From c67dbd4c0bb05a9564ca9cb9d1ff4595ac5a46ff Mon Sep 17 00:00:00 2001
From: David <130434641+Booshdag-io@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:26:01 -0600
Subject: [PATCH] fix(challenge): include passage text hash to detect source
 passage mismatches (#43)

---
 script.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/script.js b/script.js
index 6cd028c..aa33496 100644
--- a/script.js
+++ b/script.js
@@ -1124,7 +1124,7 @@ async function shareResult() {
 // A link carries a finished run's settings, seed, WPM, and keystroke
 // timings in the URL hash. Opening it plays those passages with the run as
 // the ghost, without changing the receiver's saved settings.
-const CHALLENGE_VERSION = 1;
+const CHALLENGE_VERSION = 2;
 const CHALLENGE_MAX_LENGTH = 20000; // characters in the hash
 const CHALLENGE_MAX_STROKES = 5000;
 const CHALLENGE_SETTINGS = [
@@ -1241,6 +1241,7 @@ function challengePayload() {
         v: CHALLENGE_VERSION,
         s: settings,
         seed: runtime.seed,
+        th: textHash(firstPassageText ? firstPassageText() : (runtime.passages[0] || "")),
         wpm: Number(modalWpmElement.textContent),
         k: gameState.category === 'weak' ? runtime.weakKeys : [],
         d: deltas,