[core] Fix smoke test

fix #1503
fix #1511

.env.example

@@ -3,9 +3,25 @@
 # https://waha.devlike.pro/docs/how-to/config/
 #
 
+# ====================
+# ===== SECURITY =====
+# ====================
+WAHA_API_KEY=00000000000000000000000000000000
+WAHA_DASHBOARD_USERNAME=admin
+WAHA_DASHBOARD_PASSWORD=11111111111111111111111111111111
+WHATSAPP_SWAGGER_USERNAME=admin
+WHATSAPP_SWAGGER_PASSWORD=11111111111111111111111111111111
+
+# Disable Dashboard or Swagger
+WAHA_DASHBOARD_ENABLED=True
+WHATSAPP_SWAGGER_ENABLED=True
+
 # ==================
 # ===== COMMON =====
 # ==================
+# WhatsApp engine (WEBJS is default, GOWS or NOWEB for better performance)
+WHATSAPP_DEFAULT_ENGINE=WEBJS
+
 # Base URL for the API (used for webhooks, file URLs, etc.)
 WAHA_BASE_URL=http://localhost:3000
 # WAHA_PUBLIC_URL=http://localhost:3000
@@ -15,20 +31,7 @@ WAHA_BASE_URL=http://localhost:3000
 # WHATSAPP_API_PORT=3000
 # WHATSAPP_API_HOSTNAME=localhost
 
-# ====================
-# ===== SECURITY =====
-# ====================
-# "sha512:{SHA}" format - below is "admin" api key
-WAHA_API_KEY=sha512:c7ad44cbad762a5da0a452f9e854fdc1e0e7a52a38015f23f3eab1d80b931dd472634dfac71cd34ebc35d16ab7fb8a90c81f975113d6c7538dc69dd8de9077ec
-WAHA_DASHBOARD_ENABLED=True
-WAHA_DASHBOARD_USERNAME=admin
-WAHA_DASHBOARD_PASSWORD=admin
-WHATSAPP_SWAGGER_ENABLED=True
-WHATSAPP_SWAGGER_USERNAME=admin
-WHATSAPP_SWAGGER_PASSWORD=admin
 
-# WhatsApp engine (WEBJS is default, GOWS or NOWEB for better performance)
-WHATSAPP_DEFAULT_ENGINE=WEBJS
 
 # ===================
 # ===== LOGGING =====

.github/workflows/build.yaml

@@ -129,6 +129,7 @@ jobs:
           docker run -d \
             --name smoke \
             --rm -p3000:3000 \
+            -e WAHA_API_KEY=test \
             ${{ vars.DOCKER_IMAGE }}:${{ matrix.tag }}
 
           sleep 3

.pre-commit-config.yaml

@@ -73,4 +73,5 @@ repos:
               ^src/core/engines/webjs/_lodash.js|
               ^tests/perf/.*|
               ^scripts/.*|
+              ^scripts/init-waha.js|
           )$

Dockerfile

@@ -195,6 +195,11 @@ COPY --from=build /git/node_modules ./node_modules
 COPY --from=build /git/dist ./dist
 COPY --from=dashboard /dashboard ./dist/dashboard
 COPY --from=gows /go/gows/bin/gows /app/gows
+COPY .env.example ./.env.example
+COPY scripts/init-waha.js ./scripts/init-waha.js
+RUN chmod +x ./scripts/init-waha.js \
+  && printf '%s\n' '#!/bin/sh' 'exec node /app/scripts/init-waha.js "$@"' > /usr/local/bin/init-waha \
+  && chmod +x /usr/local/bin/init-waha
 ENV WAHA_GOWS_PATH=/app/gows
 ENV WAHA_GOWS_SOCKET=/tmp/gows.sock
 

docker-compose/chatwoot/.waha.env

@@ -3,6 +3,20 @@
 # https://waha.devlike.pro/docs/how-to/config/
 #
 
+# ====================
+# ===== SECURITY =====
+# ====================
+WAHA_API_KEY_PLAIN=00000000000000000000000000000000
+WAHA_API_KEY=00000000000000000000000000000000
+WAHA_DASHBOARD_USERNAME=admin
+WAHA_DASHBOARD_PASSWORD=11111111111111111111111111111111
+WHATSAPP_SWAGGER_USERNAME=admin
+WHATSAPP_SWAGGER_PASSWORD=11111111111111111111111111111111
+
+# Disable Dashboard or Swagger
+WAHA_DASHBOARD_ENABLED=True
+WHATSAPP_SWAGGER_ENABLED=True
+
 # ==================
 # ===== COMMON =====
 # ==================
@@ -15,20 +29,6 @@ WAHA_PUBLIC_URL=http://localhost:3000
 # WHATSAPP_API_PORT=3000
 # WHATSAPP_API_HOSTNAME=localhost
 
-# ====================
-# ===== SECURITY =====
-# ====================
-# WAHA Apps requires both sha and plain version
-WAHA_API_KEY_PLAIN=00000000000000000000000000000000
-WAHA_API_KEY=sha512:98b6d128682e280b74b324ca82a6bae6e8a3f7174e0605bfd52eb9948fad8984854ec08f7652f32055c4a9f12b69add4850481d9503a7f2225501671d6124648
-WAHA_DASHBOARD_USERNAME=admin
-WAHA_DASHBOARD_PASSWORD=11111111111111111111111111111111
-WHATSAPP_SWAGGER_USERNAME=admin
-WHATSAPP_SWAGGER_PASSWORD=11111111111111111111111111111111
-
-WAHA_DASHBOARD_ENABLED=True
-WHATSAPP_SWAGGER_ENABLED=True
-
 # WhatsApp engine (WEBJS is default, GOWS or NOWEB for better performance)
 WHATSAPP_DEFAULT_ENGINE=GOWS
 

entrypoint.sh

@@ -41,11 +41,6 @@ if [ -n "$key" ]; then
     # If already hashed, use it as is
     export WAHA_API_KEY="$key"
   else
-    # Display warning about using plain text API key
-    echo "⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️"
-    echo "WARNING: Plain text API key detected. Converting to hashed format for security."
-    echo "For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}"
-    echo "⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️"
     # Hash the key using sha512sum
     HASHED_KEY=$(echo -n "$key" | sha512sum | awk '{print $1}')
     export WAHA_API_KEY="sha512:$HASHED_KEY"

package.json

@@ -76,7 +76,7 @@
     "joi": "^17.13.3",
     "knex": "^3.1.0",
     "libphonenumber-js": "^1.10.36",
-    "libsignal": "github:devlikeapro/libsignal-node#fork-master",
+    "libsignal": "github:WhiskeySockets/libsignal-node#master",
     "link-preview-js": "^3.0.4",
     "lodash": "^4.17.21",
     "long": "^5.3.2",
@@ -102,6 +102,7 @@
     "sqlite3": "^5.1.7",
     "swagger-ui-express": "^4.1.4",
     "ulid": "^2.3.0",
+    "undici": "^7.16.0",
     "whatsapp-web.js": "github:devlikeapro/whatsapp-web.js#fork-main-2025-09-10",
     "write-file-atomic": "^6.0.0",
     "yaml": "^2.7.1"
@@ -114,7 +115,6 @@
     "ws": "^8.18.0",
     "puppeteer": "^24.19.0",
     "whatwg-url": "13.0.0",
-    "libsignal": "github:devlikeapro/libsignal-node#fork-master",
     "axios": "^1.9.0"
   },
   "devDependencies": {

scripts/init-waha.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const projectRoot = path.resolve(__dirname, '..');
+
+const args = process.argv.slice(2);
+const forceIndex = args.indexOf('--force');
+const forceOverwrite = forceIndex !== -1;
+
+if (forceOverwrite) {
+  args.splice(forceIndex, 1);
+}
+
+const folderArg = args[0] || '.';
+const sourceArgRaw = args[1];
+const targetArg = args[2] || '.env';
+
+const envDir = path.resolve(process.cwd(), folderArg);
+const sourceArg = sourceArgRaw || '.env.example';
+const templateBaseDir = sourceArgRaw ? envDir : projectRoot;
+const templatePath = path.isAbsolute(sourceArg)
+  ? sourceArg
+  : path.resolve(templateBaseDir, sourceArg);
+const targetPath = path.isAbsolute(targetArg)
+  ? targetArg
+  : path.resolve(envDir, targetArg);
+
+function exitWithMessage(message, code = 1) {
+  console.error(message);
+  process.exit(code);
+}
+
+if (!fs.existsSync(envDir)) {
+  exitWithMessage(`Target directory does not exist: ${envDir}`);
+}
+
+if (!fs.existsSync(templatePath)) {
+  exitWithMessage(`Missing template file: ${templatePath}`);
+}
+
+if (!forceOverwrite && fs.existsSync(targetPath)) {
+  const stats = fs.statSync(targetPath);
+  if (stats.size > 0) {
+    exitWithMessage(
+      `${targetPath} already exists and is not empty. Remove it manually or rerun with --force to overwrite.`,
+    );
+  }
+}
+
+const exampleContent = fs.readFileSync(templatePath, 'utf8');
+
+function generateSecret() {
+  return crypto.randomUUID({ disableEntropyCache: true }).replace(/-/g, '');
+}
+
+const apiKey = generateSecret();
+const adminPassword = generateSecret();
+
+const updatedContent = exampleContent
+  .replace(/^WAHA_API_KEY=.*/m, `WAHA_API_KEY=${apiKey}`)
+  .replace(/^WAHA_API_KEY_PLAIN=.*/m, `WAHA_API_KEY_PLAIN=${apiKey}`)
+  .replace(/^WAHA_DASHBOARD_USERNAME=.*/m, 'WAHA_DASHBOARD_USERNAME=admin')
+  .replace(
+    /^WAHA_DASHBOARD_PASSWORD=.*/m,
+    `WAHA_DASHBOARD_PASSWORD=${adminPassword}`,
+  )
+  .replace(/^WHATSAPP_SWAGGER_USERNAME=.*/m, 'WHATSAPP_SWAGGER_USERNAME=admin')
+  .replace(
+    /^WHATSAPP_SWAGGER_PASSWORD=.*/m,
+    `WHATSAPP_SWAGGER_PASSWORD=${adminPassword}`,
+  );
+
+fs.writeFileSync(targetPath, updatedContent, { encoding: 'utf8' });
+
+const lines = [
+  'Credentials generated.',
+  '',
+  'Dashboard and Swagger:',
+  '  - Username: admin',
+  `  - Password: ${adminPassword}`,
+  '',
+  'API key: ',
+  `  - ${apiKey}`,
+  '',
+  'Use it in the Dashboard connection flow: https://waha.devlike.pro/docs/how-to/dashboard/#api-key',
+];
+
+console.log(lines.join('\n'));

src/apps/app_sdk/auth.ts

@@ -2,10 +2,11 @@ import * as process from 'node:process';
 
 import { parseBool } from '@waha/helpers';
 import * as basicAuth from 'express-basic-auth';
+import { Auth } from '@waha/core/auth/config';
 
 export function BullAuthMiddleware() {
-  let username = process.env.WAHA_DASHBOARD_USERNAME || '';
-  let password = process.env.WAHA_DASHBOARD_PASSWORD || '';
+  let username = Auth.dashboard.username.value || '';
+  let password = Auth.dashboard.password.value || '';
   if (process.env.WAHA_DASHBOARD_ENABLED) {
     const enabled = parseBool(process.env.WAHA_DASHBOARD_ENABLED);
     if (!enabled) {

src/apps/apps.module.ts

@@ -13,6 +13,7 @@ import { ChatwootLocalesController } from '@waha/apps/chatwoot/api/chatwoot.loca
 import { ChatWootExports } from '@waha/apps/chatwoot/chatwoot.module';
 import { parseBool } from '@waha/helpers';
 import { RMutexModule } from '@waha/modules/rmutex';
+import { Auth } from '@waha/core/auth/config';
 
 const IMPORTS = [
   BullModule.forRoot({
@@ -93,11 +94,11 @@ const AppsDisabled = {
 };
 
 function checkApiKey() {
-  const key = process.env.WHATSAPP_API_KEY || process.env.WAHA_API_KEY;
+  const key = Auth.key.value;
   if (!key) {
     return;
   }
-  const plain = process.env.WAHA_API_KEY_PLAIN;
+  const plain = Auth.keyplain.value;
   if (!plain) {
     throw Error(
       'WAHA_API_KEY set, please provide WAHA_API_KEY_PLAIN when WAHA_APPS_ENABLED',

src/apps/chatwoot/consumers/waha/message.ack.ts

@@ -19,6 +19,7 @@ import { Job } from 'bullmq';
 import { PinoLogger } from 'nestjs-pino';
 import { isJidCusFormat } from '@waha/utils/wa';
 import { isLidUser } from '@adiwajshing/baileys/lib/WABinary/jid-utils';
+import { toCusFormat } from '@waha/core/utils/jids';
 
 @Processor(QueueName.WAHA_MESSAGE_ACK, { concurrency: JOB_CONCURRENCY })
 export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
@@ -37,15 +38,23 @@ export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
     if (!isJidCusFormat(chatId) && !isLidUser(chatId)) {
       return false;
     }
+
     const payload = event.payload;
-    if (payload.fromMe) {
-      // Ignore from me
-      return;
-    }
     // Only READ and PLAYED
-    return (
-      payload.ack === WAMessageAck.READ || payload.ack == WAMessageAck.PLAYED
-    );
+    const read = payload.ack === WAMessageAck.READ;
+    const played = payload.ack == WAMessageAck.PLAYED;
+    if (!read && !played) {
+      return true;
+    }
+    // Only not from me
+    const sender = toCusFormat(payload._data?.Sender) || payload.from;
+    const me = this.manager.getSession(event.session).getSessionMeInfo();
+    if (sender == me.id || sender === me.lid) {
+      this.logger.debug('Ignore from me ack');
+      // Ignore from me
+      return false;
+    }
+    return true;
   }
 
   GetChatId(event: WAHAWebhookMessageAck): string {

src/apps/chatwoot/consumers/waha/message.any.ts

@@ -24,6 +24,7 @@ import {
   LocationMessage,
   MessageToChatWootConverter,
   PollMessage,
+  ListMessage,
   ShareContactMessage,
   TextMessage,
   UnsupportedMessage,
@@ -104,6 +105,12 @@ class MessageAnyHandler extends MessageBaseHandler<WAMessage> {
       return msg;
     }
 
+    converter = new ListMessage(this.l);
+    msg = await converter.convert(payload, protoMessage);
+    if (msg) {
+      return msg;
+    }
+
     converter = new EventMessage(this.l);
     msg = await converter.convert(payload, protoMessage);
     if (msg) {

src/apps/chatwoot/i18n/locales/ar-AE.yaml

@@ -6,7 +6,7 @@ locale.name: '🇦🇪 العربية (Arabic)'
 # تستخدمه WAHA لعرض الأرقام والعملات والتاريخ/الوقت
 locale.base: 'ar-AE'
 
-app.inbox.contact.name: 'تكامل واتساب (WAHA)'
+app.inbox.contact.name: 'تكامل واتساب'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "options" من date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/bn-BD.yaml

@@ -6,7 +6,7 @@ locale.name: '🇧🇩 বাংলা (Bengali)'
 # WAHA এটি সংখ্যা, মুদ্রা এবং তারিখ/সময়ের ফরম্যাটিংয়ে ব্যবহার করে।
 locale.base: 'bn-BD'
 
-app.inbox.contact.name: 'হোয়াটসঅ্যাপ ইন্টিগ্রেশন (WAHA)'
+app.inbox.contact.name: 'হোয়াটসঅ্যাপ ইন্টিগ্রেশন'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # date.toLocaleString এর "options"
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/de-DE.yaml

@@ -6,7 +6,7 @@ locale.name: '🇩🇪 Deutsch (German)'
 # WAHA nutzt ihn zur Darstellung von Zahlen, Währungen sowie Datum und Uhrzeit
 locale.base: 'de-DE'
 
-app.inbox.contact.name: 'WhatsApp Integration (WAHA)'
+app.inbox.contact.name: 'WhatsApp Integration'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "Optionen" von date.toLocaleString
@@ -286,6 +286,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/en-US.yaml

@@ -6,7 +6,7 @@ locale.name: '🇺🇸 English (English)'
 # WAHA uses it for number, currency and datetime representation
 locale.base: 'en-US'
 
-app.inbox.contact.name: 'WhatsApp Integration (WAHA)'
+app.inbox.contact.name: 'WhatsApp Integration'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "options" from date.toLocaleString
@@ -160,6 +160,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/es-ES.yaml

@@ -6,7 +6,7 @@ locale.name: '🇪🇸 Español (Spanish)'
 # WAHA lo utiliza para formatear números, moneda y fecha/hora
 locale.base: 'es-ES'
 
-app.inbox.contact.name: 'Integración de WhatsApp (WAHA)'
+app.inbox.contact.name: 'Integración de WhatsApp'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "opciones" de date.toLocaleString
@@ -286,6 +286,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/fa-IR.yaml

@@ -6,7 +6,7 @@ locale.name: '🇮🇷 فارسی (Persian)'
 # WAHA از آن برای نمایش اعداد، ارز و تاریخ/زمان استفاده می‌کند
 locale.base: 'fa-IR'
 
-app.inbox.contact.name: 'ادغام واتساپ (WAHA)'
+app.inbox.contact.name: 'ادغام واتساپ'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # گزینه‌های "options" از date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/fr-FR.yaml

@@ -6,7 +6,7 @@ locale.name: '🇫🇷 Français (French)'
 # WAHA l'utilise pour le formatage des nombres, devises et dates/heures
 locale.base: 'fr-FR'
 
-app.inbox.contact.name: 'Intégration WhatsApp (WAHA)'
+app.inbox.contact.name: 'Intégration WhatsApp'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "options" de date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/he-IL.yaml

@@ -6,7 +6,7 @@ locale.name: '🇮🇱 עברית (Hebrew)'
 # WAHA משתמש בכך להצגת מספרים, מטבע ותאריך/שעה
 locale.base: 'he-IL'
 
-app.inbox.contact.name: 'אינטגרציית וואטסאפ (WAHA)'
+app.inbox.contact.name: 'אינטגרציית וואטסאפ'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "אפשרויות" של date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/hi-IN.yaml

@@ -6,7 +6,7 @@ locale.name: '🇮🇳 हिंदी (Hindi)'
 # WAHA इसे संख्याएँ, मुद्रा और दिनांक/समय प्रदर्शित करने के लिए उपयोग करता है।
 locale.base: 'hi-IN'
 
-app.inbox.contact.name: 'व्हाट्सएप इंटीग्रेशन (WAHA)'
+app.inbox.contact.name: 'व्हाट्सएप इंटीग्रेशन'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # date.toLocaleString की "options"
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/id-ID.yaml

@@ -6,7 +6,7 @@ locale.name: '🇮🇩 Bahasa Indonesia (Indonesian)'
 # WAHA menggunakannya untuk format angka, mata uang, dan tanggal/waktu
 locale.base: 'id-ID'
 
-app.inbox.contact.name: 'Integrasi WhatsApp (WAHA)'
+app.inbox.contact.name: 'Integrasi WhatsApp'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "opsi" dari date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/pa-PK.yaml

@@ -6,7 +6,7 @@ locale.name: '🇵🇰 ਪੰਜਾਬੀ (Punjabi)'
 # WAHA ਇਸਨੂੰ ਅੰਕ, ਕਰੰਸੀ ਅਤੇ ਤਾਰੀਖ/ਸਮੇਂ ਦੀ ਨਮਾਇਸ਼ ਲਈ ਵਰਤਦਾ ਹੈ
 locale.base: 'pa-PK'
 
-app.inbox.contact.name: 'ਵਟਸਐਪ ਇੰਟੀਗ੍ਰੇਸ਼ਨ (WAHA)'
+app.inbox.contact.name: 'ਵਟਸਐਪ ਇੰਟੀਗ੍ਰੇਸ਼ਨ'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # date.toLocaleString ਦੀਆਂ "options"
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/pt-BR.yaml

@@ -6,7 +6,7 @@ locale.name: '🇧🇷🇵🇹 Português (Portuguese)'
 # A WAHA usa isso para formatar números, moeda e data/hora
 locale.base: 'pt-BR'
 
-app.inbox.contact.name: 'Integração WhatsApp (WAHA)'
+app.inbox.contact.name: 'Integração WhatsApp'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "opções" de date.toLocaleString
@@ -286,6 +286,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/ru-RU.yaml

@@ -6,7 +6,7 @@ locale.name: '🇷🇺 Русский (Russian)'
 # WAHA использует его для форматирования чисел, валют и даты/времени
 locale.base: 'ru-RU'
 
-app.inbox.contact.name: 'WhatsApp Интеграция (WAHA)'
+app.inbox.contact.name: 'WhatsApp Интеграция'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "параметры" из date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/tr-TR.yaml

@@ -6,7 +6,7 @@ locale.name: '🇹🇷 Türkçe (Turkish)'
 # WAHA bunu sayı, para birimi ve tarih/saat gösterimi için kullanır
 locale.base: 'tr-TR'
 
-app.inbox.contact.name: 'WhatsApp Entegrasyonu (WAHA)'
+app.inbox.contact.name: 'WhatsApp Entegrasyonu'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # date.toLocaleString için "options"
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/uk-UA.yaml

@@ -6,7 +6,7 @@ locale.name: '🇺🇦 Українська (Ukrainian)'
 # WAHA використовує його для форматування чисел, валют і дати/часу
 locale.base: 'uk-UA'
 
-app.inbox.contact.name: 'Інтеграція WhatsApp (WAHA)'
+app.inbox.contact.name: 'Інтеграція WhatsApp'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # "параметри" з date.toLocaleString
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/ur-PK.yaml

@@ -6,7 +6,7 @@ locale.name: '🇵🇰 اردو (Urdu)'
 # WAHA اسے نمبرز، کرنسی اور تاریخ/وقت کی نمائندگی کے لیے استعمال کرتا ہے۔
 locale.base: 'ur-PK'
 
-app.inbox.contact.name: 'واٹس ایپ انٹیگریشن (WAHA)'
+app.inbox.contact.name: 'واٹس ایپ انٹیگریشن'
 app.inbox.contact.avatar.url: 'https://raw.githubusercontent.com/devlikeapro/waha/core/logo.png'
 
 # date.toLocaleString کی "options"
@@ -283,6 +283,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/locales/zh-CN.yaml

@@ -285,6 +285,34 @@ whatsapp.to.chatwoot.message.poll: |-
   {{/options}}
   {{/poll}}
 
+whatsapp.to.chatwoot.message.list: |-
+  {{#message.listMessage}}
+  {{#title}}
+  *{{{title}}}*
+  {{/title}}
+  {{#description}}
+  {{{description}}}
+  {{/description}}
+  {{#footerText}}
+  {{{footerText}}}
+  {{/footerText}}
+
+  {{#buttonText}}
+  {{{buttonText}}}
+  {{/buttonText}}
+  {{#sections}}
+  {{#title}}
+  {{{title}}}:
+  {{/title}}
+  {{#rows}}
+  {{#title}}
+  - {{{title}}}
+  {{/title}}
+  {{/rows}}
+
+  {{/sections}}
+  {{/message.listMessage}}
+
 whatsapp.to.chatwoot.message.event: |-
   {{#message}}
   {{#eventMessage}}

src/apps/chatwoot/i18n/templates.ts

@@ -56,6 +56,7 @@ export enum TKey {
   WA_TO_CW_MESSAGE_PIX = 'whatsapp.to.chatwoot.message.pix',
   WA_TO_CW_MESSAGE_UNSUPPORTED = 'whatsapp.to.chatwoot.message.unsupported',
   WA_TO_CW_MESSAGE_FACEBOOK_AD = 'whatsapp.to.chatwoot.message.facebook.ad',
+  WA_TO_CW_MESSAGE_LIST = 'whatsapp.to.chatwoot.message.list',
 
   //
   // App Inbox
@@ -174,6 +175,10 @@ export type TemplatePayloads = {
       eventMessage: Record<string, unknown>;
     };
   };
+  [TKey.WA_TO_CW_MESSAGE_LIST]: {
+    payload: WAMessage;
+    message: proto.Message;
+  };
   [TKey.WA_TO_CW_MESSAGE_PIX]: {
     payload: WAMessage;
     message: proto.Message | null;

src/apps/chatwoot/messages/to/chatwoot/ListMessage.ts

@@ -0,0 +1,37 @@
+import { ChatWootMessagePartial } from '@waha/apps/chatwoot/consumers/waha/base';
+import { Locale } from '@waha/apps/chatwoot/i18n/locale';
+import { TKey } from '@waha/apps/chatwoot/i18n/templates';
+import { MessageToChatWootConverter } from '@waha/apps/chatwoot/messages/to/chatwoot';
+import { isEmptyString } from '@waha/apps/chatwoot/messages/to/chatwoot/utils/proto';
+import { WhatsappToMarkdown } from '@waha/apps/chatwoot/messages/to/chatwoot/utils/markdown';
+import * as lodash from 'lodash';
+import type { proto } from '@adiwajshing/baileys';
+import { WAMessage } from '@waha/structures/responses.dto';
+
+export class ListMessage implements MessageToChatWootConverter {
+  constructor(private readonly locale: Locale) {}
+
+  convert(
+    payload: WAMessage,
+    protoMessage: proto.Message | null,
+  ): ChatWootMessagePartial | null {
+    const listMessage = protoMessage?.listMessage;
+    if (lodash.isEmpty(listMessage)) {
+      return null;
+    }
+
+    const content = this.locale
+      .key(TKey.WA_TO_CW_MESSAGE_LIST)
+      .r({ payload, message: protoMessage as proto.Message });
+
+    if (isEmptyString(content)) {
+      return null;
+    }
+
+    return {
+      content: WhatsappToMarkdown(content),
+      attachments: [],
+      private: undefined,
+    };
+  }
+}

src/apps/chatwoot/messages/to/chatwoot/index.ts

@@ -12,6 +12,7 @@ export { FacebookAdMessage } from './FacebookAdMessage';
 export { PollMessage } from './PollMessage';
 export { EventMessage } from './EventMessage';
 export { PixMessage } from './PixMessage';
+export { ListMessage } from './ListMessage';
 
 export type Awaitable<T> = T | Promise<T>;
 

src/apps/chatwoot/session/WAHASelf.ts

@@ -11,13 +11,14 @@ import {
 } from '@waha/structures/chatting.dto';
 import { SessionInfo } from '@waha/structures/sessions.dto';
 import axios, { AxiosInstance } from 'axios';
+import { Auth } from '@waha/core/auth/config';
 
 export class WAHASelf {
   public client: AxiosInstance;
 
   constructor() {
     // Set 'X-Api-Key'
-    const key = process.env.WAHA_API_KEY_PLAIN;
+    const key = Auth.keyplain.value;
     const port =
       parseInt(process.env.PORT) ||
       parseInt(process.env.WHATSAPP_API_PORT) ||

src/config.service.ts

@@ -5,6 +5,7 @@ import { IgnoreJidConfig } from '@waha/core/utils/jids';
 
 import { parseBool } from './helpers';
 import { WebhookConfig } from './structures/webhooks.config.dto';
+import { Auth } from '@waha/core/auth/config';
 
 @Injectable()
 export class WhatsappConfigService implements OnApplicationBootstrap {
@@ -139,10 +140,7 @@ export class WhatsappConfigService implements OnApplicationBootstrap {
   }
 
   getApiKey(): string | undefined {
-    return (
-      this.configService.get('WHATSAPP_API_KEY', '') ||
-      this.configService.get('WAHA_API_KEY', '')
-    );
+    return Auth.key.value;
   }
 
   getExcludedPaths(): string[] {

src/core/auth/ApiKeyAuthFactory.ts

@@ -6,11 +6,15 @@ import {
   NoAuth,
   PlainApiKeyAuth,
 } from '@waha/core/auth/auth';
+import { ReportGeneratedValue } from '@waha/core/auth/config';
 
 export function ApiKeyAuthFactory(
   config: WhatsappConfigService,
   logger: LoggerService,
 ): IApiKeyAuth {
+  setTimeout(() => {
+    ReportGeneratedValue();
+  }, 4000);
   const apiKey = config.getApiKey();
   if (!apiKey) {
     setTimeout(() => {
@@ -36,18 +40,5 @@ export function ApiKeyAuthFactory(
   }
 
   // Fallback to plain text
-  setTimeout(() => {
-    logger.warn('⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️');
-    logger.warn(
-      'WARNING: Plain text API key detected. This is a security risk.',
-    );
-    logger.warn(
-      'Your API key can be exposed in environment variables or process lists.',
-    );
-    logger.warn(
-      'For better security, use WAHA_API_KEY=sha512:{SHA512_HASH_FOR_YOUR_API_KEY}',
-    );
-    logger.warn('⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️');
-  }, 2000);
   return new PlainApiKeyAuth(apiKey);
 }

src/core/auth/config.ts

@@ -0,0 +1,154 @@
+import { parseBool } from '@waha/helpers';
+
+export interface SValue {
+  param: string;
+  value: string | null;
+  generated: boolean;
+}
+
+function rand() {
+  return crypto.randomUUID().toString().replace(/-/g, '');
+}
+
+function FromEnv(
+  param: string,
+  skip: boolean,
+  adefault: string,
+  search: any[],
+): SValue {
+  let value = process.env[param];
+  const common = search.includes(value);
+  if (common && !skip) {
+    // Use generated value for the setting
+    return {
+      param: param,
+      value: adefault,
+      generated: true,
+    };
+  }
+
+  return {
+    param: param,
+    value: value,
+    generated: false,
+  };
+}
+
+const keys = [
+  '',
+  null,
+  undefined,
+  '123',
+  '321',
+  'waha',
+  'admin',
+  '00000000000000000000000000000000',
+  '11111111111111111111111111111111',
+  'sha512:98b6d128682e280b74b324ca82a6bae6e8a3f7174e0605bfd52eb9948fad8984854ec08f7652f32055c4a9f12b69add4850481d9503a7f2225501671d6124648',
+];
+
+const nulls = ['', null, undefined];
+
+interface UserPassword {
+  username: SValue;
+  password: SValue;
+}
+
+export class AuthConfig {
+  public key: SValue;
+  public keyplain: SValue;
+  public dashboard: UserPassword;
+  public swagger: UserPassword;
+
+  constructor() {
+    if (process.env.WHATSAPP_API_KEY) {
+      process.env.WAHA_API_KEY = process.env.WHATSAPP_API_KEY;
+    }
+    this.key = FromEnv(
+      'WAHA_API_KEY',
+      parseBool(process.env.WAHA_NO_API_KEY),
+      rand(),
+      keys,
+    );
+
+    this.keyplain = FromEnv(
+      'WAHA_API_KEY_PLAIN',
+      false,
+      this.key.value?.startsWith('sha512:') ? null : this.key.value,
+      [],
+    );
+
+    this.dashboard = this.getDashboard();
+    this.swagger = this.getSwagger();
+  }
+
+  private getDashboard(): UserPassword {
+    const password = FromEnv(
+      'WAHA_DASHBOARD_PASSWORD',
+      parseBool(process.env.WAHA_DASHBOARD_NO_PASSWORD),
+      rand(),
+      keys,
+    );
+    const username = FromEnv(
+      'WAHA_DASHBOARD_USERNAME',
+      false,
+      'admin',
+      password.value ? nulls : [],
+    );
+    return {
+      username: username,
+      password: password,
+    };
+  }
+
+  private getSwagger(): UserPassword {
+    const password = FromEnv(
+      'WHATSAPP_SWAGGER_PASSWORD',
+      parseBool(process.env.WHATSAPP_SWAGGER_NO_PASSWORD),
+      this.dashboard.password.value,
+      keys,
+    );
+    const username = FromEnv(
+      'WHATSAPP_SWAGGER_USERNAME',
+      false,
+      'admin',
+      password.value ? nulls : [],
+    );
+    return {
+      username: username,
+      password: password,
+    };
+  }
+}
+
+export const Auth = new AuthConfig();
+
+export function ReportGeneratedValue() {
+  let values = [
+    Auth.key,
+    Auth.dashboard.username,
+    Auth.dashboard.password,
+    Auth.swagger.username,
+    Auth.swagger.password,
+  ];
+  values = values.filter((key) => key.generated);
+  if (values.length === 0) {
+    return;
+  }
+  console.warn('');
+  console.warn('⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️ ⬇️');
+  console.warn('Generated credentials (persist to .env or WAHA_* env vars)');
+  console.warn(
+    'Save these values to your environment (.env or WAHA_*) to reuse them; new keys are generated on every start otherwise.',
+  );
+  console.warn('');
+  console.warn("cat <<'EOF' > .env");
+  console.warn('');
+  for (const key of values) {
+    console.warn(`${key.param}=${key.value}`);
+  }
+  console.warn('EOF');
+  console.warn('');
+  console.warn('Generated credentials ready to copy');
+  console.warn('⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️ ⬆️');
+}

src/core/config/DashboardConfigServiceCore.ts

@@ -3,6 +3,7 @@ import { ConfigService } from '@nestjs/config';
 import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
 
 import { parseBool } from '../../helpers';
+import { Auth } from '@waha/core/auth/config';
 
 @Injectable()
 export class DashboardConfigServiceCore {
@@ -20,8 +21,8 @@ export class DashboardConfigServiceCore {
   }
 
   get credentials(): [string, string] | null {
-    const user = this.configService.get('WAHA_DASHBOARD_USERNAME', '');
-    const password = this.configService.get('WAHA_DASHBOARD_PASSWORD', '');
+    const user = Auth.dashboard.username.value || '';
+    const password = Auth.dashboard.password.value || '';
     if (!user && !password) {
       return null;
     }

src/core/config/SwaggerConfigServiceCore.ts

@@ -3,6 +3,7 @@ import { ConfigService } from '@nestjs/config';
 import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
 
 import { parseBool } from '../../helpers';
+import { Auth } from '@waha/core/auth/config';
 
 @Injectable()
 export class SwaggerConfigServiceCore {
@@ -26,14 +27,8 @@ export class SwaggerConfigServiceCore {
   }
 
   get credentials(): [string, string] | undefined {
-    const user = this.configService.get<string>(
-      'WHATSAPP_SWAGGER_USERNAME',
-      undefined,
-    );
-    const password = this.configService.get<string>(
-      'WHATSAPP_SWAGGER_PASSWORD',
-      undefined,
-    );
+    const user = Auth.swagger.username.value;
+    const password = Auth.swagger.password.value;
     if (!user && !password) {
       return null;
     }

src/core/engines/noweb/session.noweb.core.ts

@@ -68,12 +68,13 @@ import {
 } from '@waha/core/exceptions';
 import { toVcardV3 } from '@waha/core/vcard';
 import { createAgentProxy } from '@waha/core/helpers.proxy';
+import type { Agent } from 'https';
 import { IMediaEngineProcessor } from '@waha/core/media/IMediaEngineProcessor';
 import { QR } from '@waha/core/QR';
 import { AckToStatus, StatusToAck } from '@waha/core/utils/acks';
 import { ExtractMessageKeysForRead } from '@waha/core/utils/convertors';
 import { parseMessageIdSerialized } from '@waha/core/utils/ids';
-import { isJidNewsletter, toJID } from '@waha/core/utils/jids';
+import { isJidNewsletter, toCusFormat, toJID } from '@waha/core/utils/jids';
 import { DistinctAck } from '@waha/core/utils/reactive';
 import { flipObject, splitAt } from '@waha/helpers';
 import { PairingCodeResponse } from '@waha/structures/auth.dto';
@@ -178,8 +179,6 @@ import { exclude } from '@waha/utils/reactive/ops/exclude';
 import { SingleDelayedJobRunner } from '@waha/utils/SingleDelayedJobRunner';
 import { SinglePeriodicJobRunner } from '@waha/utils/SinglePeriodicJobRunner';
 import { StatusTracker } from '@waha/utils/StatusTracker';
-import * as Buffer from 'buffer';
-import { Agent } from 'https';
 import * as lodash from 'lodash';
 import * as NodeCache from 'node-cache';
 import {
@@ -199,6 +198,7 @@ import { INowebStore } from './store/INowebStore';
 import { NowebPersistentStore } from './store/NowebPersistentStore';
 import { NowebStorageFactoryCore } from './store/NowebStorageFactoryCore';
 import { ensureNumber, extractMediaContent } from './utils';
+import { Agents } from '@waha/core/engines/noweb/types';
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const promiseRetry = require('promise-retry');
 
@@ -307,7 +307,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     await this.sock?.logout();
   }
 
-  getSocketConfig(agent, state): Partial<SocketConfig> {
+  getSocketConfig(agents: Agents | undefined, state): Partial<SocketConfig> {
     const fullSyncEnabled = this.sessionConfig?.noweb?.store?.fullSync || false;
     const browser = ['Ubuntu', 'Chrome', '20.0.04'] as WABrowserDescription;
     let markOnlineOnConnect = this.sessionConfig?.noweb?.markOnline;
@@ -315,8 +315,11 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
       markOnlineOnConnect = true;
     }
     return {
-      agent: agent,
-      fetchAgent: agent,
+      agent: agents?.socket,
+      // Baileys types still expect a Node https.Agent here,
+      // but 'undici' fetch requires a Dispatcher.
+      // Cast keeps the compiler satisfied while we pass the ProxyAgent at runtime.
+      fetchAgent: agents?.fetch as unknown as Agent,
       auth: state,
       printQRInTerminal: false,
       browser: browser,
@@ -346,9 +349,9 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
       this.authNOWEBStore = store;
     }
     const { state, saveCreds } = this.authNOWEBStore;
-    const agent = this.makeAgent();
+    const agents = this.makeProxyAgents();
     const socketConfig: SocketConfig = this.getSocketConfig(
-      agent,
+      agents,
       state,
     ) as SocketConfig;
     const sock = makeWASocket(socketConfig);
@@ -356,7 +359,7 @@ export class WhatsappSessionNoWebCore extends WhatsappSession {
     return sock;
   }
 
-  protected makeAgent(): Agent {
+  protected makeProxyAgents(): Agents | undefined {
     if (!this.proxyConfig) {
       return undefined;
     }
@@ -2633,37 +2636,6 @@ export class NOWEBEngineMediaProcessor implements IMediaEngineProcessor<any> {
   }
 }
 
-/**
- * Convert from 11111111111@s.whatsapp.net to 11111111111@c.us
- */
-export function toCusFormat(remoteJid) {
-  if (!remoteJid) {
-    return remoteJid;
-  }
-  if (isJidGroup(remoteJid)) {
-    return remoteJid;
-  }
-  if (isJidBroadcast(remoteJid)) {
-    return remoteJid;
-  }
-  if (isLidUser(remoteJid)) {
-    return remoteJid;
-  }
-  if (isJidNewsletter(remoteJid)) {
-    return remoteJid;
-  }
-  if (!remoteJid) {
-    return;
-  }
-  if (remoteJid == 'me') {
-    return remoteJid;
-  }
-  let number = remoteJid.split('@')[0];
-  // remove :{device} part
-  number = number.split(':')[0];
-  return ensureSuffix(number);
-}
-
 export const ALL_JID = 'all@s.whatsapp.net';
 
 /**

src/core/engines/noweb/types.ts

@@ -0,0 +1,7 @@
+import { Agent } from 'https';
+import type { Dispatcher } from 'undici';
+
+export interface Agents {
+  socket: Agent;
+  fetch: Dispatcher;
+}

src/core/helpers.proxy.ts

@@ -1,10 +1,11 @@
-import { Agent } from 'https';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { URL } from 'url';
+import { ProxyAgent } from 'undici';
 
 import { WhatsappConfigService } from '../config.service';
 import { ProxyConfig } from '../structures/sessions.dto';
 import { WhatsappSession } from './abc/session.abc';
+import { Agents } from '@waha/core/engines/noweb/types';
 
 export function getProxyConfig(
   config: WhatsappConfigService,
@@ -63,11 +64,15 @@ function getAuthenticatedUrl(
  * Return https Agent proxy for the config
  * @param proxyConfig
  */
-export function createAgentProxy(proxyConfig: ProxyConfig): Agent | undefined {
+export function createAgentProxy(proxyConfig: ProxyConfig): Agents | undefined {
   const url = getAuthenticatedUrl(
     proxyConfig.server,
     proxyConfig.username || '',
     proxyConfig.password || '',
   );
-  return new HttpsProxyAgent(url);
+
+  const socketAgent = new HttpsProxyAgent(url);
+  const fetchAgent = new ProxyAgent({ uri: url });
+
+  return { socket: socketAgent, fetch: fetchAgent };
 }

src/core/utils/jids.ts

@@ -1,4 +1,4 @@
-import type { WAMessageKey } from '@adiwajshing/baileys';
+import { jidNormalizedUser, WAMessageKey } from '@adiwajshing/baileys';
 import { ensureSuffix } from '@waha/core/abc/session.abc';
 
 export function isJidNewsletter(jid: string) {
@@ -135,14 +135,11 @@ export function toCusFormat(remoteJid) {
     return remoteJid;
   }
   if (isLidUser(remoteJid)) {
-    return remoteJid;
+    return jidNormalizedUser(remoteJid);
   }
   if (isJidNewsletter(remoteJid)) {
     return remoteJid;
   }
-  if (!remoteJid) {
-    return;
-  }
   if (remoteJid == 'me') {
     return remoteJid;
   }

src/main.ts

@@ -18,6 +18,9 @@ import { SwaggerConfiguratorCore } from './core/SwaggerConfiguratorCore';
 import { AllExceptionsFilter } from './nestjs/AllExceptionsFilter';
 import { getWAHAVersion, VERSION, WAHAVersion } from './version';
 import { loadESMModules } from '@waha/vendor/esm';
+import { setGlobalDispatcher, Agent } from 'undici';
+
+setGlobalDispatcher(new Agent({ connect: { family: 4 } }));
 
 const logger: Logger = pino({
   level: getPinoLogLevel(),

src/version.ts

@@ -30,7 +30,7 @@ export function getWAHAVersion(): WAHAVersion {
 }
 
 export const VERSION: WAHAEnvironment = {
-  version: '2025.10.2',
+  version: '2025.10.3',
   engine: getEngineName(),
   tier: getWAHAVersion(),
   browser:

tests/smoke/goss.yaml

@@ -4,4 +4,6 @@ http:
     allow-insecure: true
     no-follow-redirects: true
     timeout: 5000
+    request-headers:
+      - "X-Api-Key: test"
     body: ['version']

waha.config.json

@@ -2,11 +2,11 @@
   "waha": {
     "gows": {
       "repo": "devlikeapro/gows",
-      "ref": "v1.0.17"
+      "ref": "v1.0.18"
     },
     "dashboard": {
       "repo": "devlikeapro/dashboard",
-      "ref": "0d3523523e9d0e9d8aece8dec8a38b5fee23caad"
+      "ref": "583ee12cd77a95ca48c25dece822e3e9b4e01a23"
     }
   }
 }

yarn.lock

@@ -7,7 +7,7 @@ __metadata:
 
 "@adiwajshing/baileys@github:devlikeapro/Baileys#fork-master-2025-10-10":
   version: 7.0.0-rc.5
-  resolution: "@adiwajshing/baileys@https://github.com/devlikeapro/Baileys.git#commit=dad2730017ab6a24a48d3010796e8338928d0f43"
+  resolution: "@adiwajshing/baileys@https://github.com/devlikeapro/Baileys.git#commit=dc9b6b7589ba1d71ec85cff4a789b5709a60a714"
   dependencies:
     "@cacheable/node-cache": ^1.4.0
     "@hapi/boom": ^9.1.3
@@ -31,7 +31,7 @@ __metadata:
       optional: true
     link-preview-js:
       optional: true
-  checksum: 453dc477eee6c8df1d9aaaddcebfc5ce8b1cca72e958c6d7b742d0ef4afa3fcf1c6db06aba331d7a99596e64499af8e6ade81de0feadb4369fc567e74ddf7fa9
+  checksum: d79aca449353f170374e6647efe09a2e871219e0af176d62796f68860ad619ce715736380250521e304d3ca28c5af4baa397ee0a8875468f8c7ad026e95028b6
   languageName: node
   linkType: hard
 
@@ -8536,13 +8536,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"libsignal@github:devlikeapro/libsignal-node#fork-master":
+"libsignal@git+https://github.com/whiskeysockets/libsignal-node":
   version: 2.0.1
-  resolution: "libsignal@https://github.com/devlikeapro/libsignal-node.git#commit=83bc9236ee3d96ae1747cf3ca2e505b10cf97250"
+  resolution: "libsignal@https://github.com/whiskeysockets/libsignal-node.git#commit=e81ecfc32eb74951d789ab37f7e341ab66d5fff1"
   dependencies:
     curve25519-js: ^0.0.4
     protobufjs: 6.8.8
-  checksum: 3ee39bc7cbd123fa2c1f84ff53ab4e3dacfb5a00d10944960fd72156b24a5eb5af1fa5ca31b9f25b26aab107c712d8c295c85b0bed26ad6eba6d0e3f26f38927
+  checksum: bf7a7b93000c826958d3ba6de72545675d39579a7befff56e3db561d985267e402fdf485127f6f4b1c12855a99966867f28517123fbb4b882d7ef39e83057c3d
+  languageName: node
+  linkType: hard
+
+"libsignal@github:WhiskeySockets/libsignal-node#master":
+  version: 2.0.1
+  resolution: "libsignal@https://github.com/WhiskeySockets/libsignal-node.git#commit=e81ecfc32eb74951d789ab37f7e341ab66d5fff1"
+  dependencies:
+    curve25519-js: ^0.0.4
+    protobufjs: 6.8.8
+  checksum: bf7a7b93000c826958d3ba6de72545675d39579a7befff56e3db561d985267e402fdf485127f6f4b1c12855a99966867f28517123fbb4b882d7ef39e83057c3d
   languageName: node
   linkType: hard
 
@@ -12327,6 +12337,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"undici@npm:^7.16.0":
+  version: 7.16.0
+  resolution: "undici@npm:7.16.0"
+  checksum: dca60e323e44c2d408e0d1f5eb540632ad4e75631d5b6fcd7791876bab54e0e263a66e5606eaa717d436b2db5988c2f4af912dfa221ce53e3fc7fcb7d224c9cd
+  languageName: node
+  linkType: hard
+
 "unicorn-magic@npm:^0.3.0":
   version: 0.3.0
   resolution: "unicorn-magic@npm:0.3.0"
@@ -12558,7 +12575,7 @@ __metadata:
     joi: ^17.13.3
     knex: ^3.1.0
     libphonenumber-js: ^1.10.36
-    libsignal: "github:devlikeapro/libsignal-node#fork-master"
+    libsignal: "github:WhiskeySockets/libsignal-node#master"
     link-preview-js: ^3.0.4
     lodash: ^4.17.21
     long: ^5.3.2
@@ -12593,6 +12610,7 @@ __metadata:
     tsconfig-paths: ^4.1.0
     typescript: 5.9.2
     ulid: ^2.3.0
+    undici: ^7.16.0
     whatsapp-web.js: "github:devlikeapro/whatsapp-web.js#fork-main-2025-09-10"
     write-file-atomic: ^6.0.0
     yaml: ^2.7.1