// ==UserScript==
// @name         【伟哥自用】tsmnt 广告净化（弹窗与广告注入拦截）
// @namespace    CB@https://bbs.tampermonkey.net.cn
// @version      1.0.0
// @description  tsmnt.com 去广告：钉死 visits 频控 cookie、按黑名单清扫广告脚本加载链（vdn/hi*-cpv* 弹窗引擎、vdn/gd*.js Monetag 注入、a2+ 广告位、指纹追踪）、跨域 window.open 守卫防 popunder。保留 a1.js（站点导航栏）与原生图片/翻页功能。
// @author       朱焱伟
// @license      MIT
// @match        *://tsmnt.com/*
// @match        *://*.tsmnt.com/*
// @run-at       document-start
// @noframes
// @grant        none
// ==/UserScript==

/*
 * Background (reverse-engineered 2026-10, evidence in analysis/):
 *
 * 1. Ad serving is layered behind a frequency gate: js/dh.js counts visits in a
 *    `visits` cookie (incremented every pageview), and the actual ad loaders
 *    check it before firing:
 *      - js/vtj.js -> (desktop) js/pc.js -> on paginated pages, when visits>3,
 *        randomly loads vdn/hi1-4.js (even visits) or vdn/cpv1-4.js (odd
 *        visits). These are the click-triggered popup engines: clicking
 *        "next page" (or anything) randomly opens a new ad page.
 *      - cdn/pic.js -> (desktop) vdn/gd.js -> when visits>4, injects a
 *        gummy-debt.com script (Monetag-family popunder).
 *      - vdn/gds.js (visits>4), tsmnt/a2+a4+a5+a6+a8.js: banner/placeholder
 *        ad slots and trackers.
 *      - tsmnt/a8.js additionally loads js/dh.js, js/vtj.js and js/fp.js
 *        (FingerprintJS) and reports a tracking pixel to xs.255155.xyz.
 * 2. EXCEPTION: tsmnt/a1.js writes the SITE NAVIGATION (.nav#navh) plus three
 *    empty ad placeholder spans - it must stay. Only a2+ are pure ad slots.
 * 3. Images and pagination are plain <img>/<a> in the static HTML; no gallery
 *    script is required for normal browsing.
 *
 * Strategy (four independent layers):
 *   L1 Cookie pin: set `visits=0` at document-start. Every ad loader reads
 *      this cookie before firing, so all gates stay shut even if a loader
 *      script slips through the sweep.
 *   L2 Script sweep: MutationObserver (debounced full-document sweep)
 *      removes <script> nodes whose src matches the ad-loader blacklist
 *      below (regexps scoped to the site's JS domain, so mirror-domain
 *      rotation of js.<host> is covered automatically).
 *   L3 Popup guard: wrap window.open; drop cross-origin popups (ad landing
 *      pages are always cross-origin; the site navigates via native anchors).
 *   L4 note: a8's tracking pixel/fingerprint chain dies with the a8 kill;
 *      side effects of the sweep: the favorites (scj.js via dh.js) and the
 *      translate widgets (also loaded by dh.js) are lost - acceptable
 *      trade-off, documented in README.
 *
 * Maintenance:
 *   - New ad loader paths: add a regexp to BLACKLIST (paths are relative to
 *     any js.<host> domain).
 *   - If the nav menu disappears one day, the site probably moved it out of
 *     a1.js - then switch a1 to the blacklist too (or drop the KEEP rule).
 *   - Mirror domains: add @match.
 */

(function () {
    'use strict';

    var TAG = '[tsmnt净化]';

    /* ====================== Config ====================== */

    // Ad-loader blacklist. Matched against the absolute URL of each <script src>.
    // Site-relative patterns apply to any js.<host> mirror automatically.
    var BLACKLIST = [
        // ad slot family under /tsmnt/ (a2 onwards; a1.js is the site nav - keep)
        /\/tsmnt\/a[2-9][0-9]*\.js(?:[?#]|$)/,
        // frequency-gated popup engines and Monetag loader (visits-gated)
        /\/vdn\/gds?\.js(?:[?#]|$)/,
        /\/vdn\/(?:hi|cpv)[0-9]+\.js(?:[?#]|$)/,
        // loader chain: vtj->pc.js rotator, dh visit counter, fingerprint
        /\/js\/(?:vtj|pc|dh|fp)\.js(?:[?#]|$)/,
        // gallery + mobile loaders feeding the ad chain
        /\/cdn\/(?:pic|lam)\.js(?:[?#]|$)/,
        /\/sa\/mcpc[0-9]*\.js(?:[?#]|$)/,
        // third-party popunder engine injected by gd.js (Monetag-family)
        /gummy-debt\.com\//i,
    ];

    // Frequency-gate cookie read by gd.js (>4), pc.js (>3), vtj.js/lam.js (>1)
    var GATE_COOKIE = 'visits';

    /* ====================== L1: pin the gate cookie ====================== */

    // document-start: runs before any site script reads the cookie. dh.js is
    // swept anyway, so nothing re-increments it during the page's lifetime.
    document.cookie = GATE_COOKIE + '=0; path=/; max-age=86400';

    /* ====================== L2: script sweep ====================== */

    function isBlockedUrl(url) {
        if (!url) return false;
        var abs;
        try { abs = new URL(url, location.href).href; } catch (e) { return false; }
        for (var i = 0; i < BLACKLIST.length; i++) {
            if (BLACKLIST[i].test(abs)) return true;
        }
        return false;
    }

    function sweep(root) {
        var removed = 0;
        var scripts = root.querySelectorAll('script[src]');
        for (var i = scripts.length - 1; i >= 0; i--) {
            if (isBlockedUrl(scripts[i].getAttribute('src'))) {
                scripts[i].remove();
                removed++;
            }
        }
        return removed;
    }

    // Debounced full-document sweep. (Sweeping only addedNodes' subtrees can
    // miss nodes inserted inside containers - same lesson as ninook-ad-shield.)
    var scheduled = false;
    var mo = new MutationObserver(function () {
        if (scheduled) return;
        scheduled = true;
        setTimeout(function () {
            scheduled = false;
            var n = sweep(document);
            if (n) console.log(TAG, 'swept', n, 'ad script(s)');
        }, 100);
    });
    mo.observe(document.documentElement, { childList: true, subtree: true });

    if (document.documentElement) {
        var n0 = sweep(document);
        if (n0) console.log(TAG, 'startup sweep:', n0, 'ad script(s)');
    }

    /* ====================== L3: popup guard ====================== */

    var origOpen = window.open.bind(window);

    window.open = function (url) {
        try {
            var u = new URL(url || 'about:blank', location.href);
            // Only same-origin popups pass; ad landing pages are always cross-origin
            if (u.origin !== location.origin) {
                console.log(TAG, 'blocked cross-origin popup:', u.href);
                return null;
            }
        } catch (e) {
            return null;
        }
        return origOpen.apply(null, arguments);
    };

    console.log(TAG, 'v1.0.0 enabled');
})();

// http://www.tsmnt.com/yuan/tuntu/20350503/308441.html