Pup - the AI's own browser

@@ -1060,8 +1060,20 @@ async function rescanAllProfiles({ adoptOrphans = false } = {}) { }  // Recover sessions from disk on startup — reconnect to existing Chrome processes+// v1.9.45: crash sentinel. Written before the risky recovery ops for ONE session and removed+// after that session settles, so a leftover file at boot names exactly the session that killed us.+const RECOVERY_SENTINEL = path.join(SESSIONS_DIR, '.recovery-in-flight');+let _poisonSessionId = null;+ async function recoverSessions() {   const files = listSessionFiles();+  try {+    if (fs.existsSync(RECOVERY_SENTINEL)) {+      _poisonSessionId = fs.readFileSync(RECOVERY_SENTINEL, 'utf8').trim() || null;+      if (_poisonSessionId) console.error(`[recovery] last boot died while recovering "${_poisonSessionId}" — that ONE session will be quarantined`);+      fs.unlinkSync(RECOVERY_SENTINEL);+    }+  } catch (e) {}   if (files.length === 0) return;   console.log(`Recovering ${files.length} session(s) from disk...`); @@ -1082,14 +1094,22 @@ async function recoverSessions() {     // SUCCEEDS clears the marker (saveSessionFile rewrites without it) — so a leftover marker     // means "this file crashed recovery," and one strike quarantines it. Bounds any poison file     // to a single crash instead of an unbounded loop.-    if (Number(sf.recoverAttempts || 0) >= 1) {-      console.error(`Session "${sessionId}" left an INCOMPLETE recovery attempt last boot (likely crashed pup) — QUARANTINING it (deleting the poison file) instead of retrying`);+    // v1.9.45: the per-session `recoverAttempts` strike above was WRONG and cost John all 6 of his+    // windows. It quarantined any file carrying an unfinished-attempt marker, but "unfinished" is+    // not the same as "crashed": any restart that races the marker-clearing write leaves the mark+    // behind on a perfectly healthy session, so a NORMAL restart could quarantine EVERYTHING (log:+    // "Recovering 6 session(s) from disk... Recovery complete. 0 session(s) active"). Crash+    // protection must not be able to delete healthy sessions — that is a worse failure than the+    // respawn loop it guards against.+    // The evidence we actually need is WHICH session was in flight when the process died. That is+    // one global sentinel, written before the risky ops and removed after, naming exactly one+    // session. A crash leaves it pointing at the poison file; everything else recovers untouched.+    if (_poisonSessionId === sessionId) {+      console.error(`Session "${sessionId}" was mid-recovery when pup died last boot (native crash) — QUARANTINING just this one; all other sessions still recover`);       deleteSessionFile(sessionId);       continue;     }-    try {-      fs.writeFileSync(sessionFilePath(sessionId), JSON.stringify({ ...sf, recoverAttempts: 1 }, null, 2));-    } catch (e) { /* if we can't mark it, still attempt — but the breaker only protects when the mark persists */ }+    try { fs.writeFileSync(RECOVERY_SENTINEL, sessionId); } catch (e) {}      // Check if Chrome is still alive     if (!isProcessAlive(pid)) {@@ -1181,6 +1201,10 @@ async function recoverSessions() {       deleteSessionFile(sessionId);     }   }+  // Every session got through its risky section, so nothing is in flight — drop the sentinel.+  // (Each iteration rewrites it, so a crash always leaves it naming the session that died.)+  try { if (fs.existsSync(RECOVERY_SENTINEL)) fs.unlinkSync(RECOVERY_SENTINEL); } catch (e) {}+  _poisonSessionId = null;   console.log(`Recovery complete. ${sessions.size} session(s) active.`); } @@ -7297,8 +7321,18 @@ server.listen(PORT, BIND_HOST, async () => {     console.error('Session recovery failed:', e.message);   } -  // v1.9.44: sweep orphaned AUMID keys AFTER recovery, so live sessions are known and kept.-  try { pruneStaleAumids(); } catch (e) {}+  // v1.9.45: sweep orphaned AUMID keys, but LATE. Running it straight after recoverSessions() looked+  // right and was wrong: when recovery legitimately ends with zero sessions (or is still settling),+  // "not a live session" matches EVERY key and the sweep deletes the whole set, unbranding windows+  // that were about to be re-stamped (observed: "pruned 12 stale keys" then keys: 0). Wait for the+  // session map to settle, and never sweep from an empty map — with no live sessions there is+  // nothing to distinguish stale from pending, so doing nothing is the correct, safe answer.+  setTimeout(() => {+    try {+      if (!sessions.size) { console.log('[identity] AUMID prune skipped — no live sessions to compare against'); return; }+      pruneStaleAumids();+    } catch (e) {}+  }, 60000);    // Periodic cleanup: every 5 minutes, remove stale session files with dead PIDs   setInterval(async () => {