Pup - the AI's own browser

A pup holding a lane token whose browser is gone now adopts the live token-less one instead of refusing every poll until a restart (measured on a test PC: 20 minutes of dead lane). Every no-password answer names ab's credential reader, with its real limit: a browser never saves the password of the account it is itself signed in as.

Google sign-in survives the 60s command cap: it runs in the background and re-attaches when called again, instead of reporting a timeout while pup is mid-sign-in (same fix as the password import). Includes the merged mac window fix (PR #2, NSRunningApplication, no System Events prompt) and the pup-bridge#118 embedded-file push fix so a fresh checkout builds.

Google sign-in as the right account: pup_google_accounts searches every browser profile, nb's profiles, the vault and pup's own signed-in sessions; pup_google_signin fills the email and that account's saved password, hands back the verification step with the exact next call, and never guesses between accounts. The vault keeps one login per site and username. pup_login no longer reports success when it filled nothing. The browser-login import runs in the background and re-attaches instead of timing out while the user approves it.

Google sign-in as the right account: pup_google_accounts searches every browser profile, nb's profiles, the vault and pup's own signed-in sessions; pup_google_signin fills the email and that account's saved password, hands back the verification step with the exact next call, and never guesses between accounts. The vault keeps one login per site AND username (a second Google account no longer overwrites the first). pup_login no longer reports success when it filled nothing.

The user's close is final: a pup window closed by hand is forgotten at once and never restored; restore only on a proven browser crash (nonzero exit code) or a pup restart. The orphan about:blank sweep no longer closes a lane's last window or a window being born (it killed a cold lane and triggered a 7-window restore on 2026-09-15). rust/ ships with every release (pup-bridge#117).

skillpack install script deploys pup-lanes (it was in the tarball but not in the install list, so every container kept the pre-parity lane text; pup-bridge#116).

skills: the main pup skill's capability paragraph and the screenshots-and-recording skill now describe the extension lane as it is (input parity, pup_select, CSP and Trusted Types eval fallback, recording through ab's native recorder); the old 'no trusted input, not in the session model' text and the three-recorder table were from the era when the lane was a fallback verb and sent the Work thread to file pup-bridge#116.

pup_select {selector, value|label}: choose a option in the background on both lanes (DevTools evaluate, CSP and Trusted Types cannot refuse it); pup_eval on the extension lane falls back to DevTools for Trusted Types refusals too (Google Calendar, Admin). Closes pup-bridge#116.

pup_eval on the extension lane falls back to DevTools for Trusted Types refusals too (Google Calendar, Admin); the fallback matched only the CSP wording (pup-bridge#116).

extension worker: the packaged port.json read had no deadline and hung on every fresh worker instance after a reload in place (hellos continued, /extcmd never hit; measured on winvm), which is the 'worker stalls after a cold launch or update' bug. Now a 2 s deadline with the last good lane and port remembered in extension storage, and every poll step bounded. Plus 2.0.589: per-command deadlines, an unsticking drain guard, the hello on its own alarm, and the birth grace that demotes only a no-input-since-birth self-raise on the CDP lane.

worker watchdog: every extension command races a deadline (a hung Chrome API answers as a named error instead of freezing the lane; measured: fit after a cold launch, debugger capture), the drain guard cannot stick, and the hello has its own alarm so pup can always tell a quiet worker from a dead one. Birth grace: pup may demote a newborn only when nobody has touched the machine since it was born, CDP lane only; any input, a 200 ms taskbar click included, is a person for the full 10 minutes.

the user's foreground window is the user's, always: the demotion primitive no longer expires a raised window after 5 s of idle reading (only a NEWBORN self-raised with idle hands inside the birth grace is demoted); the silent-lane restore checks ground truth first and never relaunches a session whose window is alive on glass (it relaunched a window John was looking at); a relaunch refuses a file whose window is alive; the attention-clear workaround re-checks foreground after the clear.

close: the lane's close result is checked, an unbound extension session resolves its handle before the OS close, and a window that survives both keeps its session and is reported (close_failed) instead of being left ownerless on the user's glass (eight orphans after a worker reload, 2026-09-15).

extension lane: a cold open blocks until the lane is up and relaunches once if the first browser never calls home, returning a real window or a real error instead of starting:true with no session (the caller's next verb hit session_not_found; parity's pup_open_tab, and other threads' trouble opening pup).

z-order: ab's desktop_clear_window_attention raises the window to z1 (adom-bridge#199), undoing every park at open and after navigation; pup re-bottoms after any attention clear unless the window is the user's foreground. Plus 2.0.584: input beats the birth grace, extension windows park at birth, inset frame.

foreground doctrine: the birth grace may override session flags, never input (a human taskbar click inside the first 8 s was undone by the +2.5 s re-assert); extension-lane windows park to z-bottom once at birth (they landed at z1, right under the active window) with no re-assert, since Chrome never self-activates an unfocused-created window; the lane's fit uses the standard 10 px inset frame.

overlay badges: SVG favicons rasterize (resvg, pure Rust); the wiki serves only an SVG icon and every wiki window wore the generic globe since the compositor moved into the binary in 2.0.568. The favicon guard now rejects HTML only. Lane status counts live windows correctly when no lane pids are known (an empty pid list meant no filter and counted the user's own browsers).

recording via ab: frames, bytes and duration ride at the top level of pup_record_stop (the CLI drops a non-string output; ab-smoke reads frames there); start carries width/height/fps at the top level too.

recording rides ab's native recorder: pup_record_start/stop/status/list delegate to desktop_record_window_* keyed on the window's hwnd (Windows Graphics Capture, hardware H.264 MP4; a covered window records live; measured 2542x1520, 2.1 MB per 20 s). Works on the extension lane. The CDP screencast remains only as a fallback where ab's recorder is absent.

recovery: a lane whose worker goes silent (3 min with no lane window on glass, or 10 min regardless) is declared dead and every extension session is restored from its file, tabs included (a dead lane sat listed as 1 window for 14 h); a relaunch whose open answers starting:true waits for the worker and opens again instead of dropping the session; the another-caller guard compares Chrome window ids and treats a missing session as a failed relaunch; a token-less extension browser after a restart is adopted (token minted into port.json, pids learned from CfT frames); status reports live lane windows.