Lets say I'm making an incremental game, (e.g. cookie-clicker-like). The premise of the game is simple: players send inputs that advance their game state. Players convert their own real-life time into progress in the game.
Obviously, players can cheat on the client-side, so to prevent this - the entire game logic happens on the server, and the client's only role is to render an interface that lets the players send their inputs to the server over the network. Thus, players can't take any actions that aren't allowed by the game's rules, because each action is validated on the server.
However, this still brings up a problem: what about this type of cheating:
Instead of playing the game manually, a player just writes a script that plays the game for them. They leave their PC running 24/7, and make progress in the game, all within the game's rules, but without using their own real-life time to play.
Obviously, this gives an edge over "legit" players that only play using the game's intended interface for committing actions.
Is there anything I can do to prevent this type of cheating, or is this a lost cause with no solution?
For the sake of this discussion, assume that the player that wants to cheat is able to easily reverse engineer the clientside code. For example lets say it's an HTML5 game with JS code, and that the cheater is smart enough to read minified code (which is not a far stretch at all). This means they can basically copy the code to their own machine, set up a server (with the JS example, setting up a Node.js server takes about 2 minutes), add a bit of their own code for the automation, and make their server send requests to my server with spoofed headers in a way that it pretends to be a regular user agent.
[Edit] in response to questions in the answers: The game has no player interaction, but there's an online scoreboard, and higher-ranking players get rewards; in other words, cheating is not isolated to the cheater's local machine, and cheating can ruin the experience for other players.