@eryxenx/fca 1.0.0 → 1.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eryxenx/fca",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "Facebook Chat API by EryXenX | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free",
   "main": "index.js",
   "types": "index.d.ts",

package/src/api/action/dismissScrapingWarning.js

@@ -0,0 +1,50 @@
+"use strict";
+
+const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
+
+module.exports = function (defaultFuncs, api, ctx) {
+  return function dismissScrapingWarning(callback) {
+    let resolveFunc = function () {};
+    let rejectFunc = function () {};
+    const returnPromise = new Promise(function (resolve, reject) {
+      resolveFunc = resolve;
+      rejectFunc = reject;
+    });
+
+    if (!callback) {
+      callback = function (err, data) {
+        if (err) return rejectFunc(err);
+        resolveFunc(data);
+      };
+    }
+
+    const form = {
+      av: ctx.userID,
+      __user: ctx.userID,
+      fb_dtsg: ctx.fb_dtsg || "",
+      fb_api_caller_class: "RelayModern",
+      fb_api_req_friendly_name: "FBScrapingWarningMutation",
+      server_timestamps: "true",
+      doc_id: "24406519995698862",
+      variables: "{}"
+    };
+
+    defaultFuncs
+      .post("https://www.facebook.com/api/graphql/", ctx.jar, form)
+      .then(parseAndCheckLogin(ctx, defaultFuncs))
+      .then(function (resData) {
+        if (resData && resData.errors) throw resData;
+        log.info("dismissScrapingWarning", "Dismissed automated-behavior warning");
+        return callback(null, { success: true });
+      })
+      .catch(function (err) {
+        // Non-fatal: worst case the warning just stays on-screen, same as
+        // if a human never tapped Dismiss.
+        log.warn("dismissScrapingWarning", err && err.message ? err.message : String(err));
+        return callback(err);
+      });
+
+    return returnPromise;
+  };
+};

package/src/api/socket/e2ee/index.js

@@ -212,21 +212,7 @@ class E2EEBridge {
             }
 
             const isReply = !!(msg.replyTo && msg.replyTo.messageId);
-            if (isReply) {
-                try {
-                    console.log("[E2EE-DEBUG] msg.replyTo raw:", JSON.stringify(msg.replyTo, (k, v) => typeof v === "bigint" ? v.toString() : Buffer.isBuffer(v) ? `<Buffer ${v.length}b>` : v));
-                } catch (_) { console.log("[E2EE-DEBUG] msg.replyTo (raw, non-serializable):", msg.replyTo); }
-            }
-            if (msg.kind && msg.kind !== "text") {
-                try {
-                    console.log("[E2EE-DEBUG] msg.kind=" + msg.kind + " msg.media keys:", msg.media ? Object.keys(msg.media) : null);
-                } catch (_) {}
-            }
             if (msg.kind === "reaction") {
-                try {
-                    console.log("[E2EE-DEBUG] FULL reaction msg dump:", JSON.stringify(msg, (k, v) => typeof v === "bigint" ? v.toString() : Buffer.isBuffer(v) ? `<Buffer ${v.length}b>` : v, 2));
-                } catch (_) { console.log("[E2EE-DEBUG] FULL reaction msg (non-serializable):", msg); }
-
                 this._messageCallback(null, {
                     type: "message_reaction",
                     threadID: normalizedThreadId,
@@ -324,7 +310,6 @@ class E2EEBridge {
         // Incoming E2EE reactions — needed for onReaction handlers (e.g. a
         // reaction-triggered unsend feature) to fire in encrypted threads.
         this.client.onEvent("e2ee_reaction", (r) => {
-            console.log("[E2EE-DEBUG] e2ee_reaction fired:", JSON.stringify(r, (k, v) => typeof v === "bigint" ? v.toString() : v));
             if (!this._messageCallback) return;
             const threadID = r.chatJid ? String(r.chatJid).split("@")[0].split(".")[0] : "";
             const senderID = r.senderId || (r.senderJid ? String(r.senderJid).split(".")[0] : "");
@@ -356,23 +341,6 @@ class E2EEBridge {
         this.connected = true;
         logger.success("E2EE", "E2EE active — Signal Protocol / Noise WebSocket (vendored)");
 
-        // Diagnostic: log memory + internal cache sizes every 10 min so a
-        // future OOM can be correlated against actual growth data instead of
-        // guessing which structure is leaking.
-        if (!this._memDiagInterval) {
-            this._memDiagInterval = setInterval(() => {
-                try {
-                    const mem = process.memoryUsage();
-                    const fmtMB = (b) => (b / 1024 / 1024).toFixed(1) + "MB";
-                    console.log(`[MEM-DIAG] rss=${fmtMB(mem.rss)} heapUsed=${fmtMB(mem.heapUsed)} heapTotal=${fmtMB(mem.heapTotal)} external=${fmtMB(mem.external)} arrayBuffers=${fmtMB(mem.arrayBuffers || 0)}`);
-                    console.log(`[MEM-DIAG] caches: mediaCache=${this._mediaCache ? this._mediaCache.size : 0} msgThreadMap=${this._msgThreadMap ? this._msgThreadMap.size : 0} msgTextCache=${this._msgTextCache ? this._msgTextCache.size : 0} senderJidMap=${this._senderJidMap ? this._senderJidMap.size : 0} seenGroupMsgIds=${this._seenGroupMsgIds ? this._seenGroupMsgIds.size : 0} knownThreads=${this._knownE2EEThreads ? this._knownE2EEThreads.size : 0} knownGroups=${this._knownE2EEGroups ? this._knownE2EEGroups.size : 0} localMediaServerCache=${localMediaServer.getCacheSize()}`);
-                } catch (err) {
-                    console.log("[MEM-DIAG] logging failed:", err && err.message ? err.message : err);
-                }
-            }, 10 * 60 * 1000);
-            this._memDiagInterval.unref();
-        }
-
         // GROUP E2EE only: the vendor engine's own group Sender-Key decrypt
         // has an unresolved bug (repeated "missing sender key state" /
         // "ciphertext version too old" errors). The native mautrix-go engine
@@ -566,8 +534,6 @@ class E2EEBridge {
 
             const dims = mimeType.startsWith("image/") ? _getImageDimensions(data, mimeType) : null;
 
-            console.log(`[E2EEBridge] sendMessage attachment (native engine): fileName=${fileName}, mimeType=${mimeType}, size=${data.length} bytes, dims=${dims ? dims.width + "x" + dims.height : "n/a"}, threadId=${threadId}`);
-
             let mediaType;
             if (mimeType.startsWith("image/")) mediaType = "image";
             else if (mimeType.startsWith("video/")) mediaType = "video";
@@ -606,9 +572,6 @@ class E2EEBridge {
                 else if (mediaType === "audio") result = await this.client.sendAudio(input);
                 else result = await this.client.sendFile(input);
             }
-            try {
-                console.log(`[E2EEBridge] send result:`, JSON.stringify(result, (k, v) => typeof v === "bigint" ? v.toString() : v));
-            } catch (_) { console.log(`[E2EEBridge] send result (non-serializable):`, result); }
             if (result && result.messageId) {
                 boundedSet(this._msgThreadMap, String(result.messageId), threadId, 500);
                 // Cache our own sent media so replies to it (e.g. "/imgur" replying

package/src/api/socket/sendMessage.js

@@ -2,6 +2,7 @@
 
 var utils = require("../../utils/nexca-utils");
 var logger = require("../../utils/nexca-logger");
+var { globalAntiSuspension } = require("../../utils/antiSuspension");
 
 var ALLOWED = {
     attachment: true, url: true, sticker: true, emoji: true,
@@ -244,6 +245,19 @@ module.exports = function (defaultFuncs, api, ctx) {
             isSingleUser = ctx.threadTypes[String(threadID)] === 'dm';
         }
 
+        // Rate-limit / pace / circuit-break outbound sends to avoid looking
+        // like automated bulk traffic to Facebook. Opt-out via
+        // globalOptions.antiBan === false; on by default. This never throws
+        // in normal operation (it only adds delay), the try/catch is
+        // defensive so a bug in here can never block a real send.
+        if (!ctx.globalOptions || ctx.globalOptions.antiBan !== false) {
+            try {
+                await globalAntiSuspension.prepareBeforeMessage(threadID, msg.body || "");
+            } catch (err) {
+                logger("AntiSuspension prepareBeforeMessage error: " + (err && err.message ? err.message : err), "warn");
+            }
+        }
+
         // DM sends on E2EE threads — skip MQTT entirely, always.
         // Facebook does not deliver plaintext MQTT bodies into an E2EE (Signal Protocol)
         // thread — this applies to TEXT replies just as much as attachments. Previously
@@ -266,6 +280,7 @@ module.exports = function (defaultFuncs, api, ctx) {
                 if (callback) callback(null, wrapped);
                 else resolve(wrapped);
             } catch (e2eeErr) {
+                globalAntiSuspension.checkAccountHealth(e2eeErr);
                 logger.error("sendMessage", "E2EE DM send failed: " + (e2eeErr.message || e2eeErr));
                 if (callback) callback(e2eeErr);
                 else reject(e2eeErr);
@@ -283,6 +298,7 @@ module.exports = function (defaultFuncs, api, ctx) {
                 if (callback) callback(null, omResult);
                 else resolve(omResult);
             } catch (omErr) {
+                globalAntiSuspension.checkAccountHealth(omErr);
                 logger.error("sendMessage", "DM attachment via OldMessage failed: " + (omErr.error || omErr.message || omErr));
                 if (callback) callback(omErr);
                 else reject(omErr);
@@ -303,6 +319,7 @@ module.exports = function (defaultFuncs, api, ctx) {
                 if (callback) callback(null, fbResult);
                 else resolve(fbResult);
             } catch (fbErr) {
+                globalAntiSuspension.checkAccountHealth(fbErr);
                 logger.error("sendMessage", fbErr.error || fbErr.message || fbErr);
                 if (callback) callback(fbErr);
                 else reject(fbErr);

package/src/utils/antiSuspension.js

@@ -0,0 +1,219 @@
+"use strict";
+
+const log = {
+    warn: (tag, msg) => console.warn(`[${tag}] ${msg}`),
+    info: (tag, msg) => console.log(`[${tag}] ${msg}`)
+};
+
+// Phrases Facebook responses use when it thinks this account is being
+// operated by a bot / script rather than a human. If any of these show up
+// in a response body or an error message, we treat it as a signal that
+// current traffic looks automated and should slow down / back off.
+const SUSPICION_PHRASES = [
+    "checkpoint",
+    "automated behavior",
+    "automated_behavior",
+    "unusual activity",
+    "unusual_activity",
+    "suspicious activity",
+    "action_required",
+    "account_locked",
+    "account locked",
+    "account has been disabled",
+    "account has been suspended",
+    "account suspended",
+    "account banned",
+    "bot detected",
+    "bot_detected",
+    "not a human",
+    "spam detected",
+    "spam_detected",
+    "looks like spam",
+    "rate limited",
+    "rate_limit",
+    "too many requests",
+    "too_many_requests",
+    "temporarily blocked",
+    "feature temporarily unavailable",
+    "verify your account",
+    "confirm your identity",
+    "confirm it's you",
+    "security check required",
+    "policy violation",
+    "action blocked",
+    "you're blocked from"
+];
+
+/**
+ * Tracks send volume and paces outbound traffic so it doesn't look like a
+ * script firing messages as fast as the network allows. Three layers:
+ *
+ *  - Pacing: a small delay before every send, and a slightly larger one
+ *    between consecutive sends to the same thread.
+ *  - Volume caps: soft hourly/daily ceilings; a fresh login starts under a
+ *    stricter "warmup" ceiling for a while before easing to the normal one.
+ *  - Cooldown: if Facebook's response text matches a suspicion phrase (or
+ *    a send throws an error containing one), sending gets throttled harder
+ *    for a while instead of continuing at full speed.
+ */
+class SendPacer {
+    constructor() {
+        this.perThreadLastSendAt = new Map();
+        this.threadSendCounts = new Map();
+
+        this.startedAt = Date.now();
+        this.warmupWindowMs = 15 * 60 * 1000;
+        this.warmupHourlyCap = 40;
+        this.normalHourlyCap = 350;
+        this.dailyCap = 2500;
+
+        this.hourWindowStart = Date.now();
+        this.hourSendCount = 0;
+        this.dayWindowStart = Date.now();
+        this.daySendCount = 0;
+
+        this.cooldown = {
+            active: false,
+            since: null,
+            durationMs: 45 * 60 * 1000,
+            strikes: 0,
+            strikesToActivate: 2
+        };
+
+        this._gcTimer = setInterval(() => this._rollWindows(), 60 * 1000);
+        if (this._gcTimer.unref) this._gcTimer.unref();
+    }
+
+    destroy() {
+        if (this._gcTimer) clearInterval(this._gcTimer);
+    }
+
+    _rollWindows() {
+        const now = Date.now();
+        if (now - this.hourWindowStart >= 60 * 60 * 1000) {
+            this.hourWindowStart = now;
+            this.hourSendCount = 0;
+        }
+        if (now - this.dayWindowStart >= 24 * 60 * 60 * 1000) {
+            this.dayWindowStart = now;
+            this.daySendCount = 0;
+        }
+    }
+
+    _inWarmup() {
+        return (Date.now() - this.startedAt) < this.warmupWindowMs;
+    }
+
+    _hourlyCap() {
+        return this._inWarmup() ? this.warmupHourlyCap : this.normalHourlyCap;
+    }
+
+    /** Records that a suspicious signal was seen; may activate the cooldown. */
+    noteSuspicionSignal(source) {
+        this.cooldown.strikes++;
+        if (!this.cooldown.active && this.cooldown.strikes >= this.cooldown.strikesToActivate) {
+            this.cooldown.active = true;
+            this.cooldown.since = Date.now();
+            log.warn("AntiSuspension", `Cooldown activated after repeated suspicion signals (last: ${source || "unknown"}). Backing off for ${(this.cooldown.durationMs / 60000).toFixed(0)} min.`);
+        }
+    }
+
+    /** Same check, but scans free text (an API response body, an error message). */
+    scanForSuspicion(text) {
+        if (!text || typeof text !== "string") return false;
+        const lower = text.toLowerCase();
+        const hit = SUSPICION_PHRASES.find(p => lower.includes(p));
+        if (hit) this.noteSuspicionSignal(hit);
+        return !!hit;
+    }
+
+    /** Inspects a thrown error's message for suspicion phrases. */
+    noteSendError(err) {
+        const msg = (err && (err.message || err.error)) ? String(err.message || err.error) : "";
+        this.scanForSuspicion(msg);
+    }
+
+    isCoolingDown() {
+        if (!this.cooldown.active) return false;
+        if (Date.now() - this.cooldown.since >= this.cooldown.durationMs) {
+            this.cooldown.active = false;
+            this.cooldown.strikes = 0;
+            this.cooldown.since = null;
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * Call this right before every send. Resolves once it's safe to go —
+     * may internally wait (pacing delay, volume backoff, cooldown backoff).
+     * Never rejects; on any internal problem it just resolves immediately
+     * rather than blocking a real message.
+     */
+    async waitForTurn(threadID) {
+        try {
+            this._rollWindows();
+
+            if (this.isCoolingDown()) {
+                await this._sleep(2000 + Math.random() * 3000);
+            }
+
+            const cap = this._hourlyCap();
+            if (this.hourSendCount >= cap) {
+                log.warn("AntiSuspension", `Hourly send cap reached (${this.hourSendCount}/${cap}${this._inWarmup() ? ", warmup" : ""}). Slowing down.`);
+                await this._sleep(4000 + Math.random() * 4000);
+            }
+            if (this.daySendCount >= this.dailyCap) {
+                log.warn("AntiSuspension", `Daily send cap reached (${this.daySendCount}/${this.dailyCap}). Slowing down.`);
+                await this._sleep(4000 + Math.random() * 4000);
+            }
+
+            const key = String(threadID);
+            const lastAt = this.perThreadLastSendAt.get(key) || 0;
+            const sinceLast = Date.now() - lastAt;
+            const minGap = 400 + Math.random() * 200;
+            if (sinceLast < minGap) {
+                await this._sleep(minGap - sinceLast);
+            }
+
+            // A small, always-present jitter so consecutive sends never
+            // look perfectly back-to-back even across different threads.
+            await this._sleep(80 + Math.random() * 150);
+
+            this.perThreadLastSendAt.set(key, Date.now());
+            this.hourSendCount++;
+            this.daySendCount++;
+            const threadCount = (this.threadSendCounts.get(key) || 0) + 1;
+            this.threadSendCounts.set(key, threadCount);
+        } catch {
+            // Pacing must never be the reason a real message fails to send.
+        }
+    }
+
+    _sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, Math.max(0, ms)));
+    }
+
+    stats() {
+        return {
+            warmup: this._inWarmup(),
+            hourSendCount: this.hourSendCount,
+            hourlyCap: this._hourlyCap(),
+            daySendCount: this.daySendCount,
+            dailyCap: this.dailyCap,
+            coolingDown: this.isCoolingDown()
+        };
+    }
+}
+
+const pacer = new SendPacer();
+
+module.exports = {
+    SendPacer,
+    globalAntiSuspension: {
+        prepareBeforeMessage: (threadID) => pacer.waitForTurn(threadID),
+        detectSuspensionSignal: (text) => pacer.scanForSuspicion(text),
+        checkAccountHealth: (err) => pacer.noteSendError(err),
+        getStats: () => pacer.stats()
+    }
+};

package/src/utils/cookies.js

@@ -18,6 +18,23 @@ function saveCookies(jar) {
           } catch {
             // ignore per-cookie errors
           }
+          // Mirror facebook.com <-> messenger.com so a session refresh that
+          // only touches one domain's Set-Cookie doesn't leave the other
+          // domain holding a stale cookie. Requests to messenger.com (e.g.
+          // the periodic session-keeper ping) otherwise end up looking
+          // logged-out even while the facebook.com session is fine, which
+          // is itself an inconsistency Facebook's detection can key off.
+          try {
+            if (/domain=\.?facebook\.com/i.test(c)) {
+              const mirrored = c.replace(/domain=\.?facebook\.com/i, "domain=.messenger.com");
+              jar.setCookieSync(mirrored, "https://www.messenger.com");
+            } else if (/domain=\.?messenger\.com/i.test(c)) {
+              const mirrored = c.replace(/domain=\.?messenger\.com/i, "domain=.facebook.com");
+              jar.setCookieSync(mirrored, "https://www.facebook.com");
+            }
+          } catch {
+            // ignore per-cookie mirroring errors
+          }
         }
       }
     } catch {

package/src/utils/loginParser/parseAndCheckLogin.js

@@ -4,6 +4,7 @@ const logger = require("../../../func/logger");
 const { makeParsable } = require("./textUtils");
 const { delay, createEmit, headerOf, buildUrl, formatCookie } = require("./helpers");
 const { createMaybeAutoLogin } = require("./autoLogin");
+const { globalAntiSuspension } = require("../antiSuspension");
 
 /**
  * Trả về hàm async (res) => parsed | throw.
@@ -183,7 +184,25 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
       resStr.includes("XCheckpointFBScrapingWarningController") ||
       resStr.includes("601051028565049")
     ) {
+      globalAntiSuspension.detectSuspensionSignal("automated behavior checkpoint scraping warning");
       emit("checkpoint", { type: "scraping_warning", res: resData });
+      // Dismiss it the same way a human tapping "Dismiss" on that screen
+      // would — an unacknowledged warning left sitting is worse than one
+      // that's been cleared. Fire-and-forget: this must never block or
+      // fail the actual response being parsed.
+      http
+        .post("https://www.facebook.com/api/graphql/", ctx.jar, {
+          av: ctx.userID,
+          __user: ctx.userID,
+          fb_dtsg: ctx.fb_dtsg || "",
+          fb_api_caller_class: "RelayModern",
+          fb_api_req_friendly_name: "FBScrapingWarningMutation",
+          server_timestamps: "true",
+          doc_id: "24406519995698862",
+          variables: "{}"
+        }, ctx.globalOptions, ctx)
+        .then(() => logger("Dismissed automated-behavior warning", "info"))
+        .catch((e) => logger(`Dismissing automated-behavior warning failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn"));
       return await maybeAutoLogin(resData, res?.config);
     }
     if (
@@ -193,6 +212,7 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
       return await maybeAutoLogin(resData, res?.config);
     }
     if (resStr.includes("1501092823525282")) {
+      globalAntiSuspension.detectSuspensionSignal("checkpoint 282");
       logger("Bot checkpoint 282 detected, please check the account!", "error");
       const err = new Error("Checkpoint 282 detected");
       err.error = "checkpoint_282";
@@ -202,6 +222,7 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
       throw err;
     }
     if (resStr.includes("828281030927956")) {
+      globalAntiSuspension.detectSuspensionSignal("checkpoint 956");
       logger("Bot checkpoint 956 detected, please check the account!", "error");
       const err = new Error("Checkpoint 956 detected");
       err.error = "checkpoint_956";