Adom Bridge

@@ -1441,6 +1441,15 @@ AD auto-updates itself from the wiki manifest, but historically only a HUMAN cli - `update_set_mode {mode: auto|prompt|off}` -- the auto-apply POLICY. `auto` = unattended stage+apply on the 4h/on-launch poll (set this ONCE on headless fleet boxes and they self-update every release with no relay call); `prompt` = show the banner (default, attended); `off` = no checks.
   - Fleet flow: `update_status --target <box>` → if `updateAvailable` and unattended, `apply_update --target <box>` (or set `update_set_mode {"mode":"auto"}` once). A box must already be on ≥1.9.87 to have these verbs; the one-time bootstrap of an older box still needs a human click OR `auto` mode.
 
+### HD companion mode (v1.9.218+)
+
+When a HUMAN opens AD on a machine where Hydrogen Desktop is detected (embedded marker, HD's ports.json, or a discoverable HD install), AD shows an identity overlay ("This is Adom Desktop" + a large Open Hydrogen Desktop button), instantly opens or foregrounds HD, and places its own window directly below HD's in z-order — most people who open AD by hand were looking for HD. Facts an AI should know:
+
+- Human-open detection = bare argv AND parent process `explorer.exe` (double-click, Start menu, search, pins). Machine launches — `--autostart` boot, HD `--embedded` respawns, the relauncher/`restart` verb, CLI-style invocations — NEVER trigger it, so a remote `restart` cannot bounce the user's screen.
+- One-shot placement: AD does not fight the user's later alt-tabbing, and it is NOT a real Win32 child window (AD's lifecycle stays independent — the recovery-channel contract holds; if HD cannot be launched the overlay says so and AD stays fully usable).
+- Toggle: Settings > Hydrogen Desktop > "Act as a companion to Hydrogen Desktop", or `settings_set {"settings":{"hd_child_mode":false}}`. Default ON (self-gates on HD detection, so standalone installs never see it).
+- Forensics: every decision slogs `HD-COMPANION:` lines to startup.log.
+
 ### User settings over the API (`settings_get` / `settings_set`, v1.9.214+)
 
 AD's Settings-panel preferences are readable and settable over the API. This is the sanctioned channel for an embedding app (Hydrogen Desktop) to render AD's settings in its own panel and forward the user's changes; it also lets a fleet operator read or fix a box's boot/update prefs remotely.
@@ -2021,6 +2030,29 @@ Profile-picking heuristics for Docker Claude: 
 `profile` is optional. Omit it to open in whichever profile the browser was last using (legacy v1.6.x behavior). Profile flag is silently ignored when `browser:"default"` (no clean way to inject through the OS URL handler — name the browser explicitly to use it).
 
+### Decrypting the user's saved browser credentials — `desktop_decrypt_browser_credentials` (v1.9.220+)
+
+So pup can run an **"adom-you" Chrome profile signed in AS the user** — surfing the web on the user's behalf — it needs the user's real saved logins/cookies to seed that profile. Chrome 127+ encrypts these with **App-Bound Encryption** (the master key is DPAPI-wrapped under the SYSTEM account), so only an elevated helper can decrypt them. This verb is that path.
+
+```bash
+adom-desktop desktop_decrypt_browser_credentials '{
+  "browsers": ["chrome", "edge"],   # optional; default = all installed Chromium browsers
+  "include": ["passwords", "cookies"] # optional; default = both
+}'
+# → { "ok": true,
+#     "passwords": [ { "origin", "username", "password", "sourceBrowser", "sourceProfile", "sourceAccount", "lastUsed" }, ... ],
+#     "cookies":   [ { "host", "name", "value", "path", "sourceBrowser", "sourceProfile", ... }, ... ],
+#     "stats": { "profilesRead", "passwordsOk", "passwordsFailed", "cookiesOk", "cookiesFailed" } }
+```
+
+**How to call it (this is not a normal verb — read this):**
+
+- **LOCAL / bridge callers only.** A relay (cloud-AI) call is refused unconditionally with `errorCode:"relay_forbidden"` and **pops no UAC** — a remote container must never be able to trigger a password-decrypt. pup (a loopback bridge) and the local CLI reach it.
+- **Two human gates, in order:** (1) AD shows an in-window consent dialog + toast naming the requesting caller ("pup is requesting your saved browser passwords/cookies…"); decline → `errorCode:"consent_declined"`. (2) On continue, an elevated signed helper runs behind a **UAC prompt** ("Adom Industries, Inc."); cancel → `errorCode:"elevation_declined"`. The UAC elevation IS the user's permission for the decrypt — by design (John, wiki #457).
+- **Plaintext is returned ONCE over the loopback API and is never written to disk or logged.** Don't echo the values into any other verb's args, any activity-log emit, or any file. Consume the rows, seed the profile/vault, drop them.
+- **errorCodes:** `relay_forbidden` (you called it over the relay — you can't), `consent_declined`, `elevation_declined`, `helper_missing` (the signed helper isn't bundled — the install is broken). Per-item decrypt failures are counted in `stats.*Failed`, never fail the whole run (a managed-profile policy can block cookies; newest-Chrome `v20` blobs are best-effort if Google rotated the elevation-service key).
+- **Pair it with `desktop_list_browsers`** (above) to show the user which browsers/profiles/accounts will be read before you ask.
+
 **Node.js not installed (the puppeteer bridge can't auto-spawn):**
 
 v1.7.0+ — any `browser_*` command returning `errorCode:"node_not_found"` means Node isn't on the desktop machine. Trigger the unattended winget install:

⋯ 1 unchanged line ⋯

@@ -1,6 +1,6 @@ {
   "slug": "adom-desktop",
-  "version": "1.9.217",
+  "version": "1.9.228",
   "type": "app",
   "brief": "Adom Desktop unleashes your AI onto your full PC: full power, full safety. The AI breaks out of the container it runs in and onto your real machine, managing and running your entire laptop as you: launch apps, move files, drive any window, control KiCad, Fusion 360 or your real signed-in browser. Works with any AI, cloud or local (Claude Desktop, Claude Code, Codex), no Hydrogen required. Bridges make it an operating system for AI with managed Node and Python runtimes, and a human-only permission system keeps you in charge of every side-effecting command.",
   "description": "Install this package in a cloud or Hydrogen Desktop container, not on the PC. It delivers two things: the Linux adom-desktop CLI (linked onto PATH) and the Claude skill set that teaches an AI every desktop verb (shell, files, screenshots, windows, notifications, KiCad, Fusion 360, browser automation). The CLI drives the Adom Desktop app running on your Windows PC over the relay; the Windows app itself is the separate installer in the Download box, not part of this package. Run adom-wiki pkg update to keep the CLI and skills current.",

@@ -1,6 +1,6 @@ {   "slug": "adom-desktop",-  "version": "1.9.217",+  "version": "1.9.228",   "type": "app",   "description": "Install this package in a cloud or Hydrogen Desktop container, not on the PC. It delivers two things: the Linux adom-desktop CLI (linked onto PATH) and the Claude skill set that teaches an AI every desktop verb (shell, files, screenshots, windows, notifications, KiCad, Fusion 360, browser automation). The CLI drives the Adom Desktop app running on your Windows PC over the relay; the Windows app itself is the separate installer in the Download box, not part of this package. Run adom-wiki pkg update to keep the CLI and skills current.",   "keywords": [

@@ -1441,6 +1441,15 @@ AD auto-updates itself from the wiki manifest, but historically only a HUMAN cli - `update_set_mode {mode: auto|prompt|off}` -- the auto-apply POLICY. `auto` = unattended stage+apply on the 4h/on-launch poll (set this ONCE on headless fleet boxes and they self-update every release with no relay call); `prompt` = show the banner (default, attended); `off` = no checks.
   - Fleet flow: `update_status --target <box>` → if `updateAvailable` and unattended, `apply_update --target <box>` (or set `update_set_mode {"mode":"auto"}` once). A box must already be on ≥1.9.87 to have these verbs; the one-time bootstrap of an older box still needs a human click OR `auto` mode.
 
+### HD companion mode (v1.9.218+)
+
+When a HUMAN opens AD on a machine where Hydrogen Desktop is detected (embedded marker, HD's ports.json, or a discoverable HD install), AD shows an identity overlay ("This is Adom Desktop" + a large Open Hydrogen Desktop button), instantly opens or foregrounds HD, and places its own window directly below HD's in z-order — most people who open AD by hand were looking for HD. Facts an AI should know:
+
+- Human-open detection = bare argv AND parent process `explorer.exe` (double-click, Start menu, search, pins). Machine launches — `--autostart` boot, HD `--embedded` respawns, the relauncher/`restart` verb, CLI-style invocations — NEVER trigger it, so a remote `restart` cannot bounce the user's screen.
+- One-shot placement: AD does not fight the user's later alt-tabbing, and it is NOT a real Win32 child window (AD's lifecycle stays independent — the recovery-channel contract holds; if HD cannot be launched the overlay says so and AD stays fully usable).
+- Toggle: Settings > Hydrogen Desktop > "Act as a companion to Hydrogen Desktop", or `settings_set {"settings":{"hd_child_mode":false}}`. Default ON (self-gates on HD detection, so standalone installs never see it).
+- Forensics: every decision slogs `HD-COMPANION:` lines to startup.log.
+
 ### User settings over the API (`settings_get` / `settings_set`, v1.9.214+)
 
 AD's Settings-panel preferences are readable and settable over the API. This is the sanctioned channel for an embedding app (Hydrogen Desktop) to render AD's settings in its own panel and forward the user's changes; it also lets a fleet operator read or fix a box's boot/update prefs remotely.
@@ -2021,6 +2030,29 @@ Profile-picking heuristics for Docker Claude: 
 `profile` is optional. Omit it to open in whichever profile the browser was last using (legacy v1.6.x behavior). Profile flag is silently ignored when `browser:"default"` (no clean way to inject through the OS URL handler — name the browser explicitly to use it).
 
+### Decrypting the user's saved browser credentials — `desktop_decrypt_browser_credentials` (v1.9.220+)
+
+So pup can run an **"adom-you" Chrome profile signed in AS the user** — surfing the web on the user's behalf — it needs the user's real saved logins/cookies to seed that profile. Chrome 127+ encrypts these with **App-Bound Encryption** (the master key is DPAPI-wrapped under the SYSTEM account), so only an elevated helper can decrypt them. This verb is that path.
+
+```bash
+adom-desktop desktop_decrypt_browser_credentials '{
+  "browsers": ["chrome", "edge"],   # optional; default = all installed Chromium browsers
+  "include": ["passwords", "cookies"] # optional; default = both
+}'
+# → { "ok": true,
+#     "passwords": [ { "origin", "username", "password", "sourceBrowser", "sourceProfile", "sourceAccount", "lastUsed" }, ... ],
+#     "cookies":   [ { "host", "name", "value", "path", "sourceBrowser", "sourceProfile", ... }, ... ],
+#     "stats": { "profilesRead", "passwordsOk", "passwordsFailed", "cookiesOk", "cookiesFailed" } }
+```
+
+**How to call it (this is not a normal verb — read this):**
+
+- **LOCAL / bridge callers only.** A relay (cloud-AI) call is refused unconditionally with `errorCode:"relay_forbidden"` and **pops no UAC** — a remote container must never be able to trigger a password-decrypt. pup (a loopback bridge) and the local CLI reach it.
+- **Two human gates, in order:** (1) AD shows an in-window consent dialog + toast naming the requesting caller ("pup is requesting your saved browser passwords/cookies…"); decline → `errorCode:"consent_declined"`. (2) On continue, an elevated signed helper runs behind a **UAC prompt** ("Adom Industries, Inc."); cancel → `errorCode:"elevation_declined"`. The UAC elevation IS the user's permission for the decrypt — by design (John, wiki #457).
+- **Plaintext is returned ONCE over the loopback API and is never written to disk or logged.** Don't echo the values into any other verb's args, any activity-log emit, or any file. Consume the rows, seed the profile/vault, drop them.
+- **errorCodes:** `relay_forbidden` (you called it over the relay — you can't), `consent_declined`, `elevation_declined`, `helper_missing` (the signed helper isn't bundled — the install is broken). Per-item decrypt failures are counted in `stats.*Failed`, never fail the whole run (a managed-profile policy can block cookies; newest-Chrome `v20` blobs are best-effort if Google rotated the elevation-service key).
+- **Pair it with `desktop_list_browsers`** (above) to show the user which browsers/profiles/accounts will be read before you ask.
+
 **Node.js not installed (the puppeteer bridge can't auto-spawn):**
 
 v1.7.0+ — any `browser_*` command returning `errorCode:"node_not_found"` means Node isn't on the desktop machine. Trigger the unattended winget install:

@@ -1,16 +1,16 @@ {
   "manifest_version": 1,
-  "version": "1.9.217",
-  "released_at": "2026-08-03T12:35:43Z",
+  "version": "1.9.228",
+  "released_at": "2026-08-05T17:45:00Z",
   "windows": {
-    "installer_url": "https://wiki.adom.inc/download/adom/adom-desktop/1.9.217/Adom.Desktop_1.9.217_windows_x64-setup.exe",
-    "installer_filename": "Adom.Desktop_1.9.217_windows_x64-setup.exe",
-    "installer_sha256": "0218dc85a89e8a40128a00a9019b98704cf42ad5f9794cfb1887805651665b9e",
-    "installer_size": 13681640
+    "installer_url": "https://wiki.adom.inc/download/adom/adom-desktop/1.9.228/Adom.Desktop_1.9.228_windows_x64-setup.exe",
+    "installer_filename": "Adom.Desktop_1.9.228_windows_x64-setup.exe",
+    "installer_sha256": "23327b8c5078af7c178c1b21c54f73a8889bf821b4296f5d1f36bc4583b3400b",
+    "installer_size": 14317672
   },
   "changelog_url": "https://wiki.adom.inc/adom/adom-desktop",
   "minimum_required": "1.3.30",
-  "note": "server_sync + hourly cloud-profile re-sync (token rotation without remove/add); supervise token via env not argv; launch-on-boot self-heals while running; settings_get/settings_set; day-scale logs; caption TTL fail-safe.",
+  "note": "HD companion mode (identity overlay + one-click hand-off to Hydrogen Desktop) with a Settings button to re-show it; session-scoped Disconnect (holds until relaunch, no dark-machine footgun); reconnect backoff + full-command shell-approval toast; desktop_decrypt_browser_credentials (elevated, consented browser-credential import for pup, with a synced consent dialog + toast); and a GUI performance fix: static status LEDs eliminate an infinite box-shadow animation that pegged the WebView2 renderer at idle and overheated heavy-bridge machines.",
   "macos": {
     "installer_url": "https://wiki.adom.inc/download/adom/adom-desktop-macos/1.9.162/Adom.Desktop_1.9.162_macos_aarch64.dmg",
     "installer_filename": "Adom.Desktop_1.9.162_macos_aarch64.dmg",