') || s.endsWith('@hosted.lid')) return false;
+      const base  = s.replace(/@.*$/, '');
+      const colon = base.indexOf(':');
+      return !(colon >= 0 && parseInt(base.slice(colon + 1), 10) === 99);
+    };
+    const skdmRecipients = allTargets.filter(
+      jid => !existingSkdmMap[jid] && isSkdmEligible(jid)
+    );
 
     // Acquire mutex for all group encryption — SKDM fanout and senderKey encrypt
     // share the same Signal session state and must not run concurrently.
@@ -934,22 +936,34 @@ class MessageSender {
       skmsgCiphertext = await this._signal.senderKeyEncrypt(groupJid, senderIdentity, plaintext);
     });
 
-    const phash = phashTargets.length > 0 ? computePhash(phashTargets) : null;
-
     const skdmHasPkmsg = skdmEncrypted.some(e => e.type === 'pkmsg');
     const advBytes     = skdmHasPkmsg ? _buildOrGetAdvIdentity(this._client._store) : null;
+    // No device-identity is expected here. ADVSignedDeviceIdentity is issued
+    // when a companion device is paired, to prove the companion's identity key
+    // was authorised by the primary. This client registers over SMS as the
+    // primary device, so its identity key IS the account identity and there is
+    // nothing to attach — advBytes stays null and that is correct.
 
     const msgContent = [];
     if (advBytes) {
       msgContent.push(new BinaryNode('device-identity', {}, advBytes));
     }
     if (skdmEncrypted.length > 0) {
-      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, null));
+      // Baileys applies the same extra attrs — mediatype included — to the
+      // SenderKey participant nodes as to the skmsg, so an image sent to a
+      // group carries mediatype on both. Passing null here left the SKDM
+      // <enc> nodes unlabelled.
+      msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, mediaSubtype));
     }
     const skmsgAttrs = { type: 'skmsg', v: '2' };
     if (mediaSubtype) skmsgAttrs.mediatype = mediaSubtype;
     msgContent.push(new BinaryNode('enc', skmsgAttrs, Buffer.isBuffer(skmsgCiphertext) ? skmsgCiphertext : Buffer.from(skmsgCiphertext)));
 
+    // No phash on group stanzas. Baileys computes a participant hash only on
+    // the 1:1 path; a group message carries id/to/type/addressing_mode and
+    // nothing else. Sending a hash the server did not ask for — over a
+    // participant set it derives itself from the group — is a way to have the
+    // stanza rejected outright.
     const stanzaAttrs = {
       to: jidStrToObj(groupJid),
       id: msgId,
@@ -957,7 +971,6 @@ class MessageSender {
       addressing_mode: groupAddressingMode,
       t:   String(msNow())
     };
-    if (phash) stanzaAttrs.phash = phash;
     if (options.edit) stanzaAttrs.edit = String(options.edit);
 
     const msgNode = new BinaryNode('message', stanzaAttrs, msgContent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.66",
+  "version": "5.5.68",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",