Pup - the AI's own browser

@@ -1,6 +1,6 @@ {   "slug": "pup-bridge",-  "version": "2.0.391",+  "version": "2.0.392",   "type": "app",   "description": "The pup SKILL PACK \u2014 the AI skills that teach a cloud/container AI how to drive the Adom Desktop Puppeteer (pup) bridge (browser_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY \u2014 this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Desktop bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) \u2014 a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Desktop manages for you.",   "keywords": [

@@ -1 +1 @@-2.0.391\ No newline at end of file+2.0.392\ No newline at end of file

@@ -2,7 +2,7 @@   "manifest_version": 1,   "name": "puppeteer",   "displayName": "Puppeteer (Chrome for Testing + Native)",-  "version": "2.0.391",+  "version": "2.0.392",   "description": "Drives a browser ALREADY on the machine \u2014 installed Chrome, else Microsoft Edge (every Windows PC ships with Edge) \u2014 launched with a FRESH isolated profile, so the common case has NO ~150 MB Chrome-for-Testing download and it never touches the user's real tabs/logins. Binds its local server to LOOPBACK (127.0.0.1) only, so no Windows Firewall 'allow Node through the firewall' prompt ever pops. Chrome for Testing is fetched only as a LAST RESORT if the machine has no Chromium browser at all. SPAWN-VERIFIED fallback: pup tries each detected browser (Chrome \u2192 Edge \u2192 CfT) and actually launches it, falling through to the next if one won't start (and handling browsers like Edge that relaunch onto another PID), so a corrupt/partial install never hard-fails an open. The browser that launches is cached as the default (persisted across restarts) so it isn't re-probed each time. On spawn the bridge SELF-WARMS: detects browsers + disk, and only if the box has no Chrome/Edge and no cached CfT does it background-fetch CfT so the first open is instant. pup_use pins a specific browser (chrome | edge | cft | auto); {browser:'chrome',install:true} downloads & installs REAL Google Chrome (user-scoped, no admin) on an Edge-only box. pup_readiness (READ-ONLY) reports which browser will be used + the full candidate list + the default + free disk. Every failure returns a specific errorCode + _hint (chrome_install_no_disk, chrome_download_network, chrome_install_permission, chrome_stable_not_detected, \u2026). Launches with FULL browser permissions by default for full debug (strictPermissions:true opts out). Headful automation: open/close windows+tabs, navigate, screenshot, eval JS, record. pup is a GENERIC, non-profile browser only \u2014 every session is a fresh isolated Chrome/Edge process, never the user's real signed-in browser; profile defaults to sessionId. To drive the user's REAL Chrome/Edge (their profile, cookies, SSO), use the Adom browser EXTENSION's nbrowser_* verbs \u2014 a separate bridge, not pup's job. macOS (v1.9.74+): full parity with mac-native mechanics \u2014 background-by-default is the app-level hide (windows stay drivable/screenshottable while hidden), raise/lower map to unhide+activate/hide, pup_alert_window posts a native toast whose click focuses the window, pup_use {browser:'chrome',install:true} installs Chrome from the official dmg, and taskbar identity/badging remains Windows-only.",   "homepage": "https://wiki.adom.inc/adom/adom-bridge",   "author": "Adom Inc.",

@@ -2436,7 +2436,9 @@ const _recoverTimeout = (p, ms, fallback) => Promise.race([   new Promise(r => setTimeout(() => r(fallback), ms)), ]); +const _recoveryProbeMemo = new Map();   // v2.0.392: pid -> probe verdict, one per recovery pass async function recoverSessions() {+  _recoveryProbeMemo.clear();   const files = listSessionFiles();   try {     if (fs.existsSync(RECOVERY_SENTINEL)) {@@ -2513,12 +2515,28 @@ async function recoverSessions() {     }      try {-      // Check if Chrome is actually listening (5s cap — a wedged Chrome must not hang the pass)-      const resp = await _recoverTimeout(fetch(`http://127.0.0.1:${port}/json/version`), 5000, null);-      if (!resp || !resp.ok) {-        console.log(`Session "${sessionId}" CDP port ${port} not responding — killing orphaned Chrome PID ${pid}`);-        try { process.kill(pid, 'SIGKILL'); } catch (e) { console.log(`  kill failed: ${e.message}`); }-        deleteSessionFile(sessionId);+      // v2.0.392 (release sweep on winvm, 2026-09-04): this used to be ONE 5s probe, and a miss+      // meant SIGKILL of the Chrome PID plus deleting the session file — per session, so seven+      // sessions each tried to kill the same shared Chrome. On a 4-vCPU VM with ten heavy tabs+      // the devtools endpoint simply answered slowly, and pup destroyed nine of the user's windows+      // during a routine bridge update (both laptops answered fast and survived the same restart).+      // A SLOW Chrome is not an orphaned Chrome. Recovery now (a) probes with escalation, 5s -> 15s+      // -> 30s, (b) memoizes ONE verdict per PID for the whole pass, and (c) on a persistent miss+      // NEVER kills and NEVER deletes: the session file stays, the session is left for the 30s+      // health loop / pup_rescan to reconnect. A truly dead process is already handled above by+      // isProcessAlive; a live process that will not answer keeps its windows, which the user can+      // see and close themselves. Destroying visible windows is the worse failure, every time.+      if (!_recoveryProbeMemo.has(pid)) {+        let ok = false;+        for (const cap of [5000, 15000, 30000]) {+          const resp = await _recoverTimeout(fetch(`http://127.0.0.1:${port}/json/version`), cap, null);+          if (resp && resp.ok) { ok = true; break; }+          console.log(`Session "${sessionId}" CDP port ${port} did not answer within ${cap / 1000}s — retrying with a longer cap (Chrome PID ${pid} is alive; a slow Chrome is not an orphan)`);+        }+        _recoveryProbeMemo.set(pid, ok);+      }+      if (!_recoveryProbeMemo.get(pid)) {+        console.log(`Session "${sessionId}" CDP port ${port} still not answering after 50s of probes — LEAVING Chrome PID ${pid} and this session file alone (awaiting reconnect; the health loop and pup_rescan keep trying)`);         continue;       } @@ -2539,8 +2557,9 @@ async function recoverSessions() {        // Find the page that matches this session's URL (10s cap on pages() — same wedge risk)       const browser = browsers.get(profileName).browser;-      const pages = await _recoverTimeout(browser.pages(), 10000, null);-      if (!pages) throw new Error('browser.pages() hung (10s cap) — wedged Chrome');+      let pages = await _recoverTimeout(browser.pages(), 10000, null);+      if (!pages) { console.log(`Session "${sessionId}": browser.pages() did not answer in 10s — one more try with a 30s cap before treating it as wedged`); pages = await _recoverTimeout(browser.pages(), 30000, null); }+      if (!pages) throw new Error('browser.pages() hung (10s + 30s caps) — wedged Chrome; session left for reconnect');       let page = null;        // v1.9.154 — THE fourth matcher, fixed (two failed binding proofs cornered it here):