Pup - Puppeteer Bridge

pup-bridge#119: HTTP auth from the vault on the extension lane (retry keyed per request); no_credential on navigate/fetch; pup_fetch_url on the extension lane; skill note

pup-bridge#119: HTTP Basic/Digest auth answered from the vault on the extension lane (onAuthRequired -> /extauth, registrable-domain match); no vault entry cancels the challenge and navigate/fetch return no_credential with the host; pup_fetch_url runs on the extension lane

landed probes the DOM: a visible Log in link means NOT signed in (chatgpt.com/codex fooled the URL rule); a password or email+continue form means a sign-in page; also on pup_open_tab

open/navigate responses carry landed:{url,title,loginPage,signedIn,_hint} so an AI never asks the user to sign in where the profile already is; login recipes for claude.ai and chatgpt.com

birth hold: busy spin for the first 100 ms after the first show (Chrome re-tops between 1 ms re-bottoms)

birth: bottomed in the same instant Chrome first shows it (native spin) and held 300 ms; the park never re-shows a visible window

birth: park while still invisible (the watcher holds the handle 150 ms before Chrome's first show); normal unfocused birth instead of minimized (no restore surface)

z-watch armed before the extension creates the window (names the window and the last pup action when a newborn reaches the top)

no ab attention-clear on pup's own open/navigate paths (it raised and briefly activated every newborn, z-watch measured 40-80 ms); native FlashWindowEx stop instead; install.sh and package.json say adom-bridge, not adom-desktop

z-watch instrumentation during birth grace, ms log timestamps, last-log; re-show keeps z-position

cold birth: arm the birth watcher after the launch (it expired before the window existed, so the cold window wore the stock CfT icon for 12 s); stamp identity at the token bind as a backstop

default ext lane finally gets --no-startup-window + --keep-alive-for-test (2.0.617 only put them on the stock branch): Chrome's New Tab startup window was on top at every cold start

cold launch: no empty url argument on the default lane either (Chrome opened its cwd as a file listing on top); gate counts by process

ext birth.js (CSP blocked inline token script); cold launch passes no url so --no-startup-window holds (unowned about:blank window sat on top 18 s)

The Rust half of the birth-token binding, which 2.0.630 shipped without: pup binds every newborn by its birth-page title token before anything else, falls back to the set-diff handle only when the token is not found, and navigates every birth from the birth page to its real URL after the window is bound and parked.

Every extension-lane window is born on the extension's own birth page with a unique token as its title, and pup binds the OS window by that title, deterministically, before anything else: the set-diff bound a placeholder Chrome makes at launch and parked that while the real window came up unparked (measured: 4.5 s on top on every cold start). The real URL is navigated to only after the window is bound and parked. The birth re-assert starts at 40 ms.

The birth re-assert runs after every extension-lane birth, dense in the first second (measured: the cold window was pulled back down within seconds while warm windows, which had no re-assert, came up on top and stayed). The post-navigate park uses the idle-hands rule. The fit step sets bounds only and never restores a minimized window: state normal was a raise, and it un-minimized windows the user had put away.

The idle-hands rule applies on the extension lane too: a cold first window is activated by Chrome's own restore (measured: the re-assert answered foreground with no input since birth), so a foreground window inside the birth grace with no input since birth is Chrome's raise and is bottomed; any input means a person and pup stands down. A birth that bound a placeholder and rebinds the live window later now parks that window and re-asserts from there; it used to stamp it and leave it on top.

A cold birth's first window gets the doctrine's bounded re-assert inside the birth grace, at 1, 2.5 and 5 seconds: measured with the fixed bottom call, a warm birth ended behind at z11 while the first window of a fresh browser settled on top after every park. The primitive never touches a foreground window, so a human's click is never undone. The foreground-proof harness clears every thread's windows by name first.

The park raised the window. Measured from a fresh process on the conference-room box: SetWindowPos(HWND_BOTTOM, NOMOVE|NOSIZE|NOACTIVATE) on a pup Chrome window returned true and moved it to the TOP, where it stayed; the same call with SWP_NOOWNERZORDER put it at the bottom and it stayed. Chrome's frame owns helper windows and without that flag Windows re-orders the owner with them. Every 'parked at z-bottom: true' was a raise: the birth flash, the navigate that surfaced the window, the lower that succeeded with the window on top. One flag on every bottom call.