nexus-fca 3.1.0 → 3.1.1

package/index.js

@@ -76,7 +76,7 @@ const globalSafety = new FacebookSafety({
   enableLoginValidation: true,
   enableSafeDelays: true, // Human-like delays to reduce detection
   bypassRegionLock: true,
-  ultraLowBanMode: ultraSafeMode // Ultra-low ban rate mode
+  ultraLowBanMode: true // FORCED ULTRA-SAFE MODE for maximum protection
 });
 
 let checkVerified = null;
@@ -304,6 +304,36 @@ function buildAPI(globalOptions, html, jar) {
     }
   };
   const defaultFuncs = utils.makeDefaults(html, i_userID || userID, ctx);
+  
+  // ULTRA-SAFE WRAPPER: Throttle ALL API calls, not just sendMessage
+  const originalPost = defaultFuncs.post;
+  const originalPostFormData = defaultFuncs.postFormData;
+  const originalGet = defaultFuncs.get;
+
+  defaultFuncs.post = async function(...args) {
+    if (globalSafety && typeof globalSafety.applyAdaptiveSendDelay === 'function') {
+        await globalSafety.applyAdaptiveSendDelay();
+    }
+    return originalPost.apply(this, args);
+  };
+
+  defaultFuncs.postFormData = async function(...args) {
+    if (globalSafety && typeof globalSafety.applyAdaptiveSendDelay === 'function') {
+        await globalSafety.applyAdaptiveSendDelay();
+    }
+    return originalPostFormData.apply(this, args);
+  };
+  
+  // We don't throttle GET as much, but maybe a little? 
+  // Actually, let's throttle everything for "Most Safe" mode.
+  defaultFuncs.get = async function(...args) {
+     if (globalSafety && typeof globalSafety.applyAdaptiveSendDelay === 'function') {
+        // Use a lighter delay for GETs if needed, but for now use the same safe pipeline
+        await globalSafety.applyAdaptiveSendDelay();
+    }
+    return originalGet.apply(this, args);
+  };
+
   require("fs")
     .readdirSync(__dirname + "/src/")
     .filter((v) => v.endsWith(".js"))

package/lib/safety/FacebookSafety.js

@@ -6,6 +6,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const StealthMode = require('./StealthMode');
 
 class FacebookSafety {
     constructor(options = {}) {
@@ -23,15 +24,29 @@ class FacebookSafety {
             ...options
         };
 
-        // Safe user agents that reduce detection risk
+        // Initialize Stealth Mode
+        this.stealthMode = new StealthMode({
+            maxRequestsPerMinute: this.options.ultraLowBanMode ? 3 : 10,
+            enableRandomPauses: true,
+            pauseProbability: this.options.ultraLowBanMode ? 0.08 : 0.02,
+            minPauseMinutes: 3,
+            maxPauseMinutes: 10
+        });
+
+        // ULTRA-SAFE user agents - Most common real browsers (Nov 2025)
+        // These are the MOST COMMON UAs to blend in with real users
         this.safeUserAgents = [
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36',
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0',
-            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36'
+            // Chrome Windows (most common)
+            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
+            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36',
+            // Edge Windows (very common)
+            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0',
+            // Chrome Mac (common)
+            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
+            // Safari Mac (very common for Mac users)
+            'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15'
         ];
-        // NEW: fixed user agent anchor (set once per session)
+        // NEW: fixed user agent anchor (set once per session) - NEVER CHANGE during session!
         this._fixedUA = null;
 
         this.safeDomains = [
@@ -43,11 +58,13 @@ class FacebookSafety {
         this.regions = ['ASH', 'ATL', 'DFW', 'ORD', 'PHX', 'SJC', 'IAD'];
         this.currentRegion = this.regions[Math.floor(Math.random() * this.regions.length)];
 
+        // ULTRA-SAFE human delay patterns - Much slower to avoid detection
         this.humanDelayPatterns = {
-            typing: { min: 800, max: 2000 },
-            reading: { min: 1000, max: 3000 },
-            thinking: { min: 2000, max: 5000 },
-            browsing: { min: 500, max: 1500 }
+            typing: { min: 1500, max: 3500 },        // Slower typing (1.5-3.5s)
+            reading: { min: 3000, max: 8000 },       // Longer reading time (3-8s)
+            thinking: { min: 5000, max: 15000 },     // Much longer thinking (5-15s)
+            browsing: { min: 2000, max: 5000 },      // Slower browsing (2-5s)
+            messageDelay: { min: 8000, max: 20000 }  // 8-20s between messages!
         };
 
         this.sessionMetrics = {
@@ -150,17 +167,25 @@ class FacebookSafety {
     }
 
     /**
-     * Generate human-like delay patterns
+     * Generate human-like delay patterns - ULTRA SAFE VERSION
      */
     getHumanDelay(action = 'browsing') {
-        if (!this.options.enableSafeDelays) return 0;
+        if (!this.options.enableSafeDelays) return 5000; // Minimum 5s even if disabled!
         
         const pattern = this.humanDelayPatterns[action] || this.humanDelayPatterns.browsing;
         const baseDelay = Math.random() * (pattern.max - pattern.min) + pattern.min;
         
-        // Add randomness to make it more human-like
-        const variation = baseDelay * 0.2 * (Math.random() - 0.5);
-        return Math.max(100, Math.floor(baseDelay + variation));
+        // Add MORE randomness to make it VERY human-like
+        const variation = baseDelay * 0.4 * (Math.random() - 0.5); // ±40% variation
+        const jitter = Math.random() * 2000; // Add 0-2s random jitter
+        
+        // Risk-based multiplier - slow down even more if high risk
+        const riskMultiplier = this.sessionMetrics.riskLevel === 'high' ? 2.5 : 
+                              this.sessionMetrics.riskLevel === 'medium' ? 1.8 : 1.3;
+        
+        const finalDelay = (baseDelay + variation + jitter) * riskMultiplier;
+        
+        return Math.max(3000, Math.floor(finalDelay)); // Minimum 3 seconds!
     }
 
     /**
@@ -267,7 +292,7 @@ class FacebookSafety {
     }
 
     /**
-     * Setup safe token refresh intervals
+     * Setup safe token refresh intervals - ULTRA SAFE VERSION
      */
     setupSafeRefresh() {
         // Replace previous interval/timer to avoid stacking
@@ -279,20 +304,25 @@ class FacebookSafety {
             clearTimeout(this._safeRefreshTimer);
             this._safeRefreshTimer = null;
         }
-        // USER REQUEST: widen refresh window to random 3–5 hours (stealth longevity)
-        // Previous risk-tier windows (25–60m) replaced per instruction.
+        // MAXIMUM STEALTH: Very long refresh intervals (4-8 hours!)
         const schedule = () => {
             if (this._destroyed) return;
-            // Base window 3h–5h. If risk escalates HIGH, clamp to 1h–1.5h for safety.
             let minMs, maxMs;
             if (this.sessionMetrics.riskLevel === 'high') {
-                minMs = 60 * 60 * 1000;          // 1h
-                maxMs = 90 * 60 * 1000;          // 1.5h
-            } else {
+                // High risk: 2-3 hours (still slow to avoid detection)
+                minMs = 2 * 60 * 60 * 1000;      // 2h
+                maxMs = 3 * 60 * 60 * 1000;      // 3h
+            } else if (this.sessionMetrics.riskLevel === 'medium') {
+                // Medium risk: 3-5 hours
                 minMs = 3 * 60 * 60 * 1000;      // 3h
                 maxMs = 5 * 60 * 60 * 1000;      // 5h
+            } else {
+                // Low risk: 4-8 hours (maximum stealth!)
+                minMs = 4 * 60 * 60 * 1000;      // 4h
+                maxMs = 8 * 60 * 60 * 1000;      // 8h
             }
             const interval = minMs + Math.random() * (maxMs - minMs);
+            console.log(`🔒 Next token refresh in ${Math.floor(interval / (60 * 60 * 1000))}h ${Math.floor((interval % (60 * 60 * 1000)) / (60 * 1000))}m (ultra-safe mode)`);
             const t = setTimeout(async () => {
                 await this.refreshSafeSession();
                 schedule();
@@ -438,22 +468,22 @@ class FacebookSafety {
         this._periodicRecycleTimer = t;
     }
 
-    // Heartbeat ping & watchdog
+    // Heartbeat ping & watchdog - ULTRA SAFE VERSION
     _startHeartbeat() {
         if (this._heartbeatTimer) clearInterval(this._heartbeatTimer);
         if (this._watchdogTimer) clearInterval(this._watchdogTimer);
         if (this._destroyed) return;
-        // Stealth profile heartbeat: 80–100s random
+        // MAXIMUM STEALTH: Much slower heartbeat (2-3 minutes!)
         this._heartbeatTimer = setInterval(() => {
             if (this._destroyed) return;
             try {
                 if (this.ctx && this.ctx.mqttClient && this.ctx.mqttClient.connected) {
+                    // Only ping, don't publish foreground state (less detectable)
                     if (this.ctx.mqttClient.ping) this.ctx.mqttClient.ping();
-                    try { this.ctx.mqttClient.publish('/foreground_state', JSON.stringify({ foreground: true })); } catch(_) {}
                     this.safetyEmit('heartbeat', { ts: Date.now() });
                 }
             } catch(_) {}
-        }, (80 + Math.random()*20) * 1000);
+        }, (120 + Math.random()*60) * 1000); // 2-3 minutes!
         this._watchdogTimer = setInterval(() => {
             if (this._destroyed) return;
             const idle = Date.now() - this._lastEventTs;
@@ -777,7 +807,13 @@ class FacebookSafety {
         return Math.floor(min + Math.random()*(max-min));
     }
 
-    applyAdaptiveSendDelay(){
+    async applyAdaptiveSendDelay(){
+        // First, check Stealth Mode limits (rate limiting & pauses)
+        if (this.stealthMode) {
+            await this.stealthMode.waitIfNeeded();
+        }
+
+        // Then apply adaptive delay based on risk
         const d = this.computeAdaptiveSendDelay();
         if (!d) return Promise.resolve();
         return new Promise(r=> setTimeout(r, d));

package/lib/safety/StealthMode.js

@@ -0,0 +1,122 @@
+/**
+ * Nexus-FCA Stealth Mode - Human Behavior Simulation
+ * Implements strict rate limiting and human-like pauses to prevent bans.
+ */
+
+class StealthMode {
+    constructor(options = {}) {
+        this.options = {
+            maxRequestsPerMinute: 3, // Very low limit for safety
+            enableRandomPauses: true,
+            pauseProbability: 0.05, // 5% chance to take a break after each action
+            minPauseMinutes: 5,
+            maxPauseMinutes: 15,
+            dailyRequestLimit: 500, // Hard limit per day
+            ...options
+        };
+
+        this.requestHistory = [];
+        this.dailyCount = 0;
+        this.lastReset = Date.now();
+        this.inPause = false;
+        this.pauseUntil = 0;
+    }
+
+    /**
+     * Check if we can proceed with a request
+     * Returns { allowed: boolean, waitMs: number, reason: string }
+     */
+    canProceed() {
+        const now = Date.now();
+
+        // Check if we are in a forced pause
+        if (this.inPause) {
+            if (now < this.pauseUntil) {
+                return { 
+                    allowed: false, 
+                    waitMs: this.pauseUntil - now, 
+                    reason: 'Human pause active' 
+                };
+            }
+            this.inPause = false;
+        }
+
+        // Reset daily limit if it's a new day
+        if (now - this.lastReset > 24 * 60 * 60 * 1000) {
+            this.dailyCount = 0;
+            this.lastReset = now;
+        }
+
+        // Check daily limit
+        if (this.dailyCount >= this.options.dailyRequestLimit) {
+            return { 
+                allowed: false, 
+                waitMs: 60 * 60 * 1000, // Wait an hour before checking again (or stop)
+                reason: 'Daily limit reached' 
+            };
+        }
+
+        // Clean up old history (older than 1 minute)
+        this.requestHistory = this.requestHistory.filter(ts => now - ts < 60000);
+
+        // Check rate limit
+        if (this.requestHistory.length >= this.options.maxRequestsPerMinute) {
+            // Calculate when the oldest request expires
+            const oldest = this.requestHistory[0];
+            const waitMs = 60000 - (now - oldest) + 1000; // +1s buffer
+            return { 
+                allowed: false, 
+                waitMs: waitMs, 
+                reason: 'Rate limit exceeded' 
+            };
+        }
+
+        return { allowed: true, waitMs: 0 };
+    }
+
+    /**
+     * Record a request and potentially trigger a random pause
+     */
+    recordAction() {
+        const now = Date.now();
+        this.requestHistory.push(now);
+        this.dailyCount++;
+
+        // Random pause trigger
+        if (this.options.enableRandomPauses && Math.random() < this.options.pauseProbability) {
+            this.triggerRandomPause();
+        }
+    }
+
+    /**
+     * Trigger a random "coffee break" pause
+     */
+    triggerRandomPause() {
+        const minMs = this.options.minPauseMinutes * 60 * 1000;
+        const maxMs = this.options.maxPauseMinutes * 60 * 1000;
+        const duration = Math.floor(Math.random() * (maxMs - minMs)) + minMs;
+        
+        this.inPause = true;
+        this.pauseUntil = Date.now() + duration;
+        
+        console.log(`☕ Stealth Mode: Taking a human break for ${Math.floor(duration / 60000)} minutes...`);
+    }
+
+    /**
+     * Wait until it's safe to proceed
+     */
+    async waitIfNeeded() {
+        while (true) {
+            const status = this.canProceed();
+            if (status.allowed) {
+                this.recordAction();
+                return;
+            }
+            
+            console.log(`🛡️ Stealth Mode: Waiting ${Math.ceil(status.waitMs / 1000)}s (${status.reason})`);
+            await new Promise(resolve => setTimeout(resolve, status.waitMs));
+        }
+    }
+}
+
+module.exports = StealthMode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-fca",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Nexus-FCA 3.1 – THE BEST, SAFEST, MOST STABLE Facebook Messenger API! Email/password + appState login, proxy support (HTTP/HTTPS/SOCKS5), random user agent, proactive cookie refresh, MQTT stability, session protection, and TypeScript support.",
   "main": "index.js",
   "repository": {