CHANGELOG.md

Changelog

57.0 - External Final Guard

• Fixed unknown-site external jumps: generic Auto Flow no longer auto-clicks links such as Continue to Destination when they leave the current site or resolve to a final route.
• Manual final contract is now global: external, final-path, Telegram, and VPlink final targets all use the same guard in normal actions, countdown-ready actions, learned/intermediate clicks, and delayed auto-clicks.
• No false learning or loops: external destinations remain visible through the proxy as FINAL LINK: ..., but require a real user click and do not create recipes or pending learning.
• Live finding: nowshort.com/Ml2ld53 previously auto-opened a loan-site chain that frequently triggered a Google Search HTTP 429 CAPTCHA. V57 stops safely on the NowShort notice page instead.
• Known chains unchanged: repeated zecn and 8MY98t tests still reach the Vacancymode manual gate with isolated flow history, zero recipes, and zero pending learning.

56.0 - Honest Two-Step Learning

• Fixed the learning contract: unknown structured flows no longer auto-click on their first visit.
• First confirmation: the panel shows LEARNING 0/2: tap Continue; doing nothing causes zero clicks and creates no recipe.
• Second confirmation: the next matching visit shows LEARNING 1/2: tap Continue.
• Trusted replay: only after both verified manual transitions does the third matching visit auto-run the learned action.
• Known flows stay fast: VPlink/Vacancymode first-class handling is unchanged; both supplied links remained on the required manual gate with zero recipes, pending learning, loops, or premature clicks in repeated tests.

55.0 - Per-Link Memory + Loop Recovery

• Fixed the reported vplink.in/zecn loop: four-character aliases are now valid and zecn gets its own flow-memory key.
• Correct alias extraction: known parameters such as studiissinsucrnce are checked explicitly; shared values such as uiso=11186 can no longer merge unrelated links into one history.
• Cross-page continuity: Vacancymode stores the active alias from its landing query and reuses it on article pages in the same origin/session.
• Recent-loop detection only: route attempts older than 45 seconds no longer trigger a false loop, and stored trace entries expire after five minutes.
• Server-error brain state: 429/500/502/503/504 and Cloudflare host failures stop navigation and learning immediately with a clear retry status.
• Learning isolation: a pending recipe is cancelled if navigation changes to another website, preventing misleading learning messages across domains.
• Live finding: during testing, VPlink itself returned the expected redirect but the specific Vacancymode zecn backend endpoint returned HTTP 502 while the Vacancymode homepage remained healthy.

54.0 - Page Brain + Fast Verified Learning

• Page Brain: classifies the current page as redirect, structured step, timer, ready action, manual gate, captcha, final link, loop, or unknown before automation acts.
• Clear live explanation: the panel now reports the active state and reason instead of leaving a generic learning message; hover shows the detected target when available.
• Two-confirmation learning: stable known controls with a verified same-site page transition become trusted after two successful confirmations. Weak or dynamic matches retain the stricter legacy confidence requirement.
• Transition verification: learning still commits only after real URL/page-shape progress; unchanged, wrong, final, and stale routes are rejected with a specific status.
• Flow diagnostics: meaningful state changes are recorded in a small session-only history, capped at 24 entries, to make stuck routes explainable without persistent tracking.
• Recovery remains guarded: repeated route loops stop after three attempts, failing recipes lose confidence, and manual server gates, captchas, external destinations, and Telegram links never become automatic.

53.0 - Gate-Aware VPlink Chain

• Live-tested vplink.in/8MY98t: traced the current route through Vacancymode landing and article pages and identified the real failure point.
• Vacancymode is now first-class: added it to built-in profiles and the guarded VPlink chain allowlist instead of relying only on generic Universal matching.
• No more false Continue: when the page requires its manual ad-confirmation cookie, Time Hooker pauses instead of opening /learn_more.php early and being rejected back to the homepage.
• Automatic resume: the floating status points to the required page gate; after the user completes it and returns, Time Hooker detects confirmation, finishes the timer, and resumes safe intermediate hops.
• No fake gate completion: V53 does not auto-click ads or forge confirmation cookies. Captcha and final/Telegram destinations remain manual.

52.0 - Confirmed Learning + Safe Recipe Replay

• Confirmed learning: intermediate actions are staged first and saved only after the page URL or verified page shape actually advances. Captcha pages, final destinations, Telegram links, ads, overlays, and Time Hooker's own UI are never learned.
• Confidence-gated replay: a same-site recipe must succeed three times with a healthy success ratio before it can auto-run. Cross-site pattern matches remain advisory and require a manual tap.
• Existing safety guards stay authoritative: learned actions use the same captcha pause, final-link guard, same-host navigation checks, visit-loop protection, and single-navigation lock as normal flows.
• Self-healing storage: malformed records are sanitised, repeated failures decay confidence and remove bad recipes, stale entries expire, storage is capped, and writes are throttled.
• Final-link hardening: Telegram links now remain manual on every host, not only on VPlink pages.
• GitHub auto-update: userscript update and download metadata now point at the repository's raw main userscript.

51.0 - Fast Auto-Walk + Crash-Safe Navigation

• Faster multi-hop walk: auto-navigation between safe flow hops now fires in ~150 ms (was 300 ms), so 2-3 redirect hops chain through near-instantly instead of dragging.
• Crash-safe guard: a single window.th_navigating lock ensures only one navigation is ever scheduled at a time, so the main loop can't double-fire or bounce a page into a redirect loop. Honest note: the final Telegram link on well-built shorteners is server-gated and cannot be extracted directly — V51 makes walking the chain fast and safe, and the deep scanner still jumps directly whenever a next/final URL is actually embedded in the page.

50.0 - Stronger Ad-Overlay Removal + Chain Coverage

• Ad-overlay removal upgraded (Kill Ad Overlays): now also removes full-screen fixed/absolute/sticky blocking layers, clears body scroll-locks (overflow, position:fixed, and modal-open/no-scroll/overflow-hidden/etc. classes), and matches more selectors (backdrop, interstitial, aria-modal) and ad networks (propeller, hilltopads, monetag, popcash...). A hasFlowInside() guard protects any container holding the timer / continue / get-link / our own panel, so real content is never hidden.
• Chain coverage: traced vplink.in/<id> → it JS-redirects to vacancymode.in (landing → same-site article timer with countdown + continue + Google ads) → further hops → final Telegram link. Added vacancymode.in to the remote rules so the article-timer step auto-activates. Same-site landing→article hops are handled by the V48 deep scanner; cross-domain hops the pages perform themselves via location.href.

49.0 - Cleaner UI

• Removed the Site Macro section (Record / Stop / Play / Delete + dropdowns) from the panel — it was the most complex, least-used part. The macro backend functions remain dormant in code but are no longer exposed.
• Removed the Auto Click Target toggle and merged its behaviour into Auto Flow Skip (shouldAutoFlow() now triggers on either), so there is a single, clear "do it automatically" switch instead of two overlapping ones.
• Kept Video Fast Forward (it genuinely changes media playbackRate), Highlight, Pin, and Position. No functional change to flow/timer/captcha logic; cleanup is UI-only plus the auto-click merge.

48.0 - Deep Page Scanner

• Deep page scanner: when there is no confident Continue/Get-Link button, the script now reads the page's own code to find the hidden next URL — JS location/location.replace assignments, <meta http-equiv=refresh>, data-url/data-href/data-link attributes, and base64-encoded URLs decoded with atob. This is the "scan the page and understand the flow" capability.
• Stable by design: only same-host / known-safe-intermediate scanned URLs auto-advance (loop-protected, max 3 visits); external / final / Telegram URLs are never auto-jumped — instead the proxy shows ➡️ NEXT PAGE for a one-tap move, so the script can't send you somewhere wrong on its own.
• The ⚡ Force Skip button also uses the scanner: if nothing is clickable, it navigates to the discovered next URL (user-initiated, so external hops are allowed there).
• Runs only as a late fallback under Auto Flow Skip / Universal mode; known-site flows and the captcha pause are unchanged.

47.0 - Instant Self-Healing Panel

• The floating panel now re-injects instantly via a MutationObserver on <html> (debounced ~150 ms) instead of only a 2 s poll. Many shortlink/timer pages rebuild <body> or wipe the DOM when their countdown starts, which removed the menu and left it gone — this is why the panel showed on some sites but vanished on others. It now reappears immediately and the periodic safety net (now 1.5 s) remains as backup, with the top-most z-index re-asserted.
• Diagnosis note: the affected sites (e.g. kishanganjhalchal.com, loan.kannursalafi.com) send no CSP, so the cause was DOM rebuilds + the pre-V42 builds having no watchdog at all. Devices still on the old published version must update to get the self-healing panel.

46.0 - Remote Rules Sync

• Remote rules sync: a single hosted JSON (rules/time-hooker-rules.json, set via REMOTE_RULES_URL) can add or update site rules for every installed device with no re-publish. Edit the JSON once → all devices pick it up within a day.
• Stability first: the fetch runs only in the userscript sandbox via GM_xmlhttpRequest (added @grant + @connect hosts), is throttled to once per day, size-limited (200 KB), and fully wrapped in try/catch. The page always boots instantly from the cached/built-in rules and never blocks; if the URL is unreachable it silently keeps the last good cache.
• Safe by construction: only known PROFILE_KEYS are read from each remote entry and type-coerced, so a malformed remote file cannot break the engine. Remote rules act like built-in profiles (priority: user's own → built-in → remote → learned → global) and never override the captcha pause or the manual final/external/Telegram link guards.
• Seeded the rules file with common global networks (GPLinks, Exe.io, Ouo.io, ShrinkMe, Clk.sh, Adshrink, Try2Link). UI profile label now shows remote when a remote rule is active.

45.0 - Captcha-Safe Pause + Per-Site Learning

• Captcha / Cloudflare / Turnstile guard: when a real human-verification challenge is detected (Cloudflare "just a moment" / "checking your browser", reCAPTCHA, hCaptcha, Turnstile widgets), Time Hooker fully pauses — no timer speed-up (the timer engine reads window.th_captcha_present), no flow skip, no auto-click. The proxy shows 🔒 SOLVE CAPTCHA so it never looks "stuck". Resumes automatically once the challenge clears. Detection requires the widget to be actually visible (or a full-page CF interstitial) to avoid pausing on hidden/idle widgets.
• Per-site trick learning: a new siteTricks store records whether a site needed force (stuck-recovery fired) or flowed normally as timer. Known force sites get a lower stuck threshold (3 ticks instead of 8) so they recover faster next time.
• No change to known-site flows beyond the captcha pause.

44.0 - Stuck-Timer Killer

• performance.now() hook: now scaled with the same factor as Date.now, so requestAnimationFrame and performance-based countdowns also fast-forward. Keeping both clocks consistent also avoids tamper-detection that freezes/resets timers when the two clocks diverge.
• Stuck-timer auto-recovery: if a detected countdown value does not change for ~8 loop ticks (e.g. an ad callback never fired, or it is a server/perf timer the script cannot speed), the gate is force-finished and the Continue/Get-Link button is revealed.
• ⚡ Force Skip Now button in the panel: one tap zeros visible countdown numbers, finishes a recognised gate, and reveals + clicks the best Continue/Get-Link target. Final VPlink/Telegram links stay manual (highlighted only).
• These run only when the script is enabled; known-site flows are unchanged.

43.0 - Cross-Device Auto-Update

• Added distribution metadata to the userscript header so installs auto-update across every device: @updateURL + @downloadURL (Greasy Fork), plus @homepageURL, @supportURL, and @icon.
• Publish flow: bump @version → upload to the hosted URL → Tampermonkey/Violentmonkey on each device picks up the new version automatically (default daily check; user can force "Check for updates").
• One install link works on any device with Tampermonkey/Violentmonkey: the Greasy Fork page (or the raw *.user.js URL) triggers install.
• No behavior change to the flow engines; this release is about distribution + update reach.

42.0 - Self-Learning Flow + Self-Healing UI

• Added self-learning sites: when Universal Pattern Mode is on and a new domain matches the shortlink/countdown/verify shape, the script remembers it. On the next visit that site auto-activates (Fast-Forward + Auto Flow Skip + Universal mode) like a built-in profile.
• Added a one-tap "➕ Add Site" button to save the current domain as a strong site profile, plus a "🗑 Forget" button to remove a learned/saved site and fall back to global.
• Added a self-healing floating panel: if a page wipes the DOM or rebuilds <body>, the menu re-injects itself within ~2s and keeps its top-most z-index, so it never disappears.
• Refreshed the UI/UX: gradient title, an always-visible live status bar (current flow/gate state), profile-source label (built-in / learned / global), and a learned-sites counter.
• New learnedSites store section is persisted via GM storage alongside profiles and macros; learned sites respect the existing per-site disable/forget controls.

Note: this release is built on the local 40.0 source. If the published 41.0 contained extra fixes, reconcile those into this branch before publishing.

40.0 - V38 Flow + Universal Pattern Mode

• Restored V38 fast VPlink/DarkGuruji/StartupLearners step behavior by removing the V39 step-state wait and STEP LOOP: manual block.
• Added optional Universal Pattern Mode for unknown same-pattern shortlink pages.
• Universal mode is OFF by default and can be saved per site profile.
• Unknown sites use proxy-first safety: intermediate same-host flow links may continue, but final, external, and Telegram-style targets stay manual.

39.0 - StartupLearners Step-State Fix

• Made StartupLearners btn6/btn7 handling conservative so hidden Continue links are not followed immediately after verify.
• Added per-session step-state tracking for VPlink-style chains; repeated Step 1/3 article loops now stop with STEP LOOP: manual.
• Added a short state wait after nextbtn() before navigating to the next StartupLearners article.
• Added StartupLearners cookie/localStorage compatibility setup for the inspected step gate.
• Kept final VPlink, Telegram, and external destination actions manual.

38.0 - VPlink Multi-Hop Flow

• Added Auto Flow Skip, separate from Auto Click Target, for safe intermediate shortlink flow movement.
• Added VPlink/DarkGuruji/StartupLearners chain handling for JS redirect pages, tp-snp2 timer pages, and btn6/btn7 step pages.
• Added session loop protection so repeated article hops stop with FLOW LOOP: manual instead of spinning forever.
• Kept final Get Link, Telegram, and external destination actions manual.
• Migrated older saved built-in profiles so supported sites get the new Auto Flow Skip default.

37.0 - SchemePro Chain Skipper

• Added a SchemePro step skipper for sb1.schemepro.org and sb2.schemepro.org.
• The skipper reads the page's encoded tagrget_url, decodes it, and navigates directly to the next step instead of clicking article, ad, or wait buttons.
• Matched SchemePro's own step-cookie behavior by setting user_step=1 on Step 1/3 and clearing it on Step 2/4 transitions.
• Added per-page navigation locks so the same SchemePro step cannot fire repeatedly.
• Made final lksfy.com LinkShortify handling Turnstile-aware: the proxy now waits for a real Turnstile token before treating Get Link as ready.
• Kept final lksfy.com and VPlink-style final links manual so Auto Click does not open Telegram/final destinations unexpectedly.