@lazyneoaz/metachat 1.1.4 → 1.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyneoaz/metachat",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "type": "commonjs",
   "types": "src/types/index.d.ts",
   "description": "Advanced Facebook Chat API client for building Messenger bots — real-time messaging, thread management, MQTT, and session stability.",

package/src/engine/models/buildAPI.js

@@ -74,6 +74,16 @@ async function buildAPI(html, jar, netData, globalOptions, fbLinkFunc, errorRetr
     let region = mqttEndpoint ? new URL(mqttEndpoint).searchParams.get("region")?.toUpperCase() : undefined;
     const irisSeqIDMatch = html.match(/irisSeqID:"(.+?)"/);
     const irisSeqID = irisSeqIDMatch ? irisSeqIDMatch[1] : null;
+
+    // Extract Facebook client-state tokens that are embedded in every page load.
+    // Real browsers include these in every subsequent request to prove the request
+    // originated from a genuine page load. Missing them is a strong bot signal.
+    const spinRMatch = html.match(/"__spin_r"\s*:\s*(\d+)/);
+    const spinTMatch = html.match(/"__spin_t"\s*:\s*(\d+)/);
+    const __spin_r = spinRMatch ? parseInt(spinRMatch[1], 10) : null;
+    const __spin_t = spinTMatch ? parseInt(spinTMatch[1], 10) : null;
+    const __spin_b = 'trunk';
+
     if (globalOptions.bypassRegion && mqttEndpoint) {
         const currentEndpoint = new URL(mqttEndpoint);
         currentEndpoint.searchParams.set('region', globalOptions.bypassRegion.toLowerCase());
@@ -116,6 +126,12 @@ async function buildAPI(html, jar, netData, globalOptions, fbLinkFunc, errorRetr
         validator: globalValidator,
         _emitter: emitter,
         ttstamp,
+        // Client-state spin tokens extracted from the page HTML.
+        // These are included in every subsequent request body to prove the
+        // request originated from a real page load (not a standalone script).
+        __spin_r,
+        __spin_t,
+        __spin_b,
         ...dtsgResult,
     };
     const defaultFuncs = utils.makeDefaults(html, userID, ctx);

package/src/utils/headers.js

@@ -62,13 +62,12 @@ function getRandomTimezone() {
  *
  * Key fingerprint rules enforced here:
  *  - Navigate (page load): Accept = full HTML accept, Upgrade-Insecure-Requests = 1,
- *    Sec-Fetch-Dest/Mode/Site = document/navigate/none. NO X-Requested-With, NO Origin.
+ *    Sec-Fetch-Dest/Mode/Site = document/navigate/none. NO Origin.
  *  - XHR (AJAX/API call): Accept = *\/*, Sec-Fetch-Dest/Mode/Site = empty/cors/same-origin,
- *    Origin = host. NO Upgrade-Insecure-Requests.
+ *    Origin = host, X-Requested-With = XMLHttpRequest. NO Upgrade-Insecure-Requests.
  *
- * Real Chrome never sends X-Requested-With automatically — it is a jQuery/XHR
- * legacy header that Facebook's own modern client does NOT include and that
- * Facebook's bot-detection system flags when seen on navigation requests.
+ * X-Requested-With is sent consistently on all XHR/API calls. Consistency matters —
+ * sending it sometimes but not others is itself a detectable pattern.
  *
  * @param {string} url - The target URL.
  * @param {object} options - Global options from context.
@@ -147,12 +146,9 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
             if (ctx.region) {
                 headers['X-MSGR-Region'] = ctx.region;
             }
-            if (ctx.master) {
-                const { __spin_r, __spin_b, __spin_t } = ctx.master;
-                if (__spin_r) headers['X-Fb-Spin-R'] = String(__spin_r);
-                if (__spin_b) headers['X-Fb-Spin-B'] = String(__spin_b);
-                if (__spin_t) headers['X-Fb-Spin-T'] = String(__spin_t);
-            }
+            if (ctx.__spin_r != null) headers['X-Fb-Spin-R'] = String(ctx.__spin_r);
+            if (ctx.__spin_b)         headers['X-Fb-Spin-B'] = String(ctx.__spin_b);
+            if (ctx.__spin_t != null) headers['X-Fb-Spin-T'] = String(ctx.__spin_t);
         }
 
         if (customHeader) {
@@ -181,6 +177,7 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         'Accept-Encoding': 'gzip, deflate, br',
         'Cache-Control': 'no-cache',
         'Connection': 'keep-alive',
+        'DNT': '1',
         'Host': host,
         'Pragma': 'no-cache',
         'Referer': referer,
@@ -196,23 +193,18 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         'User-Agent': userAgent,
     };
 
-    // Upgrade-Insecure-Requests is a navigation-only hint — browsers never
-    // include it on XHR/fetch calls. Sending it on XHR is a bot fingerprint.
     if (!isXhr) {
         headers['Upgrade-Insecure-Requests'] = '1';
     }
 
-    // Origin is only present on cross-origin or same-origin XHR/fetch requests.
-    // Real browsers do NOT send Origin on top-level page navigations (Sec-Fetch-Mode: navigate).
     if (isXhr) {
         headers['Origin'] = `https://${host}`;
+        // X-Requested-With is sent consistently on all XHR/API requests.
+        // Consistency matters — sending it sometimes but not others is itself
+        // a detectable pattern. Keep it always-on for API calls.
+        headers['X-Requested-With'] = 'XMLHttpRequest';
     }
 
-    // X-Requested-With is NOT a browser-native header — it is a jQuery/XHR
-    // convention that Facebook's own modern web client does not set.
-    // Sending it (especially on navigate requests) is a well-known bot fingerprint
-    // that Facebook's detection system keys on. We never send it.
-
     if (isWindows || isMac || isLinux) {
         headers['Sec-Ch-Ua-Arch'] = '"x86"';
         headers['Sec-Ch-Ua-Bitness'] = '"64"';
@@ -225,12 +217,11 @@ function getHeaders(url, options, ctx, customHeader, requestType = 'navigate') {
         if (ctx.region) {
             headers['X-MSGR-Region'] = ctx.region;
         }
-        if (ctx.master) {
-            const { __spin_r, __spin_b, __spin_t } = ctx.master;
-            if (__spin_r) headers['X-Fb-Spin-R'] = String(__spin_r);
-            if (__spin_b) headers['X-Fb-Spin-B'] = String(__spin_b);
-            if (__spin_t) headers['X-Fb-Spin-T'] = String(__spin_t);
-        }
+        // Spin tokens are stored directly on ctx by buildAPI — ctx.master is
+        // never populated and reading from it was dead code that never fired.
+        if (ctx.__spin_r != null) headers['X-Fb-Spin-R'] = String(ctx.__spin_r);
+        if (ctx.__spin_b)         headers['X-Fb-Spin-B'] = String(ctx.__spin_b);
+        if (ctx.__spin_t != null) headers['X-Fb-Spin-T'] = String(ctx.__spin_t);
     }
 
     if (customHeader) {

package/src/utils/index.js

@@ -59,7 +59,6 @@ function makeDefaults(html, userID, ctx) {
   const network = require("./axios");
   const constants = require("./constants");
   
-  let reqCounter = 1;
   const revision = constants.getFrom(html, 'revision":', ",");
 
   /**
@@ -68,10 +67,13 @@ function makeDefaults(html, userID, ctx) {
    * @returns {object} The merged object.
    */
   function mergeWithDefaults(obj) {
+    // __req must be random, not a sequential counter. A counter that resets to 1
+    // on every session start is a textbook bot fingerprint that Facebook's systems
+    // detect. Random values match real Chrome behaviour.
     const newObj = {
       av: userID,
       __user: userID,
-      __req: (reqCounter++).toString(36),
+      __req: Math.floor(Math.random() * 36 ** 2).toString(36),
       __rev: revision,
       __a: 1,
       ...(ctx && {
@@ -80,6 +82,15 @@ function makeDefaults(html, userID, ctx) {
       }),
     };
 
+    // Include Facebook's client-state spin tokens when present. These are
+    // extracted from the page HTML at login time and prove each request
+    // originated from a real page load, not a standalone script.
+    if (ctx) {
+      if (ctx.__spin_r != null) newObj.__spin_r = ctx.__spin_r;
+      if (ctx.__spin_t != null) newObj.__spin_t = ctx.__spin_t;
+      if (ctx.__spin_b)         newObj.__spin_b = ctx.__spin_b;
+    }
+
     if (!obj) return newObj;
 
     for (const prop in obj) {

package/src/utils/tokenRefresh.js

@@ -111,7 +111,7 @@ class TokenRefreshManager {
             const resp = await utils.get(
                 probeUrl,
                 ctx.jar,
-                { reason: 'reconnect', __a: 1, __req: 'probe' },
+                { reason: 'reconnect', __a: 1, __req: Math.floor(Math.random() * 36 ** 2).toString(36) },
                 ctx.globalOptions,
                 probeCtx
             );
@@ -236,6 +236,14 @@ class TokenRefreshManager {
                 ctx.__rev = revisionMatch[1];
             }
 
+            // Refresh spin tokens alongside fb_dtsg — they are page-state values
+            // embedded in every HTML response and must stay current so requests
+            // continue to pass Facebook's client-state validation.
+            const spinRMatch = html.match(/"__spin_r"\s*:\s*(\d+)/);
+            const spinTMatch = html.match(/"__spin_t"\s*:\s*(\d+)/);
+            if (spinRMatch) ctx.__spin_r = parseInt(spinRMatch[1], 10);
+            if (spinTMatch) ctx.__spin_t = parseInt(spinTMatch[1], 10);
+
             this.lastRefresh = Date.now();
             this.failureCount = 0;