pi-chrome: humanize synthetic input + anti-automation test suite

Bump 0.8.0 → 0.9.1.

Companion extension (service_worker.js):
- humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42
  steps, 4–18 ms gaps; pointer position persisted across calls
- click point picked inside element rect, not dead center
- pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down),
  pointerId, width/height, tilt, composed
- click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold →
  pointerup → mouseup → click
- per-character typing: keydown → keypress → beforeinput → value mutate
  (or execCommand for contenteditable) → input → keyup, with 25–95 ms
  hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols
- pressKeyInPage emits same cadence + handles printable insert / Backspace
- hoverPage: humanised path + 80–220 ms dwell
- dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/
  dragleave/drop/dragend) with shared DataTransfer + pointer continuity
- new scrollPage: wheel events with front-loaded momentum-shaped deltas
- self-reload on version drift: SW reads x-pi-chrome-version header,
  reloads when older than pi-chrome

Pi side (index.ts):
- new chrome_scroll tool
- PI_CHROME_VERSION read from package.json (and re-read on every /next
  so future bumps take effect without pi restart)
- /chrome-doctor escalates version mismatch to top-line ✗ error and
  skips downstream capability probes when stale
- /next response carries x-pi-chrome-version header for SW self-heal

Test suite (test-suite/):
- 28 challenge pages each catching a different synthetic-event tell:
  isTrusted, webdriver/fingerprint, mouse entropy/timing/coords,
  pointer pressure/continuity, per-char cadence + framework invariants,
  user activation, honeypots, focus order, wheel scroll, drag+
  DataTransfer, contenteditable+Selection, paste/clipboard, native
  select, hover dwell, React valueTracker, keyboard modifiers, touch
  events, stack-trace fingerprint, viewport-edge clicks, mousemove
  rate, scroll momentum, IntersectionObserver visibility
- shared _lib.js exposes window.__verdict + writes localStorage so
  index.html dashboard aggregates results
- notes/bypass-ideas.md documents fixes still needed per challenge

1 files changed, 72 insertions, 0 deletions

diff --git a/test-suite/challenges/28-intersection-visibility.html b/test-suite/challenges/28-intersection-visibility.html
new file mode 100644
index 0000000..1c90e33
--- /dev/null
+++ b/test-suite/challenges/28-intersection-visibility.html
@@ -0,0 +1,72 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>28 IntersectionObserver visibility</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <p>Goal: scroll until the hidden <b>TARGET</b> button comes into view, then click it.
+     Page uses an <code>IntersectionObserver</code> to track when TARGET crosses the
+     viewport. Real scrolling produces a sequence of intersection updates with
+     gradually increasing <code>intersectionRatio</code> (0 → 1) across animation
+     frames. Programmatic teleports (<code>scrollIntoView({behavior:"instant"})</code>,
+     direct <code>scrollTop=</code>) produce exactly one observer callback with
+     <code>ratio≈1</code> and no rAF samples in between — fail.</p>
+  <div id="scroller" style="height:240px;overflow:auto;border:1px solid #555;background:#fff;color:#111">
+    <div style="height:1600px;padding:8px">keep scrolling …</div>
+    <button id="target" style="margin:0 auto 1600px;display:block;padding:14px 22px;background:#1f7a1f;color:#fff;border:0;border-radius:6px">TARGET</button>
+  </div>
+</main>
+<script>
+Challenge.init({ id: "intersection-visibility", instructions: "scroll until TARGET visible, then click" });
+
+const scroller = document.getElementById("scroller");
+const target = document.getElementById("target");
+
+const ratioSamples = [];
+const rafSamples = [];
+
+const io = new IntersectionObserver((entries) => {
+  for (const e of entries) ratioSamples.push({ r: e.intersectionRatio, t: performance.now() });
+}, { root: scroller, threshold: Array.from({length: 21}, (_,i) => i/20) });
+io.observe(target);
+
+// Track rAF ticks during which scroll was happening.
+let lastScrollTop = scroller.scrollTop;
+let scrollingFrames = 0;
+function tick() {
+  if (scroller.scrollTop !== lastScrollTop) {
+    scrollingFrames++;
+    rafSamples.push({ st: scroller.scrollTop, t: performance.now() });
+    lastScrollTop = scroller.scrollTop;
+  }
+  requestAnimationFrame(tick);
+}
+requestAnimationFrame(tick);
+
+target.addEventListener("click", (e) => {
+  if (!e.isTrusted) return Challenge.fail("TARGET click isTrusted=false");
+
+  // Need the target to actually be in the viewport at click time.
+  const rect = target.getBoundingClientRect();
+  const sRect = scroller.getBoundingClientRect();
+  const inViewport = rect.top < sRect.bottom && rect.bottom > sRect.top;
+  if (!inViewport) return Challenge.fail("TARGET clicked while still off-screen");
+
+  // Require at least a gradient of intersection ratios from low to high.
+  const lows  = ratioSamples.filter(s => s.r > 0 && s.r < 0.3).length;
+  const mids  = ratioSamples.filter(s => s.r >= 0.3 && s.r < 0.7).length;
+  const highs = ratioSamples.filter(s => s.r >= 0.7).length;
+  Challenge.log("io", { samples: ratioSamples.length, lows, mids, highs, scrollingFrames });
+
+  const bad = [];
+  if (ratioSamples.length < 4) bad.push(`only ${ratioSamples.length} IntersectionObserver samples (teleport)`);
+  if (lows === 0)  bad.push("no low-ratio IO samples — target appeared instantly");
+  if (mids === 0)  bad.push("no mid-ratio IO samples — no smooth approach");
+  if (scrollingFrames < 5) bad.push(`only ${scrollingFrames} rAF frames saw scroll motion`);
+
+  if (bad.length) Challenge.fail(...bad);
+  else Challenge.pass(`IO gradient seen: lows=${lows} mids=${mids} highs=${highs}, rafFrames=${scrollingFrames}`);
+});
+</script>
+</body>