hridoy-ultimate 9.0.2 → 9.0.3

package/module/config.js

@@ -2,13 +2,21 @@ const fs = require("fs");
 const path = require("path");
 const logger = require("../func/logger");
 const defaultConfig = {
-  autoUpdate: true,
+  autoUpdate: false,
+  // Opt-in: tell the user when a newer npm version exists (one small request per login).
+  checkForUpdates: false,
+  // Opt-in: when Facebook shows its "automated behavior" warning, press Dismiss for the
+  // user. Off by default: silently clicking through Facebook's own bot warning is itself
+  // an automated action on the account. Dismiss it yourself in the browser instead.
+  autoDismissAutomationWarning: false,
   mqtt: { enabled: true, reconnectInterval: 3600 },
   // Opt-in only: auto re-login with credentials (via the third-party API)
   // after a checkpoint/session failure is itself a strong suspicious-login
   // signal and invalidates every other live session on the account.
   autoLogin: false,
-  apiServer: "https://minhdong.site",
+  // No default third-party host: your e-mail/password must never be sent anywhere you
+  // did not choose. autoLogin stays off unless you set both autoLogin and apiServer.
+  apiServer: "",
   apiKey: "",
   credentials: { email: "", password: "", twofactor: "" },
   antiGetInfo: {

package/module/login.js

@@ -11,7 +11,12 @@ global.fca = { config };
 
 // Global error handlers to prevent bot crashes
 // Handle unhandled promise rejections (e.g., fetch timeouts, network errors)
-if (!global.fca._errorHandlersInstalled) {
+// A library must not own the process: the host app (the bot) installs its own handlers and
+// decides what a crash means. These stay as a fallback ONLY for plain scripts that have none,
+// and they no longer swallow everything silently (see the counter below).
+if (!global.fca._errorHandlersInstalled &&
+    process.listenerCount("uncaughtException") === 0 &&
+    process.listenerCount("unhandledRejection") === 0) {
   global.fca._errorHandlersInstalled = true;
 
   process.on("unhandledRejection", (reason, promise) => {
@@ -73,10 +78,15 @@ if (!global.fca._errorHandlersInstalled) {
         return; // Don't crash
       }
 
-      // For other uncaught exceptions, log but try to continue
-      logger(`Uncaught exception (attempting to continue): ${errorMessage}`, "error");
-      // Note: We don't exit here to allow bot to continue running
-      // In production, you might want to restart the process instead
+      // Other uncaught exceptions: continuing after one is unsafe (state may be half-updated),
+      // so log it and exit after repeated ones; the supervisor restarts the process.
+      logger(`Uncaught exception: ${errorMessage}`, "error");
+      global.fca._uncaught = (global.fca._uncaught || []).filter(t => Date.now() - t < 10 * 60 * 1000);
+      global.fca._uncaught.push(Date.now());
+      if (global.fca._uncaught.length >= 5) {
+        logger("5 uncaught exceptions in 10 minutes - exiting so the supervisor can restart cleanly", "error");
+        process.exit(1);
+      }
     } catch (e) {
       // Fallback if logger fails - silent
     }

package/module/loginHelper.js

@@ -59,7 +59,10 @@ function mask(s, keep = 3) {
  */
 async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) {
   try {
-    const baseUrl = apiBaseUrl || config.apiServer || "https://minhdong.site";
+    const baseUrl = apiBaseUrl || config.apiServer;
+    if (!baseUrl) {
+      return { ok: false, message: "No apiServer configured: credential login through a third-party API is disabled" };
+    }
     const endpoint = `${baseUrl}/api/v1/facebook/login_ios`;
     const xApiKey = apiKey || config.apiKey || null;
 
@@ -505,7 +508,7 @@ async function hydrateJarFromDB(userID) {
   }
 }
 
-async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions, ctxRef, hadAppStateInput = false) {
+async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions, ctxRef, hadAppStateInput = false, expectedUID = null) {
   // Helper to validate UID - must be a non-zero positive number string
   const isValidUID = uid => uid && uid !== "0" && /^\d+$/.test(uid) && parseInt(uid, 10) > 0;
 
@@ -547,7 +550,9 @@ async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions,
   }
 
   // Try to hydrate from DB backup
-  const hydrated = await hydrateJarFromDB(null);
+  // Only restore a backup that belongs to the account the caller asked for. Loading the
+  // "latest backup of anybody" could put a different account's cookies in the jar.
+  const hydrated = (hadAppStateInput && !expectedUID) ? false : await hydrateJarFromDB(expectedUID || null);
   if (hydrated) {
     logger("tryAutoLoginIfNeeded: Trying backup from DB...", "info");
     try {
@@ -721,6 +726,9 @@ async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions,
 
 function makeLogin(j, email, password, globalOptions) {
   return async function () {
+    if (config.autoLogin !== true && config.autoLogin !== "true") {
+      throw new Error("No usable cookies were provided and credential login is disabled (autoLogin=false). Provide a fresh appstate/cookie export.");
+    }
     const u = email || config.credentials?.email;
     const p = password || config.credentials?.password;
     const tf = config.credentials?.twofactor || null;
@@ -835,6 +843,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         const getUID = async body => (await cookieUID()) || htmlUID(body);
         const refreshJar = async () => get("https://www.facebook.com/", j, null, this.options).then(saveCookies(j));
         const bypass = async body => {
+          if (config.autoDismissAutomationWarning !== true) {
+            logger("Facebook is showing its automated-behavior warning. Not dismissing it automatically: open facebook.com in your browser, dismiss it yourself, then restart. (Set autoDismissAutomationWarning=true in fca-config.json to dismiss it automatically.)", "warn");
+            return;
+          }
           const b = s(body);
           const UID = await getUID(b);
           const fb_dtsg = getFrom(b, '"DTSGInitData",[],{"token":"', '",') || b.match(/name="fb_dtsg"\s+value="([^"]+)"/)?.[1];
@@ -920,6 +932,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           const getUID = async body => (await cookieUID()) || htmlUID(body);
           const refreshJar = async () => get("https://www.facebook.com/", j, null, this.options).then(saveCookies(j));
           const bypass = async body => {
+            if (config.autoDismissAutomationWarning !== true) {
+              logger("Facebook is showing its automated-behavior warning. Not dismissing it automatically (see autoDismissAutomationWarning in fca-config.json).", "warn");
+              return;
+            }
             const b = s(body);
             const UID = await getUID(b);
             const fb_dtsg = getFrom(b, '"DTSGInitData",[],{"token":"', '",') || b.match(/name="fb_dtsg"\s+value="([^"]+)"/)?.[1];
@@ -970,7 +986,7 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         if (!isValidUID(userID)) {
           logger("Invalid userID detected (missing or 0), attempting auto-login...", "warn");
           // Pass hadAppStateInput=true if appState/Cookie was originally provided
-          const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie));
+          const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie), userIDFromAppState);
           html = retried.html;
           cookies = retried.cookies;
           userID = retried.userID;
@@ -1089,7 +1105,7 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
             if (!isValidUID(info.USER_ID)) {
               logger("Facebook response shows invalid USER_ID (0 or empty), session is dead!", "warn");
               // Force trigger auto-login
-              const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie));
+              const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie), userIDFromAppState);
               html = retried.html;
               cookies = retried.cookies;
               userID = retried.userID;
@@ -1358,8 +1374,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         }
 
         try {
-          const { checkForUpdate } = require("../src/utils/versionCheck");
-          checkForUpdate(logger);
+          if (config.checkForUpdates === true) {
+            const { checkForUpdate } = require("../src/utils/versionCheck");
+            checkForUpdate(logger);
+          }
         } catch (_) {}
         logger("🚀 Login successful! Bot is ready.");
         callback(null, api);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hridoy-ultimate",
-  "version": "9.0.2",
+  "version": "9.0.3",
   "description": "Facebook Chat API by HR ID OY | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,7 +9,8 @@
       "require": "./index.js",
       "default": "./index.js",
       "types": "./index.d.ts"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "index.js",
@@ -66,7 +67,7 @@
   },
   "homepage": "https://github.com/hridoyhossen48360/hridoy-ultimate#readme",
   "engines": {
-    "node": ">=12.0.0"
+    "node": ">=18"
   },
   "dependencies": {
     "axios": "^1.13.5",
@@ -88,8 +89,7 @@
     "mime": "^3.0.0",
     "protobufjs": "^8.4.0",
     "koffi": "^3.0.2",
-    "yumi-json-bigint": "^1.0.0",
-    "fca-unofficial": "github:VangBanLaNhat/fca-unofficial"
+    "yumi-json-bigint": "^1.0.0"
   },
   "devDependencies": {
     "eslint": "^8.50.0",
@@ -98,5 +98,8 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
+  },
+  "optionalDependencies": {
+    "fca-unofficial": "github:VangBanLaNhat/fca-unofficial"
   }
 }

package/src/api/action/enableAutoSaveAppState.js

@@ -20,14 +20,17 @@ module.exports = function (defaultFuncs, api, ctx) {
     // Save function
     function saveAppState() {
       try {
-        const appState = api.getAppState();
-        if (!appState || !appState.appState || appState.appState.length === 0) {
-          logger("AppState is empty, skipping save", "warn");
+        const raw = api.getAppState();
+        const appState = Array.isArray(raw) ? raw : (raw && Array.isArray(raw.appState) ? raw.appState : null);
+        if (!appState || appState.length < 5) {
+          logger("AppState is empty or too small, skipping save", "warn");
           return;
         }
 
-        const data = JSON.stringify(appState, null, 2);
-        fs.writeFileSync(filePath, data, "utf8");
+        // write-then-rename so a crash mid-write can never leave a truncated cookie file
+        const tmp = filePath + ".tmp";
+        fs.writeFileSync(tmp, JSON.stringify(appState, null, 2), "utf8");
+        fs.renameSync(tmp, filePath);
         logger(`AppState saved to ${filePath}`, "info");
       } catch (error) {
         logger(`Error saving AppState: ${error && error.message ? error.message : String(error)}`, "error");

package/src/api/socket/core/connectMqtt.js

@@ -16,9 +16,25 @@ module.exports = function createListenMqtt(deps) {
 
   return function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
 
+    // Reconnects used to be a fixed 2 s forever: a flapping or refused socket meant a new
+    // WebSocket handshake to edge-chat every 2 seconds. Now exponential with jitter, capped
+    // at 5 min, reset as soon as the broker delivers /t_ms again, with a hard budget.
+    const MQTT_MAX_FAILS = 12;
+    const MQTT_MAX_DELAY_MS = 5 * 60 * 1000;
     function scheduleReconnect(delayMs) {
       const d = (ctx._mqttOpt && ctx._mqttOpt.reconnectDelayMs) || DEFAULT_RECONNECT_DELAY_MS;
-      const ms = typeof delayMs === "number" ? delayMs : d;
+      const base = typeof delayMs === "number" ? delayMs : d;
+      const streak = ctx._mqttFailStreak || 0;
+      if (!ctx._reconnectTimer && !ctx._ending) {
+        if (streak >= MQTT_MAX_FAILS) {
+          ctx._mqttFailStreak = 0;
+          logger(`mqtt reconnect budget used up (${MQTT_MAX_FAILS} attempts without a working connection) - stopping; host app decides`, "error");
+          try { globalCallback({ type: "stop_listen", error: "MQTT reconnect budget exhausted" }, null); } catch (_) { }
+          return;
+        }
+        ctx._mqttFailStreak = streak + 1;
+      }
+      const ms = Math.round(Math.min(base * Math.pow(2, streak), MQTT_MAX_DELAY_MS) * (0.85 + Math.random() * 0.3));
       if (ctx._reconnectTimer) {
         logger("mqtt reconnect already scheduled", "warn");
         return; // debounce
@@ -180,6 +196,7 @@ module.exports = function createListenMqtt(deps) {
       ctx._rTimeout = rTimeout;
 
       ctx.tmsWait = function () {
+        ctx._mqttFailStreak = 0; // broker is delivering again: connection is healthy
         if (rTimeout) {
           clearTimeout(rTimeout);
           rTimeout = null;

package/src/api/socket/core/getSeqID.js

@@ -254,9 +254,12 @@ module.exports = function createGetSeqID(deps) {
           
           throw { error: "Not logged in", originalResponse: resData };
         }
-        if (!Array.isArray(resData) || !resData.length) return;
+        if (!Array.isArray(resData) || !resData.length) throw new Error("getSeqID: empty response");
         const lastRes = resData[resData.length - 1];
-        if (lastRes && lastRes.successful_results === 0) return;
+        // Used to `return` silently here: no listener was started and nothing retried, so the
+        // bot sat "running" but deaf until the 5-minute heartbeat noticed. Now it is a
+        // retryable error (bounded back-off in listenMqtt's getSeqIDWrapper).
+        if (lastRes && lastRes.successful_results === 0) throw new Error("getSeqID: Facebook returned no successful results");
 
         const syncSeqId = resData[0]?.o0?.data?.viewer?.message_threads?.sync_sequence_id;
         if (syncSeqId) {
@@ -266,12 +269,20 @@ module.exports = function createGetSeqID(deps) {
           ctx.lastSeqId = ctx.lastSeqId || 0;
           logger("getSeqID: sync_sequence_id not found, fallback lastSeqId=" + ctx.lastSeqId, "warn");
         }
+        ctx.loggedIn = true; // emitAuth() sets this false; a working session must set it back
         listenMqtt(defaultFuncs, api, ctx, globalCallback);
       })
       .catch(async err => {
         const detail = (err && err.detail && err.detail.message) ? ` | detail=${err.detail.message}` : "";
         const msg = ((err && err.error) || (err && err.message) || String(err || "")) + detail;
 
+        // A human has to dismiss Facebook's automated-behavior warning. Not a dead session and
+        // not retryable: stop cleanly and tell the host app with its own reason.
+        if (/automation_warning|automated-behavior warning/i.test(msg) || (err && err.error === "automation_warning")) {
+          logger(`getSeqID: ${msg} - NOT retrying`, "warn");
+          return emitAuth(ctx, api, globalCallback, "automation_warning", msg);
+        }
+
         // Definitive server-side session invalidation: error 1357001
         // ("Log in to continue") or an explicit login block. The session is
         // dead, not desynced — retrying within seconds (and especially

package/src/api/socket/listenMqtt.js

@@ -96,6 +96,18 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   let conf = mqttConf(ctx, opts);
 
+  // Consecutive getSeqID failures. Used to retry every fixed 2 s forever, which is a request
+  // storm against Facebook on any persistent error (and exactly what "automation" detection
+  // looks for). Now: exponential back-off with jitter, capped, and a hard budget after which
+  // the host app is told ({type:"stop_listen"}) instead of looping.
+  let seqFailStreak = 0;
+  const SEQ_MAX_FAILS = 8;
+  const SEQ_MAX_DELAY_MS = 5 * 60 * 1000;
+  function seqRetryDelay(streak) {
+    const raw = Math.min(conf.reconnectDelayMs * Math.pow(2, streak - 1), SEQ_MAX_DELAY_MS);
+    return Math.round(raw * (0.85 + Math.random() * 0.3));
+  }
+
   function getSeqIDWrapper() {
     if (ctx._ending && !ctx._cycling) {
       logger("mqtt getSeqID skipped - ending", "warn");
@@ -118,6 +130,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
       .then(() => {
         logger("mqtt getSeqID done", "info");
         ctx._cycling = false;
+        seqFailStreak = 0;
       })
       .catch(e => {
         ctx._cycling = false;
@@ -127,8 +140,15 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
         if (ctx._ending) return;
         // Retry after delay if autoReconnect is enabled
         if (ctx.globalOptions.autoReconnect) {
-          const d = conf.reconnectDelayMs;
-          logger(`mqtt getSeqID will retry in ${d}ms`, "warn");
+          seqFailStreak++;
+          if (seqFailStreak > SEQ_MAX_FAILS) {
+            logger(`mqtt getSeqID failed ${SEQ_MAX_FAILS} times in a row - giving up (host app decides what happens next)`, "error");
+            seqFailStreak = 0;
+            try { globalCallback({ type: "stop_listen", error: errMsg }, null); } catch (_) { }
+            return;
+          }
+          const d = seqRetryDelay(seqFailStreak);
+          logger(`mqtt getSeqID will retry in ${d}ms (failure ${seqFailStreak}/${SEQ_MAX_FAILS})`, "warn");
           setTimeout(() => {
             if (!ctx._ending) getSeqIDWrapper();
           }, d);
@@ -280,9 +300,8 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   function startSessionKeeper() {
     if (ctx._sessionKeeperInterval) return;
-    // Self-rescheduling timeout with ±15 min jitter around 90 min, instead of
-    // a clockwork-exact 90:00.000 interval — perfectly periodic traffic is
-    // trivial to fingerprint.
+    // Self-rescheduling timeout with ±1 h jitter around 6 h, instead of a
+    // clockwork-exact interval — perfectly periodic traffic is trivial to fingerprint.
     const BASE_MS = 6 * 60 * 60 * 1000;
     const JITTER_MS = 60 * 60 * 1000;
     const scheduleNext = function () {
@@ -480,13 +499,3 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   };
 };
 
-
-// mqtt stability patch
-try {
-  if (typeof client !== "undefined" && client) {
-    client.on("offline", () => console.log("[FCA] MQTT offline"));
-    client.on("reconnect", () => console.log("[FCA] MQTT reconnecting"));
-    client.on("close", () => console.log("[FCA] MQTT closed"));
-    client.on("error", (e) => console.log("[FCA] MQTT error:", e?.message || e));
-  }
-} catch (e) {}

package/src/utils/fingerprint.js

@@ -1,25 +1,37 @@
 "use strict";
 
-// A small pool of current, plausible desktop Chrome versions to rotate
-// through. A single frozen version shared by every process using this
-// package is itself a fingerprint — thousands of unrelated accounts all
-// claiming the exact same browser build is a trivially detectable pattern.
-// Keep this list current; entries that are far behind Chrome's real release
-// timeline are themselves a signal.
-const CHROME_VERSIONS = [
-  "131.0.6778.140",
-  "132.0.6834.111",
-  "133.0.6943.98",
-  "134.0.6998.117",
-  "135.0.7049.85"
-];
-
-function pickChromeVersion() {
-  return CHROME_VERSIONS[Math.floor(Math.random() * CHROME_VERSIONS.length)];
+// Fallback fingerprint, used ONLY when no real browser User-Agent is configured.
+//
+// Real Chrome sends a "reduced" User-Agent (Chrome/<major>.0.0.0) since v101, so the
+// major version is all a believable UA needs. A hard-coded list of versions goes
+// stale within weeks (the old pool here was ~2 years behind and a stale browser build
+// is itself a signal), so the major is estimated from today's date instead.
+//
+// The best option by far is still to pass the exact User-Agent of the browser the
+// cookies were exported from: via the `userAgent` login option, or the FCA_USER_AGENT
+// environment variable.
+const MS_DAY = 24 * 60 * 60 * 1000;
+// Anchors from Chrome's published schedule: 151 stable on 2026-07-28 (4-week cadence),
+// 153 on 2026-09-08, then one major every 2 weeks.
+const ANCHOR_151 = Date.UTC(2026, 6, 28);
+const ANCHOR_153 = Date.UTC(2026, 8, 8);
+
+function estimateStableMajor(now) {
+  const t = typeof now === "number" ? now : Date.now();
+  if (t >= ANCHOR_153) return 153 + Math.floor((t - ANCHOR_153) / (14 * MS_DAY));
+  if (t >= ANCHOR_151) return 151 + Math.floor((t - ANCHOR_151) / (28 * MS_DAY));
+  // before the anchors: count back one major per 4 weeks (never below 130)
+  return Math.max(130, 151 - Math.ceil((ANCHOR_151 - t) / (28 * MS_DAY)));
+}
+
+// Real users are usually a release behind (staged auto-update), so use stable - 1.
+function pickChromeMajor(now) {
+  return estimateStableMajor(now) - 1;
 }
 
-function buildUserAgent(version) {
-  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
+function buildUserAgent(major) {
+  // Reduced UA format used by real Chrome: Chrome/<major>.0.0.0
+  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
 }
 
 // Chrome's Sec-Ch-Ua "GREASE" brand slot rotates through a small set of
@@ -47,30 +59,54 @@ function fingerprintFile() {
   return path.join(process.cwd(), "data", "session", "fca-fingerprint.json");
 }
 
+function fromUserAgentString(ua, source) {
+  const m = String(ua || "").match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
+  return {
+    userAgent: String(ua).trim(),
+    version: m ? m[0].split("/")[1] : "",
+    major: m ? parseInt(m[1], 10) : 0,
+    source
+  };
+}
+
 function getFingerprint() {
-  if (!cachedFingerprint) {
-    try {
-      const saved = JSON.parse(fs.readFileSync(fingerprintFile(), "utf8"));
-      if (saved && CHROME_VERSIONS.includes(saved.version)) {
-        cachedFingerprint = {
-          userAgent: buildUserAgent(saved.version),
-          version: saved.version,
-          major: parseInt(saved.version.split(".")[0], 10)
-        };
-      }
-    } catch (_) { /* first run */ }
+  if (cachedFingerprint) return cachedFingerprint;
+
+  // 1) explicit environment override (same meaning as the userAgent login option)
+  const envUA = process.env.FCA_USER_AGENT;
+  if (envUA && envUA.trim()) {
+    cachedFingerprint = fromUserAgentString(envUA, "env");
+    return cachedFingerprint;
   }
+
+  const wanted = pickChromeMajor();
+
+  // 2) the fingerprint saved by an earlier run, as long as it is not far behind a
+  //    current browser (a few majors behind is normal; two years behind is not)
+  try {
+    const saved = JSON.parse(fs.readFileSync(fingerprintFile(), "utf8"));
+    const savedMajor = saved && parseInt(String(saved.major || saved.version || "").split(".")[0], 10);
+    if (savedMajor && wanted - savedMajor <= 6 && savedMajor <= wanted + 1) {
+      cachedFingerprint = {
+        userAgent: buildUserAgent(savedMajor),
+        version: savedMajor + ".0.0.0",
+        major: savedMajor,
+        source: "saved"
+      };
+    }
+  } catch (_) { /* first run */ }
+
+  // 3) estimate from the date and remember it
   if (!cachedFingerprint) {
-    const version = pickChromeVersion();
-    const major = parseInt(version.split(".")[0], 10);
     cachedFingerprint = {
-      userAgent: buildUserAgent(version),
-      version,
-      major
+      userAgent: buildUserAgent(wanted),
+      version: wanted + ".0.0.0",
+      major: wanted,
+      source: "estimated"
     };
     try {
       fs.mkdirSync(path.dirname(fingerprintFile()), { recursive: true });
-      fs.writeFileSync(fingerprintFile(), JSON.stringify({ version }), "utf8");
+      fs.writeFileSync(fingerprintFile(), JSON.stringify({ major: wanted }), "utf8");
     } catch (_) { /* read-only fs: fall back to per-process */ }
   }
   return cachedFingerprint;
@@ -125,5 +161,8 @@ function clientHintsFromUA(ua) {
 module.exports = {
   getDefaultUserAgent,
   getFingerprint,
-  clientHintsFromUA
+  clientHintsFromUA,
+  estimateStableMajor,
+  pickChromeMajor,
+  _resetForTests: () => { cachedFingerprint = null; }
 };

package/src/utils/loginParser/parseAndCheckLogin.js

@@ -186,24 +186,31 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
     ) {
       globalAntiSuspension.detectSuspensionSignal("automated behavior checkpoint scraping warning");
       emit("checkpoint", { type: "scraping_warning", res: resData });
-      // Dismiss it the same way a human tapping "Dismiss" on that screen
-      // would — an unacknowledged warning left sitting is worse than one
-      // that's been cleared. Fire-and-forget: this must never block or
-      // fail the actual response being parsed.
-      http
-        .post("https://www.facebook.com/api/graphql/", ctx.jar, {
-          av: ctx.userID,
-          __user: ctx.userID,
-          fb_dtsg: ctx.fb_dtsg || "",
-          fb_api_caller_class: "RelayModern",
-          fb_api_req_friendly_name: "FBScrapingWarningMutation",
-          server_timestamps: "true",
-          doc_id: "6339492849481770",
-          variables: "{}"
-        }, ctx.globalOptions, ctx)
-        .then(() => logger("Dismissed automated-behavior warning", "info"))
-        .catch((e) => logger(`Dismissing automated-behavior warning failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn"));
-      return await maybeAutoLogin(resData, res?.config);
+      const fcaCfg = (global.fca && global.fca.config) || {};
+      if (fcaCfg.autoDismissAutomationWarning === true) {
+        // Opt-in only. Fire-and-forget: must never block or fail the response being parsed.
+        http
+          .post("https://www.facebook.com/api/graphql/", ctx.jar, {
+            av: ctx.userID,
+            __user: ctx.userID,
+            fb_dtsg: ctx.fb_dtsg || "",
+            fb_api_caller_class: "RelayModern",
+            fb_api_req_friendly_name: "FBScrapingWarningMutation",
+            server_timestamps: "true",
+            doc_id: "6339492849481770",
+            variables: "{}"
+          }, ctx.globalOptions, ctx)
+          .then(() => logger("Dismissed automated-behavior warning (autoDismissAutomationWarning=true)", "info"))
+          .catch((e) => logger(`Dismissing automated-behavior warning failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn"));
+      } else {
+        logger("Facebook showed its automated-behavior warning. Open facebook.com in your browser, dismiss it yourself, then restart the bot.", "warn");
+      }
+      // This is NOT a logged-out session. The old code ran the "session expired" path here,
+      // which made the bot declare itself logged out and restart (a fresh login) for nothing.
+      const err = new Error("Facebook showed an automated-behavior warning (needs a human to dismiss it)");
+      err.error = "automation_warning";
+      err.res = resData;
+      throw err;
     }
     if (
       resStr.includes("https://www.facebook.com/login.php?") ||