Pup - the AI's own browser

@@ -656,6 +656,9 @@ function attachTab(session, sessionId, page, { makeActive = true, opener = 'user         session.activeTabId = session.tabs.length > 0 ? session.tabs[session.tabs.length - 1].tabId : null;       }       console.log(`Tab "${tabId}" of session "${sessionId}" closed by user. Remaining tabs: ${session.tabs.length}. Last URL: ${lastKnownUrl || '(unknown)'}`);+      // v1.9.279: if that was the LAST window of the session, reap it NOW (badge + identity + entry)+      // instead of leaving a stale icon until the next sweep — the aa.com-closed-by-another-thread case.+      if (session.tabs.length === 0) { try { reconcileModel('tab-close').catch(() => {}); } catch (e) {} }     }     // Auto-stop any tab recording for this tab     try {@@ -2925,11 +2928,13 @@ async function stampPupIdentity(sessionId, opts) {   // leaving them off... then i can play around with having it on or off and see if aumid is what's   // crashing the app or not"). Default stays OFF. When the user turns it on: ONE gentle stamp per   // window at creation ({once}), never the category re-stamp churn.-  if (minimalTouch()) {-    if (pupSettings().aumidIcons !== 'on' || !(opts && opts.once)) return false;-    const _s0 = sessions.get(sessionId);-    if (_s0 && _s0._curAppId) return true;-  }+  // v1.9.279: the stamp is now IDEMPOTENT and SELF-CORRECTING. aumidIcons is the single master+  // switch (works the same in minimal-touch or not). The old {once} guard blocked legitimate+  // identity CHANGES (grouped->split never re-stamped, so John's split setting never took effect);+  // idempotency now comes from the desired-vs-current appId compare below (a real change re-stamps+  // exactly once; no change is a no-op), so `opts` is ignored and reconcileModel can call this every+  // sweep with zero churn.+  if (pupSettings().aumidIcons !== 'on') return false;   if (process.platform !== 'win32' || !sessionId || _identitySupported === false) return false;   if (!_identityRegistered) { await ensurePupIdentityRegistered(); if (_identitySupported === false) return false; }   try {@@ -2981,9 +2986,14 @@ async function stampPupIdentity(sessionId, opts) {     const appId = _dashInfra ? `${PUP_APP_ID}.Dashboard.${PUP_ICON_GEN}`       : grouped ? PUP_APP_ID : `${PUP_APP_ID}.${sessionId}.${cat}.${PUP_ICON_GEN}`;     const prevAppId = sess && sess._curAppId;+    // v1.9.279 THE IDEMPOTENCY GATE: only touch the window when its identity actually changes.+    // desktop_set_window_identity RECREATES the taskbar button every call, so firing it when nothing+    // changed is exactly the churn/flicker (and suspected crash pressure) we must never cause. Equal+    // desired-vs-current appId => no-op. This is what lets reconcileModel run every sweep safely.+    if (prevAppId === appId) return true;     // Register the NEW appId BEFORE stamping (AD's verified order) so the fresh button resolves     // its icon/name from the registry the moment it is created.-    if ((!grouped || _dashInfra) && prevAppId !== appId) {+    if (true) {       try { await registerPupAumid(appId, sessionId); } catch (e) {}       // v1.9.61 — ORDER MATTERS (the live-tile trap, from AD's window-identity skill): Win11 bakes a       // taskbar button's art when the button is CREATED and never re-reads it. Stamping the new appId@@ -4882,6 +4892,46 @@ async function adoptDraggedOutTabs(sessionId) { // So reclamation must work from the WINDOW side, not the tab side: enumerate every page in every // pup profile, group by OS window, and adopt any window no session owns. Runs on a timer (out of // band — never inside a targetcreated handler, to keep the pipe safe).+// v1.9.279 THE RECONCILER (John: "your code must be 100% correct... i even just saw another ai+// thread close an aa.com pup window and then you left the aa.com icon in your overlay"). Every bug+// this session was the same class: pup's in-memory model drifting from OS reality (a closed window+// lingering, a stamp not updated when a setting changed, a recycled hwnd). This one pass, run+// UNGATED every few seconds and immediately after any setting change or tab close, makes the model+// match reality. It NEVER kills a process (that stays in the gated reclaim path); it only corrects+// pup's own bookkeeping and the taskbar identity, both cheap and idempotent.+let _reconcileBusy = false;+async function reconcileModel(reason) {+  if (process.platform !== 'win32' || _reconcileBusy) return;+  _reconcileBusy = true;+  try {+    // (1) REAP any session whose windows are all gone. This is the aa.com fix: a window closed by+    // ANOTHER thread (or the user) leaves a session with only closed page handles. Unlike the old+    // reaper, we do NOT require the whole profile's Chrome to be dead — one closed window on a live+    // shared profile is still a dead session, and its lingering badge/identity is the "stale icon".+    for (const [sid, s] of [...sessions]) {+      if (_launchInFlight.has(s.profileName)) continue;+      if (s._lostBrowser && s._disconnectedAt && (Date.now() - s._disconnectedAt < 120000)) continue; // heal window+      let anyOpen = false;+      for (const t of (s.tabs || [])) { try { if (t && t.page && !t.page.isClosed()) { anyOpen = true; break; } } catch (e) {} }+      if (anyOpen) continue;+      try { if (s._curAppId && s._curAppId !== PUP_APP_ID) await unregisterPupAumid(s._curAppId); } catch (e) {}+      try { fs.unlinkSync(path.join(require('os').tmpdir(), 'pup-badge-debug', sid + '.png')); } catch (e) {}+      try { _tabFavCache && s.tabs && s.tabs.forEach(() => {}); } catch (e) {}+      sessions.delete(sid);+      try { deleteSessionFile(sid); } catch (e) {}+      console.log(`[reconcile] reaped closed session "${sid}" (no open windows${reason ? ', ' + reason : ''}) — removed its badge + taskbar identity`);+    }+    // (2) STAMP CONSISTENCY: make every live window's taskbar identity match the CURRENT settings.+    // stampPupIdentity is idempotent (no-op unless the desired appId differs), so this both applies a+    // grouped<->split or style change to existing windows AND stamps any window that never got one.+    if (pupSettings().aumidIcons === 'on' && _identitySupported !== false) {+      for (const [sid, s] of [...sessions]) {+        if (!(s.tabs || []).length) continue;+        try { await stampPupIdentity(sid, {}); } catch (e) {}+      }+    }+  } finally { _reconcileBusy = false; }+} async function reclaimUnmanagedWindows() {   let reclaimed = 0;   const handledByRescan = new Set();@@ -8880,6 +8930,9 @@ const server = http.createServer(async (req, res) => {           const _ch = { ...(pupSettings()._chosen || {}), [key]: true };           savePupSettings(key === 'openFlash' ? { [key]: val, _openFlashChosen: true, _chosen: _ch } : { [key]: val, _chosen: _ch });           console.log(`[settings] "${key}" -> ${val} (dashboard dialog)`);+          // v1.9.279: a taskbar-identity setting must take effect on EXISTING windows immediately,+          // not just future ones. Reconcile now re-stamps every live window to match (idempotent).+          if (['aumidIcons', 'taskbarGrouping', 'aumidIconStyle'].includes(key)) reconcileModel('setting ' + key).catch(() => {});           return done({ ok: true, settings: pupSettings() });         }         if (act === 'fg' && sid) {@@ -12742,6 +12795,9 @@ server.listen(PORT, BIND_HOST, async () => {   // net, so an unbranded window can never persist even if its window-opened event was missed.   setTimeout(() => { reclaimUnmanagedWindows().catch(() => {}); }, 12000);   setInterval(() => { if (minimalTouch()) return; reclaimUnmanagedWindows().catch(() => {}); }, 90000);+  // v1.9.279: the reconciler runs UNGATED (bookkeeping + identity only, never a process kill), so+  // closed windows are reaped and stamp/settings drift is corrected within seconds, in every mode.+  setInterval(() => { reconcileModel('periodic').catch(() => {}); }, 8000);   // v1.9.179 — TAB RECONCILER. Prune dead/detached and duplicate tab entries so the taskbar count   // badge reflects the REAL live tabs (rapid reconnects had inflated 1-tab windows to "4") and the   // favicon overlay reads from a LIVE active tab instead of a detached phantom. Runs on a gentle