pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 45 insertions, 0 deletions

diff --git a/test-suite/challenges/09-composition-input.html b/test-suite/challenges/09-composition-input.html
new file mode 100644
index 0000000..b4b2002
--- /dev/null
+++ b/test-suite/challenges/09-composition-input.html
@@ -0,0 +1,45 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>09 framework input invariants</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <p>Goal: type <code>abc</code>. Page asserts React-style invariants: <code>beforeinput</code>
+     fires <em>before</em> <code>input</code>, both per-character, <code>inputType==="insertText"</code>,
+     value mutates between events, and no <code>compositionstart</code> for plain typing.</p>
+  <input id="t" placeholder="type abc" style="font-size:18px;padding:8px 12px;width:240px">
+</main>
+<script>
+Challenge.init({ id: "composition-input", instructions: "type 'abc' producing framework-correct event order" });
+const t = document.getElementById("t");
+const evs = [];
+let sawCompositionStart = false;
+["beforeinput","input","compositionstart","compositionend"].forEach(name => {
+  t.addEventListener(name, (e) => {
+    evs.push({ name, t: e.timeStamp, inputType: e.inputType, data: e.data, value: t.value });
+    if (name === "compositionstart") sawCompositionStart = true;
+  });
+});
+t.addEventListener("input", () => {
+  if (t.value !== "abc") return;
+  const before = evs.filter(e => e.name === "beforeinput");
+  const inp = evs.filter(e => e.name === "input");
+  const bad = [];
+  if (sawCompositionStart) bad.push("compositionstart fired for plain ASCII typing");
+  if (before.length !== 3) bad.push(`beforeinput count=${before.length} (need 3)`);
+  if (inp.length !== 3) bad.push(`input count=${inp.length} (need 3)`);
+  if (before.some(b => b.inputType !== "insertText")) bad.push(`beforeinput.inputType=${before.map(b=>b.inputType).join(",")}`);
+  // beforeinput must precede matching input.
+  for (let i = 0; i < Math.min(before.length, inp.length); i++) {
+    if (before[i].t > inp[i].t) bad.push(`beforeinput[${i}] after input[${i}]`);
+  }
+  // Value must reflect each char incrementally.
+  const seq = inp.map(e => e.value).join("|");
+  if (seq !== "a|ab|abc") bad.push(`value seq at input events: ${seq} (need a|ab|abc)`);
+  Challenge.log("seq", { evs });
+  if (bad.length) Challenge.fail(...bad);
+  else Challenge.pass(`event order and invariants OK; seq=${seq}`);
+});
+</script>
+</body>