@hraness/sponge 0.6.10 → 0.6.11

package/README.md

@@ -72,6 +72,10 @@ never reads cookies, passwords or the browser's profile.
 Once the extension is connected, a page that comes back thin from the public web
 is tried again through the browser: first a plain fetch with your cookies, then a
 muted background tab that runs the page's scripts and closes afterwards.
+When a site shows a security check (Cloudflare's "Just a moment…"), the tab waits
+up to 20 seconds for your browser to clear it on its own, as it usually does for
+a browser the site already knows. Sponge never clicks or answers a check; one that
+stays is reported as blocked.
 `refresh ITEM --browser` (or `add URL --browser`) skips the public web and reads
 only through the browser. Its popup and right-click menu save the current page or
 a link. If no browser is connected, a `--browser` job fails as `browser-offline`

package/extension/background.js

@@ -89,6 +89,7 @@ async function renderPage(url, timeoutMs) {
   try {
     await chrome.tabs.update(tab.id, { muted: true });
     if (!(await loaded(tab.id, deadline))) return { ok: false, code: 'timeout' };
+    await passedCheck(tab.id, Math.min(deadline, Date.now() + checkWaitMs));
     const [result] = await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: snapshot });
     const page = result?.result;
     if (!page || typeof page.html !== 'string') return { ok: false, code: 'failed' };
@@ -101,6 +102,34 @@ async function renderPage(url, timeoutMs) {
   }
 }
 
+/** How long a site's security check gets to let this browser through on its own. */
+const checkWaitMs = 20_000;
+
+/**
+ * Waits while the tab shows a security check (Cloudflare's "Just a moment…" and the like), which a real browser often
+ * clears by itself within seconds. Nothing is clicked or answered; a check that stays is captured as what it is.
+ */
+async function passedCheck(tabId, until) {
+  while (Date.now() < until) {
+    const [result] = await chrome.scripting.executeScript({ target: { tabId }, func: checking }).catch(() => [null]);
+    if (result?.result === false) return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    await loaded(tabId, until);
+  }
+}
+
+/** Runs in the page: whether it is a security check rather than the page itself. */
+function checking() {
+  return (
+    /^(?:just a moment|one more step|attention required|security check|checking your browser)/i.test(
+      document.title.trim(),
+    ) ||
+    document.querySelector(
+      '#challenge-running, #challenge-form, #challenge-stage, script[src*="/cdn-cgi/challenge-platform/"]',
+    ) !== null
+  );
+}
+
 /** A new tab first reports its blank start page as complete; only the requested page counts. */
 const navigated = (tab) => tab.status === 'complete' && !tab.pendingUrl && /^https?:/.test(tab.url ?? '');
 

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Sponge",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "Save pages to your local Sponge library with the sign-ins you already have. Cookies never leave the browser.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoSbZrBglr0h0193XOgavySnrG0DQif+WgYJ37CFSrbBwWP43rUz2ZzGRPvNveHgFZvFZlhGITJD0VC4NMQa2kxGAPP66RWEulIZDvGauxKonwcrlSneD+srPY8oMNX5sivTqw819uMwDA70oxBxKyTX4t4vwpwXuFX3Zf+5jwUOD3nz8XZFGT9uDh86MHyYYlURzsZQYBJSf2qAN17+OfhV7NHCWM5FdQodnOau6N/PcH/MstVGnbOaWeaTGged0PS2QGA5NDoOu5WZv1sUTHFqzM/Wsb/h1l8Kt5IfOZAXvhokhBBW7HTyYqgvX4wFHuj5fNioYshBUfMrKeZZFlQIDAQAB",
   "minimum_chrome_version": "116",

package/native/runtime-manifest.json

@@ -33,16 +33,16 @@
     }
   ],
   "build": {
-    "asrSourceSha256": "1eb8d6a6c0df90cfdadfb26232d402a5f616b41340678927361fdcaa5acf2ab7",
+    "asrSourceSha256": "535c4265d279168ae6f971b875974669f6096dacefdfe217eeeb983eb300e9ab",
     "clangVersion": "Apple clang version 21.0.0 (clang-2100.1.1.101)",
-    "embeddingSourceSha256": "0bba0ee3cebc6dd6196e41114d7e61ca74b68440af751656fcd1c282cad3bdee",
-    "mediaSourceSha256": "6ef49c79b8ce06d73c8f53ffb892dfd8d8c6dc96adff90c224cf4803c032313b",
+    "embeddingSourceSha256": "c0588228be185b42f031243e10de15aae6c0dd5d865dda63457083a37f478bf4",
+    "mediaSourceSha256": "b8af23eb8c2298235dde54f900ac523d6614c9b92afd5db36f2d21aaecdd9d07",
     "rustcVersion": "rustc 1.97.1 (8bab26f4f 2026-07-14)",
     "swiftVersion": "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)"
   },
   "minimumMacOS": "26.0",
-  "packageVersion": "0.6.10",
+  "packageVersion": "0.6.11",
   "platform": "darwin",
   "schemaVersion": 1,
-  "sourceCommit": "05a98d475948f8de577dd51178dbfd34c1a7c872"
+  "sourceCommit": "2b29176548506e04efd9f0a304de7c573b392e1d"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/sponge",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "A local library for captured articles and verified offline assets.",
   "repository": {
     "type": "git",