Pup - the AI's own browser

@@ -5886,7 +5886,7 @@ async function fetchFaviconViaChrome(page, url) {     client.send('IO.close', { handle: r.resource.stream }).catch(() => {});     const buf = Buffer.concat(parts);     return buf.length > 100 ? buf : null;-  } catch (e) { return null; }+  } catch (e) { console.log(`[overlay] CDP favicon fetch threw: ${e && e.message}`); return null; } } async function applyAppOverlay(session, sessionId) {   // v1.9.191 (John): overlays are the GENTLE branding path and are ALLOWED in minimal-touch.@@ -5998,39 +5998,49 @@ async function applyAppOverlay(session, sessionId) {           console.log(`[overlay] "${sessionId}" reused last real favicon (${src.href}) instead of the generic globe — same page, favicon just not re-fetchable this cycle`);         }       }-      // v2.0.209 (#55, and the flaky-Mouser twin John caught on his own taskbar): when the in-page-      // favicon path yields nothing (hostile CDNs block in-page fetch; some sites declare no icons),-      // fetch <origin>/favicon.ico BRIDGE-SIDE with a real browser UA — node's fetch has no CORS and-      // no page sandbox. This is how ti.com's red Texas logo finally gets painted live.+      // v2.0.211 (#55): when the in-page favicon path yields nothing, fetch <origin>/favicon.ico+      // out-of-band. TWO rails, each honestly logged: (1) bridge-side node fetch with a browser UA;+      // (2) Chrome's OWN network stack via CDP Network.loadNetworkResource (survives TLS+      // fingerprinting that kills node). The 2.0.209/210 versions failed SILENTLY here: Akamai's bot+      // wall answers 200 with an HTML challenge page, so the node rail "succeeded" with unreadable+      // bytes, skipped the CDP rail, and fell to the generic glyph without a single log line.       if (!src || !src.b64) {         try {           let _u9 = ''; try { _u9 = (activePage && activePage.url()) || ''; } catch (e) {}           const _o9 = (() => { try { const u = new URL(_u9); return /^https?:$/.test(u.protocol) && !/^(localhost|127\.)/.test(u.hostname) ? u.origin : null; } catch (e) { return null; } })();           if (_o9) {+            const _icoUrl = _o9 + '/favicon.ico';+            const _tryIcon = async (buf, mime, rail) => {+              if (!buf || buf.length <= 100) return false;+              const _an = await analyzeIconBytes(buf.toString('base64'), mime || 'image/x-icon', _icoUrl).catch(() => null);+              if (_an && _an.b64 && !_an.unreadable) {+                src = { b64: _an.b64, mime: 'image/png', href: _icoUrl, darkDominant: _an.darkDominant, transparent: _an.transparent };+                session._overlayFav = { kind: 'page-favicon', format: _an.format, mode: 'default', transparent: _an.transparent, darkDominant: _an.darkDominant, via: rail + ' fetch (in-page favicon path came up empty)', href: _icoUrl };+                try { session._lastRealSrc = { b64: src.b64, mime: src.mime, href: _icoUrl, forUrl: _u9 }; } catch (e) {}+                console.log(`[overlay] "${sessionId}" favicon recovered ${rail} from ${_icoUrl}`);+                return true;+              }+              console.log(`[overlay] "${sessionId}" ${rail} fetch got ${buf.length}B from ${_icoUrl} but it is NOT a readable icon (bot-wall HTML?)`);+              return false;+            };+            let _got = false;             const _ctl = new AbortController(); const _tm = setTimeout(() => _ctl.abort(), 5000);-            const _resp = await fetch(_o9 + '/favicon.ico', { redirect: 'follow', signal: _ctl.signal,+            const _resp = await fetch(_icoUrl, { redirect: 'follow', signal: _ctl.signal,               headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36', 'Accept': 'image/*,*/*;q=0.8' } }).catch(() => null);             clearTimeout(_tm);-            let _buf = null;-            if (_resp && _resp.ok) { const _b0 = Buffer.from(await _resp.arrayBuffer()); if (_b0.length > 100) _buf = _b0; }-            if (!_buf) {-              // node fetch blocked (TLS fingerprinting) — go through Chrome's own network stack-              _buf = await fetchFaviconViaChrome(activePage, _o9 + '/favicon.ico');-              if (!_buf) console.log(`[overlay] "${sessionId}" favicon fetch failed BOTH bridge-side and via Chrome for ${_o9} — generic it is`);+            if (_resp && _resp.ok) {+              _got = await _tryIcon(Buffer.from(await _resp.arrayBuffer()), _resp.headers.get('content-type'), 'bridge-side');+            } else {+              console.log(`[overlay] "${sessionId}" bridge-side favicon fetch: ${_resp ? 'HTTP ' + _resp.status : 'network error/timeout'} for ${_icoUrl}`);             }-            if (_buf) {-              if (_buf.length > 100) {-                const _an = await analyzeIconBytes(_buf.toString('base64'), (_resp && _resp.headers.get('content-type')) || 'image/x-icon', _o9 + '/favicon.ico');-                if (_an && _an.b64 && !_an.unreadable) {-                  src = { b64: _an.b64, mime: 'image/png', href: _o9 + '/favicon.ico', darkDominant: _an.darkDominant, transparent: _an.transparent };-                  session._overlayFav = { kind: 'page-favicon', format: _an.format, mode: 'default', transparent: _an.transparent, darkDominant: _an.darkDominant, via: 'bridge-side fetch (in-page favicon path came up empty)', href: src.href };-                  try { session._lastRealSrc = { b64: src.b64, mime: src.mime, href: src.href, forUrl: _u9 }; } catch (e) {}-                  console.log(`[overlay] "${sessionId}" favicon recovered BRIDGE-SIDE from ${src.href}`);-                }-              }+            if (!_got) {+              const _cb = await fetchFaviconViaChrome(activePage, _icoUrl);+              if (_cb) _got = await _tryIcon(_cb, null, 'via-Chrome-CDP');+              else console.log(`[overlay] "${sessionId}" via-Chrome-CDP favicon fetch returned nothing for ${_icoUrl}`);             }+            if (!_got) console.log(`[overlay] "${sessionId}" favicon fetch failed on BOTH rails for ${_o9} — generic it is`);           }-        } catch (e) {}+        } catch (e) { console.log(`[overlay] "${sessionId}" favicon fallback threw: ${e && e.message}`); }       }       if (!src || !src.b64) {         // Generic glyph: a teal-on-dark globe, same silhouette Chrome falls back to.