v0.1.1

prism-ai-browser 0.1.1 — security fix

No breaking changes.

SECURITY: BrowserPolicy promises to refuse a private address even when the
host is allow-listed. This port judged addresses by is_private, is_loopback
and is_link_local, which admitted 100.100.100.200 (Alibaba Cloud's metadata
endpoint, in CGNAT), multicast, the NAT64 spellings of 169.254.169.254 and
IPv4-compatible loopback, and did not see shorthand IPv4 a browser resolves
to loopback (127.1, 0x7f000001, 2130706433, 0177.0.0.1) as an address at
all. If you allow-list IP literals, upgrade.

• The check is now the explicit list core's guarded media fetch uses,
  identical in every language.
• NAT64 and 6to4 addresses are judged by the IPv4 address they embed. A
  public 6to4 address, which 0.1.0 refused, now navigates.
• Shorthand IPv4 is read with inet_aton, as libc does, without DNS.

v0.1.0

v0.1.0 - First release on PyPI

A policy-bounded browser surface for agents, for Python. The Python port of particle-academy/prism-browser. The distribution is prism-ai-browser; the package imports as prism_browser.

pip install prism-ai-browser

What it has

• BrowserPolicy checks every navigation and action before the engine receives it:
  • hosts are an allow-list, and *.example.org matches subdomains, not the apex;
  • HTTPS is required and only port 443 is allowed, by default;
  • URLs with credentials are refused;
  • private, loopback and link-local addresses are refused by default, including localhost and 169.254.169.254;
  • actions are an allow-list of click, fill, select, press, scroll and hover.
• ObservationGuard refuses an observation over the size budget (65,536 bytes by default) rather than truncating it, and wraps page content in a tag with a random id so the page cannot close it.
• GuardedBrowser wraps any BrowserEngine so every navigation and action goes through the policy and every observation through the guard.
• Every refusal is a BrowserRefused with a stable code.
• No runtime dependencies. Python 3.10 or later. The package does not drive a browser; you bring the engine.

Limits

The policy checks the URL as written. It does not resolve DNS, and it does not see redirects or anything the page loads. The engine must enforce those. The observation wrapper makes prompt injection harder, not impossible.

prism-parity's browser-url-policy corpus pins the URL policy against the PHP reference and the TypeScript port.