Pup - the AI's own browser

@@ -4411,9 +4411,16 @@ async function applyAppOverlay(session, sessionId) {       console.log(`[overlay-debug] "${sessionId}" composed ${Buffer.from(overlay, 'base64').length}B -> ${_dbgPath} | src=${(src && src.href) || '?'} | hwnd=${session._hwnd || '(none, using title)'}`);     } catch (e) { console.log(`[overlay-debug] dump failed: ${e.message}`); }     if (!session._hwnd) { try { await resolveSessionHwndByBounds(session, sessionId); } catch (e) {} }-    const _tgt = (session._hwnd ? { hwnd: session._hwnd } : { titleContains: `(session: ${sessionId}` });+    // v1.9.278 THE EDGE GUARD: paint ONLY to an hwnd proven to be a pup browser window. If we cannot+    // prove ownership (recycled/dead handle), REFUSE - never fall back to a bare title match that+    // could hit another app. A missed overlay this cycle self-heals next sweep; painting on Edge does not.+    if (!session._hwnd || !(await hwndBelongsToPup(session._hwnd))) {+      session._hwnd = null; session._appOverlay = false;+      console.log(`[overlay] "${sessionId}" REFUSED to paint — no pup-owned hwnd confirmed (protecting non-pup taskbar buttons like Edge)`);+      return false;+    }     await chrome.adCommand('desktop_taskbar', {-      ..._tgt,+      hwnd: session._hwnd,       overlay: { icon: overlay, tooltip: `Adom Pup — ${nm}${plateAuthed ? 'Adom wiki: SIGNED IN · ' : ''}${tabs} tab${tabs === 1 ? '' : 's'}${tabs > 1 ? ' (icon = active tab)' : ''}` },     }, { timeoutMs: 5000 });     session._appOverlay = true;@@ -4652,10 +4659,66 @@ async function ensureWindowOpenedWatch() { // Break the circle with facts we already have: pup knows the profile's Chrome PID, and CDP tells us // the window's exact bounds. Enumerate that PID's top-level windows and match on geometry. Works for // any document type, needs no title, and the handle is then cached on the session.+// v1.9.278 (John: "why do i see a pup icon overlay over the msedge taskbar icon? you should never+// be touching edge?"). Root cause: pup cached a session's hwnd, the real window changed, the cached+// handle DIED, and Windows RECYCLES hwnd numbers - so that number was reassigned to an Edge window,+// and pup's overlay paint (which trusted the stale cache) landed on Edge. THE GUARANTEE, enforced+// below: pup only ever paints/flashes an hwnd it can PROVE belongs to one of its own browser+// processes. Any other hwnd is refused. pup can never touch Edge (or any app it did not launch).+function pupBrowserPidSet() {+  const pids = new Set();+  for (const [, be] of browsers) {+    try {+      const b = be && be.browser; if (!b) continue;+      if (b._detachedPid) pids.add(Number(b._detachedPid));+      const pr = b.process && b.process(); if (pr && pr.pid) pids.add(Number(pr.pid));+    } catch (e) {}+  }+  return pids;+}+async function hwndOwnerPid(hwnd) {+  if (process.platform !== 'win32' || !hwnd) return null;+  try {+    const sp = path.join(require('os').tmpdir(), `_adom_hpid_${process.pid}.ps1`);+    fs.writeFileSync(sp, [+      'Add-Type @"',+      'using System; using System.Runtime.InteropServices;',+      'public class HPid { [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',+      '  [DllImport("user32.dll")] public static extern bool IsWindow(IntPtr h); }',+      '"@',+      `$h = [IntPtr]${Number(hwnd)}`,+      'if (-not [HPid]::IsWindow($h)) { Write-Output "0"; exit }',+      '$p = 0; [void][HPid]::GetWindowThreadProcessId($h, [ref]$p); Write-Output $p',+    ].join(String.fromCharCode(13, 10)));+    const out = (runPsHidden(sp, { timeout: 4000 }) || '').trim();+    const pid = Number(out); return Number.isFinite(pid) && pid > 0 ? pid : null;+  } catch (e) { return null; }+}+// Confirm an hwnd is a LIVE window owned by a pup browser process. Used as the hard gate before any+// taskbar paint/flash, and to invalidate a stale cached hwnd (recycled numbers).+async function hwndBelongsToPup(hwnd) {+  const pid = await hwndOwnerPid(hwnd);+  if (!pid) return false;+  // pupBrowserPidSet is the parent detached pids; the real window often belongs to a CHILD chrome.+  if (pupBrowserPidSet().has(pid)) return true;+  try {+    const sp = path.join(require('os').tmpdir(), `_adom_ppid_${process.pid}.ps1`);+    fs.writeFileSync(sp, `try { (Get-CimInstance Win32_Process -Filter "ProcessId=${pid}" -EA Stop).ParentProcessId } catch { 0 }`);+    const par = Number((runPsHidden(sp, { timeout: 4000 }) || '0').trim());+    if (par && pupBrowserPidSet().has(par)) return true;+  } catch (e) {}+  return false;+} async function resolveSessionHwndByBounds(session, sessionId) {   if (process.platform !== 'win32' || !session) return null;   try {-    if (session._hwnd) return Number(session._hwnd);+    // v1.9.278: NEVER trust a cached hwnd blind - validate it still belongs to pup before reuse+    // (a dead/recycled handle now owned by Edge is exactly how the Edge overlay happened).+    if (session._hwnd) {+      if (await hwndBelongsToPup(session._hwnd)) return Number(session._hwnd);+      console.log(`[hwnd] "${sessionId}" cached hwnd ${session._hwnd} is stale/foreign — discarding and re-resolving`);+      session._hwnd = null;+    }     // v1.9.274 (John's dashboard showed 3 'untracked' windows that WERE the real session windows):     // every parked window shares the IDENTICAL rect (work-area minus insets), so pure geometry     // matching cannot distinguish windows after a restart and misassigns hwnds. The title tag is@@ -6049,7 +6112,11 @@ async function flashViaAD(sessionId, opts) {   // them even if the session is gone or retitled by then.   const session = sessions.get(sessionId);   if (session && !session._hwnd) { try { await resolveSessionHwndByBounds(session, sessionId); } catch (e) {} }-  const tgt = (session && session._hwnd) ? { hwnd: session._hwnd } : { titleContains: `(session: ${sessionId}` };+  // v1.9.278: flash only a proven pup hwnd; else title match (a title tag can only exist on a pup+  // window). Never flash a bare recycled hwnd - same Edge-protection guarantee as the overlay paint.+  let _flashHwndOk = false;+  if (session && session._hwnd) { try { _flashHwndOk = await hwndBelongsToPup(session._hwnd); } catch (e) {} if (!_flashHwndOk) session._hwnd = null; }+  const tgt = _flashHwndOk ? { hwnd: session._hwnd } : { titleContains: `(session: ${sessionId}` };   if (!opts.stop && session && session._hwnd) _flashedHwnds.add(session._hwnd);   const args = opts.stop ? { ...tgt, stop: true } : { ...tgt, mode: 'count', count: 4 };   try { return await chrome.adCommand('desktop_flash_window', args, { timeoutMs: 6000 }); }