Pup - the AI's own browser

@@ -1766,6 +1766,7 @@ async function updateTabCountBadge(session, sessionId) {       }       return;     }+    if (session._appOverlay) { applyAppOverlay(session, sessionId).catch(() => {}); return; } // app icon owns the slot; tooltip carries the count     const count = (session.tabs || []).length;     if (count >= 2) {       const icon = tabBadgeIcon(count);@@ -1809,6 +1810,74 @@ async function brandSweep(reason) {   if (n) console.log(`[brand-sweep] (${reason}) re-branded ${n} window(s) to current identity`); } +// v1.8.92: APP-FAVICON overlay (John's standard: a pup window driven by an app WEARS that+// app's icon). Source of truth = the page's own <link rel="icon"> — the exact artifact the+// adom-ui-design standard mandates every app serve (monochrome white mark; see hd-tab-icons:+// the served favicon is the canonical webview identity, and pup now honors the same contract).+// Explicit overrides: browser_open_window {appIconB64|appIconUrl, appName}. Composited onto a+// dark rounded plate via sharp (white marks need dark backing on the taskbar). An app-looking+// URL (localhost / *.adom.cloud proxy) serving NO favicon gets a loud reprimand hint teaching+// the standard. When an app icon is worn, it takes the overlay slot; the tab count moves to+// the hover tooltip (grouped mode's dual counter is unaffected).+async function fetchPageFavicon(page) {+  try {+    return await page.evaluate(async () => {+      const links = Array.from(document.querySelectorAll('link[rel~="icon"], link[rel="shortcut icon"], link[rel="apple-touch-icon"]'));+      const hrefs = links.map(l => l.href).filter(Boolean);+      hrefs.push(new URL('/favicon.ico', location.origin).href);+      for (const href of hrefs) {+        try {+          const r = await fetch(href, { cache: 'force-cache' });+          if (!r.ok) continue;+          const blob = await r.blob();+          if (!blob.size) continue;+          const b64 = await new Promise((res, rej) => { const fr = new FileReader(); fr.onload = () => res(fr.result.split(',')[1]); fr.onerror = rej; fr.readAsDataURL(blob); });+          return { b64, mime: blob.type || '', href };+        } catch (e) {}+      }+      return null;+    });+  } catch (e) { return null; }+}+const _appOverlayCache = new Map(); // sessionId -> composited b64+async function applyAppOverlay(session, sessionId) {+  if (process.platform !== 'win32' || _identitySupported !== true) return false;+  try {+    let src = session._appIconB64 ? { b64: session._appIconB64, mime: session._appIconMime || 'image/png' } : null;+    if (!src) src = await fetchPageFavicon(session.page);+    if (!src || !src.b64) { session._appOverlay = false; return false; }+    let overlay = _appOverlayCache.get(sessionId + ':' + (src.href || 'explicit'));+    if (!overlay) {+      if (/x-icon|vnd\.microsoft\.icon/.test(src.mime) || (src.href || '').endsWith('.ico')) {+        overlay = src.b64; // AD accepts ico base64 directly; no compositing possible (sharp can't read ico)+      } else {+        let sharpMod = null;+        try { sharpMod = require('sharp'); } catch (e) { return false; }+        try {+          const iconPng = await sharpMod(Buffer.from(src.b64, 'base64')).resize(22, 22, { fit: 'inside' }).png().toBuffer();+          const plate = Buffer.from(`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect x="0" y="0" width="32" height="32" rx="8" fill="#0b2325" fill-opacity="0.92"/></svg>`);+          overlay = (await sharpMod(plate).resize(32, 32).composite([{ input: iconPng, gravity: 'centre' }]).png().toBuffer()).toString('base64');+        } catch (e) { return false; }+      }+      _appOverlayCache.set(sessionId + ':' + (src.href || 'explicit'), overlay);+    }+    const tabs = (session.tabs || []).length;+    const nm = session._appName ? `${session._appName} — ` : '';+    await chrome.adCommand('desktop_taskbar', {+      titleContains: `(session: ${sessionId}`,+      overlay: { icon: overlay, tooltip: `Adom Pup — ${nm}${tabs} tab${tabs === 1 ? '' : 's'}` },+    }, { timeoutMs: 5000 });+    session._appOverlay = true;+    return true;+  } catch (e) { return false; }+}+function appIconReprimand(url, hadFavicon) {+  if (hadFavicon) return '';+  const appish = /localhost|127\.0\.0\.1|\.adom\.cloud\/proxy\//i.test(String(url || ''));+  if (!appish) return '';+  return ' 🎨 APP ICON MISSING: this looks like an Adom app, but the page serves NO favicon, so its pup window cannot wear the app\'s icon (and its webview tab shows a blank icon too). The adom-ui-design standard requires every app to serve a favicon (<link rel="icon">, monochrome WHITE mark, clean 24x24 SVG — see the adom-ui-design + app-creator skills). Add one and reopen, or pass appIconB64/appIconUrl on browser_open_window meanwhile.';+}+ // Brand a pup window: full identity on capable AD, overlay badge fallback on older AD. async function brandPupWindow(sessionId) {   const stamped = await stampPupIdentity(sessionId);@@ -3905,7 +3974,7 @@ const server = http.createServer(async (req, res) => {                      hint: m.hint || summary, related: m.related || [], pitfalls: m.pitfalls || [] };           };           sendJSON(res, { success: true, bridge: 'puppeteer', verbs: [-            V('browser_open_window', 'Open a generic pup window — a fresh isolated Chrome/Edge process (never your real signed-in browser), fully drivable via CDP. ALWAYS opens in the BACKGROUND (does not steal focus; never disturbs the user\'s main work; still fully screenshottable/drivable) UNLESS you pass foreground:true — do that ONLY when the user explicitly wants to watch. Pass width+height (+ optional x,y, screen px) to place it at a specific size/position for screenshot framing — this NO LONGER foregrounds it (sizing stays in the background too; default unsized is maximized). profile defaults to sessionId. OWNERSHIP: sessionIds are shared across ALL AI threads — use a task-prefixed sessionId + owner:"<your-task>" so pup can refuse other threads stealing your window (reusing an existing id with a new url navigates it away; declared cross-owner reuse errors with session_owned_by_another_thread unless takeover:true). (For the user\'s REAL Chrome/Edge, use the Adom extension\'s nbrowser_* verbs.)', { sessionId: 'required str — task-prefix it (e.g. "mytask-web"); generic ids collide across threads', url: 'optional str', profile: 'optional str — defaults to sessionId', owner: 'optional str — your thread/task label; lets pup protect this window from other threads', takeover: 'optional bool — claim a window owned by another thread (only when the user explicitly asks)', foreground: 'optional bool — request showing the window on the user\'s screen. GATED (v1.8.70): requires foregroundReason too, else the open succeeds but stays BACKGROUND with foregroundDenied set. Only when the USER explicitly asked to watch.', foregroundReason: 'required WITH foreground:true — quote/paraphrase what the user said that justifies putting a window on their screen (min 10 chars; logged + recorded in lastAgentUpdate, auditable)', width: 'optional int px — sizes for screenshot framing, stays background', height: 'optional int px', x: 'optional int px', y: 'optional int px', updateNote: 'optional str — a short "what I did" note, surfaced back in list_tabs/list_windows as lastAgentUpdate so the user knows what changed', autoFlash: 'optional bool (default true) — mutating verbs auto-flash this window\'s taskbar (debounced, never steals focus) so the user notices the agent touched it; pass false to make this window silent by default', silent: 'optional bool — suppress the auto-flash for just this call' }, 60, { sessionId: 'mytask-web', owner: 'mytask', url: 'https://example.com', width: 960, height: 540 }),+            V('browser_open_window', 'Open a generic pup window — a fresh isolated Chrome/Edge process (never your real signed-in browser), fully drivable via CDP. ALWAYS opens in the BACKGROUND (does not steal focus; never disturbs the user\'s main work; still fully screenshottable/drivable) UNLESS you pass foreground:true — do that ONLY when the user explicitly wants to watch. Pass width+height (+ optional x,y, screen px) to place it at a specific size/position for screenshot framing — this NO LONGER foregrounds it (sizing stays in the background too; default unsized is maximized). profile defaults to sessionId. OWNERSHIP: sessionIds are shared across ALL AI threads — use a task-prefixed sessionId + owner:"<your-task>" so pup can refuse other threads stealing your window (reusing an existing id with a new url navigates it away; declared cross-owner reuse errors with session_owned_by_another_thread unless takeover:true). (For the user\'s REAL Chrome/Edge, use the Adom extension\'s nbrowser_* verbs.)', { sessionId: 'required str — task-prefix it (e.g. "mytask-web"); generic ids collide across threads', url: 'optional str', profile: 'optional str — defaults to sessionId', owner: 'optional str — your thread/task label; lets pup protect this window from other threads', takeover: 'optional bool — claim a window owned by another thread (only when the user explicitly asks)', foreground: 'optional bool — request showing the window on the user\'s screen. GATED (v1.8.70): requires foregroundReason too, else the open succeeds but stays BACKGROUND with foregroundDenied set. Only when the USER explicitly asked to watch.', foregroundReason: 'required WITH foreground:true — quote/paraphrase what the user said that justifies putting a window on their screen (min 10 chars; logged + recorded in lastAgentUpdate, auditable)', width: 'optional int px — sizes for screenshot framing, stays background', height: 'optional int px', x: 'optional int px', y: 'optional int px', appName: 'optional str — the APP this window is driving (e.g. "shotlog"); shown in the hover tooltip', appIconB64: 'optional base64 PNG — override the app icon worn in the taskbar overlay. Usually UNNECESSARY: pup auto-fetches the page\'s own <link rel="icon"> favicon (the adom-ui-design standard artifact every app must serve) and wears it automatically. An app-looking URL with NO favicon gets a reprimand hint.', updateNote: 'optional str — a short "what I did" note, surfaced back in list_tabs/list_windows as lastAgentUpdate so the user knows what changed', autoFlash: 'optional bool (default true) — mutating verbs auto-flash this window\'s taskbar (debounced, never steals focus) so the user notices the agent touched it; pass false to make this window silent by default', silent: 'optional bool — suppress the auto-flash for just this call' }, 60, { sessionId: 'mytask-web', owner: 'mytask', url: 'https://example.com', width: 960, height: 540 }),             V('browser_open_tab', 'Open a new tab in an EXISTING session/window (returns {tabId, tabCount, activeTabId} — no need to diff list_tabs). This is the right verb for multi-URL work: ONE window with many tabs (one taskbar button), not many windows. The window stays in the background; the tab auto-flashes the taskbar (debounced) so the user notices. The USER can click the window\'s taskbar button at any time to view it — pup never pulls it back down.', { sessionId: 'required str', url: 'optional str', updateNote: 'optional str — short "what I did" note surfaced in list_tabs as lastAgentUpdate', silent: 'optional bool — suppress the auto-flash for this call' }, 30, { sessionId: 'work', url: 'https://example.com' }),             V('browser_close_tab', 'Close a tab.', { sessionId: 'required str', tabId: 'optional str (default active)' }, 15, { sessionId: 'work' }),             V('browser_close_window', 'Close a window/session (its tabs go too).', { sessionId: 'required str' }, 20, { sessionId: 'work' }),@@ -4040,6 +4109,9 @@ const server = http.createServer(async (req, res) => {           // and the response says exactly what was missing. A granted foreground is logged +           // recorded in lastAgentUpdate so the user can always audit who put a window on their           // screen and why. Also accepts abe's arg name userRequestedForeground.+          // v1.8.92: app identity args — the driving app's icon/name for the window overlay.+          const _appIconB64 = (typeof args.appIconB64 === 'string' && args.appIconB64.length > 50) ? args.appIconB64 : null;+          const _appName = (typeof args.appName === 'string' && args.appName.trim()) ? args.appName.trim() : null;           const fgRequested = !!(args.foreground || args.raise || args.show || args.userRequestedForeground);           const fgReason = (typeof args.foregroundReason === 'string' && args.foregroundReason.trim().length >= 10) ? args.foregroundReason.trim() : null;           const fgGranted = fgRequested && !!fgReason;@@ -4081,6 +4153,8 @@ const server = http.createServer(async (req, res) => {           // Stash on the session so attachTab uses it for any subsequent           // tab open or popup auto-attach in this session.           if (session) session._downloadPath = downloadPath;+          if (session && _appIconB64) { session._appIconB64 = _appIconB64; session._appIconMime = 'image/png'; }+          if (session && _appName) session._appName = _appName;           // v1.8.50: the background watchdog runs concurrently with navigation. Await its           // SELF-VERIFIED verdict (bounded) so the response's `background` field is the real           // outcome ('backgrounded'/'still-foreground'), never a guess mid-park.@@ -4088,6 +4162,12 @@ const server = http.createServer(async (req, res) => {             const bp = session && browsers.get(session.profileName)?.browser?._bgPromise;             if (bp) await Promise.race([bp, new Promise(r => setTimeout(r, 7000))]);           } catch (e) {}+          // v1.8.92: wear the driving app's favicon in the overlay (page-served or explicit).+          let _appIconWorn = false;+          if (session && process.platform === 'win32') {+            try { _appIconWorn = await Promise.race([applyAppOverlay(session, sessionId), new Promise(r => setTimeout(() => r(false), 4000))]); } catch (e) {}+          }+          const appIconHint = appIconReprimand(args.url, _appIconWorn);           const info = await getSessionInfo(sessionId, session);           // v1.8.0: BACKGROUND BY DEFAULT. pup is the AI's workspace, not the user's —           // a window that pops to the foreground and covers what the user is doing is@@ -4188,8 +4268,9 @@ const server = http.createServer(async (req, res) => {               // v1.8.16: reuse/ownership verdict (null = fresh window).               reused: reuse ? { navigatedAway: reuse.navigatedAway, previousUrl: reuse.previousUrl, previousOwner: reuse.previousOwner, takeover: reuse.takeover } : null,               owner: session.owner || null,+              appIconWorn: _appIconWorn || undefined,               foregroundDenied: fgDenied ? 'foreground_reason_required' : undefined,-              _hint: `${authSteerHint(args.url)}${fgDenyHint}${bgHint}${ownHint} ${brep._hint}${staleWindowsHint()}${adUpgradeHint()}`,+              _hint: `${authSteerHint(args.url)}${fgDenyHint}${appIconHint}${bgHint}${ownHint} ${brep._hint}${staleWindowsHint()}${adUpgradeHint()}`,               ...info,             }),           });@@ -5572,6 +5653,7 @@ const server = http.createServer(async (req, res) => {           if (session.tabs.length === 1) {             saveSessionFile(resolvedId, session.profileName, args.url);           }+          if (session && process.platform === 'win32') { setTimeout(() => { applyAppOverlay(session, resolvedId).catch(() => {}); }, 1500); } // v1.8.92: new site, new favicon           sendJSON(res, { success: true, output: JSON.stringify({ ok: true, url: args.url, sessionId: resolvedId, tabId, ...(authSteerHint(args.url) ? { _hint: authSteerHint(args.url).trim() } : {}) }) });           return;         }