Pup - the AI's own browser

@@ -3,8 +3,8 @@ # Per the Bridge SDK a pkg ships ONLY user skills; all skills listed here are user-facing. # The DEV + PUBLISH maintainer skills are source-only (repo dev-skills/ + publish-skills/, # NOT in package.json files[], never installed here). The bridge RUNTIME isn't here either-# — it ships in Adom Desktop + as the Releases zip. The AD CLI + core skills arrive via-# this pkg's dependencies:{ "adom/adom-desktop": "^1.9.x" } at `pkg install` time.+# — it ships in Adom Bridge + as the Releases zip. The AD CLI + core skills arrive via+# this pkg's dependencies:{ "adom/adom-bridge": "^1.9.x" } at `pkg install` time. set -e PKG_DIR="$(cd "$(dirname "$0")" && pwd)" @@ -14,11 +14,11 @@ deploy_into() {   # main user skill. SKILL.md lives at the repo ROOT (required by the registry), but it   # installs as `pup` — the skill directory name is the slug the loader surfaces, and it   # MUST equal the SKILL.md `name:` field. Every other skill on a machine follows that-  # (adom-desktop-fusion, adom-desktop-kicad, ... and all four pup sub-skills); this one+  # (adom-bridge-fusion, adom-bridge-kicad, ... and all four pup sub-skills); this one   # installed as the REPO name while declaring `name: pup`, so a `pkg install` surfaced the   # start-here skill under a slug that contradicted its own frontmatter, its trigger words,   # and every cross-reference in the sub-skills. Repo name != skill name; don't re-conflate.-  rm -rf "$BASE/adom-desktop-puppeteer-bridge"   # drop the pre-1.9.86 mis-slugged copy+  rm -rf "$BASE/adom-bridge-puppeteer-bridge"   # drop the pre-1.9.86 mis-slugged copy   # v2.0.276: ALSO purge "pup-bridge" — a second mis-slugged copy of the start-here skill that a   # pkg-layer install deposited under the PAGE slug. It was user-invocable, so it sat in the user's   # slash menu as a duplicate of /pup, and because THIS installer never touched it, it served

@@ -1,8 +1,8 @@ {   "slug": "pup-bridge",-  "version": "2.0.651",+  "version": "2.0.652",   "type": "app",-  "description": "The pup SKILL PACK: the AI skills that teach a cloud/container AI how to drive the Bridge Puppeteer (pup) bridge (pup_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY \u2014 this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Desktop bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) \u2014 a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Desktop manages for you.",+  "description": "The pup SKILL PACK: the AI skills that teach a cloud/container AI how to drive the Bridge Puppeteer (pup) bridge (pup_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY \u2014 this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Bridge bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) \u2014 a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Bridge manages for you.",   "keywords": [     "pup",     "puppeteer",@@ -148,5 +148,5 @@       "prompt": "Download the puppeteer-bridge zip from the wiki and walk me through server.js"     }   ],-  "changelog": "HOTFIX: vault migration no longer holds the cache lock across save (2.0.650 hung every vault verb) and saves before deleting legacy entries; upgrade cycle takes hwnds from live sessions"+  "changelog": "adom-desktop -> adom-bridge everywhere (vault service renamed with in-store key migration); CDP lane off by default (cdp_lane_disabled), John: the extension lane must solve every use case" }

@@ -4,7 +4,7 @@   "slug": "pup-bridge",   "title": "Pup - Puppeteer Bridge",   "brief": "pup is the AI's own browser: a real, full Chrome on the user's desktop that the AI fully controls (a sandbox, not the user's signed-in browser). Rides Bridge; pup_* verbs open windows and tabs, navigate, screenshot, and eval JS.",-  "version": "2.0.651",+  "version": "2.0.652",   "tags": [     "skills",     "pup",@@ -100,7 +100,7 @@   "created_at": "2026-05-28T05:28:43.991Z",   "skills": [],   "author_name": "John Lauer",-  "description": "The pup SKILL PACK: the AI skills that teach a cloud/container AI how to drive the Bridge Puppeteer (pup) bridge (pup_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY — this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Desktop bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) — a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Desktop manages for you.",+  "description": "The pup SKILL PACK: the AI skills that teach a cloud/container AI how to drive the Bridge Puppeteer (pup) bridge (pup_* verbs): the everyday `pup` skill plus focused sub-skills for windows/sessions/tabs, screenshots+recording, browsers+Chrome install, and driving the Adom wiki. Installs into ~/.claude/skills + ~/.codex/skills. DOCS ONLY — this is NOT the bridge runtime. The bridge itself (the Node program that drives the browser) runs on the DESKTOP: Adom Bridge bundles it and auto-installs/updates it, and it's published separately on the Releases tab as adom-bridge-puppeteer-v<ver>.zip. The pkg version is kept in lockstep with the Release version so the page's max version row always carries BOTH a pkg tarball (skills) and a runtime zip (bridge) — a skills-only or runtime-only bump on the top row breaks constraint installs. TL;DR: pkg install = the skills for your AI; the bridge = the Release zip, which Adom Bridge manages for you.",   "keywords": [     "pup",     "puppeteer",@@ -168,5 +168,5 @@       "pup-bridge verbs are invoked through the adom-bridge CLI, not through a binary this package installs, so prefix rules cannot reach them."     ]   },-  "changelog": "HOTFIX: vault migration no longer holds the cache lock across save (2.0.650 hung every vault verb) and saves before deleting legacy entries; upgrade cycle takes hwnds from live sessions"+  "changelog": "adom-desktop -> adom-bridge everywhere (vault service renamed with in-store key migration); CDP lane off by default (cdp_lane_disabled), John: the extension lane must solve every use case" }\ No newline at end of file

@@ -289,3 +289,12 @@ the three routes: `pup_import_browser_logins {}`, `pup_vault_sync {peer, hostFil {host:"<domain>", username, password}`. A stored credential the server rejects is tried once, then reported the same way (stale password: see `login-recipes/recover-a-current-password.md`). `pup_fetch_url` works on the extension lane too, so a gated file can be fetched as `bodyBase64` without a download dialog.++## Where secrets live (2.0.649+): one DPAPI file, no Windows Credential Manager cap++Every password is in `~/.adom/pup-vault.bin`, encrypted with Windows DPAPI for the current user (the same+protection Chrome's own password store uses), indexed by `~/.adom/pup-credentials.index.json` (host + username+only). Older builds kept one Credential Manager entry per login and hit the per-user cap after a full browser+import (`credential_set` failed with error 8 at 871 entries); the first vault call on a new build migrates those+entries into the file and frees the slots. The keychain service name is `adom-bridge-pup` (renamed from+`adom-desktop-pup` in 2.0.652; old keys are renamed on load).

@@ -56,3 +56,11 @@ The toolbar: four icons is the extension lane, three is CDP (John's own spec for - **`pup_fetch_url`** runs in the named tab on this lane, tries the fetch with credentials and then without (a wildcard CORS header refuses credentials), returns `httpStatus`, `contentType`, `bytes`, `sha256`, and the body as `bodyBase64` (binary-safe) or `text`. `saveTo` takes your container path: the CLI writes the file from the returned body and reports `savedTo` plus `savedToFilesystem:"container"`; compare `sha256` (measured: a 269669-byte PDF, identical hash to the reporter's). A cancelled HTTP auth challenge comes back as `no_credential` with the host. - **`isolated:true`** now mints a throwaway `iso-<id>` profile (reported by `pup_window_info`) and removes it when the window closes. It still needs `lane:"cdp"`: the extension lane is one browser on adom-you (pup-bridge#113 is the per-profile lane). - **Slow boxes:** a cold `pup_open_window` that would exceed ab's budget answers `ok:true, loading:true` with a progress frame once the window exists and finishes the navigate in the background; poll `pup_window_info` instead of opening again.++## The CDP lane is OFF by default (2.0.652, John 2026-09-19)++`pup_open_window {lane:"cdp"}` answers `cdp_lane_disabled` unless the user has turned it on for that box with+`pup_configure {cdpLane:"on"}`. John: "i want it almost NEVER used cuz then you may use it as a crutch instead of+fixing ext lane to solve all use cases." Trusted input, HTTP auth, fetch, screenshots and recording all run on the+extension lane; a feature that genuinely needs CDP is an extension-lane gap to file on adom/pup-bridge, not a reason+to open a CDP window. `isolated:true` on the extension lane is pup-bridge#112/#113 (in progress).

@@ -5,7 +5,7 @@ set -e remove_from() {   local BASE="$1"   rm -rf "$BASE/pup" \-         "$BASE/adom-desktop-puppeteer-bridge" \+         "$BASE/adom-bridge-puppeteer-bridge" \          "$BASE/pup-windows-sessions-tabs" \          "$BASE/pup-screenshots-recording" \          "$BASE/pup-browsers-and-chrome" \