fix(browser): guard Camofox eval private pages

[rayjun]

What does this PR do?

Extends the browser private-network eval guard to the Camofox backend.

Recent browser hardening closed the eval/private-page leak for the normal browser paths, but _browser_eval() returned early in Camofox mode before running the shared private URL literal pre-scan and before re-checking the current page URL after eval. That left Camofox as a sibling backend that could still execute browser_console(expression=...) against private/internal targets.

This PR routes Camofox eval through the same guard shape:

• block private/internal URL literals before sending an eval request to Camofox
• after Camofox eval, re-check window.location.href
• withhold the eval result if the page is now private/internal

Related Issue

Follow-up to the browser private-network hardening in #56173, #56526, and #56664.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• tools/browser_tool.py
  • move the eval private URL literal pre-scan before the Camofox early return
  • add a Camofox-specific current-page private URL probe using the Camofox evaluate endpoint
  • block Camofox eval responses when the page is private/internal after eval
• tests/tools/test_browser_eval_ssrf.py
  • add regression coverage for Camofox private URL literal blocking
  • add regression coverage for Camofox private current-page blocking without leaking eval results

How to Test

1. Reproduce the bug on the old code:
   • python -m pytest tests/tools/test_browser_eval_ssrf.py::TestCamofoxEvalGuard -q
   • both new tests fail because Camofox eval bypasses the private-network guard
2. Verify the targeted fix:
   • python -m pytest tests/tools/test_browser_eval_ssrf.py::TestCamofoxEvalGuard tests/tools/test_browser_eval_ssrf.py::TestExpressionPreScan tests/tools/test_browser_eval_ssrf.py::TestPostEvalPageRecheck -q
3. Verify related browser guard coverage:
   • python -m pytest tests/tools/test_browser_eval_ssrf.py tests/tools/test_browser_snapshot_ssrf.py tests/tools/test_browser_private_page_action_guard.py tests/tools/test_browser_cdp_tool.py -q

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu 24.04

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

python -m pytest tests/tools/test_browser_eval_ssrf.py::TestCamofoxEvalGuard tests/tools/test_browser_eval_ssrf.py::TestExpressionPreScan tests/tools/test_browser_eval_ssrf.py::TestPostEvalPageRecheck -q
...........                                                              [100%]
11 passed in 0.45s

python -m pytest tests/tools/test_browser_eval_ssrf.py tests/tools/test_browser_snapshot_ssrf.py tests/tools/test_browser_private_page_action_guard.py tests/tools/test_browser_cdp_tool.py -q
.................................................................        [100%]
65 passed in 10.14s

python -m ruff check tools/browser_tool.py tests/tools/test_browser_eval_ssrf.py
All checks passed!

[kshitijk4poor]

Merged via #56874 — your commit was cherry-picked with authorship preserved (it lands on main as commit 6a58bad, authored by you).

Thanks for catching that Camofox eval skipped the private-network guard. The salvage keeps your fix intact and folds in a few maintainer follow-ups on top:

• Pass the raw task_id into _camofox_eval (not the _last_session_key-resolved agent-browser key) so eval targets the correct Camofox tab and the pre-scan can't be skipped via a mismatched session key.
• Rewrote the reorder-orphaned guard comment and fixed the stale /eval → /evaluate docstring; added the fail-open rationale to the new probe's docstring for parity with the sibling guard.
• Added a regression test locking in the raw-task_id behavior.

#56874