whalibmob 5.6.8 → 5.7.0

package/cli.js

@@ -316,6 +316,9 @@ function ts() {
 let _client  = null;
 let _phone   = null;
 let _sessDir = defaultSessionDir();
+// Set when a failed connect turned out to be a number-form mismatch, so
+// /fixnumber knows what it is fixing without probing the server again.
+let _pendingFix = null;
 let _rl      = null;
 
 // ─── shell help ───────────────────────────────────────────────────────────────
@@ -438,6 +441,7 @@ const HELP = `
   Connection
     /connect    <phone> [sms|pair]           connect to WhatsApp (asks which if unset)
     /pair       <phone> [code]               link to an existing account by 8-digit code
+    /fixnumber                               re-file a session under the number WhatsApp uses
     /disconnect                              disconnect
     /reconnect                              force reconnection
     /session                                show session info
@@ -580,6 +584,23 @@ function attachEvents(client) {
     notConnected();
   });
 
+  // Someone else opened a session for this number. Reconnecting would fight
+  // them for it, so the client stands down and says so.
+  client.on('connection_replaced', (r) => {
+    _rl && _rl.pause();
+    fail('connection replaced');
+    out('  ' + r.message);
+    _rl && _rl.resume();
+    notConnected();
+  });
+
+  // A stanza whose shape we mishandled. Not fatal — the connection kept going.
+  client.on('node_error', (e) => {
+    _rl && _rl.pause();
+    fail('could not handle a <' + e.tag + '>: ' + (e.err && e.err.message));
+    _rl && (_rl.resume(), _rl.prompt(true));
+  });
+
   // The server declined the client, not the session. Nothing to re-register.
   client.on('client_rejected', (r) => {
     _rl && _rl.pause();
@@ -760,7 +781,22 @@ async function doConnect(phone) {
       out('  checking whether the number is still registered...');
       try {
         const probe = await client.checkSessionAlive();
-        if (probe.alive) {
+
+        if (probe.mismatch) {
+          // The session is filed under a number the server does not use for
+          // this account, so the handshake has been sending a username no
+          // registration matches. Renaming fixes it; re-registering would not.
+          hr();
+          out('  the session is filed under a number WhatsApp does not use');
+          out('    session : +' + probe.current);
+          out('    server  : +' + probe.canonical);
+          hr();
+          out('  WhatsApp knows this account by the second form, so every login');
+          out('  has been sent under a number it has no registration for.');
+          out('');
+          out('  fix it in place:  /fixnumber');
+          out('  (renames the session files, keeps the registration)');
+        } else if (probe.alive) {
           out('  the number IS still registered, but this device was logged out.');
           out('  register it again:  /reg code ' + phone);
         } else if (probe.error) {
@@ -769,6 +805,8 @@ async function doConnect(phone) {
           out('  the registration is gone server-side (' + (probe.status || 'no status') + ').');
           out('  register it again:  /reg code ' + phone);
         }
+        // keep the client around so /fixnumber has a store to work from
+        _pendingFix = probe.mismatch ? { client, probe } : null;
       } catch (probeErr) {
         out('  status check failed: ' + probeErr.message);
       }
@@ -861,6 +899,21 @@ async function handleLine(line) {
         break;
       }
 
+      case '/fixnumber': {
+        if (!_pendingFix) {
+          fail('nothing to fix — run /connect <phone> first and let it report a mismatch');
+          break;
+        }
+        const { client, probe } = _pendingFix;
+        out('renaming session +' + probe.current + ' → +' + probe.canonical + '...');
+        const r = await client.adoptCanonicalNumber(probe.canonical);
+        out('  moved ' + r.files.length + ' file(s)');
+        _pendingFix = null;
+        out('now connect with the number WhatsApp uses:');
+        out('  /connect ' + r.phoneNumber);
+        break;
+      }
+
       case '/pair': {
         const ph = p[1] || _phone;
         if (!ph) {
@@ -1665,9 +1718,18 @@ async function handleLine(line) {
             const finalStore = r.store || store;
             finalStore.registered  = true;
             finalStore.codePending = false;
-            saveStore(finalStore, file);
-            out('registered  session saved to ' + file);
-            out('now run: /connect ' + ph);
+            // Save under the number WhatsApp filed the account as, not the one
+            // that was typed — they differ often enough to matter.
+            const savedPhone = String(finalStore.phoneNumber || ph);
+            const savedFile  = path.join(_sessDir, `${savedPhone}.json`);
+            saveStore(finalStore, savedFile);
+            if (r.canonicalPhoneNumber) {
+              out('note: WhatsApp knows this account as +' + r.canonicalPhoneNumber +
+                  ', not +' + r.typedPhoneNumber);
+              out('      the session is saved under that number');
+            }
+            out('registered  session saved to ' + savedFile);
+            out('now run: /connect ' + savedPhone);
           } else {
             fail('verification failed  ' + JSON.stringify(r));
           }
@@ -2040,7 +2102,7 @@ async function main() {
     }
 
     if (flags.register !== undefined) {
-      const ph   = phone || normalizePhone(pos[0] || '');
+      let   ph   = phone || normalizePhone(pos[0] || '');
       const code = flags.code;
       if (!ph)   { fail('phone number required'); process.exit(1); }
       if (!code) { fail('--code is required');    process.exit(1); }
@@ -2054,9 +2116,16 @@ async function main() {
           const finalStore = r.store || store;
           finalStore.registered  = true;
           finalStore.codePending = false;
-          saveStore(finalStore, file);
-          out('registered  session saved to ' + file);
-          out('run: wa connect ' + ph);
+          const savedPhone = String(finalStore.phoneNumber || ph);
+          const savedFile  = path.join(_sessDir, `${savedPhone}.json`);
+          saveStore(finalStore, savedFile);
+          if (r.canonicalPhoneNumber) {
+            out('note: WhatsApp knows this account as +' + r.canonicalPhoneNumber +
+                ', not +' + r.typedPhoneNumber);
+          }
+          out('registered  session saved to ' + savedFile);
+          out('run: wa connect ' + savedPhone);
+          ph = savedPhone;
         } else {
           out('  status  ' + (r && r.status ? r.status : JSON.stringify(r)));
         }

package/lib/Client.js

@@ -332,7 +332,7 @@ class WhalibmobClient extends EventEmitter {
     socket.on('open',  (sn)  => this._onOpen(sn));
     socket.on('node',  node  => this._onNode(node));
     socket.on('close', ()    => this._onClose());
-    socket.on('error', err   => this.emit('error', err));
+    socket.on('error', err   => this._onSocketError(err));
 
     // Pass reconnect attempt count into the Noise handshake ClientPayload
     this._store.connectAttemptCount = this._reconnectTry;
@@ -478,12 +478,35 @@ class WhalibmobClient extends EventEmitter {
     });
     socket.on('node',  node => this._onNode(node));
     socket.on('close', ()   => this._onClose());
-    socket.on('error', err  => this.emit('error', err));
+    socket.on('error', err  => this._onSocketError(err));
 
     await socket.connect();
     return socket;
   }
 
+  /**
+   * A socket-level error, which includes the server refusing the handshake.
+   *
+   * The refusal arrives here rather than as a <failure> stanza — it happens
+   * before the stream is open, so _handleFailure never sees it and never set
+   * the flag that stops the reconnect. The result was a client that retried a
+   * rejected login every second, forever, printing the same 401 each time.
+   * Anything the handshake marked as a spent session stops the loop here.
+   */
+  _onSocketError(err) {
+    if (err && err.loggedOut) {
+      _whaDbg('[DBG] HANDSHAKE_REJECTED code=' + err.code + ' — not retrying');
+      this._fatal = true;
+      this.emit('auth_failure', {
+        reason: String(err.code || '401'),
+        location: null,
+        loggedOut: true,
+        message: err.message
+      });
+    }
+    this.emit('error', err);
+  }
+
   /**
    * Ask WhatsApp for an 8-character pairing code.
    *
@@ -795,12 +818,85 @@ class WhalibmobClient extends EventEmitter {
     try {
       const res    = await checkIfRegistered(this._store);
       const status = (res && (res.status || res.reason)) || null;
-      return { alive: status === 'ok', status, raw: res };
+
+      // The server answers with the number in its own canonical form. When that
+      // differs from what the session is filed under, the handshake has been
+      // presenting a username no registration matches — which is a 401 with a
+      // completely different remedy from "register again".
+      //
+      // Brazil is where this bites: mobile numbers gained a ninth digit, and
+      // WhatsApp keeps older accounts under the eight-digit form. Type the
+      // number as it appears on the phone and you get a session whose username
+      // the server has never heard of.
+      const canonical = res && res.login ? String(res.login).replace(/\D/g, '') : null;
+      const current   = String(this._store.phoneNumber || '');
+      const mismatch  = !!(canonical && canonical !== current);
+
+      return {
+        alive: status === 'ok',
+        status,
+        canonical,
+        current,
+        mismatch,
+        raw: res
+      };
     } catch (err) {
       return { alive: false, status: null, raw: null, error: err.message };
     }
   }
 
+  /**
+   * Re-file this session under the number the server actually knows it by.
+   *
+   * Renames the session and every file that hangs off it, then reloads. Only
+   * touches the primary (SMS) session — a companion link is keyed by the
+   * account, not by the form of the number.
+   *
+   * @param {string} canonical  the digits the server returned as `login`
+   */
+  async adoptCanonicalNumber(canonical) {
+    canonical = String(canonical || '').replace(/\D/g, '');
+    if (!canonical) throw new Error('adoptCanonicalNumber: no number given');
+    const current = String(this._store && this._store.phoneNumber || '');
+    if (canonical === current) return { renamed: false, phoneNumber: current };
+
+    const wasConnected = this._connected;
+    if (wasConnected) this.disconnect();
+
+    // Every per-session file shares the phone number as its stem.
+    const SUFFIXES = ['.json', '.signal.json', '.sk.json', '.tctoken.json',
+                      '.device-cache.json', '.lid-mapping.json',
+                      '.lid-reverse-mapping.json', '.history.json', '.messages.json'];
+    const moved = [];
+    for (const suffix of SUFFIXES) {
+      const from = path.join(this._sessionDir, current + suffix);
+      const to   = path.join(this._sessionDir, canonical + suffix);
+      if (!fs.existsSync(from)) continue;
+      if (fs.existsSync(to)) {
+        throw new Error('Cannot rename session: ' + canonical + suffix +
+          ' already exists. Move it aside first.');
+      }
+      fs.renameSync(from, to);
+      moved.push(suffix);
+    }
+    if (!moved.length) throw new Error('No session files found for ' + current);
+
+    // The number is inside the store as well as in the filename.
+    const sessionFile = path.join(this._sessionDir, canonical + '.json');
+    const store = loadStore(sessionFile);
+    if (!store) throw new Error('Session file unreadable after rename');
+    store.phoneNumber = canonical;
+    saveStore(store, sessionFile);
+
+    _whaDbg('[DBG] ADOPT_CANONICAL ' + current + ' → ' + canonical +
+      ' files=' + moved.length);
+
+    this._store = store;
+    this._phoneNumber = canonical;
+    this._fatal = false;
+    return { renamed: true, phoneNumber: canonical, files: moved };
+  }
+
   // ─── Reconnection ─────────────────────────────────────────────────────────
 
   _scheduleReconnect() {
@@ -1019,6 +1115,29 @@ class WhalibmobClient extends EventEmitter {
   // We do NOT decrypt the patches — that requires the full LTHASH machinery.
   // We DO update our version counters from the server response so that we
   // never re-request the same snapshot twice.
+  /**
+   * Acknowledge a dirty bit so the server stops announcing it.
+   *
+   * `<ib><dirty type="..."/></ib>` is the server saying something changed while
+   * we were away. Whatever the client does about it, the bit has to be cleared
+   * or the same announcement arrives on every connection.
+   *
+   * @param {string} type            the dirty type, e.g. 'groups'
+   * @param {number|string} [fromTs] the timestamp the announcement carried
+   */
+  _cleanDirtyBits(type, fromTs) {
+    if (!this._socket || !this._connected) return;
+    const attrs = { type: String(type) };
+    if (fromTs) attrs.timestamp = String(fromTs);
+    _whaDbg('[DBG] CLEAN_DIRTY type=' + type + (fromTs ? ' t=' + fromTs : ''));
+    this._socket.sendNode(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'set',
+      xmlns: 'urn:xmpp:whatsapp:dirty'
+    }, [new BinaryNode('clean', attrs, null)]));
+  }
+
   _sendAppStateSyncForTypes(dirtyTypes) {
     if (!this._socket || !this._connected) return;
 
@@ -1037,7 +1156,11 @@ class WhalibmobClient extends EventEmitter {
     for (const type of dirtyTypes) {
       const mapped = COLLECTION_MAP[type];
       if (!mapped) {
-        _whaDbg('[DBG] ignoring unknown dirty type: ' + type);
+        // "groups" is not an app-state collection, but it is still a dirty bit
+        // the server expects to be cleared. Ignoring it meant the server
+        // re-announced it on every single connection, forever.
+        _whaDbg('[DBG] DIRTY type=' + type + ' — not an app-state collection, clearing the bit');
+        this._cleanDirtyBits(type);
         continue;
       }
       for (const c of mapped) collections.add(c);
@@ -1134,18 +1257,31 @@ class WhalibmobClient extends EventEmitter {
       try { _whaDbg('[DBG] IQ_ERROR content=' + JSON.stringify(node.content)); } catch(_) {}
     }
 
-    if      (tag === 'iq')           this._handleIq(node);
-    else if (tag === 'message')      this._handleMessage(node);
-    else if (tag === 'receipt')      this._handleReceipt(node);
-    else if (tag === 'ack')          this._handleAck(node);
-    else if (tag === 'notification') this._handleNotification(node);
-    else if (tag === 'presence')     this._handlePresence(node);
-    else if (tag === 'call')         this._handleCall(node);
-    else if (tag === 'ib')           this._handleIb(node);
-    else if (tag === 'success')      this.emit('session_refresh', { node }); // late success (re-auth)
-    else if (tag === 'failure')      this._handleFailure(node);
-    else if (tag === 'stream:error') this._handleStreamError(node);
-    else                             this.emit('node', node);
+    // One malformed stanza must not take the connection down with it.
+    //
+    // A throw here propagates out through the socket's frame reader, which
+    // reports it as a socket error — so a single unhandled shape in one
+    // notification looked like the transport failing, and every stanza queued
+    // behind it in the same offline batch was lost. Contain it: log the stanza
+    // that did it, tell the caller, carry on reading.
+    try {
+      if      (tag === 'iq')           this._handleIq(node);
+      else if (tag === 'message')      this._handleMessage(node);
+      else if (tag === 'receipt')      this._handleReceipt(node);
+      else if (tag === 'ack')          this._handleAck(node);
+      else if (tag === 'notification') this._handleNotification(node);
+      else if (tag === 'presence')     this._handlePresence(node);
+      else if (tag === 'call')         this._handleCall(node);
+      else if (tag === 'ib')           this._handleIb(node);
+      else if (tag === 'success')      this.emit('session_refresh', { node }); // late success (re-auth)
+      else if (tag === 'failure')      this._handleFailure(node);
+      else if (tag === 'stream:error') this._handleStreamError(node);
+      else                             this.emit('node', node);
+    } catch (err) {
+      _whaDbg('[DBG] NODE_HANDLER_ERR tag=' + tag + ' err=' + (err && err.message) +
+        ' attrs=' + JSON.stringify(node.attrs || {}));
+      this.emit('node_error', { tag, node, err });
+    }
   }
 
   // A stream error ends the connection; the reconnect in _onClose picks it up.
@@ -1157,16 +1293,55 @@ class WhalibmobClient extends EventEmitter {
   _handleStreamError(node) {
     const attrs  = (node && node.attrs) || {};
     const code   = attrs.code ? String(attrs.code) : null;
-    const reason = attrs.reason || code || 'unknown';
 
     if (code === '515') {
       _whaDbg('[DBG] STREAM_ERROR 515 — restart required after pairing, reconnecting');
-      this.emit('restart_required', { reason });
+      this.emit('restart_required', { reason: '515' });
+      return;
+    }
+
+    // Most stream errors carry no code at all — the reason is a child element,
+    // and for <conflict> the type attribute on it says which kind. Reading only
+    // the attributes reported every one of these as "code=null reason=unknown",
+    // which is the same message for a session someone else took over and a
+    // session that was deleted.
+    const child       = Array.isArray(node.content) && node.content[0] ? node.content[0] : null;
+    const childTag    = child && child.description ? child.description : null;
+    const conflictType = childTag === 'conflict' && child.attrs
+      ? String(child.attrs.type || '') : null;
+
+    if (conflictType === 'replaced') {
+      // Another client opened a session for this account and the server handed
+      // it over. Reconnecting immediately just takes it back, and the two ends
+      // trade the session until one of them is stopped — so this one stands
+      // down and says why.
+      _whaDbg('[DBG] STREAM_ERROR conflict/replaced — another client took the session');
+      this._fatal = true;
+      this.emit('connection_replaced', {
+        message: 'Another client connected with this number and took over the ' +
+                 'session. Reconnecting would take it back and the two would ' +
+                 'keep displacing each other, so this connection has stopped. ' +
+                 'Close the other client, then connect again.'
+      });
+      this.disconnect();
+      return;
+    }
+
+    if (conflictType === 'device_removed') {
+      // The companion was unlinked from the phone. Same meaning as a 401.
+      _whaDbg('[DBG] STREAM_ERROR conflict/device_removed — unlinked');
+      this._fatal = true;
+      this.emit('auth_failure', {
+        reason: '401', location: null, loggedOut: true, node
+      });
+      this.disconnect();
       return;
     }
 
-    _whaDbg('[DBG] STREAM_ERROR code=' + code + ' reason=' + reason);
-    this.emit('stream_error', { reason, code });
+    const reason = attrs.reason || conflictType || childTag || code || 'unknown';
+    _whaDbg('[DBG] STREAM_ERROR code=' + code + ' child=' + childTag +
+      ' conflict=' + conflictType + ' reason=' + reason);
+    this.emit('stream_error', { reason, code, conflictType, childTag, node });
   }
 
   // ─── IQ handling ──────────────────────────────────────────────────────────
@@ -1956,7 +2131,13 @@ class WhalibmobClient extends EventEmitter {
       // Server push: a contact's linked device list changed (they linked or
       // unlinked a tablet, desktop, etc.).  Invalidate that phone's cache entry
       // so the next send triggers a fresh usync IQ and reaches all their devices.
-      const fromJid   = attrs.from || '';
+      // BinaryNode decodes an AD-encoded JID into an object, not a string, so
+      // this has to be stringified before it can be split. It was not, and a
+      // <notification type="devices"> from a LID-addressed contact threw
+      // "fromJid.split is not a function" out of the node handler — taking the
+      // whole dispatch down with it, so every notification behind it in the
+      // offline queue was dropped too.
+      const fromJid   = String(attrs.from || '');
       const fromPhone = fromJid.split('@')[0].split(':')[0];
       if (fromPhone && this._devMgr) {
         this._devMgr._dcDel([fromPhone]);
@@ -1980,7 +2161,7 @@ class WhalibmobClient extends EventEmitter {
       // Server push: a contact re-registered WhatsApp (new identity key / new phone).
       // Their old Signal sessions are no longer valid — clear them and the device
       // cache so the next send builds a fresh pkmsg session from scratch.
-      const fromJid   = attrs.from || '';
+      const fromJid   = String(attrs.from || '');
       const fromPhone = fromJid.split('@')[0].split(':')[0];
       if (fromPhone && this._devMgr) {
         this._devMgr._dcDel([fromPhone]);

package/lib/Registration.js

@@ -912,7 +912,23 @@ async function verifyCode(store, code) {
   const result = await sendRequest('/register', store, waVersion, true, ['code', normalized]);
 
   const status = result.status;
-  if (status === 'ok' || status === 'sent' || status === 'verified') return result;
+  if (status === 'ok' || status === 'sent' || status === 'verified') {
+    // Adopt the number in the server's own form.
+    //
+    // WhatsApp answers with `login`, the canonical digits it filed the account
+    // under, and that is not always what was typed. Brazilian mobiles are the
+    // standing example: they gained a ninth digit, WhatsApp keeps the account
+    // under the eight-digit form, and a session saved under the typed number
+    // sends a username on every connection that matches no registration. The
+    // handshake then fails with 401 and nothing in the message hints at why.
+    const canonical = result.login ? String(result.login).replace(/\D/g, '') : null;
+    if (canonical && canonical !== String(store.phoneNumber)) {
+      result.canonicalPhoneNumber = canonical;
+      result.typedPhoneNumber     = String(store.phoneNumber);
+      store.phoneNumber           = canonical;
+    }
+    return result;
+  }
 
   const reason = result.reason || '';
   if (reason === 'missing') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.6.8",
+  "version": "5.7.0",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",