← Commit history

WHY-CFT: distinguish the THREE banner mechanisms (launch flag, raw CDP, chrome.debugger), after John photographed nb's unsuppressible debugger disclosure on his own browser

John Lauer ·f66951b024 ·2mo ago ·parent c30580a
1 file changed +30
docs/WHY-CFT.md+30
@@ -68,6 +68,36 @@ Two smaller notes that came out of the same run, in the interest of not oversell - `--disable-blink-features=AutomationControlled` is NOT needed and was removed in 1.9.159: that   blink feature only activates via `--enable-automation`, which pup never passes. +### There are THREE banner mechanisms, not one, and they are often confused++Added 2026-08-26, after John photographed a fourth-wall case on his own screen: his REAL browser,+on his Schwab account summary, showing **"Adom Native Browser Extension" started debugging this+browser** with a Cancel button. That is a different mechanism from either of the two above, and the+office argument gets muddled because all three are called "the automation banner".++| # | Mechanism | What Chrome shows | Suppressible? |+|---|---|---|---|+| 1 | `--enable-automation` launch flag | "Chrome is being controlled by automated test software" | YES, by not passing the flag. pup strips it (`ignoreDefaultArgs`) |+| 2 | Raw CDP over `--remote-debugging-port` | **nothing** (measured on branded 151: real session attached, `navigator.webdriver` false) | N/A, there is nothing to suppress |+| 3 | `chrome.debugger` extension API | "<Extension> started debugging this browser" + Cancel | **NO**, not on a browser that is already running |++**pup is mechanism 2, deliberately.** Its toolbar extension requests `storage`, `tabs`, `alarms`+and `scripting`, and NOT `debugger`. pup launches its own browser with a debugging port and+connects to it, so it shows no bar of any kind.++**nb is mechanism 3, necessarily.** It drives the user's ALREADY-RUNNING browser, which no launch+flag can reach, so it attaches through the extension debugger API and Chrome posts its disclosure.+Chrome does have `--silent-debugger-extension-api` to suppress it, but that is a LAUNCH flag: it+cannot apply to a browser that is already open, and quietly removing that disclosure from a+person's own browser while it sits on their brokerage account would be the wrong thing to build+even if it were reachable. On nb the bar is correct behaviour, not a defect.++**So the tradeoff is not "pup avoids a banner and nb does not".** It is that pup gets a clean+window BECAUSE it brought its own browser, and nb gets your real identity BECAUSE it did not, and+Chrome insists on telling you when something attaches a debugger to the browser you are already+using. Those are the same fact from two directions, and it is the clearest single reason both+surfaces exist instead of one.+ ## 2. Extensions: branded Chrome closed every silent path (THE forcing reason)  Branded Chrome 137 (mid-2025) **removed the `--load-extension` flag** specifically to stop software