Guard private browser navigation targets

[NotASithLord]

Summary

• Block private, loopback, local-network, cloud-metadata, and denylisted browser targets before navigation and after committed redirects.
• Keep browser network rules scoped to the exact agent-controlled tab or child. Ordinary user tabs are unchanged.
• Add a synchronous Firefox guard for private, denylisted, HTTP, and WebSocket requests from exact actor-created children.
• Pin DOM work to the exact browser document on Chrome and current Firefox.
• Remove full target URLs from model receipts, capture metadata, view metadata, and init memory.
• Bound an unfixed build-time image parser issue with CI timeouts and an expiring scanner exception.

Security model

The guard combines target classification, exact live-document probes, committed navigation checks, durable tab custody, and tab-scoped browser network rules. Popup handling is bound to the browser-identified source and child tab.

Firefox adds a temporary blocking listener for the exact child while custody and durable rules settle. The listener blocks private, denylisted, HTTP, and WebSocket requests. If denylist policy has not loaded, open-web requests and init pause instead of treating an empty policy as permission.

Chrome and Firefox can block a request through durable browser rules before the temporary Firefox listener observes it. In that case the block is intentionally silent. When the temporary listener does observe the block, the source actor receives a fixed URL-free receipt.

The remaining documented limits are DNS rebinding after lexical classification, service-worker suspension before an observer can run, and browser behavior outside the exact tabs peerd controls.

UX review

• Human UX: protected pages are omitted from model context, protected tabs explain what is restricted, and Activity records the outcome without the target URL.
• Model UX: policy results are host-authored, normalized, URL-free, and non-retryable. Protected page content never enters the model transcript.
• Accessibility: downgrade and recovery states use explicit labels and polite status announcements. Narrow Firefox layouts keep authority controls visible and keyboard reachable.

Validation

• bun run preflight: 5,385 tests passed
• bun run e2e:verify: 54 states and 233 checks passed
• current Firefox packaged smoke and Gecko suite passed
• red-team report: 172 of 172 hostile probes held
• security, correctness, Firefox, human UX, model UX, documentation, and integration adversarial reviews completed
• copy and attribution hygiene passed

Closes #331
Closes #276

[github-actions]

Visual regression

✅ No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 46 baseline screens (light + dark) as of this commit.