pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 81 insertions, 0 deletions

diff --git a/test-suite/_lib.js b/test-suite/_lib.js
new file mode 100644
index 0000000..c6d121c
--- /dev/null
+++ b/test-suite/_lib.js
@@ -0,0 +1,81 @@
+// Tiny shared harness for challenge pages.
+// Each page calls Challenge.init({id, instructions}) then Challenge.pass()/fail()
+// based on its own listeners.
+(function () {
+  const events = [];
+  const state = {
+    id: null,
+    verdict: "PENDING",
+    reason: [],
+    events,
+  };
+
+  function render() {
+    const el = document.getElementById("__verdict");
+    if (!el) return;
+    el.textContent = state.verdict;
+    el.dataset.verdict = state.verdict;
+    el.style.background =
+      state.verdict === "PASS" ? "#1f7a1f" :
+      state.verdict === "FAIL" ? "#a11" : "#444";
+    el.style.color = "#fff";
+    const r = document.getElementById("__reason");
+    if (r) r.textContent = state.reason.join("\n");
+  }
+
+  function log(name, detail) {
+    events.push({ t: performance.now(), name, ...detail });
+    if (events.length > 500) events.shift();
+  }
+
+  const Challenge = {
+    init({ id, instructions }) {
+      state.id = id;
+      document.title = `[${state.verdict}] ${id}`;
+      const root = document.body;
+      const bar = document.createElement("div");
+      bar.style.cssText =
+        "position:sticky;top:0;background:#111;color:#eee;padding:8px 12px;font:13px monospace;border-bottom:1px solid #333;z-index:9999";
+      bar.innerHTML = `
+        <b>${id}</b>
+        <span id="__verdict" style="margin-left:8px;padding:2px 8px;border-radius:4px;background:#444">PENDING</span>
+        <span style="margin-left:12px;opacity:.7">${instructions}</span>
+        <pre id="__reason" style="white-space:pre-wrap;margin:6px 0 0;color:#bbb;font:12px monospace"></pre>
+      `;
+      root.insertBefore(bar, root.firstChild);
+      window.__challenge = id;
+      window.__verdict = state.verdict;
+      window.__reason = state.reason;
+      window.__events = state.events;
+      render();
+    },
+    pass(...reasons) {
+      if (state.verdict === "FAIL") return; // sticky
+      state.verdict = "PASS";
+      state.reason.push(...reasons.map((r) => "✓ " + r));
+      window.__verdict = state.verdict;
+      document.title = `[PASS] ${state.id}`;
+      persist(); render();
+    },
+    fail(...reasons) {
+      state.verdict = "FAIL";
+      state.reason.push(...reasons.map((r) => "✗ " + r));
+      window.__verdict = state.verdict;
+      document.title = `[FAIL] ${state.id}`;
+      persist(); render();
+    },
+    log,
+    state,
+  };
+
+  function persist() {
+    try {
+      localStorage.setItem(
+        "pi-chrome-suite:" + state.id,
+        JSON.stringify({ verdict: state.verdict, reason: state.reason, ts: Date.now() })
+      );
+    } catch {}
+  }
+
+  window.Challenge = Challenge;
+})();