@lazyneoaz/metachat 1.1.3 → 1.1.6

package/src/apis/sendMessage.js

@@ -166,7 +166,7 @@ module.exports = (defaultFuncs, api, ctx) => {
         const mention = msg.mentions[i];
         const tag = mention.tag;
         if (typeof tag !== "string") throw new Error("Mention tags must be strings.");
-        const offset = (msg.body || "").indexOf(tag, mention.fromIndex || 0);
+        const offset = msg.body.indexOf(tag, mention.fromIndex || 0);
         if (offset < 0) utils.warn("handleMention", 'Mention for "' + tag + '" not found in message string.');
         const id = mention.id || 0;
         const emptyChar = '\u200E';
@@ -285,84 +285,77 @@ module.exports = (defaultFuncs, api, ctx) => {
       return callback(new Error("Dissallowed props: `" + disallowedProperties.join(", ") + "`"));
     }
 
+    // Declare typing state here so the finally block never hits a ReferenceError
+    // in strict mode. These are set below if simulateTyping is enabled.
+    let typingTimeout = null;
+    let typingStarted = false;
+
     try {
-      // Apply anti-suspension delay and volume checks for ALL send paths
-      // (both MQTT and HTTP). This must run before transport selection so the
-      // circuit-breaker can block sends on either path.
-      try {
-        await globalAntiSuspension.prepareBeforeMessage(
-          Array.isArray(threadID) ? threadID[0] : threadID,
-          typeof msg === "string" ? msg : (msg.body || "")
-        );
-      } catch (suspensionErr) {
-        // Surface circuit-breaker and volume-limit errors directly to the caller
-        // instead of silently swallowing them. Bots MUST handle these to avoid
-        // triggering Facebook's automated-behavior detection.
-        return callback(suspensionErr);
+      // Simulate human typing delay when the option is enabled and there is
+      // text to type. The indicator is sent first, we wait the computed delay,
+      // then the actual send follows. The finally block stops the indicator.
+      if (ctx.globalOptions.simulateTyping && msg.body && typeof api.sendTypingIndicator === 'function') {
+        try {
+          const typingDelay = await globalAntiSuspension.simulateTyping(threadID, msg.body.length);
+          await api.sendTypingIndicator(true, threadID);
+          typingStarted = true;
+          await new Promise(resolve => {
+            typingTimeout = setTimeout(resolve, typingDelay);
+          });
+        } catch (_) {
+          // Typing simulation is best-effort — a failure here must never
+          // block the actual message send.
+        }
       }
 
-      const mqttReady = !!(ctx.mqttClient && ctx.mqttClient.connected);
-      const isMultiRecipient = Array.isArray(threadID);
-      // Primary transport: MQTT when connected (faster, lower overhead).
-      // Multi-recipient sends always use HTTP (MQTT only handles single thread).
-      const preferMqtt = mqttReady && !isMultiRecipient && !!api.sendMessageMqtt;
-
-      let result;
-      let primaryErr;
-      let primaryOk = false;
-
       try {
-        if (preferMqtt) {
+        const mqttReady = ctx.mqttClient && ctx.mqttClient.connected;
+        const isMultiRecipient = Array.isArray(threadID);
+        // Track which transport was used so the catch block can fall back to
+        // the OTHER transport — retrying the same one that just failed is useless.
+        const usedMqtt = mqttReady && !isMultiRecipient && api.sendMessageMqtt;
+
+        let result;
+        if (usedMqtt) {
           result = await api.sendMessageMqtt(msg, threadID, replyToMessage);
         } else {
           result = await sendViaHttp(msg, threadID, replyToMessage, isGroup);
         }
-        primaryOk = true;
-      } catch (err) {
-        primaryErr = err;
-      }
-
-      if (primaryOk) {
-        return callback(null, result);
-      }
+        callback(null, result);
+      } catch (sendErr) {
+        // Fall back to the OTHER transport, not the one that just failed.
+        const mqttNowReady = ctx.mqttClient && ctx.mqttClient.connected;
+        const primaryWasMqtt = mqttNowReady && !Array.isArray(threadID) && api.sendMessageMqtt;
 
-      // Primary transport failed — fall back to the OTHER transport.
-      let fallbackOk = false;
-      let fallbackErr;
-
-      if (preferMqtt) {
-        // MQTT was primary → fall back to HTTP
-        try {
-          result = await sendViaHttp(msg, threadID, replyToMessage, isGroup);
-          fallbackOk = true;
-        } catch (e) {
-          fallbackErr = e;
-        }
-      } else {
-        // HTTP was primary → fall back to MQTT if available
-        const mqttNow = !!(ctx.mqttClient && ctx.mqttClient.connected);
-        if (mqttNow && !isMultiRecipient && api.sendMessageMqtt) {
+        if (primaryWasMqtt) {
+          // MQTT was used (or is available) — fall back to HTTP
           try {
-            result = await api.sendMessageMqtt(msg, threadID, replyToMessage);
-            fallbackOk = true;
-          } catch (e) {
-            fallbackErr = e;
+            const httpRes = await sendViaHttp(msg, threadID, replyToMessage, isGroup);
+            callback(null, httpRes);
+          } catch (_httpErr) {
+            callback(sendErr);
           }
         } else {
-          fallbackErr = primaryErr;
+          // HTTP was used — try MQTT if it has since become available
+          if (mqttNowReady && !Array.isArray(threadID) && api.sendMessageMqtt) {
+            try {
+              const mqttRes = await api.sendMessageMqtt(msg, threadID, replyToMessage);
+              callback(null, mqttRes);
+            } catch (_mqttErr) {
+              callback(sendErr);
+            }
+          } else {
+            callback(sendErr);
+          }
         }
-      }
-
-      if (fallbackOk) {
-        return callback(null, result);
-      } else {
-        // Both transports failed — report the primary error (most informative)
-        // with the fallback error attached for diagnostics.
-        const err = primaryErr;
-        if (err && fallbackErr && fallbackErr !== primaryErr) {
-          err.fallbackError = fallbackErr;
+      } finally {
+        // Stop typing indicator regardless of success or failure.
+        // typingTimeout and typingStarted are always declared above so this
+        // block can never throw a ReferenceError in strict mode.
+        if (typingTimeout) clearTimeout(typingTimeout);
+        if (typingStarted) {
+          try { await api.sendTypingIndicator(false, threadID); } catch (_) {}
         }
-        return callback(err || fallbackErr);
       }
     } catch (err) {
       callback(err);

package/src/apis/sendMessageMqtt.js

@@ -142,22 +142,10 @@ module.exports = (defaultFuncs, api, ctx) => {
       replyToMessage = null;
     }
 
-    // Anti-suspension preparation (circuit-breaker check, smart delay, thread
-    // throttling, and daily-stat tracking) is the responsibility of the CALLER.
-    // When invoked through api.sendMessage(), preparation is already done there
-    // for ALL transport paths (both MQTT and HTTP).
-    //
-    // If you call api.sendMessageMqtt() directly (bypassing api.sendMessage()),
-    // call globalAntiSuspension.prepareBeforeMessage() yourself first and handle
-    // the circuit-breaker error it may throw — otherwise your bot has no protection.
-
     const normalized = typeof msg === "string" ? { body: msg } : msg;
     const baseBody = normalized.body != null ? String(normalized.body) : "";
     const epoch = (BigInt(Date.now()) << 22n).toString();
-    // Use monotonic ctx.wsReqNumber so concurrent sends never share the same
-    // request_id, which would cause the ACK listener to match the wrong response.
-    if (typeof ctx.wsReqNumber !== "number") ctx.wsReqNumber = 0;
-    const requestId = ++ctx.wsReqNumber;
+    const requestId = Math.floor(100 + Math.random() * 900);
     const otid = utils.generateOfflineThreadingID();
 
     const payload0 = {
@@ -229,12 +217,6 @@ module.exports = (defaultFuncs, api, ctx) => {
       payload0.attachment_fbids = files.map(f => String(Object.values(f)[0]));
     }
 
-    // Use monotonic task IDs so concurrent sends never reuse the same task_id
-    // within a session, which can confuse Facebook's MQTT deduplication.
-    if (typeof ctx.wsTaskNumber !== "number") ctx.wsTaskNumber = 0;
-    const taskId1 = ++ctx.wsTaskNumber;
-    const taskId2 = ++ctx.wsTaskNumber;
-
     const content = {
       app_id: "2220391788200892",
       payload: {
@@ -243,7 +225,7 @@ module.exports = (defaultFuncs, api, ctx) => {
             label: "46",
             payload: payload0,
             queue_name: String(threadID),
-            task_id: taskId1,
+            task_id: 400,
             failure_count: null,
           },
           {
@@ -254,7 +236,7 @@ module.exports = (defaultFuncs, api, ctx) => {
               sync_group: 1,
             },
             queue_name: String(threadID),
-            task_id: taskId2,
+            task_id: 401,
             failure_count: null,
           },
         ],

package/src/apis/setThreadThemeMqtt.js

@@ -47,17 +47,16 @@ module.exports = function (defaultFuncs, api, ctx) {
       });
 
       const messageDefs = [
-        { label: 1013, queue: ['ai_generated_theme', String(threadID)], app_id: '772021112871879' },
-        { label: 1037, queue: ['msgr_custom_thread_theme', String(threadID)], app_id: '772021112871879' },
-        { label: 1028, queue: ['thread_theme_writer', String(threadID)], app_id: '772021112871879' },
-        // label "43" (thread_theme) is the standard FB operation — app_id "2220391788200892" (dongdev confirmed)
-        { label: 43,   queue: 'thread_theme', extra: { source: null, payload: null }, app_id: '2220391788200892' },
+        { label: 1013, queue: ['ai_generated_theme', String(threadID)] },
+        { label: 1037, queue: ['msgr_custom_thread_theme', String(threadID)] },
+        { label: 1028, queue: ['thread_theme_writer', String(threadID)] },
+        { label: 43,   queue: 'thread_theme', extra: { source: null, payload: null } },
       ];
 
-      const messages = messageDefs.map(({ label, queue, extra, app_id }) => {
+      const messages = messageDefs.map(({ label, queue, extra }) => {
         ctx.wsReqNumber += 1;
         return {
-          app_id,
+          app_id: '772021112871879',
           payload: JSON.stringify({
             epoch_id: parseInt(utils.generateOfflineThreadingID()),
             tasks: [makeTask(label, queue, extra)],

package/src/apis/theme.js

@@ -150,11 +150,11 @@ module.exports = function (defaultFuncs, api, ctx) {
         };
 
         const context = {
-          app_id: '2220391788200892',
+          app_id: ctx.appID,
           payload: {
             epoch_id: currentEpochId,
             tasks: [query],
-            version_id: '8798795233522156',
+            version_id: '24631415369801570',
           },
           request_id: request_id,
           type: 3,

package/src/apis/unsendMessage.js

@@ -33,7 +33,7 @@ module.exports = function (defaultFuncs, api, ctx) {
       const taskId = ++ctx.wsTaskNumber;
 
       const content = {
-        app_id: "2220391788200892",
+        app_id: String(ctx.appID || ctx.mqttAppID || "2220391788200892"),
         payload: JSON.stringify({
           data_trace_id: null,
           epoch_id: parseInt(utils.generateOfflineThreadingID()),

package/src/engine/client.js

@@ -26,7 +26,7 @@ const DEFAULT_OPTIONS = {
     autoReconnect: true,
     online: true,
     emitReady: false,
-    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.182 Safari/537.36",
 };
 
 /**

package/src/engine/models/buildAPI.js

@@ -74,6 +74,16 @@ async function buildAPI(html, jar, netData, globalOptions, fbLinkFunc, errorRetr
     let region = mqttEndpoint ? new URL(mqttEndpoint).searchParams.get("region")?.toUpperCase() : undefined;
     const irisSeqIDMatch = html.match(/irisSeqID:"(.+?)"/);
     const irisSeqID = irisSeqIDMatch ? irisSeqIDMatch[1] : null;
+
+    // Extract Facebook client-state tokens that are embedded in every page load.
+    // Real browsers include these in every subsequent request to prove the request
+    // originated from a genuine page load. Missing them is a strong bot signal.
+    const spinRMatch = html.match(/"__spin_r"\s*:\s*(\d+)/);
+    const spinTMatch = html.match(/"__spin_t"\s*:\s*(\d+)/);
+    const __spin_r = spinRMatch ? parseInt(spinRMatch[1], 10) : null;
+    const __spin_t = spinTMatch ? parseInt(spinTMatch[1], 10) : null;
+    const __spin_b = 'trunk';
+
     if (globalOptions.bypassRegion && mqttEndpoint) {
         const currentEndpoint = new URL(mqttEndpoint);
         currentEndpoint.searchParams.set('region', globalOptions.bypassRegion.toLowerCase());
@@ -116,6 +126,12 @@ async function buildAPI(html, jar, netData, globalOptions, fbLinkFunc, errorRetr
         validator: globalValidator,
         _emitter: emitter,
         ttstamp,
+        // Client-state spin tokens extracted from the page HTML.
+        // These are included in every subsequent request body to prove the
+        // request originated from a real page load (not a standalone script).
+        __spin_r,
+        __spin_t,
+        __spin_b,
         ...dtsgResult,
     };
     const defaultFuncs = utils.makeDefaults(html, userID, ctx);

package/src/utils/antiSuspension.js

@@ -459,35 +459,6 @@ class AntiSuspension {
         return results;
     }
 
-    /**
-     * Prepare before sending — single delay model.
-     * Enforces smart delay, thread throttle, and volume limits, respects circuit breaker.
-     * If the circuit breaker is tripped (checkpoint/suspension detected) or
-     * volume limits are reached, throws to protect the account.
-     */
-    async prepareBeforeMessage(threadID, message) {
-        if (this.isCircuitBreakerTripped()) {
-            const remaining = this.getCircuitBreakerRemainingMs();
-            const { utils } = this._getUtils();
-            utils && utils.warn && utils.warn("AntiSuspension",
-                `Circuit breaker is tripped. Blocking message send to protect account. ` +
-                `Cooldown remaining: ${Math.ceil(remaining / 1000)}s`);
-            const err = new Error(`Circuit breaker is tripped. Pausing sends to protect account. Retry in ${Math.ceil(remaining / 1000)}s.`);
-            err.error = 'circuit_breaker_tripped';
-            err.remainingMs = remaining;
-            throw err;
-        }
-
-        const volumeWarning = this.checkVolumeLimit(threadID);
-        if (volumeWarning) {
-            const { utils } = this._getUtils();
-            utils && utils.warn && utils.warn("AntiSuspension", volumeWarning);
-        }
-
-        await this.enforceThreadThrottling(threadID);
-        this._incrementDailyStats(threadID);
-    }
-
     getConfig() {
         return {
             messageDelayMs: this.messageDelayMs,

package/src/utils/autoReLogin.js

@@ -205,10 +205,7 @@ class AutoReLoginManager {
 
     async pauseAPIRequests() {
         utils.log("AutoReLogin", "Pausing API requests during re-login...");
-        // Wait long enough for in-flight HTTP requests to drain before we start
-        // re-logging in. A 1s pause was too short — the session cookies could
-        // change mid-request, causing follow-up requests to arrive with stale auth.
-        await new Promise(resolve => setTimeout(resolve, 3000));
+        await new Promise(resolve => setTimeout(resolve, 1000));
     }
 
     resolvePendingRequests(success) {

package/src/utils/headers.js

@@ -28,9 +28,6 @@ function sanitizeHeaders(headers) {
     const out = {};
     for (const [key, value] of Object.entries(headers)) {
         if (!key || typeof key !== 'string') continue;
-        // Skip undefined/null values — these are intentional omissions (e.g.
-        // 'Upgrade-Insecure-Requests' on XHR requests that browsers don't send).
-        if (value === undefined || value === null) continue;
         const cleanKey = key.replace(/[^\x21-\x7E]/g, '').trim();
         if (!cleanKey) continue;
         const cleanVal = sanitizeHeaderValue(value);
@@ -62,16 +59,27 @@ function getRandomTimezone() {
 
 /**
  * Generates a comprehensive and realistic set of headers for requests to Facebook.
+ *
+ * Key fingerprint rules enforced here:
+ *  - Navigate (page load): Accept = full HTML accept, Upgrade-Insecure-Requests = 1,
+ *    Sec-Fetch-Dest/Mode/Site = document/navigate/none. NO Origin.
+ *  - XHR (AJAX/API call): Accept = *\/*, Sec-Fetch-Dest/Mode/Site = empty/cors/same-origin,
+ *    Origin = host, X-Requested-With = XMLHttpRequest. NO Upgrade-Insecure-Requests.
+ *
+ * X-Requested-With is sent consistently on all XHR/API calls. Consistency matters —
+ * sending it sometimes but not others is itself a detectable pattern.
+ *
  * @param {string} url - The target URL.
  * @param {object} options - Global options from context.
  * @param {object} ctx - The application context (containing fb_dtsg, lsd, etc.).
  * @param {object} customHeader - Any extra headers to merge.
- * @param {string} requestType - Type of request: 'xhr' for GraphQL/AJAX or 'navigate' for page navigation
+ * @param {string} requestType - 'xhr' for GraphQL/AJAX or 'navigate' for page navigation.
  * @returns {object} A complete headers object.
  */
 function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const persona = options?.persona || 'desktop';
     const isAndroid = persona === 'android' || persona === 'mobile';
+    const isXhr = requestType === 'xhr';
 
     let userAgent, secChUa, secChUaFullVersionList, secChUaPlatform, secChUaPlatformVersion;
     let androidData = null;
@@ -113,8 +121,6 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const host = new URL(url).hostname;
     const referer = `https://${host}/`;
 
-    const isXhr = requestType === 'xhr';
-
     const locales = options?.cachedLocale || (androidData?.locale ? androidData.locale.replace('_', '-') : getRandomLocale());
 
     if (isAndroid) {
@@ -140,12 +146,9 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
             if (ctx.region) {
                 headers['X-MSGR-Region'] = ctx.region;
             }
-            if (ctx.master) {
-                const { __spin_r, __spin_b, __spin_t } = ctx.master;
-                if (__spin_r) headers['X-Fb-Spin-R'] = String(__spin_r);
-                if (__spin_b) headers['X-Fb-Spin-B'] = String(__spin_b);
-                if (__spin_t) headers['X-Fb-Spin-T'] = String(__spin_t);
-            }
+            if (ctx.__spin_r != null) headers['X-Fb-Spin-R'] = String(ctx.__spin_r);
+            if (ctx.__spin_b)         headers['X-Fb-Spin-B'] = String(ctx.__spin_b);
+            if (ctx.__spin_t != null) headers['X-Fb-Spin-T'] = String(ctx.__spin_t);
         }
 
         if (customHeader) {
@@ -162,10 +165,14 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
     const isMac = secChUaPlatform === '"macOS"';
     const isLinux = secChUaPlatform === '"Linux"';
 
+    // Navigate (page load) Accept mirrors real Chrome — includes avif/webp/apng
+    // XHR Accept is simply */* as sent by Chrome's fetch/XHR APIs
+    const acceptHeader = isXhr
+        ? '*/*'
+        : 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7';
+
     const headers = {
-        'Accept': isXhr
-            ? 'application/json, text/plain, */*'
-            : 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
+        'Accept': acceptHeader,
         'Accept-Language': locales,
         'Accept-Encoding': 'gzip, deflate, br',
         'Cache-Control': 'no-cache',
@@ -177,26 +184,30 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         'Sec-Ch-Ua': secChUa,
         'Sec-Ch-Ua-Full-Version-List': secChUaFullVersionList,
         'Sec-Ch-Ua-Mobile': '?0',
+        'Sec-Ch-Ua-Model': '""',
         'Sec-Ch-Ua-Platform': secChUaPlatform,
         'Sec-Ch-Ua-Platform-Version': secChUaPlatformVersion,
         'Sec-Fetch-Dest': isXhr ? 'empty' : 'document',
         'Sec-Fetch-Mode': isXhr ? 'cors' : 'navigate',
         'Sec-Fetch-Site': isXhr ? 'same-origin' : 'none',
         'User-Agent': userAgent,
-        'Upgrade-Insecure-Requests': isXhr ? undefined : '1',
-        // X-Requested-With is only sent by XHR calls, NOT by page navigations.
-        // Sending it on navigate requests is a clear bot-detection fingerprint
-        // because real browsers never include it for document loads.
-        ...(isXhr ? { 'X-Requested-With': 'XMLHttpRequest' } : {})
     };
 
-    if (isWindows || isMac || isLinux) {
-        headers['Sec-Ch-Ua-Arch'] = '"x86"';
-        headers['Sec-Ch-Ua-Bitness'] = '"64"';
+    if (!isXhr) {
+        headers['Upgrade-Insecure-Requests'] = '1';
     }
 
     if (isXhr) {
         headers['Origin'] = `https://${host}`;
+        // X-Requested-With is sent consistently on all XHR/API requests.
+        // Consistency matters — sending it sometimes but not others is itself
+        // a detectable pattern. Keep it always-on for API calls.
+        headers['X-Requested-With'] = 'XMLHttpRequest';
+    }
+
+    if (isWindows || isMac || isLinux) {
+        headers['Sec-Ch-Ua-Arch'] = '"x86"';
+        headers['Sec-Ch-Ua-Bitness'] = '"64"';
     }
 
     if (ctx) {
@@ -206,15 +217,13 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         if (ctx.region) {
             headers['X-MSGR-Region'] = ctx.region;
         }
-        if (ctx.master) {
-            const { __spin_r, __spin_b, __spin_t } = ctx.master;
-            if (__spin_r) headers['X-Fb-Spin-R'] = String(__spin_r);
-            if (__spin_b) headers['X-Fb-Spin-B'] = String(__spin_b);
-            if (__spin_t) headers['X-Fb-Spin-T'] = String(__spin_t);
-        }
+        // Spin tokens are stored directly on ctx by buildAPI — ctx.master is
+        // never populated and reading from it was dead code that never fired.
+        if (ctx.__spin_r != null) headers['X-Fb-Spin-R'] = String(ctx.__spin_r);
+        if (ctx.__spin_b)         headers['X-Fb-Spin-B'] = String(ctx.__spin_b);
+        if (ctx.__spin_t != null) headers['X-Fb-Spin-T'] = String(ctx.__spin_t);
     }
 
-
     if (customHeader) {
         Object.assign(headers, customHeader);
         if (customHeader.noRef) {
@@ -232,4 +241,4 @@ module.exports = {
     meta,
     getRandomLocale,
     getRandomTimezone
-};
+};

package/src/utils/index.js

@@ -59,7 +59,6 @@ function makeDefaults(html, userID, ctx) {
   const network = require("./axios");
   const constants = require("./constants");
   
-  let reqCounter = 1;
   const revision = constants.getFrom(html, 'revision":', ",");
 
   /**
@@ -68,10 +67,13 @@ function makeDefaults(html, userID, ctx) {
    * @returns {object} The merged object.
    */
   function mergeWithDefaults(obj) {
+    // __req must be random, not a sequential counter. A counter that resets to 1
+    // on every session start is a textbook bot fingerprint that Facebook's systems
+    // detect. Random values match real Chrome behaviour.
     const newObj = {
       av: userID,
       __user: userID,
-      __req: (reqCounter++).toString(36),
+      __req: Math.floor(Math.random() * 36 ** 2).toString(36),
       __rev: revision,
       __a: 1,
       ...(ctx && {
@@ -80,6 +82,15 @@ function makeDefaults(html, userID, ctx) {
       }),
     };
 
+    // Include Facebook's client-state spin tokens when present. These are
+    // extracted from the page HTML at login time and prove each request
+    // originated from a real page load, not a standalone script.
+    if (ctx) {
+      if (ctx.__spin_r != null) newObj.__spin_r = ctx.__spin_r;
+      if (ctx.__spin_t != null) newObj.__spin_t = ctx.__spin_t;
+      if (ctx.__spin_b)         newObj.__spin_b = ctx.__spin_b;
+    }
+
     if (!obj) return newObj;
 
     for (const prop in obj) {

package/src/utils/lsRequest.js

@@ -122,7 +122,7 @@ function buildLsEnvelope(ctx, tasks, versionId = "25459622483894963") {
     const requestId = ++ctx.wsReqNumber;
 
     const envelope = {
-        app_id: "2220391788200892",
+        app_id: String(ctx.appID || ctx.mqttAppID || "2220391788200892"),
         payload: JSON.stringify({
             epoch_id: generateEpochId(),
             tasks,

package/src/utils/rateLimiter.js

@@ -14,12 +14,8 @@ class RateLimiter {
 
         this.ERROR_CACHE_TTL = 300000;
         this.COOLDOWN_DURATION = 60000;
-        // Raised from 50 → 120 req/min. The old limit was too aggressive — it
-        // throttled legitimate API calls (thread info lookups, getSeqID, markAsRead
-        // etc.) and caused unnecessary delays that looked bot-like when many
-        // requests were queued. Facebook's actual rate-limiting kicks in far higher.
-        this.MAX_REQUESTS_PER_MINUTE = 120;
-        this.MAX_CONCURRENT_REQUESTS = 8;
+        this.MAX_REQUESTS_PER_MINUTE = 50;
+        this.MAX_CONCURRENT_REQUESTS = 5;
 
         this.activeRequests = 0;
 
@@ -29,9 +25,7 @@ class RateLimiter {
 
         // Per-endpoint sliding windows
         this._endpointWindows = new Map();
-        // Raised from 20 → 40 req/min per endpoint. The old value throttled
-        // burst-write scenarios (e.g. thread hydration after reconnect) unnecessarily.
-        this._MAX_PER_ENDPOINT_PER_MINUTE = 40;
+        this._MAX_PER_ENDPOINT_PER_MINUTE = 20;
     }
 
     configure(opts = {}) {

package/src/utils/tokenRefresh.js

@@ -111,7 +111,7 @@ class TokenRefreshManager {
             const resp = await utils.get(
                 probeUrl,
                 ctx.jar,
-                { reason: 'reconnect', __a: 1, __req: 'probe' },
+                { reason: 'reconnect', __a: 1, __req: Math.floor(Math.random() * 36 ** 2).toString(36) },
                 ctx.globalOptions,
                 probeCtx
             );
@@ -236,6 +236,14 @@ class TokenRefreshManager {
                 ctx.__rev = revisionMatch[1];
             }
 
+            // Refresh spin tokens alongside fb_dtsg — they are page-state values
+            // embedded in every HTML response and must stay current so requests
+            // continue to pass Facebook's client-state validation.
+            const spinRMatch = html.match(/"__spin_r"\s*:\s*(\d+)/);
+            const spinTMatch = html.match(/"__spin_t"\s*:\s*(\d+)/);
+            if (spinRMatch) ctx.__spin_r = parseInt(spinRMatch[1], 10);
+            if (spinTMatch) ctx.__spin_t = parseInt(spinTMatch[1], 10);
+
             this.lastRefresh = Date.now();
             this.failureCount = 0;