P-Adamiec/Free-Games-Claimer-Remaster v1.7

on GitHub

Added

• Unity Asset Store weekly free asset (src/stores/unity.py) – claims the free Publisher of the Week asset. Opt-in: add unity to STORES, set UNITY_EMAIL/UNITY_PASSWORD. Unity's checkout starts on "exempt from consumption tax: yes", which silently blocks the coupon, so the bot answers No when no tax number is set, pays only a zero total, and asks over VNC for missing billing data.

Changed

• AliExpress diagnostics arrive on the first failure – the dump of what is actually on the page ran only after every retry was exhausted, so a bug report never contained the one line that identifies the problem. It now runs the moment no check-in button is recognised, and waiting is reserved for a real bot flag.
• GamerPower now runs by default – Epic advertises two free games a week, and its feed regularly lists several more that are free on the same account right now. gamerpower joined DEFAULT_STORES in main.py, last in the order so the stores with their own module claim first. Fanatical, Itch.io, IndieGala, Alienware and unknown sites still need their own *_ENABLE switch.
• GamerPower only claims on the stores you actually run – it delegated to Steam, Epic and GOG whatever your STORES said, so STORES=steam,gamerpower claimed Epic games you never asked for. The new src/core/selection.py records the run's stores and _claim_major_store_batch() skips the rest, naming each skip in the log. Choosing gamerpower on its own restricts nothing.
• One browser per store, not one per game – GamerPower opened, signed into and closed a fresh Chrome for every single giveaway: five Epic entries meant five launches and four sign-ins. run() in gamerpower.py now resolves the whole feed first, then claims each store's games in one session, and its own browser starts only when a side site has work. A live dry run went from 5 launches to 1.

Fixed

• A Google reCAPTCHA checkbox counted as a normal page – _human_challenge_present() in claimer.py knew Cloudflare, hCaptcha and Arkose but not reCAPTCHA, so Fanatical answering a correct password with "we just need to check that you're a real person" looked like a plain login failure. Only a visible challenge frame counts, never the silent scoring one every shop keeps on its pages, and Itch.io and Fanatical now watch for one during the claim too, not only at sign-in.
• Fanatical could never sign in, and claimed nothing while reporting success – it typed the address into the site search (the first visible text box) and looked for a password field that only exists once the header modal opens, then set claimed = True regardless of what the page said. Login now drives that modal (#emailInput, #passwordInput), credentials stop being pasted into JavaScript, and a claim counts only once the button is gone or the page says so.
• GamerPower judged every side-store giveaway on the previous one's page – the check if "itch.io" not in current_url skipped navigation whenever the browser already sat on that site, so games two onwards inherited the first page's state and five were recorded as owned that the account never had. All four spots now compare the whole address, and a dry run no longer writes to the database.
• Itch.io giveaways were reported as claimed without ever being claimed – the bot clicked "Download or claim", then "No thanks, just take me to the downloads", and called it a win. That path only opens a download; the game never reaches your library. It now walks on to the Claim game button and reports claimed only once itch.io shows the game as owned.
• Side-store messages drifted from the rest of the project – Alienware carried its explanation inside the entry title and a manual status no other store uses, the VNC prompt said sign-in needs you rather than login needs you, never used 2FA code needed, and no side store logged which account it signed in as. GamerPower also never set store_name, so NOTIFY_SKIP_STORES=gamerpower silenced nothing. All of it matches Epic, Fab and Ubisoft now.
• Side-store sign-ins failed in silence, two-factor included (#32) – Itch.io, Fanatical and IndieGala typed the password, slept a few seconds and carried on unchecked, so a code screen ended as "Could not click 'Claim'". They confirm the session now and hand a code screen to you over VNC. Authenticator secrets are never stored; only Itch.io recovery codes are automated (ITCHIO_OTP_ENABLE, ITCHIO_OTP_CODES).
• AliExpress spent half an hour on a coin page that had not rendered (#33) – the page often arrives as an empty shell, which aliexpress.py treated as a bot flag: three waits of nine minutes per run. It flips fast (one usable page in eight looks over four minutes), so the bot now walks back to it AE_PAGE_RETRIES times, four by default, and a run fell from 28 minutes to under three.
• The check-in was readable in English and Polish only – button labels were matched by text, so any other AliExpress language reported "widget did not render", sat through three retries and never registered a manual collection either. today_from_payloads() reads today's state from coin.channel.sign.list (signSuccess, coin prize) instead, and the button by its coin count.
• GamerPower routed giveaways by matching text inside the URL – gamerpower.py decided the target store with "gog.com" in url, so a lookalike host such as gog.com.evil.tld counted as a trusted shop. Routing now runs through classify_target(), a pure function that checks every host with url_has_allowed_host(). GOG and Ubisoft are recognised too: GOG giveaways used to be detected and then dropped as "not supported", and Ubisoft ones landed in "unknown" despite having their own store.
• GamerPower's instructions fallback never ran – run() built its game dicts without the instructions field that _process_gamerpower_game() reads, so the branch meant to rescue giveaways whose URL hides its destination was dead code. All 105 live entries carry instructions; the field is now passed through and the fallback works.
• GamerPower processed the whole feed, mostly pointlessly – 81 of 105 giveaways are in-game DLC needing an account in that specific game, and each one cost an HTTP request to resolve its redirect before being skipped anyway. Only full games and Early Access are processed now; GP_CLAIM_DLC=true restores the old behaviour. A dry run dropped from 105 processed entries (over ten minutes) to 22.
• GamerPower's Epic delegation launched Chrome without the GPU flags – Steam's delegation passed --ignore-gpu-blocklist and --enable-unsafe-webgpu but Epic's did not, so WebGL reported software rendering on exactly the store where that summons a captcha. Both paths now start the browser the same way.