hridoy-ultimate 9.0.2 → 9.0.4

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ---
 
+## [9.0.5] - 2026-10-30
+
+### Fixed (account / browser session safety)
+
+- `api.logout()` used to POST `facebook.com/logout.php`. Facebook then ends that session everywhere, so the same account was also logged out in your normal browser whenever a bot called `logout()` (e.g. on shutdown/restart). `api.logout()` is now a **local stop only**: it stops the MQTT listener and the internal timers and sends nothing to Facebook. It resolves with `{ localOnly: true }`.
+- The real logout is a separate method, `api.logoutFromFacebook()`. If you really want `api.logout()` to log out of Facebook, set `"allowFacebookLogout": true` in `fca-config.json` (default `false`).
+- Cookie mirroring (`facebook.com` <-> `messenger.com`): a *delete this cookie* answer from `messenger.com` for a login cookie (`c_user`, `xs`, `i_user`, `datr`, `sb`, `fr`) is no longer copied onto `facebook.com`. Before, a rejected mirrored value could wipe a perfectly good `facebook.com` login cookie from the bot's jar and make a healthy session look expired.
+
+### Added
+
+- `api.logoutFromFacebook()` (also `client.account.logoutFromFacebook` from `createFcaClient`).
+- `allowFacebookLogout` option in `fca-config.json`.
+- `test/logout.test.js`, `test/cookies.test.js`.
+
+### Not changed
+
+- Facebook can still end a session it considers suspicious (cookies used from a different IP / User-Agent than the browser they came from). Pass the exact User-Agent of that browser with the `userAgent` login option (or `FCA_USER_AGENT`) and run the bot from the same network where you can.
+
+---
+
+## [9.0.4] - 2026-10-27
+
+### Fixed
+
+- `api.getUserID()` and `api.changeGroupImage()` always threw `ReferenceError: parseAndCheckLogin is not defined` (missing import). Both work again.
+- `api.refreshFb_dtsg()` threw `ReferenceError: CustomError is not defined` on a bad argument; it now throws a normal `Error`.
+- `sendMessage`: when the safety guard blocked a send, the log call was `logger(msg, "error")` but the logger is an object, so it threw `TypeError: logger is not a function`. The send callback was never called and the caller hung. Now logs correctly and the callback / promise is rejected with `ACCOUNT_SAFETY_PAUSED`.
+- Safety guard: rate-limit style text ("too many requests", "rate limited", "temporarily blocked", "action blocked", ...) used to switch sending off until restart. Only real account signals (checkpoint, automated-behavior warning, locked/disabled/suspended, identity check) still fail closed. Rate-limit style signals now only count as strikes (2 within 30 min = slow-down cooldown).
+- `package.json` now declares `tough-cookie`, `form-data` and `request`, which the code already `require()`s. A clean `npm install` of this package alone used to crash on first use.
+
+### Added
+
+- `api.getSafetyStatus()` -> `{ blocked, reason, coolingDown, warmup, hourSendCount, hourlyCap, daySendCount, dailyCap }` so a bot can detect `ACCOUNT_SAFETY_PAUSED` instead of retrying.
+- `test/antiSuspension.test.js` (`npm test`, uses `node --test`).
+
+---
+
+## [9.0.3] - 2026-10-25 (entry added retroactively)
+
+### Account safety
+
+- Outbound sending is paused (`ACCOUNT_SAFETY_PAUSED`) after a Facebook checkpoint / automated-behavior signal. Automatic dismissal of the automated-behavior warning stays off.
+
+---
+
 ## [9.0.2] - 2026-10-22
 
 ### Session stability

package/DOCS.md

@@ -1711,24 +1711,32 @@ api.searchForThread("Study Group", (err, threads) => {
 
 ---
 
-### 3.29. logout - Logout
+### 3.29. logout / logoutFromFacebook - Stop the bot / Logout
 
-Logout from Facebook account.
+`api.logout()` **stops the bot locally** (MQTT listener and internal timers). It sends nothing to
+Facebook, so your normal browser session stays logged in. It resolves with `{ localOnly: true }`.
+
+`api.logoutFromFacebook()` is the **real** Facebook logout. Facebook ends that session everywhere,
+so you are also logged out in your browser. Use it only when that is what you want.
+
+If you want `api.logout()` itself to perform the real logout, set `"allowFacebookLogout": true` in
+`fca-config.json` (default `false`).
 
 #### Syntax:
 ```javascript
-api.logout(callback);
+api.logout(callback);              // local stop only (default)
+api.logoutFromFacebook(callback);  // real Facebook logout
 ```
 
 #### Example:
 
 ```javascript
-api.logout((err) => {
+api.logout((err, result) => {
     if (err) {
-        console.error("Logout error:", err);
+        console.error("Stop error:", err);
         return;
     }
-    console.log("Logged out successfully!");
+    console.log("Bot stopped.", result); // { localOnly: true }
 });
 ```
 

package/README.md

@@ -492,7 +492,8 @@ api.sharePost(postID, "Check this!");
 api.getCurrentUserID();
 api.getAppState();
 api.setOptions({ listenTyping: true });
-api.logout();
+api.logout();               // local stop only; your browser stays logged in
+api.logoutFromFacebook();   // real Facebook logout (ends your browser session too)
 api.refreshFb_dtsg();
 api.addExternalModule("myFunc", (defaultFuncs, api, ctx) => {
   return function(text, threadID) {
@@ -534,7 +535,7 @@ api.uploadImageToImgbb(imageUrl);
 
 MIT License
 
-**hridoy-ultimate** v9.0.1 by [HR ID OY](https://github.com/hridoyhossen48360)
+**hridoy-ultimate** v9.0.4 by [HR ID OY](https://github.com/hridoyhossen48360)
 
 > The E2EE native media engine (`src/api/socket/e2ee/native/`) bundles a
 > precompiled binary built from **mautrix-go** / **mautrix-meta**, © Tulir

package/index.d.ts

@@ -168,6 +168,7 @@ declare module '@dongdev/fca-unofficial' {
     getUserID: (name: string, callback?: (err: Error | null, obj: IFCAU_UserIDResponse) => void) => Promise<IFCAU_UserIDResponse>;
     getFriendsList: (callback?: (err: Error | null, friends: IFCAU_Friend[]) => void) => Promise<IFCAU_Friend[]>;
     getCurrentUserID: () => string;
+    getSafetyStatus: () => { blocked: boolean; reason: string | null; coolingDown: boolean; warmup: boolean; hourSendCount: number; hourlyCap: number; daySendCount: number; dailyCap: number };
 
     // Utilities
     getAppState: () => any;
@@ -200,7 +201,10 @@ declare module '@dongdev/fca-unofficial' {
 
     // Configuration & Session
     setOptions: (options: Partial<IFCAU_Options>) => void;
-    logout: (callback?: (err?: Error) => void) => Promise<void>;
+    /** Stops the bot locally (listener + timers). Does NOT log out of Facebook unless `allowFacebookLogout` is true in fca-config.json. */
+    logout: (callback?: (err?: Error | null, result?: { localOnly: true }) => void) => Promise<{ localOnly: true } | void>;
+    /** Real Facebook logout (POST logout.php). Also ends the session in your browser. */
+    logoutFromFacebook: (callback?: (err?: Error) => void) => Promise<void>;
 
     // Message Scheduler
     scheduler: {

package/module/config.js

@@ -2,13 +2,25 @@ const fs = require("fs");
 const path = require("path");
 const logger = require("../func/logger");
 const defaultConfig = {
-  autoUpdate: true,
+  autoUpdate: false,
+  // Opt-in: tell the user when a newer npm version exists (one small request per login).
+  checkForUpdates: false,
+  // api.logout() only stops the bot locally. Set true ONLY if you want api.logout() to
+  // really log the account out of Facebook, which also logs you out in your browser.
+  // The real logout is always available as api.logoutFromFacebook().
+  allowFacebookLogout: false,
+  // Opt-in: when Facebook shows its "automated behavior" warning, press Dismiss for the
+  // user. Off by default: silently clicking through Facebook's own bot warning is itself
+  // an automated action on the account. Dismiss it yourself in the browser instead.
+  autoDismissAutomationWarning: false,
   mqtt: { enabled: true, reconnectInterval: 3600 },
   // Opt-in only: auto re-login with credentials (via the third-party API)
   // after a checkpoint/session failure is itself a strong suspicious-login
   // signal and invalidates every other live session on the account.
   autoLogin: false,
-  apiServer: "https://minhdong.site",
+  // No default third-party host: your e-mail/password must never be sent anywhere you
+  // did not choose. autoLogin stays off unless you set both autoLogin and apiServer.
+  apiServer: "",
   apiKey: "",
   credentials: { email: "", password: "", twofactor: "" },
   antiGetInfo: {

package/module/login.js

@@ -11,7 +11,12 @@ global.fca = { config };
 
 // Global error handlers to prevent bot crashes
 // Handle unhandled promise rejections (e.g., fetch timeouts, network errors)
-if (!global.fca._errorHandlersInstalled) {
+// A library must not own the process: the host app (the bot) installs its own handlers and
+// decides what a crash means. These stay as a fallback ONLY for plain scripts that have none,
+// and they no longer swallow everything silently (see the counter below).
+if (!global.fca._errorHandlersInstalled &&
+    process.listenerCount("uncaughtException") === 0 &&
+    process.listenerCount("unhandledRejection") === 0) {
   global.fca._errorHandlersInstalled = true;
 
   process.on("unhandledRejection", (reason, promise) => {
@@ -73,10 +78,15 @@ if (!global.fca._errorHandlersInstalled) {
         return; // Don't crash
       }
 
-      // For other uncaught exceptions, log but try to continue
-      logger(`Uncaught exception (attempting to continue): ${errorMessage}`, "error");
-      // Note: We don't exit here to allow bot to continue running
-      // In production, you might want to restart the process instead
+      // Other uncaught exceptions: continuing after one is unsafe (state may be half-updated),
+      // so log it and exit after repeated ones; the supervisor restarts the process.
+      logger(`Uncaught exception: ${errorMessage}`, "error");
+      global.fca._uncaught = (global.fca._uncaught || []).filter(t => Date.now() - t < 10 * 60 * 1000);
+      global.fca._uncaught.push(Date.now());
+      if (global.fca._uncaught.length >= 5) {
+        logger("5 uncaught exceptions in 10 minutes - exiting so the supervisor can restart cleanly", "error");
+        process.exit(1);
+      }
     } catch (e) {
       // Fallback if logger fails - silent
     }

package/module/loginHelper.js

@@ -59,7 +59,10 @@ function mask(s, keep = 3) {
  */
 async function loginViaAPI(email, password, twoFactor = null, apiBaseUrl = null, apiKey = null) {
   try {
-    const baseUrl = apiBaseUrl || config.apiServer || "https://minhdong.site";
+    const baseUrl = apiBaseUrl || config.apiServer;
+    if (!baseUrl) {
+      return { ok: false, message: "No apiServer configured: credential login through a third-party API is disabled" };
+    }
     const endpoint = `${baseUrl}/api/v1/facebook/login_ios`;
     const xApiKey = apiKey || config.apiKey || null;
 
@@ -505,7 +508,7 @@ async function hydrateJarFromDB(userID) {
   }
 }
 
-async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions, ctxRef, hadAppStateInput = false) {
+async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions, ctxRef, hadAppStateInput = false, expectedUID = null) {
   // Helper to validate UID - must be a non-zero positive number string
   const isValidUID = uid => uid && uid !== "0" && /^\d+$/.test(uid) && parseInt(uid, 10) > 0;
 
@@ -547,7 +550,9 @@ async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions,
   }
 
   // Try to hydrate from DB backup
-  const hydrated = await hydrateJarFromDB(null);
+  // Only restore a backup that belongs to the account the caller asked for. Loading the
+  // "latest backup of anybody" could put a different account's cookies in the jar.
+  const hydrated = (hadAppStateInput && !expectedUID) ? false : await hydrateJarFromDB(expectedUID || null);
   if (hydrated) {
     logger("tryAutoLoginIfNeeded: Trying backup from DB...", "info");
     try {
@@ -721,6 +726,9 @@ async function tryAutoLoginIfNeeded(currentHtml, currentCookies, globalOptions,
 
 function makeLogin(j, email, password, globalOptions) {
   return async function () {
+    if (config.autoLogin !== true && config.autoLogin !== "true") {
+      throw new Error("No usable cookies were provided and credential login is disabled (autoLogin=false). Provide a fresh appstate/cookie export.");
+    }
     const u = email || config.credentials?.email;
     const p = password || config.credentials?.password;
     const tf = config.credentials?.twofactor || null;
@@ -820,6 +828,16 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
       }
       const ctx = { globalOptions, options: globalOptions, reconnectAttempts: 0 };
       ctx.bypassAutomation = async function (resp, j) {
+        // Never submit mutations intended to dismiss/bypass Facebook security warnings.
+        // Preserve the response so upstream login validation can fail closed.
+        const body = typeof resp?.data === "string" ? resp.data : String(resp?.data ?? "");
+        const url = resp?.request?.res?.responseUrl || resp?.config?.url || "";
+        if (/601051028565049|XCheckpointFBScrapingWarningController|automated.?behavior|checkpoint\//i.test(`${url} ${body}`)) {
+          logger("Facebook security/automation checkpoint detected; not bypassing it. Stop the bot and review the account manually.", "error");
+          const err = new Error("Facebook Checkpoint/security warning detected; automatic recovery stopped");
+          err.code = "FACEBOOK_SECURITY_CHECKPOINT";
+          throw err;
+        }
         global.fca = global.fca || {};
         global.fca.BypassAutomationNotification = this.bypassAutomation.bind(this);
         const s = x => (typeof x === "string" ? x : String(x ?? ""));
@@ -835,6 +853,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         const getUID = async body => (await cookieUID()) || htmlUID(body);
         const refreshJar = async () => get("https://www.facebook.com/", j, null, this.options).then(saveCookies(j));
         const bypass = async body => {
+          if (config.autoDismissAutomationWarning !== true) {
+            logger("Facebook is showing its automated-behavior warning. Not dismissing it automatically: open facebook.com in your browser, dismiss it yourself, then restart. (Set autoDismissAutomationWarning=true in fca-config.json to dismiss it automatically.)", "warn");
+            return;
+          }
           const b = s(body);
           const UID = await getUID(b);
           const fb_dtsg = getFrom(b, '"DTSGInitData",[],{"token":"', '",') || b.match(/name="fb_dtsg"\s+value="([^"]+)"/)?.[1];
@@ -866,7 +888,8 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           }
           return first;
         } catch (e) {
-          logger(`Bypass automation error: ${e && e.message ? e.message : String(e)}`, "error");
+          logger(`Facebook security handling stopped: ${e && e.message ? e.message : String(e)}`, "error");
+          if (e && e.code === "FACEBOOK_SECURITY_CHECKPOINT") throw e;
           return resp;
         }
       };
@@ -905,6 +928,15 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         const ctx = {};
         ctx.options = globalOptions;
         ctx.bypassAutomation = async function (resp, j) {
+          // Never submit mutations intended to dismiss/bypass Facebook security warnings.
+          const body = typeof resp?.data === "string" ? resp.data : String(resp?.data ?? "");
+          const url = resp?.request?.res?.responseUrl || resp?.config?.url || "";
+          if (/601051028565049|XCheckpointFBScrapingWarningController|automated.?behavior|checkpoint\//i.test(`${url} ${body}`)) {
+            logger("Facebook security/automation checkpoint detected; not bypassing it. Stop the bot and review the account manually.", "error");
+            const err = new Error("Facebook Checkpoint/security warning detected; automatic recovery stopped");
+            err.code = "FACEBOOK_SECURITY_CHECKPOINT";
+            throw err;
+          }
           global.fca = global.fca || {};
           global.fca.BypassAutomationNotification = this.bypassAutomation.bind(this);
           const s = x => (typeof x === "string" ? x : String(x ?? ""));
@@ -920,6 +952,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           const getUID = async body => (await cookieUID()) || htmlUID(body);
           const refreshJar = async () => get("https://www.facebook.com/", j, null, this.options).then(saveCookies(j));
           const bypass = async body => {
+            if (config.autoDismissAutomationWarning !== true) {
+              logger("Facebook is showing its automated-behavior warning. Not dismissing it automatically (see autoDismissAutomationWarning in fca-config.json).", "warn");
+              return;
+            }
             const b = s(body);
             const UID = await getUID(b);
             const fb_dtsg = getFrom(b, '"DTSGInitData",[],{"token":"', '",') || b.match(/name="fb_dtsg"\s+value="([^"]+)"/)?.[1];
@@ -938,7 +974,8 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
             }
             logger("✅ No checkpoint detected — session is clean.", "info");
             return res;
-          } catch {
+          } catch (e) {
+            if (e && e.code === "FACEBOOK_SECURITY_CHECKPOINT") throw e;
             return res;
           }
         };
@@ -970,7 +1007,7 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         if (!isValidUID(userID)) {
           logger("Invalid userID detected (missing or 0), attempting auto-login...", "warn");
           // Pass hadAppStateInput=true if appState/Cookie was originally provided
-          const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie));
+          const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie), userIDFromAppState);
           html = retried.html;
           cookies = retried.cookies;
           userID = retried.userID;
@@ -1089,7 +1126,7 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
             if (!isValidUID(info.USER_ID)) {
               logger("Facebook response shows invalid USER_ID (0 or empty), session is dead!", "warn");
               // Force trigger auto-login
-              const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie));
+              const retried = await tryAutoLoginIfNeeded(html, cookies, globalOptions, ctx, !!(appState || Cookie), userIDFromAppState);
               html = retried.html;
               cookies = retried.cookies;
               userID = retried.userID;
@@ -1358,8 +1395,10 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         }
 
         try {
-          const { checkForUpdate } = require("../src/utils/versionCheck");
-          checkForUpdate(logger);
+          if (config.checkForUpdates === true) {
+            const { checkForUpdate } = require("../src/utils/versionCheck");
+            checkForUpdate(logger);
+          }
         } catch (_) {}
         logger("🚀 Login successful! Bot is ready.");
         callback(null, api);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hridoy-ultimate",
-  "version": "9.0.2",
+  "version": "9.0.4",
   "description": "Facebook Chat API by HR ID OY | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,7 +9,8 @@
       "require": "./index.js",
       "default": "./index.js",
       "types": "./index.d.ts"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "index.js",
@@ -24,7 +25,7 @@
     "src/app/"
   ],
   "scripts": {
-    "test": "mocha",
+    "test": "node --test",
     "lint": "eslint ."
   },
   "repository": {
@@ -66,7 +67,7 @@
   },
   "homepage": "https://github.com/hridoyhossen48360/hridoy-ultimate#readme",
   "engines": {
-    "node": ">=12.0.0"
+    "node": ">=18"
   },
   "dependencies": {
     "axios": "^1.13.5",
@@ -75,21 +76,23 @@
     "chalk": "^4.1.2",
     "cheerio": "1.0.0-rc.12",
     "duplexify": "^4.1.3",
+    "form-data": "^4.0.0",
     "gradient-string": "^2.0.2",
     "https-proxy-agent": "^4.0.0",
+    "koffi": "^3.0.2",
+    "mime": "^3.0.0",
     "mqtt": "^5.10.1",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "protobufjs": "^8.4.0",
+    "request": "^2.88.2",
     "sequelize": "^6.37.6",
+    "@signalapp/libsignal-client": "0.70.0",
     "sqlite3": "^5.1.7",
     "totp-generator": "^1.0.0",
+    "tough-cookie": "^5.0.0",
     "ws": "^8.18.0",
-    "@noble/curves": "^2.2.0",
-    "@noble/hashes": "^2.2.0",
-    "@signalapp/libsignal-client": "0.70.0",
-    "mime": "^3.0.0",
-    "protobufjs": "^8.4.0",
-    "koffi": "^3.0.2",
-    "yumi-json-bigint": "^1.0.0",
-    "fca-unofficial": "github:VangBanLaNhat/fca-unofficial"
+    "yumi-json-bigint": "^1.0.0"
   },
   "devDependencies": {
     "eslint": "^8.50.0",
@@ -98,5 +101,8 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
+  },
+  "optionalDependencies": {
+    "fca-unofficial": "github:VangBanLaNhat/fca-unofficial"
   }
 }

package/src/api/action/enableAutoSaveAppState.js

@@ -20,14 +20,17 @@ module.exports = function (defaultFuncs, api, ctx) {
     // Save function
     function saveAppState() {
       try {
-        const appState = api.getAppState();
-        if (!appState || !appState.appState || appState.appState.length === 0) {
-          logger("AppState is empty, skipping save", "warn");
+        const raw = api.getAppState();
+        const appState = Array.isArray(raw) ? raw : (raw && Array.isArray(raw.appState) ? raw.appState : null);
+        if (!appState || appState.length < 5) {
+          logger("AppState is empty or too small, skipping save", "warn");
           return;
         }
 
-        const data = JSON.stringify(appState, null, 2);
-        fs.writeFileSync(filePath, data, "utf8");
+        // write-then-rename so a crash mid-write can never leave a truncated cookie file
+        const tmp = filePath + ".tmp";
+        fs.writeFileSync(tmp, JSON.stringify(appState, null, 2), "utf8");
+        fs.renameSync(tmp, filePath);
         logger(`AppState saved to ${filePath}`, "info");
       } catch (error) {
         logger(`Error saving AppState: ${error && error.message ? error.message : String(error)}`, "error");

package/src/api/action/getSafetyStatus.js

@@ -0,0 +1,27 @@
+"use strict";
+
+const { globalAntiSuspension } = require("../../utils/antiSuspension");
+
+/**
+ * api.getSafetyStatus() -> {
+ *   blocked, reason, coolingDown, warmup, hourSendCount, hourlyCap, daySendCount, dailyCap
+ * }
+ * `blocked` is true after Facebook showed a checkpoint / automated-behavior / disabled
+ * signal: sendMessage then rejects with err.code === "ACCOUNT_SAFETY_PAUSED" until the
+ * process is restarted after you reviewed the account by hand.
+ */
+module.exports = function (defaultFuncs, api, ctx) {
+  return function getSafetyStatus() {
+    const st = globalAntiSuspension.getStats();
+    return {
+      blocked: !!st.safetyBlocked,
+      reason: st.safetyReason || null,
+      coolingDown: !!st.coolingDown,
+      warmup: !!st.warmup,
+      hourSendCount: st.hourSendCount,
+      hourlyCap: st.hourlyCap,
+      daySendCount: st.daySendCount,
+      dailyCap: st.dailyCap
+    };
+  };
+};

package/src/api/action/logout.js

@@ -1,75 +1,86 @@
 "use strict";
 
+/**
+ * logout - stop this bot session WITHOUT logging the account out of Facebook.
+ *
+ * Older FCA builds POSTed facebook.com/logout.php here. That ends the session
+ * server-side, so the same account is logged out in your own browser as well,
+ * which is the opposite of what a bot owner wants when they just stop the bot.
+ *
+ * Default behaviour (since 9.0.5): local stop only
+ *   - stops the MQTT listener,
+ *   - cancels the fb_dtsg refresh timer,
+ *   - stops sessionGuard's timer,
+ *   - never sends anything to Facebook.
+ *
+ * The real Facebook logout is api.logoutFromFacebook(). It can also be made the
+ * behaviour of api.logout() by setting `"allowFacebookLogout": true` in
+ * fca-config.json (explicit opt-in).
+ */
+
 const log = require("../../../func/logAdapter");
-const { parseAndCheckLogin } = require("../../utils/client");
-const { getFrom } = require("../../utils/constants");
-const { saveCookies } = require("../../utils/client");
-module.exports = function(defaultFuncs, api, ctx) {
+const { loadConfig } = require("../../../module/config");
+
+module.exports = function (defaultFuncs, api, ctx) {
+  function stopListener() {
+    return new Promise(resolve => {
+      let done = false;
+      const finish = () => { if (!done) { done = true; resolve(); } };
+      try {
+        if (typeof api.stopListening === "function") {
+          api.stopListening(finish);
+          // never hang a shutdown on a listener that was never started
+          setTimeout(finish, 6000).unref?.();
+        } else {
+          finish();
+        }
+      } catch (_) {
+        finish();
+      }
+    });
+  }
+
+  function stopTimers() {
+    try {
+      if (ctx._dtsgRefreshInterval) {
+        clearInterval(ctx._dtsgRefreshInterval);
+        ctx._dtsgRefreshInterval = null;
+      }
+    } catch (_) { /* ignore */ }
+    try {
+      if (typeof api.stopSessionGuard === "function") api.stopSessionGuard();
+    } catch (_) { /* ignore */ }
+  }
+
   return function logout(callback) {
-    let resolveFunc = function() {};
-    let rejectFunc = function() {};
-    const returnPromise = new Promise(function(resolve, reject) {
+    let resolveFunc = function () {};
+    let rejectFunc = function () {};
+    const returnPromise = new Promise(function (resolve, reject) {
       resolveFunc = resolve;
       rejectFunc = reject;
     });
 
-    if (!callback) {
-      callback = function(err, friendList) {
-        if (err) {
-          return rejectFunc(err);
-        }
-        resolveFunc(friendList);
+    if (typeof callback !== "function") {
+      callback = function (err, result) {
+        if (err) return rejectFunc(err);
+        resolveFunc(result);
       };
     }
 
-    const form = {
-      pmid: "0"
-    };
-
-    defaultFuncs
-      .post(
-        "https://www.facebook.com/bluebar/modern_settings_menu/?help_type=364455653583099&show_contextual_help=1",
-        ctx.jar,
-        form
-      )
-      .then(parseAndCheckLogin(ctx, defaultFuncs))
-      .then(function(resData) {
-        const elem = resData.jsmods.instances[0][2][0].filter(function(v) {
-          return v.value === "logout";
-        })[0];
-
-        const html = resData.jsmods.markup.filter(function(v) {
-          return v[0] === elem.markup.__m;
-        })[0][1].__html;
-
-        const form = {
-          fb_dtsg: getFrom(html, '"fb_dtsg" value="', '"'),
-          ref: getFrom(html, '"ref" value="', '"'),
-          h: getFrom(html, '"h" value="', '"')
-        };
-
-        return defaultFuncs
-          .post("https://www.facebook.com/logout.php", ctx.jar, form)
-          .then(saveCookies(ctx.jar));
-      })
-      .then(function(res) {
-        if (!res.headers) {
-          throw { error: "An error occurred when logging out." };
-        }
+    const { config } = loadConfig();
+    if (config && config.allowFacebookLogout === true && typeof api.logoutFromFacebook === "function") {
+      log.warn("logout", "allowFacebookLogout is true: logging out of Facebook for real (your browser session ends too).");
+      api.logoutFromFacebook(callback);
+      return returnPromise;
+    }
 
-        return defaultFuncs
-          .get(res.headers.location, ctx.jar)
-          .then(saveCookies(ctx.jar));
-      })
-      .then(function() {
-        ctx.loggedIn = false;
-        log.info("logout", "Logged out successfully.");
-        callback();
+    log.info("logout", "Stopping locally. The Facebook session is NOT ended (use api.logoutFromFacebook() for a real logout).");
+    stopListener()
+      .then(() => {
+        stopTimers();
+        callback(null, { localOnly: true });
       })
-      .catch(function(err) {
-        log.error("logout", err);
-        return callback(err);
-      });
+      .catch(err => callback(err));
 
     return returnPromise;
   };