* fix(deps): upgrade eslint and plugins to 10.2.0
* chore: manual lint-fix
* chore: automatic lint-fix
* feat(repo): github actions - lint - use node v24
because it is linting (not runtime), so why not
to use the latest stable Node version
* fix: remove @stylistic/eslint-plugin (in favor of prettier)
* fix: eslint uses `ecmaVersion` 2025
* fix: eslint's "mocha" config is isolated (for test files only)
for example `describe` is not considered "global" outside the
test files. the same for all other "eslint/mocha" rules -
they are applied only to files in `/tests` folder.
* chore: update package-lock.json after eslint upgrade
WhatsApp Web changed the signature of WAWebChatLoadMessages.loadEarlierMsgs
from positional (chat, msgCollection) to an options object
{chat, msgCollection, signal, threadId, trigger}.
Calling the old positional form crashes with "Cannot read properties of
undefined (reading 'waitForChatLoading')" because the destructure reads
e.chat on the first positional argument instead of treating the first
argument as the chat.
Updates both Chat.fetchMessages and Channel.fetchMessages to pass the
options object. No other behaviour change.
* fix: recover ciphertext messages via PLACEHOLDER_MESSAGE_RESEND
Add automatic recovery for ciphertext messages using WhatsApp's built-in
PLACEHOLDER_MESSAGE_RESEND (PDO type 4). Override the AB test gate and
send recovery requests after a 5s grace period.
Also adds message_ciphertext_failed event at 15s and fixes incorrect
JSDoc on onAddMessageCiphertextEvent.
* fix: skip message event when ciphertext resolves to revoked
when a ciphertext message is revoked before it decrypts, WhatsApp's
internal revoke handler calls model.set({ type: 'revoked', ... }) on
the existing model in place. This triggers change:type on the ciphertext
model, which fired the deferred listener and emitted a spurious message
event with type === 'revoked'.
add an early return in the once('change:type') callback to skip
onaddmessageevent when the resolved type is revoked.
fixeswwebjs/whatsapp-web.js#201668
* fix: use handlePlaceholderMsgsSeen for ciphertext recovery
replace the manual sendPeerDataOperationRequest call with a direct call
to handlePlaceholderMsgsSeen. This adds subtype filtering (skips
bot_unavailable_fanout, hosted_unavailable_fanout,
view_once_unavailable_fanout), an age check (14 day limit via the
placeholder_message_resend_maximum_days_limit AB prop), and internal
deduplication so the same message doesn't get multiple PDO requests.
the true second argument is the 'is visible' flag the function expects.
since the gate override is already in place earlier in the evaluate
block, the function passes its own internal gate check and proceeds
normally.
suggested by @sofi-ans in review.
* fix: batch ciphertext PDO requests instead of sending per-message
handleplaceholdermsgsseen has built-in chunking (batches of 32 per PDO)
but calling it with [msg] per message from Msg.on('add') bypasses that.
collect ciphertext messages into a shared buffer and flush them in a
single call after the 5s grace period.
also guard the failTimer to skip if the message type already changed.
* fix: replace silent catch blocks with established patterns
address reviewer feedback - remove catch (_) { // comment } pattern:
- Gate override now uses injectToFunction (existing utility)
- PDO call uses direct require without silent error swallowing
* fix(types): add on() overload for message_ciphertext_failed event
* fix: skip unavailable fanout placeholders from ciphertext recovery
unavailable fanout placeholders (view_once, hosted, bot) are
unrecoverable - WhatsApp's handlePlaceholderMsgsSeen explicitly
skips them and won't resend via PDO. Without this check, the
15s failTimer fires message_ciphertext_failed as a false positive.
* fix: use WA's own LID resolution for block/unblock
block() was passing a Chat object to blockContact() which expects a
contact. unblock() was using synchronous Contact.get() which returns
undefined if the contact isn't cached.
with blocklist migration enabled, blocking a PN contact without a chat
fails because the internal S() function needs a LID or an existing chat
to resolve the accountLid. The old getChat() approach worked around this
by creating a chat via findOrCreateLatestChat, but that's a side effect
and passes the wrong type.
use WAWebBlockContactUtils.getContactToBlockOnlyUseIfNoAssociatedChat()
instead, which is WA's own utility for this exact case. It resolves the
contact's LID via getCurrentLidContact() without needing to create a
chat.
* fix: check alternate WID for blocked status in getContactModel
iscontactblocked on PN contacts returns false because the Blocklist
only contains LID entries. Use getAlternateUserWid() to resolve
the PN/LID mapping and check the Blocklist directly, matching WA
web's own $Contact$p_3 fallback logic.
---------
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
store.save() was receiving path.join(this.dataPath, this.sessionName)
instead of just this.sessionName. This caused remote stores (e.g. S3)
to use the full local filesystem path as the storage key, resulting in
zip files being saved under paths like:
sessions/Users/user/project/.wwebjs_session/default/RemoteAuth-default.zip
instead of:
sessions/RemoteAuth-default.zip
all other store calls (sessionExists, extract, delete) already pass
this.sessionName correctly. This brings store.save in line with them.
the local filesystem operations (creating and cleaning up the zip file)
continue to use path.join(this.dataPath, ...) which is correct.
regression introduced in e6fd112.
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
* feat: add cancelPairingCode() and allow requestPairingCode()
- requestPairingCode() now exposes onCodeReceivedEvent if needed,
so it works on clients initialized in QR mode
- Add cancelPairingCode() method to stop pairing and return to QR
- Update TypeScript definitions
* fix(auth): dynamic ADV key in getQR + structural cancelPairingCode
the getQR closure captured advSecretKey once during initialize(), but
requestpairingcode/cancelPairingCode changes the key in IndexedDB.
the stale closure key caused QR scans to fail with HMAC validation error.
fix: read key dynamically via WAWebUserPrefsMultiDevice.getADVSecretKey()
(synchronous in-memory cache) on every getQR call, matching how WhatsApp
web's internal QR component works.
cancelpairingcode now mirrors WhatsApp Web's resetLinkDeviceState:
refreshqr() restarts WebSocket for fresh refs, then
initializeqrlinking() generates a new key. QR emission happens
automatically via the existing change:ref listener.
---------
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
* fix: prevent store mutation in getContact/getChatModel LID handling
getcontact() and getChatModel() overwrite .id directly on live Backbone
model references from WhatsApp Web's Contact/Participant store. This
permanently corrupts the store for the lifetime of the session, causing
all subsequent lookups for the same contact to crash with:
- "Cannot read properties of undefined (reading '_serialized')"
- "Data passed to getter must include an id property"
the fix resolves LID to phone on the serialized copy only, never
touching the live store model.
fixes#127054
* perf: use BusinessProfile.find() instead of fetchBizProfile()
businessprofile.find() checks the local cache first and only fetches
from the server when the profile is missing, while fetchBizProfile()
always makes a network call (~85-100ms per contact). This significantly
reduces latency when getContact is called repeatedly for the same
business contacts.
closes#201656
co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove unnecessary try/catch around BusinessProfile.find()
businessprofile.find() never throws for non-business contacts - it returns
a BusinessProfile model with profileOptions: null, not an error. The comment
was factually incorrect. The existing profileOptions guard handles the
non-business case correctly without any exception handling.
verified in WhatsApp Web DevTools: find() returns a valid object for regular,
business, LID, and even non-existent contacts. Only throws when called without
an id, which cannot happen here.
co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: simplify contact/chat model utils via native WA functions
replace the O(n²) LID participant loop with WAWebLidMigrationUtils.toPn()
which resolves LID WIDs via LidPnCache in O(1). Remove the findContact
wrapper since Contact.find() accepts strings directly. Use
wawebwidfactory.createWidFromWidLike() for safe isLid() calls that handle
plain-object contact ids without WID prototype methods.
co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* perf: skip BusinessProfile.find() for non-business contacts
wa's own source guards this behind isBusiness || isEnterprise
(WAWebUseBusinessProfile.react). No point querying business profiles
for regular contacts - saves a wasted IQ roundtrip (~80ms) per call.
* revert: remove block/unblock changes from this PR
moved to a dedicated PR (#201671) with a proper fix using
wawebblockcontactutils.getContactToBlockOnlyUseIfNoAssociatedChat()
for correct LID resolution.
* fix: convert contactId to Wid before collection find() calls
contact.find() and BusinessProfile.find() reject plain strings when
the entry is not cached or stale, throwing "gadd called without an id
attr". Use createWid(contactId) to ensure a proper Wid object is passed.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* update WAWebSendReactionMsgAction call to use sendReactionToMsg method
The WhatsApp Web internal API changed the WAWebSendReactionMsgAction module
from a directly callable function to an object with a sendReactionToMsg method.
Before:
await (window.require('WAWebSendReactionMsgAction'))(msg, reaction);
After:
await (window.require('WAWebSendReactionMsgAction')).sendReactionToMsg(msg, reaction);
This fixes the TypeError: window.require(...) is not a function error
thrown when attempting to react to messages.
* Refactor react method for improved readability
* Update Message.js
Co-authored-by: @BenyFilho
* Update Message.js
Co-authored-by: @Benyfilho
* Update Message.js
Co-authored-by: @BenyFilho
* Update Message.js
Co-authored-by: BenyFilho <BenyFilho@users.noreply.github.com>
---------
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
Co-authored-by: BenyFilho <BenyFilho@users.noreply.github.com>
* ci: setup workflows, dependabot, labeler and commit linting
* docs: update README, community files and issue templates
* chore: configure prettier, editorconfig and format codebase
* chore: restore changes lost during rebase
* docs: adjust url for new logo
* fix: align badges
* chore: resolve conflicts and re-add temp lint
* copy only requiredDirs and make storeRemoteSession safer
* replace fs-extra copy with native fs cp function
to avoid unhandled exceptions bug in fs-extra
* add recursive option to cp for folders copy
* fix: correct indentation in storeRemoteSession method
Fixed ESLint indentation errors (lines 105-127) by changing from
2-space to 4-space indentation to match project standards.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix formatting of session save object in RemoteAuth
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* avoid hang by closing browser only if connected
* fix: correct indentation in destroy() method
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: update call handling for recent WhatsApp Web changes
Updated the call handling logic to accommodate the renaming of Store.Call to WAWebCallCollection in recent WhatsApp Web versions. This ensures that incoming calls are properly managed without breaking functionality.
* Update Client.js
---------
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
Co-authored-by: tuyuribr <45042245+tuyuribr@users.noreply.github.com>
Ensures correct media upload to channels by using the mimetype from mediaInfo, rather than the file, when creating OpaqueData.
Also, it replaces the call to the function getRandomFilehash with the value of the function to retrieve the correct token.
Co-authored-by: Noel Carcases <noel.david.carcases.gomez@ibm.com>
Co-authored-by: Shir Serlui <70711723+shirser121@users.noreply.github.com>
Co-authored-by: BenyFilho <168232825+BenyFilho@users.noreply.github.com>
