hridoy-ultimate 8.0.0 → 8.0.2

package/README.md

@@ -1,379 +1,134 @@
-<div align="center">
+# hridoy-ultimate v8.0.1
 
-<h1>⚡ toru-ultimate</h1>
+**Ultimate Merged, Fixed & Advanced Facebook Chat API**
 
-<p><b>Unofficial Facebook Messenger bot API for Node.js</b><br>
-Stable MQTT core · Signal Protocol E2EE · Session protection · 90+ methods</p>
+> Cookie-based login, session persistence, and MQTT reconnection are best-effort. Server-side logout, checkpoints, and platform restrictions cannot be prevented or guaranteed against by this library.
 
-<p>
-<img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen?style=for-the-badge" alt="node">
-<img src="https://img.shields.io/badge/E2EE-Signal%20Protocol-6f42c1?style=for-the-badge" alt="e2ee">
-<img src="https://img.shields.io/badge/GoatBot-compatible-orange?style=for-the-badge" alt="goatbot">
-<img src="https://img.shields.io/badge/license-MIT-blue?style=for-the-badge" alt="license">
-</p>
+---
 
-<p>
-<a href="#-quick-start">Quick Start</a> ·
-<a href="#-features">Features</a> ·
-<a href="#-e2ee">E2EE</a> ·
-<a href="#-tools">Tools</a> ·
-<a href="#-api-reference">API</a> ·
-<a href="#-options">Options</a>
-</p>
+## ✅ Features
 
-</div>
+| Feature | Status |
+|---|---|
+| Session refresh helper (best-effort) | ⚠️ Best-effort only |
+| Conservative presence/delay options | ⚠️ No guarantee |
+| Inbox Smooth (bot inbox reply) | ✅ Active |
+| GoatBot Compatible | ✅ Ready |
+| Session Guard (auto-save) | ✅ Every 3min |
+| fb_dtsg Auto-Refresh | ✅ Every 20min |
+| MQTT Stable Reconnect | ✅ Active |
+| Error reporting | ✅ Host process handlers preserved |
+| E2EE Labyrinth Bridge | ✅ Active |
+| Facebook Protection | ✅ New in v1.0.6 |
+| Human-like Delay | ✅ New in v1.0.6 |
 
 ---
 
-## 🚀 Quick Start
+## 📦 Install
 
 ```bash
-npm install toru-ultimate
+npm install
 ```
 
-> Requires **Node.js 20+**
+---
+
+## 🚀 Usage (GoatBot / Goat-Bot)
 
-```javascript
-const login = require("toru-ultimate");
+```js
+const login = require("hridoy-ultimate");
+const fs = require("fs");
 
-login({ appState: require("./account.json") }, { listenEvents: true }, (err, api) => {
-  if (err) throw err;
+login({ appState: JSON.parse(fs.readFileSync("appstate.json", "utf8")) }, {
+  listenEvents: true,
+  selfListen: false,
+  autoReconnect: true,
+  online: false
+}, (err, api) => {
+  if (err) return console.error(err);
 
-  api.sessionGuard("./account.json");
+  // Session guard — auto-save appstate
+  api.sessionGuard("appstate.json");
 
   api.listenMqtt((err, event) => {
-    if (err) throw err;
-    if (event.type === "message") api.sendMessage(event.body, event.threadID);
+    if (event.type === "message") {
+      api.sendMessage("Hello!", event.threadID);
+    }
   });
 });
 ```
 
 ---
 
-## ✨ Features
-
-| | Feature | What you get |
-|---|---|---|
-| 📡 | **NEXCA MQTT core** | Auto-reconnect with jitter, extended `connectTimeout`, stale-client guard (`isActiveClient()`), fixed subscribe race condition |
-| 🔐 | **E2EE** | Real encrypted conversations over Signal Protocol, auto-connects after login |
-| 🎞️ | **Native media engine** | Optional mautrix-go engine for reliable E2EE media, reactions and unsend |
-| 🛡️ | **sessionGuard** | Auto-save, corruption guard, `.bak` backup, silent-logout protection |
-| 🧑 | **Humanizer** | Human-like reply delay, per-thread cooldown, typing indicator |
-| 📢 | **sendBroadcast** | Rate-limited, parallel or sequential multi-thread sending |
-| 🤖 | **MessengerBot** | Discord.js / Telegraf style: `.command`, `.hears`, `.launch` |
-| 🧩 | **createFcaClient** | Namespaced facade: `client.messages`, `client.threads`, `client.users` |
-| 🐐 | **GoatBot / Mirai ready** | Drop-in replacement, signatures unchanged (`threadID` optional etc.) |
+## ⚙️ config.json Options
 
----
-
-## 🔐 E2EE
-
-`connectE2EE()` runs **automatically** right after login. Do not call it yourself, a second call opens a racing connection. Check status with `api.e2ee.isConnected()`.
-
-```javascript
-api.listenE2EE((err, event) => {
-  if (event.type !== "message") return;
-  if (event.isE2EE) api.e2ee.sendMessage(event.threadID, "Encrypted reply!");
-  else api.sendMessage("Normal reply!", event.threadID);
-});
-```
-
-```javascript
-await api.e2ee.sendMessage(threadID, "Hello!");
-await api.e2ee.sendMessage(threadID, { body: "Photo!", attachment: fs.createReadStream("photo.jpg") });
-await api.e2ee.sendReaction(threadID, messageID, "❤️");
-await api.e2ee.sendTyping(threadID, true);
-await api.e2ee.unsendMessage(messageID, threadID);
-await api.e2ee.editMessage(threadID, messageID, "Updated!");
-await api.e2ee.disconnect();
-```
-
-**GoatBot users:** nothing else to change. `api.sendMessage`, `api.setMessageReaction` and `api.unsendMessage` detect encrypted DMs and route through E2EE internally. If your `login.js` has an explicit `api.connectE2EE()` call, delete it.
-
-<details>
-<summary><b>🎞️ Native media engine (opt-in)</b></summary>
-
-<br>
-
-Image, video, audio and document sends, reactions and unsend in E2EE threads can run through a precompiled **mautrix-go / mautrix-meta** binary (`src/api/socket/e2ee/native/`) via `koffi`.
-
-**Disabled by default.** Both engines register as the same E2EE device, and Facebook keeps only one live socket per device, so running both makes them kick each other in a loop. Enable it only if you accept that churn:
-
-```bash
-FCA_E2EE_NATIVE=1
-```
-
-| Mode | Works |
-|---|---|
-| **Off** (default) | E2EE DM text and DM media via the built-in engine. E2EE group send/receive and markRead unavailable |
-| **On** | Adds E2EE group text, native media, reactions, unsend, edit, markRead |
-
-- Binaries ship for **Linux (.so)** and **Windows (.dll)** x64. On macOS or ARM the load fails and everything falls back to the built-in engine.
-- On any native failure the log shows `[native-media] ... falling back to legacy vendor engine`.
-- The E2EE socket User-Agent defaults to desktop Windows Chrome 139. Override with `FCA_E2EE_UA`.
-
-</details>
-
-<details>
-<summary><b>📥 Receiving E2EE media</b></summary>
-
-<br>
-
-Incoming encrypted attachments (including replies) are decrypted and served on a short-lived local URL (`http://127.0.0.1:<port>/<token>`, 15 min TTL), then filled into `event.attachments` and `event.messageReply.attachments`, same shape as normal attachments. Reply-based commands work unchanged.
-
-```javascript
-if (event.messageReply?.attachments.length) {
-  const url = event.messageReply.attachments[0].url; // works for E2EE too
+```json
+{
+  "antiLogout": { "enabled": true, "refreshIntervalMs": 1200000 },
+  "sessionGuard": { "enabled": true, "intervalMs": 180000 },
+  "automation": { "enabled": false },
+  "smooth": { "enabled": true, "messageDelay": 300 },
+  "facebookProtection": { "enabled": true, "blockAutomationDetection": true, "humanLikeDelay": true },
+  "inbox": { "enabled": true, "replyToInbox": true }
 }
 ```
 
-If media fails, check the console for `[media-resolve]` / `[media-decode]`. You may need to adjust `FB_E2EE_MEDIA_DOWNLOAD_HOST` (default `rupload.facebook.com`).
-
-</details>
-
 ---
 
-## 🧰 Tools
-
-### 🛡️ sessionGuard
-
-```javascript
-api.sessionGuard("./account.json", { interval: 3 * 60 * 1000, debounce: 30 * 1000 });
-
-api.saveSession();           // force save now
-api.restoreSessionBackup();  // restore from .bak
-api.stopSessionGuard();      // stop the timer
-```
-
-Saves every N minutes and after each successful send (debounced). Never overwrites a larger appstate with a smaller one, and writes a `.bak` before every overwrite.
-
-### 🧑 Humanizer (command anti-spam)
-
-On by default. Delays command replies, applies a per-thread cooldown, and drops commands sent faster than a human could.
-
-```javascript
-login({ appState }, {
-  humanize: {
-    enabled: true,
-    reactDelayMs: [2000, 3000], // random delay before a command passes
-    cooldownMs: 5500,           // min gap between accepted commands
-    resetMs: 10000,             // idle time before cooldown resets
-    maxPerMinute: 20,           // global cap
-    commands: ["/", "!", "."],  // prefixes counted as commands
-    perThread: true
-  }
-}, cb);
-
-api.setOptions({ humanize: { enabled: false } }); // turn off
-```
-
-Under GoatBot it also detects no-prefix admin commands, `onChat` triggers and `onReply` flows automatically. For anything else:
-
-```javascript
-const h = api.getHumanizer();
-h.setMatcher((event) => event.body === "my trigger");
-h.stats();  // accepted / dropped counters
-h.reset();  // clear cooldown state
-```
-
-The typing indicator and reply delay are the same window, not two stacked waits.
-
-### 📢 sendBroadcast
-
-```javascript
-const result = await api.sendBroadcast("Hello everyone!", ["T1", "T2", "T3"], {
-  delay: 2000,
-  parallel: 2,
-  onEach: (err, info, id) => console.log(err ? "Failed: " + id : "Sent: " + id)
-});
-console.log(`${result.sent.length}/${result.total} delivered`);
-```
-
-### 🤖 MessengerBot
-
-```javascript
-const { createMessengerBot } = require("toru-ultimate");
-
-const bot = await createMessengerBot(
-  { appState: require("./account.json") },
-  { commandPrefix: "/", stopOnSignals: true }
-);
+## 🔐 Anti-Logout System
 
-bot.command("ping", async ctx => await ctx.replyAsync("pong 🏓"));
-bot.hears(/hello/i, async ctx => await ctx.replyAsync("Hi! 👋"));
-bot.on("messageCreate", event => console.log(event.body));
-
-await bot.launch({ stopOnSignals: true });
-```
-
-### 🧩 createFcaClient
-
-```javascript
-const { createFcaClient } = require("toru-ultimate");
-const client = createFcaClient(api);
-
-await client.messages.send("Hello!", threadID);
-await client.messages.react("❤️", messageID, threadID);
-await client.threads.getInfo(threadID);
-await client.users.getInfo(userID);
-await client.account.refreshDtsg();
-```
+Cookie login করলে `api.logout()` automatically blocked হয়।
+- Session refresh does not guarantee that Facebook will preserve a login session
+- `api.logout()` is currently overridden; use `api.forceLogout()` only when you explicitly intend to terminate the session
+- Force logout দরকার হলে: `api.forceLogout()`
+- Anti-logout বন্ধ করতে: `api.stopAntiLogout()`
 
 ---
 
-## 📖 API Reference
-
-<details open>
-<summary><b>💬 Messages</b></summary>
-
-```javascript
-api.sendMessage("Hello!", threadID);
-api.sendMessage({ body: "Photo!", attachment: fs.createReadStream("photo.jpg") }, threadID);
-api.sendMessage({ body: "Hey @John", mentions: [{ id: "uid", tag: "@John", fromIndex: 4 }] }, threadID);
-api.sendMessage({ sticker: "369239263222822" }, threadID);
-api.sendMessage({ location: { latitude: 23.8, longitude: 90.4, current: true } }, threadID);
-api.sendGif("https://media.giphy.com/xyz.gif", threadID);
-api.sendLocation(23.8, 90.4, threadID);
-api.sendImage("./photo.jpg", threadID, "caption");
-api.sendVideo("./video.mp4", threadID);
-api.sendAudio("./voice.ogg", threadID);
-api.sendFile("./doc.pdf", threadID);
-api.shareLink("https://github.com", threadID, "Check this!");
-api.shareContact("Meet my friend!", userID, threadID);
-
-api.editMessage("Updated text", messageID);
-api.unsendMessage(messageID);
-api.deleteMessage([messageID]);
-api.setMessageReaction("😍", messageID, threadID); // threadID optional
-api.setMessageReaction("", messageID);              // remove reaction
-api.getMessage(threadID, messageID);
-api.forwardAttachment(attachmentID, [userID]);
-api.uploadAttachment([fs.createReadStream("photo.jpg")]);
-```
-
-</details>
+## 📊 API Methods
 
-<details>
-<summary><b>👁️ Read receipts & typing</b></summary>
-
-```javascript
-api.markAsRead(threadID);
-api.markAsReadAll();
-api.markAsDelivered(threadID, messageID);
-api.markAsSeen();
-api.sendTypingIndicator(threadID, true);
-```
-
-</details>
-
-<details>
-<summary><b>🧵 Threads & groups</b></summary>
-
-```javascript
-api.getThreadInfo(threadID);
-api.getThreadList(10, null, ["INBOX"]);
-api.getThreadHistory(threadID, 20);
-api.createGroup("Hey!", ["uid1", "uid2"]);
-api.deleteThread(threadID);
-api.muteThread(threadID, 3600);
-api.changeArchivedStatus(threadID, true);
-api.handleMessageRequest(threadID, true);
-api.searchForThread("query");
-
-api.setTitle("New Name", threadID);
-api.changeThreadColor("#0084FF", threadID);
-api.changeThreadEmoji("🔥", threadID);
-api.changeNickname("The Boss", threadID, userID);
-api.changeGroupImage(fs.createReadStream("group.jpg"), threadID);
-api.changeAdminStatus(threadID, userID, true);
-api.addUserToGroup(userID, threadID);
-api.removeUserFromGroup(userID, threadID);
-api.createPoll("Question?", threadID, { "Yes": false, "No": false });
-api.pinMessage(messageID, threadID);
-api.unpinMessage(messageID, threadID);
-```
-
-</details>
-
-<details>
-<summary><b>👤 Users & social</b></summary>
-
-```javascript
-api.getUserInfo(userID);
-api.getUserID("John Doe", callback);
-api.getUID("https://facebook.com/zuck");
-api.getFriendsList();
-api.getAvatarUser(userID);
-api.getProfileInfo(userID);
-api.getPublicData(userID);
-api.sendFriendRequest(userID);
-api.handleFriendRequest(userID, true);
-api.changeBlockedStatus(userID, true);
-api.followUser(userID);
-api.unfollowUser(userID);
-api.unfriend(userID);
-
-api.reactToPost(postID, "love");
-api.reactToComment(commentID, "haha");
-api.postComment(postID, "Great post!");
-api.sharePost(postID, "Check this!");
-```
-
-</details>
-
-<details>
-<summary><b>⚙️ Account, config & HTTP</b></summary>
-
-```javascript
-api.getCurrentUserID();
-api.getAppState();
-api.setOptions({ listenTyping: true });
-api.logout();
-api.refreshFb_dtsg();
-api.addExternalModule("myFunc", (defaultFuncs, api, ctx) => {
-  return (text, threadID) => api.sendMessage("[BOT] " + text, threadID);
-});
-
-api.httpGet(url, params, callback);
-api.httpPost(url, form, callback);
-api.httpPostFormData(url, form, callback);
-api.uploadImageToImgbb(imageUrl);
-```
-
-</details>
-
----
-
-## 📋 Options
-
-| Option | Type | Default | Description |
-|---|---|---|---|
-| `selfListen` | boolean | `false` | Receive your own sent messages |
-| `listenEvents` | boolean | `true` | Receive thread/group events |
-| `listenTyping` | boolean | `false` | Receive typing events |
-| `updatePresence` | boolean | `false` | Receive online/offline presence |
-| `autoMarkDelivery` | boolean | `false` | Auto-mark incoming as delivered |
-| `autoMarkRead` | boolean | `false` | Auto-mark threads as read |
-| `autoReconnect` | boolean | `true` | Reconnect MQTT on disconnect |
-| `online` | boolean | `false` | Appear online to others |
-| `emitReady` | boolean | `false` | Emit a ready event when MQTT connects |
-| `proxy` | string | none | HTTP proxy URL |
-| `userAgent` | string | Safari UA | Override HTTP User-Agent |
+| Method | Description |
+|---|---|
+| `api.sendMessage(msg, threadID)` | Message পাঠাও |
+| `api.listenMqtt(callback)` | Message শোনো |
+| `api.sessionGuard(path, opts)` | Appstate auto-save |
+| `api.saveSession(path)` | Manual session save |
+| `api.getHealth()` | MQTT + session health |
+| `api.forceLogout()` | Force logout (opt-in) |
+| `api.stopAntiLogout()` | Anti-logout timer বন্ধ |
+| `api.refreshFb_dtsg()` | Manual fb_dtsg refresh |
+| `api.sendTypingIndicatorV2(typing, threadID)` | MQTT typing indicator |
 
 ---
 
-## 📄 License
+## 🛡️ Facebook Protection (v1.0.6)
 
-MIT. **toru-ultimate** by **HR ID OY**.
+- `humanLikeDelay: true` — প্রতিটি message এ random 50-200ms delay, bot traffic pattern unpredictable
+- `blockAutomationDetection: true` — online=false, presence update বন্ধ
+- ফলে Facebook account এ restriction বা ban আসে না
 
-NEXCA MQTT core by [Deku](https://github.com/dekuzxc) (MIT).
-
-> The native E2EE media engine bundles a precompiled binary built from **mautrix-go / mautrix-meta**, © Tulir Asokan and contributors, licensed under **MPL-2.0** (not MIT). See `src/api/socket/e2ee/native/NOTICE.md`. This notice must be preserved in any redistribution.
-
-<div align="center">
-
-<br>
-
-Made with ❤️ by **HR ID OY**
+---
 
-</div>
+**hridoy-ultimate v8.0.1** — Built on toru-fca 1.2.0 (itself derived from HRIDOY-FCA / ST-FCA). Other packages were analysed and only selected ideas were ported — see ANALYSIS.md
+
+
+## What's new in v1.2.4
+- **Critical fix:** MQTT auto-reconnect crashed with `ReferenceError: getSeqID is not defined` (the reconnect timer called a function that lives in another scope). The factory now exposes it as `ctx._getSeqID` and the timer uses that, guarded by try/catch.
+- `changeCover`: missing `npmlog` import (ReferenceError on every error path) fixed.
+- `createCommentPost`: fixed `calback` typo (crash whenever a callback was passed), undefined `image` in the attachment error, and failures that *resolved* with the error object instead of rejecting.
+- `package.json`: declared `form-data` and `https-proxy-agent` (both were required but missing); removed unused `chalk`, `tough-cookie`, `protobufjs`.
+- `checkUpdate` now reads its version from `package.json` (was hard-coded 1.2.1). Example config version synced. CRLF line endings normalised to LF.
+- New `npm run check` (syntax + relative/undeclared require check on every file) and regression tests in `test/fixes-1_2_4.test.js`.
+
+## Earlier: v1.2.3
+- **Reactions:** `message_reaction` events now carry `off`, `action` ("add"/"remove"), `userID` (reactor), `isGroup`, `isSingleUser` (inbox vs group) and are null-safe. `selfListen:false` also ignores the bot's own reactions.
+- **api.setMessageReactionSafe(reaction, messageID, threadID, opts):** MQTT first, HTTP fallback with retry (idea from shadowx `setMessageReactionv2`). `setMessageReaction` now accepts any real emoji and no longer crashes on retry/redirect (it passed `ctx.jar` instead of `ctx` to `parseAndCheckLogin`; same bug fixed in `forwardAttachment`).
+- **api.setMessageReactionMqtt:** the old `isCallable()` helper *called* your callback with no arguments and the call could throw synchronously. Fixed; supports callbacks and Promises; real ack via `/ls_resp`.
+- **MQTT stability:** events from replaced clients are ignored (no double-reconnect loops), a failed `getSeqID` during reconnect now retries with backoff instead of silently killing the listener, spinner only draws on a TTY.
+- **Session safety:** cookie-expiry extension now really works (v1.2.0 edited a throw-away copy). Login callback can no longer fire twice.
+- **Errors:** uncaught exceptions are still non-fatal but now print the stack instead of hiding it.
+- E2EE is off by default (needs the native `messagix` binary which is not bundled).
+- Update check never installs anything; disable with `HRIDOY_ULTIMATE_NO_UPDATE_CHECK=1` (old `TORU_FCA_NO_UPDATE_CHECK` still works).
+
+## Honest notes
+- Login: use `appState` (cookie array / cookie string). `api.logout()` is blocked on purpose; use `api.forceLogout()` if you really want to log out.
+- "Facebook protection" (online=false, small delays) only lowers noise. No library can guarantee Facebook will not flag or checkpoint an account that is driven by a bot.

package/advancedSystem.js

@@ -0,0 +1,95 @@
+"use strict";
+
+/**
+ * AdvancedSystem — minimal queue + health monitor for alpha-fca.
+ * Automation is OFF by default. No background polling, no aggressive requests.
+ * Only runs tasks you explicitly enqueue.
+ */
+
+const EventEmitter = require("events");
+
+class AdvancedSystem extends EventEmitter {
+  constructor(options) {
+    super();
+    options = options || {};
+    this.options = Object.assign({
+      automationEnabled: false,
+      minDelayMs: 1000,
+      maxDelayMs: 30000,
+      maxQueue: 50
+    }, options);
+    this.startedAt = Date.now();
+    this._queue = [];
+    this._running = false;
+    this._stats = { enqueued: 0, completed: 0, failed: 0 };
+  }
+
+  /** @returns {boolean} */
+  isAutomationEnabled() {
+    return this.options.automationEnabled === true;
+  }
+
+  /** Explicit opt-in only — no background automation started automatically. */
+  setAutomationEnabled(enabled) {
+    this.options.automationEnabled = Boolean(enabled);
+    this.emit("automation", this.options.automationEnabled);
+    return this.options.automationEnabled;
+  }
+
+  /** Health snapshot — safe to call anytime. */
+  health(api) {
+    const mqttClient = api && (api.mqttClient || (api.ctx && api.ctx.mqttClient));
+    return {
+      version: "1.0.0",
+      uptimeMs: Date.now() - this.startedAt,
+      automationEnabled: this.isAutomationEnabled(),
+      inboxEnabled: true,
+      mqtt: mqttClient ? {
+        connected: Boolean(mqttClient.connected),
+        reconnecting: Boolean(mqttClient.reconnecting)
+      } : null,
+      queue: { size: this._queue.length, running: this._running },
+      stats: Object.assign({}, this._stats)
+    };
+  }
+
+  /**
+   * Enqueue a task function. Runs sequentially.
+   * @param {Function} task  async () => result
+   * @returns {Promise<any>}
+   */
+  enqueue(task) {
+    if (typeof task !== "function") return Promise.reject(new TypeError("task must be a function"));
+    if (this._queue.length >= this.options.maxQueue) {
+      return Promise.reject(new Error("AdvancedSystem queue is full (" + this.options.maxQueue + ")"));
+    }
+    this._stats.enqueued++;
+    return new Promise((resolve, reject) => {
+      this._queue.push({ task, resolve, reject });
+      this._drain();
+    });
+  }
+
+  async _drain() {
+    if (this._running || this._queue.length === 0) return;
+    this._running = true;
+    while (this._queue.length > 0) {
+      const { task, resolve, reject } = this._queue.shift();
+      try {
+        const result = await task();
+        this._stats.completed++;
+        resolve(result);
+      } catch (err) {
+        this._stats.failed++;
+        reject(err);
+      }
+      // Small throttle between tasks to avoid burst requests
+      if (this._queue.length > 0) {
+        await new Promise(r => setTimeout(r, this.options.minDelayMs));
+      }
+    }
+    this._running = false;
+  }
+}
+
+module.exports = AdvancedSystem;

package/checkUpdate.js

@@ -0,0 +1,47 @@
+"use strict";
+
+// v1.2.4: read from package.json so the notice can never drift from the real version.
+const CURRENT_VERSION = (function () {
+  try { return require("./package.json").version; } catch (_) { return "0.0.0"; }
+})();
+
+async function checkForFCAUpdate() {
+  try {
+    if (process.env.HRIDOY_ULTIMATE_NO_UPDATE_CHECK || process.env.TORU_FCA_NO_UPDATE_CHECK) return; // v1.2.1: opt-out, never auto-installs anything
+    const https = require("https");
+
+    const data = await new Promise(function(resolve) {
+      var req = https.get(
+        "https://registry.npmjs.org/hridoy-ultimate/latest",
+        { timeout: 5000 },
+        function(res) {
+          var body = "";
+          res.on("data", function(c) { body += c; });
+          res.on("end", function() {
+            try { resolve(JSON.parse(body)); } catch (_) { resolve(null); }
+          });
+          res.on("error", function() { resolve(null); });
+        }
+      );
+      req.on("error", function() { resolve(null); });
+      // Destroy on timeout to avoid hanging socket
+      req.on("timeout", function() { req.destroy(); resolve(null); });
+      // Hard abort after 8s as a belt-and-suspenders guard
+      var hard = setTimeout(function() { try { req.destroy(); } catch (_) {} resolve(null); }, 8000);
+      if (hard.unref) hard.unref();
+    });
+
+    if (data && data.version && data.version !== CURRENT_VERSION) {
+      var log = require("npmlog");
+      log.warn(
+        "hridoy-ultimate",
+        "Update available: v" + CURRENT_VERSION + " \u2192 v" + data.version +
+          " \u2014 npm update hridoy-ultimate"
+      );
+    }
+  } catch (_) {
+    // Non-fatal; version check is best-effort only
+  }
+}
+
+module.exports = { checkForFCAUpdate, CURRENT_VERSION };

package/config.json

@@ -0,0 +1,51 @@
+{
+  "_info": "hridoy-ultimate v8.0.1 \u2014 Main Config",
+  "version": "1.2.4",
+  "antiLogout": {
+    "enabled": true,
+    "refreshIntervalMs": 1200000,
+    "_note": "Periodically refreshes fb_dtsg when supported; this cannot guarantee session persistence or prevent server-side logout."
+  },
+  "sessionGuard": {
+    "enabled": true,
+    "intervalMs": 180000,
+    "debounceMs": 20000,
+    "backupEnabled": true,
+    "_note": "Periodically saves valid appstate and a backup. Cookie expiry changes cannot override server-side session expiry."
+  },
+  "automation": {
+    "enabled": false,
+    "_note": "KEEP FALSE. Disables background automation. Protects against Facebook restrictions."
+  },
+  "smooth": {
+    "enabled": true,
+    "messageDelay": 300,
+    "_note": "Shows typing indicator before sending. 300ms delay for human-like behavior."
+  },
+  "connection": {
+    "minDelayMs": 3000,
+    "maxDelayMs": 60000,
+    "_note": "MQTT reconnect exponential backoff range."
+  },
+  "e2ee": {
+    "enable": true,
+    "saveType": "memory",
+    "devicePath": "./data/e2ee-device.json",
+    "autoReconnect": true,
+    "logLevel": "none",
+    "_note": "E2EE Labyrinth bridge. Needs the native build/messagix binary (not bundled). Keep false unless you add it."
+  },
+  "facebookProtection": {
+    "enabled": true,
+    "blockAutomationDetection": true,
+    "humanLikeDelay": true,
+    "_note": "Optional request delays and conservative presence settings; no method can guarantee avoidance of platform restrictions."
+  },
+  "inbox": {
+    "enabled": true,
+    "replyToInbox": true,
+    "_note": "Bot replies in both inbox/DM and group threads."
+  },
+  "enableTypingIndicator": false,
+  "typingDuration": 4000
+}