Pup - the AI's own browser

@@ -1667,6 +1667,10 @@ function prepareCleanProfile(userDataDir) {     prefs.profile = prefs.profile || {};     prefs.profile.exit_type = 'Normal';     prefs.profile.exited_cleanly = true;+    // v1.9.129: the durable profile exists to ACCUMULATE logins — make sure Chrome's own+    // password manager is on so the "Save password?" bubble can do its job.+    prefs.credentials_enable_service = true;+    prefs.profile.password_manager_enabled = true;     prefs.session = prefs.session || {};     prefs.session.restore_on_startup = 5; // 5 = new tab page; 1 = restore last     prefs.session.startup_urls = [];@@ -4639,7 +4643,7 @@ async function setSessionWindowBounds(session, { x, y, width, height } = {}) {   } catch (e) { console.error(`[bounds] setSessionWindowBounds failed: ${e.message}`); return false; } } -async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPermissions = false, nativeSite = false, foreground = false, highFps = false } = {}) {+async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPermissions = false, nativeSite = false, foreground = false, highFps = false, insecureDev = false } = {}) {   // Check if browser already running for this profile.   // isConnected() can be stale after laptop sleep/wake — the WebSocket hasn't   // noticed the disconnect yet. Validate with a real CDP call (pages()) with@@ -4698,20 +4702,29 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer     defaultViewport: null,     // executablePath is set PER-CANDIDATE in the spawn-verified launch loop below.     args: [-      '--no-sandbox', '--disable-setuid-sandbox', '--disable-web-security',+      // v1.9.129 — SECURE BY DEFAULT, now that the default profile is durable and holds REAL+      // logins (John's Gmail as of today). Four flags removed from every default launch:+      //   --no-sandbox / --disable-setuid-sandbox: docker-era boilerplate; on a desktop the+      //     sandbox works and is strictly better protecting a credentialed profile.+      //   --disable-web-security: killed the same-origin policy, which was tolerable when every+      //     window was a throwaway empty jar and is UNSAFE on a profile with live sessions —+      //     any opened page could have read Gmail cross-origin.+      //   --test-type: existed only to hush the warning bars the flags above caused, and it+      //     also suppresses Chrome's promo/save bubbles — it is why Chrome NEVER OFFERED to+      //     save John's password. Remove the cause, lose the suppressor, get the bubble back.+      // Dev windows that truly need cross-origin eval opt back in per-window with+      // {webSecurity:false}, which FORCES an isolated throwaway profile (below) so the+      // insecure flags can never share a process with the credentialed jar.+      ...(insecureDev ? ['--no-sandbox', '--disable-setuid-sandbox', '--disable-web-security', '--test-type'] : []),       '--start-maximized', '--remote-debugging-port=0',       // Suppress "Sign in to Chromium" popup and first-run dialogs       '--no-first-run', '--no-default-browser-check', '--disable-default-apps',       '--disable-sync', '--disable-background-networking',       '--disable-infobars',-      // Kill the "Chrome is being controlled by automated test software" infobar.-      // It's triggered by the PRESENCE of the --enable-automation switch (Chrome keys on-      // presence, not value) — so ignoreDefaultArgs strips puppeteer's default one, and we-      // must NOT pass it ourselves. The old '--enable-automation=false' actually RE-ENABLED-      // the bar. Chrome-for-Testing hides this bar natively; regular Chrome/Edge need-      // --test-type (ChromeDriver's approach), which ALSO suppresses the "unsupported-      // command-line flag" (--disable-web-security) warning bar.-      '--test-type',+      // The "controlled by automated test software" infobar is keyed on the PRESENCE of+      // --enable-automation (stripped via ignoreDefaultArgs; never pass it). With the+      // unsupported flags gone from default launches (v1.9.129) there is no warning bar+      // left to hush, so --test-type is only added on the insecureDev opt-in above.       '--disable-blink-features=AutomationControlled',       // Tab recording uses CDP Page.startScreencast piped to ffmpeg — see       // tabRecordStartImpl below. CDP screencast is scoped to a specific@@ -5168,7 +5181,7 @@ async function createPageInNewWindow(browser) { // Launch a session as a tab in a Chrome browser // profile: which Chrome profile to use (defaults to sessionId) // If another session already uses that profile, this creates a NEW TAB in the same Chrome-async function launchSession(sessionId, url, { freshProfile = false, profile, strictPermissions = false, downloadPath = null, nativeSite = false, owner = null, takeover = false, foreground = false, silent = false, highFps = false } = {}) {+async function launchSession(sessionId, url, { freshProfile = false, profile, strictPermissions = false, downloadPath = null, nativeSite = false, owner = null, takeover = false, foreground = false, silent = false, highFps = false, insecureDev = false } = {}) {   const profileName = profile || sessionId;    // If session already exists and page is still alive, just navigate@@ -5241,7 +5254,7 @@ async function launchSession(sessionId, url, { freshProfile = false, profile, st   }    // Get or launch Chrome for this profile-  const browser = await getOrLaunchBrowser(profileName, { freshProfile, strictPermissions, nativeSite, foreground, highFps });+  const browser = await getOrLaunchBrowser(profileName, { freshProfile, strictPermissions, nativeSite, foreground, highFps, insecureDev });   // v1.9.76: a high-fps window is leased, never open-ended. See HIGHFPS_DEFAULT_MINUTES.   if (highFps) { try { highFpsGrant(sessionId, undefined); } catch (e) {} } @@ -6593,9 +6606,13 @@ const server = http.createServer(async (req, res) => {           //   isolated:true           -> a private throwaway dir (fresh-login test, act-as-other-user)           //   wiki PUBLIC view        -> per-session, UNCHANGED (keeps the logged-out view truly fresh)           //   everything else         -> DEFAULT_PROFILE (durable, shared, credential-accumulating)+          // v1.9.129: {webSecurity:false} is the dev escape hatch for cross-origin eval. It+          // implies isolation — the insecure flags are per-PROCESS, and the shared credentialed+          // profile must never run under them — so it overrides any profile the caller passed.+          if (args.webSecurity === false) args.isolated = true;+          if (args.isolated === true) args.profile = 'iso-' + args.sessionId;   // isolation beats any explicit profile           if (!args.profile) {-            if (args.isolated === true) args.profile = 'iso-' + args.sessionId;-            else if (isAdomUrl(args.url)) args.profile = args.sessionId;   // wiki public: unchanged+            if (isAdomUrl(args.url)) args.profile = args.sessionId;   // wiki public: unchanged             else args.profile = DEFAULT_PROFILE;           }           const sessionId = args.sessionId;@@ -6651,6 +6668,7 @@ const server = http.createServer(async (req, res) => {           try {             session = await launchSession(sessionId, args.url, {               freshProfile: !!args.freshProfile,+              insecureDev: args.webSecurity === false,               profile: args.profile,               strictPermissions: !!args.strictPermissions,               downloadPath,