Pup - the AI's own browser

@@ -1581,7 +1581,7 @@ async function findChromesByProfile(profileName) {       const result = spawnSync('powershell', [         '-NoProfile',         '-Command',-        `Get-CimInstance Win32_Process -Filter "Name='chrome.exe'" | Where-Object { $_.CommandLine -match '${profileName.replace(/[\\.\\^\\$\\*\\+\\?\\(\\)\\[\\]\\{\\}\\|\\\\]/g, '\\\\$&')}' } | Select-Object ProcessId, CommandLine | ConvertTo-Json -Compress`,+        `Get-CimInstance Win32_Process -Filter "Name='chrome.exe'" | Where-Object { $_.CommandLine -match '${psRegexEscape(profileName)}' } | Select-Object ProcessId, CommandLine | ConvertTo-Json -Compress`,       ], { encoding: 'utf8', timeout: 10_000, windowsHide: true });       if (result.stdout) {         let parsed;@@ -1939,7 +1939,7 @@ async function rescanAllProfiles({ adoptOrphans = false } = {}) {   try {     if (process.platform === 'win32') {       const { spawnSync } = require('child_process');-      const profilesDir = PROFILES_DIR.replace(/[\\.\\^\\$\\*\\+\\?\\(\\)\\[\\]\\{\\}\\|\\\\]/g, '\\\\$&');+      const profilesDir = psRegexEscape(PROFILES_DIR);       const result = spawnSync('powershell', [         '-NoProfile', '-Command',         `Get-CimInstance Win32_Process -Filter "Name='chrome.exe'" | Where-Object { $_.CommandLine -match 'remote-debugging-port' -and $_.CommandLine -match '${profilesDir}' -and $_.CommandLine -notmatch '--type=' } | ForEach-Object { if ($_.CommandLine -match 'user-data-dir=([^"]*?)(?=\\s+--|"$|$)') { Split-Path -Leaf $matches[1] } } | Sort-Object -Unique`,@@ -6259,19 +6259,7 @@ async function applyAppOverlay(session, sessionId) {           let _u2 = '';           try { _u2 = (activePage && activePage.url()) || ''; } catch (e) {}           const _isPdf2 = /\.pdf(\?|#|$)/i.test(_u2);-          const _svg2 = _isPdf2-            ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">'-              + '<rect x="0" y="0" width="48" height="48" rx="9" fill="#f1f3f4"/>'-              + '<path d="M13 8 h15 l8 8 v24 a1 1 0 0 1-1 1 H14 a1 1 0 0 1-1-1 V9 a1 1 0 0 1 1-1 Z" fill="#ffffff" stroke="#9aa0a6" stroke-width="1.6"/>'-              + '<path d="M28 8 v8 h8 Z" fill="#dadce0"/>'-              + '<rect x="13" y="26" width="23" height="12" rx="2" fill="#e34f4f"/>'-              + '<text x="24.5" y="35.4" font-family="Segoe UI,Arial,sans-serif" font-size="9" font-weight="700" fill="#ffffff" text-anchor="middle">PDF</text></svg>'-            : '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">'-              + '<rect x="0" y="0" width="48" height="48" rx="9" fill="#f1f3f4"/>'-              + '<circle cx="24" cy="24" r="13" fill="none" stroke="#5f6368" stroke-width="3"/>'-              + '<ellipse cx="24" cy="24" rx="5.6" ry="13" fill="none" stroke="#5f6368" stroke-width="2.6"/>'-              + '<path d="M11.4 24 H36.6" stroke="#5f6368" stroke-width="2.6"/>'-              + '<path d="M13.6 16.4 H34.4 M13.6 31.6 H34.4" stroke="#5f6368" stroke-width="2"/></svg>';+          const _svg2 = genericIconSvg(_isPdf2);           src = { b64: Buffer.from(_svg2).toString('base64'), mime: 'image/svg+xml', href: _isPdf2 ? 'generic:pdf' : 'generic:page' };           session._overlayFav = { kind: _isPdf2 ? 'generic-pdf' : 'generic-web', format: 'svg', mode: 'default', transparent: false, via: 'generated (no favicon existed anywhere in this window)', href: src.href, candidates: 0 };           if (session._noFavLogKey !== _u2) { session._noFavLogKey = _u2; console.log(`[overlay] "${sessionId}" no favicon in this session — generic ${_isPdf2 ? 'PDF' : 'webpage'} icon + Adom mark`); }@@ -6378,22 +6366,7 @@ async function applyAppOverlay(session, sessionId) {               let u = '';               try { u = (activePage && activePage.url()) || ''; } catch (e) {}               const isPdf = /\.pdf(\?|#|$)/i.test(u) || /application\/pdf/i.test(String(src && src.mime || ''));-              const svg = isPdf-                // Document sheet with a folded corner + PDF wordmark, on Adobe-ish red so a datasheet-                // reads instantly as a PDF at 16px.-                ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">'-                  + '<rect x="0" y="0" width="48" height="48" rx="9" fill="#f1f3f4"/>'-                  + '<path d="M13 8 h15 l8 8 v24 a1 1 0 0 1-1 1 H14 a1 1 0 0 1-1-1 V9 a1 1 0 0 1 1-1 Z" fill="#ffffff" stroke="#9aa0a6" stroke-width="1.6"/>'-                  + '<path d="M28 8 v8 h8 Z" fill="#dadce0"/>'-                  + '<rect x="13" y="26" width="23" height="12" rx="2" fill="#e34f4f"/>'-                  + '<text x="24.5" y="35.4" font-family="Segoe UI,Arial,sans-serif" font-size="9" font-weight="700" fill="#ffffff" text-anchor="middle">PDF</text></svg>'-                // Chrome's generic page icon: a grey globe on a light plate.-                : '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">'-                  + '<rect x="0" y="0" width="48" height="48" rx="9" fill="#f1f3f4"/>'-                  + '<circle cx="24" cy="24" r="13" fill="none" stroke="#5f6368" stroke-width="3"/>'-                  + '<ellipse cx="24" cy="24" rx="5.6" ry="13" fill="none" stroke="#5f6368" stroke-width="2.6"/>'-                  + '<path d="M11.4 24 H36.6" stroke="#5f6368" stroke-width="2.6"/>'-                  + '<path d="M13.6 16.4 H34.4 M13.6 31.6 H34.4" stroke="#5f6368" stroke-width="2"/></svg>';+              const svg = genericIconSvg(isPdf);               // v1.9.326: render the glyph straight INTO iconPng. The composite below only draws               // iconPng, so the old code (which set `src` and left iconPng null) fell through to a               // mark-only badge — exactly the "no main overlay icon" John kept reporting. sharp@@ -8132,6 +8105,29 @@ const PS_RAISE_TYPEDEF = [   '}',   '"@', ];+// v2.0.240: the Chrome-style generic icons (grey globe / PDF sheet) were written out as SVG string+// literals in TWO different no-favicon paths — the second was added because the first was missed,+// and the comment above it says so. One builder now, so the glyph a user sees cannot depend on+// which path produced it.+function genericIconSvg(isPdf) {+  const plate = '<rect x="0" y="0" width="48" height="48" rx="9" fill="#f1f3f4"/>';+  return isPdf+    ? '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">' + plate+      + '<path d="M13 8 h15 l8 8 v24 a1 1 0 0 1-1 1 H14 a1 1 0 0 1-1-1 V9 a1 1 0 0 1 1-1 Z" fill="#ffffff" stroke="#9aa0a6" stroke-width="1.6"/>'+      + '<path d="M28 8 v8 h8 Z" fill="#dadce0"/>'+      + '<rect x="13" y="26" width="23" height="12" rx="2" fill="#e34f4f"/>'+      + '<text x="24.5" y="35.4" font-family="Segoe UI,Arial,sans-serif" font-size="9" font-weight="700" fill="#ffffff" text-anchor="middle">PDF</text></svg>'+    : '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48">' + plate+      + '<circle cx="24" cy="24" r="13" fill="none" stroke="#5f6368" stroke-width="3"/>'+      + '<ellipse cx="24" cy="24" rx="5.6" ry="13" fill="none" stroke="#5f6368" stroke-width="2.6"/>'+      + '<path d="M11.4 24 H36.6" stroke="#5f6368" stroke-width="2.6"/>'+      + '<path d="M13.6 16.4 H34.4 M13.6 31.6 H34.4" stroke="#5f6368" stroke-width="2"/></svg>';+}+// v2.0.240: escaping a string for use inside a PowerShell -match pattern was written out twice as+// the same dense character class. One helper, so a fix to the escaping cannot land in only one scan.+function psRegexEscape(v) {+  return String(v).replace(/[\\.^$*+?()[\]{}|]/g, '\\$&');+} async function reconcileModel(reason) {   if (process.platform !== 'win32' || _reconcileBusy) return;   _reconcileBusy = true;@@ -14218,10 +14214,7 @@ const server = http.createServer(async (req, res) => {         case 'pup_close_window': {           invalidateEnumCache();   // v2.0.187: the desktop is about to change           const sessionId = args.sessionId;-          if (!sessionId || !sessions.has(sessionId)) {-            sendJSON(res, { success: false, error: `Session "${sessionId}" not found` });-            return;-          }+          if (!requireLiveSession(res, { ...args, sessionId })) return;           const session = sessions.get(sessionId);           // v1.8.16: refuse a declared cross-owner close (destroying another thread's window).           { const refusal = ownershipRefusal(session, sessionId, args, 'pup_close_window'); if (refusal) { sendJSON(res, refusal); return; } }@@ -14570,8 +14563,9 @@ const server = http.createServer(async (req, res) => {         // is brought on-screen. Not meant for AI threads (they pass wikiView on pup_open_window).         case 'pup_wiki_set_view': {           const sessionId = args.sessionId;-          if (!sessionId || !sessions.has(sessionId)) { sendJSON(res, { success: false, error: `Session "${sessionId}" not found` }); return; }-          const session = sessions.get(sessionId);+          const _lv = requireLiveSession(res, { ...args, sessionId });+          if (!_lv) return;+          const session = _lv.session;           let url = null; try { url = session.page.url() || null; } catch (e) {}           if (!url || !isAdomUrl(url)) { sendJSON(res, { success: false, error: 'wiki view toggle applies only to Adom (adom.inc) URLs', output: JSON.stringify({ ok: false, url }) }); return; }           const curView = session._wikiView === 'authed' ? 'authed' : 'public';@@ -17063,8 +17057,9 @@ const server = http.createServer(async (req, res) => {           // the full production chain without CDP input-simulation flakiness. Honest errors: floaty           // absent means the setting is off or the page never got the injection.           const sessionId = args.sessionId;-          if (!sessionId || !sessions.has(sessionId)) { sendJSON(res, { success: false, error: `Session "${sessionId}" not found` }); return; }-          const session = sessions.get(sessionId);+          const _lv = requireLiveSession(res, { ...args, sessionId });+          if (!_lv) return;+          const session = _lv.session;           const tab = (args.tabId && (session.tabs || []).find(t => t.tabId === args.tabId)) || (session.activeTabId && (session.tabs || []).find(t => t.tabId === session.activeTabId)) || (session.tabs || [])[0];           if (!tab || !tab.page) { sendJSON(res, { success: false, error: 'no tab' }); return; }           try {@@ -17084,8 +17079,9 @@ const server = http.createServer(async (req, res) => {           // start/cancel the human annotation overlay on a window's active tab. Jump-list clicks           // arrive as user-taskbar-menu (ownership-gate exempt); threads annotate their OWN windows.           const sessionId = args.sessionId;-          if (!sessionId || !sessions.has(sessionId)) { sendJSON(res, { success: false, error: `Session "${sessionId}" not found` }); return; }-          const session = sessions.get(sessionId);+          const _lv = requireLiveSession(res, { ...args, sessionId });+          if (!_lv) return;+          const session = _lv.session;           try {             if (args.action === 'cancel') {               const tab0 = (session.tabs || [])[0];