@webdecoy/fcaptcha 1.45.0 → 1.46.0

package/detection.js

@@ -1031,18 +1031,6 @@ function analyzeFonts(fontsInfo, userAgent) {
     });
   }
 
-  // Mac UA but no SF Pro (modern macOS)
-  if ((ua.includes('mac os x') || ua.includes('macintosh')) && fontsInfo.hasSFPro === false &&
-      ua.includes('10_15') === false && ua.includes('10_14') === false && fontsInfo.count > 5) {
-    // SF Pro is on macOS 10.15+ (Catalina and later)
-    detections.push({
-      category: 'bot',
-      score: 0.3,
-      confidence: 0.4,
-      reason: 'Modern macOS UA but SF Pro font not detected'
-    });
-  }
-
   // Linux UA but no DejaVu Sans (very common on Linux)
   if (ua.includes('linux') && !ua.includes('android') &&
       fontsInfo.hasDejaVuSans === false && fontsInfo.count > 5) {

package/engine.js

@@ -585,17 +585,9 @@ function detectCDP(signals) {
     }
   }
 
-  // CDP Runtime/DevTools console consumer attached. Low confidence: a developer
-  // with DevTools open also trips this, so it contributes rather than blocks.
-  if (env.cdpRuntime && env.cdpRuntime.consoleAttached) {
-    detections.push({
-      category: 'cdp', score: 0.6, confidence: 0.5,
-      reason: 'CDP/DevTools console consumer attached (automation protocol or open DevTools)',
-      // A developer with DevTools open produces exactly this signal, so it
-      // cannot be one of the independent views the corroboration floor counts.
-      nonCorroborating: true
-    });
-  }
+  // cdpRuntime.consoleAttached is collected but not scored: measured on real
+  // visitors it fires in every Chrome and Safari session (no DevTools, no
+  // extensions), so it cannot tell a person from an agent.
 
   if (cdp.detected) {
     const signalList = cdp.signals || [];

package/experimental.js

@@ -8,6 +8,27 @@ const { calculateCategoryScores, BEHAVIOURAL_CATEGORIES, CORROBORATION_AGREE_AT,
 // change. An old selector must never silently opt an operator into a new policy.
 const EXPERIMENTAL_POLICY = 'stealth-corroboration-v1';
 const ANIMATION_POLICY = 'animation-consistency-v1';
+const POINTER_POLICY = 'pointer-movement-v1';
+const POINTER_MIN_SAMPLES = 30;
+const POINTER_ZERO_RATIO_BELOW = 0.05;
+
+// Moves where the pointer position changed but movementX/Y read 0. Measured on
+// real mice and trackpads in Chrome, Safari and Firefox, at 1x and 2x pixel
+// ratio: 14-38% of moves. Stealth CDP-driven Chrome: 0-3%. Observe only until
+// production traffic shows the rate on hardware the bench never saw.
+function pointerObservation(signals) {
+  const b = signals.behavioral || {};
+  const f = b.inputForensics || {};
+  const samples = f.pointerMoveSamples;
+  const ratio = f.pointerMoveZeroRatio;
+  const known = (b.touchEvents ?? 0) < 3 && Number.isFinite(samples) && samples >= POINTER_MIN_SAMPLES &&
+    Number.isFinite(ratio) && ratio >= 0 && ratio <= 1;
+  const status = !known ? 'unknown' : ratio < POINTER_ZERO_RATIO_BELOW ? 'detected' : 'clear';
+  return { mode: 'observe', status, detections: status === 'detected' ? [{
+    id: 'pointer-movement-never-zero',
+    reason: 'Pointer moves always report movement; experimental observation, not proof of automation',
+  }] : [] };
+}
 
 function animationObservation(signals) {
   const probe = signals.environmental?.animationConsistency;
@@ -55,8 +76,9 @@ function evaluateExperimental(signals, productionScore, detections, blocking = f
     observations: {
       [ANIMATION_POLICY]: animationObservation(signals),
       [IDENTITY_POLICY]: identityObservation(signals),
+      [POINTER_POLICY]: pointerObservation(signals),
     },
   };
 }
 
-module.exports = { evaluateExperimental, EXPERIMENTAL_POLICY };
+module.exports = { evaluateExperimental, pointerObservation, EXPERIMENTAL_POLICY, POINTER_POLICY };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.45.0",
+  "version": "1.46.0",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {

package/server.js

@@ -28,7 +28,8 @@ const {
   sanitizeAction,
   sanitizeCdata,
   secretMatches,
-  siteverifyAsync
+  siteverifyAsync,
+  asRecaptchaScore
 } = require('./siteverify');
 
 const app = express();
@@ -960,17 +961,16 @@ app.post('/api/token/verify', asyncRoute(async (req, res) => {
 // integration at this server should be a base-URL change and nothing else.
 // See siteverify.js for the adapter itself.
 async function siteverifyHandler(req, res) {
-  res.json(
-    await siteverifyAsync({
-      body: req.body,
-      // Bind to this server's token store, so replay state is shared with the
-      // native endpoint rather than kept in a parallel universe.
-      verifyToken,
-      expectedSecret: VERIFY_SECRET,
-      idempotencyStore: IDEMPOTENCY,
-      requireSecret: !LEGACY_UNAUTH_VERIFY
-    })
-  );
+  const out = await siteverifyAsync({
+    body: req.body,
+    // Bind to this server's token store, so replay state is shared with the
+    // native endpoint rather than kept in a parallel universe.
+    verifyToken,
+    expectedSecret: VERIFY_SECRET,
+    idempotencyStore: IDEMPOTENCY,
+    requireSecret: !LEGACY_UNAUTH_VERIFY
+  });
+  res.json(req.path === '/recaptcha/api/siteverify' ? asRecaptchaScore(out) : out);
 }
 
 app.post('/turnstile/v0/siteverify', asyncRoute(siteverifyHandler));

package/siteverify.js

@@ -237,6 +237,19 @@ class IdempotencyStore {
   }
 }
 
+/**
+ * Restate a response in reCAPTCHA v3's score direction.
+ *
+ * reCAPTCHA scores run 1.0 = human, 0.0 = bot, and every integration compares
+ * `score >= threshold`. FCaptcha's run the other way, so served unchanged on the
+ * reCAPTCHA path they would reject people and admit bots. The native score
+ * stays available as `fcaptcha_score`.
+ */
+function asRecaptchaScore(out) {
+  if (!out || typeof out.score !== 'number') return out;
+  return { ...out, score: Math.round((1 - out.score) * 10000) / 10000, fcaptcha_score: out.score };
+}
+
 /** A failing siteverify response carrying the given codes. */
 function failure(...codes) {
   return { success: false, 'error-codes': codes };
@@ -355,6 +368,7 @@ async function siteverifyAsync({
 
 module.exports = {
   ERROR_CODES,
+  asRecaptchaScore,
   HostnameAllowlist,
   IdempotencyStore,
   hostFromUrl,