anti-visibility cloak - v1.2.1 patch notes

• fix: sliders/thumbs sticking to the cursor when clicking away. cause was the page-realm injector swallowing focusout on global targets, which many ui libs use to end drag/active state.

• change: in page-realm patch, only treat blur as a “global blur.” focusout is no longer blocked at document/window/html/body/visualViewport.

• config respect: injector now honors CONFIG.focus.blockGlobalBlur (main-realm toggle applies in page realm).

• unchanged: exit/enter-intent protections (mouseleave/pointerleave and mouseenter/pointerover rules), visibility prop forcing, and synthetic mouse presence.

• impact: styled sliders (mui/radix/etc.) no longer stick; anti-visibility behavior preserved.

anti-visibility cloak - changelog (v1.1 → v1.2)

highlights

• stronger blur/focusout protection: blocks global blur/focusout registration & invocation (window/document/html/body/visualViewport).
• page-realm coverage: mirrors core patches inside the page’s own JS realm.
• cleaner config: grouped, commented options without breaking behavior.

added

• focus.blockGlobalBlur option to swallow global blur/focusout.
• pageRealmPatch (default true) to inject patches in the page realm.
• patchTimers (opt-in) to smooth requestAnimationFrame / requestIdleCallback under throttling.
• patchPointerCapture (default true) to soften pointer-capture-based exit-intent.
• secureRandomString() for crypto-safe IDs used by the API.
• Randomized window API name (__${random}) and randomized method names each load.
• Support for EventListener objects ({ handleEvent() {} }) in listener wrapping.
• Extra events covered: focusin, focusout, pointermove.
• Property-style handlers wrapped: onvisibilitychange, onblur, onfocus, onfocusin, onfocusout, etc.
• visualViewport treated as a global-ish target.
• Optional stealthier notifications: notify.burstWindowMs, notify.silentBootMs.
• Metrics via STATS and (randomized) API: stats(), reapply().
  • Metrics seem to be broken; they will be fixed in a future update

changed

• CONFIG reorganized for readability; keys preserved to avoid breakage.
• Exit/enter-intent filtering generalized via asGlobalLike() (window/document/html/body/visualViewport).
• Mouse presence simulation: optional interval jitter; optional paired pointermove.
• Window focus()/blur() no-op (with optional hardening in strictMode).
• Initial lifecycle ping now dispatches visibilitychange and pageshow.

hardened

• Listeners are wrapped at add time and invoke time; global blur/focusout are blocked both ways.
• strictMode can harden descriptors (configurable:false) to prevent overwrites/changes by the website.
• Paranoid re-apply loop (when paranoidMode:true) to resist hostile redefinitions.
• Pointer capture wrappers ignore global-ish captures on html/body.

dev notes

• The randomized API key + method map is logged once to the console:
  • console.info('[AVC] api key:', 'window.__XXXXXXXXXXXXXX', 'methods:', { ... })
  • Remove that line if you want zero console output.
• notify.addListener.* / notify.invoke.* defaults tuned to reduce toast noise.

update tips (from v1.1)

• To keep behavior closest to v1.1, leave patchTimers:false, paranoidMode:false, strictMode:false.

• added mouse enter-event spoofing:

  • now blocks mouseover, mouseenter, and pointerover when fired globally with relatedTarget === null
  • allows only one initial global enter after load (configurable with initialEnterOnce)

• extended CONFIG.notify to cover mouse enter/over events for both addListener and invoke

• new config flags under CONFIG.mouse:

  • blockGlobalEnter: swallow global enter events
  • initialEnterOnce: permit exactly one global enter log, then suppress further ones

• improved event wrapper logic:

  • detects and swallows global enter events just like global leave events
  • sends notifier messages when enter events are blocked

• updated patchAEL to also block registration of global enter-intent listeners