hridoy-ultimate 9.0.2 → 9.0.4

package/src/api/action/logoutFromFacebook.js

@@ -0,0 +1,86 @@
+"use strict";
+
+/**
+ * logoutFromFacebook - REAL Facebook logout.
+ *
+ * This POSTs facebook.com/logout.php with the session cookies. Facebook then
+ * invalidates that session everywhere it is used, so the same account is also
+ * logged out in your normal browser. It is NOT called by api.logout() unless you
+ * opt in with `allowFacebookLogout: true` in fca-config.json. Call it directly
+ * only when you really want to end the Facebook session.
+ */
+
+const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
+const { getFrom } = require("../../utils/constants");
+const { saveCookies } = require("../../utils/client");
+module.exports = function(defaultFuncs, api, ctx) {
+  return function logoutFromFacebook(callback) {
+    let resolveFunc = function() {};
+    let rejectFunc = function() {};
+    const returnPromise = new Promise(function(resolve, reject) {
+      resolveFunc = resolve;
+      rejectFunc = reject;
+    });
+
+    if (!callback) {
+      callback = function(err, friendList) {
+        if (err) {
+          return rejectFunc(err);
+        }
+        resolveFunc(friendList);
+      };
+    }
+
+    const form = {
+      pmid: "0"
+    };
+
+    defaultFuncs
+      .post(
+        "https://www.facebook.com/bluebar/modern_settings_menu/?help_type=364455653583099&show_contextual_help=1",
+        ctx.jar,
+        form
+      )
+      .then(parseAndCheckLogin(ctx, defaultFuncs))
+      .then(function(resData) {
+        const elem = resData.jsmods.instances[0][2][0].filter(function(v) {
+          return v.value === "logout";
+        })[0];
+
+        const html = resData.jsmods.markup.filter(function(v) {
+          return v[0] === elem.markup.__m;
+        })[0][1].__html;
+
+        const form = {
+          fb_dtsg: getFrom(html, '"fb_dtsg" value="', '"'),
+          ref: getFrom(html, '"ref" value="', '"'),
+          h: getFrom(html, '"h" value="', '"')
+        };
+
+        return defaultFuncs
+          .post("https://www.facebook.com/logout.php", ctx.jar, form)
+          .then(saveCookies(ctx.jar));
+      })
+      .then(function(res) {
+        if (!res.headers) {
+          throw { error: "An error occurred when logging out." };
+        }
+
+        return defaultFuncs
+          .get(res.headers.location, ctx.jar)
+          .then(saveCookies(ctx.jar));
+      })
+      .then(function() {
+        ctx.loggedIn = false;
+        log.info("logoutFromFacebook", "Logged out of Facebook (this also ends the browser session).");
+        callback();
+      })
+      .catch(function(err) {
+        log.error("logoutFromFacebook", err);
+        return callback(err);
+      });
+
+    return returnPromise;
+  };
+};

package/src/api/action/refreshFb_dtsg.js

@@ -12,7 +12,7 @@ module.exports = function (defaultFuncs, api, ctx) {
     }
     if (!obj) obj = {};
     if (getType(obj) !== "Object") {
-      throw new CustomError("The first parameter must be an object or a callback function");
+      throw new Error("The first parameter must be an object or a callback function");
     }
     let resolveFunc, rejectFunc;
     const returnPromise = new Promise((resolve, reject) => {

package/src/api/messaging/changeGroupImage.js

@@ -2,6 +2,7 @@
 
 const { generateOfflineThreadingID } = require("../../utils/format");
 const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
 
 module.exports = function (defaultFuncs, api, ctx) {
   function handleUpload(image) {

package/src/api/socket/OldMessage.js

@@ -119,7 +119,10 @@ module.exports = function (defaultFuncs, api, ctx) {
         form.signatureID = utils.getGUID().replace(/-/g, "").slice(0, 8);
         const doSend = () => sendContent(form, threadID, isSingleUser, messageAndOTID, callback);
         if (!ctx.globalOptions || ctx.globalOptions.antiBan !== false) {
-            globalAntiSuspension.prepareBeforeMessage(threadID, form.body || "").then(doSend).catch(doSend);
+            globalAntiSuspension.prepareBeforeMessage(threadID, form.body || "").then(doSend).catch(err => {
+                if (typeof callback === "function") return callback(err);
+                return undefined;
+            });
         } else {
             doSend();
         }

package/src/api/socket/core/connectMqtt.js

@@ -16,9 +16,25 @@ module.exports = function createListenMqtt(deps) {
 
   return function listenMqtt(defaultFuncs, api, ctx, globalCallback) {
 
+    // Reconnects used to be a fixed 2 s forever: a flapping or refused socket meant a new
+    // WebSocket handshake to edge-chat every 2 seconds. Now exponential with jitter, capped
+    // at 5 min, reset as soon as the broker delivers /t_ms again, with a hard budget.
+    const MQTT_MAX_FAILS = 12;
+    const MQTT_MAX_DELAY_MS = 5 * 60 * 1000;
     function scheduleReconnect(delayMs) {
       const d = (ctx._mqttOpt && ctx._mqttOpt.reconnectDelayMs) || DEFAULT_RECONNECT_DELAY_MS;
-      const ms = typeof delayMs === "number" ? delayMs : d;
+      const base = typeof delayMs === "number" ? delayMs : d;
+      const streak = ctx._mqttFailStreak || 0;
+      if (!ctx._reconnectTimer && !ctx._ending) {
+        if (streak >= MQTT_MAX_FAILS) {
+          ctx._mqttFailStreak = 0;
+          logger(`mqtt reconnect budget used up (${MQTT_MAX_FAILS} attempts without a working connection) - stopping; host app decides`, "error");
+          try { globalCallback({ type: "stop_listen", error: "MQTT reconnect budget exhausted" }, null); } catch (_) { }
+          return;
+        }
+        ctx._mqttFailStreak = streak + 1;
+      }
+      const ms = Math.round(Math.min(base * Math.pow(2, streak), MQTT_MAX_DELAY_MS) * (0.85 + Math.random() * 0.3));
       if (ctx._reconnectTimer) {
         logger("mqtt reconnect already scheduled", "warn");
         return; // debounce
@@ -180,6 +196,7 @@ module.exports = function createListenMqtt(deps) {
       ctx._rTimeout = rTimeout;
 
       ctx.tmsWait = function () {
+        ctx._mqttFailStreak = 0; // broker is delivering again: connection is healthy
         if (rTimeout) {
           clearTimeout(rTimeout);
           rTimeout = null;

package/src/api/socket/core/getSeqID.js

@@ -254,9 +254,12 @@ module.exports = function createGetSeqID(deps) {
           
           throw { error: "Not logged in", originalResponse: resData };
         }
-        if (!Array.isArray(resData) || !resData.length) return;
+        if (!Array.isArray(resData) || !resData.length) throw new Error("getSeqID: empty response");
         const lastRes = resData[resData.length - 1];
-        if (lastRes && lastRes.successful_results === 0) return;
+        // Used to `return` silently here: no listener was started and nothing retried, so the
+        // bot sat "running" but deaf until the 5-minute heartbeat noticed. Now it is a
+        // retryable error (bounded back-off in listenMqtt's getSeqIDWrapper).
+        if (lastRes && lastRes.successful_results === 0) throw new Error("getSeqID: Facebook returned no successful results");
 
         const syncSeqId = resData[0]?.o0?.data?.viewer?.message_threads?.sync_sequence_id;
         if (syncSeqId) {
@@ -266,12 +269,20 @@ module.exports = function createGetSeqID(deps) {
           ctx.lastSeqId = ctx.lastSeqId || 0;
           logger("getSeqID: sync_sequence_id not found, fallback lastSeqId=" + ctx.lastSeqId, "warn");
         }
+        ctx.loggedIn = true; // emitAuth() sets this false; a working session must set it back
         listenMqtt(defaultFuncs, api, ctx, globalCallback);
       })
       .catch(async err => {
         const detail = (err && err.detail && err.detail.message) ? ` | detail=${err.detail.message}` : "";
         const msg = ((err && err.error) || (err && err.message) || String(err || "")) + detail;
 
+        // A human has to dismiss Facebook's automated-behavior warning. Not a dead session and
+        // not retryable: stop cleanly and tell the host app with its own reason.
+        if (/automation_warning|automated-behavior warning/i.test(msg) || (err && err.error === "automation_warning")) {
+          logger(`getSeqID: ${msg} - NOT retrying`, "warn");
+          return emitAuth(ctx, api, globalCallback, "automation_warning", msg);
+        }
+
         // Definitive server-side session invalidation: error 1357001
         // ("Log in to continue") or an explicit login block. The session is
         // dead, not desynced — retrying within seconds (and especially

package/src/api/socket/listenMqtt.js

@@ -96,6 +96,18 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   let conf = mqttConf(ctx, opts);
 
+  // Consecutive getSeqID failures. Used to retry every fixed 2 s forever, which is a request
+  // storm against Facebook on any persistent error (and exactly what "automation" detection
+  // looks for). Now: exponential back-off with jitter, capped, and a hard budget after which
+  // the host app is told ({type:"stop_listen"}) instead of looping.
+  let seqFailStreak = 0;
+  const SEQ_MAX_FAILS = 8;
+  const SEQ_MAX_DELAY_MS = 5 * 60 * 1000;
+  function seqRetryDelay(streak) {
+    const raw = Math.min(conf.reconnectDelayMs * Math.pow(2, streak - 1), SEQ_MAX_DELAY_MS);
+    return Math.round(raw * (0.85 + Math.random() * 0.3));
+  }
+
   function getSeqIDWrapper() {
     if (ctx._ending && !ctx._cycling) {
       logger("mqtt getSeqID skipped - ending", "warn");
@@ -118,6 +130,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
       .then(() => {
         logger("mqtt getSeqID done", "info");
         ctx._cycling = false;
+        seqFailStreak = 0;
       })
       .catch(e => {
         ctx._cycling = false;
@@ -127,8 +140,15 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
         if (ctx._ending) return;
         // Retry after delay if autoReconnect is enabled
         if (ctx.globalOptions.autoReconnect) {
-          const d = conf.reconnectDelayMs;
-          logger(`mqtt getSeqID will retry in ${d}ms`, "warn");
+          seqFailStreak++;
+          if (seqFailStreak > SEQ_MAX_FAILS) {
+            logger(`mqtt getSeqID failed ${SEQ_MAX_FAILS} times in a row - giving up (host app decides what happens next)`, "error");
+            seqFailStreak = 0;
+            try { globalCallback({ type: "stop_listen", error: errMsg }, null); } catch (_) { }
+            return;
+          }
+          const d = seqRetryDelay(seqFailStreak);
+          logger(`mqtt getSeqID will retry in ${d}ms (failure ${seqFailStreak}/${SEQ_MAX_FAILS})`, "warn");
           setTimeout(() => {
             if (!ctx._ending) getSeqIDWrapper();
           }, d);
@@ -280,9 +300,8 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   function startSessionKeeper() {
     if (ctx._sessionKeeperInterval) return;
-    // Self-rescheduling timeout with ±15 min jitter around 90 min, instead of
-    // a clockwork-exact 90:00.000 interval — perfectly periodic traffic is
-    // trivial to fingerprint.
+    // Self-rescheduling timeout with ±1 h jitter around 6 h, instead of a
+    // clockwork-exact interval — perfectly periodic traffic is trivial to fingerprint.
     const BASE_MS = 6 * 60 * 60 * 1000;
     const JITTER_MS = 60 * 60 * 1000;
     const scheduleNext = function () {
@@ -480,13 +499,3 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   };
 };
 
-
-// mqtt stability patch
-try {
-  if (typeof client !== "undefined" && client) {
-    client.on("offline", () => console.log("[FCA] MQTT offline"));
-    client.on("reconnect", () => console.log("[FCA] MQTT reconnecting"));
-    client.on("close", () => console.log("[FCA] MQTT closed"));
-    client.on("error", (e) => console.log("[FCA] MQTT error:", e?.message || e));
-  }
-} catch (e) {}

package/src/api/socket/sendMessage.js

@@ -254,7 +254,10 @@ module.exports = function (defaultFuncs, api, ctx) {
             try {
                 await globalAntiSuspension.prepareBeforeMessage(threadID, msg.body || "");
             } catch (err) {
-                logger("AntiSuspension prepareBeforeMessage error: " + (err && err.message ? err.message : err), "warn");
+                logger.error("sendMessage", "Outbound send blocked by safety guard: " + (err && err.message ? err.message : err));
+                if (callback) callback(err);
+                else reject(err);
+                return promise;
             }
         }
 

package/src/api/users/getUserID.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
 const { formatID } = require("../../utils/format");
 function formatData(data) {
   return {

package/src/app/createFcaClient.js

@@ -88,6 +88,7 @@ function createFallbackNamespaces(api) {
       getCurrentUserID: bindOptionalMethod(api, "getCurrentUserID"),
       handleFriendRequest: bindOptionalMethod(api, "handleFriendRequest"),
       logout: bindOptionalMethod(api, "logout"),
+      logoutFromFacebook: bindOptionalMethod(api, "logoutFromFacebook"),
       refreshDtsg: bindOptionalMethod(api, "refreshFb_dtsg"),
       changeBlockedStatus: bindOptionalMethod(api, "changeBlockedStatus"),
       setOptions: bindOptionalMethod(api, "setOptions"),

package/src/utils/antiSuspension.js

@@ -6,17 +6,21 @@ const log = {
 };
 
 // Phrases Facebook responses use when it thinks this account is being
-// operated by a bot / script rather than a human. If any of these show up
-// in a response body or an error message, we treat it as a signal that
-// current traffic looks automated and should slow down / back off.
-const SUSPICION_PHRASES = [
+// operated by a bot / script rather than a human, or when it is restricting it.
+//
+// HARD signals mean the account itself is flagged / locked / needs a human
+// (checkpoint, automated-behavior warning, disabled, identity check). On these
+// the guard FAILS CLOSED: outbound sending stops until the process is restarted
+// after a manual review of the account.
+//
+// SOFT signals are rate-limit style responses ("too many requests", "rate
+// limited", "temporarily blocked" ...). They are usually transient, so they only
+// count as strikes and trigger the slow-down cooldown. Treating them as hard
+// signals made one passing 429-style error silence the bot for good.
+const HARD_SUSPICION_PHRASES = [
     "checkpoint",
     "automated behavior",
     "automated_behavior",
-    "unusual activity",
-    "unusual_activity",
-    "suspicious activity",
-    "action_required",
     "account_locked",
     "account locked",
     "account has been disabled",
@@ -26,6 +30,17 @@ const SUSPICION_PHRASES = [
     "bot detected",
     "bot_detected",
     "not a human",
+    "verify your account",
+    "confirm your identity",
+    "confirm it's you",
+    "security check required"
+];
+
+const SOFT_SUSPICION_PHRASES = [
+    "unusual activity",
+    "unusual_activity",
+    "suspicious activity",
+    "action_required",
     "spam detected",
     "spam_detected",
     "looks like spam",
@@ -35,15 +50,14 @@ const SUSPICION_PHRASES = [
     "too_many_requests",
     "temporarily blocked",
     "feature temporarily unavailable",
-    "verify your account",
-    "confirm your identity",
-    "confirm it's you",
-    "security check required",
     "policy violation",
     "action blocked",
     "you're blocked from"
 ];
 
+// Kept for backwards compatibility with anything that imported the old list.
+const SUSPICION_PHRASES = HARD_SUSPICION_PHRASES.concat(SOFT_SUSPICION_PHRASES);
+
 /**
  * Tracks send volume and paces outbound traffic so it doesn't look like a
  * script firing messages as fast as the network allows. Three layers:
@@ -72,13 +86,18 @@ class SendPacer {
         this.dayWindowStart = Date.now();
         this.daySendCount = 0;
 
+        this.accountSafetyBlocked = false;
+        this.accountSafetyReason = null;
+
         this.cooldown = {
             active: false,
             since: null,
             durationMs: 45 * 60 * 1000,
             strikes: 0,
-            strikesToActivate: 2
+            strikesToActivate: 2,
+            strikeWindowMs: 30 * 60 * 1000
         };
+        this.softStrikeTimes = [];
 
         this._gcTimer = setInterval(() => this._rollWindows(), 60 * 1000);
         if (this._gcTimer.unref) this._gcTimer.unref();
@@ -108,12 +127,30 @@ class SendPacer {
         return this._inWarmup() ? this.warmupHourlyCap : this.normalHourlyCap;
     }
 
-    /** Records that a suspicious signal was seen; may activate the cooldown. */
-    noteSuspicionSignal(source) {
-        this.cooldown.strikes++;
+    /**
+     * Records that a suspicious signal was seen.
+     * hard=true  (default): fail closed - stop sending until a human reviews the account.
+     * hard=false: count a strike; two strikes inside strikeWindowMs start the cooldown.
+     */
+    noteSuspicionSignal(source, hard) {
+        const isHard = hard !== false;
+        if (isHard) {
+            // Fail closed: once Facebook signals checkpoint/automation/disabled status,
+            // do not continue sending or retrying in this process. Human review is required.
+            if (!this.accountSafetyBlocked) {
+                log.warn("AntiSuspension", `Outbound sending paused: ${source || "Facebook security signal"}. Review the account manually, then restart the bot.`);
+            }
+            this.accountSafetyBlocked = true;
+            this.accountSafetyReason = String(source || "Facebook security signal");
+            return;
+        }
+        const now = Date.now();
+        this.softStrikeTimes = this.softStrikeTimes.filter(t => now - t < this.cooldown.strikeWindowMs);
+        this.softStrikeTimes.push(now);
+        this.cooldown.strikes = this.softStrikeTimes.length;
         if (!this.cooldown.active && this.cooldown.strikes >= this.cooldown.strikesToActivate) {
             this.cooldown.active = true;
-            this.cooldown.since = Date.now();
+            this.cooldown.since = now;
             log.warn("AntiSuspension", `Cooldown activated after repeated suspicion signals (last: ${source || "unknown"}). Backing off for ${(this.cooldown.durationMs / 60000).toFixed(0)} min.`);
         }
     }
@@ -122,9 +159,17 @@ class SendPacer {
     scanForSuspicion(text) {
         if (!text || typeof text !== "string") return false;
         const lower = text.toLowerCase();
-        const hit = SUSPICION_PHRASES.find(p => lower.includes(p));
-        if (hit) this.noteSuspicionSignal(hit);
-        return !!hit;
+        const hardHit = HARD_SUSPICION_PHRASES.find(p => lower.includes(p));
+        if (hardHit) {
+            this.noteSuspicionSignal(hardHit, true);
+            return true;
+        }
+        const softHit = SOFT_SUSPICION_PHRASES.find(p => lower.includes(p));
+        if (softHit) {
+            this.noteSuspicionSignal(softHit, false);
+            return true;
+        }
+        return false;
     }
 
     /** Inspects a thrown error's message for suspicion phrases. */
@@ -138,6 +183,7 @@ class SendPacer {
         if (Date.now() - this.cooldown.since >= this.cooldown.durationMs) {
             this.cooldown.active = false;
             this.cooldown.strikes = 0;
+            this.softStrikeTimes = [];
             this.cooldown.since = null;
             return false;
         }
@@ -151,6 +197,11 @@ class SendPacer {
      * rather than blocking a real message.
      */
     async waitForTurn(threadID) {
+        if (this.accountSafetyBlocked) {
+            const err = new Error(`Outbound messaging paused after Facebook security signal: ${this.accountSafetyReason}. Review the account manually before restarting.`);
+            err.code = "ACCOUNT_SAFETY_PAUSED";
+            throw err;
+        }
         try {
             this._rollWindows();
 
@@ -185,8 +236,10 @@ class SendPacer {
             this.daySendCount++;
             const threadCount = (this.threadSendCounts.get(key) || 0) + 1;
             this.threadSendCounts.set(key, threadCount);
-        } catch {
-            // Pacing must never be the reason a real message fails to send.
+        } catch (err) {
+            // Safety-related errors must not be swallowed.
+            if (err && err.code === "ACCOUNT_SAFETY_PAUSED") throw err;
+            log.warn("AntiSuspension", `Pacing check failed: ${err && err.message ? err.message : String(err)}`);
         }
     }
 
@@ -201,7 +254,9 @@ class SendPacer {
             hourlyCap: this._hourlyCap(),
             daySendCount: this.daySendCount,
             dailyCap: this.dailyCap,
-            coolingDown: this.isCoolingDown()
+            coolingDown: this.isCoolingDown(),
+            safetyBlocked: this.accountSafetyBlocked,
+            safetyReason: this.accountSafetyReason
         };
     }
 }
@@ -210,10 +265,15 @@ const pacer = new SendPacer();
 
 module.exports = {
     SendPacer,
+    HARD_SUSPICION_PHRASES,
+    SOFT_SUSPICION_PHRASES,
+    SUSPICION_PHRASES,
     globalAntiSuspension: {
         prepareBeforeMessage: (threadID) => pacer.waitForTurn(threadID),
         detectSuspensionSignal: (text) => pacer.scanForSuspicion(text),
         checkAccountHealth: (err) => pacer.noteSendError(err),
-        getStats: () => pacer.stats()
+        getStats: () => pacer.stats(),
+        isAccountSafetyBlocked: () => pacer.accountSafetyBlocked,
+        getAccountSafetyReason: () => pacer.accountSafetyReason
     }
 };

package/src/utils/cookies.js

@@ -2,6 +2,28 @@
 
 // Cookie helpers extracted from client.js
 
+const AUTH_COOKIES = new Set(["c_user", "xs", "i_user", "datr", "sb", "fr"]);
+
+// True for a Set-Cookie header that deletes one of the login cookies
+// (empty / "deleted" value, Max-Age<=0, or an expiry in the past).
+function isAuthCookieDeletion(setCookieHeader) {
+  const first = String(setCookieHeader || "").split(";")[0];
+  const eq = first.indexOf("=");
+  if (eq <= 0) return false;
+  const name = first.slice(0, eq).trim();
+  if (!AUTH_COOKIES.has(name)) return false;
+  const value = first.slice(eq + 1).trim().replace(/^"|"$/g, "");
+  if (value === "" || /^deleted$/i.test(value)) return true;
+  const maxAge = /;\s*max-age\s*=\s*(-?\d+)/i.exec(setCookieHeader);
+  if (maxAge && parseInt(maxAge[1], 10) <= 0) return true;
+  const expires = /;\s*expires\s*=\s*([^;]+)/i.exec(setCookieHeader);
+  if (expires) {
+    const t = Date.parse(expires[1]);
+    if (!Number.isNaN(t) && t <= Date.now()) return true;
+  }
+  return false;
+}
+
 function saveCookies(jar) {
   return res => {
     try {
@@ -29,6 +51,11 @@ function saveCookies(jar) {
               const mirrored = c.replace(/domain=\.?facebook\.com/i, "domain=.messenger.com");
               jar.setCookieSync(mirrored, "https://www.messenger.com");
             } else if (/domain=\.?messenger\.com/i.test(c)) {
+              // A messenger.com "delete this cookie" answer must never wipe the matching
+              // facebook.com login cookie in our jar: that would silently kill a perfectly
+              // good facebook.com session (the cookie values are mirrored, so messenger.com
+              // may well reject them while facebook.com is fine).
+              if (isAuthCookieDeletion(c)) continue;
               const mirrored = c.replace(/domain=\.?messenger\.com/i, "domain=.facebook.com");
               jar.setCookieSync(mirrored, "https://www.facebook.com");
             }
@@ -80,6 +107,7 @@ function getAppState(jar) {
 
 module.exports = {
   saveCookies,
-  getAppState
+  getAppState,
+  isAuthCookieDeletion
 };