hridoy-ultimate 9.0.2 → 9.0.4

package/src/utils/fingerprint.js

@@ -1,25 +1,37 @@
 "use strict";
 
-// A small pool of current, plausible desktop Chrome versions to rotate
-// through. A single frozen version shared by every process using this
-// package is itself a fingerprint — thousands of unrelated accounts all
-// claiming the exact same browser build is a trivially detectable pattern.
-// Keep this list current; entries that are far behind Chrome's real release
-// timeline are themselves a signal.
-const CHROME_VERSIONS = [
-  "131.0.6778.140",
-  "132.0.6834.111",
-  "133.0.6943.98",
-  "134.0.6998.117",
-  "135.0.7049.85"
-];
-
-function pickChromeVersion() {
-  return CHROME_VERSIONS[Math.floor(Math.random() * CHROME_VERSIONS.length)];
+// Fallback fingerprint, used ONLY when no real browser User-Agent is configured.
+//
+// Real Chrome sends a "reduced" User-Agent (Chrome/<major>.0.0.0) since v101, so the
+// major version is all a believable UA needs. A hard-coded list of versions goes
+// stale within weeks (the old pool here was ~2 years behind and a stale browser build
+// is itself a signal), so the major is estimated from today's date instead.
+//
+// The best option by far is still to pass the exact User-Agent of the browser the
+// cookies were exported from: via the `userAgent` login option, or the FCA_USER_AGENT
+// environment variable.
+const MS_DAY = 24 * 60 * 60 * 1000;
+// Anchors from Chrome's published schedule: 151 stable on 2026-07-28 (4-week cadence),
+// 153 on 2026-09-08, then one major every 2 weeks.
+const ANCHOR_151 = Date.UTC(2026, 6, 28);
+const ANCHOR_153 = Date.UTC(2026, 8, 8);
+
+function estimateStableMajor(now) {
+  const t = typeof now === "number" ? now : Date.now();
+  if (t >= ANCHOR_153) return 153 + Math.floor((t - ANCHOR_153) / (14 * MS_DAY));
+  if (t >= ANCHOR_151) return 151 + Math.floor((t - ANCHOR_151) / (28 * MS_DAY));
+  // before the anchors: count back one major per 4 weeks (never below 130)
+  return Math.max(130, 151 - Math.ceil((ANCHOR_151 - t) / (28 * MS_DAY)));
+}
+
+// Real users are usually a release behind (staged auto-update), so use stable - 1.
+function pickChromeMajor(now) {
+  return estimateStableMajor(now) - 1;
 }
 
-function buildUserAgent(version) {
-  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
+function buildUserAgent(major) {
+  // Reduced UA format used by real Chrome: Chrome/<major>.0.0.0
+  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
 }
 
 // Chrome's Sec-Ch-Ua "GREASE" brand slot rotates through a small set of
@@ -47,30 +59,54 @@ function fingerprintFile() {
   return path.join(process.cwd(), "data", "session", "fca-fingerprint.json");
 }
 
+function fromUserAgentString(ua, source) {
+  const m = String(ua || "").match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
+  return {
+    userAgent: String(ua).trim(),
+    version: m ? m[0].split("/")[1] : "",
+    major: m ? parseInt(m[1], 10) : 0,
+    source
+  };
+}
+
 function getFingerprint() {
-  if (!cachedFingerprint) {
-    try {
-      const saved = JSON.parse(fs.readFileSync(fingerprintFile(), "utf8"));
-      if (saved && CHROME_VERSIONS.includes(saved.version)) {
-        cachedFingerprint = {
-          userAgent: buildUserAgent(saved.version),
-          version: saved.version,
-          major: parseInt(saved.version.split(".")[0], 10)
-        };
-      }
-    } catch (_) { /* first run */ }
+  if (cachedFingerprint) return cachedFingerprint;
+
+  // 1) explicit environment override (same meaning as the userAgent login option)
+  const envUA = process.env.FCA_USER_AGENT;
+  if (envUA && envUA.trim()) {
+    cachedFingerprint = fromUserAgentString(envUA, "env");
+    return cachedFingerprint;
   }
+
+  const wanted = pickChromeMajor();
+
+  // 2) the fingerprint saved by an earlier run, as long as it is not far behind a
+  //    current browser (a few majors behind is normal; two years behind is not)
+  try {
+    const saved = JSON.parse(fs.readFileSync(fingerprintFile(), "utf8"));
+    const savedMajor = saved && parseInt(String(saved.major || saved.version || "").split(".")[0], 10);
+    if (savedMajor && wanted - savedMajor <= 6 && savedMajor <= wanted + 1) {
+      cachedFingerprint = {
+        userAgent: buildUserAgent(savedMajor),
+        version: savedMajor + ".0.0.0",
+        major: savedMajor,
+        source: "saved"
+      };
+    }
+  } catch (_) { /* first run */ }
+
+  // 3) estimate from the date and remember it
   if (!cachedFingerprint) {
-    const version = pickChromeVersion();
-    const major = parseInt(version.split(".")[0], 10);
     cachedFingerprint = {
-      userAgent: buildUserAgent(version),
-      version,
-      major
+      userAgent: buildUserAgent(wanted),
+      version: wanted + ".0.0.0",
+      major: wanted,
+      source: "estimated"
     };
     try {
       fs.mkdirSync(path.dirname(fingerprintFile()), { recursive: true });
-      fs.writeFileSync(fingerprintFile(), JSON.stringify({ version }), "utf8");
+      fs.writeFileSync(fingerprintFile(), JSON.stringify({ major: wanted }), "utf8");
     } catch (_) { /* read-only fs: fall back to per-process */ }
   }
   return cachedFingerprint;
@@ -125,5 +161,8 @@ function clientHintsFromUA(ua) {
 module.exports = {
   getDefaultUserAgent,
   getFingerprint,
-  clientHintsFromUA
+  clientHintsFromUA,
+  estimateStableMajor,
+  pickChromeMajor,
+  _resetForTests: () => { cachedFingerprint = null; }
 };

package/src/utils/loginParser/parseAndCheckLogin.js

@@ -186,24 +186,13 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
     ) {
       globalAntiSuspension.detectSuspensionSignal("automated behavior checkpoint scraping warning");
       emit("checkpoint", { type: "scraping_warning", res: resData });
-      // Dismiss it the same way a human tapping "Dismiss" on that screen
-      // would — an unacknowledged warning left sitting is worse than one
-      // that's been cleared. Fire-and-forget: this must never block or
-      // fail the actual response being parsed.
-      http
-        .post("https://www.facebook.com/api/graphql/", ctx.jar, {
-          av: ctx.userID,
-          __user: ctx.userID,
-          fb_dtsg: ctx.fb_dtsg || "",
-          fb_api_caller_class: "RelayModern",
-          fb_api_req_friendly_name: "FBScrapingWarningMutation",
-          server_timestamps: "true",
-          doc_id: "6339492849481770",
-          variables: "{}"
-        }, ctx.globalOptions, ctx)
-        .then(() => logger("Dismissed automated-behavior warning", "info"))
-        .catch((e) => logger(`Dismissing automated-behavior warning failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn"));
-      return await maybeAutoLogin(resData, res?.config);
+      logger("Facebook automated-behavior warning detected. Automatic dismissal is disabled; stop the bot and review the account manually.", "error");
+      // This is NOT a logged-out session. The old code ran the "session expired" path here,
+      // which made the bot declare itself logged out and restart (a fresh login) for nothing.
+      const err = new Error("Facebook showed an automated-behavior warning (needs a human to dismiss it)");
+      err.error = "automation_warning";
+      err.res = resData;
+      throw err;
     }
     if (
       resStr.includes("https://www.facebook.com/login.php?") ||