@ardennguyen/zalo-agent-cli 2.5.9 → 3.0.0

package/src/core/sync-v2/assets.js

@@ -1,181 +0,0 @@
-/**
- * transfer-sync-v2 crypto/codec assets.
- *
- * Zalo Web decrypts sync batches with a wasm-bindgen module (`libzproto`) and
- * decodes them with google-protobuf ("jspb") message classes, both shipped in
- * its public web bundle. Rather than vendor Zalo's proprietary binary into this
- * package, we fetch those pieces from Zalo's own CDN on first use and cache the
- * extracted modules locally (they are ~350 KB total and change only when Zalo
- * ships a new web build). Everything runs in-process in Node — no browser.
- *
- * Pipeline these assets serve (see src/core/sync-v2/index.js):
- *   msgUrl bytes -> [u32 LE len][payload] chunk -> zproto decrypt
- *     (metadata: it.j(chunk, ikPub, ikPriv, ekPriv) -> sessionRecord + plaintext;
- *      message:  it.i(chunk, sessionRecord) -> plaintext)
- *   -> Zstd (node:zlib) -> protobuf SyncChunk.
- */
-import fs from "node:fs";
-import { resolve } from "node:path";
-import { createRequire } from "node:module";
-
-const require = createRequire(import.meta.url);
-const APP_ORIGIN = "https://chat.zalo.me";
-const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131 Safari/537.36";
-
-/** Extract one webpack module body `"<id>":function(A,e,t){...}` (or `<id>:function…`) by brace matching. */
-function extractModule(src, id) {
-    let start = src.indexOf(`"${id}":function(`);
-    let sliceFrom = start;
-    if (start < 0) {
-        start = src.indexOf(`${id}:function(`);
-        sliceFrom = start;
-    }
-    if (start < 0) throw new Error(`webpack module ${id} not found (Zalo web build changed?)`);
-    const braceStart = src.indexOf("{", src.indexOf("function(", start));
-    let depth = 0;
-    for (let i = braceStart; i < src.length; i++) {
-        const c = src[i];
-        if (c === "{") depth++;
-        else if (c === "}") {
-            depth--;
-            if (depth === 0) return src.slice(sliceFrom, i + 1);
-        }
-    }
-    throw new Error(`webpack module ${id} not brace-balanced`);
-}
-
-async function fetchText(url) {
-    const r = await fetch(url, { headers: { "User-Agent": UA } });
-    if (!r.ok) throw new Error(`GET ${url} -> ${r.status}`);
-    return r.text();
-}
-async function fetchBytes(url) {
-    const r = await fetch(url, { headers: { "User-Agent": UA } });
-    if (!r.ok) throw new Error(`GET ${url} -> ${r.status}`);
-    return Buffer.from(await r.arrayBuffer());
-}
-
-/**
- * Ensure the extracted assets exist under `cacheDir`, fetching from the CDN
- * once and caching by the web build's worker hash. Returns absolute paths.
- *
- * @param {string} cacheDir
- * @param {(m: string) => void} [log]
- * @returns {Promise<{dir: string, wasm: string, glue: string, pbMsg: string, pbConv: string}>}
- */
-export async function ensureAssets(cacheDir, log = () => {}) {
-    // Discover the sync-v2 worker filename from the app shell.
-    const html = await fetchText(`${APP_ORIGIN}/`);
-    const wm = /__SRC_SYNC_V2_WORKER__\s*=\s*'([^']+)'/.exec(html) || /(sync-v2-worker\.[0-9a-f]+\.js)/.exec(html);
-    if (!wm) throw new Error("could not locate sync-v2 worker in Zalo web shell");
-    const workerFile = wm[1];
-    const hash = (/\.([0-9a-f]{6,})\.js$/.exec(workerFile) || [, "unknown"])[1];
-    const dir = resolve(cacheDir, hash);
-    const paths = {
-        dir,
-        wasm: resolve(dir, "libzproto_bg.wasm"),
-        glue: resolve(dir, "vox7.glue.js"),
-        pbMsg: resolve(dir, "pb.message.js"),
-        pbConv: resolve(dir, "pb.conversation.js"),
-    };
-    if (
-        fs.existsSync(paths.wasm) &&
-        fs.existsSync(paths.glue) &&
-        fs.existsSync(paths.pbMsg) &&
-        fs.existsSync(paths.pbConv)
-    )
-        return paths;
-
-    log(`fetching transfer-sync-v2 assets (build ${hash}) from ${APP_ORIGIN}…`);
-    fs.mkdirSync(dir, { recursive: true });
-    const worker = await fetchText(`${APP_ORIGIN}/${workerFile}`);
-    // The libzproto glue module id used by Zalo web is "Vox7"; message/conversation protobufs are "1y5R"/"Ho1Y".
-    fs.writeFileSync(paths.glue, extractModule(worker, "Vox7"));
-    fs.writeFileSync(paths.pbMsg, extractModule(worker, "1y5R"));
-    fs.writeFileSync(paths.pbConv, extractModule(worker, "Ho1Y"));
-    const wasmRef = /libs\/libzproto_wasm_bg\.[0-9a-f]+\.wasm/.exec(worker);
-    if (!wasmRef) throw new Error("could not locate libzproto wasm filename in worker");
-    fs.writeFileSync(paths.wasm, await fetchBytes(`${APP_ORIGIN}/${wasmRef[0]}`));
-    log(`cached sync-v2 assets in ${dir}`);
-    return paths;
-}
-
-function stripModulePrefix(src, id) {
-    src = src.trim();
-    if (src.startsWith(`"${id}":`)) return src.slice(`"${id}":`.length);
-    if (src.startsWith(`${id}:`)) return src.slice(`${id}:`.length);
-    return src;
-}
-
-/** Minimal webpack __webpack_require__ shim covering what these modules use. */
-function makeRequire(extra) {
-    const t = (id) => {
-        if (id === "yLpj") return globalThis; // webpack global helper
-        if (id === "3UD+") return (m) => m; // wasm default-path helper (unused; we pass bytes)
-        if (id === "hRO2") return require("google-protobuf"); // jspb + goog runtime
-        if (id === "N3ek") return {}; // base proto namespace
-        if (extra && extra[id]) return extra[id];
-        throw new Error(`sync-v2 asset required an unmocked webpack module: ${id}`);
-    };
-    t.d = (e, name, getter) => {
-        if (!Object.prototype.hasOwnProperty.call(e, name))
-            Object.defineProperty(e, name, { enumerable: true, get: getter });
-    };
-    t.r = () => {};
-    t.n = (m) => () => m;
-    t.o = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
-    return t;
-}
-
-function runModule(srcFile, id) {
-    const src = stripModulePrefix(fs.readFileSync(srcFile, "utf8"), id);
-    const factory = (0, eval)("(" + src + ")");
-    const mod = { exports: {} };
-    factory(mod, mod.exports, makeRequire());
-    return mod.exports;
-}
-
-/**
- * Load the crypto (WASM) + protobuf codecs from cached assets.
- *
- * @param {{wasm: string, glue: string, pbMsg: string, pbConv: string}} paths
- * @returns {Promise<{zproto: object, M: object, C: object}>}
- */
-export async function loadCodecs(paths) {
-    // ---- libzproto WASM via the Vox7 wasm-bindgen glue ----
-    const it = runModule(paths.glue, "Vox7");
-    await it.b(fs.readFileSync(paths.wasm)); // e.b = init(module_or_path); accepts raw bytes
-    const u8 = (x) => (x instanceof Uint8Array ? x : new Uint8Array(x));
-    const zproto = {
-        generateKeyPair() {
-            const a = it.e();
-            const out = { publicKey: Buffer.from(a.publicKey.slice()), privateKey: Buffer.from(a.privateKey.slice()) };
-            a.free();
-            return out;
-        },
-        decryptMetadata(metaChunk, ikPub, ikPriv, ekPriv) {
-            const r = it.j(u8(metaChunk), u8(ikPub), u8(ikPriv), u8(ekPriv));
-            const out = {
-                plaintext: Buffer.from(r.plaintext.slice()),
-                sessionRecord: Buffer.from(r.sessionRecord.slice()),
-            };
-            r.free();
-            return out;
-        },
-        decryptMessage(msgChunk, sessionRecord) {
-            const r = it.i(u8(msgChunk), u8(sessionRecord));
-            const out = { plaintext: Buffer.from(r.plaintext.slice()) };
-            r.free();
-            return out;
-        },
-    };
-
-    // ---- protobuf (jspb) codecs; they register on a global `proto` namespace ----
-    if (!globalThis.proto) globalThis.proto = {};
-    runModule(paths.pbMsg, "1y5R");
-    runModule(paths.pbConv, "Ho1Y");
-    const M = globalThis.proto?.Sync2?.Message;
-    const C = globalThis.proto?.Sync2?.Conversation;
-    if (!M?.SyncChunk || !C?.SyncChunk) throw new Error("sync-v2 protobuf codecs failed to load");
-    return { zproto, M, C };
-}

package/src/core/sync-v2/gid.js

@@ -1,106 +0,0 @@
-/**
- * Tier-3 conversation-id resolution — the same path Zalo Web uses for peers not
- * in the local friend/group cache.
- *
- * A synced conversation is keyed by an opaque "global noised id". Friends and
- * current groups are resolved from their lists (both carry `globalId`). Everyone
- * else — non-friend 1-1s, OA/bot accounts — falls back to Zalo's profile server:
- *
- *   GET {profileDomain}/api/gid/decrypt   (cmd 12054)
- *     params = AES({ globalUids: JSON.stringify([id, …]) })
- *     -> { <globalNoisedId>: <userId> }
- *
- * We then batch `getUserInfo(userIds)` for display names. Left groups have no
- * per-item endpoint server-side, so they stay unresolved (matches Zalo Web).
- *
- * Built on zca-js's own request/crypto (`apiFactory` + bound `utils`) so the
- * authenticated envelope is exactly what the profile API expects; zca-js is
- * located via `require.resolve` so this survives whatever node_modules layout.
- */
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-import { runPacedBatches } from "../user-info.js";
-
-const require = createRequire(import.meta.url);
-
-let _utils = null;
-/** zca-js's internal utils (apiFactory/makeURL/encodeAES/request), located robustly. */
-function zcaUtils() {
-    if (_utils) return _utils;
-    _utils = require(join(dirname(require.resolve("zca-js")), "utils.cjs"));
-    return _utils;
-}
-
-const GID_BATCH = 50;
-const NAME_BATCH = 100;
-
-/** Build the authenticated `/api/gid/decrypt` caller bound to this session. */
-function makeGidDecrypt(api) {
-    const zu = zcaUtils();
-    const base = `${api.zpwServiceMap.profile[0]}/api/gid/decrypt`;
-    return zu.apiFactory()((_api, ctx, utils) => async (globalIds) => {
-        const enc = utils.encodeAES(JSON.stringify({ globalUids: JSON.stringify(globalIds), imei: ctx.imei }));
-        if (!enc) throw new Error("failed to encrypt gid params");
-        const resp = await utils.request(utils.makeURL(base, { params: enc }), { method: "GET" });
-        const result = await utils.resolve(resp);
-        // response shape: resolve() -> { data: { <globalId>: <userId> } } (or the map directly)
-        return result && typeof result.data === "object" ? result.data : result || {};
-    })(api.getContext(), api);
-}
-
-/**
- * Resolve opaque 1-1 global-noised ids to real numeric user ids + names.
- *
- * @param {object} api - logged-in zca-js api
- * @param {string[]} globalIds - the 32-char ids (partition without the `oneone/` prefix)
- * @param {(m: string) => void} [log]
- * @returns {Promise<Map<string, {id: string, name: string}>>} globalId -> {id, name}
- */
-export async function resolveNonFriendDms(api, globalIds, log = () => {}) {
-    const out = new Map();
-    if (!globalIds || !globalIds.length) return out;
-
-    // 1. globalId -> userId via /api/gid/decrypt (cmd 12054), batched.
-    let gidDecrypt;
-    try {
-        gidDecrypt = makeGidDecrypt(api);
-    } catch (e) {
-        log(`gid/decrypt unavailable (${e.message}); non-friend 1-1s stay opaque`);
-        return out;
-    }
-    const idToUser = new Map();
-    const decrypted = await runPacedBatches(globalIds, {
-        batchSize: GID_BATCH,
-        label: "gid/decrypt",
-        log,
-        call: (batch) => gidDecrypt(batch),
-    });
-    for (const map of decrypted.results) {
-        for (const [gid, uid] of Object.entries(map || {})) if (uid) idToUser.set(gid, String(uid));
-    }
-    if (!idToUser.size) return out;
-
-    // 2. userId -> display name via getUserInfo (batched). Best-effort.
-    const names = new Map();
-    const zaloNames = new Map();
-    const uids = [...new Set([...idToUser.values()])];
-    const named = await runPacedBatches(uids, {
-        batchSize: NAME_BATCH,
-        label: "getUserInfo",
-        log,
-        call: (batch) => api.getUserInfo(batch),
-    });
-    for (const info of named.results) {
-        for (const bag of [info?.changed_profiles, info?.unchanged_profiles]) {
-            for (const [uid, p] of Object.entries(bag || {})) {
-                if (!names.has(uid) && p) names.set(uid, p.zaloName || p.displayName || "");
-                if (p?.zaloName) zaloNames.set(uid, p.zaloName);
-            }
-        }
-    }
-    if (named.failed || named.skippedIds) log("some names may be blank (getUserInfo did not answer for every batch)");
-
-    for (const [gid, uid] of idToUser)
-        out.set(gid, { id: uid, name: names.get(uid) || "", zaloName: zaloNames.get(uid) || "" });
-    return out;
-}

package/src/core/sync-v2/keepalive.js

@@ -1,177 +0,0 @@
-/**
- * WebSocket heartbeat for the long idle windows in the socket stages.
- *
- * WHY THIS EXISTS, and why it is not `api.keepAlive()`
- * ---------------------------------------------------
- * zca-js exposes `api.keepAlive()`, which looks like the obvious instrument and
- * is the wrong one: it is an HTTP GET to `<chat host>/keepalive`
- * (`apis/keepAlive.js`). It touches the session, never the socket, so it cannot
- * keep a WebSocket flow warm.
- *
- * What actually keeps this socket warm is Zalo's own application-level ping --
- * `cmd 2 / subCmd 1` carrying `{eventId}`, which the server echoes back
- * verbatim. zca-js already sends it, on an interval the server hands out at
- * login (`settings.features.socket.ping_interval`, measured at **180000 ms**
- * for this account -- the same value a captured Zalo Web session used).
- *
- * So the socket is not unpinged. It is pinged every three minutes, which leaves
- * two problems this module fixes:
- *
- *   1. **Three minutes is the whole idle window.** A restore waiting on the
- *      phone sends nothing and receives nothing for up to the full wait budget,
- *      so the flow can sit silent right up to the server's own liveness bound
- *      with no margin. One late ping means six minutes of silence.
- *   2. **The interval is armed once, on the cipher-key frame, and never
- *      re-phased.** `setInterval` also queues catch-up work when the event loop
- *      blocks -- and the decode/store phase does block it.
- *
- * This sends the same frame Zalo Web sends, on a shorter interval, using a
- * self-rescheduling timer (no catch-up burst after a blocked loop), and counts
- * the echoes so a caller can say how long the socket had been silent before it
- * dropped. It never closes the socket on its own: a missed echo is evidence,
- * not a verdict.
- */
-
-/** Zalo's heartbeat frame: `cmd 2 / subCmd 1`, body `{eventId}`. */
-export const PING_CMD = 2;
-export const PING_SUBCMD = 1;
-
-/** What the server advises, and what zca-js and Zalo Web both use. */
-export const SERVER_PING_INTERVAL_MS = 180000;
-
-/**
- * A third of the server's own interval: three chances to keep the flow warm
- * inside the window the server itself still considers alive, instead of one.
- */
-export const DEFAULT_KEEPALIVE_MS = 60000;
-
-/** Never ping faster than this, whatever a caller asks for. */
-export const MIN_KEEPALIVE_MS = 15000;
-
-/**
- * Clamp a requested heartbeat interval into a sane range.
- *
- * @param {number|undefined} ms - requested interval
- * @returns {number} a finite interval between MIN_KEEPALIVE_MS and the server's own
- */
-export function resolveKeepAliveInterval(ms) {
-    if (!Number.isFinite(ms) || ms <= 0) return DEFAULT_KEEPALIVE_MS;
-    return Math.min(SERVER_PING_INTERVAL_MS, Math.max(MIN_KEEPALIVE_MS, ms));
-}
-
-/**
- * The ping payload, in the shape `Listener.sendWs` expects.
- *
- * @param {number} [now=Date.now()] - the eventId the server echoes back
- * @returns {{version: number, cmd: number, subCmd: number, data: {eventId: number}}}
- */
-export function pingPayload(now = Date.now()) {
-    return { version: 1, cmd: PING_CMD, subCmd: PING_SUBCMD, data: { eventId: now } };
-}
-
-/**
- * True for a raw frame that is a `cmd 2 / subCmd 1` heartbeat echo.
- *
- * @param {Buffer} buf - a raw socket frame
- * @returns {boolean}
- */
-export function isPingEcho(buf) {
-    return Buffer.isBuffer(buf) && buf.length >= 4 && buf.readUInt16LE(1) === PING_CMD && buf[3] === PING_SUBCMD;
-}
-
-/**
- * Start pinging a listener's socket until the returned stop function is called.
- *
- * The timer is unref'd, so it can never hold the process open, and it stops
- * rescheduling once the socket is gone -- `sendWs` is a silent no-op on a null
- * socket, so a running timer on a dead wire would just spin.
- *
- * @param {object} listener - a zca-js Listener (needs `sendWs` and `ws`)
- * @param {object} [opts]
- * @param {number} [opts.intervalMs] - heartbeat interval; clamped
- * @param {(info: {sent: number, echoed: number}) => void} [opts.onPing] - called after each ping
- * @param {() => number} [opts.now=Date.now] - injectable clock
- * @param {{setTimeout: Function, clearTimeout: Function}} [opts.timers] - injectable scheduler
- * @returns {{stop: () => void, stats: () => {sent: number, echoed: number, intervalMs: number, silentMs: number}}}
- */
-export function startKeepAlive(listener, opts = {}) {
-    const intervalMs = resolveKeepAliveInterval(opts.intervalMs);
-    const now = typeof opts.now === "function" ? opts.now : Date.now;
-    const timers = opts.timers || { setTimeout, clearTimeout };
-    const onPing = typeof opts.onPing === "function" ? opts.onPing : () => {};
-
-    let sent = 0;
-    let echoed = 0;
-    let lastEchoAt = now();
-    let handle = null;
-    let stopped = false;
-
-    // The echo tap goes on the RAW socket, and a reconnect replaces that object
-    // -- so the tap follows the socket rather than being pinned to the one that
-    // was there at startup. Without this a keepalive held across a reconnect
-    // would keep pinging (sendWs reads `listener.ws` fresh) while silently
-    // counting no echoes at all, which is exactly the signal it exists to give.
-    const onFrame = (buf) => {
-        if (!isPingEcho(buf)) return;
-        echoed++;
-        lastEchoAt = now();
-    };
-    let tapped = null;
-    const retap = () => {
-        const ws = listener?.ws;
-        if (ws === tapped) return;
-        try {
-            tapped?.off?.("message", onFrame);
-        } catch {
-            /* the old socket is gone; nothing to detach */
-        }
-        tapped = ws || null;
-        try {
-            tapped?.on?.("message", onFrame);
-        } catch {
-            /* a socket shape without events still gets pinged, just uncounted */
-        }
-    };
-    retap();
-
-    const tick = () => {
-        if (stopped) return;
-        // A closed socket cannot be kept alive, and zca-js nulls `ws` on close,
-        // so an absent socket is just as dead as a CLOSING/CLOSED one.
-        if (!listener?.ws || listener.ws.readyState > 1) return;
-        retap();
-        try {
-            listener.sendWs(pingPayload(now()), false);
-            sent++;
-            onPing({ sent, echoed });
-        } catch {
-            /* a send on a dying socket is not worth failing the run over */
-        }
-        schedule();
-    };
-
-    // setTimeout chaining, not setInterval: a blocked event loop must not queue
-    // a burst of catch-up pings the moment it frees up.
-    const schedule = () => {
-        handle = timers.setTimeout(tick, intervalMs);
-        if (typeof handle?.unref === "function") handle.unref();
-    };
-    schedule();
-
-    return {
-        stop() {
-            stopped = true;
-            if (handle) timers.clearTimeout(handle);
-            handle = null;
-            try {
-                tapped?.off?.("message", onFrame);
-            } catch {
-                /* already torn down */
-            }
-            tapped = null;
-        },
-        stats() {
-            return { sent, echoed, intervalMs, silentMs: now() - lastEchoAt };
-        },
-    };
-}