Replace uniform mouse jitter with Gaussian-distributed delays

The per-step delay jitter for smooth mouse movements and drags used
a uniform ±2ms offset (rand.Intn(5) - 2), producing near-constant
inter-event timing. Real human mouse movement has substantially more
timing variance due to motor noise, acceleration phases, and
micro-hesitations.

Replace with a Gaussian distribution (Box-Muller, stddev = 40% of
mean delay, clamped to [3ms, 3x mean]). This preserves the average
movement duration while producing natural timing variance in each
step.

Affects both doMoveMouseSmooth and doDragMouseSmooth code paths.

Made-with: Cursor

Author: ulziibay-kernel

server/cmd/api/api/computer.go

@@ -173,7 +173,10 @@ func (s *ApiService) doMoveMouseSmooth(ctx context.Context, log *slog.Logger, bo
 		}()
 	}
 
-	// Move along Bezier path: mousemove_relative for each step with delay
+	// Move along Bezier path: mousemove_relative for each step with delay.
+	// Use Gaussian-distributed delays so that inter-event timing has natural
+	// variance matching real human motor noise, rather than near-constant
+	// intervals that fingerprinting systems can distinguish from humans.
 	for i := 1; i < len(points); i++ {
 		select {
 		case <-ctx.Done():
@@ -190,14 +193,8 @@ func (s *ApiService) doMoveMouseSmooth(ctx context.Context, log *slog.Logger, bo
 				return &executionError{msg: "failed during smooth mouse movement"}
 			}
 		}
-		jitter := stepDelayMs
-		if stepDelayMs > 3 {
-			jitter = stepDelayMs + rand.Intn(5) - 2
-			if jitter < 3 {
-				jitter = 3
-			}
-		}
-		if err := sleepWithContext(ctx, time.Duration(jitter)*time.Millisecond); err != nil {
+		delay := gaussianDelay(stepDelayMs, 3)
+		if err := sleepWithContext(ctx, time.Duration(delay)*time.Millisecond); err != nil {
 			return &executionError{msg: "mouse movement cancelled"}
 		}
 	}
@@ -1233,12 +1230,9 @@ func (s *ApiService) doDragMouseSmooth(ctx context.Context, log *slog.Logger, bo
 		args = append(args, "mousemove_relative", "--", strconv.Itoa(dx), strconv.Itoa(dy))
 
 		if i < numSteps {
-			delay := smoothStepDelay(i, numSteps, baseDelayMs*2, baseDelayMs/2)
-			jitter := delay + rand.Intn(5) - 2
-			if jitter < 3 {
-				jitter = 3
-			}
-			args = append(args, "sleep", fmt.Sprintf("%.3f", float64(jitter)/1000.0))
+			baseDelay := smoothStepDelay(i, numSteps, baseDelayMs*2, baseDelayMs/2)
+			delay := gaussianDelay(baseDelay, 3)
+			args = append(args, "sleep", fmt.Sprintf("%.3f", float64(delay)/1000.0))
 		}
 	}
 
@@ -1254,6 +1248,28 @@ func (s *ApiService) doDragMouseSmooth(ctx context.Context, log *slog.Logger, bo
 	return nil
 }
 
+// gaussianDelay returns a Gaussian-distributed delay centered on meanMs with
+// stddev of 40% of meanMs, clamped to [minMs, 3*meanMs]. This produces timing
+// variance that matches real human motor noise rather than the near-zero
+// variance of uniform jitter.
+func gaussianDelay(meanMs int, minMs int) int {
+	stddev := float64(meanMs) * 0.4
+	u1 := rand.Float64()
+	u2 := rand.Float64()
+	if u1 <= 0 {
+		u1 = 1e-10
+	}
+	z := math.Sqrt(-2*math.Log(u1)) * math.Cos(2*math.Pi*u2)
+	delay := int(math.Round(float64(meanMs) + stddev*z))
+	if delay < minMs {
+		delay = minMs
+	}
+	if delay > meanMs*3 {
+		delay = meanMs * 3
+	}
+	return delay
+}
+
 // smoothStepDelay maps position i/n through a smoothstep curve to produce
 // a delay in [fastMs, slowMs]. Slow at start and end, fast in the middle.
 // smoothstep(t) = 3t² - 2t³

server/cmd/api/api/computer_test.go

@@ -3,6 +3,7 @@ package api
 import (
 	"errors"
 	"fmt"
+	"math"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -168,6 +169,60 @@ func TestIsValidationErr_Nil(t *testing.T) {
 	assert.False(t, isValidationErr(nil))
 }
 
+func TestGaussianDelay(t *testing.T) {
+	const n = 10000
+	meanMs := 10
+
+	var sum, sumSq float64
+	minVal, maxVal := math.MaxFloat64, -math.MaxFloat64
+
+	for i := 0; i < n; i++ {
+		d := float64(gaussianDelay(meanMs, 3))
+		sum += d
+		sumSq += d * d
+		if d < minVal {
+			minVal = d
+		}
+		if d > maxVal {
+			maxVal = d
+		}
+	}
+
+	avg := sum / n
+	variance := sumSq/n - avg*avg
+
+	assert.InDelta(t, float64(meanMs), avg, float64(meanMs)*0.15,
+		"average delay should be near %dms, got %.1fms", meanMs, avg)
+
+	assert.Greater(t, variance, 5.0,
+		"variance should be substantial for human-like timing, got %.1f", variance)
+
+	assert.GreaterOrEqual(t, minVal, 3.0, "delay must not go below floor")
+
+	assert.LessOrEqual(t, maxVal, float64(meanMs*3), "delay must not exceed 3x mean")
+}
+
+func TestGaussianDelay_VarianceMuchHigherThanUniform(t *testing.T) {
+	const n = 5000
+	meanMs := 10
+
+	var gSum, gSumSq float64
+	for i := 0; i < n; i++ {
+		d := float64(gaussianDelay(meanMs, 3))
+		gSum += d
+		gSumSq += d * d
+	}
+	gAvg := gSum / n
+	gVariance := gSumSq/n - gAvg*gAvg
+
+	// Old uniform: meanMs + rand.Intn(5) - 2, variance of {-2,-1,0,1,2} = 2.0
+	uniformVariance := 2.0
+
+	assert.Greater(t, gVariance, uniformVariance*3,
+		"Gaussian variance (%.1f) should be much larger than old uniform variance (%.1f)",
+		gVariance, uniformVariance)
+}
+
 func TestClampPoints(t *testing.T) {
 	tests := []struct {
 		name     string