whalibmob 5.5.68 → 5.5.71

package/cli.js

@@ -174,6 +174,47 @@ function enableWireTrace() {
     }
   }
 
+  // The Noise handshake never goes through sendNode — sendNode refuses to run
+  // until the channel is secured, and the ClientHello/ClientFinish frames are
+  // written straight to the TCP socket. Wrap that socket as soon as connect()
+  // creates it so the handshake is visible too, then step aside once the
+  // channel is up and the stanza-level hooks take over.
+  const HS_OUT = ['ClientHello', 'ClientFinish'];
+  const HS_IN  = ['ServerHello'];
+  const origConnect = NoiseSocket.prototype.connect;
+  NoiseSocket.prototype.connect = function (...args) {
+    const result = origConnect.apply(this, args);
+    const sock = this.socket;
+    if (sock && !sock.__waTraced) {
+      sock.__waTraced = true;
+      let outN = 0, inN = 0;
+      trace(`\n${C.out}${stamp()} ──▶ TCP CONNECT ${sock.remoteAddress || ''}${C.off}`);
+
+      const origWrite = sock.write.bind(sock);
+      sock.write = (chunk, ...rest) => {
+        if (!this.secured && Buffer.isBuffer(chunk)) {
+          const name = HS_OUT[outN++] || 'handshake frame';
+          trace(`\n${C.out}${stamp()} ──▶ NOISE ${name}  (${chunk.length} bytes)${C.off}`);
+          trace(`  ${C.dim}${chunk.toString('hex')}${C.off}`);
+        }
+        return origWrite(chunk, ...rest);
+      };
+
+      sock.on('data', (d) => {
+        if (this.secured) return;
+        // Label positionally, but say so when the reply is plainly not a Noise
+        // frame — a proxy or captive portal answering in ASCII is worth reading
+        // as text rather than staring at its hex.
+        const ascii = isPrintable(d);
+        const name  = ascii ? 'unexpected plaintext reply' : (HS_IN[inN++] || 'handshake frame');
+        trace(`\n${C.in}${stamp()} ◀── NOISE ${name}  (${d.length} bytes)${C.off}`);
+        trace(`  ${C.dim}${d.toString('hex').slice(0, 1024)}${C.off}`);
+        if (ascii) trace(`  ${C.dim}as text: ${JSON.stringify(d.toString('utf8').slice(0, 400))}${C.off}`);
+      });
+    }
+    return result;
+  };
+
   const origSendNode = NoiseSocket.prototype.sendNode;
   NoiseSocket.prototype.sendNode = function (node) {
     try { logStanza('OUT', node); } catch (_) {}

package/lib/Attestation.js

@@ -158,19 +158,27 @@ async function iosAppAttest(noisePubB64) {
 // ENC envelope, so the Play Integrity nonce is derived from the store (a stable
 // per-session value), NOT from the ENC body. pushToken comes from the optional
 // push client — empty by default.
+// A field with no value is omitted from the body rather than sent empty.
+// buildForm drops null and keeps '', and the registration server validates the
+// shape of what it receives: an empty push_code is a malformed push_code, and
+// it answers with bad_param/bad_format naming that field. An absent field has
+// nothing to validate, which is what an unattested client should send.
+// Real values are still sent whenever a Frida attestation server supplies them.
+const orNull = (v) => (v === '' || v === undefined ? null : v);
+
 async function attestationFields(device, nonceB64, opts) {
   opts = opts || {};
-  const pushToken = opts.pushToken || '';
+  const pushToken = orNull(opts.pushToken);
 
   if (device && device.os === 'android') {
     const a = await androidIntegrity(nonceB64 || '');
     return [
-      'gpia',       a.gpia,
-      '_gg',        a.gg,
-      '_gi',        a.gi,
-      '_gp',        a.gp,
-      '_ge',        a.ge,
-      '_ga',        a.ga,
+      'gpia',       orNull(a.gpia),
+      '_gg',        orNull(a.gg),
+      '_gi',        orNull(a.gi),
+      '_gp',        orNull(a.gp),
+      '_ge',        orNull(a.ge),
+      '_ga',        orNull(a.ga),
       'push_token', pushToken
     ];
   }

package/lib/Client.js

@@ -877,9 +877,16 @@ class WhalibmobClient extends EventEmitter {
       return;
     }
 
-    const fromStr       = attrs.from ? String(attrs.from) : '';
-    // Extract bare phone number: "40756469325@s.whatsapp.net" → "40756469325"
-    const recipientPhone = fromStr.split('@')[0].split('.')[0];
+    const fromStr = attrs.from ? String(attrs.from) : '';
+    const isGroup = fromStr.endsWith('@g.us');
+
+    // On a group retry `from` is the group and `participant` is the device that
+    // failed to decrypt. Keying off `from` there would have targeted the group
+    // id as if it were a contact and cleared nothing.
+    const targetJid = isGroup && attrs.participant
+      ? String(attrs.participant)
+      : fromStr;
+    const recipientPhone = targetJid.split('@')[0].split(':')[0].split('.')[0];
 
     _whaDbg('[DBG] RETRY_RECV msgId=' + msgId + ' from=' + fromStr + ' — clearing session + resending\n');
 
@@ -900,7 +907,24 @@ class WhalibmobClient extends EventEmitter {
       this._devMgr.clearCache([recipientPhone]);
     }
 
-    // Re-send the message — will create fresh pre-key (pkmsg) sessions
+    // Re-send the message — will create fresh pre-key (pkmsg) sessions.
+    // A group resend must go back through the group path: it needs a fresh
+    // SenderKey distribution, which only _sendGroupMessage builds. Drop the
+    // "already distributed" record first, or the resend would carry the same
+    // bare skmsg the recipient just told us it could not read.
+    const resendId = generateMessageId();
+    if (cached.isGroup) {
+      if (this._signal && this._signal.senderKeyStore) {
+        this._signal.senderKeyStore.invalidateSKDM(cached.toJid);
+      }
+      this._sender._sendGroupMessage(
+        cached.toJid, resendId, cached.plaintext, cached.mediaType, cached.options
+      )
+        .then(r  => _whaDbg('[DBG] RETRY_RESEND group ok id=' + (r && r.id) + '\n'))
+        .catch(e => _whaDbg('[DBG] RETRY_RESEND_ERR: ' + e.message));
+      return;
+    }
+
     this._sender._sendDMMessage(
       cached.toJid, cached.msgId, cached.plaintext, cached.mediaType, cached.options
     )

package/lib/DeviceManager.js

@@ -305,30 +305,15 @@ class DeviceManager {
   async fetchBundles(jids) {
     if (!jids || jids.length === 0) return new Map();
 
-    // Convert a string JID like "user@server" or "user:device@server" into
-    // a proper JID object so the binary encoder uses JID_PAIR / AD_JID format.
-    // Raw UTF-8 strings are NOT recognised by the WA server for @lid JIDs — the
-    // server silently ignores unknown JIDs and returns an empty bundle list.
-    const toJidObj = jidStr => {
-      const str    = typeof jidStr === 'string' ? jidStr : String(jidStr);
-      const at     = str.indexOf('@');
-      const raw    = at >= 0 ? str.slice(0, at) : str;
-      const server = at >= 0 ? str.slice(at + 1) : 's.whatsapp.net';
-      const colon  = raw.indexOf(':');
-      const user   = colon >= 0 ? raw.slice(0, colon) : raw;
-      const device = colon >= 0 ? (parseInt(raw.slice(colon + 1), 10) || 0) : 0;
-      const self   = str;
-      // AD_JID binary format is for @s.whatsapp.net with device > 0.
-      // JID_PAIR binary format is used for @lid and for device-0 @s.whatsapp.net.
-      if (server === 's.whatsapp.net' && device > 0) {
-        // AD_JID: agent=0, device=N
-        return { user, agent: 0, device, server, toString() { return self; } };
-      }
-      // JID_PAIR: user@server  — server may be 'lid' or 's.whatsapp.net'
-      return { user, server, toString() { return self; } };
-    };
-
-    const userNodes = jids.map(jid => new BinaryNode('user', { jid: toJidObj(jid) }, null));
+    // Use the shared converter. The local copy this replaced dropped the device
+    // suffix on @lid JIDs: it split "112713111982325:49@lid" into user and
+    // device, then fell through to a JID_PAIR built from `user` alone, so every
+    // device of a contact encoded to the identical "112713111982325@lid". The
+    // server saw one repeated JID, returned a single device-0 bundle, and no
+    // session was ever built for the other devices — leaving them unable to
+    // decrypt anything we sent. jidStrToObj keeps the colon inside the user
+    // part for @lid, which is what the server expects.
+    const userNodes = jids.map(jid => new BinaryNode('user', { jid: jidStrToObj(jid) }, null));
     const iqId   = this._client._genMsgId();
     const iqNode = new BinaryNode('iq',
       { id: iqId, xmlns: 'encrypt', type: 'get', to: 's.whatsapp.net' },

package/lib/Registration.js

@@ -424,7 +424,9 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'manage_call_permission',     'false',
       'clicked_education_link',     'false',
       'aid',                        '',
-      'push_code',                  store.pushCode || ''
+      // Omitted unless a push client supplies a real code — an empty value is
+      // rejected as bad_format, an absent field is not validated at all.
+      'push_code',                  null
     ];
   }
 
@@ -434,7 +436,8 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
     'sim_mcc',           meta.mcc,
     'sim_mnc',           meta.mnc,
     'jailbroken',        '0',
-    'push_code',         store.pushCode || '',
+    // Omitted unless a push client supplies a real code (see above).
+    'push_code',         null,
     'cellular_strength', '1'
   ];
 }

package/lib/Store.js

@@ -64,11 +64,6 @@ function createNewStore(phoneNumber) {
   // Registration.js): advertising id (UUID) and the 20-byte backup token.
   const advertisingId  = uuidv4();
   const backupToken    = crypto.randomBytes(20);
-  // Push-notification token sent as `push_code` on /code. The server validates
-  // its shape and rejects an empty value with bad_param/bad_format, so it has
-  // to be a real 32-hex-character token. Generated once and persisted, because
-  // the value must stay the same across the /code and /register pair.
-  const pushCode       = crypto.randomBytes(16).toString('hex');
 
   const device  = getDeviceConfig();
   const version = device.os === 'android' ? ANDROID_VERSION_FALLBACK : IOS_VERSION_FALLBACK;
@@ -91,7 +86,6 @@ function createNewStore(phoneNumber) {
     identityId,
     advertisingId,
     backupToken,
-    pushCode,
     registered:    false,
     codePending:   false,  // true after /code request, cleared on successful /register
     name:          'User',
@@ -146,7 +140,6 @@ function storeToJson(store) {
     identityId:     store.identityId.toString('base64'),
     advertisingId:  store.advertisingId || null,
     backupToken:    store.backupToken ? store.backupToken.toString('base64') : null,
-    pushCode:       store.pushCode || null,
     registered:     !!store.registered,
     codePending:    store.codePending || false,
     name,
@@ -189,7 +182,6 @@ function storeFromJson(obj) {
     // enriched /code request always has stable values.
     advertisingId:  obj.advertisingId || uuidv4(),
     backupToken:    obj.backupToken ? Buffer.from(obj.backupToken, 'base64') : crypto.randomBytes(20),
-    pushCode:       obj.pushCode || crypto.randomBytes(16).toString('hex'),
     registered:     !!obj.registered,
     codePending:    obj.codePending || false,
     name,

package/lib/messages/MessageSender.js

@@ -973,6 +973,21 @@ class MessageSender {
     };
     if (options.edit) stanzaAttrs.edit = String(options.edit);
 
+    // Cache the plaintext here too, not just on the DM path. A group recipient
+    // that cannot decrypt sends a retry receipt exactly like a DM recipient
+    // does, and without this the client had nothing to re-send and dropped it
+    // with "no cached plaintext" — so the message was acked by the server and
+    // then silently never arrived.
+    if (this._client._sentMsgCache) {
+      this._client._sentMsgCache.set(msgId, {
+        plaintext, toJid: groupJid, msgId, mediaType, options, isGroup: true
+      });
+      if (this._client._sentMsgCache.size > 200) {
+        const firstKey = this._client._sentMsgCache.keys().next().value;
+        this._client._sentMsgCache.delete(firstKey);
+      }
+    }
+
     const msgNode = new BinaryNode('message', stanzaAttrs, msgContent);
     return this._dispatchAndAck(msgNode, msgId);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.68",
+  "version": "5.5.71",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",