pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 50 insertions, 0 deletions

diff --git a/test-suite/challenges/19-hover-dwell.html b/test-suite/challenges/19-hover-dwell.html
new file mode 100644
index 0000000..21ce80a
--- /dev/null
+++ b/test-suite/challenges/19-hover-dwell.html
@@ -0,0 +1,50 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>19 hover dwell</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <p>Goal: hover the trigger and wait until the <b>Confirm</b> button reveals (≥600ms dwell
+     with continuous <code>pointermove</code> activity inside the trigger), then click Confirm.
+     Instant hover-then-click without dwell, or hover with no intermediate pointermove,
+     looks robotic and fails.</p>
+  <div id="trig" style="display:inline-block;padding:16px 24px;background:#2a4;color:#fff;border-radius:6px;cursor:pointer">
+    hover me
+  </div>
+  <button id="go" style="display:none;margin-left:12px;padding:10px 18px;background:#1f7a1f;color:#fff;border:0;border-radius:6px">Confirm</button>
+</main>
+<script>
+Challenge.init({ id: "hover-dwell", instructions: "hover ≥600ms with movement, then click Confirm" });
+const trig = document.getElementById("trig");
+const btn = document.getElementById("go");
+
+let enterTs = 0, lastMoveTs = 0, moveCount = 0;
+trig.addEventListener("pointerenter", (e) => { enterTs = e.timeStamp; lastMoveTs = e.timeStamp; moveCount = 0; });
+trig.addEventListener("pointermove",  (e) => { lastMoveTs = e.timeStamp; moveCount++; });
+trig.addEventListener("pointerleave", () => {
+  if (!btn.dataset.revealed) { enterTs = 0; lastMoveTs = 0; moveCount = 0; }
+});
+
+// Reveal after sustained dwell + activity.
+setInterval(() => {
+  if (btn.dataset.revealed) return;
+  if (!enterTs) return;
+  const dwell = performance.now() - enterTs;
+  if (dwell >= 600 && moveCount >= 3) {
+    btn.style.display = "inline-block";
+    btn.dataset.revealed = "1";
+    btn.dataset.revealTs = performance.now();
+    Challenge.log("revealed", { dwell, moveCount });
+  }
+}, 50);
+
+btn.addEventListener("click", (e) => {
+  if (!btn.dataset.revealed) return Challenge.fail("Confirm clicked before reveal (display:none)");
+  const sinceReveal = e.timeStamp - Number(btn.dataset.revealTs);
+  if (sinceReveal < 80) return Challenge.fail(`clicked ${sinceReveal.toFixed(0)}ms after reveal (too instant)`);
+  if (!e.isTrusted) return Challenge.fail("Confirm click isTrusted=false");
+  Challenge.pass(`dwell+activity+human-latency reveal (Δ=${sinceReveal.toFixed(0)}ms)`);
+});
+</script>
+</body>