Pup - the AI's own browser

@@ -5991,6 +5991,30 @@ function wikiUrlLint(u) {   const r = urlLint(u, null);   return (r && r.code === 'url_wiki_missing_owner') ? r.message : null; }+// v1.9.125 (follow-on) — AUTO-FILL a vault-matched login form the instant the page renders.+// Runs after every render verb (open/tab/navigate/reload). Conservative by design:+//   - only when the vault has a credential for this exact origin (deliberate opt-in per host),+//   - only on real http(s) pages,+//   - FILL ONLY, never auto-submit (auto-submitting on load risks MFA/lockouts/wrong-form logins),+//   - never throws — autofill must never block or fail a navigation,+//   - reported to the caller as _autoLogin, and silenceable with browser_configure {autoLogin:"off"}.+async function autoLoginOnLoad(res, page) {+  try {+    if (!res || !page) return;+    let mode = 'on';+    try { mode = (pupSettings().autoLogin === 'off') ? 'off' : 'on'; } catch (e) {}+    if (mode === 'off') return;+    let url = '';+    try { url = page.url(); } catch (e) { return; }+    if (!url || !/^https?:/i.test(url)) return;+    const creds = await credentialVault.getCredentialForUrl(url);+    if (!creds) return;+    const r = await credentialVault.fillLoginForm(page, { username: creds.username, password: creds.password, submit: false });+    if (r && r.ok && r.filledPassword) {+      res._autoLoginNote = `pup AUTO-FILLED this login form for "${creds.host}" from your saved credential (username ${creds.username}) — in the BACKGROUND, NOT submitted, no Chrome dropdown, no foregrounding. To sign in: browser_login {sessionId,submit:true} or click the submit button yourself. Wrong form? browser_configure {autoLogin:"off"} turns this off.`;+    }+  } catch (e) { /* autofill is best-effort; never disturb the navigation */ }+} async function probeRender(page, httpStatus) {   const out = { httpStatus: (httpStatus === undefined ? null : httpStatus), ok: true, signals: [] };   try {@@ -6171,6 +6195,8 @@ function sendJSON(res, obj, status = 200) {             if (_v && RENDER_VERBS.has(_v) && _ok && inner._verifyRender === undefined) {               const _rc2 = (res && res._renderCheck) || null;               if (_rc2 && inner.renderCheck === undefined) inner.renderCheck = _rc2;+              // v1.9.125: surface any background auto-login note.+              if (res && res._autoLoginNote && inner._autoLogin === undefined) { inner._autoLogin = res._autoLoginNote; touched = true; }               // v1.9.118: CALL-TIME reprimand — fires on the URL itself, pass or fail.               try {                 if (inner._urlLint === undefined) {@@ -6193,7 +6219,7 @@ function sendJSON(res, obj, status = 200) {               touched = true;             }           } catch (e) {}-          for (const k of ['_reportIssues', '_cleanupReport', '_hint', '_next', 'related', 'pitfalls']) {+          for (const k of ['_reportIssues', '_cleanupReport', '_autoLogin', '_hint', '_next', 'related', 'pitfalls']) {             if (obj[k] !== undefined && inner[k] === undefined) { inner[k] = obj[k]; touched = true; }           }           if (touched) obj.output = JSON.stringify(inner);@@ -6719,6 +6745,7 @@ const server = http.createServer(async (req, res) => {               let _hs = null;               try { _hs = session.page && session.page.__pupHttpStatus; } catch (e) {}               res._renderCheck = await probeRender(session.page, _hs);+              try { await autoLoginOnLoad(res, session.page); } catch (e) {}               const _rc = res._renderCheck;               if (_rc && _rc.ok === false) console.log(`[render] "${sessionId}" LOOKS BROKEN: ${_rc.signals.join(', ')}`);             } catch (e) {}@@ -6935,7 +6962,14 @@ const server = http.createServer(async (req, res) => {             sendJSON(res, { success: false, error: `reportIssues must be one of on|off` });             return;           }+          // v1.9.125: autoLogin on|off — pup auto-filling a vault-matched login form on page load.+          const al = args.autoLogin;+          if (al !== undefined && !['on', 'off'].includes(al)) {+            sendJSON(res, { success: false, error: `autoLogin must be one of on|off` });+            return;+          }           if (ri) { savePupSettings({ reportIssues: ri }); console.log(`[configure] reportIssues -> ${ri}`); }+          if (al) { savePupSettings({ autoLogin: al }); console.log(`[configure] autoLogin -> ${al}`); }           if (aa) {             savePupSettings({ agentActivity: aa });             console.log(`[configure] agentActivity -> ${aa}`);@@ -7414,6 +7448,7 @@ const server = http.createServer(async (req, res) => {             // verdict — otherwise "open it in a tab" silently skips the check that "open it in a window"             // performs. When a behavior belongs to a declared SET, every member gets it.             try { res._renderCheck = await probeRender(tab.page, tab.page.__pupHttpStatus); } catch (e) {}+            try { await autoLoginOnLoad(res, tab.page); } catch (e) {}             try {               const _rc = res._renderCheck;               if (_rc && _rc.ok === false) console.log(`[render] "${sessionId}" tab ${tabId} BROKEN: ${_rc.signals.join(', ')}`);@@ -8684,6 +8719,7 @@ const server = http.createServer(async (req, res) => {           // success on a page nobody had checked. The verb used to confirm a fix is exactly the verb           // that must verify it.           try { res._renderCheck = await probeRender(tab.page, tab.page.__pupHttpStatus); } catch (e) {}+          try { await autoLoginOnLoad(res, tab.page); } catch (e) {}           try {             const _rc = res._renderCheck;             if (_rc && _rc.ok === false) console.log(`[render] "${resolvedId}" STILL BROKEN after reload: ${_rc.signals.join(', ')}`);@@ -8771,6 +8807,7 @@ const server = http.createServer(async (req, res) => {           if (tab._crashed) { tab._crashed = false; delete tab._crashedAt; delete tab._crashReason; console.log(`[crash] session "${resolvedId}" tab ${tabId} recovered via navigate`); }           // v1.9.109: probe on navigate as well — same reasoning as reload.           try { res._renderCheck = await probeRender(tab.page, tab.page.__pupHttpStatus); } catch (e) {}+          try { await autoLoginOnLoad(res, tab.page); } catch (e) {}           try {             const _rc = res._renderCheck;             if (_rc && _rc.ok === false) console.log(`[render] "${resolvedId}" BROKEN after navigate to ${args.url}: ${_rc.signals.join(', ')}`);