grasp-rat-bot

KO | EN

gitlite — search

#csharp #llm #editor #javascript #machine-learning #git #deep-learning #codex #mcp #docker

(★ 9)

No description available.

File Explorer

ZIP Download

- .gitignore
- analyze-logs.js
- cleanup-logs.js
- daily-summary.js
- package.json
- replay-combat.js
- server.js
- watchdog-config.example.json
- watchdog-dry-run-replay.js
- watchdog-smoke.js
- watchdog.js
- browserless-runner.env.example
- browserless-runner.service
- grasp-rat-remote-bot.js
- manifest.json
- target-whitelist.json
- - icon-128.png
  - icon-16.png
  - icon-32.png
  - icon-48.png
  - tuntunshu.svg
- background.js
- content-bridge.js
- manifest.json
- page-bootstrap.js
- popup.css
- popup.html
- popup.js
- grasp-rat-headless-demo.service
- server.js
- start-demo.sh
- activate-browserless-release.sh
- audit-runtime-log-fixes.js
- benchmark-browserless-hot-path.js
- benchmark-login-success-state-patch.js
- browserless-acceptance-report.js
- browserless-action-parity-audit.js
- browserless-canary-audit.js
- browserless-combat-regression.js
- browserless-deployment-audit.js
- browserless-import-state.js
- browserless-log-summary.js
- browserless-runner.js
- browserless-test-migration-audit.js
- build-browserless-release.js
- build-remote-bot-bundled.js
- build-remote-bot.js
- build-runtime-helper-entry.js
- coin-balance-report.js
- deploy-browserless-release.sh
- install-browserless-release.sh
- install-browserless-runner-service.sh
- iteration-timing.js
- objective-status.js
- reconcile-browserless-today-stats.js
- remote-bot-bundle.js
- render-extension-icons.js
- replay-browserless-runtime-log.js
- replay-combat-optimization-candidates.js
- verify-browserless-release.js
- verify-browserless-runner-start.js
- verify-evasive-aim-model.js
- verify-objective-build.js
- watchdog-heartbeat-runtime-self-test.js
- - page-global-core.js
  - runtime-entry.js
  - runtime-helper-entry.mjs
- - run-self-test.js
- - browser-preserved-state.js
  - daily-stamina-window.js
  - display-format.js
  - exit-summary.js
  - grz-frame.js
  - leave-response.js
  - runtime-defaults.js
  - runtime-utils.js
  - target-whitelist.js
- - action-arbitration.js
  - action-priority.js
  - action-switch-diagnostics.js
  - active-threat-avoidance.js
  - afk-fire-policy.js
  - attack-worth.js
  - center-activity-afk.js
  - center-activity-boundary.js
  - chase-mode.js
  - coin-competition.js
  - coin-diagnostics.js
  - coin-motion.js
  - coin-progress.js
  - coin-route.js
  - coin-target.js
  - combat-aim.js
  - combat-attack-clock.js
  - combat-bullet-reachability.js
  - combat-constants.js
  - combat-economic-stop-loss.js
  - combat-exit.js
  - combat-fire-discipline.js
  - combat-hp-loss-attribution.js
  - combat-movement-ownership.js
  - combat-movement.js
  - combat-pressure.js
  - combat-response-policy-shadow.js
  - combat-shot-coverage.js
  - combat-target-selection.js
  - drop-matched-kill.js
  - dual-target-cover.js
  - dual-target-policy.js
  - dynamic-whitelist-safety.js
  - eight-way-route-eta.js
  - evasive-aim-experiment.js
  - evasive-aim-model.json
  - exit-motion.js
  - final-candidate-selection.js
  - integration-helpers.js
  - invulnerability-time.js
  - invulnerable-afk-self-test.js
  - invulnerable-approach-window.js
  - invulnerable-profit-selection.js
  - leave-command.js
  - login-point-relogin-shortcut-self-test.js
  - login-point-relogin-shortcut.js
  - loot-race-positioning.js
  - migration-examples.js
  - opponent-behavior.js
  - opportunity-candidates.js
  - opportunity-choice.js
  - opportunity-clear.js
  - opportunity-constants.js
  - opportunity-pick.js
  - outside-center-idle.js
  - patrol.js
  - pending-exit.js
  - player-profit-score.js
  - post-attack-drop.js
  - post-kill-settlement.js
  - profit-escort.js
  - profit-kill-race.js
  - profit-mission-arrival.js
  - profit-target-distance-correction.js
  - profit-threshold.js
  - recovery-contact-guard.js
  - recovery-profit-priority.js
  - remote-profit-targets-self-test.js
  - remote-profit-targets.js
  - self-test.js
  - single-coin-bait.js
  - stamina-budget.js
- grasp-rat-bootstrap.user.js
.env.example
.gitattributes
.gitignore
cdp-relay.ps1
grasp-rat-bot.js
grasp-rat-debug-api.js
grasp-rat-monitor.js
grasp-rat-stop.js
package-lock.json
package.json
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

This repository contains the browser-side automation scripts for `https://grasp-rat-game.h-e.top/`.

The primary runtime uses a small bootstrap script A plus the shared remote bot script B. Script A can run either as Tampermonkey or as the Chrome extension in this repo:

- `userscript/grasp-rat-bootstrap.user.js` is script A. Install it in the user's normal Chrome. It checks the manifest every 10 seconds, verifies the remote bot hash, injects the bot, and hot-updates without stopping a working old bot when download or verification fails.
- `extension/` is the Chrome extension version of script A. Load this directory as an unpacked extension in Chrome.
- `dist/grasp-rat-remote-bot.js` is script B. It is generated from the modular browser runtime and contains the game strategy plus native page WebSocket control.
- `dist/manifest.json` points A at B and includes the SHA-256 hash A must verify before injection.
- `dist/target-whitelist.json` is the retained creator-protection artifact. The maintained browserless runner treats only stable user ID `28886` as the creator, so later display-name changes do not alter protection. The separately persisted browserless dynamic whitelist is managed from the local status panel and is not stored in this repository. The frozen browser runtime retains its historical username-only reader but is no longer the maintained consumer.

The older CDP entry points remain available in `grasp-rat-bot.js` as a fallback, but normal use should prefer bootstrap injection through Tampermonkey or the extension.

Do not run the Tampermonkey A and extension A in the same Chrome profile at the same time. They share the same B script and page panel. If both are enabled, the extension detects the Tampermonkey bootstrap marker and disables itself so Tampermonkey wins.

## Install Script A

### Chrome Extension

1. Clone this repository.
2. Open `chrome://extensions`.
3. Enable Developer mode.
4. Click "Load unpacked" and select the `extension/` directory, not the repository root.
5. Click the extension button. If one game tab exists, the extension records its tab id. If no game tab exists, click "打开游戏". If multiple game tabs exist, close extras before continuing.

The extension uses the same `dist/manifest.json` and `dist/grasp-rat-remote-bot.js` as the Tampermonkey bootstrap. Strategy-only B updates still happen through the remote manifest poll; the extension itself only needs reloading when extension/bootstrap A code changes. The extension icon source is `extension/icons/tuntunshu.svg`, copied from the user's `D:\Downloads\囤囤鼠.svg`; PNG extension icon sizes are generated by `node scripts/render-extension-icons.js`.

### Tampermonkey

1. Install Tampermonkey in normal Chrome.
2. Open `userscript/grasp-rat-bootstrap.user.js` and install it.
3. Open `https://grasp-rat-game.h-e.top/` in normal Chrome.

If an older bootstrap is already installed, update or reinstall script A to at least `0.4.0`. Earlier `0.3.x` source changes accidentally kept the Tampermonkey metadata version at `0.3.0`, so Tampermonkey may not auto-update A even though the repository changed.

By default the bootstrap loads:

```text
https://raw.githubusercontent.com/ZeroJehovah/grasp-rat-bot/main/dist/manifest.json
```

The bootstrap polls every 10 seconds. On refresh, navigation, relogin, or page recovery, Tampermonkey runs again and fetches the latest verified manifest before falling back to cache. It also runs a one-second watchdog: if the page bot is missing, stopped, stale, or on the wrong manifest hash, it reinstalls from verified source. Version `0.3.5` refuses cached remote bot builds that contain bot-owned game WebSocket creation or page reconnect calls.

Version `0.3.6` fixes a refresh-time bootstrap race: script A no longer waits forever for script B's startup promise, and script B registers `window.__graspRatBot` before waiting on `/snapshot` or `/minimap`. Those page data requests are now timeout-bounded, so a slow page refresh cannot leave the bootstrap stuck in `installing` without future manifest polls.

Version `0.3.7` changes script A's page-context injection path to prefer Tampermonkey `GM_addElement(script)`. This covers pages where normal inline script insertion is blocked by CSP or browser extension policy even though the bootstrap userscript itself is enabled.

Version `0.3.8` changes script B strategy only. If the same unsafe player keeps pressuring the bot for about 5 minutes, the bot leaves the game, stops local movement, suppresses relogin for 30 seconds, then lets the normal login flow resume. The overlay and status include the current pursuit target, duration, and pursuit-leave wait state.

Version `0.3.9` changes script B strategy only. The bot now merges page-native coin drops with `/snapshot` `coin_drops`, uses the snapshot to navigate directly toward known coin areas when no higher-priority local/safety action exists, and removes the old open-area patrol fallback. If no native or fresh snapshot coin is available, it waits for the next snapshot instead of cruising randomly.

Version `0.4.0` changes both script A and script B. At full HP, the bot no longer actively avoids or approaches players and keeps collecting coins. Moving, active, or firing enemies inside attack range trigger combat: the bot shoots more frequently, dodges incoming bullets along a random tangent, aims exactly at stationary targets, and adds small aim jitter for moving targets. In combat, if own HP is below 50 and below the target HP, the bot leaves. Static AFK players with `Drop > 0` inside shooting range are shot opportunistically without switching to combat, while coin movement remains the primary movement target when coins exist. After a recent fight, dropped coins with amount greater than 1 are picked before returning to recovery wait. Script A and the monitor also avoid starting LinuxDO login while the page still has token/self/in-game state unless a leave was issued first.

Version `0.4.1` changes script B strategy and overlay only. AFK `Drop=x` targets now compete in the main opportunity score as the same value as `x` coins; equal-score ties prefer the AFK Drop target, while higher-value coins can still win. Shooting or approaching those AFK Drop targets is not marked as combat. The top-right overlay also shows the current remote bot version and the first 8 characters of the verified source hash, so manifest updates are visible in game.

Version `0.4.7` moves the top-right overlay to script A. The panel is visible on game pages even before the remote bot is injected, shows manifest/script fetch and install/cache status, and includes a pause/resume button. While paused, script A still fetches and verifies remote updates into cache but does not inject/reinstall the bot or start login, and script B stops sending movement/attack control so manual control is possible. Injury, combat disadvantage, and sustained-pursuit exits now suppress relogin for a random 1-3 minute enemy-leave wait before normal login resumes.

Version `0.4.10` hardens the remaining bootstrap and remote tick entry points. Script A wraps startup, watchdog, polling, callback, authorize, and panel timers so unexpected errors are recorded instead of becoming uncaught userscript interval errors. Script B routes timer/native tick scheduling through a safe promise wrapper, so edge failures in tick finalization or status reporting are retained in `bot.errors` and visible status instead of surfacing as unhandled promise rejections. Version `0.4.8` fixed pause synchronization so panel refreshes no longer repeatedly call script B's pause handler or interfere with manual control.

When the game page is not logged in, the bootstrap and remote bot try `startLinuxDoLogin()` or the visible login/join control. On the LinuxDO OAuth authorize page, the bootstrap waits 10 seconds before clicking the allow/authorize control, so it acts only as a fallback behind the user's primary authorization script.

After login starts or the OAuth authorize/callback page is seen, the bootstrap suppresses another login attempt for 45 seconds. This prevents a just-authorized page from bouncing back into LinuxDO before the game writes token/self state. If the bot is already in game but page WebSocket control stays offline for more than 3 seconds, the remote bot attempts `leave(userId)` or `#leaveBtn` before any reload fallback.

Remote bot WebSocket reconnects are page-owned. The Tampermonkey remote bot does not call page `connectWs()` / `scheduleReconnect()` and does not create its own fallback `wss://.../ws` connection; these switches are hard-disabled even if runtime config tries to enable them. If native page WebSocket state is unavailable or disconnected, the bot observes that state, stops local movement, and leaves after the configured offline window instead of creating extra sockets.

If the overlay disappears and `[grasp-rat-bot] started live control` prints again, that means the bootstrap watchdog replaced or reinstalled the page bot because it was missing, stopped, stale, or on an older manifest. It is not a bot-owned WebSocket reconnect. For the stale-cache, refresh-startup, and CSP-safe injection fixes, script A must be updated to `0.3.7`; future strategy-only script B changes update through the manifest poll.

Static full-stamina `Active` entities are treated as ordinary targets instead of active threats. Moving or non-full-stamina `Active` entities still trigger avoidance, but avoidance distances are narrower than the old bootstrap `0.2.x` build so the bot stops fleeing far across the map.

## Combat Logs

The bootstrap can send detailed combat-window logs to the local collector in `combat-log-service/`. The panel logging control stays hidden until a log endpoint has been configured from the game page console.

Start the local service:

```bash
cd combat-log-service
npm start
```

Configure the endpoint and enable logging from the game page console:

```js
window.__graspRatBotBootstrap.configureCombatLogging({
  enabled: true,
  endpoint: 'http://127.0.0.1:18765/combat-log'
})
```

Disable it:

```js
window.__graspRatBotBootstrap.configureCombatLogging({ enabled: false })
```

The setting is persisted by the active bootstrap. Once an endpoint has been configured, the compact panel shows the logging dot so logging can be toggled without returning to the console. Logs are written as split JSONL under `combat-log-service/logs/YYYY-MM-DD/<kind>/<combatId>.jsonl`, usually `combat`, `important`, `audit`, or `misc`. The bot records roughly 10 seconds before combat, every combat tick, and roughly 10 seconds after combat. Entries include the final decision, exit reason, self/target HP, nearby entities, incoming bullets, pursuit/injury context, control state, and snapshot ages. Entity and bullet lists are capped so normal fights should be MB-scale rather than unbounded full-page dumps.

The collector runs detailed-log cleanup on startup and then daily at local `03:30`, keeping only the latest 3 local date directories of detailed `combat`/`misc` JSONL and legacy flat combat JSONL. Summary material such as `important` and `audit` is retained for daily reports and exit audits. In the maintainer workspace, generated Markdown reports are written to the adjacent private documentation repository under `../docs/reports/YYYY-MM/`; other deployments can pass an explicit output path. Manual cleanup is available with:

```bash
cd combat-log-service
npm run cleanup
npm run cleanup -- --dry-run
```

## Development Surfaces

Use the current source layout when changing behavior.

- `src/strategy/` contains pure strategy cores and their self-tests. Put reusable scoring, action arbitration, target-switch, coin, stamina, and combat policy helpers here when they can be tested without a browser.
- `src/browser/runtime/` contains browser runtime domain integration: state binding, control flow, native transport, profit, combat, logging, UI, and orchestration modules.
- `src/browser/runtime-entry.js` is the single browser runtime entry bundled by esbuild. It should stay a composition entry and should not regain domain bodies.
- `grasp-rat-bot.js` is the Node/CDP fallback and local CLI wrapper. It delegates self-tests and runtime bundling; normal strategy or runtime changes should not be added there.
- `userscript/` and `extension/` contain script A/bootstrap code. Change both surfaces unless a bootstrap change is explicitly Tampermonkey-only or extension-only.

## Build Script B

After changing `src/strategy/`, `src/browser/runtime/`, `src/browser/runtime-entry.js`, or runtime config that affects script B, regenerate the remote bot and manifest:

```bash
node scripts/build-remote-bot.js
```

Use an explicit version when needed:

```bash
node scripts/build-remote-bot.js --version 20260608-remote-loader
```

Then commit and push the changed source plus `dist/grasp-rat-remote-bot.js` and `dist/manifest.json`. Installed bootstrap scripts will pick up the new manifest on the next poll.

When changing script A behavior, update both `userscript/grasp-rat-bootstrap.user.js` and the Chrome extension bootstrap files under `extension/` unless the change is explicitly Tampermonkey-only or extension-only.

## Local Development Loader

Script-side debug event posting has been removed. Use CDP for runtime inspection. If you deliberately serve a local `dist/` manifest from your own static server, switch the bootstrap manifest URL through the page API:

```js
window.__graspRatBotBootstrap.setManifestUrl('http://127.0.0.1:18777/bot/manifest.json')
```

To switch back to GitHub:

```js
window.__graspRatBotBootstrap.setManifestUrl('https://raw.githubusercontent.com/ZeroJehovah/grasp-rat-bot/main/dist/manifest.json')
```

If Windows Chrome cannot reach WSL through `127.0.0.1`, use the WSL IP instead and update the URL accordingly.

## Validation

Run these checks before pushing strategy or runtime changes:

```bash
node --check grasp-rat-bot.js
node --check scripts/build-remote-bot.js
node --check scripts/render-extension-icons.js
node --check scripts/verify-objective-build.js
node --check scripts/objective-status.js
node --check userscript/grasp-rat-bootstrap.user.js
node --check extension/background.js
node --check extension/content-bridge.js
node --check extension/page-bootstrap.js
node --check extension/popup.js
node --check combat-log-service/cleanup-logs.js
node --check combat-log-service/server.js
node grasp-rat-bot.js --self-test
node scripts/objective-status.js --self-test
node scripts/build-remote-bot.js
node scripts/verify-objective-build.js
node scripts/objective-status.js --fail-on-incomplete
```

`verify-objective-build.js` is a static release check. It verifies that `dist/manifest.json` matches the generated remote bot hash/current source, that key objective constants are present in source and dist, and that bootstrap layout/source-hash/compact-panel/post-login zoom invariants are still present. It does not replace fresh `combat-log-service` current-version live validation.

`objective-status.js` combines the static verifier with current-version objective log validation. It reports which objective requirements are proven and exits non-zero with `--fail-on-incomplete` until fresh matching logs include required exit, Active-in-range combat, and HP-disadvantage exit evidence.

## CDP Fallback

The old CDP fallback commands still exist:

```bash
node grasp-rat-bot.js
node grasp-rat-bot.js --status
node grasp-rat-bot.js --diagnose
node grasp-rat-stop.js
```

Use them only for deliberate debugging. The primary injection path is the Tampermonkey bootstrap.

grasp-rat-bot

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README