feat: Human Entropy — Gaussian noise on mouse coordinates and timing

[Delqhi]

Problem

Anti-bot systems (Cloudflare Turnstile, DataDome, hCaptcha 2026) analyze:

• Mouse coordinate entropy (perfect center clicks = bot)
• Click timing patterns (instant press+release = bot)
• Movement trajectories (teleporting cursors = bot)

Our click_ref tool was dispatching instant, pixel-perfect CDP clicks — instantly flaggable.

Evidence

• Jonas Tischer: Why AI Agents Still Cant Create Their Own Email Accounts — Layer 4: Behavioral Analysis
• HackerNoon: AI Agent Browsers Are Failing — fingerprinting + behavioral detection
• Medium: 6 Failure Envelopes

Solution (Implemented)

Modified click_ref in service_worker.js:

1. Coordinate Jitter: ±5px Gaussian noise on X and Y
2. mouseMoved first: Cursor travels to target before clicking (humans never teleport)
3. Reaction Delay: 20-70ms random pause before mousePressed
4. Finger Hold: 50-150ms random pause before mouseReleased

Files Changed

• extension/background/service_worker.js — click_ref tool handler

Acceptance Criteria

• No two consecutive clicks land on identical pixel coordinates
• Click timing varies between 70-220ms total duration
• Cloudflare Turnstile does not flag the extension as bot

[Delqhi]

Implementation note from cloud execution lane:

• Reported outcome: remaining service-worker interaction paths were hardened so click/hover/vision-related flows route through shared human-entropy helpers with movement, jitter, and non-zero timing.
• Reported validation: targeted syntax/test checks passed in the execution lane, including dedicated human-entropy regression coverage.
• Important repo-state note: the checkout still contains unrelated pre-existing modifications, so PR isolation/staging hygiene remains necessary before merge.