@eryxenx/fca 1.0.5 → 1.0.7

package/README.md

@@ -18,7 +18,7 @@ NEXCA MQTT · Signal Protocol E2EE (mautrix-go powered) · sessionGuard · 90+ A
 ## ⚡ Why @eryxenx/fca?
 
 - ✅ **NEXCA MQTT** — stable connection core, autoReconnect, jitter
-- ✅ **Signal Protocol E2EE** — Facebook real encrypted conversations support. Reliable media/reaction/unsend delivery is powered by a bundled **mautrix-go / mautrix-meta** native engine (© Tulir Asokan, MPL-2.0) — NEXCA's own hand-written E2EE encoder produced protocol-valid messages that Facebook accepted but Messenger clients failed to render for attachments/reactions/unsend, so this fork routes those through the native engine instead. Text messaging still uses the original engine (already reliable).
+- ✅ **Signal Protocol E2EE** — Facebook real encrypted conversations support. Reliable media/reaction/unsend delivery is powered by a bundled **mautrix-go / mautrix-meta** native engine (© Tulir Asokan, MPL-2.0) — NEXCA's own hand-written E2EE encoder produced protocol-valid messages that Facebook accepted but Messenger clients failed to render for attachments/reactions/unsend, so this fork routes those through the native engine instead. Text messaging still uses the original engine (already reliable). The native engine is opt-in (`FCA_E2EE_NATIVE=1`) — see [Native media engine](#native-media-engine).
 - ✅ **sessionGuard** — appstate corruption and silent logout protection, auto-backup
 - ✅ **sendBroadcast** — rate-limited multi-thread broadcast
 - ✅ **Fixed MQTT subscribe race condition** — no more "Connection refused: No subscription existed"
@@ -35,7 +35,7 @@ NEXCA MQTT · Signal Protocol E2EE (mautrix-go powered) · sessionGuard · 90+ A
 - ✅ Full Messenger API — messages, reactions, attachments, stickers, polls, pins
 - ✅ NEXCA MQTT — stable connection, autoReconnect, jitter, isActiveClient guard
 - ✅ E2EE — Signal Protocol encrypted threads, auto-connects after login (listenE2EE, e2ee.*)
-- ✅ E2EE media engine — native mautrix-go engine for reliable image/video/audio/document sending, reactions, and unsend in encrypted threads (falls back to the built-in JS engine automatically)
+- ✅ E2EE media engine — native mautrix-go engine (opt-in via `FCA_E2EE_NATIVE=1`) for reliable image/video/audio/document sending, reactions, and unsend in encrypted threads (falls back to the built-in JS engine automatically)
 - ✅ E2EE incoming media — attachments on encrypted messages (including replies) are auto-decrypted and served locally, so existing commands work unmodified
 - ✅ sessionGuard — appstate auto-save, corruption guard, .bak backup
 - ✅ sendBroadcast — parallel/sequential multi-thread sending with rate limit
@@ -53,7 +53,9 @@ npm install @eryxenx/fca
 
 Node.js >= 18 required.
 
-The E2EE media engine ships a precompiled native binary (`src/api/socket/e2ee/native/build/`) for **Linux (.so)** and **Windows (.dll)**, loaded via the `koffi` FFI. `npm install` pulls in `koffi` and `yumi-json-bigint` automatically — no extra setup needed. If your deployment platform isn't Linux/Windows x64 (e.g. macOS, ARM), the native engine will fail to load and E2EE media/reactions/unsend automatically fall back to the built-in JS engine (text messaging is unaffected either way).
+The E2EE media engine ships a precompiled native binary (`src/api/socket/e2ee/native/build/`) for **Linux (.so)** and **Windows (.dll)**, loaded via the `koffi` FFI. `npm install` pulls in `koffi` and `yumi-json-bigint` automatically — no extra setup needed. Note the native engine only runs when `FCA_E2EE_NATIVE=1` is set (see [Native media engine](#native-media-engine)); on platforms other than Linux/Windows x64 (e.g. macOS, ARM) the binary fails to load and E2EE media/reactions/unsend automatically fall back to the built-in JS engine (text messaging is unaffected either way).
+
+The E2EE socket's User-Agent defaults to desktop Windows Chrome 139 to match the rest of the client; override with `FCA_E2EE_UA` if you run with a different UA.
 
 ---
 
@@ -179,7 +181,12 @@ await api.e2ee.disconnect();
 
 ### Native media engine
 
-Sending image/video/audio/document attachments, reactions, and unsend in E2EE threads is routed through a precompiled **mautrix-go / mautrix-meta** binary (`src/api/socket/e2ee/native/`) via the `koffi` FFI, instead of this project's own hand-written Signal Protocol encoder. This project's own encoder builds protocol-valid messages that Facebook's servers accept, but real Messenger clients silently fail to render — the native engine avoids that entirely.
+Sending image/video/audio/document attachments, reactions, and unsend in E2EE threads can be routed through a precompiled **mautrix-go / mautrix-meta** binary (`src/api/socket/e2ee/native/`) via the `koffi` FFI, instead of this project's own hand-written Signal Protocol encoder. This project's own encoder builds protocol-valid messages that Facebook's servers accept, but real Messenger clients silently fail to render — the native engine avoids that entirely.
+
+**⚠️ The native engine is DISABLED by default.** Both the vendored JS engine and the native engine register with Facebook as the *same* E2EE device (same device id), and Facebook's server keeps only one live E2EE socket per device — so when both run at once they kick each other off in a loop (a fresh handshake every few seconds, which looks like automated behavior to Facebook). The vendored JS engine is therefore given exclusive use of the socket unless you opt in:
+
+- Set `FCA_E2EE_NATIVE=1` in the environment to enable the native engine. With it on you get E2EE group text receive/send, native media sends, native reactions/unsend/edit/markRead — but you also accept the device-kick socket churn described above (the JS engine reconnects with exponential backoff, so it stays usable, just noisy).
+- With it off (default): E2EE DM text + DM media work through the vendored engine. E2EE **group** send/receive, and E2EE markRead, are unavailable; reactions/unsend/edit in E2EE DMs fall back to the vendored engine.
 
 - Text messages always use @eryxenx/fca's own E2EE engine (already reliable, no native dependency).
 - If the native engine fails to load or a send fails (unsupported platform, binary mismatch, etc.), @eryxenx/fca automatically falls back to its own engine and logs `[native-media] ... falling back to legacy vendor engine`.

package/module/config.js

@@ -4,7 +4,10 @@ const logger = require("../func/logger");
 const defaultConfig = {
   autoUpdate: true,
   mqtt: { enabled: true, reconnectInterval: 3600 },
-  autoLogin: true,
+  // Opt-in only: auto re-login with credentials (via the third-party API)
+  // after a checkpoint/session failure is itself a strong suspicious-login
+  // signal and invalidates every other live session on the account.
+  autoLogin: false,
   apiServer: "https://minhdong.site",
   apiKey: "",
   credentials: { email: "", password: "", twofactor: "" },

package/module/loginHelper.js

@@ -1283,14 +1283,17 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           api._listenMqttRaw = api.listenMqtt;
           api.listen = api.listenMqtt;
         }
-        if (api.refreshFb_dtsg) {
-          setInterval(function () {
+        if (api.refreshFb_dtsg && !ctxMain._dtsgRefreshInterval) {
+          ctxMain._dtsgRefreshInterval = setInterval(function () {
             api.refreshFb_dtsg().then(function () {
               logger("Successfully refreshed fb_dtsg");
             }).catch(function () {
               logger("An error occurred while refreshing fb_dtsg", "error");
             });
           }, 86400000);
+          // Don't stack a new interval per login, and don't keep the process
+          // alive just for this.
+          if (ctxMain._dtsgRefreshInterval.unref) ctxMain._dtsgRefreshInterval.unref();
         }
         // ✅ nexca core features register
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eryxenx/fca",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Facebook Chat API by EryXenX | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free",
   "main": "index.js",
   "types": "index.d.ts",

package/src/api/action/refreshFb_dtsg.js

@@ -1,9 +1,9 @@
 "use strict";
 
 const log = require("../../../func/logAdapter");
-const { getFrom } = require("../../utils/constants");
 const { get } = require("../../utils/request")
 const { getType } = require("../../utils/format");
+const { extractDtsg } = require("../../utils/loginParser/extractDtsg");
 module.exports = function (defaultFuncs, api, ctx) {
   return function refreshFb_dtsg(obj, callback) {
     if (typeof obj === "function") {
@@ -24,8 +24,7 @@ module.exports = function (defaultFuncs, api, ctx) {
     }
     if (Object.keys(obj).length === 0) {
       get("https://www.facebook.com/", ctx.jar, null, ctx.globalOptions, { noRef: true }).then(({ data }) => {
-        const fb_dtsg = getFrom(data, '["DTSGInitData",[],{"token":"', '","');
-        const jazoest = getFrom(data, "jazoest=", '",');
+        const { fb_dtsg, jazoest } = extractDtsg(data);
         if (!fb_dtsg) throw new Error("Could not find fb_dtsg in HTML after requesting Facebook.");
         Object.assign(ctx, { fb_dtsg, jazoest });
         callback(null, {

package/src/api/messaging/markAsDelivered.js

@@ -24,6 +24,18 @@ module.exports = function(defaultFuncs, api, ctx) {
       return callback("Error: messageID or threadID is not defined");
     }
 
+    // Modern Messenger clients do not POST delivery receipts to the
+    // Mercury-era delivery_receipts.php endpoint — delivery is implicit in
+    // the MQTT sync channel. Calling that endpoint once per incoming message
+    // (which GoatBot's handlerEvents does) produced a constant stream of
+    // request shapes no real client emits. When MQTT is live we resolve
+    // immediately; the legacy HTTP call is kept only as a fallback for
+    // callers that explicitly use this API without an active listener.
+    if (ctx.mqttClient && ctx.mqttClient.connected) {
+      callback();
+      return returnPromise;
+    }
+
     const form = {};
 
     form["message_ids[0]"] = messageID;

package/src/api/messaging/markAsRead.js

@@ -60,18 +60,38 @@ module.exports = function(defaultFuncs, api, ctx) {
       return null;
     } else {
       try {
-        if (ctx.mqttClient) {
+        if (ctx.mqttClient && ctx.mqttClient.connected) {
+          // Modern clients send read state as a label-21 ls_req task (the
+          // same shape sendMessage.js already uses for its read watermark),
+          // not the legacy /mark_thread topic or the Mercury-era
+          // change_read_status.php endpoint.
+          const requestId = Math.floor(100 + Math.random() * 900);
+          const epoch = (BigInt(Date.now()) << 22n).toString();
+          const content = {
+            app_id: "2220391788200892",
+            payload: JSON.stringify({
+              tasks: [
+                {
+                  label: "21",
+                  payload: JSON.stringify({
+                    thread_id: String(threadID),
+                    last_read_watermark_ts: Date.now(),
+                    sync_group: 1
+                  }),
+                  queue_name: String(threadID),
+                  task_id: Math.floor(100 + Math.random() * 900),
+                  failure_count: null
+                }
+              ],
+              epoch_id: epoch,
+              version_id: "24804310205905615",
+              data_trace_id: "#" + Buffer.from(String(Math.random())).toString("base64").replace(/=+$/, "")
+            }),
+            request_id: requestId,
+            type: 3
+          };
           const err = await new Promise(r =>
-            ctx.mqttClient.publish(
-              "/mark_thread",
-              JSON.stringify({
-                threadID,
-                mark: "read",
-                state: read
-              }),
-              { qos: 1, retain: false },
-              r
-            )
+            ctx.mqttClient.publish("/ls_req", JSON.stringify(content), { qos: 1, retain: false }, r)
           );
           if (err) throw err;
         } else {
@@ -83,6 +103,8 @@ module.exports = function(defaultFuncs, api, ctx) {
         callback(e);
         return e;
       }
+      callback();
+      return null;
     }
   };
 };

package/src/api/socket/core/connectMqtt.js

@@ -38,7 +38,10 @@ module.exports = function createListenMqtt(deps) {
       return /No subscription existed|client disconnecting|socket hang up|ECONNRESET/i.test(msg || "");
     }
 
-    const chatOn = ctx.globalOptions.online;
+    // Default to online unless explicitly disabled — GoatBot's optionsFca
+    // has no `online` key, which used to make this undefined (falsy), so the
+    // account sat permanently "inactive" while actively sending messages.
+    const chatOn = ctx.globalOptions.online !== false;
     const sessionID = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER) + 1;
     const username = {
       u: ctx.userID, s: sessionID, chat_on: chatOn, fg: false, d: ctx.clientId,
@@ -71,7 +74,10 @@ module.exports = function createListenMqtt(deps) {
           Upgrade: "websocket",
           "Sec-WebSocket-Version": "13",
           "Accept-Encoding": "gzip, deflate, br",
-          "Accept-Language": "vi,en;q=0.9",
+          // Must match the HTTP layer's Accept-Language (src/utils/headers.js)
+          // — a hardcoded different value here made the WS handshake and the
+          // HTTP requests disagree about the same "browser".
+          "Accept-Language": ctx.globalOptions.acceptLanguage || "en-US,en;q=0.9,vi;q=0.8",
           "Sec-WebSocket-Extensions": "permessage-deflate; client_max_window_bits"
         },
         origin: "https://www.facebook.com",
@@ -187,6 +193,7 @@ module.exports = function createListenMqtt(deps) {
 
     mqttClient.on("message", function (topic, message) {
       if (ctx._ending) return; // Ignore messages if ending
+      ctx.lastMqttActivity = Date.now(); // packet-level liveness for the heartbeat
       try {
         let jsonMessage = Buffer.isBuffer(message) ? Buffer.from(message).toString() : message;
         try {

package/src/api/socket/core/getSeqID.js

@@ -48,7 +48,10 @@ async function tryAutoLogin(logger, config, ctx, defaultFuncs) {
   const password = config.credentials?.password || config.password;
   const twofactor = config.credentials?.twofactor || config.twofactor || null;
 
-  if (config.autoLogin === false || !email || !password) {
+  // Opt-in, consistent with loginHelper: auto re-login only runs when the
+  // user explicitly sets autoLogin: true. (Previously `!== false`, so it ran
+  // for everyone who never set the flag.)
+  if ((config.autoLogin !== true && config.autoLogin !== "true") || !email || !password) {
     return null;
   }
 
@@ -210,7 +213,10 @@ async function tryAutoLogin(logger, config, ctx, defaultFuncs) {
           logger(`getSeqID: web session refresh failed - ${refreshErr && refreshErr.message ? refreshErr.message : String(refreshErr)}`, "warn");
         }
 
-        return { ...result, cookies };
+        // NOTE: there was a `cookies` ReferenceError here (no such variable
+        // in scope) which made every auto-login attempt throw into the catch
+        // below and get reported as failed even when it succeeded.
+        return { ...result };
       }
     }
 
@@ -226,7 +232,6 @@ module.exports = function createGetSeqID(deps) {
   const { listenMqtt, logger, emitAuth } = deps;
 
   return function getSeqID(defaultFuncs, api, ctx, globalCallback, form, retryCount = 0) {
-    const MAX_RETRIES = 3;
     const RETRY_DELAY = 2000;
     ctx.t_mqttCalled = false;
 
@@ -267,55 +272,60 @@ module.exports = function createGetSeqID(deps) {
         const detail = (err && err.detail && err.detail.message) ? ` | detail=${err.detail.message}` : "";
         const msg = ((err && err.error) || (err && err.message) || String(err || "")) + detail;
 
+        // Definitive server-side session invalidation: error 1357001
+        // ("Log in to continue") or an explicit login block. The session is
+        // dead, not desynced — retrying within seconds (and especially
+        // re-logging-in with credentials) just hammers Facebook with
+        // failed-auth requests from an already-flagged account and makes the
+        // account-level risk score worse. Stop cleanly instead and surface
+        // account_inactive so the operator can step in manually.
+        const isDefinitive =
+          /1357001|blocked the login|checkpoint\/block/i.test(msg) ||
+          (err && err.res && err.res.error === 1357001);
+        if (isDefinitive) {
+          logger(`getSeqID: session definitively invalidated (${msg}) — NOT retrying. Update appstate manually.`, "error");
+          return emitAuth(ctx, api, globalCallback, /blocked/i.test(msg) ? "login_blocked" : "not_logged_in", msg);
+        }
+
         // Check if this is an auth-related error
-        const isAuthError = /Not logged in|no sync_sequence_id found|blocked the login|401|403/i.test(msg);
+        const isAuthError = /Not logged in|no sync_sequence_id found|401|403/i.test(msg);
 
-        // For auth errors, try retry + auto-login
+        // For transient auth errors (cookie/dtsg desync), do ONE
+        // refresh-and-retry, then give up instead of looping.
         if (isAuthError) {
-          // Retry logic with increasing delay
-          if (retryCount < MAX_RETRIES) {
-            const delay = RETRY_DELAY * (retryCount + 1); // Increasing delay: 2s, 4s, 6s
-            logger(`getSeqID: retry ${retryCount + 1}/${MAX_RETRIES} after ${delay}ms... (error: ${msg})`, "warn");
-            await new Promise(resolve => setTimeout(resolve, delay));
-            
-            // Before retrying, try to refresh the session if this is the first retry
-            if (retryCount === 0 && ctx.loggedIn) {
-              try {
-                logger("getSeqID: refreshing session before retry...", "info");
-                const { get } = require("../../../utils/request");
-                const { saveCookies } = require("../../../utils/client");
-                await get("https://www.facebook.com/", ctx.jar, null, ctx.globalOptions, ctx).then(saveCookies(ctx.jar));
-              } catch (refreshErr) {
-                logger(`getSeqID: session refresh failed: ${refreshErr && refreshErr.message ? refreshErr.message : String(refreshErr)}`, "warn");
-              }
+          if (retryCount < 1 && ctx.loggedIn) {
+            logger(`getSeqID: auth error (${msg}) — one session refresh + retry`, "warn");
+            await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+            try {
+              const { get } = require("../../../utils/request");
+              const { saveCookies } = require("../../../utils/client");
+              await get("https://www.facebook.com/", ctx.jar, null, ctx.globalOptions, ctx).then(saveCookies(ctx.jar));
+            } catch (refreshErr) {
+              logger(`getSeqID: session refresh failed: ${refreshErr && refreshErr.message ? refreshErr.message : String(refreshErr)}`, "warn");
             }
-            
             return getSeqID(defaultFuncs, api, ctx, globalCallback, form, retryCount + 1);
           }
 
-          // All retries failed, try auto-login
-          logger("getSeqID: all retries failed, attempting auto re-login...", "warn");
+          // Refresh+retry didn't help. Auto re-login only when explicitly
+          // enabled in fca-config.json (autoLogin: true).
           const config = getConfig();
-          const loginResult = await tryAutoLogin(logger, config, ctx, defaultFuncs);
-
-          if (loginResult) {
-            // Wait longer after auto-login to ensure session is ready
-            logger("getSeqID: retrying with new session...", "info");
-            await new Promise(resolve => setTimeout(resolve, 3000)); // Increased delay to 3s
-            return getSeqID(defaultFuncs, api, ctx, globalCallback, form, 0);
+          if (config.autoLogin === true || config.autoLogin === "true") {
+            logger("getSeqID: attempting auto re-login (autoLogin enabled)...", "warn");
+            const loginResult = await tryAutoLogin(logger, config, ctx, defaultFuncs);
+            if (loginResult) {
+              await new Promise(resolve => setTimeout(resolve, 3000));
+              return getSeqID(defaultFuncs, api, ctx, globalCallback, form, 0);
+            }
           }
 
-          // Determine the auth error type
-          if (/blocked/i.test(msg)) {
-            return emitAuth(ctx, api, globalCallback, "login_blocked", msg);
-          }
-          if (/Not logged in/i.test(msg)) {
-            return emitAuth(ctx, api, globalCallback, "not_logged_in", msg);
-          }
+          return emitAuth(ctx, api, globalCallback, "not_logged_in", msg);
         }
 
-        logger(`getSeqID error: ${msg}`, "error");
-        return emitAuth(ctx, api, globalCallback, "auth_error", msg);
+        // Non-auth error (network hiccup, parse failure, ...): do NOT kill
+        // the session over it. Rethrow so the caller's autoReconnect retry
+        // (listenMqtt getSeqIDWrapper) handles it with its normal backoff.
+        logger(`getSeqID error (transient, will retry via reconnect): ${msg}`, "error");
+        throw err instanceof Error ? err : new Error(msg);
       });
   };
 };

package/src/api/socket/e2ee/index.js

@@ -133,31 +133,52 @@ class E2EEBridge {
         // Auto-reconnect the Noise WebSocket whenever it drops unexpectedly.
         // `this.connected` stays true through reconnect cycles; it's only set
         // false by an explicit api.e2ee.disconnect() call.
+        //
+        // Exponential backoff is critical here: a fixed 5s retry means that if
+        // FB is deliberately kicking the socket, we end up doing a fresh Noise
+        // handshake + prekey sync every ~11s — a loud automated-behavior signal
+        // on the server side. Back off 5s -> 10s -> 20s ... capped at 5min,
+        // and reset the counter after the connection has been stable for a
+        // while.
         const _self = this;
+        _self._e2eeReconnectDelay = 5000;
+        _self._e2eeReconnectTimer = null;
+        _self._e2eeStableTimer = null;
+        function _markE2EEStable() {
+            _self._e2eeReconnectDelay = 5000;
+            if (_self._e2eeStableTimer) { clearTimeout(_self._e2eeStableTimer); _self._e2eeStableTimer = null; }
+        }
+        this.client.onEvent("e2ee_connected", function _onE2EEConnected() {
+            // Only count it as stable if it survived a bit — the reset timer
+            // is started below on reconnect success instead, since this event
+            // also fires on the very first connect.
+        });
         this.client.onEvent("disconnected", function _onE2EEDisconnected() {
             if (!_self.connected) return; // intentional disconnect — skip
-            logger.warn("E2EE", "Noise WebSocket disconnected — reconnecting in 5s...");
-            setTimeout(async function () {
+            if (_self._e2eeReconnectTimer) return; // a reconnect is already queued
+            if (_self._e2eeStableTimer) { clearTimeout(_self._e2eeStableTimer); _self._e2eeStableTimer = null; }
+            const delay = _self._e2eeReconnectDelay;
+            logger.warn("E2EE", "Noise WebSocket disconnected — reconnecting in " + Math.round(delay / 1000) + "s...");
+            _self._e2eeReconnectTimer = setTimeout(async function () {
+                _self._e2eeReconnectTimer = null;
                 if (!_self.connected) return;
                 try {
                     await _self.client.connectE2EE(_e2eeDevicePath, _e2eeUserId);
                     logger.success("E2EE", "E2EE WebSocket reconnected.");
+                    // Next failure doubles the wait; reset only after the
+                    // socket has stayed up for 10 minutes.
+                    _self._e2eeReconnectDelay = Math.min(_self._e2eeReconnectDelay * 2, 5 * 60 * 1000);
+                    _self._e2eeStableTimer = setTimeout(_markE2EEStable, 10 * 60 * 1000);
                 } catch (err) {
                     logger.error("E2EE", "E2EE reconnect failed: " + (err && err.message ? err.message : String(err)));
-                    // Retry again after another 10s if reconnect failed
-                    if (_self.connected) {
-                        setTimeout(async function () {
-                            if (!_self.connected) return;
-                            try {
-                                await _self.client.connectE2EE(_e2eeDevicePath, _e2eeUserId);
-                                logger.success("E2EE", "E2EE WebSocket reconnected (retry).");
-                            } catch (err2) {
-                                logger.error("E2EE", "E2EE reconnect retry failed: " + (err2 && err2.message ? err2.message : String(err2)));
-                            }
-                        }, 10000);
-                    }
+                    _self._e2eeReconnectDelay = Math.min(_self._e2eeReconnectDelay * 2, 5 * 60 * 1000);
+                    // Schedule another attempt via the same back-off path.
+                    _self._e2eeReconnectTimer = setTimeout(function () {
+                        _self._e2eeReconnectTimer = null;
+                        if (_self.connected) _onE2EEDisconnected();
+                    }, _self._e2eeReconnectDelay);
                 }
-            }, 5000);
+            }, delay);
         });
 
         // Forward incoming E2EE messages to the registered callback.
@@ -347,7 +368,23 @@ class E2EEBridge {
         // decrypts these correctly, so group messages are received through it
         // instead. DM receiving is untouched — it still goes exclusively
         // through the vendor engine above, unchanged.
+        //
+        // IMPORTANT trade-off: the native engine and the vendored engine both
+        // register as the SAME E2EE device (same jidDevice). Facebook's server
+        // only allows ONE live E2EE socket per device, so when the native
+        // engine connects, the server kicks the vendored socket, and our
+        // reconnect then kicks the native one — an endless kick/ping-pong
+        // loop (a fresh Noise handshake every few seconds). Until the two
+        // engines can use distinct device ids, the native engine must stay
+        // OFF for the vendored socket to stay alive. Opt back in with
+        // FCA_E2EE_NATIVE=1 (group E2EE receive + native media sends) if you
+        // accept the resulting socket churn.
+        const _nativeEnabled = process.env.FCA_E2EE_NATIVE === "1";
+        if (!_nativeEnabled) {
+            logger.info("E2EE", "[native-group] native engine disabled (FCA_E2EE_NATIVE!=1) — vendored socket kept exclusive to avoid server-side device kicks");
+        }
         try {
+            if (!_nativeEnabled) throw { _skipNative: true };
             this._seenGroupMsgIds = this._seenGroupMsgIds || new Set();
             // Fire-and-forget: do NOT await this. The native client's own
             // connect (ICDC device registration etc.) can be slow/unpredictable,
@@ -426,8 +463,12 @@ class E2EEBridge {
                     (err && err.message ? err.message : String(err)));
             });
         } catch (err) {
-            logger.error("E2EE", "[native-group] failed to attach native message listener (non-fatal, DM unaffected): " +
-                (err && err.message ? err.message : String(err)));
+            if (err && err._skipNative) {
+                // intentional — native engine disabled, see note above
+            } else {
+                logger.error("E2EE", "[native-group] failed to attach native message listener (non-fatal, DM unaffected): " +
+                    (err && err.message ? err.message : String(err)));
+            }
         }
 
         return this;
@@ -470,6 +511,12 @@ class E2EEBridge {
         const isGroup = this._knownE2EEGroups.has(String(threadId));
 
         if (!attachment && isGroup) {
+            if (process.env.FCA_E2EE_NATIVE !== "1") {
+                // Native engine disabled (default) — it shares the same E2EE
+                // device id as the vendored socket and triggers server-side
+                // device kicks. Group E2EE text send unavailable in this mode.
+                throw new Error("E2EE group text send requires the native engine (FCA_E2EE_NATIVE=1), which is disabled to protect the vendored socket from server-side device kicks.");
+            }
             // Vendor's own group Sender-Key encryption is broken (see native-group
             // listener above) — group text sends go through native instead.
             const result = await nativeMediaBridge.sendGroupMessage(this.api.getAppState(), threadId, text, replyToMessageId);
@@ -546,6 +593,9 @@ class E2EEBridge {
             const appState = this.api.getAppState();
             let result;
             try {
+                if (process.env.FCA_E2EE_NATIVE !== "1") {
+                    throw new Error("native engine disabled (FCA_E2EE_NATIVE!=1) — see native-group note");
+                }
                 result = await nativeMediaBridge.sendMedia(appState, threadId, mediaType, data, mimeType, {
                     caption: text || undefined,
                     width: dims ? dims.width : undefined,
@@ -640,7 +690,11 @@ class E2EEBridge {
 
     async markRead(threadId, watermarkTs) {
         this.ensureConnected();
-        return nativeMediaBridge.markRead(this.api.getAppState(), threadId, watermarkTs);
+        if (process.env.FCA_E2EE_NATIVE === "1")
+            return nativeMediaBridge.markRead(this.api.getAppState(), threadId, watermarkTs);
+        // Native disabled: read receipts aren't available through the vendored
+        // engine — treat as a no-op rather than waking the native engine.
+        return undefined;
     }
 
     getThreadIdForMessage(messageId) {
@@ -657,6 +711,8 @@ class E2EEBridge {
         this._knownE2EEGroups = this._knownE2EEGroups || new Set();
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         try {
+            if (process.env.FCA_E2EE_NATIVE !== "1")
+                throw new Error("native engine disabled (FCA_E2EE_NATIVE!=1)");
             return await nativeMediaBridge.sendReaction(this.api.getAppState(), threadId, messageId, senderJid, reaction, isGroup);
         } catch (err) {
             if (isGroup) {
@@ -678,6 +734,8 @@ class E2EEBridge {
         this._knownE2EEGroups = this._knownE2EEGroups || new Set();
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         try {
+            if (process.env.FCA_E2EE_NATIVE !== "1")
+                throw new Error("native engine disabled (FCA_E2EE_NATIVE!=1)");
             return await nativeMediaBridge.unsendMessage(this.api.getAppState(), threadId, messageId, isGroup);
         } catch (err) {
             if (isGroup) {
@@ -694,6 +752,8 @@ class E2EEBridge {
         this._knownE2EEGroups = this._knownE2EEGroups || new Set();
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         if (isGroup) {
+            if (process.env.FCA_E2EE_NATIVE !== "1")
+                throw new Error("E2EE group edit requires the native engine (FCA_E2EE_NATIVE=1), which is disabled.");
             // Vendor's group Sender-Key encryption is broken, so route
             // group edits through native (it doesn't need a chatJid — the
             // messageId alone identifies which chat/message to edit).
@@ -727,10 +787,12 @@ class E2EEBridge {
     }
 
     async disconnect() {
+        this.connected = false; // set first so the disconnect handler won't queue a reconnect
+        if (this._e2eeReconnectTimer) { clearTimeout(this._e2eeReconnectTimer); this._e2eeReconnectTimer = null; }
+        if (this._e2eeStableTimer) { clearTimeout(this._e2eeStableTimer); this._e2eeStableTimer = null; }
         if (this.client) {
             try { await this.client.disconnect(); } catch (_) {}
         }
-        this.connected = false;
         logger.info("E2EE", "E2EE disconnected.");
     }
 }

package/src/api/socket/e2ee/native/lib/index.mjs

@@ -98,24 +98,52 @@ function call(fn, payload) {
   return data.data;
 }
 __name(call, "call");
+
+// Real async FFI: koffi's .async runs the native call on libuv's threadpool
+// instead of the main thread. The old callAsync() only deferred the call with
+// setTimeout(0) but still executed it synchronously on the main thread, which
+// froze the event loop for the entire duration of long native calls (media
+// sends were observed blocking for 80+ seconds). A frozen event loop means
+// MQTT keepalive pings never go out, so the server kills the socket
+// (close 1000) and the session starts looking erratic to Facebook.
+var _asyncFns = {};
+function getAsyncFn(fn) {
+  if (!_asyncFns[fn]) {
+    // koffi 3.x: async is a member of the decoded function and takes a
+    // callback as the last argument (runs the native call on a libuv worker
+    // thread instead of blocking the main thread).
+    const bound = fns[fn];
+    _asyncFns[fn] = (input) => new Promise((resolve, reject) => {
+      bound.async(input, (err, res) => (err ? reject(err) : resolve(res)));
+    });
+  }
+  return _asyncFns[fn];
+}
+
+// Serialize all native calls through a single FIFO queue. The Go side keeps
+// per-handle state (device tables, socket, ratchet state) and the JS side
+// shares one handle across every call, so parallel native invocations would
+// interleave unpredictably. Serial + async gives non-blocking execution
+// without any concurrency hazards.
+var _nativeQueue = Promise.resolve();
 function callAsync(fn, payload) {
-  return new Promise((resolve, reject) => {
-    setTimeout(() => {
-      try {
-        const result = call(fn, payload);
-        resolve(result);
-      } catch (err) {
-        reject(err);
-      }
-    }, 0);
+  const run = _nativeQueue.then(async () => {
+    const input = JSONBigNative.stringify(payload);
+    const out = await getAsyncFn(fn)(input);
+    const data = JSONBigNative.parse(out);
+    if (!data.ok) throw new Error(data.error || "Unknown error");
+    return data.data;
   });
+  // A rejected call must not poison the queue for subsequent calls.
+  _nativeQueue = run.catch(() => {});
+  return run;
 }
 __name(callAsync, "callAsync");
 var native = {
-  newClient: /* @__PURE__ */ __name((cfg) => call("MxNewClient", cfg), "newClient"),
-  connect: /* @__PURE__ */ __name((handle) => call("MxConnect", { handle }), "connect"),
+  newClient: /* @__PURE__ */ __name((cfg) => callAsync("MxNewClient", cfg), "newClient"),
+  connect: /* @__PURE__ */ __name((handle) => callAsync("MxConnect", { handle }), "connect"),
   connectE2EE: /* @__PURE__ */ __name((handle) => callAsync("MxConnectE2EE", { handle }), "connectE2EE"),
-  disconnect: /* @__PURE__ */ __name((handle) => call("MxDisconnect", { handle }), "disconnect"),
+  disconnect: /* @__PURE__ */ __name((handle) => callAsync("MxDisconnect", { handle }), "disconnect"),
   isConnected: /* @__PURE__ */ __name((handle) => call("MxIsConnected", { handle }), "isConnected"),
   sendMessage: /* @__PURE__ */ __name((handle, options) => callAsync("MxSendMessage", { handle, options }), "sendMessage"),
   sendReaction: /* @__PURE__ */ __name((handle, threadId, messageId, emoji) => callAsync("MxSendReaction", { handle, threadId, messageId, emoji }), "sendReaction"),
@@ -257,7 +285,7 @@ var Client = class extends EventEmitter {
    * @returns User info and initial data
    */
   async connect() {
-    const { handle } = native.newClient({
+    const { handle } = await native.newClient({
       cookies: this.cookies,
       platform: this.options.platform,
       devicePath: this.options.devicePath,
@@ -266,7 +294,7 @@ var Client = class extends EventEmitter {
       logLevel: this.options.logLevel
     });
     this.handle = handle;
-    const result = native.connect(handle);
+    const result = await native.connect(handle);
     this._user = result.user;
     this._initialData = result.initialData;
     this.startEventLoop();
@@ -295,7 +323,7 @@ var Client = class extends EventEmitter {
   async disconnect() {
     this.stopEventLoop();
     if (this.handle) {
-      native.disconnect(this.handle);
+      await native.disconnect(this.handle);
       this.handle = null;
     }
   }

package/src/api/socket/e2ee/native/nativeMediaBridge.js

@@ -20,10 +20,45 @@
  */
 
 const path = require("path");
+const fs = require("fs");
 const logger = require("../../../../utils/nexca-logger");
 
 const NATIVE_CALL_TIMEOUT_MS = 15000;
 
+// Where the native client's E2EE device identity is persisted between
+// restarts. With memory-only storage every bot restart registers a brand-new
+// E2EE device with Facebook — on an already-flagged account, "yet another
+// new device" per restart is exactly the kind of signal that keeps the
+// account under scrutiny.
+function _deviceDataPath() {
+    return path.join(process.cwd(), ".nexca", "native_e2ee_device.json");
+}
+
+function _loadDeviceData() {
+    try {
+        const p = _deviceDataPath();
+        if (fs.existsSync(p)) {
+            const raw = fs.readFileSync(p, "utf8");
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed.deviceData === "string" && parsed.deviceData.length) {
+                return parsed.deviceData;
+            }
+        }
+    } catch (_) { /* corrupted/absent store — start fresh */ }
+    return null;
+}
+
+function _saveDeviceData(client) {
+    try {
+        if (!client || typeof client.getDeviceData !== "function") return;
+        const deviceData = client.getDeviceData();
+        if (!deviceData || typeof deviceData !== "string") return;
+        const p = _deviceDataPath();
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, JSON.stringify({ deviceData, savedAt: Date.now() }), "utf8");
+    } catch (_) { /* best-effort persistence */ }
+}
+
 /**
  * Wraps a native-engine call with a hard timeout. A hung native call (e.g.
  * a stuck getDeviceList/usync query) was observed blocking the whole
@@ -95,9 +130,12 @@ async function getClient(appState) {
                 throw new Error("Native E2EE media engine: c_user/xs cookies missing from appState");
             }
 
+            const storedDeviceData = _loadDeviceData();
+
             _clientInstance = new mod.Client(cookies, {
                 enableE2EE: true,
                 e2eeMemoryOnly: true,
+                deviceData: storedDeviceData || undefined,
                 autoReconnect: true,
                 logLevel: "none"
             });
@@ -105,6 +143,7 @@ async function getClient(appState) {
             _clientInstance.on("error", (err) => {
                 logger.warn("E2EE", "[native-media] " + (err && err.message ? err.message : String(err)));
             });
+            _clientInstance.on("deviceDataChanged", () => _saveDeviceData(_clientInstance));
             _clientInstance.on("disconnected", () => {
                 logger.warn("E2EE", "[native-media] native client disconnected, will reconnect on next send");
                 _connected = false;
@@ -119,6 +158,7 @@ async function getClient(appState) {
         await _clientInstance.connect();
         await _clientInstance.connectE2EE();
         _connected = true;
+        _saveDeviceData(_clientInstance);
 
         return _clientInstance;
     })();

package/src/api/socket/e2ee/vendor/fme/dist/index.cjs

@@ -1285,8 +1285,8 @@ var ProtoWriter = class {
 // src/e2ee/message/builders/client-payload.ts
 function encodeClientPayload(opts) {
   const appVersion = new ProtoWriter().varint(1, 301).varint(2, 0).varint(3, 2).build();
-  const userAgent = new ProtoWriter().varint(1, 32).bytes(2, appVersion).string(3, "000").string(4, "000").string(5, "").string(6, "Linux").string(7, "Chrome").string(8, "").varint(10, 3).string(11, "en").string(12, "en").build();
-  const UserAgentStr = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36";
+  const userAgent = new ProtoWriter().varint(1, 32).bytes(2, appVersion).string(3, "000").string(4, "000").string(5, "").string(6, "Windows").string(7, "Chrome").string(8, "").varint(10, 3).string(11, "en").string(12, "en").build();
+  const UserAgentStr = process.env.FCA_E2EE_UA || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
   let w = new ProtoWriter().uint64_varint(1, opts.username).bool(3, false).bytes(5, userAgent).varint(12, 1).varint(13, 1).varint(18, opts.deviceId).varint(20, 1).bytes(21, opts.fbCatBase64 ? Buffer.from(opts.fbCatBase64) : Buffer.alloc(0)).bytes(22, opts.fbUserAgent ?? Buffer.from(UserAgentStr)).bool(33, true);
   return w.build();
 }
@@ -3439,9 +3439,9 @@ var FacebookE2EESocket = class extends import_node_events2.EventEmitter {
         if (cookies) this.cookieHeader = cookies;
         const wsUrl = new URL(this.url);
         wsUrl.searchParams.set("cid", "client-" + Date.now());
-        const UserAgentStr = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36";
+        const UserAgentStr = process.env.FCA_E2EE_UA || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
         const wsHeaders = {
-          "Origin": "https://www.facebook.com",
+          "Origin": "https://www.messenger.com",
           "User-Agent": UserAgentStr
         };
         if (this.cookieHeader) {
@@ -6370,7 +6370,7 @@ var FBClient = class {
     const threadService = new ThreadService(mediaService);
     const e2eeService = new E2EEService();
     const icdcService = new ICDCService(
-      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
+      process.env.FCA_E2EE_UA || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
     );
     this.controller = new ClientController(
       authService,

package/src/api/socket/listenMqtt.js

@@ -18,7 +18,13 @@ const getTaskResponseData = require("./core/getTaskResponseData");
 const createEmitAuth = require("./core/emitAuth");
 const createMiddlewareSystem = require("./middleware");
 
-const CYCLE_MS_DEFAULT = 60 * 60 * 1000;
+// Auto-cycle is OFF by default now: a real browser keeps one MQTT socket
+// open for hours. Cycling every exactly-3600.000s (full unsubscribe,
+// /browser_close, two page loads, re-auth, resubscribe) on a clockwork
+// schedule is itself a robot signature, and each cycle is a burst of
+// session-touching requests. Reconnects still happen on actual socket
+// close/error. Pass { cycleMs: <ms> } to listenMqtt to re-enable.
+const CYCLE_MS_DEFAULT = 0;
 const RECONNECT_DELAY_MS_DEFAULT = 2000;
 const UNSUB_ALL_TIMEOUT_MS = 5000;
 
@@ -255,21 +261,31 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   function startSessionKeeper() {
     if (ctx._sessionKeeperInterval) return;
-    ctx._sessionKeeperInterval = setInterval(function () {
-      if (!ctx.loggedIn) return;
-      logger("sessionKeeper: refreshing cookies + fb_dtsg", "info");
-      defaultFuncs.get("https://www.messenger.com/", ctx.jar, null, ctx)
-        .then(function () {
-          if (typeof api.refreshFb_dtsg === "function") return api.refreshFb_dtsg();
-        })
-        .then(function () {
-          logger("sessionKeeper: refresh done", "info");
-        })
-        .catch(function (err) {
-          logger(`sessionKeeper: refresh failed - ${err && err.message ? err.message : String(err)}`, "warn");
-        });
-    }, 90 * 60 * 1000);
-    if (ctx._sessionKeeperInterval.unref) ctx._sessionKeeperInterval.unref();
+    // Self-rescheduling timeout with ±15 min jitter around 90 min, instead of
+    // a clockwork-exact 90:00.000 interval — perfectly periodic traffic is
+    // trivial to fingerprint.
+    const BASE_MS = 90 * 60 * 1000;
+    const JITTER_MS = 15 * 60 * 1000;
+    const scheduleNext = function () {
+      const delay = BASE_MS - JITTER_MS + Math.floor(Math.random() * 2 * JITTER_MS);
+      ctx._sessionKeeperInterval = setTimeout(function () {
+        if (!ctx.loggedIn) { scheduleNext(); return; }
+        logger("sessionKeeper: refreshing cookies + fb_dtsg", "info");
+        defaultFuncs.get("https://www.messenger.com/", ctx.jar, null, ctx)
+          .then(function () {
+            if (typeof api.refreshFb_dtsg === "function") return api.refreshFb_dtsg();
+          })
+          .then(function () {
+            logger("sessionKeeper: refresh done", "info");
+          })
+          .catch(function (err) {
+            logger(`sessionKeeper: refresh failed - ${err && err.message ? err.message : String(err)}`, "warn");
+          })
+          .finally(scheduleNext);
+      }, delay);
+      if (ctx._sessionKeeperInterval.unref) ctx._sessionKeeperInterval.unref();
+    };
+    scheduleNext();
   }
 
   function startHeartbeat() {
@@ -277,9 +293,12 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
     ctx.lastMqttActivity = Date.now();
     ctx._heartbeatInterval = setInterval(function () {
       if (!ctx.loggedIn) return;
-      const idleTime = Date.now() - (ctx.lastMqttActivity || Date.now());
-      if (idleTime > 45 * 60 * 1000) {
-        logger("heartbeat: no MQTT activity for 45 minutes, forcing reconnect", "warn");
+      // Liveness is the socket's own state + mqtt.js keepalive, not "did a
+      // chat message arrive". The old check force-cycled a perfectly healthy
+      // connection every 45 quiet minutes (e.g. overnight), producing
+      // re-auth bursts exactly when a real user would be asleep.
+      if (!isConnected() && !ctx._ending && !ctx._cycling) {
+        logger("heartbeat: MQTT socket not connected, forcing reconnect", "warn");
         ctx.lastMqttActivity = Date.now();
         forceCycle();
       }

package/src/utils/headers.js

@@ -37,6 +37,46 @@ function sanitizeHeaderName(name) {
   return name.replace(/[^\x21-\x7E]/g, "").trim();
 }
 
+// Derive the Sec-CH-UA client-hint set from the configured User-Agent instead
+// of hardcoding it. Previously the hints always claimed "Windows desktop
+// Chrome 139" even when the UA said "Android Chrome 101" — every single
+// request then contradicted itself, which is a trivial server-side check.
+function clientHintsFromUA(ua) {
+  const s = String(ua || "");
+  const chromeMatch = s.match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
+  const major = chromeMatch ? chromeMatch[1] : "139";
+  const full = chromeMatch ? chromeMatch[0].split("/")[1] : `${major}.0.0.0`;
+  const isMobile = /Mobile|Android|iPhone|iPad/i.test(s);
+  let platform = "Windows";
+  let platformVersion = "\"15.0.0\"";
+  if (/Android\s*(\d+)/i.test(s)) {
+    platform = "Android";
+    platformVersion = `"${s.match(/Android\s*(\d+(?:\.\d+)?)/i)[1]}.0"`;
+  } else if (/iPhone|iPad/i.test(s)) {
+    platform = "iOS";
+    platformVersion = "\"17.0.0\"";
+  } else if (/Mac OS X/i.test(s)) {
+    platform = "macOS";
+    platformVersion = "\"14.0.0\"";
+  } else if (/Linux/i.test(s) && !/Android/i.test(s)) {
+    platform = "Linux";
+    platformVersion = "\"\"";
+  }
+  const hints = {
+    "sec-ch-ua": `"Chromium";v="${major}", "Not;A=Brand";v="24", "Google Chrome";v="${major}"`,
+    "sec-ch-ua-mobile": isMobile ? "?1" : "?0",
+    "sec-ch-ua-platform": `"${platform}"`,
+    "sec-ch-ua-full-version-list": `"Chromium";v="${full}", "Not;A=Brand";v="24.0.0.0", "Google Chrome";v="${full}"`,
+    "sec-ch-ua-platform-version": platformVersion
+  };
+  // Arch/bitness hints are only sent by desktop Chrome builds.
+  if (!isMobile) {
+    hints["sec-ch-ua-arch"] = "\"x86\"";
+    hints["sec-ch-ua-bitness"] = "\"64\"";
+  }
+  return hints;
+}
+
 function getHeaders(url, options, ctx, customHeader) {
   const u = new URL(url);
   const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
@@ -44,11 +84,12 @@ function getHeaders(url, options, ctx, customHeader) {
   const origin = referer.replace(/\/+$/, "");
   const contentType = options?.contentType || "application/x-www-form-urlencoded";
   const acceptLang = options?.acceptLanguage || "en-US,en;q=0.9,vi;q=0.8";
-  const isNavigation = u.pathname === "/" &&
+  // NOTE: keep the && chain parenthesized — `||` binds looser than `&&`.
+  const isNavigation = (u.pathname === "/" &&
     !url.includes("ajax") &&
     !url.includes("graphql") &&
-    !url.includes("api") &&
-    !url.includes("chat") ||
+    !u.pathname.includes("api") &&
+    !url.includes("chat")) ||
     url.includes("checkpoint");
   const acceptHeader = isNavigation
     ? "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
@@ -65,13 +106,7 @@ function getHeaders(url, options, ctx, customHeader) {
     Connection: "keep-alive",
     DNT: "1",
     "Upgrade-Insecure-Requests": "1",
-    "sec-ch-ua": "\"Chromium\";v=\"139\", \"Not;A=Brand\";v=\"24\", \"Google Chrome\";v=\"139\"",
-    "sec-ch-ua-mobile": "?0",
-    "sec-ch-ua-platform": "\"Windows\"",
-    "sec-ch-ua-arch": "\"x86\"",
-    "sec-ch-ua-bitness": "\"64\"",
-    "sec-ch-ua-full-version-list": "\"Chromium\";v=\"139.0.0.0\", \"Not;A=Brand\";v=\"24.0.0.0\", \"Google Chrome\";v=\"139.0.0.0\"",
-    "sec-ch-ua-platform-version": "\"15.0.0\"",
+    ...clientHintsFromUA(ua),
     "Sec-Fetch-Site": isNavigation ? "none" : "same-origin",
     "Sec-Fetch-Mode": isNavigation ? "navigate" : "cors",
     "Sec-Fetch-Dest": isNavigation ? "document" : "empty",

package/src/utils/loginParser/extractDtsg.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// Multi-pattern fb_dtsg / jazoest extractor.
+// Facebook serves the token in different shapes depending on surface, A/B
+// bucket and login state (DTSGInitialData / DTSGInitData blobs, escaped JSON
+// inside <script>, plain hidden inputs, async_get_token, ...). Matching only
+// one shape is why refreshes intermittently fail with "Could not find
+// fb_dtsg in HTML". Pattern order is first-match-wins.
+
+const DTSG_PATTERNS = [
+  /\["DTSGInitialData",\[\],\{"token":"([^"]+)"\}\]/,
+  /\["DTSGInitData",\[\],\{"token":"([^"]+)"/,
+  /"DTSGInitData",\[\],\{"token":"([^"]+)"/,
+  /"dtsg":\{"token":"([^"]+)"/,
+  /\{\\"token\\":\\"([^\\]+)\\"/,
+  /,\{"token":"([^"]+)"\},\d+\]/,
+  /"async_get_token":"([^"]+)"/,
+  /name="fb_dtsg"\s+value="([^"]+)"/,
+];
+
+const JAZOEST_PATTERNS = [
+  /name="jazoest"\s+value="([^"]+)"/,
+  /jazoest=(\d+)/,
+  /"jazoest":"?(\d+)"?/,
+];
+
+function firstMatch(html, patterns) {
+  for (const pattern of patterns) {
+    const m = html.match(pattern);
+    if (m && m[1]) return m[1];
+  }
+  return null;
+}
+
+function extractDtsg(html) {
+  if (!html) return { fb_dtsg: null, jazoest: null };
+  const raw = String(html);
+  return {
+    fb_dtsg: firstMatch(raw, DTSG_PATTERNS),
+    jazoest: firstMatch(raw, JAZOEST_PATTERNS),
+  };
+}
+
+module.exports = { extractDtsg, DTSG_PATTERNS, JAZOEST_PATTERNS };