whalibmob 5.6.2 → 5.6.4

package/README.md

@@ -669,6 +669,29 @@ Run it once, type the code into the phone, and it is linked. Run it again and it
 |---|---|---|
 | `syncFullHistory` | `true` | Ask the phone for the full archive. `false` requests recent messages only and links noticeably faster. |
 | `browser` | `['Ubuntu', 'Chrome', '120.0.0.0']` | `[os, client, version]`. The second element picks the icon shown under Linked Devices: `Chrome`, `Firefox`, `Safari`, `Edge`, `Opera`, `Desktop`. |
+| `version` | fetched live | Web client revision to announce, e.g. `[2, 3000, 1035194821]`. Set it to pin one. |
+| `fetchVersion` | `true` | Set `false` to skip the live lookup and use the pinned fallback. |
+
+#### The Announced Version
+
+The web endpoint checks the client revision during the handshake and refuses an unrecognised one with `<failure reason="405">` — before any stanza is exchanged, and with nothing in the failure to say the version was the problem. The mobile endpoint is far more forgiving; this one is not.
+
+whalibmob therefore reads the live revision from WhatsApp Web's own service worker on each `connectWeb()`, and falls back to a pinned value if that lookup fails. You should not have to think about it, but you can:
+
+```js
+const { fetchWaWebVersion } = require('whalibmob')
+
+const { version, isLatest } = await fetchWaWebVersion()
+console.log(version, isLatest)   // [2, 3000, 1035194821] true
+
+// pin it yourself
+await client.connectWeb(phone, { version: [2, 3000, 1035194821] })
+
+// or skip the lookup entirely
+await client.connectWeb(phone, { fetchVersion: false })
+```
+
+If you ever see `405`, this is what it means. It is not a revoked session and there is nothing to re-pair — reconnect to pick up the current revision.
 
 `requestPairingCode(phone, customCode)`:
 
@@ -687,6 +710,7 @@ Every event from the SMS primary API fires here too — `message`, `receipt`, `p
 | `pair_device` | `{ refs }` | the QR path produced reference strings |
 | `history_sync` | `{ syncTypeName, chats, contacts, pushNames, merged }` | a chunk of history arrived |
 | `history_sync_error` | `{ err, notification }` | a chunk could not be fetched or decrypted |
+| `client_rejected` | `{ reason, location, message }` | the server refused the client itself, not the session — `405` means the announced version is not accepted. Distinct from `auth_failure`, and there is nothing to re-pair. |
 
 ### Reading What the Phone Sent
 

package/cli.js

@@ -572,7 +572,19 @@ function attachEvents(client) {
 
   client.on('auth_failure', (f) => {
     _rl && _rl.pause();
-    fail('session revoked: ' + f.reason + ' — re-register with /reg code');
+    const how = client._mode === 'web'
+      ? 'link again with /pair'
+      : 're-register with /reg code';
+    fail('session revoked: ' + f.reason + ' — ' + how);
+    _rl && (_rl.resume(), _rl.prompt(true));
+  });
+
+  // The server declined the client, not the session. Nothing to re-register.
+  client.on('client_rejected', (r) => {
+    _rl && _rl.pause();
+    fail('rejected by WhatsApp (' + r.reason +
+         (r.location ? ', edge ' + r.location : '') + ')');
+    out('  ' + r.message);
     _rl && (_rl.resume(), _rl.prompt(true));
   });
 
@@ -812,7 +824,12 @@ async function handleLine(line) {
 
       case '/pair': {
         const ph = p[1] || _phone;
-        if (!ph) { fail('usage: /pair <phone> [8-char-code]'); break; }
+        if (!ph) {
+          fail('usage: /pair <phone> [8-char-code]');
+          out('  the phone number is the account you want to link to, digits only');
+          out('  example: /pair 40756469325');
+          break;
+        }
         if (_client && _client.connected) { fail('already connected — /disconnect first'); break; }
         out('connecting...');
         await doConnectWeb(ph, { customCode: p[2] });

package/index.js

@@ -28,6 +28,7 @@ const {
   buildCompanionFinishBundle
 } = require('./lib/PairingCode');
 const { configureSuccessfulPairing } = require('./lib/CompanionPairing');
+const { fetchWaWebVersion } = require('./lib/WebVersion');
 const {
   encodeCompanionRegisterPayload,
   encodeCompanionLoginPayload
@@ -81,6 +82,7 @@ module.exports = {
   configureSuccessfulPairing,
   encodeCompanionRegisterPayload,
   encodeCompanionLoginPayload,
+  fetchWaWebVersion,
   // Signal / encryption internals
   SignalProtocol,
   SignalStore,

package/lib/Client.js

@@ -198,6 +198,10 @@ class WhalibmobClient extends EventEmitter {
     // account as a companion, via pairing code.
     this._mode          = 'mobile';
     this._webSessionFile = null;
+    // Set once the server has told us to stop trying: an account logout, or a
+    // client the server will not accept. Suppresses the reconnect loop.
+    this._fatal          = false;
+    this._closing        = false;
     this._pingTimer               = null;
     this._keepTimer               = null;
     this._connected     = false;
@@ -267,6 +271,9 @@ class WhalibmobClient extends EventEmitter {
   async init(phoneNumber) {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
+    // A fresh attempt clears whatever made the last one fatal. Only the public
+    // entry points reset it — the reconnect loop must not clear its own guard.
+    this._fatal = false;
 
     const sessionFile = path.join(this._sessionDir, `${phoneNumber}.json`);
     this._store = loadStore(sessionFile);
@@ -354,6 +361,7 @@ class WhalibmobClient extends EventEmitter {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
     this._mode = 'web';
+    this._fatal = false;
 
     const { createNewWebStore, loadWebStore, saveWebStore, webSessionPath } =
       require('./WebStore');
@@ -363,6 +371,25 @@ class WhalibmobClient extends EventEmitter {
 
     if (opts.syncFullHistory !== undefined) this._store.syncFullHistory = !!opts.syncFullHistory;
     if (opts.browser) this._store.browser = opts.browser;
+
+    // Announce the revision the web client is actually on.
+    //
+    // The web endpoint rejects an unrecognised version during the handshake
+    // with <failure reason="405"> and says nothing about why, so a version
+    // pinned in source is a connection that stops working on WhatsApp's
+    // schedule rather than ours. Read the live one, keep the pinned value as
+    // the fallback, and let a caller override both.
+    if (opts.version) {
+      this._store.webVersion = opts.version;
+    } else if (opts.fetchVersion !== false) {
+      const { fetchWaWebVersion } = require('./WebVersion');
+      const res = await fetchWaWebVersion();
+      this._store.webVersion = res.version;
+      _whaDbg('[DBG] WEB_VERSION ' + res.version.join('.') +
+        (res.isLatest ? ' (live)' : ' (pinned fallback: ' +
+          (res.error && res.error.message) + ')'));
+    }
+
     saveWebStore(this._store, this._webSessionFile);
 
     // Signal state lives in its own files so a web link and an SMS
@@ -721,6 +748,12 @@ class WhalibmobClient extends EventEmitter {
   }
 
   disconnect() {
+    // Closing the socket makes it emit 'close', which lands in _onClose and
+    // schedules a reconnect. That is right for a dropped connection and wrong
+    // for a deliberate teardown — and it is what turned a single <failure> into
+    // an endless retry loop, since clearing _reconnecting was not enough to
+    // stop the handler that sets it again.
+    this._closing      = true;
     this._reconnecting = false;
     this._reconnectTry = 0;
     this._stopTimers();
@@ -730,11 +763,16 @@ class WhalibmobClient extends EventEmitter {
     }
     this._connected = false;
     this.emit('close');
+    this._closing = false;
   }
 
   // ─── Reconnection ─────────────────────────────────────────────────────────
 
   _scheduleReconnect() {
+    // A fatal failure — the account logged us out, or the server refused the
+    // client outright — will fail identically every time. Retrying it only
+    // fills the terminal.
+    if (this._closing || this._fatal) return;
     if (this._reconnecting) return;
     this._reconnecting = true;
     const delay = RECONNECT_BACKOFF[Math.min(this._reconnectTry, RECONNECT_BACKOFF.length - 1)];
@@ -2068,11 +2106,44 @@ class WhalibmobClient extends EventEmitter {
 
   // ─── Auth failure (server forces logout during active session) ──────────────
 
+  // <failure> ends the connection, but not every reason means the session died.
+  //
+  // 401, 403 and 419 are the ones that do: the account logged us out, or the
+  // owner removed the device. Those are unrecoverable and reconnecting only
+  // burns attempts.
+  //
+  // 405 is different, and reading it as "session revoked" sent people looking
+  // in the wrong place. It means the server declined the client itself — on the
+  // web endpoint, almost always because the announced version is one it does
+  // not recognise. Nothing about the session is wrong; retrying with the same
+  // version will fail identically, so say what it is instead.
   _handleFailure(node) {
     const attrs  = (node && node.attrs) || {};
-    const reason = attrs.reason || attrs.location || 'unknown';
-    this.emit('auth_failure', { reason, node });
+    const reason = String(attrs.reason || attrs.location || 'unknown');
+    const loc    = attrs.location ? String(attrs.location) : null;
+
+    if (reason === '405') {
+      const detail = this._mode === 'web'
+        ? 'WhatsApp refused this client (405). The web version we announced (' +
+          ((this._store && this._store.webVersion) || []).join('.') +
+          ') is not one the server accepts — it changes on their schedule. ' +
+          'Reconnect to pick up the current one, or pass { version: [2, 3000, N] } ' +
+          'to connectWeb().'
+        : 'WhatsApp refused this client (405) — the announced app version is ' +
+          'not accepted. Update the version in the session store.';
+      _whaDbg('[DBG] FAILURE 405 location=' + loc + ' — client refused, not a dead session');
+      this._fatal = true;
+      this._reconnecting = false;
+      this.emit('client_rejected', { reason, location: loc, message: detail, node });
+      this.emit('error', new Error(detail));
+      this.disconnect();
+      return;
+    }
+
+    _whaDbg('[DBG] FAILURE reason=' + reason + ' location=' + loc);
+    this.emit('auth_failure', { reason, location: loc, node });
     // The session is no longer valid — stop reconnecting and disconnect
+    this._fatal = true;
     this._reconnecting = false;
     this.disconnect();
   }

package/lib/DeviceManager.js

@@ -901,7 +901,10 @@ class DeviceManager {
       }
     }
 
-    const deviceIds  = (this._dcGet(cacheKey) || []).filter(d => d !== 0);
+    // Same rule as the phone-addressed path: skip the device we are, not the
+    // device that happens to be numbered zero.
+    const selfDevice = this._ownDeviceIndex();
+    const deviceIds  = (this._dcGet(cacheKey) || []).filter(d => d !== selfDevice);
     const deviceJids = deviceIds.map(d => makeDeviceJid(lidUser, d, 'lid'));
     if (deviceJids.length === 0) return [];
 
@@ -1085,10 +1088,30 @@ class DeviceManager {
   //   On the first call we query usync, on all subsequent calls we return
   //   from cache — zero extra network round-trips.
   //
+  // Which device index this client occupies.
+  //
+  // A device registered over SMS is the account's primary and is always 0. A
+  // companion linked by pairing code occupies a numbered slot — and then
+  // device 0 is the owner's phone, which is a recipient like any other.
+  _ownDeviceIndex() {
+    const store = this._client && this._client._store;
+    return (store && store.deviceIndex) || 0;
+  }
+
   async ensureOwnDeviceSessions(ownPhone, signalProto, allowPkmsg = true) {
+    // Everything the account owns except the device doing the sending.
+    //
+    // This used to drop device 0 unconditionally, which is right only while we
+    // are device 0. As a companion it silently excluded the owner's own phone
+    // from every message we sent: the recipient got it, the phone did not, and
+    // it sat there showing "waiting for this message" forever. It also put our
+    // participant list out of step with the server's, which is what the phash
+    // mismatch on the ack was reporting.
+    const selfDevice = this._ownDeviceIndex();
+
     // Use cached own device list if it hasn't expired (5-min TTL matches _deviceCache)
     if (this._ownDeviceJids !== null && Date.now() < this._ownDeviceExpiry) {
-      const others = this._ownDeviceJids.filter(j => stripUser(j).device !== 0);
+      const others = this._ownDeviceJids.filter(j => stripUser(j).device !== selfDevice);
       return this._ensureSessions(others, signalProto, allowPkmsg);
     }
 
@@ -1097,7 +1120,7 @@ class DeviceManager {
     this._ownDeviceJids   = deviceJids;
     this._ownDeviceExpiry = Date.now() + 5 * 60 * 1000;
 
-    const others = deviceJids.filter(j => stripUser(j).device !== 0);
+    const others = deviceJids.filter(j => stripUser(j).device !== selfDevice);
     return this._ensureSessions(others, signalProto, allowPkmsg);
   }
 

package/lib/WebVersion.js

@@ -0,0 +1,78 @@
+'use strict';
+
+// The web client's own revision number.
+//
+// The mobile endpoint tolerates a version that has drifted by months. The web
+// endpoint does not: it checks the revision during the Noise handshake and
+// refuses an unrecognised one with <failure reason="405"> before a single
+// stanza has been exchanged. There is nothing in that failure to say the
+// version was the problem, which makes a stale constant an expensive thing to
+// carry.
+//
+// So read the live one. WhatsApp Web ships its service worker at
+// /sw.js with the current revision embedded in it; that number, paired with
+// the fixed 2.3000 prefix, is the version the browser announces.
+//
+// Everything here is best-effort — a failed fetch falls back to the pinned
+// value rather than blocking a connection.
+
+const https = require('https');
+const { WEB_VERSION_FALLBACK } = require('./constants');
+
+const SW_URL   = 'https://web.whatsapp.com/sw.js';
+const CACHE_MS = 60 * 60 * 1000;   // an hour; the revision changes far slower
+
+let _cached   = null;
+let _cachedAt = 0;
+
+function fetchText(url, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(url, {
+      headers: {
+        // The minimum that gets past the anti-bot check on this path.
+        'sec-fetch-site': 'none',
+        'user-agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 ' +
+                      '(KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'
+      }
+    }, (res) => {
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error('sw.js returned HTTP ' + res.statusCode));
+      }
+      const chunks = [];
+      res.on('data', c => chunks.push(c));
+      res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+    req.setTimeout(timeoutMs || 10000, () => req.destroy(new Error('sw.js fetch timed out')));
+  });
+}
+
+/**
+ * Resolve the version to announce.
+ *
+ * @param {object} [opts]  { force } to bypass the hourly cache
+ * @returns {Promise<{version: number[], isLatest: boolean, error?: Error}>}
+ */
+async function fetchWaWebVersion(opts) {
+  opts = opts || {};
+  if (!opts.force && _cached && (Date.now() - _cachedAt) < CACHE_MS) {
+    return { version: _cached.slice(), isLatest: true };
+  }
+
+  try {
+    const body  = await fetchText(SW_URL, opts.timeoutMs);
+    const match = body.match(/\\?"client_revision\\?":\s*(\d+)/);
+    if (!match || !match[1]) throw new Error('client_revision not found in sw.js');
+
+    const version = [2, 3000, parseInt(match[1], 10)];
+    _cached   = version;
+    _cachedAt = Date.now();
+    return { version: version.slice(), isLatest: true };
+  } catch (error) {
+    return { version: WEB_VERSION_FALLBACK.slice(), isLatest: false, error };
+  }
+}
+
+module.exports = { fetchWaWebVersion, WEB_VERSION_FALLBACK };

package/lib/constants.js

@@ -18,10 +18,14 @@ const WEB_PROLOGUE   = Buffer.from([0x57, 0x41, 0x06, 0x03]);
 const WEB_SOCKET_URL = 'wss://web.whatsapp.com/ws/chat';
 const WEB_ORIGIN     = 'https://web.whatsapp.com';
 
-// Version the companion announces. Unlike the mobile version this is not tied
-// to an App Store build — it is the web client release, and the server is
-// tolerant of a slightly stale one.
-const WEB_VERSION_FALLBACK = [2, 3000, 1027934701];
+// Version the companion announces.
+//
+// Not an App Store build like the mobile version — this is the web client's
+// own revision, and the server is far less tolerant of it than the mobile
+// endpoint is: an unrecognised revision is refused during the handshake with
+// <failure reason="405">, before any stanza is exchanged. Keep it current, or
+// let fetchWaWebVersion() read the live one.
+const WEB_VERSION_FALLBACK = [2, 3000, 1035194821];
 
 // [os, browser] pair. Decides the DeviceProps.platformType we register with and
 // the name the account owner sees in the linked-devices list on their phone.

package/lib/messages/MessageSender.js

@@ -1259,8 +1259,8 @@ class MessageSender {
         : Promise.resolve([]),
       // Our own linked devices, in the address family the stanza is routed with.
       // ensureOwnDeviceSessions hands back @s.whatsapp.net JIDs, which cannot go
-      // into a stanza carrying addressing_mode='lid'; both helpers already leave
-      // out device 0.
+      // into a stanza carrying addressing_mode='lid'; both helpers leave out the
+      // device we are, which is device 0 only while we are the primary.
       useLid
         ? this._devMgr.ensureOwnLidDeviceSessions(myLidUser, ownPhone, this._signal)
         : this._devMgr.ensureOwnDeviceSessions(ownPhone, this._signal)
@@ -1275,8 +1275,17 @@ class MessageSender {
       const s = String(jid);
       return s.endsWith('@hosted') || s.endsWith('@hosted.lid');
     };
+    // The sending device counts in the enumeration even though it is not a
+    // recipient — and that is *this* device, not device 0. On a companion link
+    // the bare JID names the owner's phone, which arrives through ownTargets
+    // like every other device; adding it here again while leaving our own slot
+    // out would hash a set the server never computes.
+    const ownSelfJid = (useLid
+      ? this._client._ownDeviceLidJid()
+      : this._client._ownDeviceJid()) || selfJid;
+
     const enumeratedDevices = [...new Set(
-      [...memberDevices, ...lidDevices, ...ownTargets, selfJid]
+      [...memberDevices, ...lidDevices, ...ownTargets, ownSelfJid]
     )].filter(jid => !isHostedJid(jid));
 
     // The participant hash the server checks the fan-out against. whatsmeow puts

package/lib/webproto.js

@@ -148,6 +148,9 @@ function encodeAppVersion(v) {
   ]);
 }
 
+// Exactly the fields the web client sets, and no others. `manufacturer` is
+// deliberately absent: the reference never populates it for a web UserAgent,
+// and an extra field is a difference the server can notice.
 function encodeWebUserAgent(opts) {
   const version = opts.version || [2, 3000, 1];
   const browser = opts.browser || ['Ubuntu', 'Chrome', '120.0.0.0'];
@@ -158,7 +161,6 @@ function encodeWebUserAgent(opts) {
     stringField(3, '000'),                                  // mcc
     stringField(4, '000'),                                  // mnc
     stringField(5, '0.1'),                                  // osVersion
-    stringField(6, 'Desktop'),                              // manufacturer
     stringField(7, 'Desktop'),                              // device
     stringField(8, '0.1'),                                  // osBuildNumber
     varintField(10, 0),                                     // releaseChannel = RELEASE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.6.2",
+  "version": "5.6.4",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",