Pup - the AI's own browser
Public Made by Adomby adom
pup gives your AI a real browser on your desktop that it drives completely, in the background, signed in as you: windows that never jump in front of your work, one shared profile that learns your logins, and every window labeled on the taskbar with its AI thread's name.
isolated:true does not isolate: the window still runs on the adom-you profile
isolated:true does not isolate. It shares the adom-you profile.
Observed on 2.0.553, Windows, Rust shell. pup_open_window with isolated:true plus an isolationReason returns a window whose pup_window_info reports profile = adom-you, i.e. the same durable jar every default window uses.
Cause looks like rust/verbs/src/lib.rs:1039, which is the only place profile is bound:
let profile = args.get("profile").and_then(|p| p.as_str()).unwrap_or("adom-you").to_string();
isolated is read at 1057 and used only to keep the window on the CDP lane (line 1058) and to select the anonymous identity tile. Nothing derives a throwaway profile name from it.
Why this matters more than a cosmetic bug:
- isolated:true is REASON-GATED. Callers must state why the window must NOT be adom-you, which strongly implies the request is honored.
- The pup skill tells callers to use it for logged-out views, acting as a different user, and untrusted pages, and states that an isolated window discards its logins so they build nothing. If the jar is actually adom-you, a login performed in a supposedly throwaway window persists into the shared profile, and an untrusted page runs against the users real cookies.
- It also silently invalidates any experiment that uses isolated:true as a fresh-profile control. That happened here: a warm-versus-fresh comparison ran adom-you twice and the wrong conclusion was published before it was caught.
Expected: isolated:true mints a throwaway profile directory (or an explicit named profile) distinct from adom-you, and pup_window_info reports that profile.
Either fix the behaviour or, if sharing the jar is deliberate, change the verb contract and the skill text so nobody relies on isolation that does not exist. The current combination of a mandatory reason and no isolation is the dangerous case.