Pup - the AI's own browser

@@ -4,7 +4,7 @@ members = ["core", "host", "host-win", "host-mac", "cdp", "browser", "session",  # One version for the whole bridge, in lockstep with src/BRIDGE_VERSION (tools/ship.sh bumps both). [workspace.package]-version = "2.0.709"+version = "2.0.711" edition = "2021" license = "MIT" 

@@ -3,7 +3,8 @@ // Rendered by the extension (not pup injection) so the click can route through the worker to // pup's loopback. Gated by pup's tbFloatyPencil setting (checked once per page load). (async () => {-  if (window !== window.top) return;+  // 2.0.711: this script now runs in EVERY frame, so Alt+Shift+A works while focus is inside an embedded frame (a+  // YouTube player, an embedded document). Only the hotkey runs in subframes; the pencil stays top-frame only.   if (window.__pupFloatyInstalled) return;   window.__pupFloatyInstalled = true;   try {@@ -20,6 +21,7 @@       chrome.runtime.sendMessage({ t: 'pup-annotate', tool: 'pen' }).catch(() => {});     }, true);   }+  if (window !== window.top) return;   if (!cfg || !cfg.enabled) return;    const host = document.createElement('div');

@@ -144,7 +144,7 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => { // and action all work), so the worker injects the floaty itself when a tab finishes loading. chrome.tabs.onUpdated.addListener((tabId, info, tab) => {   if (info.status !== 'complete' || !tab || !tab.url || !/^https?:/.test(tab.url)) return;-  chrome.scripting.executeScript({ target: { tabId }, files: ['content.js'] }).catch(() => {});+  chrome.scripting.executeScript({ target: { tabId, allFrames: true }, files: ['content.js'] }).catch(() => {});   // 2.0.711: every frame, for the hotkey   // 2.0.602: the login-capture rail. It lived only on the CDP lane, so a password typed in a normal   // (extension-lane) pup window was never stored: pup's whole "sign in once and I remember" promise was   // off on the DEFAULT lane. Injected the same way as content.js because declarative content_scripts do