Pup - the AI's own browser

Focus-emulation policy reaches the file-based re-attach path, converges on the health tick, and moves into Ctx so a session clone cannot clobber it

Focus emulation follows the active tab instead of every attached tab, so Chrome throttles and can reclaim background tabs

Esc always closes the annotation overlay: listener kept after a quick capture, registered on window, document and canvas, canvas focused when armed

Recovery adopts a window's other tabs at boot and reconnect; boot Page.enable off the blocking path

Adopting a discarded tab no longer blocks 30 s (page setup on a helper thread); attach_tab idempotent

Boot recovery repaired after 2.0.453: discovery replay ignored, adoption only into window-owning sessions, named sessions recovered first, no double re-attach, failures logged

Window survives its tab being replaced (tabless grace + re-attach by CDP window id); user-opened tabs join their window; toolbar pen resolves by _tabUrl

Every bundled SKILL.md parses as strict YAML (#103: pup-adom-wiki description folded); ship.sh aborts on an invalid frontmatter

Desktop recording guidance: ab's native GPU-accelerated recorder first, pup's Meet-style screen share as the broadly compatible fallback; in hints and skills

winAttentionFlash setting (default off) in the Settings dialog: the Windows attention flash on new windows, off = focus:false births

New windows created with focus:false: Chrome never asks Windows for the foreground, so no denied activation and no orange attention state on the button

Thread tiles drawn at every size Windows shows them (t10): each ICO entry rendered by the canvas at its own size, no resampling

Born wearing the tile: newborn stamped natively before Chrome's first show (watcher thread + in-process property store); window icon posted after commit

Born wearing the tile: newborn stamped natively before Chrome's first show (watcher thread + in-process property store); frame_windows_all + stamp_identity

Tile token hashes tile content (Node v2.0.271 parity): regenerated tiles keep their AUMID, no button rebuild under an open jump list; rolling pup.log file

Annotate this page from the jump list raises the window again (Node v2.0.293 user-caller rule); ralph asserts the raise

Closes verified against the OS window (ab WM_CLOSE fallback), orphan windows swept on connect; tile text width on the rounded plate

• v2.0.441 candidate (rust): Thread tiles through the brand raster pipeline (Lanczos3, IM unsharp, alpha clamp) in Rust on the Adom rounded plate; two lines, no ellipsis; tile generation t9 (John Lauer)
• Publish 2.0.441 (John Lauer)
• v2.0.440 candidate (rust): Windows placed in CSS pixels measured from the page and placed again once settled (Node v1.8.66 and v1.9.342): no overhang on scaled displays, no cascade drift (John Lauer)
• Publish 2.0.440 (John Lauer)
• v2.0.439 candidate (rust): Windows placed in CSS pixels measured from the page (Node v1.8.66), no overhang on scaled displays (John Lauer)
• Publish 2.0.439 (John Lauer)
• Update 3 file(s) (John Lauer)
• v2.0.438 candidate (rust): pup_open_window honours the declared owner (Node ownerSource declared); tile cache generation bumped so every thread tile re-renders with the multi-size renderer (John Lauer)
• Publish 2.0.438 (John Lauer)
• Update 21 file(s) (John Lauer)
• v2.0.437 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (no button during the first paint, then stamp and AddTab), focus handed back when a birth takes it, identity audit is a detector only (John Lauer)
• Publish 2.0.437 (John Lauer)
• v2.0.436 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (no button during the first paint, then stamp and AddTab), identity audit is a detector only (John Lauer)
• Publish 2.0.436 (John Lauer)
• v2.0.435 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (park first, settle, DeleteTab, stamp, AddTab), identity audit is a detector only (John Lauer)
• Publish 2.0.435 (John Lauer)
• v2.0.434 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (on-screen within 50 ms, ITaskbarList DeleteTab, stamp, AddTab), identity audit is a detector only (John Lauer)
• Publish 2.0.434 (John Lauer)
• v2.0.433 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (ITaskbarList DeleteTab, stamp, AddTab; the window is never hidden), identity audit is a detector only (John Lauer)
• Publish 2.0.433 (John Lauer)
• v2.0.432 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (stamped hidden, re-shown off-screen, attention flag cleared, then moved on-screen), identity audit is a detector only (John Lauer)
• Publish 2.0.432 (John Lauer)
• Publish 2.0.431 (John Lauer)
• v2.0.430 candidate (rust): CSP-safe favicon badges, thread tiles rendered natively at every ICO size, one taskbar button born with the thread tile (stamped hidden, re-shown off-screen, then moved on-screen), identity audit is a detector only (John Lauer)
• Publish 2.0.430 (John Lauer)
• v2.0.429 candidate (rust): CSP-safe favicon badges (data: before blob:), thread tiles rendered natively at every ICO size as 32-bit DIBs, one taskbar button born with the thread tile (stamped while hidden, shown once), identity audit is a detector only (John Lauer)
• Publish 2.0.429 (John Lauer)
• v2.0.428 candidate (rust): Overlay badges as Node painted them: 48 px compositor with Node's card rules, globe/PDF fallback instead of the Adom mark, favicon rails and retries on open and navigate, tab-switch and settings repaint triggers, paint signature, dashboard provenance (John Lauer)
• Publish 2.0.428 (John Lauer)
• Fix wiki browser skill YAML so Codex can load its metadata (John Lauer)
• v2.0.427 candidate (rust): Overlay badges as Node painted them: 48 px compositor with Node's card rules, globe/PDF fallback instead of the Adom mark, favicon rails and retries, tab-switch and settings repaint triggers, paint signature, dashboard provenance (John Lauer)
• Publish 2.0.427 (John Lauer)
• Update 12 file(s) (John Lauer)
• v2.0.426 candidate (rust): Z-order doctrine restored from Node: no activation at birth (the 2.0.425 attention clear removed), bottom-unless-foreground at every re-park with birth grace and the user-in-use latch, foreground:true opens honoured (John Lauer)
• Publish 2.0.426 (John Lauer)
• Update 9 file(s) (John Lauer)
• v2.0.425 candidate (rust): Taskbar activity contract restored from Node: taskbarActivity progress|flash|off (dead keys openFlash/autoFlash/agentActivity/fgWatch refused), attention tint cleared after birth, icon-apply and screenshot progress bars, alert = progress pulse, four-count flash only in flash mode (John Lauer)
• Publish 2.0.425 (John Lauer)
• Update 10 file(s) (John Lauer)
• v2.0.424 candidate (rust): Jump-list tasks work again: human callers (jump list, toolbar, dashboard) bypass window ownership as in Node; tools/jumplist-ralph.py fires every task through the real shim path; release profile thin LTO (John Lauer)
• Publish 2.0.424 (John Lauer)
• v2.0.423 candidate (rust): Jump-list tasks and taskbar relaunch call pup's own exe (--jumplist mode) instead of powershell.exe + a .ps1; explicit pup icon on every task; the .ps1 is removed at boot (John Lauer)
• Publish 2.0.423 (John Lauer)
• v2.0.422 candidate (rust): Launch Chrome with --no-startup-window (Node v1.8.51 rule) and close orphan about:blank targets on connect: no more stock Chrome for Testing taskbar buttons beside the thread tile (John Lauer)
• Publish 2.0.422 (John Lauer)
• v2.0.421 candidate (rust): Start Menu anchor row (aumidShortcut) in the dashboard Settings dialog; jump-list row names the measured cause of the first-click flash (ab#155, pup-bridge#101) (John Lauer)
• Publish 2.0.421 (John Lauer)
• Update 2 file(s) (John Lauer)
• Update 11 file(s) (John Lauer)
• v2.0.420 candidate (rust): Runtime data under ADOM_BRIDGE_DATA_DIR (profiles/sessions/screenshots/recordings, legacy dirs moved once) with retention (screenshots 14d/1GB, recordings 30d/3GB); aumidShortcut maps to ab 2.1.49 anchor:true/anchorFolder 'Adom Pup'; demo driver take-2 fixes; pup-bridge#98 #99, ab#155 (John Lauer)
• Publish 2.0.420 (John Lauer)
• Update 5 file(s) (John Lauer)
• plan: vault sync, demo tour, ab#155/#157 state (John Lauer)
• v2.0.419 candidate (rust): The pup demo tour (tools/pup-demo.py + the 8-beat Play-the-demo prompt); consent toasts carry reason/aiThread/delegate for ab->ah forwarding (ab#157); misrouted desktop_record_* answers wrong_bridge (ab#150); pup_login reports credentialSource on the 2FA/captcha path; aumidShortcut setting (ab#155 anchor). (John Lauer)
• Publish 2.0.419 (John Lauer)
• pup demo tour driver (tools/pup-demo.py) + the 8-beat Play-the-demo prompt; consent toast reason/aiThread; aumidShortcut setting; recorder misroute wording (John Lauer)
• v2.0.418 candidate (rust): aumidShortcut setting: opt-in Start Menu shortcut anchor so jump lists stay on the first right-click (ab#155). (John Lauer)
• Publish 2.0.418 (John Lauer)
• v2.0.417 candidate (rust): Fix: pup_vault_sync peer accepts a same-account desktop egress (container-empty), still refuses cloud containers. (John Lauer)
• Publish 2.0.417 (John Lauer)
• v2.0.416 candidate (rust): Fix: pup_vault_sync cross-desktop egress no longer hardcodes the app name (peer ab infers it). (John Lauer)
• Publish 2.0.416 (John Lauer)
• v2.0.415 candidate (rust): Fix: pup_vault_sync consent toast now carries Allow/Deny buttons (2.0.414 rendered none). (John Lauer)
• Publish 2.0.415 (John Lauer)
• credentials skill: the serve-from-the-vault doctrine + pup_vault_sync (never ask the human for a password) (John Lauer)
• v2.0.414 candidate (rust): pup_vault_sync {peer,reason}: bidirectional adom-you credential union across the user's desktops (newest-wins, pup-to-pup, no AI sees a password), one consent toast; internal vault_export/import refused for relay. (John Lauer)
• Publish 2.0.414 (John Lauer)
• 2.0.413: missing verbs + behaviors (assisted_click, import, fg-watch, url lint, notices, chrome-stable, eval frame, move_to_workspace), issue #97 (disable on-device model, reap by age, CONSERVATIVE auto-janitor), goldens 37->56, macOS unsupported in the exe package (John Lauer)
• v2.0.413 candidate (rust): SAFETY: the auto profile-janitor now reaps only leaked iso-* jars + strips the on-device model dir; named durable profiles are deleted only by an explicit pup_reap_profiles call (the 2.0.409-2.0.412 janitor auto-deleted idle named profiles, which was wrong). (John Lauer)
• Publish 2.0.413 (John Lauer)
• v2.0.412 (insiders): Rust exe parity (missing verbs + behaviors, goldens 37->56 all matching) and issue #97 (disable the 4 GB on-device Chrome model download, reap stale profiles by age + strip the model dir, daily janitor). (John Lauer)
• v2.0.412 candidate (rust): Rust exe parity (missing verbs + behaviors, goldens 37->56 all matching) and issue #97 (disable the 4 GB on-device Chrome model download, reap stale profiles by age + strip the model dir, daily janitor). (John Lauer)
• Publish 2.0.412 (John Lauer)
• v2.0.411 candidate (rust): Rust exe parity (missing verbs + behaviors, goldens 37->57) and issue #97 (disable the 4 GB on-device Chrome model download, reap stale profiles by age + strip the model dir, daily janitor); aligned credential_delete/card_set/record_status/screenshot_element/full_res/progress/deps/install_toolbar/annotate output shapes to the Node build. (John Lauer)
• Publish 2.0.411 (John Lauer)
• v2.0.410 candidate (rust): Rust exe parity (pup_assisted_click, import verbs, fg-watch, URL lint, session notices, real-Chrome install, pup_eval frame, move_to_workspace; macOS unsupported; goldens 37->63) AND issue #97: disable the 4 GB on-device Chrome AI model download on every launch, pup_reap_profiles sweeps stale profiles by idle age and strips the model dir, daily profile-janitor. (John Lauer)
• Publish 2.0.410 (John Lauer)
• v2.0.409 candidate (rust): Rust exe parity: pup_assisted_click, pup_import_scan/browser_logins, the fg-watch, URL lint, session notices, real-Chrome install, pup_eval {frame}, move_to_workspace; macOS declared unsupported in the exe package; goldens 37->63. (John Lauer)
• Publish 2.0.409 (John Lauer)
• 2.0.408 on insiders: recovered tabs get their page scripts back; plan status (John Lauer)
• v2.0.408 candidate (rust): pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort, relaunch when Chrome is gone (boot + health loop), recovered tabs get the owner chip, floaty and login capture back; panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP. (John Lauer)
• Publish 2.0.408 (John Lauer)
• 2.0.407: the Rust exe ships to insiders; rust-build/ship candidate flow, parity + ab-smoke gates, plan and docs updated (John Lauer)
• v2.0.407 candidate (rust): pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort, relaunch when Chrome is gone (at boot and from the health loop); panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP. (John Lauer)
• Publish 2.0.407 (John Lauer)
• v2.0.406 candidate (rust): pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort + relaunch when Chrome is gone; panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP. (John Lauer)
• Publish 2.0.406 (John Lauer)
• v2.0.405 candidate (rust): pup as one Rust exe (spawn.kind exe): parity gate green on the loopback and through ab; recovery through the session file's cdpPort + relaunch when Chrome is gone; panic log; bind retry; pup_close everyone:true; screencast diagnostics. (John Lauer)
• Publish 2.0.405 (John Lauer)
• v2.0.404 candidate (rust): pup as one Rust exe (spawn.kind exe): parity gate green on the loopback and through ab; recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone; panics land in ~/.adom/bridge-logs/pup-rust-panic.log; the port bind retries for 10 s; pup_close honours everyone:true. (John Lauer)
• Publish 2.0.404 (John Lauer)
• v2.0.403 candidate (rust): pup as one Rust exe (spawn.kind exe); every success carries success:true + the full JSON output so ab's relay and CLI unwrap it (found by the via-ab parity run); recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone. (John Lauer)
• Publish 2.0.403 (John Lauer)
• v2.0.402 candidate (rust): pup as one Rust exe (spawn.kind exe); recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone (_cleanupReport). (John Lauer)
• Publish 2.0.402 (John Lauer)
• v2.0.401 candidate (rust): pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package; parity gate green; ship.sh gains --shell and --candidate. (John Lauer)
• Publish 2.0.401 (John Lauer)
• rust: Phase 4 parity gate (tools/parity.py) green 37/37 on winvm; Node response envelope ported into dispatch (verb catalog, bug invite, output mirror, render probe), session rows carry lastAgentUpdate/ownerSource/overlay/flash, loop cadences in pup_status, default permissions granted at launch, Hydrogen proxy (John Lauer)
• rust: Phase 3 complete (vault, cards, wiki auto-sign + view flip, annotate, tab + screen recording, highFps lease, download, identity audit, Hydrogen proxy); placeholder crates removed; plan status updated (John Lauer)
• Delete rust/record/src/lib.rs (John Lauer)

Thread tiles through the brand raster pipeline (Lanczos3, IM unsharp, alpha clamp) in Rust on the Adom rounded plate; two lines, no ellipsis; tile generation t9

Windows placed in CSS pixels measured from the page and placed again once settled (Node v1.8.66 and v1.9.342): no overhang on scaled displays, no cascade drift