hridoy-ultimate 9.0.3 → 9.0.4

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ---
 
+## [9.0.5] - 2026-10-30
+
+### Fixed (account / browser session safety)
+
+- `api.logout()` used to POST `facebook.com/logout.php`. Facebook then ends that session everywhere, so the same account was also logged out in your normal browser whenever a bot called `logout()` (e.g. on shutdown/restart). `api.logout()` is now a **local stop only**: it stops the MQTT listener and the internal timers and sends nothing to Facebook. It resolves with `{ localOnly: true }`.
+- The real logout is a separate method, `api.logoutFromFacebook()`. If you really want `api.logout()` to log out of Facebook, set `"allowFacebookLogout": true` in `fca-config.json` (default `false`).
+- Cookie mirroring (`facebook.com` <-> `messenger.com`): a *delete this cookie* answer from `messenger.com` for a login cookie (`c_user`, `xs`, `i_user`, `datr`, `sb`, `fr`) is no longer copied onto `facebook.com`. Before, a rejected mirrored value could wipe a perfectly good `facebook.com` login cookie from the bot's jar and make a healthy session look expired.
+
+### Added
+
+- `api.logoutFromFacebook()` (also `client.account.logoutFromFacebook` from `createFcaClient`).
+- `allowFacebookLogout` option in `fca-config.json`.
+- `test/logout.test.js`, `test/cookies.test.js`.
+
+### Not changed
+
+- Facebook can still end a session it considers suspicious (cookies used from a different IP / User-Agent than the browser they came from). Pass the exact User-Agent of that browser with the `userAgent` login option (or `FCA_USER_AGENT`) and run the bot from the same network where you can.
+
+---
+
+## [9.0.4] - 2026-10-27
+
+### Fixed
+
+- `api.getUserID()` and `api.changeGroupImage()` always threw `ReferenceError: parseAndCheckLogin is not defined` (missing import). Both work again.
+- `api.refreshFb_dtsg()` threw `ReferenceError: CustomError is not defined` on a bad argument; it now throws a normal `Error`.
+- `sendMessage`: when the safety guard blocked a send, the log call was `logger(msg, "error")` but the logger is an object, so it threw `TypeError: logger is not a function`. The send callback was never called and the caller hung. Now logs correctly and the callback / promise is rejected with `ACCOUNT_SAFETY_PAUSED`.
+- Safety guard: rate-limit style text ("too many requests", "rate limited", "temporarily blocked", "action blocked", ...) used to switch sending off until restart. Only real account signals (checkpoint, automated-behavior warning, locked/disabled/suspended, identity check) still fail closed. Rate-limit style signals now only count as strikes (2 within 30 min = slow-down cooldown).
+- `package.json` now declares `tough-cookie`, `form-data` and `request`, which the code already `require()`s. A clean `npm install` of this package alone used to crash on first use.
+
+### Added
+
+- `api.getSafetyStatus()` -> `{ blocked, reason, coolingDown, warmup, hourSendCount, hourlyCap, daySendCount, dailyCap }` so a bot can detect `ACCOUNT_SAFETY_PAUSED` instead of retrying.
+- `test/antiSuspension.test.js` (`npm test`, uses `node --test`).
+
+---
+
+## [9.0.3] - 2026-10-25 (entry added retroactively)
+
+### Account safety
+
+- Outbound sending is paused (`ACCOUNT_SAFETY_PAUSED`) after a Facebook checkpoint / automated-behavior signal. Automatic dismissal of the automated-behavior warning stays off.
+
+---
+
 ## [9.0.2] - 2026-10-22
 
 ### Session stability

package/DOCS.md

@@ -1711,24 +1711,32 @@ api.searchForThread("Study Group", (err, threads) => {
 
 ---
 
-### 3.29. logout - Logout
+### 3.29. logout / logoutFromFacebook - Stop the bot / Logout
 
-Logout from Facebook account.
+`api.logout()` **stops the bot locally** (MQTT listener and internal timers). It sends nothing to
+Facebook, so your normal browser session stays logged in. It resolves with `{ localOnly: true }`.
+
+`api.logoutFromFacebook()` is the **real** Facebook logout. Facebook ends that session everywhere,
+so you are also logged out in your browser. Use it only when that is what you want.
+
+If you want `api.logout()` itself to perform the real logout, set `"allowFacebookLogout": true` in
+`fca-config.json` (default `false`).
 
 #### Syntax:
 ```javascript
-api.logout(callback);
+api.logout(callback);              // local stop only (default)
+api.logoutFromFacebook(callback);  // real Facebook logout
 ```
 
 #### Example:
 
 ```javascript
-api.logout((err) => {
+api.logout((err, result) => {
     if (err) {
-        console.error("Logout error:", err);
+        console.error("Stop error:", err);
         return;
     }
-    console.log("Logged out successfully!");
+    console.log("Bot stopped.", result); // { localOnly: true }
 });
 ```
 

package/README.md

@@ -492,7 +492,8 @@ api.sharePost(postID, "Check this!");
 api.getCurrentUserID();
 api.getAppState();
 api.setOptions({ listenTyping: true });
-api.logout();
+api.logout();               // local stop only; your browser stays logged in
+api.logoutFromFacebook();   // real Facebook logout (ends your browser session too)
 api.refreshFb_dtsg();
 api.addExternalModule("myFunc", (defaultFuncs, api, ctx) => {
   return function(text, threadID) {
@@ -534,7 +535,7 @@ api.uploadImageToImgbb(imageUrl);
 
 MIT License
 
-**hridoy-ultimate** v9.0.1 by [HR ID OY](https://github.com/hridoyhossen48360)
+**hridoy-ultimate** v9.0.4 by [HR ID OY](https://github.com/hridoyhossen48360)
 
 > The E2EE native media engine (`src/api/socket/e2ee/native/`) bundles a
 > precompiled binary built from **mautrix-go** / **mautrix-meta**, © Tulir

package/index.d.ts

@@ -168,6 +168,7 @@ declare module '@dongdev/fca-unofficial' {
     getUserID: (name: string, callback?: (err: Error | null, obj: IFCAU_UserIDResponse) => void) => Promise<IFCAU_UserIDResponse>;
     getFriendsList: (callback?: (err: Error | null, friends: IFCAU_Friend[]) => void) => Promise<IFCAU_Friend[]>;
     getCurrentUserID: () => string;
+    getSafetyStatus: () => { blocked: boolean; reason: string | null; coolingDown: boolean; warmup: boolean; hourSendCount: number; hourlyCap: number; daySendCount: number; dailyCap: number };
 
     // Utilities
     getAppState: () => any;
@@ -200,7 +201,10 @@ declare module '@dongdev/fca-unofficial' {
 
     // Configuration & Session
     setOptions: (options: Partial<IFCAU_Options>) => void;
-    logout: (callback?: (err?: Error) => void) => Promise<void>;
+    /** Stops the bot locally (listener + timers). Does NOT log out of Facebook unless `allowFacebookLogout` is true in fca-config.json. */
+    logout: (callback?: (err?: Error | null, result?: { localOnly: true }) => void) => Promise<{ localOnly: true } | void>;
+    /** Real Facebook logout (POST logout.php). Also ends the session in your browser. */
+    logoutFromFacebook: (callback?: (err?: Error) => void) => Promise<void>;
 
     // Message Scheduler
     scheduler: {

package/module/config.js

@@ -5,6 +5,10 @@ const defaultConfig = {
   autoUpdate: false,
   // Opt-in: tell the user when a newer npm version exists (one small request per login).
   checkForUpdates: false,
+  // api.logout() only stops the bot locally. Set true ONLY if you want api.logout() to
+  // really log the account out of Facebook, which also logs you out in your browser.
+  // The real logout is always available as api.logoutFromFacebook().
+  allowFacebookLogout: false,
   // Opt-in: when Facebook shows its "automated behavior" warning, press Dismiss for the
   // user. Off by default: silently clicking through Facebook's own bot warning is itself
   // an automated action on the account. Dismiss it yourself in the browser instead.

package/module/loginHelper.js

@@ -828,6 +828,16 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
       }
       const ctx = { globalOptions, options: globalOptions, reconnectAttempts: 0 };
       ctx.bypassAutomation = async function (resp, j) {
+        // Never submit mutations intended to dismiss/bypass Facebook security warnings.
+        // Preserve the response so upstream login validation can fail closed.
+        const body = typeof resp?.data === "string" ? resp.data : String(resp?.data ?? "");
+        const url = resp?.request?.res?.responseUrl || resp?.config?.url || "";
+        if (/601051028565049|XCheckpointFBScrapingWarningController|automated.?behavior|checkpoint\//i.test(`${url} ${body}`)) {
+          logger("Facebook security/automation checkpoint detected; not bypassing it. Stop the bot and review the account manually.", "error");
+          const err = new Error("Facebook Checkpoint/security warning detected; automatic recovery stopped");
+          err.code = "FACEBOOK_SECURITY_CHECKPOINT";
+          throw err;
+        }
         global.fca = global.fca || {};
         global.fca.BypassAutomationNotification = this.bypassAutomation.bind(this);
         const s = x => (typeof x === "string" ? x : String(x ?? ""));
@@ -878,7 +888,8 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           }
           return first;
         } catch (e) {
-          logger(`Bypass automation error: ${e && e.message ? e.message : String(e)}`, "error");
+          logger(`Facebook security handling stopped: ${e && e.message ? e.message : String(e)}`, "error");
+          if (e && e.code === "FACEBOOK_SECURITY_CHECKPOINT") throw e;
           return resp;
         }
       };
@@ -917,6 +928,15 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
         const ctx = {};
         ctx.options = globalOptions;
         ctx.bypassAutomation = async function (resp, j) {
+          // Never submit mutations intended to dismiss/bypass Facebook security warnings.
+          const body = typeof resp?.data === "string" ? resp.data : String(resp?.data ?? "");
+          const url = resp?.request?.res?.responseUrl || resp?.config?.url || "";
+          if (/601051028565049|XCheckpointFBScrapingWarningController|automated.?behavior|checkpoint\//i.test(`${url} ${body}`)) {
+            logger("Facebook security/automation checkpoint detected; not bypassing it. Stop the bot and review the account manually.", "error");
+            const err = new Error("Facebook Checkpoint/security warning detected; automatic recovery stopped");
+            err.code = "FACEBOOK_SECURITY_CHECKPOINT";
+            throw err;
+          }
           global.fca = global.fca || {};
           global.fca.BypassAutomationNotification = this.bypassAutomation.bind(this);
           const s = x => (typeof x === "string" ? x : String(x ?? ""));
@@ -954,7 +974,8 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
             }
             logger("✅ No checkpoint detected — session is clean.", "info");
             return res;
-          } catch {
+          } catch (e) {
+            if (e && e.code === "FACEBOOK_SECURITY_CHECKPOINT") throw e;
             return res;
           }
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hridoy-ultimate",
-  "version": "9.0.3",
+  "version": "9.0.4",
   "description": "Facebook Chat API by HR ID OY | Stable • Auto Re-login • Full E2EE Support — send messages, media, reactions & more in encrypted chats, hassle-free",
   "main": "index.js",
   "types": "index.d.ts",
@@ -25,7 +25,7 @@
     "src/app/"
   ],
   "scripts": {
-    "test": "mocha",
+    "test": "node --test",
     "lint": "eslint ."
   },
   "repository": {
@@ -76,19 +76,22 @@
     "chalk": "^4.1.2",
     "cheerio": "1.0.0-rc.12",
     "duplexify": "^4.1.3",
+    "form-data": "^4.0.0",
     "gradient-string": "^2.0.2",
     "https-proxy-agent": "^4.0.0",
+    "koffi": "^3.0.2",
+    "mime": "^3.0.0",
     "mqtt": "^5.10.1",
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "protobufjs": "^8.4.0",
+    "request": "^2.88.2",
     "sequelize": "^6.37.6",
+    "@signalapp/libsignal-client": "0.70.0",
     "sqlite3": "^5.1.7",
     "totp-generator": "^1.0.0",
+    "tough-cookie": "^5.0.0",
     "ws": "^8.18.0",
-    "@noble/curves": "^2.2.0",
-    "@noble/hashes": "^2.2.0",
-    "@signalapp/libsignal-client": "0.70.0",
-    "mime": "^3.0.0",
-    "protobufjs": "^8.4.0",
-    "koffi": "^3.0.2",
     "yumi-json-bigint": "^1.0.0"
   },
   "devDependencies": {

package/src/api/action/getSafetyStatus.js

@@ -0,0 +1,27 @@
+"use strict";
+
+const { globalAntiSuspension } = require("../../utils/antiSuspension");
+
+/**
+ * api.getSafetyStatus() -> {
+ *   blocked, reason, coolingDown, warmup, hourSendCount, hourlyCap, daySendCount, dailyCap
+ * }
+ * `blocked` is true after Facebook showed a checkpoint / automated-behavior / disabled
+ * signal: sendMessage then rejects with err.code === "ACCOUNT_SAFETY_PAUSED" until the
+ * process is restarted after you reviewed the account by hand.
+ */
+module.exports = function (defaultFuncs, api, ctx) {
+  return function getSafetyStatus() {
+    const st = globalAntiSuspension.getStats();
+    return {
+      blocked: !!st.safetyBlocked,
+      reason: st.safetyReason || null,
+      coolingDown: !!st.coolingDown,
+      warmup: !!st.warmup,
+      hourSendCount: st.hourSendCount,
+      hourlyCap: st.hourlyCap,
+      daySendCount: st.daySendCount,
+      dailyCap: st.dailyCap
+    };
+  };
+};

package/src/api/action/logout.js

@@ -1,75 +1,86 @@
 "use strict";
 
+/**
+ * logout - stop this bot session WITHOUT logging the account out of Facebook.
+ *
+ * Older FCA builds POSTed facebook.com/logout.php here. That ends the session
+ * server-side, so the same account is logged out in your own browser as well,
+ * which is the opposite of what a bot owner wants when they just stop the bot.
+ *
+ * Default behaviour (since 9.0.5): local stop only
+ *   - stops the MQTT listener,
+ *   - cancels the fb_dtsg refresh timer,
+ *   - stops sessionGuard's timer,
+ *   - never sends anything to Facebook.
+ *
+ * The real Facebook logout is api.logoutFromFacebook(). It can also be made the
+ * behaviour of api.logout() by setting `"allowFacebookLogout": true` in
+ * fca-config.json (explicit opt-in).
+ */
+
 const log = require("../../../func/logAdapter");
-const { parseAndCheckLogin } = require("../../utils/client");
-const { getFrom } = require("../../utils/constants");
-const { saveCookies } = require("../../utils/client");
-module.exports = function(defaultFuncs, api, ctx) {
+const { loadConfig } = require("../../../module/config");
+
+module.exports = function (defaultFuncs, api, ctx) {
+  function stopListener() {
+    return new Promise(resolve => {
+      let done = false;
+      const finish = () => { if (!done) { done = true; resolve(); } };
+      try {
+        if (typeof api.stopListening === "function") {
+          api.stopListening(finish);
+          // never hang a shutdown on a listener that was never started
+          setTimeout(finish, 6000).unref?.();
+        } else {
+          finish();
+        }
+      } catch (_) {
+        finish();
+      }
+    });
+  }
+
+  function stopTimers() {
+    try {
+      if (ctx._dtsgRefreshInterval) {
+        clearInterval(ctx._dtsgRefreshInterval);
+        ctx._dtsgRefreshInterval = null;
+      }
+    } catch (_) { /* ignore */ }
+    try {
+      if (typeof api.stopSessionGuard === "function") api.stopSessionGuard();
+    } catch (_) { /* ignore */ }
+  }
+
   return function logout(callback) {
-    let resolveFunc = function() {};
-    let rejectFunc = function() {};
-    const returnPromise = new Promise(function(resolve, reject) {
+    let resolveFunc = function () {};
+    let rejectFunc = function () {};
+    const returnPromise = new Promise(function (resolve, reject) {
       resolveFunc = resolve;
       rejectFunc = reject;
     });
 
-    if (!callback) {
-      callback = function(err, friendList) {
-        if (err) {
-          return rejectFunc(err);
-        }
-        resolveFunc(friendList);
+    if (typeof callback !== "function") {
+      callback = function (err, result) {
+        if (err) return rejectFunc(err);
+        resolveFunc(result);
       };
     }
 
-    const form = {
-      pmid: "0"
-    };
-
-    defaultFuncs
-      .post(
-        "https://www.facebook.com/bluebar/modern_settings_menu/?help_type=364455653583099&show_contextual_help=1",
-        ctx.jar,
-        form
-      )
-      .then(parseAndCheckLogin(ctx, defaultFuncs))
-      .then(function(resData) {
-        const elem = resData.jsmods.instances[0][2][0].filter(function(v) {
-          return v.value === "logout";
-        })[0];
-
-        const html = resData.jsmods.markup.filter(function(v) {
-          return v[0] === elem.markup.__m;
-        })[0][1].__html;
-
-        const form = {
-          fb_dtsg: getFrom(html, '"fb_dtsg" value="', '"'),
-          ref: getFrom(html, '"ref" value="', '"'),
-          h: getFrom(html, '"h" value="', '"')
-        };
-
-        return defaultFuncs
-          .post("https://www.facebook.com/logout.php", ctx.jar, form)
-          .then(saveCookies(ctx.jar));
-      })
-      .then(function(res) {
-        if (!res.headers) {
-          throw { error: "An error occurred when logging out." };
-        }
+    const { config } = loadConfig();
+    if (config && config.allowFacebookLogout === true && typeof api.logoutFromFacebook === "function") {
+      log.warn("logout", "allowFacebookLogout is true: logging out of Facebook for real (your browser session ends too).");
+      api.logoutFromFacebook(callback);
+      return returnPromise;
+    }
 
-        return defaultFuncs
-          .get(res.headers.location, ctx.jar)
-          .then(saveCookies(ctx.jar));
-      })
-      .then(function() {
-        ctx.loggedIn = false;
-        log.info("logout", "Logged out successfully.");
-        callback();
+    log.info("logout", "Stopping locally. The Facebook session is NOT ended (use api.logoutFromFacebook() for a real logout).");
+    stopListener()
+      .then(() => {
+        stopTimers();
+        callback(null, { localOnly: true });
       })
-      .catch(function(err) {
-        log.error("logout", err);
-        return callback(err);
-      });
+      .catch(err => callback(err));
 
     return returnPromise;
   };

package/src/api/action/logoutFromFacebook.js

@@ -0,0 +1,86 @@
+"use strict";
+
+/**
+ * logoutFromFacebook - REAL Facebook logout.
+ *
+ * This POSTs facebook.com/logout.php with the session cookies. Facebook then
+ * invalidates that session everywhere it is used, so the same account is also
+ * logged out in your normal browser. It is NOT called by api.logout() unless you
+ * opt in with `allowFacebookLogout: true` in fca-config.json. Call it directly
+ * only when you really want to end the Facebook session.
+ */
+
+const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
+const { getFrom } = require("../../utils/constants");
+const { saveCookies } = require("../../utils/client");
+module.exports = function(defaultFuncs, api, ctx) {
+  return function logoutFromFacebook(callback) {
+    let resolveFunc = function() {};
+    let rejectFunc = function() {};
+    const returnPromise = new Promise(function(resolve, reject) {
+      resolveFunc = resolve;
+      rejectFunc = reject;
+    });
+
+    if (!callback) {
+      callback = function(err, friendList) {
+        if (err) {
+          return rejectFunc(err);
+        }
+        resolveFunc(friendList);
+      };
+    }
+
+    const form = {
+      pmid: "0"
+    };
+
+    defaultFuncs
+      .post(
+        "https://www.facebook.com/bluebar/modern_settings_menu/?help_type=364455653583099&show_contextual_help=1",
+        ctx.jar,
+        form
+      )
+      .then(parseAndCheckLogin(ctx, defaultFuncs))
+      .then(function(resData) {
+        const elem = resData.jsmods.instances[0][2][0].filter(function(v) {
+          return v.value === "logout";
+        })[0];
+
+        const html = resData.jsmods.markup.filter(function(v) {
+          return v[0] === elem.markup.__m;
+        })[0][1].__html;
+
+        const form = {
+          fb_dtsg: getFrom(html, '"fb_dtsg" value="', '"'),
+          ref: getFrom(html, '"ref" value="', '"'),
+          h: getFrom(html, '"h" value="', '"')
+        };
+
+        return defaultFuncs
+          .post("https://www.facebook.com/logout.php", ctx.jar, form)
+          .then(saveCookies(ctx.jar));
+      })
+      .then(function(res) {
+        if (!res.headers) {
+          throw { error: "An error occurred when logging out." };
+        }
+
+        return defaultFuncs
+          .get(res.headers.location, ctx.jar)
+          .then(saveCookies(ctx.jar));
+      })
+      .then(function() {
+        ctx.loggedIn = false;
+        log.info("logoutFromFacebook", "Logged out of Facebook (this also ends the browser session).");
+        callback();
+      })
+      .catch(function(err) {
+        log.error("logoutFromFacebook", err);
+        return callback(err);
+      });
+
+    return returnPromise;
+  };
+};

package/src/api/action/refreshFb_dtsg.js

@@ -12,7 +12,7 @@ module.exports = function (defaultFuncs, api, ctx) {
     }
     if (!obj) obj = {};
     if (getType(obj) !== "Object") {
-      throw new CustomError("The first parameter must be an object or a callback function");
+      throw new Error("The first parameter must be an object or a callback function");
     }
     let resolveFunc, rejectFunc;
     const returnPromise = new Promise((resolve, reject) => {

package/src/api/messaging/changeGroupImage.js

@@ -2,6 +2,7 @@
 
 const { generateOfflineThreadingID } = require("../../utils/format");
 const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
 
 module.exports = function (defaultFuncs, api, ctx) {
   function handleUpload(image) {

package/src/api/socket/OldMessage.js

@@ -119,7 +119,10 @@ module.exports = function (defaultFuncs, api, ctx) {
         form.signatureID = utils.getGUID().replace(/-/g, "").slice(0, 8);
         const doSend = () => sendContent(form, threadID, isSingleUser, messageAndOTID, callback);
         if (!ctx.globalOptions || ctx.globalOptions.antiBan !== false) {
-            globalAntiSuspension.prepareBeforeMessage(threadID, form.body || "").then(doSend).catch(doSend);
+            globalAntiSuspension.prepareBeforeMessage(threadID, form.body || "").then(doSend).catch(err => {
+                if (typeof callback === "function") return callback(err);
+                return undefined;
+            });
         } else {
             doSend();
         }

package/src/api/socket/sendMessage.js

@@ -254,7 +254,10 @@ module.exports = function (defaultFuncs, api, ctx) {
             try {
                 await globalAntiSuspension.prepareBeforeMessage(threadID, msg.body || "");
             } catch (err) {
-                logger("AntiSuspension prepareBeforeMessage error: " + (err && err.message ? err.message : err), "warn");
+                logger.error("sendMessage", "Outbound send blocked by safety guard: " + (err && err.message ? err.message : err));
+                if (callback) callback(err);
+                else reject(err);
+                return promise;
             }
         }
 

package/src/api/users/getUserID.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const log = require("../../../func/logAdapter");
+const { parseAndCheckLogin } = require("../../utils/client");
 const { formatID } = require("../../utils/format");
 function formatData(data) {
   return {

package/src/app/createFcaClient.js

@@ -88,6 +88,7 @@ function createFallbackNamespaces(api) {
       getCurrentUserID: bindOptionalMethod(api, "getCurrentUserID"),
       handleFriendRequest: bindOptionalMethod(api, "handleFriendRequest"),
       logout: bindOptionalMethod(api, "logout"),
+      logoutFromFacebook: bindOptionalMethod(api, "logoutFromFacebook"),
       refreshDtsg: bindOptionalMethod(api, "refreshFb_dtsg"),
       changeBlockedStatus: bindOptionalMethod(api, "changeBlockedStatus"),
       setOptions: bindOptionalMethod(api, "setOptions"),

package/src/utils/antiSuspension.js

@@ -6,17 +6,21 @@ const log = {
 };
 
 // Phrases Facebook responses use when it thinks this account is being
-// operated by a bot / script rather than a human. If any of these show up
-// in a response body or an error message, we treat it as a signal that
-// current traffic looks automated and should slow down / back off.
-const SUSPICION_PHRASES = [
+// operated by a bot / script rather than a human, or when it is restricting it.
+//
+// HARD signals mean the account itself is flagged / locked / needs a human
+// (checkpoint, automated-behavior warning, disabled, identity check). On these
+// the guard FAILS CLOSED: outbound sending stops until the process is restarted
+// after a manual review of the account.
+//
+// SOFT signals are rate-limit style responses ("too many requests", "rate
+// limited", "temporarily blocked" ...). They are usually transient, so they only
+// count as strikes and trigger the slow-down cooldown. Treating them as hard
+// signals made one passing 429-style error silence the bot for good.
+const HARD_SUSPICION_PHRASES = [
     "checkpoint",
     "automated behavior",
     "automated_behavior",
-    "unusual activity",
-    "unusual_activity",
-    "suspicious activity",
-    "action_required",
     "account_locked",
     "account locked",
     "account has been disabled",
@@ -26,6 +30,17 @@ const SUSPICION_PHRASES = [
     "bot detected",
     "bot_detected",
     "not a human",
+    "verify your account",
+    "confirm your identity",
+    "confirm it's you",
+    "security check required"
+];
+
+const SOFT_SUSPICION_PHRASES = [
+    "unusual activity",
+    "unusual_activity",
+    "suspicious activity",
+    "action_required",
     "spam detected",
     "spam_detected",
     "looks like spam",
@@ -35,15 +50,14 @@ const SUSPICION_PHRASES = [
     "too_many_requests",
     "temporarily blocked",
     "feature temporarily unavailable",
-    "verify your account",
-    "confirm your identity",
-    "confirm it's you",
-    "security check required",
     "policy violation",
     "action blocked",
     "you're blocked from"
 ];
 
+// Kept for backwards compatibility with anything that imported the old list.
+const SUSPICION_PHRASES = HARD_SUSPICION_PHRASES.concat(SOFT_SUSPICION_PHRASES);
+
 /**
  * Tracks send volume and paces outbound traffic so it doesn't look like a
  * script firing messages as fast as the network allows. Three layers:
@@ -72,13 +86,18 @@ class SendPacer {
         this.dayWindowStart = Date.now();
         this.daySendCount = 0;
 
+        this.accountSafetyBlocked = false;
+        this.accountSafetyReason = null;
+
         this.cooldown = {
             active: false,
             since: null,
             durationMs: 45 * 60 * 1000,
             strikes: 0,
-            strikesToActivate: 2
+            strikesToActivate: 2,
+            strikeWindowMs: 30 * 60 * 1000
         };
+        this.softStrikeTimes = [];
 
         this._gcTimer = setInterval(() => this._rollWindows(), 60 * 1000);
         if (this._gcTimer.unref) this._gcTimer.unref();
@@ -108,12 +127,30 @@ class SendPacer {
         return this._inWarmup() ? this.warmupHourlyCap : this.normalHourlyCap;
     }
 
-    /** Records that a suspicious signal was seen; may activate the cooldown. */
-    noteSuspicionSignal(source) {
-        this.cooldown.strikes++;
+    /**
+     * Records that a suspicious signal was seen.
+     * hard=true  (default): fail closed - stop sending until a human reviews the account.
+     * hard=false: count a strike; two strikes inside strikeWindowMs start the cooldown.
+     */
+    noteSuspicionSignal(source, hard) {
+        const isHard = hard !== false;
+        if (isHard) {
+            // Fail closed: once Facebook signals checkpoint/automation/disabled status,
+            // do not continue sending or retrying in this process. Human review is required.
+            if (!this.accountSafetyBlocked) {
+                log.warn("AntiSuspension", `Outbound sending paused: ${source || "Facebook security signal"}. Review the account manually, then restart the bot.`);
+            }
+            this.accountSafetyBlocked = true;
+            this.accountSafetyReason = String(source || "Facebook security signal");
+            return;
+        }
+        const now = Date.now();
+        this.softStrikeTimes = this.softStrikeTimes.filter(t => now - t < this.cooldown.strikeWindowMs);
+        this.softStrikeTimes.push(now);
+        this.cooldown.strikes = this.softStrikeTimes.length;
         if (!this.cooldown.active && this.cooldown.strikes >= this.cooldown.strikesToActivate) {
             this.cooldown.active = true;
-            this.cooldown.since = Date.now();
+            this.cooldown.since = now;
             log.warn("AntiSuspension", `Cooldown activated after repeated suspicion signals (last: ${source || "unknown"}). Backing off for ${(this.cooldown.durationMs / 60000).toFixed(0)} min.`);
         }
     }
@@ -122,9 +159,17 @@ class SendPacer {
     scanForSuspicion(text) {
         if (!text || typeof text !== "string") return false;
         const lower = text.toLowerCase();
-        const hit = SUSPICION_PHRASES.find(p => lower.includes(p));
-        if (hit) this.noteSuspicionSignal(hit);
-        return !!hit;
+        const hardHit = HARD_SUSPICION_PHRASES.find(p => lower.includes(p));
+        if (hardHit) {
+            this.noteSuspicionSignal(hardHit, true);
+            return true;
+        }
+        const softHit = SOFT_SUSPICION_PHRASES.find(p => lower.includes(p));
+        if (softHit) {
+            this.noteSuspicionSignal(softHit, false);
+            return true;
+        }
+        return false;
     }
 
     /** Inspects a thrown error's message for suspicion phrases. */
@@ -138,6 +183,7 @@ class SendPacer {
         if (Date.now() - this.cooldown.since >= this.cooldown.durationMs) {
             this.cooldown.active = false;
             this.cooldown.strikes = 0;
+            this.softStrikeTimes = [];
             this.cooldown.since = null;
             return false;
         }
@@ -151,6 +197,11 @@ class SendPacer {
      * rather than blocking a real message.
      */
     async waitForTurn(threadID) {
+        if (this.accountSafetyBlocked) {
+            const err = new Error(`Outbound messaging paused after Facebook security signal: ${this.accountSafetyReason}. Review the account manually before restarting.`);
+            err.code = "ACCOUNT_SAFETY_PAUSED";
+            throw err;
+        }
         try {
             this._rollWindows();
 
@@ -185,8 +236,10 @@ class SendPacer {
             this.daySendCount++;
             const threadCount = (this.threadSendCounts.get(key) || 0) + 1;
             this.threadSendCounts.set(key, threadCount);
-        } catch {
-            // Pacing must never be the reason a real message fails to send.
+        } catch (err) {
+            // Safety-related errors must not be swallowed.
+            if (err && err.code === "ACCOUNT_SAFETY_PAUSED") throw err;
+            log.warn("AntiSuspension", `Pacing check failed: ${err && err.message ? err.message : String(err)}`);
         }
     }
 
@@ -201,7 +254,9 @@ class SendPacer {
             hourlyCap: this._hourlyCap(),
             daySendCount: this.daySendCount,
             dailyCap: this.dailyCap,
-            coolingDown: this.isCoolingDown()
+            coolingDown: this.isCoolingDown(),
+            safetyBlocked: this.accountSafetyBlocked,
+            safetyReason: this.accountSafetyReason
         };
     }
 }
@@ -210,10 +265,15 @@ const pacer = new SendPacer();
 
 module.exports = {
     SendPacer,
+    HARD_SUSPICION_PHRASES,
+    SOFT_SUSPICION_PHRASES,
+    SUSPICION_PHRASES,
     globalAntiSuspension: {
         prepareBeforeMessage: (threadID) => pacer.waitForTurn(threadID),
         detectSuspensionSignal: (text) => pacer.scanForSuspicion(text),
         checkAccountHealth: (err) => pacer.noteSendError(err),
-        getStats: () => pacer.stats()
+        getStats: () => pacer.stats(),
+        isAccountSafetyBlocked: () => pacer.accountSafetyBlocked,
+        getAccountSafetyReason: () => pacer.accountSafetyReason
     }
 };

package/src/utils/cookies.js

@@ -2,6 +2,28 @@
 
 // Cookie helpers extracted from client.js
 
+const AUTH_COOKIES = new Set(["c_user", "xs", "i_user", "datr", "sb", "fr"]);
+
+// True for a Set-Cookie header that deletes one of the login cookies
+// (empty / "deleted" value, Max-Age<=0, or an expiry in the past).
+function isAuthCookieDeletion(setCookieHeader) {
+  const first = String(setCookieHeader || "").split(";")[0];
+  const eq = first.indexOf("=");
+  if (eq <= 0) return false;
+  const name = first.slice(0, eq).trim();
+  if (!AUTH_COOKIES.has(name)) return false;
+  const value = first.slice(eq + 1).trim().replace(/^"|"$/g, "");
+  if (value === "" || /^deleted$/i.test(value)) return true;
+  const maxAge = /;\s*max-age\s*=\s*(-?\d+)/i.exec(setCookieHeader);
+  if (maxAge && parseInt(maxAge[1], 10) <= 0) return true;
+  const expires = /;\s*expires\s*=\s*([^;]+)/i.exec(setCookieHeader);
+  if (expires) {
+    const t = Date.parse(expires[1]);
+    if (!Number.isNaN(t) && t <= Date.now()) return true;
+  }
+  return false;
+}
+
 function saveCookies(jar) {
   return res => {
     try {
@@ -29,6 +51,11 @@ function saveCookies(jar) {
               const mirrored = c.replace(/domain=\.?facebook\.com/i, "domain=.messenger.com");
               jar.setCookieSync(mirrored, "https://www.messenger.com");
             } else if (/domain=\.?messenger\.com/i.test(c)) {
+              // A messenger.com "delete this cookie" answer must never wipe the matching
+              // facebook.com login cookie in our jar: that would silently kill a perfectly
+              // good facebook.com session (the cookie values are mirrored, so messenger.com
+              // may well reject them while facebook.com is fine).
+              if (isAuthCookieDeletion(c)) continue;
               const mirrored = c.replace(/domain=\.?messenger\.com/i, "domain=.facebook.com");
               jar.setCookieSync(mirrored, "https://www.facebook.com");
             }
@@ -80,6 +107,7 @@ function getAppState(jar) {
 
 module.exports = {
   saveCookies,
-  getAppState
+  getAppState,
+  isAuthCookieDeletion
 };
 

package/src/utils/loginParser/parseAndCheckLogin.js

@@ -186,25 +186,7 @@ function parseAndCheckLogin(ctx, http, retryCount = 0) {
     ) {
       globalAntiSuspension.detectSuspensionSignal("automated behavior checkpoint scraping warning");
       emit("checkpoint", { type: "scraping_warning", res: resData });
-      const fcaCfg = (global.fca && global.fca.config) || {};
-      if (fcaCfg.autoDismissAutomationWarning === true) {
-        // Opt-in only. Fire-and-forget: must never block or fail the response being parsed.
-        http
-          .post("https://www.facebook.com/api/graphql/", ctx.jar, {
-            av: ctx.userID,
-            __user: ctx.userID,
-            fb_dtsg: ctx.fb_dtsg || "",
-            fb_api_caller_class: "RelayModern",
-            fb_api_req_friendly_name: "FBScrapingWarningMutation",
-            server_timestamps: "true",
-            doc_id: "6339492849481770",
-            variables: "{}"
-          }, ctx.globalOptions, ctx)
-          .then(() => logger("Dismissed automated-behavior warning (autoDismissAutomationWarning=true)", "info"))
-          .catch((e) => logger(`Dismissing automated-behavior warning failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn"));
-      } else {
-        logger("Facebook showed its automated-behavior warning. Open facebook.com in your browser, dismiss it yourself, then restart the bot.", "warn");
-      }
+      logger("Facebook automated-behavior warning detected. Automatic dismissal is disabled; stop the bot and review the account manually.", "error");
       // This is NOT a logged-out session. The old code ran the "session expired" path here,
       // which made the bot declare itself logged out and restart (a fresh login) for nothing.
       const err = new Error("Facebook showed an automated-behavior warning (needs a human to dismiss it)");