Pup - the AI's own browser

@@ -5821,6 +5821,82 @@ const server = http.createServer(async (req, res) => {             sendJSON(res, { success: true, output: JSON.stringify({ ok: true, view, unchanged: true, url }) });             return;           }+          // v1.9.63 — IN-PLACE view switch, no close-and-relaunch.+          //+          // A wiki session cookie is per-PROFILE and a profile's userDataDir is fixed at Chrome+          // launch, which is why this used to tear the window down and relaunch it under the other+          // profile (the thing John watched vanish and never come back). Colby's browser-session+          // endpoint removes that: an ALREADY-LOGGED-IN page can mint its own single-use magic link+          // with nothing but its session cookie —+          //     POST /api/v1/auth/browser-session {next:"/adom/page"} -> {url, expires_in:60}+          // so the BRIDGE can mint on the desktop (no container token, no adom-wiki CLI) and just+          // navigate this window. The other direction is a cookie wipe plus a plain navigate. Either+          // way it is one hop and the window/tabs are never destroyed.+          //+          // Guard: only wipe cookies when this window owns its profile. The shared authed profile+          // backs OTHER windows too and clearing it would silently log them all out — fall through+          // to the legacy relaunch in that case.+          const _sharedAuthed = /adom-wiki-authed/i.test(session.profileName || '');+          const _canInPlace = (view === 'authed') ? true : !_sharedAuthed;+          if (_canInPlace) {+            try {+              let targetUrl = null;+              if (view === 'authed') {+                // Mint from ANY currently-authenticated pup page. Single-use + 60s TTL, so mint+                // immediately before navigating and never cache it (a live link IS a credential).+                let minter = null;+                for (const [, s2] of sessions) {+                  for (const t2 of (s2.tabs || [])) {+                    try {+                      if (!isAdomUrl(t2.page.url())) continue;+                      const a2 = await checkWikiAuth(t2.page);+                      if (a2 && a2.authed) { minter = t2.page; break; }+                    } catch (e) {}+                  }+                  if (minter) break;+                }+                if (minter) {+                  const nextPath = (() => { try { const u2 = new URL(url); return u2.pathname + u2.search; } catch (e) { return '/'; } })();+                  targetUrl = await minter.evaluate(async (np) => {+                    try {+                      const r = await fetch('/api/v1/auth/browser-session', {+                        method: 'POST', credentials: 'same-origin',+                        headers: { 'content-type': 'application/json' },+                        body: JSON.stringify({ next: np }),+                      });+                      if (!r.ok) return null;+                      const j = await r.json();+                      return (j && j.url) ? j.url : null;+                    } catch (e) { return null; }+                  }, nextPath);+                }+                if (!targetUrl) console.log(`[wikiview] "${sessionId}" no logged-in page to mint from — falling back to relaunch`);+              } else {+                try {+                  const cdp = await session.page.target().createCDPSession();+                  await cdp.send('Network.clearBrowserCookies');+                  await cdp.detach();+                } catch (e) {}+                targetUrl = url;+              }+              if (targetUrl) {+                await session.page.goto(targetUrl, { waitUntil: 'domcontentloaded', timeout: 25000 });+                session._wikiView = view;+                const a3 = await checkWikiAuth(session.page).catch(() => ({ authed: false }));+                await setWikiAuthedState(session, sessionId, !!(a3 && a3.authed));+                try { await setWikiModeGlyph(session.page, (a3 && a3.authed) ? '● Logged in' : '○ Public'); } catch (e) {}+                session._wikiJumplistKey = undefined;   // the toggle's own label flips+                updateWikiJumplist(session, sessionId).catch(() => {});+                updateThumbnailTooltip(session, sessionId).catch(() => {});+                session._foreground = true;+                try { await session.page.bringToFront(); } catch (e) {}+                console.log(`[wikiview] "${sessionId}" -> ${view} IN PLACE (authed=${!!(a3 && a3.authed)}) — no relaunch`);+                sendJSON(res, { success: true, output: JSON.stringify({ ok: true, view, inPlace: true, authed: !!(a3 && a3.authed), url: session.page.url() }) });+                return;+              }+            } catch (e) { console.log(`[wikiview] "${sessionId}" in-place switch failed (${e.message}) — falling back to relaunch`); }+          }+           // v1.9.29 BUG FIX: carry EVERY tab across the switch. The old code relaunched only the           // active tab's url and closed the rest, silently destroying the user's other tabs (John           // lost a 5-tab research window to one jump-list click). Snapshot all urls + which was