feat(browser): add URL whitelist configuration for browser navigation

[tkwkeven]

Summary

Adds browser.url_whitelist config option to restrict browser navigation to specific domains. When configured, only URLs matching the whitelist patterns are allowed; all other URLs are blocked.

Changes

• Add check_url_whitelist() and _load_url_whitelist() in tools/website_policy.py
• Integrate whitelist check into browser_navigate in tools/browser_tool.py (after existing blocklist check)
• Supports glob patterns like *.toutiao.com, example.com
• Cached with TTL matching existing blocklist cache (30s)
• Fail-open on config errors (consistent with blocklist behavior)

Config Example

browser:
  url_whitelist:
    - "*.toutiao.com"
    - "*.douyin.com"
    - "example.com"

Use Case

Multi-tenant deployments or automation workflows that should only access specific domains. Complements the existing website blocklist (deny specific) with a whitelist (allow only specific).

Testing

Unit tests for whitelist matching. Running in production for 2+ months.

[teknium1]

Thanks for adding an opt-in browser boundary. The allowlist idea is still needed on current main, but the submitted implementation does not yet provide the stated navigation restriction.

Problems

• The new check is pre-navigation only. Current browser_navigate obtains final_url at tools/browser_tool.py:2817-2820; its post-redirect checks at tools/browser_tool.py:2822-2853 cover only SSRF. An allowed URL can therefore redirect to a non-whitelisted host and still return its snapshot.
• browser_back only rechecks private URLs (tools/browser_tool.py:3167-3209), and raw Page.navigate only applies the private-network guard (tools/browser_cdp_tool.py:148-175), leaving sibling navigation paths outside the policy.
• The diff changes only two production files. It does not add the user-facing setting to hermes_cli/config.py or documentation, and it includes no tests despite the PR description.

Suggested changes

• Apply the allowlist to final URLs and sibling navigation paths, blanking the page on a rejected redirect as the existing private-redirect handling does.
• Add defaults, docs, and targeted policy/navigation tests.

Automated hermes-sweeper review.