pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 62 insertions, 0 deletions

diff --git a/test-suite/challenges/25-pointer-continuity.html b/test-suite/challenges/25-pointer-continuity.html
new file mode 100644
index 0000000..c441045
--- /dev/null
+++ b/test-suite/challenges/25-pointer-continuity.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>25 pointer continuity</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <p>Goal: click <b>A</b>, then click <b>B</b>. Page requires pointer continuity:
+     between the two clicks there must be intermediate <code>pointermove</code> events
+     whose path roughly connects the two click points (no teleport). Two clicks
+     &gt;100px apart with zero moves between is a synthetic-bridge tell.</p>
+  <div style="display:flex;justify-content:space-between;margin-top:20px">
+    <button id="a" style="padding:14px 22px;background:#36c;color:#fff;border:0;border-radius:6px">A</button>
+    <div style="flex:1"></div>
+    <button id="b" style="padding:14px 22px;background:#c36;color:#fff;border:0;border-radius:6px">B</button>
+  </div>
+</main>
+<script>
+Challenge.init({ id: "pointer-continuity", instructions: "click A, move mouse to B, click B" });
+
+const a = document.getElementById("a");
+const b = document.getElementById("b");
+
+const moves = [];
+window.addEventListener("pointermove", (e) => {
+  moves.push({ x: e.clientX, y: e.clientY, t: e.timeStamp });
+  if (moves.length > 500) moves.shift();
+});
+
+let aClickTs = 0, aPoint = null;
+a.addEventListener("click", (e) => {
+  if (!e.isTrusted) return Challenge.fail("A click isTrusted=false");
+  aClickTs = e.timeStamp;
+  aPoint = { x: e.clientX, y: e.clientY };
+  Challenge.log("A click", aPoint);
+});
+
+b.addEventListener("click", (e) => {
+  if (!aClickTs) return Challenge.fail("B clicked before A");
+  if (!e.isTrusted) return Challenge.fail("B click isTrusted=false");
+  const bPoint = { x: e.clientX, y: e.clientY };
+  const between = moves.filter(m => m.t > aClickTs && m.t < e.timeStamp);
+  Challenge.log("B click", { bPoint, betweenCount: between.length });
+  const dist = Math.hypot(bPoint.x - aPoint.x, bPoint.y - aPoint.y);
+  if (dist < 100) return Challenge.fail(`A-B distance only ${dist.toFixed(0)}px — buttons should be further apart in viewport`);
+  if (between.length < 5) return Challenge.fail(`only ${between.length} pointermove(s) between A and B (need ≥5)`);
+
+  // Path coverage: at least some intermediate move must be ≥30% of the way across.
+  const inSpan = between.filter(m => {
+    const px = (m.x - aPoint.x) / (bPoint.x - aPoint.x || 1);
+    return px > 0.25 && px < 0.75;
+  });
+  if (inSpan.length === 0) return Challenge.fail("no pointermove samples in mid-span between A and B (teleport)");
+
+  // Move timestamps should be spread, not bunched in <20ms.
+  const span = between[between.length-1].t - between[0].t;
+  if (span < 30) return Challenge.fail(`pointermoves bunched in ${span.toFixed(0)}ms (need spread ≥30ms)`);
+
+  Challenge.pass(`${between.length} moves bridging A→B over ${span.toFixed(0)}ms, dist=${dist.toFixed(0)}px`);
+});
+</script>
+</body>