Pup - the AI's own browser

@@ -1998,6 +1998,8 @@ async function dualBadgeB64(wins, tabs) {  async function updateTabCountBadge(session, sessionId) {   if (process.platform !== 'win32' || _identitySupported !== true) return; // overlay busy with brand badge on old AD+  // v1.9.31: a tab verb just ran — cheap moment to notice a drag-out (event-driven, not a scan).+  drainWindowOpenedEvents().catch(() => {});   // v1.9.22: if the window's CATEGORY changed (a tab made it mixed, a navigate left the wiki...),   // re-stamp the base icon NOW — the 10-minute brand debounce is for redundant re-stamps of the   // SAME icon, not for a category flip the user should see immediately.@@ -2330,6 +2332,109 @@ async function osRaiseSessionWindow(session, sessionId) {     try { const r = (await runPsHiddenPromise(psScript, { timeout: 8000 })).toString().trim(); console.log(`[wiki] raised session "${sessionId}" to foreground: ${r}`); } catch (e) {}   } catch (e) {} }+// ── v1.9.31: TAB DRAGGED OUT of a pup window → adopt it as its OWN session ──────────────+// John dragged a tab out of a pup window: Chrome created a NEW OS window, which (being a new HWND)+// carries none of pup's identity, so it wore the bare Chrome-for-Testing icon. Worse, the dragged+// page keeps its "(session: <id>)" title suffix, so ONE session suddenly spanned TWO windows and+// AD's title-based window resolution became ambiguous.+//+// Detection is EVENT-DRIVEN, never a scan (John: "scanning every second is wasteful"). AD exposes a+// global UIA subscription — desktop_ui_watch {event:"window-opened"} — whose events land in a+// 500-deep ring we drain with desktop_ui_events {sinceSeq}. A new window announces itself; we then+// do ONE cheap CDP check (Browser.getWindowForTarget per tab) only for sessions that could be+// affected. Draining is piggybacked on existing activity (the 30s health tick + tab verbs), so+// there is no dedicated timer.+//+// Policy (John's call, option A): the dragged-out tab becomes its OWN session — its own sessionId,+// identity, CATEGORY icon and jump list. That keeps "one session = one window" true, keeps titles+// unique, and lets a dragged-out digikey tab correctly show the globe instead of inheriting the+// wiki book.+let _uiWatchId = null;+let _uiWatchSeq = 0;+let _uiWatchSupported = null;   // null = unprobed, false = AD too old+async function ensureWindowOpenedWatch() {+  if (process.platform !== 'win32' || _uiWatchSupported === false || _uiWatchId) return;+  try {+    const r = await chrome.adCommand('desktop_ui_watch', { event: 'window-opened' }, { timeoutMs: 6000 });+    const raw = r && (typeof r.output === 'string' ? r.output : JSON.stringify(r.output || ''));+    if (_isUnknownVerb(r, raw)) { _uiWatchSupported = false; return; }+    const o = raw ? JSON.parse(raw) : {};+    _uiWatchId = ((o.data || o).watchId) || (o.watchId) || 'w1';+    _uiWatchSupported = true;+    console.log(`[drag] subscribed to window-opened (watchId=${_uiWatchId}) — dragged-out tabs adopt themselves`);+  } catch (e) {}+}+// Which OS window (CDP windowId) is this page in?+async function pageWindowId(page) {+  let cdp = null;+  try {+    cdp = await page.target().createCDPSession();+    const { windowId } = await cdp.send('Browser.getWindowForTarget');+    return windowId;+  } catch (e) { return null; }+  finally { try { if (cdp) await cdp.detach(); } catch (e) {} }+}+// Split any tab that no longer shares its session's window into its own session.+async function adoptDraggedOutTabs(sessionId) {+  const session = sessions.get(sessionId);+  if (!session || (session.tabs || []).length < 2) return 0;+  let adopted = 0;+  try {+    const active = (session.tabs || []).find(t => t.tabId === session.activeTabId) || session.tabs[0];+    const homeWin = await pageWindowId(active.page);+    if (homeWin == null) return 0;+    for (const t of [...session.tabs]) {+      if (t === active) continue;+      const wid = await pageWindowId(t.page);+      if (wid == null || wid === homeWin) continue;+      // This tab lives in a DIFFERENT OS window now → it was dragged out. Give it its own session.+      const newId = `${sessionId}-split${adopted + 1}-${Date.now().toString(36).slice(-4)}`;+      const idx = session.tabs.indexOf(t);+      if (idx !== -1) session.tabs.splice(idx, 1);+      if (session.activeTabId === t.tabId) session.activeTabId = session.tabs.length ? session.tabs[0].tabId : null;+      const ns = createSession(session.profileName);+      ns.owner = session.owner || null;+      ns._wikiView = session._wikiView;+      ns._wikiAuthed = session._wikiAuthed;+      ns._publicProfile = session._publicProfile;+      ns._sessionId = newId;+      attachTab(ns, newId, t.page);+      sessions.set(newId, ns);+      const be = browsers.get(session.profileName);+      if (be) be.refCount++;+      let u = null; try { u = t.page.url(); } catch (e) {}+      console.log(`[drag] "${sessionId}" tab dragged out → adopted as session "${newId}" (${(u || '').slice(0, 60)})`);+      adopted++;+      // Brand the new window: its own identity, CATEGORY icon, overlay and jump list.+      try { await brandPupWindow(newId); } catch (e) {}+      try { await updateTabCountBadge(ns, newId); } catch (e) {}+      try { await updateWikiJumplist(ns, newId); } catch (e) {}+      try { saveSessionFile(newId, ns.profileName, u); } catch (e) {}+    }+    if (adopted) { try { await updateTabCountBadge(session, sessionId); } catch (e) {} }+  } catch (e) {}+  return adopted;+}+// Drain the window-opened ring; a new window means SOME session may have lost a tab. Cheap: one+// drain call, then the CDP check only for multi-tab sessions.+async function drainWindowOpenedEvents() {+  if (process.platform !== 'win32' || _uiWatchSupported === false) return;+  await ensureWindowOpenedWatch();+  if (!_uiWatchId) return;+  try {+    const r = await chrome.adCommand('desktop_ui_events', { sinceSeq: _uiWatchSeq, max: 200 }, { timeoutMs: 6000 });+    const raw = r && (typeof r.output === 'string' ? r.output : JSON.stringify(r.output || ''));+    if (!raw) return;+    const o = JSON.parse(raw);+    const data = o.data || o;+    const evs = data.events || [];+    if (typeof data.nextSeq === 'number') _uiWatchSeq = data.nextSeq;+    // Only Chrome-class windows matter (a pup tab drag makes one).+    const chromeWins = evs.filter(e => /Chrome|Chromium/i.test(((e.element || {}).name) || ''));+    if (!chromeWins.length) return;+    for (const [sid] of [...sessions]) { await adoptDraggedOutTabs(sid); }+  } catch (e) {}+} // Brand a pup window: full identity on capable AD, overlay badge fallback on older AD. async function brandPupWindow(sessionId) {   const stamped = await stampPupIdentity(sessionId);@@ -4275,6 +4380,9 @@ setInterval(async () => {       }     }   }+  // v1.9.31: drain the window-opened ring here (no dedicated timer) so an idle desktop still+  // notices a dragged-out tab within one tick; active use catches it immediately via the tab verbs.+  drainWindowOpenedEvents().catch(() => {});   // Clean stale session files whose PIDs are confirmed dead. Sessions that   // are _lostBrowser but whose PID is alive STAY on disk for recovery.   const files = listSessionFiles();@@ -6961,6 +7069,7 @@ server.listen(PORT, BIND_HOST, async () => {   setTimeout(() => { ensurePupIdentityRegistered().catch(() => {}); }, 2500);   setTimeout(() => { probeAdVersion().catch(() => {}); }, 1500);   setTimeout(() => { brandSweep('startup').catch(() => {}); }, 8000);+  setTimeout(() => { ensureWindowOpenedWatch().catch(() => {}); }, 9000);    // Recover sessions from disk (reconnect to Chrome windows that survived bridge restart)   try {