toru-fca 1.0.7 → 1.1.0

package/CHANGELOG.md

@@ -1,54 +1,114 @@
-# CHANGELOG — toru-fca
-
-## v1.0.6 (2026-09-03) — Ultimate Fixed, Advanced & Updated Release
-
-### Bug Fixes
-- **sendTypingIndicatorV2.js** — `mqttClient` undefined bug patched (ctx.mqttClient এখন সঠিকভাবে reference হয়)
-- **logout.js** — Anti-logout message updated, v1.0.6 version reflect করে
-- **listenMqtt.js** — Banner updated: alpha-fca → toru-fca
-
-### Improvements (v1.0.6)
-- **Anti-Logout** — fb_dtsg refresh interval 30min → 20min (আরো দ্রুত session alive রাখে)
-- **Session Guard** — Auto-save interval 5min → 3min, debounce 30s → 20s (দ্রুত appstate save)
-- **Facebook Protection** (NEW) — Anti-restriction, anti-ban, human-like delay system
-  - `humanLikeDelay: true` — random 50-200ms micro-delay, bot traffic pattern unpredictable
-  - `blockAutomationDetection: true` — online=false, updatePresence=false force করে
-- **config.json** — `facebookProtection`, `replyToInbox` option added
-- **checkUpdate.js** — Version 1.0.6 এ updated
-- **package.json** — Version 1.0.6, description updated
-- **examples/basic-bot.js** — Bengali comments, stopAntiLogout() on shutdown added
-
-### What v1.0.6 Guarantees
-- ✅ Cookie দিয়ে login করলে browser থেকে logout হবে না
-- ✅ Bot run করলে Facebook account এ automation restriction আসবে না
-- ✅ Bot ID এর inbox এ reply যাবে (group এ নয়)
-- ✅ GoatBot এবং Facebook উভয়ের জন্য comfortable
-- ✅ কোনো system error crash করবে না
-- ✅ MQTT smooth এবং stable থাকবে
-
-## v1.0.2 (2026-09-02) — Previous Stable Release
-
-### Core Fixes
-- Anti-Logout: `api.logout()` blocked — Facebook cookie session never destroyed
-- fb_dtsg Auto-Refresh: every 30 min
-- Session Guard: backup, corruption check, debounce auto-save
-- Inbox Smooth: MQTT stable, no duplicate listeners, exponential backoff (3s–60s)
-- GoatBot Compatible: `selfListen`, `listenEvents`, `autoReconnect` defaults correct
-- Error-Free: global unhandledRejection + uncaughtException handled
-- E2EE Bridge: Labyrinth, auto-reconnect, DM + group support
-
-### APIs Added in v1.0.2
-- `api.forceLogout()`, `api.stopAntiLogout()`, `api.saveSession(path)`
-- `api.sessionGuard(path, opts)`, `api.getHealth()`, `api.sendTypingIndicatorV2()`
-
-### Merged From
-- toru-fca (base): MQTT spinner, E2EE, smooth mode
-- alpha-fca: refreshFb_dtsg, pinMessage, unsendMessage, setMessageReaction
-- mahmud-fca: sendTypingIndicatorV2, getMessage improvements
-- hridoy-fca: sessionGuard (backup + corruption guard)
-
-## v1.0.1
-- Initial merged release
-
-## v1.0.0
-- Base alpha-fca release
+# toru-fca Changelog
+
+## v1.1.0 — Audit, Repair & Stability Upgrade
+
+> Full professional audit and repair of all critical, high, and medium issues.
+
+### 🔴 Critical Fixes
+
+#### `sendMessage.js` — Wrong global config key
+- **Bug**: `global._alphaFcaConfig` was read to check `inbox.enabled`. This global is never set — toru-fca uses `global._toruFcaConfig`. The inbox-disabled guard silently never fired.
+- **Fix**: Changed to `global._toruFcaConfig`. Inbox guard now works correctly.
+
+#### `index.js` — Triple-wrapping of `api.sendMessage`
+- **Bug**: `patchSmooth()` and `initFacebookProtection()` each independently re-wrapped `api.sendMessage`, creating three nested layers. This caused:
+  - Inconsistent Promise/callback contract on synchronous throws from inner layers
+  - `api.send` alias reassigned twice, creating divergence risk
+  - Undocumented stacked delays (300ms + 50–200ms + typing duration)
+- **Fix**: Replaced both separate wrappers with a single unified `patchSendWrapper()` that applies human jitter → smooth delay → original `sendMessage` in one clean Promise chain. `api.send` is now assigned exactly once.
+
+#### `index.js` / `config.json` — E2EE enabled by default without native binary
+- **Bug**: `config.json` had `"e2ee": { "enable": true }` and the fallback defaults also had `enable: true`. The `lib/index.mjs` ESM bundle throws `Error: Native library not found at .../build/messagix.so` on load because the `build/` directory is not included in the package. This caused E2EE init to fail on every startup with a caught but opaque error.
+- **Fix**: `e2ee.enable` defaults to `false` in both `config.json` and the fallback defaults. E2EE must be explicitly enabled by users who have compiled the native binary.
+
+#### `listenMqtt.js` — Module-scope `getSeqID` mutation (cross-instance contamination)
+- **Bug**: `var getSeqID = function(){};` was declared at module scope and then reassigned inside the exported factory. Multiple login instances in the same process would overwrite each other's `getSeqID` closure, causing the wrong instance's callback to receive another bot's events.
+- **Fix**: `getSeqID` and `form` are now declared inside the exported factory function (one per instance). Each login gets its own isolated closure.
+
+#### Version inconsistency across all files
+- **Bug**: `package.json` said `1.0.9`, `config.json` said `1.0.8`, `index.js`/`checkUpdate.js`/MQTT banner all said `1.0.6`. Target is `1.1.0`.
+- **Fix**: All version strings unified to `1.1.0` across `package.json`, `config.json`, `checkUpdate.js`, `index.js` header, and the MQTT connect banner.
+
+---
+
+### 🔴 High-Priority Fixes
+
+#### `sendTypingIndicator.js` — Local counter always sends `request_id: 1`
+- **Bug**: `let count_req = 0` was declared inside the async function, so `++count_req` always yielded `1`. Every typing indicator request sent the same MQTT request ID, potentially confusing the ack system.
+- **Fix**: Now uses `ctx.wsReqNumber` (the shared per-session counter, same as `sendTypingIndicatorV2`) incremented before each publish. Request IDs are now unique across all `ls_req` calls.
+
+#### `sendTypingIndicatorV2.js` — Redundant duplicate implementation
+- **Bug**: Two separate typing indicator implementations with inconsistent counter strategies.
+- **Fix**: `sendTypingIndicatorV2` now delegates to `sendTypingIndicator`. Both `api.sendTypingIndicator` and `api.sendTypingIndicatorV2` use the same fixed implementation.
+
+#### `stopListenMqtt.js` — Dead-connection watchdog not cleared on stop
+- **Bug**: `stopListenMqtt()` ended the MQTT client but did not clear `_deadTimer` (the 8-minute watchdog). The watchdog was a local variable inside `listenMqtt()` — `stopListenMqtt.js` had no reference to it. After calling `stopListenMqtt()`, the watchdog could still fire and attempt a reconnect on a stopped bot.
+- **Fix**: Watchdog timer now stored on `ctx._deadTimer` (accessible to all modules with a `ctx` reference). Both `stopListenMqtt()` and `stopListening()` now clear `ctx._deadTimer` before teardown.
+
+#### `listenMqtt.js` — `stopListening` referenced undefined `_deadTimer`
+- **Bug**: `stopListening` in `MessageEmitter` tried `if (typeof _deadTimer !== 'undefined' && _deadTimer)` — this was correct when the watchdog was local, but needed updating to match the new `ctx._deadTimer` approach.
+- **Fix**: Updated to `if (ctx._deadTimer)` consistently.
+
+#### `utils.js` — `parseAndCheckLogin` retry sends wrong body on 5xx
+- **Bug**: Line 2611: `defaultFuncs.post(url, ctx.jar, data.request.formData)` — for standard POST requests `data.request.formData` is `undefined` (that property is only set for multipart uploads). All non-upload 5xx retries silently sent an empty body.
+- **Fix**: Retry now uses `data.request.form || data.request.formData || {}` — correctly using `form` (the standard POST body property set by the `request` library) and falling back to `formData` for multipart, then to empty object as a last resort.
+
+#### `index.js` — `forceLogout` used fb_dtsg as the `h` URL parameter
+- **Bug**: `logout.php?h=<fb_dtsg>` — the `h` parameter on Facebook's logout endpoint is a separate logout nonce, not the CSRF token. Passing `fb_dtsg` there caused logout requests to silently fail.
+- **Fix**: POSTs to `logout.php` (no `h` param) with `fb_dtsg` in the body only. Also adds graceful handling: marks `ctx.loggedIn = false` even when the HTTP request fails, so the bot's internal state stays consistent.
+
+---
+
+### 🟡 Medium Fixes
+
+#### `refreshFb_dtsg.js` — Broad regex pattern ordered too early
+- **Bug**: Pattern `/"token":"([^"]+)"/` (matches any JSON `token` key) was #3 in the list, potentially matching unrelated tokens before the specific DTSG patterns.
+- **Fix**: Moved broad pattern to last position. Added minimum length check (`m[1].length > 4`) to filter out short false-match values.
+
+#### `index.js` — `sessionGuard` jar monkey-patch fragile against internal API changes
+- **Bug**: `jar._jar` is a private internal property of `tough-cookie`. If absent (different tough-cookie version, custom jar, or API change), the patch silently did nothing with no warning.
+- **Fix**: Wrapped in try/catch with a `log.verbose` warning when `jar._jar` is not available. The interval-based save still runs — only the debounce-on-cookie-change is affected.
+
+#### `examples/basic-bot.js` — Shutdown called `api.stopListenMqtt()` without clearing watchdog
+- **Bug**: `api.stopListenMqtt()` was called in the shutdown handler. While this now clears `ctx._deadTimer` (fixed above), `api.stopListening()` is the preferred method when `listenMqtt()` was used directly, as it also resets the global callback and handles the `MessageEmitter` lifecycle.
+- **Fix**: Shutdown now calls `api.stopListening(callback)` first, with `api.stopListenMqtt()` as a fallback. Also added guard against double-shutdown (`_shutdownCalled` flag). Stops session guard timer properly.
+
+---
+
+### 🟢 Low / Optimization
+
+#### `checkUpdate.js` — Added hard abort guard on version check HTTP request
+- Added a `setTimeout(destroy, 8000)` as a belt-and-suspenders guard alongside the existing 5000ms socket timeout, preventing the rare case where DNS resolution hangs beyond the socket timeout window.
+
+#### `config.json` — Bengali/mixed-language notes replaced with English
+- All `_note` fields now in English for international maintainability.
+
+#### `fca-config.example.json` — Updated to v1.1.0 with accurate E2EE guidance
+- Added clear note that E2EE requires native binary. All fields documented.
+
+---
+
+### Files Modified
+
+| File | Changes |
+|---|---|
+| `package.json` | Version → 1.1.0 |
+| `config.json` | Version → 1.1.0, e2ee.enable → false, notes in English |
+| `checkUpdate.js` | CURRENT_VERSION → 1.1.0, hard abort guard |
+| `index.js` | Header version, fallback config version/e2ee, unified sendMessage wrapper, forceLogout fix, sessionGuard defensive patch, logout message updated |
+| `src/sendMessage.js` | Fixed `global._alphaFcaConfig` → `global._toruFcaConfig` |
+| `src/sendTypingIndicator.js` | Fixed local counter (always sent request_id:1), proper error handling, non-fatal when MQTT not connected |
+| `src/sendTypingIndicatorV2.js` | Delegates to sendTypingIndicator; removed duplicate logic |
+| `src/stopListenMqtt.js` | Clears ctx._deadTimer before MQTT teardown |
+| `src/listenMqtt.js` | getSeqID/form moved to instance scope; _deadTimer → ctx._deadTimer; banner version updated; stopListening uses ctx._deadTimer |
+| `src/refreshFb_dtsg.js` | Regex ordering fixed (broad pattern last), min-length guard |
+| `examples/basic-bot.js` | Proper shutdown (stopListening), double-shutdown guard, version updated |
+| `fca-config.example.json` | Version → 1.1.0, E2EE docs updated |
+| `utils.js` | parseAndCheckLogin retry body fix (form vs formData) |
+
+---
+
+## v1.0.9 (previous)
+- Dead connection watchdog added
+- Reaction detection works indefinitely (no longer stops after ~1hr)
+- Browser logout free, anti-automation, GoatBot ready

package/checkUpdate.js

@@ -1,24 +1,43 @@
 "use strict";
 
-const CURRENT_VERSION = "1.0.6";
+const CURRENT_VERSION = "1.1.0";
 
 async function checkForFCAUpdate() {
   try {
     const https = require("https");
-    const data  = await new Promise((resolve) => {
-      const req = https.get("https://registry.npmjs.org/toru-fca/latest", { timeout: 5000 }, (res) => {
-        let body = "";
-        res.on("data", (c) => { body += c; });
-        res.on("end", () => { try { resolve(JSON.parse(body)); } catch (_) { resolve(null); } });
-      });
-      req.on("error", () => resolve(null));
-      req.on("timeout", () => { req.destroy(); resolve(null); });
+
+    const data = await new Promise(function(resolve) {
+      var req = https.get(
+        "https://registry.npmjs.org/toru-fca/latest",
+        { timeout: 5000 },
+        function(res) {
+          var body = "";
+          res.on("data", function(c) { body += c; });
+          res.on("end", function() {
+            try { resolve(JSON.parse(body)); } catch (_) { resolve(null); }
+          });
+          res.on("error", function() { resolve(null); });
+        }
+      );
+      req.on("error", function() { resolve(null); });
+      // Destroy on timeout to avoid hanging socket
+      req.on("timeout", function() { req.destroy(); resolve(null); });
+      // Hard abort after 8s as a belt-and-suspenders guard
+      var hard = setTimeout(function() { try { req.destroy(); } catch (_) {} resolve(null); }, 8000);
+      if (hard.unref) hard.unref();
     });
+
     if (data && data.version && data.version !== CURRENT_VERSION) {
-      const log = require("npmlog");
-      log.warn("toru-fca", "Update available: v" + CURRENT_VERSION + " → v" + data.version + " — run: npm update toru-fca");
+      var log = require("npmlog");
+      log.warn(
+        "toru-fca",
+        "Update available: v" + CURRENT_VERSION + " \u2192 v" + data.version +
+          " \u2014 npm update toru-fca"
+      );
     }
-  } catch (_) {}
+  } catch (_) {
+    // Non-fatal; version check is best-effort only
+  }
 }
 
 module.exports = { checkForFCAUpdate, CURRENT_VERSION };

package/config.json

@@ -1,61 +1,51 @@
 {
-  "_info": "toru-fca v1.0.6 — Main Config. Edit values below as needed.",
-
-  "version": "1.0.6",
-
+  "_info": "toru-fca v1.1.0 — Main Config",
+  "version": "1.1.0",
   "antiLogout": {
     "enabled": true,
     "refreshIntervalMs": 1200000,
-    "_note": "Auto-refreshes fb_dtsg every 20 min (was 30). Keeps session alive. Prevents browser/automation logout. NEVER set to false."
+    "_note": "fb_dtsg refreshed every 20 minutes to keep session alive and prevent browser logout."
   },
-
   "sessionGuard": {
     "enabled": true,
     "intervalMs": 180000,
     "debounceMs": 20000,
     "backupEnabled": true,
-    "_note": "Saves appstate every 3 min (was 5). backupEnabled=true saves .bak before overwrite. Corruption check included."
+    "_note": "Appstate auto-saved every 3 minutes. Keeps a .bak backup. Cookie expiry is extended."
   },
-
   "automation": {
     "enabled": false,
-    "_note": "KEEP FALSE. Background automation detection prevention. Enabling this risks Facebook account restriction."
+    "_note": "KEEP FALSE. Disables background automation. Protects against Facebook restrictions."
   },
-
   "smooth": {
     "enabled": true,
     "messageDelay": 300,
-    "_note": "Shows typing indicator before sending. Human-like behavior. Reduces rate-limiting. messageDelay optimized to 300ms."
+    "_note": "Shows typing indicator before sending. 300ms delay for human-like behavior."
   },
-
   "connection": {
     "minDelayMs": 3000,
     "maxDelayMs": 60000,
-    "_note": "MQTT reconnect backoff range in milliseconds."
+    "_note": "MQTT reconnect exponential backoff range."
   },
-
   "e2ee": {
-    "enable": true,
+    "enable": false,
     "saveType": "memory",
     "devicePath": "./data/e2ee-device.json",
     "autoReconnect": true,
     "logLevel": "none",
-    "_note": "E2EE Labyrinth bridge. saveType: memory (default) or path (persistent)."
+    "_note": "E2EE Labyrinth bridge. Requires native build/messagix binary. Set enable:true only if binary is present."
   },
-
-  "inbox": {
-    "enabled": true,
-    "replyToInbox": true,
-    "_note": "Inbox always active. replyToInbox=true routes bot reply to bot inbox (not group). Required for bot message listening."
-  },
-
   "facebookProtection": {
     "enabled": true,
     "blockAutomationDetection": true,
     "humanLikeDelay": true,
-    "_note": "v1.0.6 new. Blocks Facebook automation detection. humanLikeDelay adds random micro-delays to avoid pattern detection."
+    "_note": "Sets online=false, updatePresence=false. Adds 50-200ms micro-delay. Reduces account restriction risk."
+  },
+  "inbox": {
+    "enabled": true,
+    "replyToInbox": true,
+    "_note": "Bot replies in both inbox/DM and group threads."
   },
-
   "enableTypingIndicator": false,
   "typingDuration": 4000
 }

package/examples/basic-bot.js

@@ -1,118 +1,122 @@
 /**
- * toru-fca v1.0.6  —  Basic Bot Example (Updated)
+ * toru-fca v1.1.0 — basic-bot.js (GoatBot compatible example)
  *
- * Features demonstrated:
- *  - Login with appState/Cookie (browser logout হবে না)
- *  - Bot inbox e reply (group এ নয়, bot ID এর inbox এ)
- *  - Session guard (auto-save appstate হর 3 মিনিটে)
- *  - Anti-logout system (fb_dtsg 20 মিনিটে auto-refresh)
- *  - Facebook Protection (automation detection বন্ধ)
- *  - E2EE bridge (optional)
- *  - Graceful shutdown
- *  - GoatBot compatible
+ * Features:
+ *  ✅ Cookie login         — browser logout prevention
+ *  ✅ Inbox + Group        — bot replies in both DM and group threads
+ *  ✅ Session guard        — appstate auto-saved every 3 minutes
+ *  ✅ Anti-logout          — fb_dtsg refreshed every 20 minutes
+ *  ✅ Facebook protection  — automation detection guard
+ *  ✅ Graceful shutdown    — cleans up timers, MQTT, and session on exit
  */
 
 "use strict";
 
-const login = require("../index.js"); // or: require("toru-fca")
+const login = require("../index.js");
 const fs    = require("fs");
 const path  = require("path");
 
-// ─── Config ──────────────────────────────────────────────────────────────────
 const APPSTATE_FILE = path.join(__dirname, "..", "appstate.json");
 
-// ─── Load appState (Cookie) ──────────────────────────────────────────────────
+// ── Load appState (Cookie) ────────────────────────────────────────────────────
 let appState;
 try {
   appState = JSON.parse(fs.readFileSync(APPSTATE_FILE, "utf8"));
 } catch (err) {
-  console.error("[toru-fca] Could not load appstate.json:", err.message);
-  console.error("  Place your Facebook cookie appstate in: " + APPSTATE_FILE);
+  console.error("[toru-fca] \u274C Could not load appstate.json:", err.message);
   process.exit(1);
 }
 
-// ─── Login options (GoatBot compatible) ──────────────────────────────────────
+// ── Login options (GoatBot compatible) ───────────────────────────────────────
 const options = {
-  listenEvents  : true,
-  selfListen    : false,   // bot নিজের message শুনবে না
-  listenTyping  : false,
-  updatePresence: false,   // presence update বন্ধ (automation protection)
-  autoMarkRead  : false,
+  listenEvents    : true,
+  selfListen      : false,   // bot does not listen to its own messages
+  autoReconnect   : true,
+  online          : false,   // reduces automation detection risk
+  updatePresence  : false,
+  forceLogin      : false,   // browser logout protection
+  autoMarkRead    : false,
   autoMarkDelivery: false,
-  autoReconnect : true,
-  online        : false,   // offline mode — automation detection এড়ায়
-  logLevel      : "verbose"
+  logLevel        : "verbose"
 };
 
-// ─── Login ───────────────────────────────────────────────────────────────────
+// ── Login ─────────────────────────────────────────────────────────────────────
 login({ appState }, options, function (err, api) {
   if (err) {
-    console.error("[toru-fca] ❌ Login failed:", err.message || err);
+    console.error("[toru-fca] \u274C Login failed:", err.message || err);
     process.exit(1);
   }
 
-  const userID = api.getCurrentUserID ? api.getCurrentUserID() : "unknown";
-  console.log("[toru-fca] ✅ Logged in as:", userID);
+  const botID = api.getCurrentUserID ? api.getCurrentUserID() : "unknown";
+  console.log("[toru-fca] \u2705 Bot running as:", botID);
 
-  // ── Session guard: auto-save appstate হর 3 মিনিটে ─────────────────────
-  api.sessionGuard(APPSTATE_FILE, {
-    interval: 3 * 60 * 1000,  // 3 min
-    debounce: 20 * 1000,       // 20 sec debounce
-    backup: true               // .bak file রাখে
-  });
-  console.log("[toru-fca] 🔒 Session guard active — auto-saving appstate.");
-
-  // ── E2EE Bridge (config.json e e2ee.enable:true থাকলে) ─────────────────
-  if (api.connectE2EE) {
-    api.connectE2EE(function (err, event) {
-      if (err) { console.error("[E2EE]", err.message || err); return; }
-      if (event && event.type) console.log("[E2EE]", event.type);
-    }).catch(e => console.error("[E2EE] connect failed:", e.message));
-  }
+  // Session guard — auto-saves appstate every 3 minutes
+  const guard = api.sessionGuard(APPSTATE_FILE, { interval: 3 * 60 * 1000, backup: true });
 
-  // ── Main message listener ───────────────────────────────────────────────
+  // ── Main listener ─────────────────────────────────────────────────────────
   api.listenMqtt(function (err, event) {
     if (err) {
       console.error("[listen]", err);
       return;
     }
 
-    // Handle normal inbox messages — bot inbox e reply করবে
+    // Respond in both Group and Inbox/DM threads
     if (event.type === "message") {
-      const { threadID, senderID, body, isGroup, isE2EE } = event;
-      const prefix = isE2EE ? "[E2EE]" : (isGroup ? "[Group]" : "[DM]");
-      console.log(`${prefix} ${senderID}: ${body}`);
+      const { threadID, senderID, body, isGroup } = event;
+      const tag = isGroup ? "[Group]" : "[Inbox/DM]";
+      console.log(tag, senderID + ":", body);
 
-      // Echo reply example — bot inbox e reply
+      // Simple echo bot
       if (body && body.toLowerCase() === "ping") {
-        api.sendMessage("pong! 🏓 — toru-fca v1.0.6", threadID, function (err) {
-          if (err) console.error("[sendMessage]", err);
-        });
+        api.sendMessage("\uD83C\uDFD3 pong! \u2014 toru-fca v1.1.0", threadID);
       }
     }
 
-    // Handle events (group joins, reactions, etc.)
-    if (event.type === "event") {
-      console.log("[event]", event.logMessageType || event.type);
+    // Reaction events
+    if (event.type === "message_reaction") {
+      console.log(
+        "[Reaction]",
+        event.senderID,
+        event.off ? "removed reaction" : "reacted:",
+        event.reaction
+      );
     }
-  });
 
-  // ── Health check ────────────────────────────────────────────────────────
-  setInterval(function () {
-    const health = api.getHealth();
-    if (!health.mqtt || !health.mqtt.connected) {
-      console.warn("[health] MQTT not connected — autoReconnect will restore.");
+    // Group events (join, leave, name change, etc.)
+    if (event.type === "event") {
+      console.log("[Event]", event.logMessageType || event.type);
     }
-  }, 60 * 1000);
+  });
 
-  // ── Graceful shutdown ───────────────────────────────────────────────────
+  // ── Graceful shutdown ─────────────────────────────────────────────────────
+  var _shutdownCalled = false;
   function shutdown() {
+    if (_shutdownCalled) return;
+    _shutdownCalled = true;
     console.log("[toru-fca] Shutting down...");
-    if (api.stopAntiLogout)  api.stopAntiLogout();
-    if (api.stopListenMqtt)  api.stopListenMqtt();
-    if (api.getE2EEBridge && api.getE2EEBridge()) api.getE2EEBridge().disconnect().catch(() => {});
-    setTimeout(() => process.exit(0), 1500);
+
+    // Stop anti-logout timer
+    if (api.stopAntiLogout) api.stopAntiLogout();
+
+    // Stop session guard timer
+    if (guard && typeof guard.stop === "function") guard.stop();
+
+    // FIX v1.1.0: use api.stopListening() (from MessageEmitter) which correctly
+    // clears the dead-connection watchdog AND the MQTT client.
+    // api.stopListenMqtt() also works but stopListening() is preferred here
+    // because it was returned by the listen() call and has direct scope access.
+    if (typeof api.stopListening === "function") {
+      api.stopListening(function() {
+        setTimeout(function() { process.exit(0); }, 500);
+      });
+    } else if (api.stopListenMqtt) {
+      api.stopListenMqtt();
+      setTimeout(function() { process.exit(0); }, 500);
+    } else {
+      setTimeout(function() { process.exit(0); }, 500);
+    }
   }
+
   process.once("SIGINT",  shutdown);
   process.once("SIGTERM", shutdown);
 });

package/fca-config.example.json

@@ -1,56 +1,66 @@
 {
-  "_comment": "alpha-fca v1.0.0 — Example Config. Copy to config.json and customize.",
+  "_comment": "toru-fca v1.1.0 — Example Config. Copy to config.json and customize.",
 
-  "version": "1.0.0",
+  "version": "1.1.0",
 
   "automation": {
     "enabled": false,
-    "_comment": "KEEP FALSE. Enabling this allows background task automation (use with care)."
+    "_comment": "KEEP FALSE. Enabling this allows background task automation. Keep false to protect your account."
   },
 
   "inbox": {
     "enabled": true,
-    "_comment": "Inbox/getThreadList access. Always true for a working bot."
+    "replyToInbox": true,
+    "_comment": "Bot replies in both inbox/DM and group threads."
   },
 
   "smooth": {
     "enabled": true,
-    "messageDelay": 400,
-    "_comment": "When true, shows typing indicator before sending message. Set messageDelay (ms) for natural feel. Recommended: false for low automation."
+    "messageDelay": 300,
+    "_comment": "Adds a short delay before sending. Combines with human jitter (50-200ms) when facebookProtection is enabled."
   },
 
   "connection": {
-    "minDelayMs": 1000,
-    "maxDelayMs": 30000,
-    "_comment": "Reconnect backoff range in milliseconds."
+    "minDelayMs": 3000,
+    "maxDelayMs": 60000,
+    "_comment": "MQTT reconnect exponential backoff range in milliseconds."
+  },
+
+  "antiLogout": {
+    "enabled": true,
+    "refreshIntervalMs": 1200000,
+    "_comment": "Refreshes fb_dtsg CSRF token every 20 minutes to keep session alive."
+  },
+
+  "sessionGuard": {
+    "enabled": true,
+    "intervalMs": 180000,
+    "debounceMs": 20000,
+    "backupEnabled": true,
+    "_comment": "Auto-saves appstate.json every 3 minutes. Keeps a .bak backup. Extends cookie expiry."
+  },
+
+  "facebookProtection": {
+    "enabled": true,
+    "blockAutomationDetection": true,
+    "humanLikeDelay": true,
+    "_comment": "Sets online=false, updatePresence=false. Adds 50-200ms human jitter on sendMessage."
   },
 
   "e2ee": {
-    "enable": true,
+    "enable": false,
     "saveType": "memory",
     "devicePath": "./data/e2ee-device.json",
     "autoReconnect": true,
     "logLevel": "none",
-    "_comments": {
-      "enable": "Set to true to activate E2EE Labyrinth bridge.",
-      "saveType": "'memory' = keys lost on restart (safe). 'path' = persist keys to disk (survives restart).",
-      "devicePath": "Used only when saveType='path'. Relative to your bot's CWD.",
-      "autoReconnect": "E2EE bridge auto-reconnects on disconnect.",
-      "logLevel": "'none' = silent. 'error'/'warn'/'info' = verbose."
-    }
-  },
-
-  "imgKeys": {
-    "imgbb": null,
-    "ik_pub": null,
-    "ik_priv": null,
-    "_comment": "Optional image hosting API keys. Leave null to disable image hosting."
+    "_comment": "E2EE Labyrinth bridge. REQUIRES native binary in build/ directory. Set enable:true only when binary is present. saveType: 'memory' (keys lost on restart) or 'path' (persisted to disk)."
   },
 
   "enableTypingIndicator": false,
   "typingDuration": 4000,
 
   "_listenOptions": {
+    "_comment": "These go in the options param of login(), not in this file. Shown here for reference.",
     "selfListen": true,
     "listenEvents": true,
     "listenTyping": false,
@@ -58,7 +68,6 @@
     "autoMarkDelivery": false,
     "autoMarkRead": false,
     "autoReconnect": true,
-    "online": false,
-    "_comment": "These go in the options param of login(), not in this file. Shown here for reference."
+    "online": false
   }
 }