cyborg-hunter 0.5.0 → 0.7.2

package/src/jspsych/extension-guard-friction.js

@@ -56,6 +56,22 @@
 //
 // ============================================================
 
+// Prefix-aware fullscreen-element lookup. Safari <16.4 and some iOS WebViews
+// expose ONLY document.webkitFullscreenElement (and fire 'webkitfullscreenchange');
+// older Firefox used the moz-prefixed API. requestFullscreen() below already
+// falls through these prefixes, so the authoritative check()/start()/settling
+// gates MUST too — otherwise a participant who successfully enters fullscreen on
+// a prefix-only browser reads a null unprefixed element and is trapped behind a
+// permanent false 'not_fullscreen' violation. Pure + exported for unit testing.
+export function fullscreenElementOf(doc) {
+    doc = doc || (typeof document !== 'undefined' ? document : null);
+    if (!doc) return null;
+    return doc.fullscreenElement
+        || doc.webkitFullscreenElement
+        || doc.mozFullScreenElement
+        || null;
+}
+
 (function (global) {
     'use strict';
 
@@ -143,10 +159,7 @@
     }
 
     function getDiagnostics() {
-        const fsEl = document.fullscreenElement
-            || document.webkitFullscreenElement
-            || document.mozFullScreenElement
-            || null;
+        const fsEl = fullscreenElementOf(document);
         const baselineDeltaCssPx = computeBaselineDeltaCssPx();
 
         return {
@@ -487,7 +500,7 @@
     function check() {
         const diagnostics = getDiagnostics();
 
-        if (!document.fullscreenElement) {
+        if (!fullscreenElementOf(document)) {
             return { ok: false, reason: 'not_fullscreen', diagnostics: diagnostics };
         }
         if (document.visibilityState !== 'visible') {
@@ -689,7 +702,7 @@
                 // re-capture baseline against the now-settled DPR. Fixes
                 // a Chrome-on-Retina case where DPR is briefly stale on
                 // the frame where fullscreenchange fires.
-                if (document.fullscreenElement && performance.now() < state.rebaselineUntil) {
+                if (fullscreenElementOf(document) && performance.now() < state.rebaselineUntil) {
                     state.rebaselineUntil = 0;
                     captureBaseline(function () { update('event.resize.rebaseline'); });
                     return;
@@ -699,6 +712,11 @@
         };
 
         _addEventListener.call(document, 'fullscreenchange', state.eventHandlers.fullscreenchange);
+        // Prefixed variants for browsers that only fire the vendor event
+        // (Safari <16.4, some iOS WebViews, older Firefox). Same handler, so
+        // baseline capture / re-check happens regardless of which one fires.
+        _addEventListener.call(document, 'webkitfullscreenchange', state.eventHandlers.fullscreenchange);
+        _addEventListener.call(document, 'mozfullscreenchange', state.eventHandlers.fullscreenchange);
         _addEventListener.call(document, 'visibilitychange', state.eventHandlers.visibilitychange);
         _addEventListener.call(window, 'blur', state.eventHandlers.blur);
         _addEventListener.call(window, 'focus', state.eventHandlers.focus);
@@ -712,6 +730,8 @@
 
         if (state.eventHandlers) {
             _removeEventListener.call(document, 'fullscreenchange', state.eventHandlers.fullscreenchange);
+            _removeEventListener.call(document, 'webkitfullscreenchange', state.eventHandlers.fullscreenchange);
+            _removeEventListener.call(document, 'mozfullscreenchange', state.eventHandlers.fullscreenchange);
             _removeEventListener.call(document, 'visibilitychange', state.eventHandlers.visibilitychange);
             _removeEventListener.call(window, 'blur', state.eventHandlers.blur);
             _removeEventListener.call(window, 'focus', state.eventHandlers.focus);
@@ -724,7 +744,7 @@
     }
 
     function onFullscreenChange() {
-        if (document.fullscreenElement) {
+        if (fullscreenElementOf(document)) {
             captureBaseline();
             // Open a brief window during which the next resize re-captures
             // baseline. Chrome reports a stale devicePixelRatio on the
@@ -802,7 +822,7 @@
             state.tamperHandle = _setInterval(tamperCheck, TAMPER_CHECK_MS);
             logDebug('tamper_poll.started', { interval_ms: TAMPER_CHECK_MS });
         }
-        if (document.fullscreenElement) {
+        if (fullscreenElementOf(document)) {
             captureBaseline(function () { update('start'); });
         } else {
             update('start');
@@ -885,8 +905,11 @@
     }
 
     // ----- Entry trial ---------------------------------------------
-    function createEntryTrial(opts = {}) {
-        const message = opts.message || `
+    // Hoisted out of createEntryTrial (verbatim string move) so the frozen
+    // public API can expose it as `defaultEntryMessage` below — demo/demo.js
+    // renders this SAME string verbatim on its guard-entry step, so it can
+    // never drift out of sync with what a real participant actually sees.
+    const DEFAULT_ENTRY_MESSAGE = `
             <h2>Fullscreen mode required</h2>
             <p>To keep the experiment fair for everyone, we ask that this study be completed in fullscreen mode,
                with no browser sidebars (Gemini, Copilot, Edge sidebar, etc.) open, and with this tab focused.</p>
@@ -894,6 +917,9 @@
             <p>We care about collecting high-quality data, and these rules help ensure a fair experience for all participants.</p>
             <p>Please close any sidebars now, then click the button below to continue in fullscreen.</p>
         `;
+
+    function createEntryTrial(opts = {}) {
+        const message = opts.message || DEFAULT_ENTRY_MESSAGE;
         return {
             type: jsPsychHtmlButtonResponse,
             stimulus: message,
@@ -1028,6 +1054,9 @@
         createEntryTrial: function (opts) { return createEntryTrial(opts); },
         onViolation: function (handler) { return onViolation(handler); },
         getCurrentState: function () { return getCurrentState(); },
+        // Added on the object literal BEFORE Object.freeze() below — a
+        // post-freeze assignment would silently no-op.
+        defaultEntryMessage: DEFAULT_ENTRY_MESSAGE,
     };
 
     Object.freeze(api);
@@ -1054,10 +1083,10 @@
 class GuardFrictionExtension {
   static info = {
     name: 'guard-friction',
-    // Hand-bumped on each release. The actual library version is whatever
-    // plugin-guard-friction.js exports at runtime; this number is for the
-    // jsPsych developer console only.
-    version: '0.4.0',
+    // Hand-bumped on each release to track the package version
+    // (package.json / src/shared/constants.js). Shown in the jsPsych developer
+    // console only; the runtime library version is independent.
+    version: '0.6.0',
     data: {}
   };
 

package/src/jspsych/extension-guard-honeypot.js

@@ -160,6 +160,8 @@
         // ----- Hidden form fields (catch full-DOM scrapes) -----
         const honeypot = _createElement.call(document, 'div');
         honeypot.id = 'fg-honeypot';
+        // Marks bait DOM for replay/DOM serializers to exclude ([data-ch-role]).
+        honeypot.setAttribute('data-ch-role', 'honeypot');
         Object.assign(honeypot.style, {
             position: 'absolute',
             width: '0',
@@ -199,6 +201,8 @@
         // doesn't change.
         const baitButton = _createElement.call(document, 'button');
         baitButton.id = 'fg-ai-bait-button';
+        // Marks bait DOM for replay/DOM serializers to exclude ([data-ch-role]).
+        baitButton.setAttribute('data-ch-role', 'honeypot');
         baitButton.type = 'button';
         baitButton.tabIndex = -1;
         baitButton.setAttribute('aria-label', BAIT_BUTTON_LABEL);
@@ -221,6 +225,8 @@
         const baitInput = _createElement.call(document, 'input');
         baitInput.type = 'text';
         baitInput.id = 'fg-ai-bait-input';
+        // Marks bait DOM for replay/DOM serializers to exclude ([data-ch-role]).
+        baitInput.setAttribute('data-ch-role', 'honeypot');
         baitInput.name = 'fg-ai-bait-input';
         baitInput.tabIndex = -1;
         baitInput.setAttribute('aria-label', BAIT_INPUT_LABEL);
@@ -285,12 +291,30 @@
         }
     }
 
+    function resetBaitFields() {
+        const aiUseEl = document.getElementById('fg-ai-use');
+        const aiReportEl = document.getElementById('fg-ai-report');
+        if (aiUseEl) aiUseEl.checked = false;
+        if (aiReportEl) aiReportEl.value = '';
+    }
+
     function init(opts) {
         opts = opts || {};
         if (opts.jsPsych) state.jsPsych = opts.jsPsych;
         if (typeof opts.debug === 'boolean') state.debugEnabled = opts.debug;
 
+        // Reset per-run forensic state. init() runs once per experiment, before
+        // any trial, so a second init() means a fresh run (jsPsych preview,
+        // restart, or two experiments sharing a tab) — it must NOT inherit the
+        // prior run's violation evidence or AI disclosures. injectHoneypotDOM()
+        // is idempotent (guards on state.injected), so on a re-init the old bait
+        // fields survive with their stale values; clear them explicitly.
+        state.violations = [];
+        state.currentViolation = null;
+        state.trialViolationStartIdx = 0;
+
         injectHoneypotDOM();
+        resetBaitFields();
 
         const friction = opts.friction || global.GuardFriction;
         if (friction && typeof friction.onViolation === 'function') {
@@ -418,7 +442,7 @@
 class GuardHoneypotExtension {
   static info = {
     name: 'guard-honeypot',
-    version: '0.4.0',
+    version: '0.6.0',
     // Per-trial fields written by on_finish. Reflect violations for this
     // trial only; jsPsych spreads them onto each trial row (CSV columns).
     // Session totals are written as global properties by finalize().