Pup - the AI's own browser
Public Made by Adomby adom
pup gives your AI a real browser on your desktop that it drives completely, in the background, signed in as you: windows that never jump in front of your work, one shared profile that learns your logins, and every window labeled on the taskbar with its AI thread's name.
Rust 2.0.725: pup_login and pup_eval fail with 'eval is disabled' on CSP pages (Amex login), no DevTools retry
Summary
pup 2.0.725 (Rust shell), extension lane, AdomLapper: on a page whose CSP forbids unsafe-eval, pup_eval and pup_login both fail with eval_failed: "pup_eval could not run your code: eval is disabled". The skill docs say the extension lane retries a CSP-refused eval through DevTools (2.0.591), but the Rust build does not, and pup_devtools answers "not served by the Rust bridge yet (Phase 1)". Net effect: pup_login cannot sign in to American Express at all, even with a fresh vault entry (adom1, imported 2026-10-19).
Repro (2026-10-19)
pup_open_window {window:"cs-amex", url:"https://www.americanexpress.com/en-us/account/login"}(no lane) -> ok, transport ext.pup_eval {window:"cs-amex", script:"1+1"}->eval_failed, "eval is disabled". Same verb on example.com and on americanexpress.com/en-us/business/ returns 2.pup_login {window:"cs-amex", submit:false, username:"adom1"}->eval_failed, "eval is disabled" (vault has www.americanexpress.com adom1).pup_fill {selector:"#eliloUserID", text:"adom1"}WORKS on the same page (valueLanded:true), so a non-string-eval injection path exists.- Auto-fill on load (autoLogin on) does not fill the form either.
Expected
pup_login fills from the vault on CSP pages (use the same func-based injection pup_fill uses, or the DevTools retry the Node build had). pup_eval should retry through DevTools as documented.
Found while
Downloading the Adom Amex activity CSV for a CEO spend report; the login is fully blocked on the default lane.