whalibmob 5.5.90 → 5.6.2

package/lib/WebStore.js

@@ -0,0 +1,117 @@
+'use strict';
+
+// Session state for a WhatsApp Web (companion) link.
+//
+// Deliberately the same shape as the mobile store: SignalProtocol,
+// DeviceManager and MessageSender all read `noiseKeyPair`, `identityKeyPair`,
+// `signedPreKey`, `registrationId` and `advIdentity` off it, and none of them
+// should have to care which way the session was established. What web mode adds
+// on top is the pairing material and the identity the server hands back:
+//
+//   advSecretKey            derived during pairing; every later proof that this
+//                           device belongs to the account is an HMAC under it
+//   pairingEphemeralKeyPair one half of the code-authenticated exchange
+//   pairingCode             the eight characters shown to the human
+//   me                      { id, lid, name } — the JID we were issued
+//   deviceIndex             which linked-device slot we occupy; 0 is the phone
+//
+// Stored beside the mobile session as `<phone>.web.json`, so registering a
+// number over SMS and linking it as a companion never overwrite each other.
+
+const fs      = require('fs');
+const path    = require('path');
+const crypto  = require('crypto');
+
+const { createNewStore, storeToJson, storeFromJson } = require('./Store');
+const { WEB_VERSION_FALLBACK, WEB_BROWSER } = require('./constants');
+const { generateEphemeralKeyPair } = require('./PairingCode');
+
+function webSessionPath(sessionDir, phoneNumber) {
+  return path.join(sessionDir, `${String(phoneNumber).replace(/\D/g, '')}.web.json`);
+}
+
+function createNewWebStore(phoneNumber) {
+  const store = createNewStore(phoneNumber);
+
+  store.mode                    = 'web';
+  store.registered              = false;
+  store.advSecretKey            = null;
+  store.pairingCode             = null;
+  store.pairingEphemeralKeyPair = generateEphemeralKeyPair();
+  store.me                      = null;
+  store.deviceIndex             = 0;
+  store.platform                = null;
+  store.webVersion              = WEB_VERSION_FALLBACK.slice();
+  store.browser                 = WEB_BROWSER.slice();
+  store.syncFullHistory         = true;
+
+  return store;
+}
+
+function webStoreToJson(store) {
+  const base = storeToJson(store);
+  return Object.assign(base, {
+    mode:        'web',
+    advSecretKey: store.advSecretKey || null,
+    pairingCode:  store.pairingCode  || null,
+    pairingEphemeralKeyPair: store.pairingEphemeralKeyPair ? {
+      private: store.pairingEphemeralKeyPair.private.toString('base64'),
+      public:  store.pairingEphemeralKeyPair.public.toString('base64')
+    } : null,
+    me:          store.me          || null,
+    deviceIndex: store.deviceIndex || 0,
+    platform:    store.platform    || null,
+    webVersion:  store.webVersion  || WEB_VERSION_FALLBACK.slice(),
+    browser:     store.browser     || WEB_BROWSER.slice(),
+    syncFullHistory: store.syncFullHistory !== false
+  });
+}
+
+function webStoreFromJson(obj) {
+  const store = storeFromJson(obj);
+
+  store.mode         = 'web';
+  store.advSecretKey = obj.advSecretKey || null;
+  store.pairingCode  = obj.pairingCode  || null;
+  store.pairingEphemeralKeyPair = obj.pairingEphemeralKeyPair
+    ? {
+        private: Buffer.from(obj.pairingEphemeralKeyPair.private, 'base64'),
+        public:  Buffer.from(obj.pairingEphemeralKeyPair.public, 'base64')
+      }
+    // A store written before this field existed still needs a usable key pair;
+    // it is only ever consumed inside a single pairing attempt.
+    : generateEphemeralKeyPair();
+  store.me          = obj.me          || null;
+  store.deviceIndex = obj.deviceIndex || 0;
+  store.platform    = obj.platform    || null;
+  store.webVersion  = obj.webVersion  || WEB_VERSION_FALLBACK.slice();
+  store.browser     = obj.browser     || WEB_BROWSER.slice();
+  store.syncFullHistory = obj.syncFullHistory !== false;
+
+  return store;
+}
+
+function saveWebStore(store, filePath) {
+  if (!store) return;
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(webStoreToJson(store), null, 2), 'utf8');
+}
+
+function loadWebStore(filePath) {
+  if (!fs.existsSync(filePath)) return null;
+  try {
+    return webStoreFromJson(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+  } catch (_) {
+    return null;
+  }
+}
+
+module.exports = {
+  createNewWebStore,
+  saveWebStore,
+  loadWebStore,
+  webStoreToJson,
+  webStoreFromJson,
+  webSessionPath
+};

package/lib/constants.js

@@ -7,6 +7,26 @@ const REGISTRATION_PUBLIC_KEY = Buffer.from('8e8c0f74c3ebc5d7a6865c6c3c843856b06
 
 const MOBILE_PROLOGUE = Buffer.from([0x57, 0x41, 0x05, 0x03]);
 
+// ─── WhatsApp Web (companion) transport ──────────────────────────────────────
+//
+// The mobile client speaks the same Noise handshake and the same binary node
+// dictionary over a raw TLS socket to g.whatsapp.net. The web client speaks it
+// over a WebSocket to web.whatsapp.com. The only wire-level differences are the
+// prologue byte that announces which edition is talking (5 = mobile,
+// 6 = web/multi-device) and the ClientPayload that rides inside the handshake.
+const WEB_PROLOGUE   = Buffer.from([0x57, 0x41, 0x06, 0x03]);
+const WEB_SOCKET_URL = 'wss://web.whatsapp.com/ws/chat';
+const WEB_ORIGIN     = 'https://web.whatsapp.com';
+
+// Version the companion announces. Unlike the mobile version this is not tied
+// to an App Store build — it is the web client release, and the server is
+// tolerant of a slightly stale one.
+const WEB_VERSION_FALLBACK = [2, 3000, 1027934701];
+
+// [os, browser] pair. Decides the DeviceProps.platformType we register with and
+// the name the account owner sees in the linked-devices list on their phone.
+const WEB_BROWSER = ['Ubuntu', 'Chrome', '120.0.0.0'];
+
 // Static tokens used in WhatsApp registration token computation.
 // token = MD5( staticToken + MD5hex(waVersion) + nationalNumber )
 const IOS_STATIC_TOKEN          = '0a1mLfGUIBVrMKF1RdvLI5lkRBvof6vn0fD2QRSM';
@@ -197,6 +217,11 @@ module.exports = {
   REGISTRATION_ENDPOINT,
   REGISTRATION_PUBLIC_KEY,
   MOBILE_PROLOGUE,
+  WEB_PROLOGUE,
+  WEB_SOCKET_URL,
+  WEB_ORIGIN,
+  WEB_VERSION_FALLBACK,
+  WEB_BROWSER,
   IOS_STATIC_TOKEN,
   IOS_BUSINESS_STATIC_TOKEN,
   ANDROID_STATIC_TOKEN,

package/lib/messages/MessageSender.js

@@ -23,7 +23,8 @@ const {
 } = require('../proto/MessageProto');
 const { uploadMedia } = require('../MediaService');
 const { imageThumbnail, videoThumbnail, probeImageSize } = require('../MediaThumbnail');
-const { tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken } = require('./TcTokenStore');
+const { tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken,
+        isRegularTcTokenUser } = require('./TcTokenStore');
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -932,15 +933,19 @@ class MessageSender {
       ]);
       otherJids     = lidDevices.length > 0 ? lidDevices : [toJid];
       ownLinkedJids = ownLidDevices;
-      ownPrimaryJid = `${ownLidUser}@lid`;
+      ownPrimaryJid = this._client._ownDeviceLidJid() || `${ownLidUser}@lid`;
     } else {
       const [pnDevices, ownDevices] = await Promise.all([
         this._devMgr.bulkEnsureSessions([recipientPhone], this._signal, allowPkmsg),
         this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal, allowPkmsg)
       ]);
       otherJids     = pnDevices.length > 0 ? pnDevices : [toJid];
-      ownLinkedJids = ownDevices.filter(j => j !== ownMainJid);
-      ownPrimaryJid = ownMainJid;
+      // Every own device except the one doing the sending. As a primary that is
+      // device 0 and the list below drops it; as a companion the account's
+      // phone is device 0 and must stay in — it is a peer we encrypt to, not
+      // ourselves. The filter a few lines down removes whichever one we are.
+      ownLinkedJids = ownDevices;
+      ownPrimaryJid = this._client._ownDeviceJid();
     }
 
     // The device doing the sending is never one of its own recipients. Both
@@ -1014,7 +1019,10 @@ class MessageSender {
     // event. Once enough accumulate the server returns error 463 (timelock).
     // We attach the stored trusted-contact token when one exists and is valid.
     const tcStore = this._client._tcTokenStore;
-    const tcJid   = normalizeJidForTcToken(routingToJid);
+    // Keyed by the contact's LID, which is where a token they issued us was
+    // filed when it arrived. Looking it up by the phone JID — which is what
+    // this did — never found one, so nothing was ever attached.
+    const tcJid   = this._client._resolveTcTokenJid(routingToJid);
     if (tcStore) {
       const tcEntry = tcStore.get(tcJid);
       if (tcEntry && tcEntry.token && tcEntry.token.length) {
@@ -1078,11 +1086,23 @@ class MessageSender {
     // for this JID (one issuance per 7-day bucket is enough).  The token is
     // stored and attached on future sends so the server does not count them
     // as anonymous "reaching out" events (which would trigger error 463).
-    if (tcStore && tcStore.shouldIssue(tcJid) &&
+    //
+    // Two targets never get one. WhatsApp's own announcement account
+    // (0@s.whatsapp.net) and the bot numbers, including Meta AI, are not
+    // contacts you can be "timelocked" against, and no real client issues to
+    // them — whatsmeow gates on shouldSendTCTokenInChatAction, Baileys on
+    // isBotOrPSA. Protocol messages (a revoke, an ephemeral-timer change) are
+    // out too: Baileys skips issuance for them because they are bookkeeping,
+    // not a reach-out. Attaching an existing token to them is still correct
+    // and still happens above — this only governs asking for a new one.
+    const isProtocolMsg = !!(options && options._protocol);
+    if (tcStore && isRegularTcTokenUser(tcJid) && !isProtocolMsg &&
+        tcStore.shouldIssue(tcJid) &&
         !this._client._inFlightTcTokenIssuance.has(tcJid)) {
       this._client._inFlightTcTokenIssuance.add(tcJid);
-      const issueTs = Math.floor(Date.now() / 1000);
-      this._client._issuePrivacyTokens(routingToJid, issueTs)
+      const issueTs  = Math.floor(Date.now() / 1000);
+      const issueJid = this._client._resolveTcTokenIssuanceJid(routingToJid);
+      this._client._issuePrivacyTokens(issueJid, issueTs)
         .then(result => this._client._storeTcTokenFromIqResult(result, tcJid, issueTs))
         .catch(() => {})
         .finally(() => this._client._inFlightTcTokenIssuance.delete(tcJid));
@@ -1110,10 +1130,17 @@ class MessageSender {
         (typeof this._client._getStatusRecipients === 'function'
           ? await this._client._getStatusRecipients()
           : []);
-      if (!members.length) {
+      // Our own JID is always in the list so the post reaches our own devices,
+      // so a list of length one means there is nobody else on it. Counting the
+      // raw list let that through: the walk below then dropped us as the
+      // sender, left no targets, and the stanza went out as a bare skmsg with
+      // no <participants> — a SenderKey message nobody holds the key for, which
+      // the server answers with ack 479.
+      const others = members.filter(jid => !this._client._isOwnUser(jid));
+      if (others.length === 0) {
         throw new Error(
-          'Cannot post a Status: no recipients. Sync history so the contact ' +
-          'list is known, or pass { recipients: [...] }.'
+          'Cannot post a Status: it would reach nobody. The contact list is ' +
+          'empty — sync history first, or pass { recipients: [...] }.'
         );
       }
     }
@@ -1170,7 +1197,13 @@ class MessageSender {
     // For LID-mode groups, sender identity is own LID JID; otherwise own PN JID.
     // Normalised to the bare user so it matches the participant targets below.
     const selfJid = useLid ? `${myLidUser}@lid` : ownJid;
-    const senderIdentity = selfJid;
+    // The SenderKey is this device's, so the identity it is filed under carries
+    // our device index. On a primary that index is 0 and this is exactly the
+    // bare JID above; on a companion it keeps our key distinct from the
+    // account's phone, which distributes its own.
+    const senderIdentity = (useLid
+      ? this._client._ownDeviceLidJid()
+      : this._client._ownDeviceJid()) || selfJid;
 
     const rawSKDM   = await this._signal.buildSKDM(groupJid, senderIdentity);
     const skdmMsg   = encodeSenderKeyDistributionMessage(groupJid, rawSKDM);
@@ -1254,10 +1287,26 @@ class MessageSender {
 
     // Targets to actually encrypt for: everything but the sending device. Both
     // Baileys and whatsmeow skip it explicitly at this point and not before.
-    const selfAddrs = new Set([adString(`${ownPhone}@s.whatsapp.net`)]);
-    if (myLidUser) selfAddrs.add(adString(`${myLidUser}@lid`));
+    // Only the device actually sending. On a companion link that is not the
+    // account's phone — the phone is a peer that has to receive the SenderKey
+    // like everyone else, so excluding the bare number here would leave the
+    // owner's own phone unable to read the message.
+    const selfAddrs = new Set([adString(this._client._ownDeviceJid())]);
+    const ownLidSelf = this._client._ownDeviceLidJid();
+    if (ownLidSelf)     selfAddrs.add(adString(ownLidSelf));
+    else if (myLidUser) selfAddrs.add(adString(`${myLidUser}@lid`));
     const allTargets = enumeratedDevices.filter(jid => !selfAddrs.has(adString(jid)));
 
+    // Whatever the member list said, if nothing came back with a session there
+    // is no one to hand the SenderKey to and the skmsg below is undeliverable.
+    // Better to say so than to emit it and read the 479 back.
+    if (isStatus && allTargets.length === 0) {
+      throw new Error(
+        'Cannot post a Status: no Signal session could be opened with any ' +
+        'recipient, so the post would reach nobody.'
+      );
+    }
+
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
     // Same exclusions Baileys applies when choosing SenderKey recipients:
@@ -1411,7 +1460,7 @@ class MessageSender {
           // concurrent 463 recoveries and proactive issuances don't clash.
           if (error === '463' && !_isRetry) {
             const ackFrom = ackAttrs.from ? String(ackAttrs.from) : '';
-            const tcJid   = normalizeJidForTcToken(
+            const tcJid   = client._resolveTcTokenJid(
               ackFrom || String(node.attrs && node.attrs.to || '')
             );
             _whaDbg('[DBG] ACK_463 from=' + ackFrom + ' id=' + id +
@@ -1439,7 +1488,13 @@ class MessageSender {
             client._inFlight463Recoveries.add(tcJid);
             const issueTs = Math.floor(Date.now() / 1000);
 
-            client._issuePrivacyTokens(ackFrom || tcJid, issueTs)
+            // Same address family as every other issuance path — see
+            // Client._resolveTcTokenIssuanceJid. This used to hand the server
+            // whatever the ack happened to carry.
+            const issueJid = client._resolveTcTokenIssuanceJid(
+              ackFrom || String(node.attrs && node.attrs.to || '')
+            );
+            client._issuePrivacyTokens(issueJid, issueTs)
               .then(result => client._storeTcTokenFromIqResult(result, tcJid, issueTs))
               .then(() => {
                 // Verify that real token bytes were received from the server.
@@ -1540,7 +1595,9 @@ class MessageSender {
     const msgBuf = encodeMessage('protocol', revokePayload);
     // ProtocolMessage is one of the explicit "text" cases in whatsmeow's
     // getTypeFromMessage; there is no "protocol" stanza type.
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', { ...opts, edit: editBit });
+    // _protocol marks it for the tcToken issuance gate — see _sendDMMessage.
+    return this._sendMessage(toJid, msgId, msgBuf, 'text',
+      { ...opts, edit: editBit, _protocol: true });
   }
 
   // ─── Ephemeral timer DM ───────────────────────────────────────────────────
@@ -1555,7 +1612,7 @@ class MessageSender {
       ephemeralExpiration:  seconds
     });
     const msgBuf = encodeMessage('protocol', payload);
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', opts);
+    return this._sendMessage(toJid, msgId, msgBuf, 'text', { ...opts, _protocol: true });
   }
 
   // ─── Utility: mark read, presence, receipt, ping ─────────────────────────
@@ -1610,7 +1667,10 @@ class MessageSender {
       await this._fetchMediaConn();
       return { hosts: this._mediaHosts, auth: this._mediaAuth };
     };
-    return uploadMedia(mediaType, buf, this._mediaHosts, this._mediaAuth, refreshAuth);
+    // A companion talks to the CDN as a browser: different endpoint for the
+    // types the web client folds together, and an Origin header.
+    return uploadMedia(mediaType, buf, this._mediaHosts, this._mediaAuth, refreshAuth,
+      { web: this._client && this._client._mode === 'web' });
   }
 
   async _fetchMediaConn() {

package/lib/messages/TcTokenStore.js

@@ -6,6 +6,14 @@ const path = require('path');
 // 7-day buckets, 4 buckets = ~28-day rolling window (matches Baileys tc-token-utils)
 const TC_BUCKET_DURATION = 604800;
 const TC_NUM_BUCKETS     = 4;
+// whatsmeow prunes expired rows out of the token table at most once a day
+// (tcTokenDBPruneInterval). Ours is a JSON file, so the same cadence applies.
+const TC_PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+// The two phone-number ranges WhatsApp uses for bots, including Meta AI.
+// Byte-for-byte the same expression in whatsmeow (botUserRegex) and in
+// Baileys (BOT_PHONE_REGEX).
+const BOT_USER_RE = /^1313555\d{4}$|^131655500\d{2}$/;
 
 function tcTokenExpired(timestamp) {
   if (timestamp == null) return true;
@@ -25,6 +33,26 @@ function shouldSendNewTcToken(senderTimestamp) {
   return curBucket > senderBucket;
 }
 
+// Whether a JID is a real person we may hold a trusted-contact token for.
+//
+// whatsmeow gates issuance with shouldSendTCTokenInChatAction and Baileys gates
+// both issuance and storage with isRegularUser; the two agree on the rule:
+// a user address (phone or LID), not the PSA pseudo-contact 0@…, not a bot.
+// Without it we issue a privacy IQ to WhatsApp's own announcement account and
+// to Meta AI, which no real client ever does.
+function isRegularTcTokenUser(jid) {
+  if (!jid) return false;
+  const norm   = normalizeJidForTcToken(jid);
+  const atIdx  = norm.indexOf('@');
+  if (atIdx < 0) return false;
+  const user   = norm.slice(0, atIdx);
+  const server = norm.slice(atIdx + 1);
+  if (server !== 's.whatsapp.net' && server !== 'c.us' && server !== 'lid') return false;
+  if (user === '0') return false;              // PSA
+  if (BOT_USER_RE.test(user)) return false;    // bots, Meta AI
+  return true;
+}
+
 // Strip device part and normalize to bare JID
 function normalizeJidForTcToken(jid) {
   if (!jid) return String(jid || '');
@@ -43,7 +71,36 @@ class TcTokenStore {
     this._path = filePath;
     // jid → { token: Buffer|null, timestamp: number|null, senderTimestamp: number|null }
     this._map  = new Map();
+    this._lastPrune = 0;
     this._load();
+    this.pruneExpired();
+  }
+
+  // Drop entries that are past the 28-day window on both counts.
+  //
+  // whatsmeow runs DeleteExpiredPrivacyTokens against the same cutoff and lets
+  // its in-memory sender-timestamp map age out on the same boundary. An entry
+  // whose token has expired but whose senderTimestamp is still inside the
+  // window has to stay: that timestamp is what keeps us from re-issuing on
+  // every single send.
+  pruneExpired() {
+    let removed = 0;
+    for (const [jid, entry] of this._map) {
+      const tokenDead  = !entry.token || !entry.token.length || tcTokenExpired(entry.timestamp);
+      const senderDead = tcTokenExpired(entry.senderTimestamp);
+      if (tokenDead && senderDead) {
+        this._map.delete(jid);
+        removed++;
+      }
+    }
+    this._lastPrune = Date.now();
+    if (removed) this._save();
+    return removed;
+  }
+
+  _maybePrune() {
+    if (Date.now() - this._lastPrune < TC_PRUNE_INTERVAL_MS) return;
+    this.pruneExpired();
   }
 
   _load() {
@@ -77,14 +134,36 @@ class TcTokenStore {
   }
 
   get(jid) {
+    // whatsmeow prunes from ensureTCToken, i.e. on the read path, rate-limited
+    // to once a day. Same here.
+    this._maybePrune();
     return this._map.get(normalizeJidForTcToken(jid)) || null;
   }
 
+  // Returns true when the token was accepted.
+  //
+  // Two rejections, both taken from Baileys' storeTcTokensFromIqResult:
+  //  - a token with no timestamp is already expired by definition, so storing
+  //    it only wastes a slot and guarantees a miss on the next send;
+  //  - a token older than the one on file must never overwrite it. Token
+  //    deliveries are not ordered — an issuance result and a privacy_token
+  //    notification for the same contact can land in either order — so without
+  //    this a stale copy can replace a fresh one.
   setToken(jid, tokenBuf, timestamp) {
     const key      = normalizeJidForTcToken(jid);
-    const existing = this._map.get(key) || {};
-    this._map.set(key, { ...existing, token: tokenBuf, timestamp });
+    const incoming = timestamp != null ? Number(timestamp) : 0;
+    if (!incoming || isNaN(incoming)) return false;
+
+    const existing   = this._map.get(key) || {};
+    const existingTs = existing.timestamp != null ? Number(existing.timestamp) : 0;
+    if (existingTs > 0 && existingTs > incoming &&
+        existing.token && existing.token.length) {
+      return false;
+    }
+
+    this._map.set(key, { ...existing, token: tokenBuf, timestamp: incoming });
     this._save();
+    return true;
   }
 
   clearToken(jid) {
@@ -113,4 +192,12 @@ class TcTokenStore {
   }
 }
 
-module.exports = { TcTokenStore, tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken };
+module.exports = {
+  TcTokenStore,
+  tcTokenExpired,
+  shouldSendNewTcToken,
+  normalizeJidForTcToken,
+  isRegularTcTokenUser,
+  TC_BUCKET_DURATION,
+  TC_NUM_BUCKETS
+};

package/lib/noise.js

@@ -6,7 +6,7 @@ const EventEmitter = require('events');
 const curveJs      = require('curve25519-js');
 const { sha256 }   = require('@noble/hashes/sha256');
 const { hkdf }     = require('@noble/hashes/hkdf');
-const { MOBILE_PROLOGUE, WHATSAPP_HOST, WHATSAPP_PORT } = require('./constants');
+const { MOBILE_PROLOGUE, WEB_PROLOGUE, WHATSAPP_HOST, WHATSAPP_PORT } = require('./constants');
 const { encodeHandshakeClientHello, encodeHandshakeClientFinish,
         decodeServerHello, encodeClientPayload } = require('./proto');
 const { parsePhone, getCountryMeta } = require('./Registration');
@@ -112,7 +112,10 @@ function deriveHkdf(salt, ikm, length) {
 }
 
 class NoiseState {
-  constructor() {
+  // The prologue is mixed into the handshake hash, so mobile and web produce
+  // different transcripts from the first byte and a payload built for one
+  // edition can never authenticate against the other.
+  constructor(prologue) {
     // Noise spec: if protocol_name.length <= HASHLEN(32), h = protocol_name padded with zeros.
     // Do NOT hash — use the raw 32-byte name directly as the initial h and ck.
     const modeBytes = Buffer.from(NOISE_MODE, 'utf8'); // 'Noise_XX_25519_AESGCM_SHA256\0\0\0\0' = 32 bytes
@@ -120,7 +123,7 @@ class NoiseState {
     this.ck      = Buffer.from(modeBytes);
     this.key     = null;  // single key for both enc+dec during handshake
     this.counter = 0;     // single counter for both encrypt+decrypt
-    this.hash(MOBILE_PROLOGUE);
+    this.hash(prologue || MOBILE_PROLOGUE);
   }
 
   hash(data) {
@@ -188,8 +191,26 @@ function readFrameLength(data) {
 //   'error'(err)  — an error occurred
 //
 class NoiseSocket extends EventEmitter {
-  constructor(store) {
+  /**
+   * @param {object} store   session store
+   * @param {object} [opts]
+   *   transport      'mobile' (raw TLS to g.whatsapp.net) or 'web' (WebSocket
+   *                  to web.whatsapp.com). Defaults to mobile — every existing
+   *                  caller keeps its behaviour without passing anything.
+   *   buildPayload   () => Buffer, replaces the mobile ClientPayload. Web mode
+   *                  supplies the companion register/login payload here.
+   *   expectSuccess  when false the connect() promise resolves as soon as the
+   *                  channel is secured instead of waiting for <success>. A
+   *                  companion that has not been paired yet never receives one:
+   *                  the server replies with pair-device and waits for a human.
+   */
+  constructor(store, opts) {
     super();
+    opts = opts || {};
+    this.transport     = opts.transport === 'web' ? 'web' : 'mobile';
+    this._buildPayload = opts.buildPayload || null;
+    this._expectSuccess = opts.expectSuccess !== false;
+    this._prologue     = this.transport === 'web' ? WEB_PROLOGUE : MOBILE_PROLOGUE;
     this.store        = store;
     this.socket       = null;
     this.noiseState   = null;
@@ -211,7 +232,12 @@ class NoiseSocket extends EventEmitter {
       this._connectResolve = resolve;
       this._connectReject  = reject;
 
-      this.socket = net.createConnection({ host: WHATSAPP_HOST, port: WHATSAPP_PORT });
+      if (this.transport === 'web') {
+        const { WebSocketStream } = require('./WebSocketStream');
+        this.socket = new WebSocketStream().connect();
+      } else {
+        this.socket = net.createConnection({ host: WHATSAPP_HOST, port: WHATSAPP_PORT });
+      }
       // OS-level TCP keepalive: detects silently-dead NAT connections that never send FIN/RST
       this.socket.setKeepAlive(true, 15000);
       // Connect-phase watchdog: abort if TCP handshake takes >20s
@@ -241,7 +267,7 @@ class NoiseSocket extends EventEmitter {
   }
 
   _startHandshake() {
-    this.noiseState    = new NoiseState();
+    this.noiseState    = new NoiseState(this._prologue);
     const seed         = crypto.randomBytes(32);
     const kp           = curveJs.generateKeyPair(seed);
     this._ephemeralKeyPair = {
@@ -251,7 +277,7 @@ class NoiseSocket extends EventEmitter {
     this.noiseState.hash(this._ephemeralKeyPair.public);
 
     const helloPayload = encodeHandshakeClientHello(this._ephemeralKeyPair.public);
-    const frame        = Buffer.concat([MOBILE_PROLOGUE, makeFrame(helloPayload)]);
+    const frame        = Buffer.concat([this._prologue, makeFrame(helloPayload)]);
     this.socket.write(frame);
   }
 
@@ -302,6 +328,37 @@ class NoiseSocket extends EventEmitter {
       const sharedSS   = dhShared(noisePriv, serverHello.ephemeral);
       this.noiseState.mixKey(sharedSS);
 
+      // Web mode hands us a finished companion payload; there is no phone
+      // identity to derive anything from, and the fields below do not exist on
+      // that side of the protocol.
+      if (this._buildPayload) {
+        const encPayload = this.noiseState.encryptWithAd(this._buildPayload());
+        const finish     = encodeHandshakeClientFinish(encStatic, encPayload);
+        this.socket.write(makeFrame(finish));
+
+        const webKeys     = this.noiseState.split();
+        this.writeKey     = webKeys.writeKey;
+        this.readKey      = webKeys.readKey;
+        this.writeCounter = 0;
+        this.readCounter  = 0;
+        this.secured      = true;
+
+        if (this._expectSuccess) {
+          this._awaitingAuth = true;
+        } else {
+          // An unpaired companion gets pair-device, not <success>. Hand the
+          // caller a live channel and let the pairing flow drive from here.
+          this._awaitingAuth = false;
+          if (this._connectResolve) {
+            this._connectResolve();
+            this._connectResolve = null;
+            this._connectReject  = null;
+          }
+          this.emit('secured');
+        }
+        return;
+      }
+
       // Auto-derive MCC/MNC and locale from the registered phone number so the
       // ClientPayload userAgent is never sent with the telltale '000'/'000' values.
       const _phoneMeta  = getCountryMeta(parsePhone(this.store.phoneNumber).cc);
@@ -411,6 +468,14 @@ class NoiseSocket extends EventEmitter {
       }
       // ─────────────────────────────────────────────────────────────────────
 
+      // A companion that connected unpaired resolves connect() early, so
+      // <success> arrives here as an ordinary node once the link completes.
+      // It still means the same thing, so it still opens the session.
+      if (!this._expectSuccess && node && node.description === 'success') {
+        this.emit('open', node);
+        return;
+      }
+
       this.emit('node', node);
     } catch (err) {
       this.emit('error', err);

package/lib/signal/SignalProtocol.js

@@ -282,11 +282,20 @@ class SignalProtocol {
   // SenderKeyName format: groupId::senderId::0 (device 0 for group identity).
 
   _senderKeyName(groupId, senderId) {
-    // Strip device suffix (e.g. "1234567890:2@lid" → "1234567890")
-    const user = typeof senderId === 'string'
-      ? senderId.split('@')[0].split(':')[0]
-      : String(senderId);
-    return new SenderKeyName(groupId, { id: user, deviceId: 0 });
+    // A SenderKey belongs to a device, not to an account. Every device that
+    // posts to a group distributes its own key, so the name has to carry the
+    // device index the way Baileys and whatsmeow do — otherwise two devices of
+    // the same person share one slot and the second one to speak overwrites
+    // the first, leaving its messages undecryptable.
+    //
+    // Bare JIDs still resolve to device 0, so everything already on disk keeps
+    // the exact same key string.
+    const raw     = typeof senderId === 'string' ? senderId : String(senderId);
+    const userPart = raw.split('@')[0];
+    const colon    = userPart.indexOf(':');
+    const user     = colon >= 0 ? userPart.slice(0, colon) : userPart;
+    const deviceId = colon >= 0 ? (parseInt(userPart.slice(colon + 1), 10) || 0) : 0;
+    return new SenderKeyName(groupId, { id: user, deviceId });
   }
 
   async senderKeyEncrypt(groupId, senderId, plaintext) {