Pup - the AI's own browser

@@ -1,6 +1,6 @@ {   "slug": "pup-bridge",-  "version": "2.0.577",+  "version": "2.0.578",   "type": "app",   "description": "The pup SKILL PACK \u2014 the AI skills that teach a cloud/container AI how to drive the Adom Desktop Puppeteer (pup) bridge (browser_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY \u2014 this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Desktop bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) \u2014 a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Desktop manages for you.",   "keywords": [@@ -148,5 +148,5 @@       "prompt": "Download the puppeteer-bridge zip from the wiki and walk me through server.js"     }   ],-  "changelog": "ext lane: windows born with the early native stamp now get their jump list (right-click menu) too; a busy lane no longer gets relaunched by an unanswered open (that killed every thread's windows five times today), the open fails with ext_busy instead; lane-rule refusals are logged."+  "changelog": "ext lane at input parity: click, hover, type, press_key, scroll, fill, element and full-res screenshots, and CSP-proof eval now run on extension-lane windows through nbe's DevTools driver (one driver, synced from nb; chrome.debugger attached on demand). Recording and selector downloads still need lane:cdp (they wait on DevTools events)." }

@@ -4,7 +4,7 @@   "slug": "pup-bridge",   "title": "Pup - Puppeteer Bridge",   "brief": "pup is the AI's own browser: a real, full Chrome on the user's desktop that the AI fully controls (a sandbox, not the user's signed-in browser). Rides Bridge; pup_* verbs open windows and tabs, navigate, screenshot, and eval JS.",-  "version": "2.0.577",+  "version": "2.0.578",   "tags": [     "skills",     "pup",@@ -168,5 +168,5 @@       "pup-bridge verbs are invoked through the adom-bridge CLI, not through a binary this package installs, so prefix rules cannot reach them."     ]   },-  "changelog": "ext lane: windows born with the early native stamp now get their jump list (right-click menu) too; a busy lane no longer gets relaunched by an unanswered open (that killed every thread's windows five times today), the open fails with ext_busy instead; lane-rule refusals are logged."+  "changelog": "ext lane at input parity: click, hover, type, press_key, scroll, fill, element and full-res screenshots, and CSP-proof eval now run on extension-lane windows through nbe's DevTools driver (one driver, synced from nb; chrome.debugger attached on demand). Recording and selector downloads still need lane:cdp (they wait on DevTools events)." }\ No newline at end of file

@@ -30,7 +30,7 @@ only CDP can do. pup no longer falls back to CDP on its own for any reason. - Pro: one shared adom-you browser, so logins and cookies accumulate for every thread, and every window carries the full toolbar including nbe. - Con: `pup_eval` runs in the page's MAIN world, so a page with a strict Content-Security-Policy (wiki.adom.inc, claude.ai) refuses it with "Evaluating a string as JavaScript violates the following Content Security Policy". Use `pup_screenshot`, `pup_list_tabs`, `pup_navigate` and the other DOM-free verbs there, or `lane:"cdp"` if you truly must run script on such a page and accept that vendor sites will not load in that window. - Note on screenshots (2.0.576): stock Chrome stops painting a window that is COMPLETELY covered by other windows, and every capture of such a window failed with Chrome's own "image readback failed" (measured 2026-09-14: 0 of 20 tabs under a maximized Edge; the same 20 captured the moment the window was raised). Attaching `chrome.debugger` for a one-frame `Page.startScreencast` did NOT help: no frame ever arrives for a natively occluded tab (measured: "first screencast frame timed out after 8000 ms" on all 20), and `Page.captureScreenshot` never returns at all (it hung the lane in 2.0.574). The fix is the one the CDP lane has always used: the lane launches with `CalculateNativeWinOcclusion` disabled, so a covered window keeps compositing and the plain capture works. Compositor-only, nothing on the wire, so vendor sites are unaffected. The debugger path remains only as a deadline-bounded fallback. Background TABS are still throttled by Chrome as before; this is not the highFps anti-throttle set.-- Con: no trusted input events, no iframe targeting, no element or full-resolution screenshots, no recording, no selector-driven downloads, no `realKeystrokes`, no separate profile (backlog: pup-bridge#113), no `highFps`, no `webSecurity:false`. Each of those verbs answers `lane_needs_cdp` with the fix. Annotate DOES work here since 2.0.569 (the overlay is file-injected, which page CSP cannot refuse, and the capture is composed in the binary).+- Since 2.0.578 the extension lane ALSO has trusted input (`pup_click`, `pup_hover`, `pup_type`, `pup_press_key`, `pup_scroll`, `pup_fill`), element and full-resolution screenshots, and CSP-proof `pup_eval` (a page whose Content-Security-Policy refuses the injected eval is retried through DevTools automatically). They ride nbe's DevTools driver inside the lane (`chrome.debugger`, attached to one tab on demand, detached after nbe's idle window; no debug port, no automation flag, `navigator.webdriver` stays false, no bar). Still CDP-only: recording (`pup_record_*`), selector-driven `pup_download`, `realKeystrokes` logins, iframe targeting, separate profiles (backlog: pup-bridge#113), `highFps`, `webSecurity:false`. Those answer `lane_needs_cdp` with the fix.  **CDP lane** - Pro: everything DevTools can do: trusted mouse and keyboard events, cross-origin iframes, `Runtime.evaluate` that ignores page CSP, element and full-res screenshots, annotate, recording, emulation, separate profiles, anti-throttle for a live view.