From 33110e803fcacc31dc2859dbc0d470b008556798 Mon Sep 17 00:00:00 2001 From: Tianren Dong Date: Wed, 13 May 2026 01:05:46 -0400 Subject: pi-chrome: humanize synthetic input + anti-automation test suite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump 0.8.0 → 0.9.1. Companion extension (service_worker.js): - humanise pointer paths: easing Bezier-ish interpolation w/ wobble, 12–42 steps, 4–18 ms gaps; pointer position persisted across calls - click point picked inside element rect, not dead center - pointer events fill movementX/Y, screenX/Y, pressure (0.5 on down), pointerId, width/height, tilt, composed - click sequence: humanMoveTo → pointerdown → focus → 45–140 ms hold → pointerup → mouseup → click - per-character typing: keydown → keypress → beforeinput → value mutate (or execCommand for contenteditable) → input → keyup, with 25–95 ms hold + 35–140 ms inter-key; auto Shift chord for uppercase/symbols - pressKeyInPage emits same cadence + handles printable insert / Backspace - hoverPage: humanised path + 80–220 ms dwell - dragPage: full HTML5 sequence (dragstart/drag/dragenter/dragover/ dragleave/drop/dragend) with shared DataTransfer + pointer continuity - new scrollPage: wheel events with front-loaded momentum-shaped deltas - self-reload on version drift: SW reads x-pi-chrome-version header, reloads when older than pi-chrome Pi side (index.ts): - new chrome_scroll tool - PI_CHROME_VERSION read from package.json (and re-read on every /next so future bumps take effect without pi restart) - /chrome-doctor escalates version mismatch to top-line ✗ error and skips downstream capability probes when stale - /next response carries x-pi-chrome-version header for SW self-heal Test suite (test-suite/): - 28 challenge pages each catching a different synthetic-event tell: isTrusted, webdriver/fingerprint, mouse entropy/timing/coords, pointer pressure/continuity, per-char cadence + framework invariants, user activation, honeypots, focus order, wheel scroll, drag+ DataTransfer, contenteditable+Selection, paste/clipboard, native select, hover dwell, React valueTracker, keyboard modifiers, touch events, stack-trace fingerprint, viewport-edge clicks, mousemove rate, scroll momentum, IntersectionObserver visibility - shared _lib.js exposes window.__verdict + writes localStorage so index.html dashboard aggregates results - notes/bypass-ideas.md documents fixes still needed per challenge --- test-suite/challenges/20-react-value-tracker.html | 78 +++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 test-suite/challenges/20-react-value-tracker.html (limited to 'test-suite/challenges/20-react-value-tracker.html') diff --git a/test-suite/challenges/20-react-value-tracker.html b/test-suite/challenges/20-react-value-tracker.html new file mode 100644 index 0000000..fb217d1 --- /dev/null +++ b/test-suite/challenges/20-react-value-tracker.html @@ -0,0 +1,78 @@ + + +20 React _valueTracker + + + +
+

Goal: set the input to react-ok in a way that React would accept. + The page mimics React's _valueTracker: it stamps the input with a + hidden tracker holding the last-seen value. An input event is only + considered "framework-real" if the tracker's recorded value differs from the + current input.value at the moment the event fires + (i.e. somebody used the native HTMLInputElement.value setter and + dispatched input — what React internals require).

+

Setting el.value = ... directly and dispatching a synthetic input + fails because the native setter wasn't used. Calling setRangeText without + dispatching input also fails.

+ +
+ + -- cgit v1.2.3