Pairing: handle companion_reg_refresh (Baileys patch, pending a live check)

Dockerfile

@@ -12,6 +12,8 @@ WORKDIR /evolution
 COPY ./package*.json ./
 COPY ./tsconfig.json ./
 COPY ./tsup.config.ts ./
+# npm ci's postinstall (patch-package) applies these to node_modules.
+COPY ./patches ./patches
 
 RUN npm ci --silent
 

FORK.md

@@ -32,6 +32,7 @@ A fix without a failing test first is not merged here. See `AGENTS.md`.
   against Evolution Foundation's server and breaks `POST /instance/create`.
 - Baileys pinned to `7.0.0-rc14` (2.3.7 ships rc.9, which is inside the range
   of CVE-2026-48063).
+  It runs with `patches/baileys+7.0.0-rc14.patch` applied (pairing, below).
 
 ## Changes from 2.3.7
 
@@ -73,6 +74,7 @@ named where one exists.
 - Session files on disk are replaced whole, never written in place: each signal key file of the Prisma auth store (keys live under INSTANCE_DIR next to creds in the database) and the pending-logout marker go to a temp file in the same directory, are flushed, renamed over the target and the directory flushed. A process killed mid-write, a full disk or two writes of one key at once used to leave a torn or empty file, and a key file that does not parse reads as no key; tested by SIGKILLing a writer at random moments (half the files torn or empty before, none after). A failed write keeps the previous file and rejects; writes of one file run in call order; a temp file a killed writer left is removed when the store next opens. The provider-files store writes on its own server and Redis holds no files, so neither is covered.
 - Profile pictures are looked up once per contact per hour, at most four at a time, and history never waits on them (#1883). The picture update a history batch sends carries each contact's newest name, and a lookup that finishes after WhatsApp said the picture changed or was removed is dropped.
 - One pairing code per connect attempt, and a fresh QR budget per attempt (#2100, #2696).
+- A new device can be linked again. Since about 2026-07-28 WhatsApp sends a `companion_reg_refresh` notification during pairing, which retires the adv secret the QR advertises; Baileys 7.0.0-rc14 dropped it (its ack even threw before login), so the phone showed "Couldn't link device" and the QR refs ran out (Baileys #2737). Baileys now mints a new adv secret, stores it and re-renders the QR on screen with it, spending no ref, and acks the notification. Linking with a code keeps the adv secret the code exchange derives, and a `link_code_companion_reg` notification with no pairing data no longer fails with 'Invalid buffer' (Baileys #2600). No Baileys release has these fixes, so the fork carries them as `patches/baileys+7.0.0-rc14.patch`, applied by patch-package on `npm install` and `npm ci` (the Docker build included), and a test fails when the Baileys under test lacks it. The patch is the one vendored in #2727 by Clovis Coli Jr, which compiles Baileys #2765 (doryani-ai) and #2602 (joivo), plus the one-line ack fix of Baileys #2749 (IamYGT). Tested against a local WhatsApp that plays the phone's side of both flows; not yet checked against a real phone.
 
 **Live checks**
 - A live check against a real phone can be recorded (`LIVE_RECORD_DIR`; the QR, its image and pairing codes are never written), scrubbed into a fixture, and replayed through the real event buffer and service in a test. The scrubber keeps a value as written only under a field it lists with a value that field is known to take, and stops on a field it does not know; its leak gate searches the output for every raw value that is not structure; a guard scans every committed fixture. None of them recognises a name the scrubber mistook for structure, so a person still reads every new fixture. A replay compares the webhooks' content, not their order or the pictures, and runs on events already decoded: it shows what Evolution does with what WhatsApp sent, not the encryption or the timing around it. The protocol, the check catalogue and the results log are in `docs/LIVE-CHECKS.md`.

package.json

@@ -20,6 +20,7 @@
     "db:studio": "node runWithProvider.js \"npx prisma studio --schema ./prisma/DATABASE_PROVIDER-schema.prisma\"",
     "db:migrate:dev": "node runWithProvider.js \"rm -rf ./prisma/migrations && cp -r ./prisma/DATABASE_PROVIDER-migrations ./prisma/migrations && npx prisma migrate dev --schema ./prisma/DATABASE_PROVIDER-schema.prisma && cp -r ./prisma/migrations/* ./prisma/DATABASE_PROVIDER-migrations\"",
     "db:migrate:dev:win": "node runWithProvider.js \"xcopy /E /I prisma\\DATABASE_PROVIDER-migrations prisma\\migrations && npx prisma migrate dev --schema prisma\\DATABASE_PROVIDER-schema.prisma\"",
+    "postinstall": "patch-package --error-on-fail",
     "prepare": "husky",
     "test:watch": "vitest"
   },
@@ -154,6 +155,7 @@
     "eslint-plugin-simple-import-sort": "^12.1.1",
     "husky": "^9.1.7",
     "lint-staged": "^16.1.6",
+    "patch-package": "^8.0.1",
     "prettier": "^3.4.2",
     "tsconfig-paths": "^4.2.0",
     "tsx": "^4.20.5",