Pup - the AI's own browser

@@ -5920,6 +5920,16 @@ function sendJSON(res, obj, status = 200) {             if (_v && RENDER_VERBS.has(_v) && _ok && inner._verifyRender === undefined) {               const _rc2 = (res && res._renderCheck) || null;               if (_rc2 && inner.renderCheck === undefined) inner.renderCheck = _rc2;+              // v1.9.109: on ANY render verb, a detected failure must lead the hint the caller reads,+              // not just browser_open_window's (which composes its own). reload/navigate get it here.+              if (_rc2 && _rc2.ok === false && (_rc2.signals || []).length) {+                const _st = (typeof _rc2.httpStatus === 'number') ? ' (HTTP ' + _rc2.httpStatus + ')' : '';+                const _lead = '\u26D4 THE PAGE IS STILL BROKEN: ' + _rc2.signals.join(', ') + _st+                  + (_rc2.excerpt ? ' \u2014 it says "' + String(_rc2.excerpt).replace(/\s+/g, ' ').slice(0, 120) + '"' : '')+                  + '. Do NOT report success. See _verifyRender. ';+                const _cur = (inner._hint !== undefined ? inner._hint : obj._hint) || '';+                if (String(_cur).indexOf('STILL BROKEN') === -1 && String(_cur).indexOf('IS BROKEN') === -1) inner._hint = _lead + _cur;+              }               inner._verifyRender = renderVerifyHint(inner.sessionId || (obj && obj.sessionId), inner.url || (obj && obj.url), _rc2);               touched = true;             }@@ -6526,12 +6536,23 @@ const server = http.createServer(async (req, res) => {               ok: true,               highFps: hf || false,               defaultPermissionsApplied: !args.strictPermissions,-              defaultPermissions: args.strictPermissions ? [] : PERMISSIVE_DEFAULT_PERMISSIONS.map(p => `${p.name}=${p.setting}`),+              // v1.9.109 (John: "you can trim the bloat if you think that just causes the ai to ignore+              // stuff") — this emitted all ~32 permission strings on EVERY open. The caller never acts on+              // them, and they were padding the response that a 404 verdict had to compete with. Ordering+              // by consequence means boilerplate collapses to a count + a pointer.+              defaultPermissionsCount: args.strictPermissions ? 0 : PERMISSIVE_DEFAULT_PERMISSIONS.length,+              defaultPermissionsNote: args.strictPermissions+                ? 'strictPermissions: nothing pre-granted'+                : 'full browser permissions pre-granted (clipboard, camera, geolocation, window-management, ...) — browser_describe has the exact list',               downloadsEnabled: !args.strictPermissions,               downloadPath,               // v1.4.0: which browser pup drove + the full fallback picture.               browser: brep.browser,-              availableBrowsers: brep.availableBrowsers,+              // Same treatment: the full browser inventory is a one-time discovery fact, not something a+              // caller re-reads on every open. The chosen browser is already reported in `browser`.+              availableBrowsers: (() => {+                try { return (brep.availableBrowsers || []).map(b => `${b.kind}(${b.source})`); } catch (e) { return brep.availableBrowsers; }+              })(),               defaultBrowser: brep.defaultBrowser,               // v1.8.0: window placement — background unless explicitly foregrounded.               placement: foreground ? 'foreground' : 'background',@@ -8335,14 +8356,27 @@ const server = http.createServer(async (req, res) => {           try { ({ tab, tabId } = resolveTabOrError(session, resolvedId, args, { allowCrashed: true })); }           catch (e) { sendTabResolveError(res, e); return; }           tab.errors.length = 0;-          await withTimeout(+          // v1.9.109: keep the reload's own HTTP status — page.reload() returns the response, and this+          // is the verb an AI uses right after "I fixed it", so a still-broken page must be caught here.+          const _rlResp = await withTimeout(             tab.page.reload({ waitUntil: 'domcontentloaded', timeout: 25000 }),             30_000, 'page.reload'           );+          try { tab.page.__pupHttpStatus = _rlResp && typeof _rlResp.status === 'function' ? _rlResp.status() : null; } catch (e) {}           if (tab._crashed) { tab._crashed = false; delete tab._crashedAt; delete tab._crashReason; console.log(`[crash] session "${resolvedId}" tab ${tabId} recovered via reload`); }           // v1.8.26: the user is signalled by the auto-flash, NOT by raising the window.           // Only raise if this session is one the user is actively watching.           if (session._foreground) { try { await tab.page.bringToFront(); } catch {} }+          // v1.9.109 — PROBE ON RELOAD TOO. This was the hole: only browser_open_window probed, so a+          // thread that hit a 404, fixed its dev server, called browser_reload and got ok:true with the+          // GENERIC "do not assume it rendered" hint concluded "Mockup is now live again" — reporting+          // success on a page nobody had checked. The verb used to confirm a fix is exactly the verb+          // that must verify it.+          try { res._renderCheck = await probeRender(tab.page, tab.page.__pupHttpStatus); } catch (e) {}+          try {+            const _rc = res._renderCheck;+            if (_rc && _rc.ok === false) console.log(`[render] "${resolvedId}" STILL BROKEN after reload: ${_rc.signals.join(', ')}`);+          } catch (e) {}           sendJSON(res, { success: true, output: JSON.stringify({ ok: true, sessionId: resolvedId, tabId }) });           return;         }@@ -8424,6 +8458,12 @@ const server = http.createServer(async (req, res) => {             setTimeout(() => { updateWikiJumplist(session, resolvedId).catch(() => {}); }, 1000);           }           if (tab._crashed) { tab._crashed = false; delete tab._crashedAt; delete tab._crashReason; console.log(`[crash] session "${resolvedId}" tab ${tabId} recovered via navigate`); }+          // v1.9.109: probe on navigate as well — same reasoning as reload.+          try { res._renderCheck = await probeRender(tab.page, tab.page.__pupHttpStatus); } catch (e) {}+          try {+            const _rc = res._renderCheck;+            if (_rc && _rc.ok === false) console.log(`[render] "${resolvedId}" BROKEN after navigate to ${args.url}: ${_rc.signals.join(', ')}`);+          } catch (e) {}           sendJSON(res, { success: true, output: JSON.stringify({ ok: true, url: args.url, sessionId: resolvedId, tabId, ...(authSteerHint(args.url) ? { _hint: authSteerHint(args.url).trim() } : {}) }) });           return;         }