Pup - the AI's own browser

@@ -5786,19 +5786,6 @@ async function parkSessionWindowDirect(page, sessionId) { // batch sat on top with honest 'backgrounded' verdicts; a later same-window navigate does NOT // raise — tested). force:false so AD skips a window the user is actively holding foreground. async function reassertBottomAfterNav(sessionId) {-  // v1.9.252 (John: "why did that pup window that just opened to the adom-theme disrupt me in the-  // foreground?"): arm the FG-STEAL GUARD. Chrome can self-raise a parked background window on late-  // paints or an in-page focus() AFTER these scripted re-asserts finish, and under minimal-touch the-  // old watcher that would notice was disabled - so the steal stuck and the user got disrupted. For-  // 20s after any background open/navigation, the guard interval below knocks back any un-granted-  // foreground takeover the moment it is seen.-  try {-    const _gs = sessions.get(sessionId);-    if (_gs && !_gs._foreground) {-      if (!_gs._fgGuardUntil || _gs._fgGuardUntil < Date.now()) _gs._fgStealCount = 0;   // fresh arm resets the strike count-      _gs._fgGuardUntil = Date.now() + 20000;-    }-  } catch (e) {}   if (process.platform !== 'win32' || !sessionId) return;   // v1.9.201 (John's PDF window came to the front with NO ai requesting it): this used ONLY AD's   // desktop_set_window_state — a verb that is NOT present on every desktop (the Bills thread hit@@ -6681,40 +6668,6 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer // always makes a tab; only CDP Target.createTarget accepts newWindow. Page identity is resolved by // diffing browser.pages() before/after rather than matching internal target ids, so this stays // correct across puppeteer versions. Returns null if the window never materialises.-function osRestoreForeground(hwnd) {-  // Give the USER's window its focus back (SetForegroundWindow needs the AttachThreadInput trick-  // when called from a background process). Only ever called with the user's prior-foreground hwnd.-  if (process.platform !== 'win32' || !hwnd) return false;-  try {-    const scriptPath = path.join(require('os').tmpdir(), `_adom_restorefg_${process.pid}.ps1`);-    const ps = [-      'Add-Type @"',-      'using System; using System.Runtime.InteropServices;',-      'public class WinRf {',-      '  [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();',-      '  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',-      '  [DllImport("user32.dll")] public static extern bool AttachThreadInput(uint a, uint b, bool f);',-      '  [DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr h);',-      '  [DllImport("user32.dll")] public static extern bool BringWindowToTop(IntPtr h);',-      '  [DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();',-      '}',-      '"@',-      `$t = [IntPtr]${Number(hwnd)}`,-      '$fg = [WinRf]::GetForegroundWindow()',-      'if ($fg -eq $t) { Write-Output "already"; exit }',-      '$p1 = 0; $tid1 = [WinRf]::GetWindowThreadProcessId($fg, [ref]$p1)',-      '$me = [WinRf]::GetCurrentThreadId()',-      '[void][WinRf]::AttachThreadInput($me, $tid1, $true)',-      '[void][WinRf]::SetForegroundWindow($t)',-      '[void][WinRf]::BringWindowToTop($t)',-      '[void][WinRf]::AttachThreadInput($me, $tid1, $false)',-      'Write-Output "restored"',-    ].join(String.fromCharCode(13, 10));-    fs.writeFileSync(scriptPath, ps);-    const out = runPsHidden(scriptPath, { timeout: 5000 }).trim();-    return out === 'restored' || out === 'already';-  } catch (e) { return false; }-} async function createPageInNewWindow(browser) {   let cdp = null;   try {@@ -6741,12 +6694,11 @@ async function createPageInNewWindow(browser) {     }     try {       const nowFg = osGetForegroundWindow();-      if (prevFg && nowFg && String(nowFg) !== String(prevFg)) {-        const restored = osRestoreForeground(prevFg);-        console.log(`[focus] MEASURED: createTarget(newWindow) STOLE the OS foreground (fg ${prevFg} -> ${nowFg}); restored to the user: ${restored}`);-      } else {-        console.log(`[focus] MEASURED: createTarget(newWindow) did NOT move the OS foreground (fg=${prevFg || '?'})`);-      }+      // Diagnostic only. The playbook (dev-skills/pup-bridge-dev, SOLVED PLAYBOOK) says this can+      // never show a steal: with --no-startup-window the browser is a background process and the OS+      // denies it the foreground. Measured TRUE on 2026-07-31. If this line EVER logs a steal, the+      // playbook assumption broke - investigate, do not add re-park loops (they are banned there).+      if (prevFg && nowFg && String(nowFg) !== String(prevFg)) console.log(`[focus] MEASURED: createTarget(newWindow) moved the OS foreground (${prevFg} -> ${nowFg}) — PLAYBOOK ASSUMPTION BROKEN, investigate`);     } catch (e) {}     return fresh;   } catch (e) {@@ -12484,41 +12436,6 @@ server.listen(PORT, BIND_HOST, async () => {   const _healingIds = new Set();          // sessionIds with a relaunch in flight (guards the 15s re-tick)   const MAX_HEAL_ATTEMPTS = 2;   const HEAL_COOLDOWN_MS = 5 * 60 * 1000;-  // v1.9.252 FG-STEAL GUARD (ungated: user protection, not cosmetic machinery - the same doctrine-  // as the foreground caption). A background pup window must NEVER sit in the OS foreground without-  // a granted foregroundReason. Chrome self-raises parked windows (late first paint, in-page-  // focus()), and the fixed post-nav re-asserts can end before the last raise. While any session's-  // guard is armed (20s after each background open/nav), one cheap foreground read per 2.5s tick-  // catches the steal and bottoms the window immediately, giving the user their screen back.-  // Steady-state (no guards armed) costs nothing. A user's own deliberate raise outside the guard-  // window, or any granted raise (_foreground), is never touched.-  setInterval(async () => {-    if (process.platform !== 'win32') return;-    try {-      const now = Date.now();-      const guarded = [...sessions].filter(([, s2]) => s2._fgGuardUntil && s2._fgGuardUntil > now && !s2._foreground && !s2._lostBrowser);-      if (!guarded.length) return;-      const fg = osGetForegroundWindow();-      if (!fg) return;-      for (const [sid2, s2] of guarded) {-        try {-          if (!s2._hwnd) { try { await resolveSessionHwndByBounds(s2, sid2); } catch (e) {} }-          if (!s2._hwnd || String(fg) !== String(s2._hwnd)) continue;-          if ((s2._fgStealCount || 0) >= 3) {-            // three knockbacks in one guard window = a human is insisting; the human wins.-            s2._fgGuardUntil = 0; s2._foreground = true;-            console.log(`[fg-guard] "${sid2}" raised 3x inside one guard window — assuming the USER wants it up; backing off and marking foreground`);-            continue;-          }-          console.log(`[fg-guard] "${sid2}" STOLE the OS foreground with no granted reason (Chrome self-raise) — bottoming it and returning the screen to the user`);-          s2._fgStealCount = (s2._fgStealCount || 0) + 1;-          await reassertBottomAfterNav(sid2);-          break;-        } catch (e) {}-      }-    } catch (e) {}-  }, 2500);-   // v1.9.243 (John: "you have red led's galore in your dashboard. why?"). The overlay ENFORCER was   // dead on arrival: it sat inside the health interval ABOVE, whose first line is `if (minimalTouch())   // return;` — and minimal-touch is the normal mode, so it never ran once. Overlays are explicitly