@lazyneoaz/metachat 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyneoaz/metachat",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "type": "commonjs",
   "types": "src/types/index.d.ts",
   "description": "Advanced Facebook Chat API client for building Messenger bots — real-time messaging, thread management, MQTT, and session stability.",

package/src/apis/sendMessage.js

@@ -285,7 +285,29 @@ module.exports = (defaultFuncs, api, ctx) => {
       return callback(new Error("Dissallowed props: `" + disallowedProperties.join(", ") + "`"));
     }
 
+    // Declare typing state here so the finally block never hits a ReferenceError
+    // in strict mode. These are set below if simulateTyping is enabled.
+    let typingTimeout = null;
+    let typingStarted = false;
+
     try {
+      // Simulate human typing delay when the option is enabled and there is
+      // text to type. The indicator is sent first, we wait the computed delay,
+      // then the actual send follows. The finally block stops the indicator.
+      if (ctx.globalOptions.simulateTyping && msg.body && typeof api.sendTypingIndicator === 'function') {
+        try {
+          const typingDelay = await globalAntiSuspension.simulateTyping(threadID, msg.body.length);
+          await api.sendTypingIndicator(true, threadID);
+          typingStarted = true;
+          await new Promise(resolve => {
+            typingTimeout = setTimeout(resolve, typingDelay);
+          });
+        } catch (_) {
+          // Typing simulation is best-effort — a failure here must never
+          // block the actual message send.
+        }
+      }
+
       try {
         const mqttReady = ctx.mqttClient && ctx.mqttClient.connected;
         const isMultiRecipient = Array.isArray(threadID);
@@ -327,6 +349,9 @@ module.exports = (defaultFuncs, api, ctx) => {
           }
         }
       } finally {
+        // Stop typing indicator regardless of success or failure.
+        // typingTimeout and typingStarted are always declared above so this
+        // block can never throw a ReferenceError in strict mode.
         if (typingTimeout) clearTimeout(typingTimeout);
         if (typingStarted) {
           try { await api.sendTypingIndicator(false, threadID); } catch (_) {}

package/src/apis/sendMessageMqtt.js

@@ -1,7 +1,6 @@
 "use strict";
 
 const utils = require('../utils');
-const { globalAntiSuspension } = require('../utils/antiSuspension');
 
 module.exports = (defaultFuncs, api, ctx) => {
   function detectAttachmentType(attachment) {
@@ -143,10 +142,6 @@ module.exports = (defaultFuncs, api, ctx) => {
       replyToMessage = null;
     }
 
-    try {
-      await globalAntiSuspension.prepareBeforeMessage(String(threadID), typeof msg === "string" ? msg : (msg.body || ""));
-    } catch (_) {}
-
     const normalized = typeof msg === "string" ? { body: msg } : msg;
     const baseBody = normalized.body != null ? String(normalized.body) : "";
     const epoch = (BigInt(Date.now()) << 22n).toString();

package/src/engine/client.js

@@ -26,7 +26,7 @@ const DEFAULT_OPTIONS = {
     autoReconnect: true,
     online: true,
     emitReady: false,
-    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.182 Safari/537.36",
 };
 
 /**

package/src/utils/antiSuspension.js

@@ -459,35 +459,6 @@ class AntiSuspension {
         return results;
     }
 
-    /**
-     * Prepare before sending — single delay model.
-     * Enforces thread throttle and volume limits, respects circuit breaker.
-     * If the circuit breaker is tripped (checkpoint/suspension detected) or
-     * volume limits are reached, throws to protect the account.
-     */
-    async prepareBeforeMessage(threadID, message) {
-        if (this.isCircuitBreakerTripped()) {
-            const remaining = this.getCircuitBreakerRemainingMs();
-            const { utils } = this._getUtils();
-            utils && utils.warn && utils.warn("AntiSuspension",
-                `Circuit breaker is tripped. Blocking message send to protect account. ` +
-                `Cooldown remaining: ${Math.ceil(remaining / 1000)}s`);
-            const err = new Error(`Circuit breaker is tripped. Pausing sends to protect account. Retry in ${Math.ceil(remaining / 1000)}s.`);
-            err.error = 'circuit_breaker_tripped';
-            err.remainingMs = remaining;
-            throw err;
-        }
-
-        const volumeWarning = this.checkVolumeLimit(threadID);
-        if (volumeWarning) {
-            const { utils } = this._getUtils();
-            utils && utils.warn && utils.warn("AntiSuspension", volumeWarning);
-        }
-
-        await this.enforceThreadThrottling(threadID);
-        this._incrementDailyStats(threadID);
-    }
-
     getConfig() {
         return {
             messageDelayMs: this.messageDelayMs,

package/src/utils/headers.js

@@ -59,16 +59,28 @@ function getRandomTimezone() {
 
 /**
  * Generates a comprehensive and realistic set of headers for requests to Facebook.
+ *
+ * Key fingerprint rules enforced here:
+ *  - Navigate (page load): Accept = full HTML accept, Upgrade-Insecure-Requests = 1,
+ *    Sec-Fetch-Dest/Mode/Site = document/navigate/none. NO X-Requested-With, NO Origin.
+ *  - XHR (AJAX/API call): Accept = *\/*, Sec-Fetch-Dest/Mode/Site = empty/cors/same-origin,
+ *    Origin = host. NO Upgrade-Insecure-Requests.
+ *
+ * Real Chrome never sends X-Requested-With automatically — it is a jQuery/XHR
+ * legacy header that Facebook's own modern client does NOT include and that
+ * Facebook's bot-detection system flags when seen on navigation requests.
+ *
  * @param {string} url - The target URL.
  * @param {object} options - Global options from context.
  * @param {object} ctx - The application context (containing fb_dtsg, lsd, etc.).
  * @param {object} customHeader - Any extra headers to merge.
- * @param {string} requestType - Type of request: 'xhr' for GraphQL/AJAX or 'navigate' for page navigation
+ * @param {string} requestType - 'xhr' for GraphQL/AJAX or 'navigate' for page navigation.
  * @returns {object} A complete headers object.
  */
 function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const persona = options?.persona || 'desktop';
     const isAndroid = persona === 'android' || persona === 'mobile';
+    const isXhr = requestType === 'xhr';
 
     let userAgent, secChUa, secChUaFullVersionList, secChUaPlatform, secChUaPlatformVersion;
     let androidData = null;
@@ -110,8 +122,6 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const host = new URL(url).hostname;
     const referer = `https://${host}/`;
 
-    const isXhr = requestType === 'xhr';
-
     const locales = options?.cachedLocale || (androidData?.locale ? androidData.locale.replace('_', '-') : getRandomLocale());
 
     if (isAndroid) {
@@ -159,38 +169,55 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const isMac = secChUaPlatform === '"macOS"';
     const isLinux = secChUaPlatform === '"Linux"';
 
+    // Navigate (page load) Accept mirrors real Chrome — includes avif/webp/apng
+    // XHR Accept is simply */* as sent by Chrome's fetch/XHR APIs
+    const acceptHeader = isXhr
+        ? '*/*'
+        : 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7';
+
     const headers = {
-        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,application/json;q=0.8,*/*;q=0.7',
+        'Accept': acceptHeader,
         'Accept-Language': locales,
         'Accept-Encoding': 'gzip, deflate, br',
         'Cache-Control': 'no-cache',
         'Connection': 'keep-alive',
-        'DNT': '1',
         'Host': host,
         'Pragma': 'no-cache',
         'Referer': referer,
         'Sec-Ch-Ua': secChUa,
         'Sec-Ch-Ua-Full-Version-List': secChUaFullVersionList,
         'Sec-Ch-Ua-Mobile': '?0',
+        'Sec-Ch-Ua-Model': '""',
         'Sec-Ch-Ua-Platform': secChUaPlatform,
         'Sec-Ch-Ua-Platform-Version': secChUaPlatformVersion,
         'Sec-Fetch-Dest': isXhr ? 'empty' : 'document',
         'Sec-Fetch-Mode': isXhr ? 'cors' : 'navigate',
         'Sec-Fetch-Site': isXhr ? 'same-origin' : 'none',
         'User-Agent': userAgent,
-        'Upgrade-Insecure-Requests': '1',
-        'X-Requested-With': 'XMLHttpRequest'
     };
 
-    if (isWindows || isMac || isLinux) {
-        headers['Sec-Ch-Ua-Arch'] = '"x86"';
-        headers['Sec-Ch-Ua-Bitness'] = '"64"';
+    // Upgrade-Insecure-Requests is a navigation-only hint — browsers never
+    // include it on XHR/fetch calls. Sending it on XHR is a bot fingerprint.
+    if (!isXhr) {
+        headers['Upgrade-Insecure-Requests'] = '1';
     }
 
+    // Origin is only present on cross-origin or same-origin XHR/fetch requests.
+    // Real browsers do NOT send Origin on top-level page navigations (Sec-Fetch-Mode: navigate).
     if (isXhr) {
         headers['Origin'] = `https://${host}`;
     }
 
+    // X-Requested-With is NOT a browser-native header — it is a jQuery/XHR
+    // convention that Facebook's own modern web client does not set.
+    // Sending it (especially on navigate requests) is a well-known bot fingerprint
+    // that Facebook's detection system keys on. We never send it.
+
+    if (isWindows || isMac || isLinux) {
+        headers['Sec-Ch-Ua-Arch'] = '"x86"';
+        headers['Sec-Ch-Ua-Bitness'] = '"64"';
+    }
+
     if (ctx) {
         if (ctx.lsd || ctx.fb_dtsg) {
             headers['X-Fb-Lsd'] = ctx.lsd || ctx.fb_dtsg;
@@ -206,7 +233,6 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         }
     }
 
-
     if (customHeader) {
         Object.assign(headers, customHeader);
         if (customHeader.noRef) {
@@ -224,4 +250,4 @@ module.exports = {
     meta,
     getRandomLocale,
     getRandomTimezone
-};
+};

package/src/utils/user-agents.js

@@ -1,28 +1,81 @@
 "use strict";
 const { getRandom } = require("./constants");
 
+// Chrome versions ordered newest-first. Keep this list current — Facebook's
+// bot-detection compares claimed UA versions against known release timelines.
+// Versions that are too old (pre-120) or too new (unreleased) are flagged.
 const BROWSER_DATA = {
     windows: {
         platform: "Windows NT 10.0; Win64; x64",
-        chromeVersions: ["139.0.0.0", "131.0.6778.86", "130.0.6723.92", "129.0.6668.101", "128.0.6613.120", "127.0.6533.120"],
-        edgeVersions: ["139.0.0.0", "131.0.2903.51", "130.0.2849.68", "129.0.2792.89"],
+        chromeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114", "139.0.7258.100", "138.0.7204.92",
+            "137.0.7151.68",  "136.0.7103.113", "135.0.7049.96",
+            "134.0.6998.165"
+        ],
+        edgeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114", "139.0.7258.100"
+        ],
         platformVersion: '"15.0.0"'
     },
     mac: {
         platform: "Macintosh; Intel Mac OS X 10_15_7",
-        chromeVersions: ["139.0.0.0", "131.0.6778.86", "130.0.6723.92", "129.0.6668.101", "128.0.6613.120", "127.0.6533.120"],
-        edgeVersions: ["139.0.0.0", "131.0.2903.51", "130.0.2849.68", "129.0.2792.89"],
+        chromeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114", "139.0.7258.100", "138.0.7204.92",
+            "137.0.7151.68",  "136.0.7103.113", "135.0.7049.96",
+            "134.0.6998.165"
+        ],
+        edgeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114", "139.0.7258.100"
+        ],
         platformVersion: '"14.7.0"'
     },
     linux: {
         platform: "X11; Linux x86_64",
-        chromeVersions: ["139.0.0.0", "131.0.6778.86", "130.0.6723.92", "129.0.6668.101", "128.0.6613.120"],
-        edgeVersions: ["139.0.0.0", "131.0.2903.51", "130.0.2849.68"],
+        chromeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114", "139.0.7258.100", "138.0.7204.92",
+            "137.0.7151.68",  "136.0.7103.113"
+        ],
+        edgeVersions: [
+            "143.0.7499.182", "142.0.7410.114", "141.0.7358.100",
+            "140.0.7294.114"
+        ],
         platformVersion: '""'
     }
 };
 
-const defaultUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
+const defaultUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.182 Safari/537.36";
+
+/**
+ * Builds the correct GREASE token for a given major Chrome version.
+ *
+ * Chrome picks one of several "not a brand" placeholder strings via a
+ * deterministic algorithm keyed to the major version.  Using the wrong
+ * GREASE value is a detectable fingerprint mismatch.
+ *
+ * The set used by Chrome 100+ rotates through these four forms based on
+ * (major % 4):
+ *   0 → "Not)A;Brand"
+ *   1 → "Not A(Brand"
+ *   2 → "Not;A=Brand"
+ *   3 → "Not A Brand"   (older alias)
+ *
+ * @param {number} major - Chrome major version number.
+ * @returns {string} - GREASE brand string without the surrounding quotes.
+ */
+function greaseForVersion(major) {
+    const forms = [
+        "Not)A;Brand",
+        "Not A(Brand",
+        "Not;A=Brand",
+        "Not A Brand"
+    ];
+    return forms[major % 4];
+}
 
 /**
  * Generates a realistic, randomized User-Agent string and related Sec-CH headers.
@@ -33,32 +86,42 @@ function randomUserAgent() {
     const os = getRandom(Object.keys(BROWSER_DATA));
     const data = BROWSER_DATA[os];
 
-    const useEdge = Math.random() > 0.7 && data.edgeVersions;
+    const useEdge = Math.random() > 0.75 && data.edgeVersions && data.edgeVersions.length > 0;
     const versions = useEdge ? data.edgeVersions : data.chromeVersions;
     const version = getRandom(versions);
     const majorVersion = version.split('.')[0];
+    const major = parseInt(majorVersion, 10);
     const browserName = useEdge ? 'Microsoft Edge' : 'Google Chrome';
-    const browserIdentifier = useEdge ? 'Edg' : 'Chrome';
 
-    const userAgent = useEdge 
+    const userAgent = useEdge
         ? `Mozilla/5.0 (${data.platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36 Edg/${version}`
         : `Mozilla/5.0 (${data.platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
 
-    const greeseValue = Math.random() > 0.5 ? '99' : '8';
-    const brands = useEdge ? [
-        `"Chromium";v="${majorVersion}"`,
-        `"Not(A:Brand";v="${greeseValue}"`,
-        `"${browserName}";v="${majorVersion}"`
-    ] : [
-        `"${browserName}";v="${majorVersion}"`,
-        `"Not;A=Brand";v="${greeseValue}"`,
-        `"Chromium";v="${majorVersion}"`
-    ];
+    // Use the version-correct GREASE placeholder — mismatched GREASE is a
+    // detectable fingerprint that Facebook's bot detection system checks.
+    const greaseStr = greaseForVersion(major);
+    const greaseVersion = "99";
+
+    let brands;
+    if (useEdge) {
+        brands = [
+            `"Chromium";v="${majorVersion}"`,
+            `"${browserName}";v="${majorVersion}"`,
+            `"${greaseStr}";v="${greaseVersion}"`
+        ];
+    } else {
+        brands = [
+            `"${browserName}";v="${majorVersion}"`,
+            `"Chromium";v="${majorVersion}"`,
+            `"${greaseStr}";v="${greaseVersion}"`
+        ];
+    }
 
     const secChUa = brands.join(', ');
+
+    // Full version list replaces the major-only version with the full string
     const secChUaFullVersionList = brands.map(b => {
-        const match = b.match(/v="(\d+)"/);
-        if (match && match[1] === majorVersion) {
+        if (b.includes(`v="${majorVersion}"`)) {
             return b.replace(`v="${majorVersion}"`, `v="${version}"`);
         }
         return b;
@@ -235,4 +298,4 @@ module.exports = {
     randomOrcaUA,
     generateUserAgentByPersona,
     cachePersonaData,
-};
+};