Pup - the AI's own browser

@@ -313,6 +313,19 @@ function callerOwnWindow(callerThread) {   }   return best; }+// v2.0.103 (John, watching the ah-build thread hwnd-hunt its own window): every open/navigate+// response teaches the caller how to KEEP driving its window with zero ids — the follow-ups an+// AI actually needs next, stated as ready-to-run calls.+function threadNextBlock() {+  return [+    'pup_screenshot {} — screenshot YOUR window (no ids: pup resolves your --ai-thread name to your window)',+    'pup_reload {} — reload it (e.g. after you publish or rebuild something it shows)',+    'pup_my_windows {} — full state of everything your thread owns: windows, tabs, urls, titles',+    'pup_open_window {"url":"..."} — another page = another TAB in your same window',+    'pup_raise_os_window {"foregroundReason":"..."} — bring it onto the user\'s screen (gated)',+    'Windows open MAXIMIZED already. NEVER hunt hwnds (desktop_find_window / desktop_screenshot_window / desktop_set_window_state) for a pup window — pup verbs already know your window.',+  ];+} let pupshotUrl = null; // v1.9.4: profileName -> in-flight launch Promise. A fresh profile isn't in `browsers` until its // Chrome launch FINISHES (~10-15s), so two near-simultaneous opens for the same profile used to@@ -11161,6 +11174,19 @@ const server = http.createServer(async (req, res) => {           }         }       }+      // v2.0.103 (John: "dispense with sessionId — the thread name is the handle"): explicit+      // thread-name addressing. aiThreadName resolves to that thread's window on any targeting verb.+      if (args && !args.sessionId && args.aiThreadName && SESSION_TARGETING_VERBS.has(command)) {+        const tn = String(args.aiThreadName);+        const derivedT = threadDefaultSessionId(tn);+        if (sessions.has(derivedT)) args.sessionId = derivedT;+        else {+          const theirs = [...sessions.entries()].filter(([, s2]) => (s2.owner || s2._ownerThread) === tn).map(([k]) => k);+          if (theirs.length === 1) args.sessionId = theirs[0];+          else if (theirs.length) { sendJSON(res, { success: false, errorCode: 'ambiguous_session', error: `Thread "${tn}" owns ${theirs.length} windows (${theirs.join(', ')}) — pass sessionId to pick one.` }, 404); return; }+          else { sendJSON(res, { success: false, errorCode: 'no_session_for_thread', error: `No pup window for thread "${tn}".`, _hint: 'pup_my_windows {} lists a thread\'s windows; pup_open_window creates yours keyed to your thread name.' }, 404); return; }+        }+      }       if (args && !args.sessionId && _callerThread && !USER_CALLERS.has(_callerThread) && SESSION_TARGETING_VERBS.has(command)) {         const derived = threadDefaultSessionId(_callerThread);         if (sessions.has(derived)) args.sessionId = derived;@@ -11316,6 +11342,7 @@ const server = http.createServer(async (req, res) => {                      hint: m.hint || summary, related: m.related || [], pitfalls: m.pitfalls || [] };           };           sendJSON(res, { success: true, bridge: 'puppeteer', verbs: [+            V('pup_my_windows', 'START HERE for window management: everything YOUR thread owns — windows, tabs, urls, titles, state — with ready-to-run next steps. Zero args. You NEVER need an hwnd, desktop_find_window, or desktop_screenshot_window for a pup window: pup keys every window to its owning --ai-thread name and resolves ids for you — omit sessionId in any pup verb to target your own window, or pass aiThreadName to address a thread by name. pup_screenshot {} screenshots it; pup_reload {} refreshes it.', { aiThreadName: 'optional str — inspect another thread\'s windows (read-only listing); default = the calling thread' }, 10, {}),             V('pup_open_window', 'Open a generic pup window — a fresh isolated Chrome/Edge process (never your real signed-in browser), fully drivable via CDP. ALWAYS opens in the BACKGROUND (does not steal focus; never disturbs the user\'s main work; still fully screenshottable/drivable) UNLESS you pass foreground:true — do that ONLY when the user explicitly wants to watch. Pass width+height (+ optional x,y, screen px) to place it at a specific size/position for screenshot framing — this NO LONGER foregrounds it (sizing stays in the background too; default unsized is maximized). profile defaults to the durable shared \'adom-you\' profile (logins/localStorage persist + are shared across all pup windows); isolated:true for a private throwaway. OWNERSHIP: sessionIds are shared across ALL AI threads — use a task-prefixed sessionId + owner:"<your-task>" so pup can refuse other threads stealing your window (reusing an existing id with a new url navigates it away; declared cross-owner reuse errors with session_owned_by_another_thread unless takeover:true). (For the user\'s REAL Chrome/Edge, use the Adom extension\'s nbrowser_* verbs.)', { sessionId: 'optional str — OMIT IT (recommended): your thread gets its OWN window keyed on your --ai-thread name; the first open creates it, later opens become TABS in it, and no other thread can touch it. Pass an explicit id only when you need a SEPARATE window (task-prefix it, e.g. "mytask-web")', url: 'optional str', profile: 'optional str — a named durable jar; DEFAULT is the shared "adom-you" profile (signed-in state shared across windows). isolated:true overrides to a throwaway', isolated: 'optional bool — private throwaway profile: fresh-login tests, acting as a different user. REASON-GATED (v2.0.101): requires isolationReason or the open is refused — every window defaults to the shared adom-you profile', isolationReason: 'required WITH isolated:true — why this window must NOT ride the shared adom-you profile (min 10 chars; logged, auditable). webSecurity:false and wikiView:public carry their own built-in reason', webSecurity: 'optional false — dev escape hatch for cross-origin eval; FORCES isolation so insecure flags never touch the credentialed profile', owner: 'optional str — your thread/task label; lets pup protect this window from other threads', takeover: 'optional bool — claim a window owned by another thread (only when the user explicitly asks)', foreground: 'optional bool — request showing the window on the user\'s screen. GATED (v1.8.70): requires foregroundReason too, else the open succeeds but stays BACKGROUND with foregroundDenied set. Only when the USER explicitly asked to watch.', foregroundReason: 'required WITH foreground:true — quote/paraphrase what the user said that justifies putting a window on their screen (min 10 chars; logged + recorded in lastAgentUpdate, auditable)', width: 'optional int px — sizes for screenshot framing, stays background', height: 'optional int px', x: 'optional int px', y: 'optional int px', wikiView: 'optional "authed"|"public" — for wiki.adom.inc URLs. THREE distinct cases: (1) OMIT = the shared adom-you profile, which is LOGGED IN as the user if they have signed into the wiki (the usual case — one shared login serves every window); this is NOT anonymous. (2) "public" = an ISOLATED anonymous jar, genuinely LOGGED OUT — exactly what the world sees; use this to verify a publish did not leak private source. (3) "authed" = the explicit logged-in vault view (30-day SSO; first use may need a one-time login — response says wikiLoginNeeded). To compare "what I see" vs "what the world sees", open one "authed" (or omit) AND one "public" — do NOT rely on omit for the public view, it shows the logged-in shared profile.', appName: 'optional str — the APP this window is driving (e.g. "shotlog"); shown in the hover tooltip', appIconB64: 'optional base64 PNG — override the app icon worn in the taskbar overlay. Usually UNNECESSARY: pup auto-fetches the page\'s own <link rel="icon"> favicon (the adom-ui-design standard artifact every app must serve) and wears it automatically. An app-looking URL with NO favicon gets a reprimand hint.', updateNote: 'optional str — a short "what I did" note, surfaced back in list_tabs/list_windows as lastAgentUpdate so the user knows what changed', autoFlash: 'optional bool (default true) — mutating verbs auto-flash this window\'s taskbar (debounced, never steals focus) so the user notices the agent touched it; pass false to make this window silent by default', silent: 'optional bool — suppress the auto-flash for just this call' }, 60, { sessionId: 'mytask-web', owner: 'mytask', url: 'https://example.com', width: 960, height: 540 }),             V('pup_open_tab', 'Open a new tab in an EXISTING session/window (returns {tabId, tabCount, activeTabId} — no need to diff list_tabs). This is the right verb for multi-URL work: ONE window with many tabs (one taskbar button), not many windows. The window stays in the background; the tab auto-flashes the taskbar (debounced) so the user notices. The USER can click the window\'s taskbar button at any time to view it — pup never pulls it back down.', { sessionId: 'required str', url: 'optional str', updateNote: 'optional str — short "what I did" note surfaced in list_tabs as lastAgentUpdate', silent: 'optional bool — suppress the auto-flash for this call' }, 30, { sessionId: 'work', url: 'https://example.com' }),             V('pup_close_tab', 'Close a tab.', { sessionId: 'required str', tabId: 'optional str (default active)' }, 15, { sessionId: 'work' }),@@ -11513,7 +11540,7 @@ const server = http.createServer(async (req, res) => {                 sendJSON(res, { success: true, output: JSON.stringify({                   ok: true, sessionId: args.sessionId, tabId, openedAsTab: true,                   tabCount: (_own.tabs || []).length, activeTabId: _own.activeTabId,-                }), _hint: `Opened as a NEW TAB in your thread's own window ("${args.sessionId}") — one window per thread, tabs accumulate there (pass an explicit sessionId if you truly need a separate window). Drive this tab via tabId ${tabId}.` });+                }), _hint: `Opened as a NEW TAB in your thread's own window ("${args.sessionId}") — one window per thread, tabs accumulate there (pass an explicit sessionId if you truly need a separate window). Drive this tab via tabId ${tabId}.`, _next: threadNextBlock() });                 return;               } catch (e) { /* fall through to a fresh window if the tab add failed */ }             }@@ -11918,6 +11945,7 @@ const server = http.createServer(async (req, res) => {               wikiView: isAdomUrl(args.url) ? (args.wikiView === 'authed' ? 'authed' : 'public') : undefined,               wikiLoginNeeded: (args.wikiView === 'authed' && _wikiAuth && !_wikiAuth.authed) || undefined,               foregroundDenied: fgDenied ? 'foreground_reason_required' : undefined,+              _next: threadNextBlock(),               // v1.9.108 (John, looking at a real launcher-mockup response) — A DETECTED RENDER               // FAILURE MUST LEAD. The verdict was correct and the calling AI did act on it, but _hint               // opened with a FAVICON nag, then a power lecture, then a browser inventory, so the single@@ -12057,7 +12085,30 @@ const server = http.createServer(async (req, res) => {           sendJSON(res, { success: true, output: JSON.stringify({ ok: true, settings: pupSettings(), platform: process.platform, taskbarSupported: _isWin, _hint: _gHint }) });           return;         }-                case 'pup_quit_idle_browsers': {+                case 'pup_my_windows': {+          // v2.0.103 (John: "shouldn't you give the thread a unique way to talk to you recalling+          // the windows you opened for it?"): one verb, zero args — everything the calling thread+          // owns, with ready-to-run next steps. aiThreadName inspects another thread read-only.+          const who = (args && args.aiThreadName) || _callerThread;+          if (!who) { sendJSON(res, { success: false, errorCode: 'caller_identity_required', error: 'Identify your thread (--ai-thread "<name>") or pass aiThreadName.' }); return; }+          const wins = [];+          for (const [sid, sM] of sessions) {+            if ((sM.owner || sM._ownerThread) !== who) continue;+            const tabsM = [];+            for (const tM of (sM.tabs || [])) {+              let uM = null, tiM = null;+              try { uM = tM.page.url(); } catch (e) {}+              try { tiM = await Promise.race([tM.page.title(), new Promise(r => setTimeout(() => r(null), 800))]); } catch (e) {}+              tabsM.push({ tabId: tM.tabId, url: uM, title: tiM, active: tM.tabId === sM.activeTabId });+            }+            wins.push({ window: sid, profile: sM.profileName, notYou: /^iso-/.test(sM.profileName || ''), lostBrowser: !!sM._lostBrowser, createdMinAgo: sM.createdAt ? Math.round((Date.now() - sM.createdAt) / 60000) : null, lastAgentUpdate: sM._lastAgentUpdate || null, tabs: tabsM });+          }+          sendJSON(res, { success: true, output: JSON.stringify({ ok: true, aiThreadName: who, windows: wins,+            _hint: wins.length ? `These are ${who === _callerThread ? 'your' : `${who}'s`} windows. Target them with NO ids: any pup verb without sessionId resolves to your own thread's window (or address any thread via aiThreadName). pup_screenshot {} to see it; pup_reload {} to refresh it; tab verbs take tabId.` : `No windows for "${who}" yet. pup_open_window {"url":"..."} creates one — pup keys it to the thread name, remembers it, and every later verb finds it with no ids.`,+            _next: threadNextBlock() }) });+          return;+        }+        case 'pup_quit_idle_browsers': {           // v2.0.98 (maintenance): gracefully Browser.close() every profile browser that has ZERO           // live sessions. pup deliberately keeps Chrome warm across window closes and bridge           // restarts, but a warm browser never reloads its --load-extension dirs, so extension@@ -14394,7 +14445,7 @@ const server = http.createServer(async (req, res) => {             const _rc = res._renderCheck;             if (_rc && _rc.ok === false) console.log(`[render] "${resolvedId}" BROKEN after navigate to ${args.url}: ${_rc.signals.join(', ')}`);           } catch (e) {}-          sendJSON(res, { success: true, output: JSON.stringify({ ok: true, url: args.url, sessionId: resolvedId, tabId, ...(authSteerHint(args.url) ? { _hint: authSteerHint(args.url).trim() } : {}) }) });+          sendJSON(res, { success: true, output: JSON.stringify({ ok: true, url: args.url, sessionId: resolvedId, tabId, _next: threadNextBlock(), ...(authSteerHint(args.url) ? { _hint: authSteerHint(args.url).trim() } : {}) }) });           return;         }         case 'pup_install_toolbar': {