Pup - the AI's own browser

@@ -1,10 +1,10 @@ {   "manifest_version": 1,   "name": "puppeteer",-  "version": "1.9.91",-  "url": "https://wiki.adom.inc/download/adom/adom-desktop-puppeteer-bridge/1.9.91/adom-bridge-puppeteer-v1.9.91.zip",-  "sha256": "3b7a335d283e42084d2bbaa968957dd681783e2e80f54e7aa013ba624645dc7c",-  "size": 365406,+  "version": "1.9.92",+  "url": "https://wiki.adom.inc/download/adom/adom-desktop-puppeteer-bridge/1.9.92/adom-bridge-puppeteer-v1.9.92.zip",+  "sha256": "edc5dc4c6a8dd439cd0803fc78d44205727c1a679bc0aae39b73905e16668ef7",+  "size": 366514,   "verbPrefixes": [     "browser_",     "desktop_recorder_",

@@ -1 +1 @@-1.9.91+1.9.92

@@ -2,7 +2,7 @@   "manifest_version": 1,   "name": "puppeteer",   "displayName": "Puppeteer (Chrome for Testing + Native)",-  "version": "1.9.91",+  "version": "1.9.92",   "description": "Drives a browser ALREADY on the machine \u2014 installed Chrome, else Microsoft Edge (every Windows PC ships with Edge) \u2014 launched with a FRESH isolated profile, so the common case has NO ~150 MB Chrome-for-Testing download and it never touches the user's real tabs/logins. Binds its local server to LOOPBACK (127.0.0.1) only, so no Windows Firewall 'allow Node through the firewall' prompt ever pops. Chrome for Testing is fetched only as a LAST RESORT if the machine has no Chromium browser at all. SPAWN-VERIFIED fallback: pup tries each detected browser (Chrome \u2192 Edge \u2192 CfT) and actually launches it, falling through to the next if one won't start (and handling browsers like Edge that relaunch onto another PID), so a corrupt/partial install never hard-fails an open. The browser that launches is cached as the default (persisted across restarts) so it isn't re-probed each time. On spawn the bridge SELF-WARMS: detects browsers + disk, and only if the box has no Chrome/Edge and no cached CfT does it background-fetch CfT so the first open is instant. browser_use pins a specific browser (chrome | edge | cft | auto); {browser:'chrome',install:true} downloads & installs REAL Google Chrome (user-scoped, no admin) on an Edge-only box. browser_readiness (READ-ONLY) reports which browser will be used + the full candidate list + the default + free disk. Every failure returns a specific errorCode + _hint (chrome_install_no_disk, chrome_download_network, chrome_install_permission, chrome_stable_not_detected, \u2026). Launches with FULL browser permissions by default for full debug (strictPermissions:true opts out). Headful automation: open/close windows+tabs, navigate, screenshot, eval JS, record. pup is a GENERIC, non-profile browser only \u2014 every session is a fresh isolated Chrome/Edge process, never the user's real signed-in browser; profile defaults to sessionId. To drive the user's REAL Chrome/Edge (their profile, cookies, SSO), use the Adom browser EXTENSION's nbrowser_* verbs \u2014 a separate bridge, not pup's job. macOS (v1.9.74+): full parity with mac-native mechanics \u2014 background-by-default is the app-level hide (windows stay drivable/screenshottable while hidden), raise/lower map to unhide+activate/hide, browser_alert_window posts a native toast whose click focuses the window, browser_use {browser:'chrome',install:true} installs Chrome from the official dmg, and taskbar identity/badging remains Windows-only.",   "homepage": "https://wiki.adom.inc/adom/adom-desktop",   "author": "Adom Inc.",

@@ -1510,6 +1510,22 @@ async function reapOrphanPupChromes() {   if (!_isWin) return { killed: 0, remaining: 0 };   const liveDirs = new Set();   for (const [, s] of sessions) { if (s && s.profileName) liveDirs.add(path.join(PROFILES_DIR, s.profileName).toLowerCase()); }+  // v1.9.92 (learned from issue #16) — NEVER SWEEP FROM AN EMPTY SESSION MAP while session FILES+  // still exist on disk. This sweep decides "orphan" as "no live session owns this profile", so an+  // empty map makes EVERY pup window an orphan and we would kill the user's live windows. The map can+  // legitimately be empty-but-pending: at boot before recoverSessions() finishes, or (pre-#16-fix)+  // after a resolver purged it. On-disk session files are the tell that windows are expected. Same+  // doctrine as the AUMID prune below: with nothing to distinguish stale from pending, doing nothing+  // is the correct answer. A genuine no-windows box has no session files, so real orphans still get+  // reaped there.+  if (!liveDirs.size) {+    let pending = 0;+    try { pending = listSessionFiles().length; } catch (e) {}+    if (pending) {+      console.log(`[reap-orphan] SKIPPED — session map is empty but ${pending} session file(s) exist (recovery pending); refusing to treat live windows as orphans`);+      return { killed: 0, remaining: 0, skipped: 'recovery_pending' };+    }+  }   const where = `$_.CommandLine -like '*${_psLike(PROFILES_DIR)}*'`;   const isOrphan = (p) => { const c = (p.cmd || '').toLowerCase(); for (const d of liveDirs) { if (c.includes(d)) return false; } return true; };   let orphans = (await _psProcs(where)).filter(isOrphan);@@ -5214,24 +5230,47 @@ async function addTabToSession(sessionId, url) { }  // Check if a session's browser is still connected+// v1.9.92 (issue #16) — liveness asks the SESSION'S OWN handle, not just our bookkeeping.+// The old check consulted ONLY the `browsers` map, so the instant `handleBrowserDisconnect` did+// `browsers.delete(profileName)` (a CDP blip, sleep/wake, a renderer crash) every session on that+// profile read as dead — even when its page was still perfectly connected and drivable. That false+// "dead" is what fed the destructive purge below. Now: trust the browsers entry when present, else+// fall back to asking the session's own page whether its browser is still connected. A session that+// can still be driven must never report as not-alive. function isSessionAlive(s) {+  if (!s) return false;   const be = browsers.get(s.profileName);-  return be && be.browser.isConnected();+  if (be && be.browser && be.browser.isConnected()) return true;+  // Fallback: the bookkeeping entry is gone, but is the actual page still live?+  try {+    const p = s.page;+    if (p && !p.isClosed() && p.browser() && p.browser().isConnected()) return true;+  } catch (e) { /* detached handle — fall through to not-alive */ }+  return false; } -// Get active session, fallback to first, or return null+// Get active session, fallback to first, or return null.+// v1.9.92 (issue #16): NON-DESTRUCTIVE. This is a RESOLVER, not a reaper — it must never delete from+// the session map. The old version deleted every session whose isSessionAlive() was false, with no+// `_lostBrowser` guard (unlike resolveSession, which deliberately keeps disconnected entries for+// rescan). So after a transient disconnect, ONE call to this function silently wiped the ENTIRE+// session map — destroying the exact entries handleBrowserDisconnect had just preserved and told the+// user to recover with browser_rescan. That is the reported bug: browser_list_windows returns 0+// windows while the windows are still open and drivable by sessionId, and rescan can't help because+// the sessionId→profile records it needs are gone from memory. Mark, don't delete; removal belongs to+// the close and rescan paths. function getActiveSession() {   if (activeSessionId && sessions.has(activeSessionId)) {     const s = sessions.get(activeSessionId);     if (isSessionAlive(s)) return s;-    sessions.delete(activeSessionId);+    s._lostBrowser = true;                 // keep the entry so browser_rescan can recover it   }   for (const [id, s] of sessions) {     if (isSessionAlive(s)) {       activeSessionId = id;       return s;     }-    sessions.delete(id);+    s._lostBrowser = true;                 // was: sessions.delete(id) — the map-wiping bug   }   activeSessionId = null;   return null;