whalibmob 5.5.71 → 5.5.73

package/lib/BinaryNode.js

@@ -310,9 +310,15 @@ class NodeDecoder {
     // that does not exist, so device queries for it came back empty, no Signal
     // session was ever built, and group sends were rejected with ack 479.
     const server = _serverForAgent(agent);
+    // The device must survive stringification. Everything downstream keys off
+    // the string form: fetchBundles maps bundles by it, so five devices all
+    // rendering as "user@server" collapsed into one entry and left the rest
+    // without a session; and jidToAddress parses the ":device" out of it, so
+    // dropping it addressed every Signal session as device 0 — which is why a
+    // message from a linked device could not be decrypted either.
     return {
       user, agent, device, server,
-      toString() { return `${user}@${server}`; }
+      toString() { return device ? `${user}:${device}@${server}` : `${user}@${server}`; }
     };
   }
 }

package/lib/Client.js

@@ -11,6 +11,11 @@ const { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, assert
 const { getDeviceConfig } = require('./DeviceConfig');
 const { createNewStore, saveStore, loadStore, toSixParts, fromSixParts } = require('./Store');
 const { BinaryNode }      = require('./BinaryNode');
+
+// How many times a message may be re-sent in answer to retry receipts before
+// the client stops. Each resend can itself draw retries, so this is what keeps
+// an undecryptable message from turning into a flood.
+const MAX_RETRY_RESENDS = 2;
 const { NodeCache }       = require('@cacheable/node-cache');
 
 // Group metadata cache lifetime — matches DeviceManager's device cache.
@@ -877,6 +882,23 @@ class WhalibmobClient extends EventEmitter {
       return;
     }
 
+    // Consume the entry before doing anything else. Every device that failed to
+    // decrypt sends its own retry receipt for the same message, and a group
+    // resend already re-addresses all of them — without this, each receipt
+    // started its own resend.
+    this._sentMsgCache.delete(msgId);
+
+    // Bound the chain. A resend that still cannot be decrypted draws fresh
+    // retry receipts of its own, so an unbounded handler answers each one with
+    // another send and floods the chat. Give up after a few rounds and leave
+    // the message undelivered rather than keep spamming.
+    const depth = (cached.retryDepth || 0) + 1;
+    if (depth > MAX_RETRY_RESENDS) {
+      _whaDbg('[DBG] RETRY_RECV msgId=' + msgId + ' — giving up after ' +
+        cached.retryDepth + ' resends\n');
+      return;
+    }
+
     const fromStr = attrs.from ? String(attrs.from) : '';
     const isGroup = fromStr.endsWith('@g.us');
 
@@ -912,13 +934,18 @@ class WhalibmobClient extends EventEmitter {
     // SenderKey distribution, which only _sendGroupMessage builds. Drop the
     // "already distributed" record first, or the resend would carry the same
     // bare skmsg the recipient just told us it could not read.
-    const resendId = generateMessageId();
+    // Carry the round count into the resend so its own retry receipts continue
+    // the same chain instead of restarting it at zero.
+    const opts = Object.assign({}, cached.options, { _retryDepth: depth });
+
     if (cached.isGroup) {
+      const resendId = generateMessageId();
       if (this._signal && this._signal.senderKeyStore) {
         this._signal.senderKeyStore.invalidateSKDM(cached.toJid);
       }
+      _whaDbg('[DBG] RETRY_RESEND group round=' + depth + ' newId=' + resendId + '\n');
       this._sender._sendGroupMessage(
-        cached.toJid, resendId, cached.plaintext, cached.mediaType, cached.options
+        cached.toJid, resendId, cached.plaintext, cached.mediaType, opts
       )
         .then(r  => _whaDbg('[DBG] RETRY_RESEND group ok id=' + (r && r.id) + '\n'))
         .catch(e => _whaDbg('[DBG] RETRY_RESEND_ERR: ' + e.message));
@@ -926,7 +953,7 @@ class WhalibmobClient extends EventEmitter {
     }
 
     this._sender._sendDMMessage(
-      cached.toJid, cached.msgId, cached.plaintext, cached.mediaType, cached.options
+      cached.toJid, cached.msgId, cached.plaintext, cached.mediaType, opts
     )
       .then(r  => _whaDbg('[DBG] RETRY_RESEND ok id=' + r.id + '\n'))
       .catch(e => _whaDbg('[DBG] RETRY_RESEND_ERR: ' + e.message));

package/lib/messages/MessageSender.js

@@ -554,6 +554,21 @@ class MessageSender {
           return this._sendGroupMessage(toJid, msgId, plaintext, mediaType,
             Object.assign({}, options, { _479retry: true }));
         }
+        // No session could be built for a single member — usually a prekey IQ
+        // that timed out, leaving the device list cached with nothing behind
+        // it. Purge the cached devices and sessions so the retry re-fetches
+        // bundles and opens fresh pkmsg sessions instead of failing again.
+        if (err && /NO_OPEN_SESSION/.test(err.message) && !options._noSessionRetry) {
+          _whaDbg('[DBG] NO_OPEN_SESSION group ' + toJid + ' — forcing fresh pkmsg\n');
+          await this._forceSessionRebuild(
+            (this._client._getGroupMembers ? this._client._getGroupMembers(toJid) : [])
+          );
+          if (this._signal && this._signal.senderKeyStore) {
+            this._signal.senderKeyStore.invalidateSKDM(toJid);
+          }
+          return this._sendGroupMessage(toJid, msgId, plaintext, mediaType,
+            Object.assign({}, options, { _noSessionRetry: true }));
+        }
         throw err;
       }
     }
@@ -587,11 +602,41 @@ class MessageSender {
         return this._sendDMMessage(toJid, retryMsgId, plaintext, mediaType,
           Object.assign({}, options, { _479retry: true }));
       }
+      // ── No session at all ────────────────────────────────────────────────────
+      // Nothing could be encrypted for any device, so there is no ciphertext to
+      // send. This is what a timed-out prekey IQ leaves behind: the device list
+      // is cached but no session sits behind it, and every later send fails the
+      // same way because the cache hides the gap. Purge both and retry once, so
+      // the next attempt re-fetches bundles and opens fresh pkmsg sessions.
+      if (err && /NO_OPEN_SESSION/.test(err.message) && !options._noSessionRetry) {
+        _whaDbg('[DBG] NO_OPEN_SESSION dm ' + toJid + ' — forcing fresh pkmsg\n');
+        await this._forceSessionRebuild([toJid]);
+        return this._sendDMMessage(toJid, generateMessageId(), plaintext, mediaType,
+          Object.assign({}, options, { _noSessionRetry: true }));
+      }
       // ─────────────────────────────────────────────────────────────────────────
       throw err;
     }
   }
 
+  // Drop every cached device list and Signal session for these JIDs so the next
+  // send is forced to re-query devices, re-fetch prekey bundles and open new
+  // pkmsg sessions from scratch.
+  async _forceSessionRebuild(jids) {
+    const phones = [...new Set((jids || []).map(phoneFromJid).filter(Boolean))];
+    for (const phone of phones) {
+      await this._clearSignalSessionsForRecipient(phone).catch(() => {});
+    }
+    if (this._devMgr && phones.length) {
+      this._devMgr.clearCache(phones);
+      // LID device lists are cached under a separate key.
+      if (typeof this._devMgr._dcDel === 'function') {
+        this._devMgr._dcDel(phones.map(p => 'lid:' + p));
+      }
+    }
+    _whaDbg('[DBG] FORCE_SESSION_REBUILD purged ' + phones.join(', ') + '\n');
+  }
+
   // ─── Clear all Signal sessions for a phone-number recipient ─────────────────
   //
   // Called on error 479 (stale session).  Deletes:
@@ -772,7 +817,8 @@ class MessageSender {
     // Cache plaintext so Client can re-send with fresh session on recipient retry
     if (this._client._sentMsgCache) {
       this._client._sentMsgCache.set(msgId, {
-        plaintext, toJid, msgId, mediaType, options, recipientPhone
+        plaintext, toJid, msgId, mediaType, options, recipientPhone,
+        retryDepth: options._retryDepth || 0
       });
       // Keep cache bounded — evict oldest entries beyond 200
       if (this._client._sentMsgCache.size > 200) {
@@ -980,7 +1026,8 @@ class MessageSender {
     // then silently never arrived.
     if (this._client._sentMsgCache) {
       this._client._sentMsgCache.set(msgId, {
-        plaintext, toJid: groupJid, msgId, mediaType, options, isGroup: true
+        plaintext, toJid: groupJid, msgId, mediaType, options, isGroup: true,
+        retryDepth: options._retryDepth || 0
       });
       if (this._client._sentMsgCache.size > 200) {
         const firstKey = this._client._sentMsgCache.keys().next().value;

package/lib/signal/SignalProtocol.js

@@ -320,6 +320,14 @@ function jidToAddress(jid) {
   } else if (jid && jid.user) {
     user     = jid.user;
     deviceId = jid.device || 0;
+    // A @lid JID is encoded as JID_PAIR with the device kept inside the user
+    // part ("112713111982325:49"), so an object can carry its device there
+    // rather than in .device. Without this the address came out as device 0.
+    const colonIdx = String(user).indexOf(':');
+    if (colonIdx >= 0) {
+      if (!deviceId) deviceId = parseInt(String(user).slice(colonIdx + 1), 10) || 0;
+      user = String(user).slice(0, colonIdx);
+    }
   } else {
     user = String(jid);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.71",
+  "version": "5.5.73",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",