whalibmob 5.6.9 → 5.7.1

package/README.md

@@ -150,6 +150,7 @@ npm install -g whalibmob
     - [Handling Reconnects](#handling-reconnects)
     - [Knowing Which Mode You Are In](#knowing-which-mode-you-are-in)
     - [Two Sessions on One Number](#two-sessions-on-one-number)
+  - [The Number WhatsApp Files Your Account Under](#the-number-whatsapp-files-your-account-under)
   - [Routing Registration Through a Proxy](#routing-registration-through-a-proxy)
   - [Saving & Restoring Sessions](#saving--restoring-sessions)
   - [Signal Store Utilities](#signal-store-utilities)
@@ -807,6 +808,53 @@ await client.connectWeb(PHONE)  // web / companion, over WebSocket
 
 Use two `WhalibmobClient` instances if you want both at once.
 
+## The Number WhatsApp Files Your Account Under
+
+WhatsApp does not always keep an account under the number you type. Brazilian mobiles are the standing example: they gained a ninth digit, and WhatsApp keeps older accounts under the eight-digit form. `5596976042705` and `559676042705` are the same account, but only the second is the one the server recognises.
+
+This matters because the number in your session is sent as the username on every connection. Get the form wrong and the server has no registration matching it, so the login is refused with `401` — a code that says "logged out" and gives no hint that the number was the problem.
+
+whalibmob handles this on its own, in both directions:
+
+**When you register**, the canonical form is read from the server's reply and the session is saved under it. Numbers registered through whalibmob cannot end up in this state.
+
+**When you connect** an older session that is in this state, the first login is refused, whalibmob asks the server which form it uses, re-files the session, and connects. You see one line:
+
+```
+connecting to +5596976042705...
+  this account is registered as +559676042705 (not +5596976042705) — session updated
+connected as +559676042705
+```
+
+The rename keeps the registration and the Signal keys — it moves the session files, it does not re-register anything.
+
+```js
+client.on('number_corrected', ({ from, to }) => {
+  console.log('session re-filed:', from, '→', to)
+})
+```
+
+To be told rather than fixed:
+
+```js
+const client = new WhalibmobClient({ sessionDir, autoFixNumber: false })
+```
+
+Then the `401` is thrown as-is, and `checkSessionAlive()` tells you what the server calls the account:
+
+```js
+const probe = await client.checkSessionAlive()
+// { alive: true, status: 'ok', current: '5596976042705',
+//   canonical: '559676042705', mismatch: true }
+
+if (probe.mismatch) {
+  await client.adoptCanonicalNumber(probe.canonical)
+}
+```
+
+> [!NOTE]
+> The check costs nothing when things work — it runs only after a login has already been refused.
+
 ## Routing Registration Through a Proxy
 
 Registration is the part of the protocol most likely to be refused from a datacenter IP. If you are seeing security blocks or an undeterminable number status, route it through a SOCKS proxy — Tor, or a residential provider.

package/cli.js

@@ -316,6 +316,9 @@ function ts() {
 let _client  = null;
 let _phone   = null;
 let _sessDir = defaultSessionDir();
+// Set when a failed connect turned out to be a number-form mismatch, so
+// /fixnumber knows what it is fixing without probing the server again.
+let _pendingFix = null;
 let _rl      = null;
 
 // ─── shell help ───────────────────────────────────────────────────────────────
@@ -438,6 +441,7 @@ const HELP = `
   Connection
     /connect    <phone> [sms|pair]           connect to WhatsApp (asks which if unset)
     /pair       <phone> [code]               link to an existing account by 8-digit code
+    /fixnumber                               re-file a session under the number WhatsApp uses
     /disconnect                              disconnect
     /reconnect                              force reconnection
     /session                                show session info
@@ -743,6 +747,14 @@ async function doConnect(phone) {
   const client = new WhalibmobClient({ sessionDir: _sessDir });
   attachEvents(client);
 
+  // The session may be re-filed mid-connect when WhatsApp turns out to keep the
+  // account under a different form of the number. Everything from here on has
+  // to use the corrected one, including the prompt.
+  client.on('number_corrected', ({ from, to }) => {
+    phone = to;
+    out('  this account is registered as +' + to + ' (not +' + from + ') — session updated');
+  });
+
   client.once('connected', () => {
     _client = client;
     _phone  = phone;
@@ -777,7 +789,20 @@ async function doConnect(phone) {
       out('  checking whether the number is still registered...');
       try {
         const probe = await client.checkSessionAlive();
-        if (probe.alive) {
+
+        if (probe.mismatch) {
+          // Reached only when the automatic correction inside init() could not
+          // run — a session already exists under the canonical number, or the
+          // rename failed. Say what it would have done.
+          hr();
+          out('  the session is filed under a number WhatsApp does not use');
+          out('    session : +' + probe.current);
+          out('    server  : +' + probe.canonical);
+          hr();
+          out('  this is normally corrected automatically; it could not be here.');
+          out('  check whether a session for +' + probe.canonical + ' already exists,');
+          out('  then:  /fixnumber');
+        } else if (probe.alive) {
           out('  the number IS still registered, but this device was logged out.');
           out('  register it again:  /reg code ' + phone);
         } else if (probe.error) {
@@ -786,6 +811,8 @@ async function doConnect(phone) {
           out('  the registration is gone server-side (' + (probe.status || 'no status') + ').');
           out('  register it again:  /reg code ' + phone);
         }
+        // keep the client around so /fixnumber has a store to work from
+        _pendingFix = probe.mismatch ? { client, probe } : null;
       } catch (probeErr) {
         out('  status check failed: ' + probeErr.message);
       }
@@ -878,6 +905,21 @@ async function handleLine(line) {
         break;
       }
 
+      case '/fixnumber': {
+        if (!_pendingFix) {
+          fail('nothing to fix — run /connect <phone> first and let it report a mismatch');
+          break;
+        }
+        const { client, probe } = _pendingFix;
+        out('renaming session +' + probe.current + ' → +' + probe.canonical + '...');
+        const r = await client.adoptCanonicalNumber(probe.canonical);
+        out('  moved ' + r.files.length + ' file(s)');
+        _pendingFix = null;
+        out('now connect with the number WhatsApp uses:');
+        out('  /connect ' + r.phoneNumber);
+        break;
+      }
+
       case '/pair': {
         const ph = p[1] || _phone;
         if (!ph) {
@@ -1682,9 +1724,18 @@ async function handleLine(line) {
             const finalStore = r.store || store;
             finalStore.registered  = true;
             finalStore.codePending = false;
-            saveStore(finalStore, file);
-            out('registered  session saved to ' + file);
-            out('now run: /connect ' + ph);
+            // Save under the number WhatsApp filed the account as, not the one
+            // that was typed — they differ often enough to matter.
+            const savedPhone = String(finalStore.phoneNumber || ph);
+            const savedFile  = path.join(_sessDir, `${savedPhone}.json`);
+            saveStore(finalStore, savedFile);
+            if (r.canonicalPhoneNumber) {
+              out('note: WhatsApp knows this account as +' + r.canonicalPhoneNumber +
+                  ', not +' + r.typedPhoneNumber);
+              out('      the session is saved under that number');
+            }
+            out('registered  session saved to ' + savedFile);
+            out('now run: /connect ' + savedPhone);
           } else {
             fail('verification failed  ' + JSON.stringify(r));
           }
@@ -2057,7 +2108,7 @@ async function main() {
     }
 
     if (flags.register !== undefined) {
-      const ph   = phone || normalizePhone(pos[0] || '');
+      let   ph   = phone || normalizePhone(pos[0] || '');
       const code = flags.code;
       if (!ph)   { fail('phone number required'); process.exit(1); }
       if (!code) { fail('--code is required');    process.exit(1); }
@@ -2071,9 +2122,16 @@ async function main() {
           const finalStore = r.store || store;
           finalStore.registered  = true;
           finalStore.codePending = false;
-          saveStore(finalStore, file);
-          out('registered  session saved to ' + file);
-          out('run: wa connect ' + ph);
+          const savedPhone = String(finalStore.phoneNumber || ph);
+          const savedFile  = path.join(_sessDir, `${savedPhone}.json`);
+          saveStore(finalStore, savedFile);
+          if (r.canonicalPhoneNumber) {
+            out('note: WhatsApp knows this account as +' + r.canonicalPhoneNumber +
+                ', not +' + r.typedPhoneNumber);
+          }
+          out('registered  session saved to ' + savedFile);
+          out('run: wa connect ' + savedPhone);
+          ph = savedPhone;
         } else {
           out('  status  ' + (r && r.status ? r.status : JSON.stringify(r)));
         }

package/lib/Client.js

@@ -203,6 +203,11 @@ class WhalibmobClient extends EventEmitter {
     // client the server will not accept. Suppresses the reconnect loop.
     this._fatal          = false;
     this._closing        = false;
+    // A session whose number is not in WhatsApp's canonical form is re-filed
+    // automatically on the first refused login. Set { autoFixNumber: false } to
+    // be told about it instead.
+    this._autoFixNumber  = opts.autoFixNumber !== false;
+    this._numberFixAttempted = false;
     this._pingTimer               = null;
     this._keepTimer               = null;
     this._connected     = false;
@@ -316,10 +321,83 @@ class WhalibmobClient extends EventEmitter {
     }
     _whaDbg('[DBG] LID_RESTORED count=' + Object.keys(persistedLid).length);
 
-    await this._connectSocket();
+    try {
+      await this._connectSocket();
+    } catch (err) {
+      // A session filed under a number WhatsApp does not use fails here and
+      // only here, with a 401 that says nothing about the number. Since we can
+      // ask the server which form it uses, there is no reason to make anyone
+      // find that out by hand.
+      const fixed = await this._tryCorrectPhoneNumber(err);
+      if (!fixed) throw err;
+      return this.init(fixed);
+    }
     return this;
   }
 
+  /**
+   * Last resort before reporting a refused login: check whether the session is
+   * simply filed under the wrong form of the number, and re-file it if so.
+   *
+   * Returns the corrected number when it did something, null otherwise. Only
+   * ever runs once per client — a second 401 after a rename is a real one.
+   */
+  async _tryCorrectPhoneNumber(err) {
+    if (this._autoFixNumber === false) return null;
+    if (this._numberFixAttempted) return null;
+    if (!err || !err.loggedOut || String(err.code) !== '401') return null;
+    this._numberFixAttempted = true;
+
+    let probe;
+    try {
+      probe = await this.checkSessionAlive();
+    } catch (_) {
+      return null;
+    }
+    if (!probe || !probe.mismatch || !probe.canonical) return null;
+
+    _whaDbg('[DBG] AUTO_FIX_NUMBER ' + probe.current + ' → ' + probe.canonical);
+
+    // Let go of the session files before moving them. The Signal store writes
+    // on a debounce, so a pending write would recreate the old file moments
+    // after the rename and leave two half-sessions on disk.
+    this._releaseSessionFiles();
+
+    try {
+      await this.adoptCanonicalNumber(probe.canonical);
+    } catch (renameErr) {
+      _whaDbg('[DBG] AUTO_FIX_NUMBER failed: ' + renameErr.message);
+      return null;
+    }
+
+    this.emit('number_corrected', {
+      from: probe.current,
+      to:   probe.canonical,
+      reason: 'WhatsApp files this account under a different form of the number'
+    });
+    return probe.canonical;
+  }
+
+  // Flush and detach whatever is holding the current session's files open, so
+  // they can be renamed without a queued write putting one of them back.
+  _releaseSessionFiles() {
+    for (const store of [this._signal && this._signal.store,
+                         this._signal && this._signal.senderKeyStore]) {
+      if (!store) continue;
+      try {
+        if (typeof store.detach === 'function') store.detach();
+        else {
+          if (typeof store._flushSync === 'function') store._flushSync();
+          if (store._saveTimer) { clearTimeout(store._saveTimer); store._saveTimer = null; }
+          store._filePath = null;
+        }
+      } catch (_) {}
+    }
+    this._signal       = null;
+    this._devMgr       = null;
+    this._tcTokenStore = null;
+  }
+
   async _connectSocket() {
     if (this._mode === 'web') return this._connectWebSocket();
 
@@ -332,7 +410,7 @@ class WhalibmobClient extends EventEmitter {
     socket.on('open',  (sn)  => this._onOpen(sn));
     socket.on('node',  node  => this._onNode(node));
     socket.on('close', ()    => this._onClose());
-    socket.on('error', err   => this.emit('error', err));
+    socket.on('error', err   => this._onSocketError(err));
 
     // Pass reconnect attempt count into the Noise handshake ClientPayload
     this._store.connectAttemptCount = this._reconnectTry;
@@ -478,12 +556,35 @@ class WhalibmobClient extends EventEmitter {
     });
     socket.on('node',  node => this._onNode(node));
     socket.on('close', ()   => this._onClose());
-    socket.on('error', err  => this.emit('error', err));
+    socket.on('error', err  => this._onSocketError(err));
 
     await socket.connect();
     return socket;
   }
 
+  /**
+   * A socket-level error, which includes the server refusing the handshake.
+   *
+   * The refusal arrives here rather than as a <failure> stanza — it happens
+   * before the stream is open, so _handleFailure never sees it and never set
+   * the flag that stops the reconnect. The result was a client that retried a
+   * rejected login every second, forever, printing the same 401 each time.
+   * Anything the handshake marked as a spent session stops the loop here.
+   */
+  _onSocketError(err) {
+    if (err && err.loggedOut) {
+      _whaDbg('[DBG] HANDSHAKE_REJECTED code=' + err.code + ' — not retrying');
+      this._fatal = true;
+      this.emit('auth_failure', {
+        reason: String(err.code || '401'),
+        location: null,
+        loggedOut: true,
+        message: err.message
+      });
+    }
+    this.emit('error', err);
+  }
+
   /**
    * Ask WhatsApp for an 8-character pairing code.
    *
@@ -795,12 +896,85 @@ class WhalibmobClient extends EventEmitter {
     try {
       const res    = await checkIfRegistered(this._store);
       const status = (res && (res.status || res.reason)) || null;
-      return { alive: status === 'ok', status, raw: res };
+
+      // The server answers with the number in its own canonical form. When that
+      // differs from what the session is filed under, the handshake has been
+      // presenting a username no registration matches — which is a 401 with a
+      // completely different remedy from "register again".
+      //
+      // Brazil is where this bites: mobile numbers gained a ninth digit, and
+      // WhatsApp keeps older accounts under the eight-digit form. Type the
+      // number as it appears on the phone and you get a session whose username
+      // the server has never heard of.
+      const canonical = res && res.login ? String(res.login).replace(/\D/g, '') : null;
+      const current   = String(this._store.phoneNumber || '');
+      const mismatch  = !!(canonical && canonical !== current);
+
+      return {
+        alive: status === 'ok',
+        status,
+        canonical,
+        current,
+        mismatch,
+        raw: res
+      };
     } catch (err) {
       return { alive: false, status: null, raw: null, error: err.message };
     }
   }
 
+  /**
+   * Re-file this session under the number the server actually knows it by.
+   *
+   * Renames the session and every file that hangs off it, then reloads. Only
+   * touches the primary (SMS) session — a companion link is keyed by the
+   * account, not by the form of the number.
+   *
+   * @param {string} canonical  the digits the server returned as `login`
+   */
+  async adoptCanonicalNumber(canonical) {
+    canonical = String(canonical || '').replace(/\D/g, '');
+    if (!canonical) throw new Error('adoptCanonicalNumber: no number given');
+    const current = String(this._store && this._store.phoneNumber || '');
+    if (canonical === current) return { renamed: false, phoneNumber: current };
+
+    const wasConnected = this._connected;
+    if (wasConnected) this.disconnect();
+
+    // Every per-session file shares the phone number as its stem.
+    const SUFFIXES = ['.json', '.signal.json', '.sk.json', '.tctoken.json',
+                      '.device-cache.json', '.lid-mapping.json',
+                      '.lid-reverse-mapping.json', '.history.json', '.messages.json'];
+    const moved = [];
+    for (const suffix of SUFFIXES) {
+      const from = path.join(this._sessionDir, current + suffix);
+      const to   = path.join(this._sessionDir, canonical + suffix);
+      if (!fs.existsSync(from)) continue;
+      if (fs.existsSync(to)) {
+        throw new Error('Cannot rename session: ' + canonical + suffix +
+          ' already exists. Move it aside first.');
+      }
+      fs.renameSync(from, to);
+      moved.push(suffix);
+    }
+    if (!moved.length) throw new Error('No session files found for ' + current);
+
+    // The number is inside the store as well as in the filename.
+    const sessionFile = path.join(this._sessionDir, canonical + '.json');
+    const store = loadStore(sessionFile);
+    if (!store) throw new Error('Session file unreadable after rename');
+    store.phoneNumber = canonical;
+    saveStore(store, sessionFile);
+
+    _whaDbg('[DBG] ADOPT_CANONICAL ' + current + ' → ' + canonical +
+      ' files=' + moved.length);
+
+    this._store = store;
+    this._phoneNumber = canonical;
+    this._fatal = false;
+    return { renamed: true, phoneNumber: canonical, files: moved };
+  }
+
   // ─── Reconnection ─────────────────────────────────────────────────────────
 
   _scheduleReconnect() {

package/lib/Registration.js

@@ -912,7 +912,23 @@ async function verifyCode(store, code) {
   const result = await sendRequest('/register', store, waVersion, true, ['code', normalized]);
 
   const status = result.status;
-  if (status === 'ok' || status === 'sent' || status === 'verified') return result;
+  if (status === 'ok' || status === 'sent' || status === 'verified') {
+    // Adopt the number in the server's own form.
+    //
+    // WhatsApp answers with `login`, the canonical digits it filed the account
+    // under, and that is not always what was typed. Brazilian mobiles are the
+    // standing example: they gained a ninth digit, WhatsApp keeps the account
+    // under the eight-digit form, and a session saved under the typed number
+    // sends a username on every connection that matches no registration. The
+    // handshake then fails with 401 and nothing in the message hints at why.
+    const canonical = result.login ? String(result.login).replace(/\D/g, '') : null;
+    if (canonical && canonical !== String(store.phoneNumber)) {
+      result.canonicalPhoneNumber = canonical;
+      result.typedPhoneNumber     = String(store.phoneNumber);
+      store.phoneNumber           = canonical;
+    }
+    return result;
+  }
 
   const reason = result.reason || '';
   if (reason === 'missing') {

package/lib/signal/SenderKey.js

@@ -93,10 +93,26 @@ class SenderKeyStore {
     this._dirty     = false;
     this._saveTimer = null;
 
-    const flush = () => this._flushSync();
-    process.once('exit',    flush);
-    process.once('SIGTERM', () => { flush(); process.exit(0); });
-    process.once('SIGINT',  () => { flush(); process.exit(0); });
+    // Detachable, for the same reason as in SignalStore: a replaced store must
+    // not keep three process listeners alive for the rest of the run.
+    this._onExit    = () => this._flushSync();
+    this._onSigTerm = () => { this._flushSync(); process.exit(0); };
+    this._onSigInt  = () => { this._flushSync(); process.exit(0); };
+    process.once('exit',    this._onExit);
+    process.once('SIGTERM', this._onSigTerm);
+    process.once('SIGINT',  this._onSigInt);
+  }
+
+  /** Flush, stop writing, and stop holding the process open. */
+  detach() {
+    this._flushSync();
+    if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    try {
+      process.removeListener('exit',    this._onExit);
+      process.removeListener('SIGTERM', this._onSigTerm);
+      process.removeListener('SIGINT',  this._onSigInt);
+    } catch (_) {}
+    this._filePath = null;
   }
 
   attachFile(filePath) {

package/lib/signal/SignalStore.js

@@ -36,11 +36,30 @@ class SignalStore {
     this._dirty            = false;
     this._saveTimer        = null;
 
-    // Flush synchronously on exit so no state is ever lost
-    const flush = () => this._flushSync();
-    process.once('exit',    flush);
-    process.once('SIGTERM', () => { flush(); process.exit(0); });
-    process.once('SIGINT',  () => { flush(); process.exit(0); });
+    // Flush synchronously on exit so no state is ever lost.
+    //
+    // Kept as references so they can be taken off again: a store that has been
+    // replaced — when a session is re-filed under a different number, say —
+    // would otherwise stay reachable from process forever, and every store ever
+    // built would add three more listeners.
+    this._onExit    = () => this._flushSync();
+    this._onSigTerm = () => { this._flushSync(); process.exit(0); };
+    this._onSigInt  = () => { this._flushSync(); process.exit(0); };
+    process.once('exit',    this._onExit);
+    process.once('SIGTERM', this._onSigTerm);
+    process.once('SIGINT',  this._onSigInt);
+  }
+
+  /** Flush, stop writing, and stop holding the process open. */
+  detach() {
+    this._flushSync();
+    if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    try {
+      process.removeListener('exit',    this._onExit);
+      process.removeListener('SIGTERM', this._onSigTerm);
+      process.removeListener('SIGINT',  this._onSigInt);
+    } catch (_) {}
+    this._filePath = null;
   }
 
   init(identityKeyPair, registrationId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.6.9",
+  "version": "5.7.1",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",