@webdecoy/fcaptcha 1.43.0 → 1.45.0

package/engine.js

@@ -266,7 +266,7 @@ function detectVisionAI(signals) {
         category: 'vision_ai', score: 0.8, confidence: 0.7,
         reason: 'PoW completed impossibly fast'
       });
-    } else if (pow.duration > expectedMax * 3) {
+    } else if (pow.duration > expectedMax * 10) {
       detections.push({
         category: 'vision_ai', score: 0.6, confidence: 0.5,
         reason: 'PoW timing suggests external processing'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {

package/server.js

@@ -165,7 +165,10 @@ const CLIENT_PATH = process.env.FCAPTCHA_CLIENT_PATH
   || path.join(__dirname, '..', 'client', 'fcaptcha.js');
 
 if (process.env.FCAPTCHA_SERVE_CLIENT !== 'false') {
-  app.get('/fcaptcha.js', (req, res) => {
+  // The same file on each provider's script path, where it answers to that
+  // provider's global, so apps that let an admin change a Turnstile, hCaptcha
+  // or reCAPTCHA URL can point it here (see installCompat in the client).
+  app.get(['/fcaptcha.js', '/turnstile/v0/api.js', '/1/api.js', '/recaptcha/api.js'], (req, res) => {
     res.sendFile(CLIENT_PATH);
   });
 }
@@ -1041,7 +1044,9 @@ async function start() {
   if (SHARED_STATE) await SHARED_STATE.connect();
   const host = SECRET_KEY === require('./config').INSECURE_DEFAULT_SECRET ? '127.0.0.1' : '0.0.0.0';
   const server = app.listen(PORT, host, () => {
-    console.log(`FCaptcha server running on port ${server.address().port}`);
+    const addr = server.address();
+    const port = addr ? addr.port : PORT;
+    console.log(`FCaptcha server running on port ${port}`);
     console.log(`Trusted proxies: ${PROXY_TRUST.describe()}`);
     console.log(`Site keys: ${SITE_KEYS.describe()}`);
     console.log(`Shared state: ${SHARED_STATE ? 'Redis (PoW)' : 'in-memory'}`);