Pup - the AI's own browser

@@ -30,7 +30,7 @@ only CDP can do. pup no longer falls back to CDP on its own for any reason. - Pro: one shared adom-you browser, so logins and cookies accumulate for every thread, and every window carries the full toolbar including nbe. - Con: `pup_eval` runs in the page's MAIN world, so a page with a strict Content-Security-Policy (wiki.adom.inc, claude.ai) refuses it with "Evaluating a string as JavaScript violates the following Content Security Policy". Use `pup_screenshot`, `pup_list_tabs`, `pup_navigate` and the other DOM-free verbs there, or `lane:"cdp"` if you truly must run script on such a page and accept that vendor sites will not load in that window. - Note on screenshots (2.0.576): stock Chrome stops painting a window that is COMPLETELY covered by other windows, and every capture of such a window failed with Chrome's own "image readback failed" (measured 2026-09-14: 0 of 20 tabs under a maximized Edge; the same 20 captured the moment the window was raised). Attaching `chrome.debugger` for a one-frame `Page.startScreencast` did NOT help: no frame ever arrives for a natively occluded tab (measured: "first screencast frame timed out after 8000 ms" on all 20), and `Page.captureScreenshot` never returns at all (it hung the lane in 2.0.574). The fix is the one the CDP lane has always used: the lane launches with `CalculateNativeWinOcclusion` disabled, so a covered window keeps compositing and the plain capture works. Compositor-only, nothing on the wire, so vendor sites are unaffected. The debugger path remains only as a deadline-bounded fallback. Background TABS are still throttled by Chrome as before; this is not the highFps anti-throttle set.-- Since 2.0.578 the extension lane ALSO has trusted input (`pup_click`, `pup_hover`, `pup_type`, `pup_press_key`, `pup_scroll`, `pup_fill`), element and full-resolution screenshots, and CSP-proof `pup_eval` (a page whose Content-Security-Policy refuses the injected eval is retried through DevTools automatically). They ride nbe's DevTools driver inside the lane (`chrome.debugger`, attached to one tab on demand, detached after nbe's idle window; no debug port, no automation flag, `navigator.webdriver` stays false, no bar). Since 2.0.581 recording (`pup_record_start` / `pup_record_stop`) works on this lane too: it rides ab's native recorder (Windows Graphics Capture, hardware H.264 MP4, keyed on the window handle), which records a covered window live and emits frames only when the content changes. Still CDP-only: selector-driven `pup_download`, `realKeystrokes` logins, iframe targeting, separate profiles (backlog: pup-bridge#113), `highFps`, `webSecurity:false`. Those answer `lane_needs_cdp` with the fix.+- Since 2.0.578 the extension lane ALSO has trusted input (`pup_click`, `pup_hover`, `pup_type`, `pup_press_key`, `pup_scroll`, `pup_fill`), element and full-resolution screenshots, `pup_select` (a `<select>` by value or label, 2.0.592), and CSP-proof `pup_eval` (a page whose Content-Security-Policy or Trusted Types policy refuses the injected eval is retried through DevTools automatically, 2.0.591; Google Calendar and Admin are the everyday cases). They ride nbe's DevTools driver inside the lane (`chrome.debugger`, attached to one tab on demand, detached after nbe's idle window; no debug port, no automation flag, `navigator.webdriver` stays false, no bar). Since 2.0.581 recording (`pup_record_start` / `pup_record_stop`) works on this lane too: it rides ab's native recorder (Windows Graphics Capture, hardware H.264 MP4, keyed on the window handle), which records a covered window live and emits frames only when the content changes. Still CDP-only: selector-driven `pup_download`, `realKeystrokes` logins, iframe targeting, separate profiles (backlog: pup-bridge#113), `highFps`, `webSecurity:false`. Those answer `lane_needs_cdp` with the fix.  **CDP lane** - Pro: everything DevTools can do: trusted mouse and keyboard events, cross-origin iframes, `Runtime.evaluate` that ignores page CSP, element and full-res screenshots, annotate, recording, emulation, separate profiles, anti-throttle for a live view.