Pup - the AI's own browser

aumidShortcut setting: opt-in Start Menu shortcut anchor so jump lists stay on the first right-click (ab#155).

Fix: pup_vault_sync peer accepts a same-account desktop egress (container-empty), still refuses cloud containers.

Fix: pup_vault_sync cross-desktop egress no longer hardcodes the app name (peer ab infers it).

Fix: pup_vault_sync consent toast now carries Allow/Deny buttons (2.0.414 rendered none).

pup_vault_sync {peer,reason}: bidirectional adom-you credential union across the user's desktops (newest-wins, pup-to-pup, no AI sees a password), one consent toast; internal vault_export/import refused for relay.

SAFETY: the auto profile-janitor now reaps only leaked iso-* jars + strips the on-device model dir; named durable profiles are deleted only by an explicit pup_reap_profiles call (the 2.0.409-2.0.412 janitor auto-deleted idle named profiles, which was wrong).

Rust exe parity (missing verbs + behaviors, goldens 37->56 all matching) and issue #97 (disable the 4 GB on-device Chrome model download, reap stale profiles by age + strip the model dir, daily janitor).

Rust exe parity (missing verbs + behaviors, goldens 37->57) and issue #97 (disable the 4 GB on-device Chrome model download, reap stale profiles by age + strip the model dir, daily janitor); aligned credential_delete/card_set/record_status/screenshot_element/full_res/progress/deps/install_toolbar/annotate output shapes to the Node build.

Rust exe parity (pup_assisted_click, import verbs, fg-watch, URL lint, session notices, real-Chrome install, pup_eval frame, move_to_workspace; macOS unsupported; goldens 37->63) AND issue #97: disable the 4 GB on-device Chrome AI model download on every launch, pup_reap_profiles sweeps stale profiles by idle age and strips the model dir, daily profile-janitor.

Rust exe parity: pup_assisted_click, pup_import_scan/browser_logins, the fg-watch, URL lint, session notices, real-Chrome install, pup_eval {frame}, move_to_workspace; macOS declared unsupported in the exe package; goldens 37->63.

pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort, relaunch when Chrome is gone (boot + health loop), recovered tabs get the owner chip, floaty and login capture back; panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP.

pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort, relaunch when Chrome is gone (at boot and from the health loop); panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP.

pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package. Parity gate green on the loopback and through ab; recovery through the session file's cdpPort + relaunch when Chrome is gone; panic log; port bind retry; pup_close everyone:true; render_html hint on origin CSP.

pup as one Rust exe (spawn.kind exe): parity gate green on the loopback and through ab; recovery through the session file's cdpPort + relaunch when Chrome is gone; panic log; bind retry; pup_close everyone:true; screencast diagnostics.

pup as one Rust exe (spawn.kind exe): parity gate green on the loopback and through ab; recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone; panics land in ~/.adom/bridge-logs/pup-rust-panic.log; the port bind retries for 10 s; pup_close honours everyone:true.

pup as one Rust exe (spawn.kind exe); every success carries success:true + the full JSON output so ab's relay and CLI unwrap it (found by the via-ab parity run); recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone.

pup as one Rust exe (spawn.kind exe); recovery re-attaches through the session file's cdpPort and relaunches windows whose Chrome is gone (_cleanupReport).

pup as one Rust exe (spawn.kind exe): the Node runtime leaves the package; parity gate green; ship.sh gains --shell and --candidate.

• plan: Phase 2 status (48 verbs native, recovery, identity, dashboard measured on winvm); dashboard favicon fallback (John Lauer)
• rust: dashboard page + SSE snapshot + image/action routes, /api/status, /identity, embedded MV3 toolbar extensions with --load-extension and pinned prefs, pup_dashboard verb (John Lauer)
• rust: taskbar identity through ab (tiles rendered by the browser, AUMID register+stamp, jump list, favicon overlay), reconnect learns the browser pid, close waits for Chrome to exit (John Lauer)
• rust: Phase 2 part 1 (tabs, input, dialogs, viewport, history, fetch, render_html, maximize; event pump; recovery + health loop; raise/lower/alert/progress; configure/use/quit_idle/rescan); measured on winvm incl. kill+restart recovery (John Lauer)
• docs/contract: golden fixtures recorded from the Node build 2.0.399 for the Rust port (John Lauer)
• rust: Phase 0 (contract fixtures, ab asks, workspace) + Phase 1 skeleton (core, host, host-win, host-mac stubs, cdp, browser, session, verbs, dashboard, bridge); measured on winvm: CfT up in 769ms, background window in 1.75s, eval/navigate/screenshot/close in the Node shapes (John Lauer)
• docs: first-run contract in the Rust plan (arav-rog findings), changelog 2.0.397-2.0.399, ship.sh publishes pkg before release (John Lauer)
• v2.0.399 (insiders): pup-bridge#94: canonical pup_screen_record_*/pup_recorder_* names for the Chrome screen-share recorder (desktop_* names stay as aliases until ab-core serves them natively, adom-bridge#143), recorder responses carry the naming/ownership hint. ship.sh publishes the skills pkg before creating the release (a release-born version row never gets the tarball, adom/wiki#188). Archive size shown when the download is reused. (John Lauer)
• Publish 2.0.399 (John Lauer)
• v2.0.398 (insiders): Chrome for Testing unpack could hang forever in puppeteer's in-process extract-zip (arav-rog: 3 files then silence for 7 min, the origin of the half-populated folders). pup now downloads only and unpacks in a supervised child process (OS tar first, extract-zip worker fallback) with a stall watchdog, verifies the exe, renames the .partial folder into place atomically; readiness shows a real unpack phase. (John Lauer)