Pup - the AI's own browser

@@ -2472,12 +2472,16 @@ function prepareCleanProfile(userDataDir) {     // it is the same on every machine that stages to ~/.adom/pup-extension.     try {       if (pupSettings().toolbarExtension !== 'off') {-        const PIN_ID = 'hifinjmfmabkmichcicmfckakhokmpbh';         prefs.extensions = prefs.extensions || {};         const pins = Array.isArray(prefs.extensions.pinned_extensions) ? prefs.extensions.pinned_extensions : [];-        if (!pins.includes(PIN_ID)) { pins.push(PIN_ID); prefs.extensions.pinned_extensions = pins; }+        for (const d of [path.join(os.homedir(), '.adom', 'pup-extension'), path.join(os.homedir(), '.adom', 'pup-identity-extension')]) {+          const id2 = unpackedExtensionId(d);+          if (!pins.includes(id2)) pins.push(id2);+        }+        prefs.extensions.pinned_extensions = pins;       }     } catch (e) {}+    try { prefs.browser = prefs.browser || {}; prefs.browser.promotional_tabs_enabled = false; } catch (e) {}     prefs.profile.exit_type = 'Normal';     prefs.profile.exited_cleanly = true;     // v1.9.129: the durable profile exists to ACCUMULATE logins — make sure Chrome's own@@ -5588,12 +5592,10 @@ async function showCaptureToast(pg, previewDataUrl, line1) { // browser is CfT and the toolbarExtension setting is on, every profile launch carries the flag // and every window is BORN with the toolbar: no install step exists at all. This helper just // stages the extension files at a stable path for the flag to point at.-function stageToolbarExtension() {-  if (process.platform !== 'win32') return null;-  if (pupSettings().toolbarExtension === 'off') return null;-  const srcDir = path.join(__dirname, 'extension');+function _stageExtDir(srcName, dstName) {+  const srcDir = path.join(__dirname, srcName);   if (!fs.existsSync(path.join(srcDir, 'manifest.json'))) return null;-  const dstDir = path.join(os.homedir(), '.adom', 'pup-extension');+  const dstDir = path.join(os.homedir(), '.adom', dstName);   try {     fs.mkdirSync(dstDir, { recursive: true });     for (const f of fs.readdirSync(srcDir)) {@@ -5603,6 +5605,40 @@ function stageToolbarExtension() {     return dstDir;   } catch (e) { return null; } }+function stageToolbarExtension() {+  if (process.platform !== 'win32') return null;+  if (pupSettings().toolbarExtension === 'off') return null;+  return _stageExtDir('extension', 'pup-extension');+}+// v2.0.57 (John: "we could never show the Adom profile avatar in the chrome toolbar — now we+// can"): a second staged extension whose toolbar icon IS the user's avatar, click → the identity+// card ("surfing as adom-you"). Rides ONLY the adom-you profile (an isolated throwaway carrying+// the identity would lie). The avatar (settings.identityAvatarB64, same source as the owner chip)+// overrides the icon files at stage time; the Adom favicon stays as the fallback.+async function stageIdentityExtension() {+  if (process.platform !== 'win32') return null;+  if (pupSettings().toolbarExtension === 'off') return null;+  const dstDir = _stageExtDir('extension-identity', 'pup-identity-extension');+  if (!dstDir) return null;+  try {+    const b64 = pupSettings().identityAvatarB64;+    if (b64) {+      const sharp = require('sharp');+      const buf = Buffer.from(String(b64).replace(/^data:image\/[a-z+]+;base64,/, ''), 'base64');+      for (const size of [16, 48, 128]) {+        const out = await sharp(buf).resize(size, size, { fit: 'cover' }).png().toBuffer();+        fs.writeFileSync(path.join(dstDir, `icon${size}.png`), out);+      }+    }+  } catch (e) {}+  return dstDir;+}+// Chromium's unpacked-extension id: first 16 bytes of SHA-256 over the UTF-16LE path, hex mapped+// a..p. Validated against a live id 2026-08-10 (utf16le is the correct encoding on Windows).+function unpackedExtensionId(dir) {+  const h = require('crypto').createHash('sha256').update(Buffer.from(dir, 'utf16le')).digest('hex').slice(0, 32);+  return [...h].map(c => String.fromCharCode('a'.charCodeAt(0) + parseInt(c, 16))).join('');+} async function startAnnotation(session, sessionId, callerThread, opts) {   const tab = (session.activeTabId && (session.tabs || []).find(t => t.tabId === session.activeTabId)) || (session.tabs || [])[0];   const pg = tab && tab.page;@@ -7647,6 +7683,14 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer       '--no-first-run', '--no-default-browser-check', '--disable-default-apps',       '--disable-sync', '--disable-background-networking',       '--disable-infobars',+      // v2.0.57 (John: the "Chromium now launches when Windows starts" promo infobar on fresh+      // profiles is hideous): layered suppression. Unknown --disable-features names are ignored+      // harmlessly, so we name every plausible id for the launch-on-startup promo; and+      // --disable-field-trial-config turns off the experiment config that gates promos like it,+      // which is also the determinism WHY-CFT promises (same browser on every machine).+      '--disable-field-trial-config',+      '--disable-features=WinLaunchOnLogon,LaunchChromeOnWindowsLogon,StartupBoost,BeginBrowsingInstantly,DesktopStartupPromo,IPH_LaunchOnStartup',+      '--ash-no-nudges',       // ADOM-YOU VISUAL IDENTITY (John, 2026-08-06). A custom logo image on the       // Chrome profile chip is impossible for a local non-signed-in profile       // (faking the gaia picture shows a gray generic + a permanent "Action@@ -7812,7 +7856,8 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer       // own name so the user can still tell windows apart. Both wear the       // Adom-logo avatar so ANY pup window is visually distinct from real Chrome.       brandPupProfile(userDataDir, profileName,-        profileName === DEFAULT_PROFILE ? 'Adom' : ('Adom · ' + profileName));+        profileName === DEFAULT_PROFILE ? 'Adom'+          : (/^iso-.*-pub$/.test(profileName) ? 'Adom · anonymous' : ('Adom · ' + profileName)));     }      // ─── Helper: kill any Chrome processes locking this profile dir ───@@ -8014,8 +8059,11 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer       return b;     }; -    // v2.0.53: stage the toolbar extension; CfT candidates carry it as --load-extension below.+    // v2.0.53/57: stage the extensions; CfT candidates carry them as --load-extension below.+    // The identity extension rides ONLY adom-you (throwaway profiles must not claim the identity).     const _tbExtDir = stageToolbarExtension();+    const _idExtDir = (path.basename(userDataDir || '') === 'adom-you') ? await stageIdentityExtension() : null;+    const _extDirs = [_tbExtDir, _idExtDir].filter(Boolean);      // ─── Spawn-verified launch: try each candidate browser in order, up to 3 ───     // attempts each (with orphan/lock cleanup between attempts). If a browser can't@@ -8037,7 +8085,7 @@ async function getOrLaunchBrowser(profileName, { freshProfile = false, strictPer       else delete launchOpts.executablePath;       // v2.0.53: the toolbar rides ONLY on CfT (branded Chrome ignores/removed the flag).       launchOpts.args = launchOpts.args.filter(a => !a.startsWith('--load-extension='));-      if (_tbExtDir && cand.kind === 'chrome-for-testing') launchOpts.args.push(`--load-extension=${_tbExtDir}`);+      if (_extDirs.length && cand.kind === 'chrome-for-testing') launchOpts.args.push(`--load-extension=${_extDirs.join(',')}`);       lastErr = null;       for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {         try {@@ -11914,7 +11962,12 @@ const server = http.createServer(async (req, res) => {           // profile; every other window keeps its login.           let _profileShared = /adom-wiki-authed|adom-you/i.test(session.profileName || '');           try { for (const [k5, s5] of sessions) { if (k5 !== sessionId && s5 && s5.profileName === session.profileName) { _profileShared = true; break; } } } catch (e) {}-          const _canInPlace = (view === 'authed') ? true : !_profileShared;+          // v2.0.57 (John round-tripped the toggle: authed direction signed in the THROWAWAY+          // profile instead of coming home): in-place authed is only correct when the window is+          // NOT on a toggle-created iso-* jar. From a throwaway, the authed direction takes the+          // tab-preserving relaunch back to the shared adom-you jar, so the round trip is+          // symmetric and logins land where they enrich the shared credential store.+          const _canInPlace = (view === 'authed') ? !/^iso-/.test(session.profileName || '') : !_profileShared;           if (_canInPlace) {             try {               let targetUrl = null;@@ -12114,6 +12167,10 @@ const server = http.createServer(async (req, res) => {           // the user's active window — the reason John "never saw the switch work"). Plus a taskbar           // flash as a belt-and-suspenders notice in case Windows' foreground lock denies the raise.           await osRaiseSessionWindow(s2, sessionId, 'you clicked the taskbar menu to switch this wiki view');+          // v2.0.57 (John: "it re-opened in the bg which didn't make sense, I was in the fg"):+          // one delayed second raise — the first can lose the foreground race while the new+          // window is still materializing.+          setTimeout(() => { try { const s4 = sessions.get(sessionId); if (s4) osRaiseSessionWindow(s4, sessionId, 'finishing the view switch you clicked').catch(() => {}); } catch (e) {} }, 2500);           // v1.9.29 BUG FIX: VERIFY the window actually came back. John clicked the toggle, the old           // window closed, captions fired, and NO window returned: the relaunch had happened but the           // window stayed unfindable/off-screen (the identity stamp logged "No visible window"),