fix(browser): extend private-network guard to browser_console

[necoweb3]

Summary

This extends the browser private-network SSRF guard to browser_console() when it is used in console-output mode.

Why

Recent SSRF fixes sealed browser_snapshot, browser_vision, _browser_eval, and browser_get_images against eval-navigated private pages. However, browser_console() has two modes:

• browser_console(expression=...) evaluates JavaScript and already routes through _browser_eval.
• browser_console() without expression fetches console logs and uncaught exceptions directly.

The second path did not re-check the current page URL before returning console/error output. After an eval-driven navigation to a private/internal URL, this could expose console messages or exception details from the internal page.

Changes

• Add the same _eval_ssrf_guard_active() + _current_page_private_url() check to browser_console() console-output mode.
• Return a blocked error payload when the current page is private/internal.
• Add regression coverage for private-page blocking, public-page allow, local-backend bypass, and allow_private_urls bypass.

Tests

python -m pytest tests/tools/test_browser_console_ssrf.py -q --timeout-method=thread
5 passed

python -m pytest tests/tools/test_browser_get_images_ssrf.py tests/tools/test_browser_eval_ssrf.py tests/tools/test_browser_snapshot_ssrf.py -q --timeout-method=thread
34 passed

[egilewski]

looks mergeable

I found no source-level blocker in the browser private-network guard change. The patch closes the browser_console console-output gap by checking the current page URL before returning console messages or uncaught exceptions, and current-main reproduction, PR-head and patch-replay probes, focused browser SSRF tests, sibling guard inspection, merge-tree/whitespace checks, the required GitHub aggregate check, and reviewer-tooling output left no source-backed blocker.

The sensitive boundary is untrusted page console output and exception details after browser eval navigation to a private/internal URL; browser_console() now applies the same non-local private-network guard before reading those buffers, while public-page, local-sidecar, and configured private-URL opt-out behavior remain preserved.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Merged via PR #56373. Your commit was cherry-picked onto current main with your authorship preserved in git log (a4af257). Thanks for sealing the last read path the SSRF sweep missed!