Pup - Puppeteer Bridge
Public Made by Adomby adom
pup is the AI's own browser: a real, full Chrome on the user's desktop that the AI fully controls (a sandbox, not the user's signed-in browser). Rides Bridge; pup_* verbs open windows and tabs, navigate, screenshot, and eval JS.
Dead-session verbs silently fall back to another thread's ACTIVE window (isolation break); SPA title rewrites also defeat pup_rescan's recovery tag
Verbs against a DEAD sessionId silently act on another thread's active window instead of erroring - looked exactly like a cross-thread takeover.
Timeline (2026-08-09, AdomLapper, thread "nb bridge build"):
- My session
nb-hero-gate(own window, own profile, owner set) was alive and serving screenshots at 13:24. - Around 13:30-13:50 the pup bridge restarted (Adom Bridge relay bounce + a native-browser bridge refresh happened in that window). All pup sessions died; other threads re-created theirs (
pup-wiki,kicad-page-live2). Mine was not re-created. - My next calls with
{"sessionId":"nb-hero-gate"}did NOT error:pup_navigatereturned ok-shaped output.pup_screenshotRETURNED A SCREENSHOT - of the ACTIVE window, which belonged to the pup-wiki thread and was showing adom/kicad-bridge. To the operator this is indistinguishable from "the kicad thread took over my window" - John asked exactly that. It also means my thread was effectively reading another thread's window contents, which the ownership model exists to prevent.
pup_list_tabs {"sessionId":"nb-hero-gate"}DID error (the _reportIssues hint). So some verbs validate the session and some fall back to "active tab" - the fallback is the bug.
Ask: any verb addressed to a sessionId that no longer exists must hard-error (unknown_session, with the live-session list in the hint), never fall back to the active window. Cross-thread reads via fallback are an isolation break, not a convenience.
Second finding, same incident: SPA title rewrites destroy the rescan recovery tag.
pup_rescan recovers orphans "by parsing the (session: X) tag from each page's title". My window hosted Hero Studio, whose SPA continuously rewrites document.title to "Hero Studio" - so the tag was gone and rescan adopted 0 orphans even while my windows were still on screen. Suggestion: also stamp the session tag somewhere the page cannot overwrite (window.name, a CDP target attribute, or track by targetId), so rescan survives title-rewriting apps.
Repro is cheap: open a session, kill the pup bridge process, let it respawn, then call pup_screenshot with the old sessionId - you get the active window of whichever thread re-created first.