app

Pup - the AI's own browser

Public Made by Adom

by adom

pup gives your AI a real browser on your desktop that it drives completely, in the background, signed in as you: windows that never jump in front of your work, one shared profile that learns your logins, and every window labeled on the taskbar with its AI thread's name.

skillspuppuppeteerbrowseradom-bridgebridgepup-bridge
Overview Files Skills Discover Packages Releases Dependencies Issues17 Breadcrumbs Pull Requests1 Activity
Closed bug report

AI falls back to the CDP lane on CSP pages because pup never tells it the extension lane can do it (Amex login, 2.0.725)

John Lauer · 22d ago ·closed by John Lauer

What happened (John Lauer's AdomLapper, Windows 11, pup 2.0.725 Rust shell, 2026-10-19): an AI needed to sign John into American Express in pup. On the extension lane, pup_login and pup_eval both fail on the Amex login page with "eval is disabled". The page's CSP refuses string eval (#130), the 2.0.591 DevTools retry isn't in the Rust shell, and pup_devtools answers "not served by the Rust bridge yet".

What the AI did next, and why that is the real bug: two different AI threads concluded that "pup can't do this without the CDP lane". One proposed pup_configure {cdpLane:"on"}, the other did it: it turned the CDP lane on and opened an isolated lane:"cdp" window to fill the form. It worked, but it is exactly the path the skills say not to take. John's point: the extension lane is supposed to have CDP-equivalent power through the extension (chrome.debugger via nbe). Nothing in pup's responses or skills told the AI that, or what to do instead when that power is missing in this build.

Asks:

  1. Responses that steer. When pup_login/pup_eval hit a CSP page on the extension lane, the error's _hint should say what to do on THIS build: the extension-lane DevTools path (or that it is missing in 2.0.725, with the issue number), and that the CDP lane is a last resort that needs the user's OK. Today the AI only gets "eval is disabled" and invents its own plan.
  2. Skills that say it plainly. The pup and pup-lanes skills should open with one clear line: "the extension lane has CDP-level access through the extension (chrome.debugger); you never need the CDP lane for CSP pages, iframes or raw DevTools." Then list what is missing in the Rust shell today, with links to the issues.
  3. Vault entry choice. With several saved logins for one host (www.americanexpress.com had adom1 plus four old personal ones), pup_login silently filled the wrong account. Its username is ignored unless you also pass password. Let pup_login {username} pick that vault entry, and return candidates:[usernames] when there are several, so the AI can choose.
  4. Screenshots showing a revealed password. A screenshot taken while the password field was in "show" mode captured the plaintext password. pup_screenshot should mask input[type=password] fields that a page has switched to type=text, or at least warn.

Related: #130 (CSP eval), #116 (extension lane CSP, closed).

1 Reply

John Lauer · 21d ago

Fixed on insiders in 2.0.727, both asks:

  1. Responses that steer. A lane:"cdp" open on a box with the CDP lane off now opens on the extension lane with a _laneNote instead of refusing. Every hint that sent an AI to the CDP lane now names the extension-lane way, and each ends with a standing note: pup windows have CDP-level access, so never stop or switch machines because CDP is off. The new pup_devtools {method, params} sends any DevTools command to a pup window through pup's extension (verified: Runtime.evaluate and DOM.getDocument on the extension lane; Browser.close is blocked).
  2. Skills that say it plainly. The pup skill's description and a new section near the top say it in those words, and pup-lanes no longer tells an AI to reopen with lane:"cdp". The underlying CSP failure (#130) is being fixed in 2.0.730.
John Lauer closed this · 21d ago

Log in to reply.