pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 51 insertions, 0 deletions

diff --git a/test-suite/challenges/03-webdriver-flag.html b/test-suite/challenges/03-webdriver-flag.html
new file mode 100644
index 0000000..c5953f1
--- /dev/null
+++ b/test-suite/challenges/03-webdriver-flag.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>03 webdriver / runtime fingerprint</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <p>Auto-checks runtime properties commonly inspected by bot-detection scripts.</p>
+  <pre id="rep" style="font:12px monospace;background:#111;color:#eee;padding:12px;border-radius:6px"></pre>
+</main>
+<script>
+Challenge.init({
+  id: "webdriver-flag",
+  instructions: "no interaction; auto-verdict on load",
+});
+const checks = [];
+function chk(name, bad, note) {
+  checks.push({ name, bad, note });
+  if (bad) Challenge.log("flag", { name, note });
+}
+
+chk("navigator.webdriver", navigator.webdriver === true, String(navigator.webdriver));
+chk("languages-empty", !navigator.languages || navigator.languages.length === 0,
+    JSON.stringify(navigator.languages));
+chk("plugins-empty", !navigator.plugins || navigator.plugins.length === 0,
+    `length=${navigator.plugins && navigator.plugins.length}`);
+chk("permissions-notifications-quirk", false, "checked async below");
+
+(async () => {
+  try {
+    const p = await navigator.permissions.query({ name: "notifications" });
+    // Headless Chrome historically returned "denied" while Notification.permission === "default".
+    const mismatch = p.state === "denied" && Notification.permission === "default";
+    checks.push({ name: "permissions-notifications-quirk", bad: mismatch,
+      note: `perm=${p.state} api=${Notification.permission}` });
+    finalize();
+  } catch (e) {
+    checks.push({ name: "permissions-notifications-quirk", bad: false, note: "n/a " + e.message });
+    finalize();
+  }
+})();
+
+function finalize() {
+  const rep = document.getElementById("rep");
+  rep.textContent = checks.map(c => `${c.bad ? "✗" : "✓"} ${c.name}  ${c.note}`).join("\n");
+  const failed = checks.filter(c => c.bad);
+  if (failed.length) Challenge.fail(...failed.map(c => `${c.name}: ${c.note}`));
+  else Challenge.pass("all runtime checks clean");
+}
+</script>
+</body>