hridoy-ultimate 8.0.0 → 8.0.2

package/ANALYSIS.md

@@ -0,0 +1,31 @@
+# Analysis of the packages reviewed for toru-fca v1.2.1
+
+## Lineages
+| Group | Packages | Notes |
+|---|---|---|
+| A (toru line) | HRIDOY-FCA 2.0.0, ST-FCA 1.2.29, toru-fca 1.1.0 / 1.2.0 | ST ≈ HRIDOY (only index/config/checkUpdate differ). toru 1.2.0 rewrote listenMqtt, refreshFb_dtsg, logout, sendMessage, stopListenMqtt, sendTypingIndicator, index. **Used as base.** |
+| B (eryxenx line) | @eryxenx/fca 1.0.0 / 1.0.4 / 1.1.9, fca-eryxenx-merged, fca-abalcdiokay | ~75% identical files. TypeScript-free but different architecture (src/api/*, E2EE via Signal/koffi). |
+| C (native line) | fca-native 5.0.0, Metachat 1.2.2 | Nearly the same code; adds ErrorHandler, SessionRecovery, rate limiter, etc. |
+| D | shadowx-fca 10.8.0 | B-like plus extra helpers (unsendOnReaction, listenSpeed, reaction v2...). |
+| E | xtreme-fca 1.0.2 | Single bundled dist (TS source not included). No anti-logout, no E2EE. |
+
+## Security findings (NOT merged)
+- **Third-party login API:** group B (`module/loginHelper.js`, default `apiServer: https://minhdong.site`) and the fca-native example config (`https://donixdev.com`) can POST **email, password and the 2FA secret** to that server (`loginViaAPI` / `tokensViaAPI`). It only runs when `autoLogin:true`, but it is a credential-leak risk. Not included. toru-fca logs in only directly to facebook.com.
+- **ST-FCA / HRIDOY `checkUpdate.js`** runs `npm install` automatically. Not included (toru's version only prints a notice).
+- **remoteClient.js** (group B) opens a WebSocket to an arbitrary configured URL and accepts remote commands. Opt-in, but not included.
+- **fca-abalcdiokay and fca-eryxenx-merged ship `Fca_Database/database.sqlite` containing `app_state_backups` rows** — most likely a saved Facebook session (cookies). I did not read it. If it is your account, treat it as exposed and log that session out / change the password. It is NOT in toru-fca.
+- ST/HRIDOY `getUID` uses id.traodoisub.com / api.findids.net (username → uid). Present in toru base already; sends only a public username/URL.
+
+## Ideas ported into 1.2.1
+- shadowx `setMessageReactionv2` → `setMessageReactionSafe` (MQTT first, HTTP retry fallback).
+- Stale-MQTT-client guard (eryxenx `isActiveClient` idea) → `ctx.mqttClient !== mqttClient` guards.
+- Reconnect backoff + old-client teardown (eryxenx/native CriticalBugFixes idea).
+
+## Not ported (and why)
+- E2EE native binaries (messagix .so/.dll, ~17 MB each) — platform-specific, unverified; toru keeps its optional bridge, off by default.
+- fca-native resilience classes (ConnectionPool, RateLimit, Monitoring...) — large, overlapping with what toru already has; would add risk.
+- Theme/AI-theme, broadcast, scheduler, spy, bypassScrap modules — not needed for your goals; "spy/bypassScrap" are scraping-oriented.
+- xtreme — compiled bundle only, cannot be reviewed line by line.
+
+## Limits of this review
+No network, no real Facebook cookie: nothing was run against Facebook. Code was syntax-checked and key functions stub-tested.

package/AUDIT_REPORT.md

@@ -0,0 +1,57 @@
+# TORU-FCA 1.2.4 — Defect Fix Addendum
+
+Found by a static review of the 1.2.3 archive (syntax check, require-resolution, TypeScript `checkJs` undefined-name scan, manual reading) and fixed in 1.2.4:
+
+| # | File | Defect | Status |
+|---|---|---|---|
+| 1 | src/listenMqtt.js | `getSeqID` not in scope inside `scheduleReconnect` -> ReferenceError, auto-reconnect dead | Fixed + regression test |
+| 2 | src/changeCover.js | `log` never required | Fixed + test |
+| 3 | src/createCommentPost.js | `calback` typo; `image` undefined; errors resolved as success | Fixed + tests |
+| 4 | package.json | `form-data`, `https-proxy-agent` undeclared; 3 unused deps | Fixed |
+| 5 | checkUpdate.js | version hard-coded 1.2.1 | Fixed + test |
+| 6 | fca-config.example.json | stale version 1.1.0 | Fixed |
+| 7 | 5 src files | CRLF line endings | Normalised |
+
+Not changed / still open: `yumi-json-bigint` is pinned to `*` (could not look up a safe version offline); no live Facebook/MQTT test was possible; the 1.2.3 limitations below still apply.
+
+---
+
+# (previous) TORU-FCA 1.2.3 — Comparative Audit and Second-Stage Patch Report
+
+## Scope
+This is a static source review and local unit-test run using the supplied TORU-FCA and HRIDOY-FCA archives. No Facebook account, live session, or production Messenger traffic was used. Other FCA archives were used as comparison references, not as proof of runtime correctness.
+
+## Changes carried into 1.2.3
+
+### MQTT lifecycle
+- Clear an existing reconnect timer and dead-connection watchdog when `listenMqtt()` replaces/restarts the listener.
+- Reject and remove pending `ctx.reqCallbacks` on current MQTT transport errors and close events, instead of leaving callbacks waiting until their individual timeout.
+- On explicit `stopListenMqtt()`, clear pending request callbacks with an error and empty the callback map, including when no client is currently present.
+- Added a unit test for pending callback cleanup on explicit stop.
+
+### E2EE bridge lifecycle
+- Track the E2EE reconnect timer in bridge state and ensure repeated `disconnected` events do not create multiple reconnect timers.
+- Use bounded exponential backoff with jitter and `unref()` the timer so it does not keep the Node process alive by itself.
+- Clear reconnect timers on successful connect and explicit disconnect.
+- Disable the native client's own auto-reconnect option and let TORU's wrapper manage retries, avoiding two competing retry managers.
+
+## Local verification
+- `node --check` passed for `index.js`, `e2ee.js`, all `src/*.js` and all `test/*.js` files.
+- `npm test`: 3 tests passed, 0 failed.
+- `npm run check`: passed.
+- `npm pack --dry-run`: package contents validated for `toru-fca@1.2.3`.
+- The publishable source archive excludes obvious session filenames (`cookie.txt`, `appstate.json`, `*.session`). This does not prove every file is free of secrets; review before publishing.
+
+## Important limitations / not verified
+1. No live MQTT integration test was run. Reconnect timing, subscription restoration, sequence ID refresh, and callback cleanup still need a controlled integration test.
+2. No E2EE native bridge was loaded. The package archive does not bundle the required native `build/messagix` runtime binary, so E2EE connection, key persistence, and message delivery remain unverified.
+3. No multi-hour memory/listener soak test was run.
+4. `api.logout()` intentionally blocks logout and invokes its callback as success in the existing design. This remains misleading API behavior and should be redesigned in a separately documented breaking-change-safe patch.
+5. Reaction MQTT acknowledgment may confirm a transport/task response rather than proving the final reaction is visible to recipients. Timeout delivery remains unknown.
+6. No patch can guarantee Facebook session persistence or prevent server-side account restrictions.
+
+## Recommended next steps
+- Test MQTT disconnect/reconnect and manual stop in a sandbox using mocked sockets before using a live account.
+- Confirm that the native E2EE client supports repeated `connect()` calls on the same instance after a disconnect; if not, recreate the client safely during retries and detach old listeners.
+- Add GoatBot API compatibility tests and run a controlled 2–6 hour heap/RSS/listener soak test.
+- Inspect all archive contents for credentials/session data before publishing.

package/CHANGELOG.md

@@ -1,325 +1,43 @@
 # Changelog
 
-All notable changes to this project are documented in this file.
+## 8.0.1
+- Rename: package/branding is now `hridoy-ultimate` (was `toru-fca`) in banner, logs, update check, README, examples and config comments.
+- Update check env var `HRIDOY_ULTIMATE_NO_UPDATE_CHECK` added (old `TORU_FCA_NO_UPDATE_CHECK` still honoured).
+- Internal globals (`global._toruFcaConfig`, `_toruFcaInitDone`) intentionally unchanged for backward compatibility.
+
+## 1.2.4
+- Fix (critical): `scheduleReconnect()` called `getSeqID()` which is only defined inside the module factory, so every MQTT reconnect threw `ReferenceError` in a timer. Now exposed as `ctx._getSeqID` and called with a try/catch.
+- Fix: `changeCover` used `log` without requiring `npmlog`.
+- Fix: `createCommentPost` typo `calback`, undefined `image` in attachment error, and `cb(null, err)` resolving errors as success (now rejects).
+- Fix: `package.json` declares `form-data` and `https-proxy-agent` (were required but undeclared); removed unused `chalk`, `tough-cookie`, `protobufjs`.
+- Fix: `checkUpdate.js` hard-coded version 1.2.1; now read from `package.json`.
+- Chore: example config version synced; CRLF -> LF in `reply.js`, `getUID.js`, `httpGet.js`, `httpPost.js`, `changeAvt.js`.
+- Add: `scripts/check.js` (`npm run check`) and `test/fixes-1_2_4.test.js` (6 regression tests, incl. a reconnect test verified to fail on the old code).
+
+## 1.2.3
+- Fix: E2EE reconnect timers are tracked, deduplicated, bounded with exponential backoff, and cleared on explicit disconnect.
+- Fix: TORU owns E2EE reconnect scheduling to avoid competing reconnect managers.
+- Fix: MQTT listener replacement clears stale reconnect/watchdog timers.
+- Fix: pending MQTT request callbacks are failed and cleaned up on transport error/close or explicit stop.
+- Add: regression test for pending MQTT callback cleanup on stop.
+
+## 1.2.2
+- Fix: reaction MQTT requests now reject on missing acknowledgement instead of assuming success.
+- Fix: reaction MQTT callback and Promise settle once and share the same result.
+- Fix: forward explicit MQTT response errors to request callbacks.
+- Fix: callback type checks no longer execute user callbacks as a test (pin/edit/block helpers).
+- Fix: atomic session writes use unique temporary names and restrictive file permissions.
+- Add: Node.js syntax-check script and focused MQTT reaction tests.
+
+
+## 1.2.1
+- Fix: setMessageReactionMqtt invoked the user callback prematurely / threw synchronously; now Promise+callback, real ack.
+- Add: `/ls_resp` dispatch to `ctx.reqCallbacks` (reaction/pin/block helpers finally get acks).
+- Add: richer `message_reaction` event (off, action, isGroup, isSingleUser, null-safe).
+- Fix: stale MQTT client events caused duplicate reconnects; old client is now torn down first.
+- Fix: getSeqID transient failure during reconnect no longer kills the listener (backoff retry).
+- Fix: cookie expiry extension edited a copy; now updates the live jar.
+- Fix: login callback double-fire guard.
+- Change: uncaughtException logs stack for non-network errors.
+- Change: e2ee disabled by default; spinner TTY-only; update check opt-out.
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) where applicable.
-
----
-
-## [4.0.0] - 2026-06-10
-
-### Major — NEXCA Engine Integration
-
-- **MQTT**: nexca v1.4.11 এর `listenMqtt.js` দিয়ে replace — better stability, autoReconnect, jitter
-- **E2EE**: Signal Protocol encrypted conversations support (`api.connectE2EE()`, `api.listenE2EE()`, `api.e2ee.*`)
-- **sessionGuard**: appstate auto-save every 3min, corruption guard, auto-backup (`api.sessionGuard()`)
-- **sendBroadcast**: rate-limited multi-thread broadcast (`api.sendBroadcast(msg, threadIDs, opts)`)
-- **sendMessage**: nexca version (MQTT-first + HTTP fallback, better attachment handling)
-- **OldMessage**: nexca HTTP-only send, `sendMessageDM` shorthand
-- All toru-ultimate API files preserved (GoatBot compatible signatures)
-- Copyright: toru-ultimate by HR ID OY
-
----
-
-## [3.1.0] - 2026-06-09
-
-### Fixed (MQTT stability — account safety)
-
-- **`connectMqtt.js`: `isActiveClient()` guard added** — stale/previous MQTT client এর events আর process হবে না। Multiple reconnect race condition বন্ধ।
-- **`connectMqtt.js`: Subscribe → wait SUBACK → then publish** — আগে `topics.forEach(subscribe)` করে immediately publish হতো। Facebook এটাকে invalid sequence ধরে "Connection refused: No subscription existed" দিয়ে socket বন্ধ করত। এখন callback-based subscribe দিয়ে SUBACK পাওয়ার পরেই publish।
-- **`connectMqtt.js`: `connectTimeout` 5000ms → 12000ms** — slow network এ premature timeout থেকে logout বন্ধ।
-- **`connectMqtt.js`: `T_MS_WAIT_TIMEOUT_MS` 5000ms → 8000ms** — slow server response এ needless reconnect cycle বন্ধ।
-- **`connectMqtt.js`: `close`/`disconnect` handlers এ `autoReconnect` যোগ** — আগে close/disconnect এ reconnect হতো না। বট offline হয়ে যেত।
-- **`connectMqtt.js`: Previous client cleanup before new connection** — stale client memory leak বন্ধ।
-- **`connectMqtt.js`: Reconnect jitter (±400ms)** — একসাথে অনেক reconnect storm কমাবে।
-
----
-
-## [3.0.29] - 2026-02-22
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.30] - 2026-02-26
-
-- **Security & supply chain**
-  - Removed legacy/self-dependency and old HTTP stack (`request`, `sqlite3`, `npmlog`), pinned `axios` to a secure version, and cleaned up `npm audit` findings (no Critical/High CVEs in runtime deps).
-  - Added `SECURITY.md`, restricted the published files via `package.json.files` (no Horizon refs, no bundled node_modules) and wired `npm publish --provenance` into CI for verifiable builds.
-- **Event-driven core**
-  - Promoted the `api` object to an `EventEmitter` with lifecycle events: `sessionExpired`, `autoLoginSuccess`, `autoLoginFailed`, `checkpoint`/`checkpoint_282`/`checkpoint_956`, `loginBlocked`, `rateLimit`, `networkError`.
-  - Hooked these into `loginParser` and the HTTP layer so consumers can react to login, checkpoint, and network conditions without brittle error-string matching.
-- **Thread/User info & DB-backed anti-get-info**
-  - Refactored `getThreadInfo` and `getUserInfo` to use GraphQL batch calls with optional SQLite caching (via Sequelize models), reducing repeated Facebook requests and aligning with Horizon-style anti-get-info behavior.
-  - Added configuration toggles in `fca-config.json` (`antiGetInfo.AntiGetThreadInfo`, `antiGetInfo.AntiGetUserInfo`) to switch between DB-backed and legacy behaviors when needed.
-- **Remote control & analytics**
-  - Introduced a lightweight WebSocket **remote control client** (`src/remote/remoteClient.js`) driven by `remoteControl` config, emitting `remoteConnected`, `remoteDisconnected`, `remoteStop`, `remoteBroadcast`, and `remoteMessage` events for integration with external dashboards.
-  - Taught the MQTT layer to update per-thread statistics in SQLite via an atomic `Thread.increment("messageCount")` on each message, enabling future analytics (e.g. “most active threads”) without impacting message latency.
-- **Docs & utilities**
-  - Updated `README.md`, `DOCS.md`, and `docs/ARCHITECTURE.md` to document the new event system, DB caching behavior, remote control, proxy configuration, and the optional `broadcast` helper.
-
-## [3.0.28] - 2026-02-22
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.27] - 2026-02-22
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.25] - 2026-02-05
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.23] - 2026-01-30
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.22] - 2026-01-07
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.21] - 2025-12-31
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.20] - 2025-12-31
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.19] - 2025-12-31
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.17] - 2025-12-16
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.15] - 2025-12-12
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.12] - 2025-12-05
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.11] - 2025-12-05
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.10] - 2025-12-05
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.9] - 2025-12-05
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.8] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.7] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.6] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.5] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.4] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.3] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [3.0.2] - 2025-11-27
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.32] - 2025-10-30
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.31] - 2025-10-27
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.30] - 2025-10-19
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.29] - 2025-10-19
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.28] - 2025-10-18
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.27] - 2025-10-18
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.26] - 2025-10-16
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.25] - 2025-10-12
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.24] - 2025-10-11
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.23] - 2025-10-11
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.22] - 2025-10-09
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.21] - 2025-10-08
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.20] - 2025-10-08
-
-- **Added:** Config option to enable/disable `autoLogin`.
-- **Added:** Auto-update feature (configurable).
-
-## [2.0.19] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.18] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.17] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.16] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.15] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.14] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.13] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.12] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.11] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.10] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.9] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.8] - 2025-10-07
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.7] - 2025-10-06
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.6-beta] - 2025-10-06
-
-- Beta release (hotfix / version bump).
-
-## [2.0.5] - 2025-10-06
-
-- **Added:** Toggle for `autoLogin` in config.
-- **Added:** Auto-update feature.
-
-## [2.0.4] - 2025-10-05
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.3] - 2025-10-05
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.2] - 2025-10-05
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.1] - 2025-10-05
-
-- Maintenance release (hotfix / version bump).
-
-## [2.0.0] - 2025-10-05
-
-- Major version bump (hotfix / version bump).
-
-## [1.0.19] - 2025-05-23
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.18] - 2025-05-22
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.17] - 2025-05-07
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.16] - 2025-05-07
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.15] - 2025-05-03
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.14] - 2025-04-28
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.13] - 2025-04-28
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.12] - 2025-04-28
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.11] - 2025-04-24
-
-- Maintenance release (hotfix / version bump).
-
-## [1.0.10] - 2025-04-24
-
-- Maintenance release (hotfix / version bump).
-
----
-
-[3.0.29]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.28...v3.0.29
-[3.0.28]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.27...v3.0.28
-[3.0.27]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.25...v3.0.27
-[1.0.10]: https://github.com/Donix-VN/fca-unofficial/releases/tag/v1.0.10
-
-## v3.0.30 - 2026-03-07
-- Hotfix / auto bump