whalibmob 5.7.0 → 5.7.1

package/README.md

@@ -150,6 +150,7 @@ npm install -g whalibmob
     - [Handling Reconnects](#handling-reconnects)
     - [Knowing Which Mode You Are In](#knowing-which-mode-you-are-in)
     - [Two Sessions on One Number](#two-sessions-on-one-number)
+  - [The Number WhatsApp Files Your Account Under](#the-number-whatsapp-files-your-account-under)
   - [Routing Registration Through a Proxy](#routing-registration-through-a-proxy)
   - [Saving & Restoring Sessions](#saving--restoring-sessions)
   - [Signal Store Utilities](#signal-store-utilities)
@@ -807,6 +808,53 @@ await client.connectWeb(PHONE)  // web / companion, over WebSocket
 
 Use two `WhalibmobClient` instances if you want both at once.
 
+## The Number WhatsApp Files Your Account Under
+
+WhatsApp does not always keep an account under the number you type. Brazilian mobiles are the standing example: they gained a ninth digit, and WhatsApp keeps older accounts under the eight-digit form. `5596976042705` and `559676042705` are the same account, but only the second is the one the server recognises.
+
+This matters because the number in your session is sent as the username on every connection. Get the form wrong and the server has no registration matching it, so the login is refused with `401` — a code that says "logged out" and gives no hint that the number was the problem.
+
+whalibmob handles this on its own, in both directions:
+
+**When you register**, the canonical form is read from the server's reply and the session is saved under it. Numbers registered through whalibmob cannot end up in this state.
+
+**When you connect** an older session that is in this state, the first login is refused, whalibmob asks the server which form it uses, re-files the session, and connects. You see one line:
+
+```
+connecting to +5596976042705...
+  this account is registered as +559676042705 (not +5596976042705) — session updated
+connected as +559676042705
+```
+
+The rename keeps the registration and the Signal keys — it moves the session files, it does not re-register anything.
+
+```js
+client.on('number_corrected', ({ from, to }) => {
+  console.log('session re-filed:', from, '→', to)
+})
+```
+
+To be told rather than fixed:
+
+```js
+const client = new WhalibmobClient({ sessionDir, autoFixNumber: false })
+```
+
+Then the `401` is thrown as-is, and `checkSessionAlive()` tells you what the server calls the account:
+
+```js
+const probe = await client.checkSessionAlive()
+// { alive: true, status: 'ok', current: '5596976042705',
+//   canonical: '559676042705', mismatch: true }
+
+if (probe.mismatch) {
+  await client.adoptCanonicalNumber(probe.canonical)
+}
+```
+
+> [!NOTE]
+> The check costs nothing when things work — it runs only after a login has already been refused.
+
 ## Routing Registration Through a Proxy
 
 Registration is the part of the protocol most likely to be refused from a datacenter IP. If you are seeing security blocks or an undeterminable number status, route it through a SOCKS proxy — Tor, or a residential provider.

package/cli.js

@@ -747,6 +747,14 @@ async function doConnect(phone) {
   const client = new WhalibmobClient({ sessionDir: _sessDir });
   attachEvents(client);
 
+  // The session may be re-filed mid-connect when WhatsApp turns out to keep the
+  // account under a different form of the number. Everything from here on has
+  // to use the corrected one, including the prompt.
+  client.on('number_corrected', ({ from, to }) => {
+    phone = to;
+    out('  this account is registered as +' + to + ' (not +' + from + ') — session updated');
+  });
+
   client.once('connected', () => {
     _client = client;
     _phone  = phone;
@@ -783,19 +791,17 @@ async function doConnect(phone) {
         const probe = await client.checkSessionAlive();
 
         if (probe.mismatch) {
-          // The session is filed under a number the server does not use for
-          // this account, so the handshake has been sending a username no
-          // registration matches. Renaming fixes it; re-registering would not.
+          // Reached only when the automatic correction inside init() could not
+          // run — a session already exists under the canonical number, or the
+          // rename failed. Say what it would have done.
           hr();
           out('  the session is filed under a number WhatsApp does not use');
           out('    session : +' + probe.current);
           out('    server  : +' + probe.canonical);
           hr();
-          out('  WhatsApp knows this account by the second form, so every login');
-          out('  has been sent under a number it has no registration for.');
-          out('');
-          out('  fix it in place:  /fixnumber');
-          out('  (renames the session files, keeps the registration)');
+          out('  this is normally corrected automatically; it could not be here.');
+          out('  check whether a session for +' + probe.canonical + ' already exists,');
+          out('  then:  /fixnumber');
         } else if (probe.alive) {
           out('  the number IS still registered, but this device was logged out.');
           out('  register it again:  /reg code ' + phone);

package/lib/Client.js

@@ -203,6 +203,11 @@ class WhalibmobClient extends EventEmitter {
     // client the server will not accept. Suppresses the reconnect loop.
     this._fatal          = false;
     this._closing        = false;
+    // A session whose number is not in WhatsApp's canonical form is re-filed
+    // automatically on the first refused login. Set { autoFixNumber: false } to
+    // be told about it instead.
+    this._autoFixNumber  = opts.autoFixNumber !== false;
+    this._numberFixAttempted = false;
     this._pingTimer               = null;
     this._keepTimer               = null;
     this._connected     = false;
@@ -316,10 +321,83 @@ class WhalibmobClient extends EventEmitter {
     }
     _whaDbg('[DBG] LID_RESTORED count=' + Object.keys(persistedLid).length);
 
-    await this._connectSocket();
+    try {
+      await this._connectSocket();
+    } catch (err) {
+      // A session filed under a number WhatsApp does not use fails here and
+      // only here, with a 401 that says nothing about the number. Since we can
+      // ask the server which form it uses, there is no reason to make anyone
+      // find that out by hand.
+      const fixed = await this._tryCorrectPhoneNumber(err);
+      if (!fixed) throw err;
+      return this.init(fixed);
+    }
     return this;
   }
 
+  /**
+   * Last resort before reporting a refused login: check whether the session is
+   * simply filed under the wrong form of the number, and re-file it if so.
+   *
+   * Returns the corrected number when it did something, null otherwise. Only
+   * ever runs once per client — a second 401 after a rename is a real one.
+   */
+  async _tryCorrectPhoneNumber(err) {
+    if (this._autoFixNumber === false) return null;
+    if (this._numberFixAttempted) return null;
+    if (!err || !err.loggedOut || String(err.code) !== '401') return null;
+    this._numberFixAttempted = true;
+
+    let probe;
+    try {
+      probe = await this.checkSessionAlive();
+    } catch (_) {
+      return null;
+    }
+    if (!probe || !probe.mismatch || !probe.canonical) return null;
+
+    _whaDbg('[DBG] AUTO_FIX_NUMBER ' + probe.current + ' → ' + probe.canonical);
+
+    // Let go of the session files before moving them. The Signal store writes
+    // on a debounce, so a pending write would recreate the old file moments
+    // after the rename and leave two half-sessions on disk.
+    this._releaseSessionFiles();
+
+    try {
+      await this.adoptCanonicalNumber(probe.canonical);
+    } catch (renameErr) {
+      _whaDbg('[DBG] AUTO_FIX_NUMBER failed: ' + renameErr.message);
+      return null;
+    }
+
+    this.emit('number_corrected', {
+      from: probe.current,
+      to:   probe.canonical,
+      reason: 'WhatsApp files this account under a different form of the number'
+    });
+    return probe.canonical;
+  }
+
+  // Flush and detach whatever is holding the current session's files open, so
+  // they can be renamed without a queued write putting one of them back.
+  _releaseSessionFiles() {
+    for (const store of [this._signal && this._signal.store,
+                         this._signal && this._signal.senderKeyStore]) {
+      if (!store) continue;
+      try {
+        if (typeof store.detach === 'function') store.detach();
+        else {
+          if (typeof store._flushSync === 'function') store._flushSync();
+          if (store._saveTimer) { clearTimeout(store._saveTimer); store._saveTimer = null; }
+          store._filePath = null;
+        }
+      } catch (_) {}
+    }
+    this._signal       = null;
+    this._devMgr       = null;
+    this._tcTokenStore = null;
+  }
+
   async _connectSocket() {
     if (this._mode === 'web') return this._connectWebSocket();
 

package/lib/signal/SenderKey.js

@@ -93,10 +93,26 @@ class SenderKeyStore {
     this._dirty     = false;
     this._saveTimer = null;
 
-    const flush = () => this._flushSync();
-    process.once('exit',    flush);
-    process.once('SIGTERM', () => { flush(); process.exit(0); });
-    process.once('SIGINT',  () => { flush(); process.exit(0); });
+    // Detachable, for the same reason as in SignalStore: a replaced store must
+    // not keep three process listeners alive for the rest of the run.
+    this._onExit    = () => this._flushSync();
+    this._onSigTerm = () => { this._flushSync(); process.exit(0); };
+    this._onSigInt  = () => { this._flushSync(); process.exit(0); };
+    process.once('exit',    this._onExit);
+    process.once('SIGTERM', this._onSigTerm);
+    process.once('SIGINT',  this._onSigInt);
+  }
+
+  /** Flush, stop writing, and stop holding the process open. */
+  detach() {
+    this._flushSync();
+    if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    try {
+      process.removeListener('exit',    this._onExit);
+      process.removeListener('SIGTERM', this._onSigTerm);
+      process.removeListener('SIGINT',  this._onSigInt);
+    } catch (_) {}
+    this._filePath = null;
   }
 
   attachFile(filePath) {

package/lib/signal/SignalStore.js

@@ -36,11 +36,30 @@ class SignalStore {
     this._dirty            = false;
     this._saveTimer        = null;
 
-    // Flush synchronously on exit so no state is ever lost
-    const flush = () => this._flushSync();
-    process.once('exit',    flush);
-    process.once('SIGTERM', () => { flush(); process.exit(0); });
-    process.once('SIGINT',  () => { flush(); process.exit(0); });
+    // Flush synchronously on exit so no state is ever lost.
+    //
+    // Kept as references so they can be taken off again: a store that has been
+    // replaced — when a session is re-filed under a different number, say —
+    // would otherwise stay reachable from process forever, and every store ever
+    // built would add three more listeners.
+    this._onExit    = () => this._flushSync();
+    this._onSigTerm = () => { this._flushSync(); process.exit(0); };
+    this._onSigInt  = () => { this._flushSync(); process.exit(0); };
+    process.once('exit',    this._onExit);
+    process.once('SIGTERM', this._onSigTerm);
+    process.once('SIGINT',  this._onSigInt);
+  }
+
+  /** Flush, stop writing, and stop holding the process open. */
+  detach() {
+    this._flushSync();
+    if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    try {
+      process.removeListener('exit',    this._onExit);
+      process.removeListener('SIGTERM', this._onSigTerm);
+      process.removeListener('SIGINT',  this._onSigInt);
+    } catch (_) {}
+    this._filePath = null;
   }
 
   init(identityKeyPair, registrationId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.7.0",
+  "version": "5.7.1",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",