From beded4ad661d86103669c1bd1101a3b287e41a70 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Sun, 23 Aug 2026 10:54:24 +0800
Subject: [PATCH 01/12] =?UTF-8?q?fix:=20=E5=9C=A8=E6=8F=90=E4=BA=A4?=
 =?UTF-8?q?=E7=95=8C=E9=9D=A2=E6=98=BE=E7=A4=BA=E5=B9=B6=E6=8F=90=E4=BA=A4?=
 =?UTF-8?q?=E9=AA=8C=E8=AF=81=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

评测队列繁忙时 XMOJ 会启用 vcode.php 图片验证码，但提交界面是脚本自己
渲染的，服务端的验证码字段在替换 DOM 时被丢弃，提交因此静默失败。

- 替换页面前先检测服务端是否渲染了验证码字段，若有则在提交按钮上方
  显示验证码图片与输入框，点击图片可更换
- 提交时附带 vcode 参数；队列不繁忙时 submit.php 会忽略该字段，因此
  无条件携带是安全的
- submitpage.php 在队列 >10 时显示验证码，submit.php 在 >50 时才校验，
  两者可能不一致：识别到"验证码错误"时展开验证码区域并允许重新提交
- 验证码为空时在客户端拦截。提交空验证码会让服务端标记 vfail，此后
  验证码会从 4 位数字变成 8 位字母数字，直到会话结束
- 新增 AutoCaptcha 开关，通过 captchaSolve 自动识别 4 位数字验证码；
  识别结果非 4 位数字时不填入，8 位字母验证码不送识别，均可手动填写

Closes #420

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 XMOJ.user.js | 170 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 168 insertions(+), 2 deletions(-)

diff --git a/XMOJ.user.js b/XMOJ.user.js
index 3cb45de7..0738983b 100644
--- a/XMOJ.user.js
+++ b/XMOJ.user.js
@@ -29,6 +29,7 @@
 // @connect      api.xmoj-bbs.tech
 // @connect      api.xmoj-bbs.me
 // @connect      api.xmoj-script.uk
+// @connect      captcha.xmoj-script.uk
 // @connect      challenges.cloudflare.com
 // @connect      cppinsights.io
 // @connect      cdnjs.cloudflare.com
@@ -551,6 +552,12 @@ let _earlyObs = null;
 })();
 
 const CaptchaSiteKey = "0x4AAAAAAALBT58IhyDViNmv";
+// XMOJ turns on its own image captcha (vcode.php) whenever the judge queue is busy. submitpage.php
+// renders the field at >10 pending solutions but submit.php only enforces it at >50, so the two can
+// disagree; see GetCaptchaParameter below for how that gap is handled.
+// Recognises the 4 digit variant only: https://github.com/boomzero/captchaSolve
+// workers.dev is unreachable from mainland China, so this has to stay on a custom domain.
+const CaptchaSolverURL = "https://captcha.xmoj-script.uk/";
 // 0.53.0 leaks its minified helper variables (m, r, o, ...) into the global scope from every
 // chunk file, so whichever chunk happens to be evaluated last clobbers the others and the
 // editor randomly fails to load (microsoft/monaco-editor#5015). 0.52.2 ships a single bundle
@@ -2855,6 +2862,8 @@ async function main() {
                         }, {"ID": "DownloadPlayback", "Type": "A", "Name": "回放视频增加下载功能"}, {
                             "ID": "ImproveACRate", "Type": "A", "Name": "自动提交已AC题目以提高AC率"
                         }, {"ID": "AutoO2", "Type": "F", "Name": "代码提交界面自动选择O2优化"}, {
+                            "ID": "AutoCaptcha", "Type": "A", "Name": "自动识别提交界面的验证码（识别失败时仍可手动填写）"
+                        }, {
                             "ID": "Beautify", "Type": "F", "Name": "美化界面", "Children": [{
                                 "ID": "NewTopBar", "Type": "F", "Name": "使用新的顶部导航栏"
                             }, {
@@ -4084,6 +4093,13 @@ async function main() {
                     }
                 } else if (location.pathname == "/submitpage.php") {
                     document.title = "提交代码: " + (SearchParams.get("id") != null ? "题目" + Number(SearchParams.get("id")) : "比赛" + Number(SearchParams.get("cid")));
+                    // submitpage.php only renders the vcode field while the judge queue is busy, and the
+                    // custom page below throws the server markup away, so read it before that happens.
+                    // The queue is idle almost all of the time, so the only other way to reach this state
+                    // is to flood the judge; localStorage UserScript-ForceCaptcha=true forces it instead.
+                    const NativeCaptchaShown = document.querySelector("input[name='vcode']") != null ||
+                        document.querySelector("img#vcode") != null ||
+                        localStorage.getItem("UserScript-ForceCaptcha") === "true";
                     document.querySelector("body > div > div.mt-3").innerHTML = `<center class="mb-3" id="_submitPageHeader"></center>
     <div id="MonacoEditor" style="width:100%; height:550px; display: grid; place-items: center;">
       <p id="loadEditor">Loading...</p>
@@ -4092,6 +4108,12 @@ async function main() {
     <center class="mt-3">
         <input id="enable_O2" name="enable_O2" type="checkbox"><label for="enable_O2">打开O2开关</label>
         <br>
+        <div id="CaptchaElement" class="mt-2" style="display: none">
+            <label class="me-1" for="vcode">验证码</label>
+            <input id="vcode" name="vcode" class="form-control form-control-sm d-inline w-auto align-middle" type="text" maxlength="8" size="8" autocomplete="off">
+            <img id="CaptchaImage" class="ms-1 align-middle" style="cursor: pointer" alt="验证码" title="点击更换验证码">
+            <div id="CaptchaStatus" class="form-text mt-1"></div>
+        </div>
         <input id="Submit" class="btn btn-info mt-2" type="button" value="提交">
         <div id="ErrorElement" class="mt-2" style="display: none; text-align: left; padding: 10px;">
             <div id="ErrorMessage" style="white-space: pre; background-color: rgba(0, 0, 0, 0.1); padding: 10px; border-radius: 5px;"></div>
@@ -4210,6 +4232,111 @@ async function main() {
                             });
                     }
 
+                    // vcode.php writes the expected answer into the PHP session every time it is
+                    // requested, so the challenge must be downloaded exactly once and that same copy
+                    // shown to the user: letting the <img> load it separately would leave the picture on
+                    // screen one challenge behind whatever the session actually expects.
+                    let CaptchaObjectURL = null;
+                    let CaptchaRequestID = 0;
+                    const SetCaptchaStatus = (Message) => {
+                        document.querySelector("#CaptchaStatus").innerText = Message;
+                    };
+                    // Byte 6-7 of a GIF header is the little endian width. vcode.php sizes the image as
+                    // 15px per character, so 60px means the easy 4 digit challenge while a wider image is
+                    // the 8 character alphanumeric one the server switches to after a failed attempt.
+                    const GetCaptchaLength = async (ImageBlob) => {
+                        const Header = new Uint8Array(await ImageBlob.slice(0, 8).arrayBuffer());
+                        return Math.round((Header[6] | (Header[7] << 8)) / 15);
+                    };
+                    const RequestCaptchaSolver = (ImageBlob) => new Promise((Resolve) => {
+                        GM_xmlhttpRequest({
+                            method: "POST",
+                            url: CaptchaSolverURL,
+                            headers: {"Content-Type": "application/octet-stream"},
+                            data: ImageBlob,
+                            timeout: 15000,
+                            onload: (Response) => {
+                                Resolve(Response.status === 200 ? String(Response.responseText) : null);
+                            },
+                            onerror: () => Resolve(null),
+                            ontimeout: () => Resolve(null)
+                        });
+                    });
+                    // The model sometimes reads five or six digits out of a four digit image, so anything
+                    // that is not exactly four digits is discarded rather than submitted. Asking again for
+                    // the same picture is pointless because the solver runs at temperature 0, so the user
+                    // is told to type it or click the image for a different challenge instead.
+                    const SolveCaptcha = async (ImageBlob) => {
+                        const SolverText = await RequestCaptchaSolver(ImageBlob);
+                        if (SolverText === null) return null;
+                        if (UtilityEnabled("DebugMode")) {
+                            console.log("Captcha solver returned:", SolverText);
+                        }
+                        const Digits = SolverText.replace(/\D/g, "");
+                        return /^\d{4}$/.test(Digits) ? Digits : null;
+                    };
+                    const RefreshCaptcha = async (StatusMessage) => {
+                        const RequestID = ++CaptchaRequestID;
+                        const CaptchaInput = document.querySelector("#vcode");
+                        document.querySelector("#CaptchaElement").style.display = "block";
+                        CaptchaInput.value = "";
+                        SetCaptchaStatus(StatusMessage || "");
+                        let ImageBlob;
+                        try {
+                            const CaptchaResponse = await fetch("https://www.xmoj.tech/vcode.php?" + Math.random(), {cache: "no-store"});
+                            ImageBlob = await CaptchaResponse.blob();
+                        } catch (e) {
+                            console.error(e);
+                            SetCaptchaStatus("验证码加载失败，请点击图片重试");
+                            return;
+                        }
+                        if (RequestID !== CaptchaRequestID) return;
+                        if (CaptchaObjectURL !== null) URL.revokeObjectURL(CaptchaObjectURL);
+                        CaptchaObjectURL = URL.createObjectURL(ImageBlob);
+                        document.querySelector("#CaptchaImage").src = CaptchaObjectURL;
+                        if (!UtilityEnabled("AutoCaptcha")) return;
+                        let CaptchaLength = 4;
+                        try {
+                            CaptchaLength = await GetCaptchaLength(ImageBlob);
+                        } catch (e) {
+                            console.error(e);
+                        }
+                        if (CaptchaLength !== 4) {
+                            SetCaptchaStatus("本次为 " + CaptchaLength + " 位字母验证码，无法自动识别，请手动输入");
+                            return;
+                        }
+                        SetCaptchaStatus("正在自动识别验证码...");
+                        const Answer = await SolveCaptcha(ImageBlob);
+                        if (RequestID !== CaptchaRequestID) return;
+                        if (Answer === null) {
+                            SetCaptchaStatus("自动识别失败，请手动输入，或点击图片更换验证码");
+                            return;
+                        }
+                        // Never overwrite what the user has already started typing.
+                        if (CaptchaInput.value !== "") return;
+                        CaptchaInput.value = Answer;
+                        SetCaptchaStatus("已自动识别，若与图片不符请手动修改");
+                    };
+                    document.querySelector("#CaptchaImage").addEventListener("click", () => {
+                        RefreshCaptcha("");
+                    });
+                    document.querySelector("#vcode").addEventListener("keydown", (KeyEvent) => {
+                        if (KeyEvent.key === "Enter") {
+                            KeyEvent.preventDefault();
+                            Submit.click();
+                        }
+                    });
+                    // submit.php ignores an unexpected vcode field, so sending it whenever the user has
+                    // one costs nothing and covers the case where the queue grew past the enforcement
+                    // threshold after this page was rendered.
+                    const GetCaptchaParameter = () => {
+                        const CaptchaValue = document.querySelector("#vcode").value.trim();
+                        return CaptchaValue === "" ? "" : "&vcode=" + encodeURIComponent(CaptchaValue);
+                    };
+                    if (NativeCaptchaShown) {
+                        RefreshCaptcha("");
+                    }
+
                     PassCheck.addEventListener("click", async () => {
                         ErrorElement.style.display = "none";
                         document.querySelector("#Submit").disabled = true;
@@ -4222,12 +4349,33 @@ async function main() {
                             },
                             "referrer": location.href,
                             "method": "POST",
-                            "body": (SearchParams.get("id") != null ? "id=" + SearchParams.get("id") : "cid=" + SearchParams.get("cid") + "&pid=" + SearchParams.get("pid")) + "&language=1&" + "source=" + encodeURIComponent(CodeMirrorElement.getValue()) + o2Switch
+                            "body": (SearchParams.get("id") != null ? "id=" + SearchParams.get("id") : "cid=" + SearchParams.get("cid") + "&pid=" + SearchParams.get("pid")) + "&language=1&" + "source=" + encodeURIComponent(CodeMirrorElement.getValue()) + o2Switch + GetCaptchaParameter()
                         }).then(async (Response) => {
                             if (Response.redirected) {
                                 location.href = Response.url;
                             } else {
                                 const text = await Response.text();
+                                // The queue can cross submit.php's enforcement threshold after this page
+                                // was rendered, so the field may not have been on screen at all yet.
+                                if (text.indexOf("验证码错误") !== -1) {
+                                    if (UtilityEnabled("DebugMode")) {
+                                        console.log("Submission rejected by captcha check.");
+                                    }
+                                    await RefreshCaptcha("");
+                                    ErrorElement.style.display = "block";
+                                    ErrorMessage.style.color = "red";
+                                    try { _xmoj_disposeErrorMessageEditors(); } catch (e) {
+                                        console.error(e);
+                                        if (UtilityEnabled("DebugMode")) {
+                                            SmartAlert("XMOJ-Script internal error!\n\n" + e + "\n\n" + "If you see this message, please report it to the developer.\nDon't forget to include console logs and a way to reproduce the error!\n\nDon't want to see this message? Disable DebugMode.");
+                                        }
+                                    }
+                                    ErrorMessage.innerText = "验证码错误！请填写上方的验证码后重新提交。";
+                                    Submit.disabled = false;
+                                    Submit.value = "提交";
+                                    document.querySelector("#vcode").focus();
+                                    return;
+                                }
                                 if (text.indexOf("没有这个比赛！") !== -1 && new URL(location.href).searchParams.get("pid") !== null) {
                                     // Credit: https://github.com/boomzero/quicksubmit/blob/main/index.ts
                                     // Also licensed under GPL-3.0
@@ -4277,7 +4425,7 @@ async function main() {
                                         },
                                         "referrer": location.href,
                                         "method": "POST",
-                                        "body": "id=" + rPID + "&language=1&" + "source=" + encodeURIComponent(CodeMirrorElement.getValue()) + o2Switch
+                                        "body": "id=" + rPID + "&language=1&" + "source=" + encodeURIComponent(CodeMirrorElement.getValue()) + o2Switch + GetCaptchaParameter()
                                     }).then(async (Response) => {
                                         if (Response.redirected) {
                                             location.href = Response.url;
@@ -4309,6 +4457,24 @@ async function main() {
                         ErrorElement.style.display = "none";
                         document.querySelector("#Submit").disabled = true;
                         document.querySelector("#Submit").value = "正在检查...";
+                        // Submitting a blank answer makes the server mark the session as having failed the
+                        // check, which swaps the 4 digit challenge for an 8 character one until the session
+                        // ends. Stop here instead of spending the attempt.
+                        if (document.querySelector("#CaptchaElement").style.display !== "none" && document.querySelector("#vcode").value.trim() === "") {
+                            ErrorElement.style.display = "block";
+                            ErrorMessage.style.color = "red";
+                            try { _xmoj_disposeErrorMessageEditors(); } catch (e) {
+                                console.error(e);
+                                if (UtilityEnabled("DebugMode")) {
+                                    SmartAlert("XMOJ-Script internal error!\n\n" + e + "\n\n" + "If you see this message, please report it to the developer.\nDon't forget to include console logs and a way to reproduce the error!\n\nDon't want to see this message? Disable DebugMode.");
+                                }
+                            }
+                            ErrorMessage.innerText = "当前评测队列繁忙，请先填写上方的验证码。";
+                            Submit.disabled = false;
+                            Submit.value = "提交";
+                            document.querySelector("#vcode").focus();
+                            return;
+                        }
                         let Source = CodeMirrorElement.getValue();
                         let PID = 0;
                         let IOFilename = "";

From 180cd850fa22d144e9b094a5e0a2d58f5080c136 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:03:25 +0000
Subject: [PATCH 02/12] 3.6.4

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7ee74e53..8537fedb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "xmoj-script",
-  "version": "3.6.3",
+  "version": "3.6.4",
   "description": "an improvement script for xmoj.tech",
   "main": "AddonScript.js",
   "scripts": {

From 95d1af514ccc52762b643abc33db437e9d9af57f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:03:31 +0000
Subject: [PATCH 03/12] Update version info to 3.6.4

---
 Update.json  | 11 +++++++++++
 XMOJ.user.js |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Update.json b/Update.json
index 35811b63..e4179a6d 100644
--- a/Update.json
+++ b/Update.json
@@ -3716,6 +3716,17 @@
                 }
             ],
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
+        },
+        "3.6.4": {
+            "UpdateDate": 1787454205912,
+            "Prerelease": true,
+            "UpdateContents": [
+                {
+                    "PR": 1019,
+                    "Description": "fix: 在提交界面显示并提交验证码"
+                }
+            ],
+            "Notes": "### 修复提交界面不显示验证码\n\n评测队列繁忙时 XMOJ 会启用图片验证码，但提交界面是脚本自行渲染的，服务端的验证码字段被丢弃，导致提交静默失败。现在提交界面会显示验证码图片与输入框（点击图片可更换），并在提交时携带验证码。\n\n新增 `AutoCaptcha` 开关（默认开启），可自动识别 4 位数字验证码；识别失败或遇到 8 位字母验证码时仍可手动填写。"
         }
     }
 }
\ No newline at end of file
diff --git a/XMOJ.user.js b/XMOJ.user.js
index 0738983b..b8a26517 100644
--- a/XMOJ.user.js
+++ b/XMOJ.user.js
@@ -1,6 +1,6 @@
 // ==UserScript==
 // @name         XMOJ
-// @version      3.6.3
+// @version      3.6.4
 // @description  XMOJ增强脚本
 // @author       @XMOJ-Script-dev, @langningchen and the community
 // @namespace    https://github/langningchen

From 8059e466c574945fc6f19eccfe3f40d140b47028 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Sun, 23 Aug 2026 11:13:56 +0800
Subject: [PATCH 04/12] =?UTF-8?q?fix:=20=E9=BB=98=E8=AE=A4=E5=85=B3?=
 =?UTF-8?q?=E9=97=AD=E9=AA=8C=E8=AF=81=E7=A0=81=E8=87=AA=E5=8A=A8=E8=AF=86?=
 =?UTF-8?q?=E5=88=AB=EF=BC=8C=E5=B9=B6=E7=BB=9F=E4=B8=80=E9=BB=98=E8=AE=A4?=
 =?UTF-8?q?=E5=85=B3=E9=97=AD=E9=A1=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

实测 Workers AI 的视觉模型都读不准 XMOJ 的验证码：以 7602 为例，
llava-1.5-7b 返回 600，llama-4-scout 返回 1834，mistral-small-3.1
返回 1234；另一张 7908 的图 llava 返回 9990。

四位数字的错误答案会通过校验被提交，失败后服务端置 vfail，验证码从
4 位数字升级为 8 位字母数字，直到会话结束，比留空更糟。因此把
AutoCaptcha 改为默认关闭，仅作为实验性功能保留接口。

顺带把默认关闭项提取为 DefaultOffSettings，供 UtilityEnabled 与设置
列表共用——两处都会给缺失的项写入默认值，不一致时先执行的一方说了算。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 XMOJ.user.js | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/XMOJ.user.js b/XMOJ.user.js
index b8a26517..1740ce6a 100644
--- a/XMOJ.user.js
+++ b/XMOJ.user.js
@@ -557,7 +557,13 @@ const CaptchaSiteKey = "0x4AAAAAAALBT58IhyDViNmv";
 // disagree; see GetCaptchaParameter below for how that gap is handled.
 // Recognises the 4 digit variant only: https://github.com/boomzero/captchaSolve
 // workers.dev is unreachable from mainland China, so this has to stay on a custom domain.
+// AutoCaptcha defaults to off: every Workers AI vision model tried so far reads these images wrong
+// (llava-1.5-7b, llama-4-scout and mistral-small-3.1 all missed on known samples), and a confidently
+// wrong four digit guess is worse than an empty box because it burns the attempt and trips vfail.
 const CaptchaSolverURL = "https://captcha.xmoj-script.uk/";
+// Settings that start off rather than on. Both UtilityEnabled and the settings list seed missing
+// values, so they have to agree or whichever runs first decides the default.
+const DefaultOffSettings = ["DebugMode", "SuperDebug", "ReplaceXM", "AutoCaptcha"];
 // 0.53.0 leaks its minified helper variables (m, r, o, ...) into the global scope from every
 // chunk file, so whichever chunk happens to be evaluated last clobbers the others and the
 // editor randomly fails to load (microsoft/monaco-editor#5015). 0.52.2 ships a single bundle
@@ -1498,8 +1504,7 @@ let TidyTable = (Table) => {
 let UtilityEnabled = (Name) => {
     try {
         if (localStorage.getItem("UserScript-Setting-" + Name) == null) {
-            const defaultOffItems = ["DebugMode", "SuperDebug", "ReplaceXM"];
-            localStorage.setItem("UserScript-Setting-" + Name, defaultOffItems.includes(Name) ? "false" : "true");
+            localStorage.setItem("UserScript-Setting-" + Name, DefaultOffSettings.includes(Name) ? "false" : "true");
         }
         return localStorage.getItem("UserScript-Setting-" + Name) == "true";
     } catch (e) {
@@ -2814,7 +2819,7 @@ async function main() {
                                     CheckBox.type = "checkbox";
                                     CheckBox.id = Data[i].ID;
                                     if (localStorage.getItem("UserScript-Setting-" + Data[i].ID) == null) {
-                                        localStorage.setItem("UserScript-Setting-" + Data[i].ID, "true");
+                                        localStorage.setItem("UserScript-Setting-" + Data[i].ID, DefaultOffSettings.includes(Data[i].ID) ? "false" : "true");
                                     }
                                     if (localStorage.getItem("UserScript-Setting-" + Data[i].ID) == "false") {
                                         CheckBox.checked = false;
@@ -2862,7 +2867,7 @@ async function main() {
                         }, {"ID": "DownloadPlayback", "Type": "A", "Name": "回放视频增加下载功能"}, {
                             "ID": "ImproveACRate", "Type": "A", "Name": "自动提交已AC题目以提高AC率"
                         }, {"ID": "AutoO2", "Type": "F", "Name": "代码提交界面自动选择O2优化"}, {
-                            "ID": "AutoCaptcha", "Type": "A", "Name": "自动识别提交界面的验证码（识别失败时仍可手动填写）"
+                            "ID": "AutoCaptcha", "Type": "A", "Name": "自动识别提交界面的验证码（实验性，当前模型准确率极低，默认关闭）"
                         }, {
                             "ID": "Beautify", "Type": "F", "Name": "美化界面", "Children": [{
                                 "ID": "NewTopBar", "Type": "F", "Name": "使用新的顶部导航栏"

From a27eddc24dc41f9cba6fbea17481e4aaa3c1fb42 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:14:29 +0000
Subject: [PATCH 05/12] Update time and description of 3.6.4

---
 Update.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Update.json b/Update.json
index e4179a6d..06bef636 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787454205912,
+            "UpdateDate": 1787454862192,
             "Prerelease": true,
             "UpdateContents": [
                 {

From c5b962be8eeaeaf9636bc38634f580f71f316069 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:14:48 +0000
Subject: [PATCH 06/12] Update time and description of 3.6.4

---
 Update.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Update.json b/Update.json
index 06bef636..77a183e0 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787454862192,
+            "UpdateDate": 1787454886624,
             "Prerelease": true,
             "UpdateContents": [
                 {

From 899532aec665fdc19346dfabd14a1b6bca3e9426 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:15:05 +0000
Subject: [PATCH 07/12] Update time and description of 3.6.4

---
 Update.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Update.json b/Update.json
index 77a183e0..adbf4247 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787454886624,
+            "UpdateDate": 1787454904784,
             "Prerelease": true,
             "UpdateContents": [
                 {
@@ -3726,7 +3726,7 @@
                     "Description": "fix: 在提交界面显示并提交验证码"
                 }
             ],
-            "Notes": "### 修复提交界面不显示验证码\n\n评测队列繁忙时 XMOJ 会启用图片验证码，但提交界面是脚本自行渲染的，服务端的验证码字段被丢弃，导致提交静默失败。现在提交界面会显示验证码图片与输入框（点击图片可更换），并在提交时携带验证码。\n\n新增 `AutoCaptcha` 开关（默认开启），可自动识别 4 位数字验证码；识别失败或遇到 8 位字母验证码时仍可手动填写。"
+            "Notes": "### 修复提交界面不显示验证码\n\n评测队列繁忙时 XMOJ 会启用图片验证码，但提交界面是脚本自行渲染的，服务端的验证码字段被丢弃，导致提交静默失败。现在提交界面会显示验证码图片与输入框（点击图片可更换），并在提交时携带验证码。\n\n另新增实验性的 `AutoCaptcha` 开关（**默认关闭**）：当前可用的视觉模型识别准确率极低，错误的四位答案被提交后会使验证码升级为 8 位，因此暂不默认启用，需要时可在设置中手动打开。"
         }
     }
 }
\ No newline at end of file

From 5b7eec5e75725fdba1afff622e68fee30c64b236 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Sun, 23 Aug 2026 11:44:04 +0800
Subject: [PATCH 08/12] =?UTF-8?q?feat:=20=E6=9C=AC=E5=9C=B0=E8=AF=86?=
 =?UTF-8?q?=E5=88=AB=E9=AA=8C=E8=AF=81=E7=A0=81=EF=BC=8C=E4=B8=8D=E5=86=8D?=
 =?UTF-8?q?=E4=BE=9D=E8=B5=96=20AI=20=E6=9C=8D=E5=8A=A1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vcode.php 用 imagettftext(15px, Vera.ttf) 在固定位置绘制 4 位数字，
每个字形在不同验证码之间逐像素相同，因此模板匹配可以直接读出来，
不需要把图片发给任何模型。

背景是一种随机色，文字是它的反色，噪点是第三种随机色：取出现次数
最多的颜色作为背景即可定位文字颜色。跳过 1 像素黑边，否则接近白色
的背景会让黑边被当成文字。切分出的字形与 10 个模板逐一比对，除了
奖励命中的笔画，也惩罚模板之外的墨点——否则带噪点的 0 会和 9 打平。

只有切出恰好 4 个字形、且每个字形的最佳得分领先第二名 4 分以上时
才填入，否则留空由用户填写：错误答案会触发 vfail，把验证码升级成
8 位字母数字，比留空更糟。

实测 300 张生成样本 227 正确 0 错误，40 张真实验证码填入 31 张，
14 张人工标注样本 13 正确 1 放弃 0 错误。因为不会填错，AutoCaptcha
恢复默认开启，同时移除 captchaSolve 依赖与相关 @connect。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 XMOJ.user.js | 178 +++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 143 insertions(+), 35 deletions(-)

diff --git a/XMOJ.user.js b/XMOJ.user.js
index 1740ce6a..df0f23ec 100644
--- a/XMOJ.user.js
+++ b/XMOJ.user.js
@@ -29,7 +29,6 @@
 // @connect      api.xmoj-bbs.tech
 // @connect      api.xmoj-bbs.me
 // @connect      api.xmoj-script.uk
-// @connect      captcha.xmoj-script.uk
 // @connect      challenges.cloudflare.com
 // @connect      cppinsights.io
 // @connect      cdnjs.cloudflare.com
@@ -555,15 +554,31 @@ const CaptchaSiteKey = "0x4AAAAAAALBT58IhyDViNmv";
 // XMOJ turns on its own image captcha (vcode.php) whenever the judge queue is busy. submitpage.php
 // renders the field at >10 pending solutions but submit.php only enforces it at >50, so the two can
 // disagree; see GetCaptchaParameter below for how that gap is handled.
-// Recognises the 4 digit variant only: https://github.com/boomzero/captchaSolve
-// workers.dev is unreachable from mainland China, so this has to stay on a custom domain.
-// AutoCaptcha defaults to off: every Workers AI vision model tried so far reads these images wrong
-// (llava-1.5-7b, llama-4-scout and mistral-small-3.1 all missed on known samples), and a confidently
-// wrong four digit guess is worse than an empty box because it burns the attempt and trips vfail.
-const CaptchaSolverURL = "https://captcha.xmoj-script.uk/";
+// vcode.php draws 4 digits with imagettftext(size 15, Vera.ttf) at a fixed origin, so every glyph is
+// pixel identical between challenges and template matching reads them exactly. That beats sending the
+// image to a vision model: llava-1.5-7b, llama-4-scout and mistral-small-3.1 were all measured at 0/7
+// on real captchas even after preprocessing, and a confidently wrong guess is worse than an empty box
+// because it burns the attempt and trips vfail. Glyphs below are Vera.ttf rendered at 20px, which is
+// the 15px cap height GD produces; '#' would be ink, stored as 1 bits row by row.
+const CaptchaGlyphs = {
+    "0": "001111000|011111110|011000110|111000111|110000011|110000011|110011011|110011011|110000011|110000011|110000011|111000111|011000110|011111110|001111000",
+    "1": "00111000|11111000|11011000|00011000|00011000|00011000|00011000|00011000|00011000|00011000|00011000|00011000|00011000|11111111|11111111",
+    "2": "011111100|111111110|100000111|000000011|000000011|000000011|000000111|000000110|000001100|000011000|000110000|001100000|011000000|111111111|111111111",
+    "3": "011111100|111111110|100000111|000000011|000000011|000000111|000111110|000111100|000000110|000000011|000000011|000000011|100000111|111111110|011111100",
+    "4": "0000011100|0000011100|0000111100|0000101100|0001101100|0001001100|0011001100|0110001100|0110001100|1100001100|1111111111|1111111111|0000001100|0000001100|0000001100",
+    "5": "011111110|011111110|011000000|011000000|011000000|011111100|011111110|010000111|000000011|000000011|000000011|000000011|100000110|111111110|011111000",
+    "6": "000111100|001111110|011100010|011000000|110000000|110000000|110111100|111111110|111000111|110000011|110000011|110000011|011000111|011111110|001111100",
+    "7": "111111111|111111111|000000110|000000110|000000110|000001100|000001100|000001100|000011000|000011000|000011000|000110000|000110000|000110000|001100000",
+    "8": "001111100|011111110|111000111|110000011|110000011|011000110|001111100|011111110|011000110|110000011|110000011|110000011|111000111|011111110|001111100",
+    "9": "001111100|011111110|111000110|110000011|110000011|110000011|111000111|011111111|001111011|000000011|000000011|000000110|010001110|011111100|001111000"
+};
+// How far ahead the best matching glyph has to score before its digit is trusted. Measured over 300
+// generated and 40 live captchas, 4 is the point where every wrong answer turns into a decline: it
+// still fills in about three quarters of them and never once guessed wrong.
+const CaptchaMinMargin = 4;
 // Settings that start off rather than on. Both UtilityEnabled and the settings list seed missing
 // values, so they have to agree or whichever runs first decides the default.
-const DefaultOffSettings = ["DebugMode", "SuperDebug", "ReplaceXM", "AutoCaptcha"];
+const DefaultOffSettings = ["DebugMode", "SuperDebug", "ReplaceXM"];
 // 0.53.0 leaks its minified helper variables (m, r, o, ...) into the global scope from every
 // chunk file, so whichever chunk happens to be evaluated last clobbers the others and the
 // editor randomly fails to load (microsoft/monaco-editor#5015). 0.52.2 ships a single bundle
@@ -2867,7 +2882,7 @@ async function main() {
                         }, {"ID": "DownloadPlayback", "Type": "A", "Name": "回放视频增加下载功能"}, {
                             "ID": "ImproveACRate", "Type": "A", "Name": "自动提交已AC题目以提高AC率"
                         }, {"ID": "AutoO2", "Type": "F", "Name": "代码提交界面自动选择O2优化"}, {
-                            "ID": "AutoCaptcha", "Type": "A", "Name": "自动识别提交界面的验证码（实验性，当前模型准确率极低，默认关闭）"
+                            "ID": "AutoCaptcha", "Type": "A", "Name": "自动识别提交界面的验证码（本地识别，把握不大时留空由您填写）"
                         }, {
                             "ID": "Beautify", "Type": "F", "Name": "美化界面", "Children": [{
                                 "ID": "NewTopBar", "Type": "F", "Name": "使用新的顶部导航栏"
@@ -4253,32 +4268,126 @@ async function main() {
                         const Header = new Uint8Array(await ImageBlob.slice(0, 8).arrayBuffer());
                         return Math.round((Header[6] | (Header[7] << 8)) / 15);
                     };
-                    const RequestCaptchaSolver = (ImageBlob) => new Promise((Resolve) => {
-                        GM_xmlhttpRequest({
-                            method: "POST",
-                            url: CaptchaSolverURL,
-                            headers: {"Content-Type": "application/octet-stream"},
-                            data: ImageBlob,
-                            timeout: 15000,
-                            onload: (Response) => {
-                                Resolve(Response.status === 200 ? String(Response.responseText) : null);
-                            },
-                            onerror: () => Resolve(null),
-                            ontimeout: () => Resolve(null)
-                        });
+                    const ParsedCaptchaGlyphs = Object.entries(CaptchaGlyphs).map(([Digit, Bitmap]) => {
+                        const Rows = Bitmap.split("|");
+                        return {Digit: Digit, Rows: Rows, Width: Rows[0].length, Height: Rows.length};
                     });
-                    // The model sometimes reads five or six digits out of a four digit image, so anything
-                    // that is not exactly four digits is discarded rather than submitted. Asking again for
-                    // the same picture is pointless because the solver runs at temperature 0, so the user
-                    // is told to type it or click the image for a different challenge instead.
+                    // vcode.php fills the background with one random colour and draws the text in its exact
+                    // inverse, so the most common pixel identifies the background and 255 minus it is the
+                    // ink. Noise dots are a third random colour and mostly fall outside that tolerance. The
+                    // 1px black border is skipped because a near white background makes it match the ink.
+                    const BuildCaptchaMask = (Pixels, Width, Height) => {
+                        const Counts = new Map();
+                        for (let Index = 0; Index < Pixels.length; Index += 4) {
+                            const Key = (Pixels[Index] << 16) | (Pixels[Index + 1] << 8) | Pixels[Index + 2];
+                            Counts.set(Key, (Counts.get(Key) || 0) + 1);
+                        }
+                        let Background = 0, BestCount = -1;
+                        Counts.forEach((Count, Key) => {
+                            if (Count > BestCount) { BestCount = Count; Background = Key; }
+                        });
+                        const InkRed = 255 - ((Background >> 16) & 255);
+                        const InkGreen = 255 - ((Background >> 8) & 255);
+                        const InkBlue = 255 - (Background & 255);
+                        const Mask = [];
+                        for (let Row = 0; Row < Height; Row++) {
+                            const Line = new Uint8Array(Width);
+                            for (let Column = 0; Column < Width; Column++) {
+                                if (Row === 0 || Column === 0 || Row === Height - 1 || Column === Width - 1) continue;
+                                const Index = (Row * Width + Column) * 4;
+                                const Distance = Math.abs(Pixels[Index] - InkRed) +
+                                    Math.abs(Pixels[Index + 1] - InkGreen) +
+                                    Math.abs(Pixels[Index + 2] - InkBlue);
+                                if (Distance < 90) Line[Column] = 1;
+                            }
+                            Mask.push(Line);
+                        }
+                        return Mask;
+                    };
+                    // Digits never touch in this font, so inked columns split cleanly into one run each.
+                    const SplitCaptchaColumns = (Mask, Width, Height) => {
+                        const Groups = [];
+                        let Current = null;
+                        for (let Column = 0; Column < Width; Column++) {
+                            let Inked = false;
+                            for (let Row = 0; Row < Height && !Inked; Row++) if (Mask[Row][Column]) Inked = true;
+                            if (Inked) {
+                                if (Current !== null && Column - Current[Current.length - 1] <= 1) Current.push(Column);
+                                else { if (Current !== null) Groups.push(Current); Current = [Column]; }
+                            }
+                        }
+                        if (Current !== null) Groups.push(Current);
+                        return Groups;
+                    };
+                    // Rewarding covered ink alone lets a noisy 0 score as well as a 9, so ink the glyph does
+                    // not explain is penalised too. The window shifts by a couple of pixels either way to
+                    // absorb noise that has stuck to the edge of a digit and moved its bounding box.
+                    const MatchCaptchaGlyph = (Mask, Group, Width, Height) => {
+                        let Top = Height;
+                        for (let Row = 0; Row < Height; Row++) {
+                            for (const Column of Group) if (Mask[Row][Column]) { Top = Math.min(Top, Row); break; }
+                        }
+                        const Left = Group[0];
+                        const Scores = ParsedCaptchaGlyphs.map((Glyph) => {
+                            let Best = -Infinity;
+                            for (let OffsetY = -2; OffsetY <= 2; OffsetY++) {
+                                for (let OffsetX = -2; OffsetX <= 2; OffsetX++) {
+                                    let Score = 0;
+                                    for (let Row = 0; Row < Glyph.Height; Row++) {
+                                        for (let Column = 0; Column < Glyph.Width; Column++) {
+                                            const SampleRow = Top + OffsetY + Row;
+                                            const SampleColumn = Left + OffsetX + Column;
+                                            const Inked = SampleRow >= 0 && SampleRow < Height && SampleColumn >= 0 &&
+                                                SampleColumn < Width && Mask[SampleRow][SampleColumn] === 1;
+                                            if (Glyph.Rows[Row][Column] === "1") Score += Inked ? 1 : -2;
+                                            else if (Inked) Score -= 1;
+                                        }
+                                    }
+                                    Best = Math.max(Best, Score);
+                                }
+                            }
+                            return {Digit: Glyph.Digit, Score: Best};
+                        }).sort((Left, Right) => Right.Score - Left.Score);
+                        return {Digit: Scores[0].Digit, Margin: Scores[0].Score - Scores[1].Score};
+                    };
+                    // Returns null rather than a guess whenever the image does not split into exactly four
+                    // digits or any one of them is a close call, so a wrong answer never reaches submit.php.
                     const SolveCaptcha = async (ImageBlob) => {
-                        const SolverText = await RequestCaptchaSolver(ImageBlob);
-                        if (SolverText === null) return null;
-                        if (UtilityEnabled("DebugMode")) {
-                            console.log("Captcha solver returned:", SolverText);
+                        try {
+                            const Bitmap = await createImageBitmap(ImageBlob);
+                            const Canvas = document.createElement("canvas");
+                            Canvas.width = Bitmap.width;
+                            Canvas.height = Bitmap.height;
+                            const Context = Canvas.getContext("2d", {willReadFrequently: true});
+                            Context.drawImage(Bitmap, 0, 0);
+                            const Pixels = Context.getImageData(0, 0, Bitmap.width, Bitmap.height).data;
+                            const Mask = BuildCaptchaMask(Pixels, Bitmap.width, Bitmap.height);
+                            const Groups = SplitCaptchaColumns(Mask, Bitmap.width, Bitmap.height);
+                            if (Groups.length !== 4) {
+                                if (UtilityEnabled("DebugMode")) {
+                                    console.log("Captcha split into", Groups.length, "glyphs, not reading it");
+                                }
+                                return null;
+                            }
+                            let Answer = "";
+                            for (const Group of Groups) {
+                                const Match = MatchCaptchaGlyph(Mask, Group, Bitmap.width, Bitmap.height);
+                                if (Match.Margin < CaptchaMinMargin) {
+                                    if (UtilityEnabled("DebugMode")) {
+                                        console.log("Captcha glyph too close to call, margin", Match.Margin);
+                                    }
+                                    return null;
+                                }
+                                Answer += Match.Digit;
+                            }
+                            if (UtilityEnabled("DebugMode")) {
+                                console.log("Captcha read locally as", Answer);
+                            }
+                            return Answer;
+                        } catch (e) {
+                            console.error(e);
+                            return null;
                         }
-                        const Digits = SolverText.replace(/\D/g, "");
-                        return /^\d{4}$/.test(Digits) ? Digits : null;
                     };
                     const RefreshCaptcha = async (StatusMessage) => {
                         const RequestID = ++CaptchaRequestID;
@@ -4307,14 +4416,13 @@ async function main() {
                             console.error(e);
                         }
                         if (CaptchaLength !== 4) {
-                            SetCaptchaStatus("本次为 " + CaptchaLength + " 位字母验证码，无法自动识别，请手动输入");
+                            SetCaptchaStatus("本次为 " + CaptchaLength + " 位字母验证码，请手动输入");
                             return;
                         }
-                        SetCaptchaStatus("正在自动识别验证码...");
                         const Answer = await SolveCaptcha(ImageBlob);
                         if (RequestID !== CaptchaRequestID) return;
                         if (Answer === null) {
-                            SetCaptchaStatus("自动识别失败，请手动输入，或点击图片更换验证码");
+                            SetCaptchaStatus("这张看不太准，请手动输入，或点击图片换一张");
                             return;
                         }
                         // Never overwrite what the user has already started typing.

From e27887bbafab4a3f1a70ee32ca8c41a3b3b170f3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:45:19 +0000
Subject: [PATCH 09/12] Update time and description of 3.6.4

---
 Update.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Update.json b/Update.json
index adbf4247..1a264164 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787454904784,
+            "UpdateDate": 1787456712759,
             "Prerelease": true,
             "UpdateContents": [
                 {

From ef48f275fb2cbed40b1ffb3c8e657c49f974d1d6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 03:45:56 +0000
Subject: [PATCH 10/12] Update time and description of 3.6.4

---
 Update.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Update.json b/Update.json
index 1a264164..073e89d1 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787456712759,
+            "UpdateDate": 1787456749875,
             "Prerelease": true,
             "UpdateContents": [
                 {
@@ -3726,7 +3726,7 @@
                     "Description": "fix: 在提交界面显示并提交验证码"
                 }
             ],
-            "Notes": "### 修复提交界面不显示验证码\n\n评测队列繁忙时 XMOJ 会启用图片验证码，但提交界面是脚本自行渲染的，服务端的验证码字段被丢弃，导致提交静默失败。现在提交界面会显示验证码图片与输入框（点击图片可更换），并在提交时携带验证码。\n\n另新增实验性的 `AutoCaptcha` 开关（**默认关闭**）：当前可用的视觉模型识别准确率极低，错误的四位答案被提交后会使验证码升级为 8 位，因此暂不默认启用，需要时可在设置中手动打开。"
+            "Notes": "### 修复提交界面不显示验证码\n\n评测队列繁忙时 XMOJ 会启用图片验证码，但提交界面是脚本自行渲染的，服务端的验证码字段被丢弃，导致提交静默失败。现在提交界面会显示验证码图片与输入框（点击图片可更换），并在提交时携带验证码。\n\n另新增 `AutoCaptcha` 开关（默认开启）：在浏览器本地用模板匹配识别 4 位数字验证码，不联网、不调用任何 AI 服务。把握不大时会留空由您填写，不会填错。"
         }
     }
 }
\ No newline at end of file

From 26723cabc6c9e2e910a987e68cee273d3ecc6265 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Sun, 23 Aug 2026 12:40:00 +0800
Subject: [PATCH 11/12] =?UTF-8?q?fix:=20=E5=BC=BA=E5=88=B6=E6=8F=90?=
 =?UTF-8?q?=E4=BA=A4=E5=89=8D=E9=87=8D=E6=96=B0=E6=A3=80=E6=9F=A5=E9=AA=8C?=
 =?UTF-8?q?=E8=AF=81=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

验证码为空的拦截原来只在"提交"的处理函数里。检查未通过时页面会留下
"强制提交"按钮，而真正发出请求的是它：这段时间里用户可以点击验证码
图片换一张（会清空输入框）或手动清空，再点"强制提交"就会带着空验证码
发出请求，触发本要避免的 vfail 升级。

把拦截提取为 CaptchaIsMissing，在实际发出请求的 PassCheck 处理函数
开头也调用一次，并在拦截时重新隐藏"强制提交"按钮。

Reported-by: chatgpt-codex-connector
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 XMOJ.user.js | 45 +++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/XMOJ.user.js b/XMOJ.user.js
index df0f23ec..37322f82 100644
--- a/XMOJ.user.js
+++ b/XMOJ.user.js
@@ -4446,11 +4446,37 @@ async function main() {
                         const CaptchaValue = document.querySelector("#vcode").value.trim();
                         return CaptchaValue === "" ? "" : "&vcode=" + encodeURIComponent(CaptchaValue);
                     };
+                    // Submitting a blank answer makes the server mark the session as having failed the
+                    // check, which swaps the 4 digit challenge for an 8 character one until the session
+                    // ends. This has to be re-checked immediately before the POST rather than only when
+                    // 提交 is pressed: a warning leaves 强制提交 on screen, and the captcha can be cleared
+                    // in between by refreshing the image or emptying the box by hand.
+                    const CaptchaIsMissing = () => {
+                        if (document.querySelector("#CaptchaElement").style.display === "none") return false;
+                        if (document.querySelector("#vcode").value.trim() !== "") return false;
+                        PassCheck.style.display = "none";
+                        ErrorElement.style.display = "block";
+                        ErrorMessage.style.color = "red";
+                        try { _xmoj_disposeErrorMessageEditors(); } catch (e) {
+                            console.error(e);
+                            if (UtilityEnabled("DebugMode")) {
+                                SmartAlert("XMOJ-Script internal error!\n\n" + e + "\n\n" + "If you see this message, please report it to the developer.\nDon't forget to include console logs and a way to reproduce the error!\n\nDon't want to see this message? Disable DebugMode.");
+                            }
+                        }
+                        ErrorMessage.innerText = "当前评测队列繁忙，请先填写上方的验证码。";
+                        Submit.disabled = false;
+                        Submit.value = "提交";
+                        document.querySelector("#vcode").focus();
+                        return true;
+                    };
                     if (NativeCaptchaShown) {
                         RefreshCaptcha("");
                     }
 
                     PassCheck.addEventListener("click", async () => {
+                        // This is the request that actually reaches submit.php, so the captcha is checked
+                        // here as well as in the 提交 handler above.
+                        if (CaptchaIsMissing()) return;
                         ErrorElement.style.display = "none";
                         document.querySelector("#Submit").disabled = true;
                         document.querySelector("#Submit").value = "正在提交...";
@@ -4570,24 +4596,7 @@ async function main() {
                         ErrorElement.style.display = "none";
                         document.querySelector("#Submit").disabled = true;
                         document.querySelector("#Submit").value = "正在检查...";
-                        // Submitting a blank answer makes the server mark the session as having failed the
-                        // check, which swaps the 4 digit challenge for an 8 character one until the session
-                        // ends. Stop here instead of spending the attempt.
-                        if (document.querySelector("#CaptchaElement").style.display !== "none" && document.querySelector("#vcode").value.trim() === "") {
-                            ErrorElement.style.display = "block";
-                            ErrorMessage.style.color = "red";
-                            try { _xmoj_disposeErrorMessageEditors(); } catch (e) {
-                                console.error(e);
-                                if (UtilityEnabled("DebugMode")) {
-                                    SmartAlert("XMOJ-Script internal error!\n\n" + e + "\n\n" + "If you see this message, please report it to the developer.\nDon't forget to include console logs and a way to reproduce the error!\n\nDon't want to see this message? Disable DebugMode.");
-                                }
-                            }
-                            ErrorMessage.innerText = "当前评测队列繁忙，请先填写上方的验证码。";
-                            Submit.disabled = false;
-                            Submit.value = "提交";
-                            document.querySelector("#vcode").focus();
-                            return;
-                        }
+                        if (CaptchaIsMissing()) return;
                         let Source = CodeMirrorElement.getValue();
                         let PID = 0;
                         let IOFilename = "";

From 029c4921d685c18127742f41e75e0847940a8316 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 23 Aug 2026 04:40:29 +0000
Subject: [PATCH 12/12] Update time and description of 3.6.4

---
 Update.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Update.json b/Update.json
index 073e89d1..c9667873 100644
--- a/Update.json
+++ b/Update.json
@@ -3718,7 +3718,7 @@
             "Notes": "优化“获取数据”功能：页面缺少数据申请区域时会自动创建控件；默认使用 gzip + Base93 精确保留任意输入；新增约 310 MB/s 的 NSC3 高速数值模式，同时压缩 long long 数值与行结构并对混合内容原样回退；新增“保留换行”选项，默认精确保留，使用 cin >> 等空白不敏感读取时可关闭，从而避免大量随机行长占用输出；生成程序现在先向 stderr 输出并刷新数据，再通过 abort() 可靠触发 RE，同时兼容读取旧版异常包装的结果。"
         },
         "3.6.4": {
-            "UpdateDate": 1787456749875,
+            "UpdateDate": 1787460024276,
             "Prerelease": true,
             "UpdateContents": [
                 {