fix(browser): block Camofox input on private pages

[necoweb3]

Summary

This extends the Camofox private-page guard to input actions (camofox_click, camofox_type, and camofox_press).

Why

Recent browser hardening closed the private/internal-page boundary for the main browser tools and for Camofox read tools such as snapshot, image extraction, and vision. However, Camofox input actions still posted directly to the Camofox backend when the current page was a private/internal URL.

On a non-local Camofox backend, that means an agent could interact with an intranet or cloud-metadata-adjacent page that the terminal itself cannot reach. Even without reading the page back, clicks, typing, and key presses can mutate internal/admin state or submit forms.

Changes

• Reuse the existing _camofox_private_page_block() helper before:
  • camofox_click
  • camofox_type
  • camofox_press
• Keep public-page and guard-inactive behavior unchanged.
• Add regression coverage proving private-page input actions short-circuit before any Camofox POST is sent.

Tests

python -m pytest tests/tools/test_browser_camofox_private_page_guard.py -q --timeout-method=thread
9 passed

python -m ruff check tools/browser_camofox.py tests/tools/test_browser_camofox_private_page_guard.py

[egilewski]

looks mergeable

Security evidence:

• trust boundary: Camofox mode returns from browser_click, browser_type, and browser_press into the dedicated Camofox backend path before the general browser private-page action guard can run.
• source/sink/invariant: the source is the current Camofox tab URL resolving to a private/internal address while the SSRF guard is active; the sinks are Camofox /click, /type, and /press POSTs; the invariant is that those input actions must not reach the backend for a private current page unless the guard is inactive by configuration/local sidecar policy.
• current-main reproduction: on current main, a direct probe imported the current-main tools/browser_camofox.py and showed camofox_click, camofox_type, and camofox_press all returned success and sent backend POSTs while the current page probe returned http://169.254.169.254/latest/meta-data/.
• PR-head or patch-replay validation: on the PR head, the same probe imported the PR tools/browser_camofox.py; all three actions returned private-page blocked errors and the mocked backend saw zero POST calls.
• positive/negative cases: the new regression test covers private-page click/type/press short-circuiting, verifies the blocked type response does not echo the typed text, and preserves the public-page click path; the existing sibling private-page action, eval, console, image, Camofox auth, and Camofox unit tests still pass.
• residual bypass search: I checked the Camofox dispatch ordering and backend POST surfaces; this closes the claimed element/key input gap for click/type/press, while the existing read guards remain in place for snapshot, image extraction, and vision.
• reviewer validation: CodeRabbit completed with no findings in the clean-pass flow.

The patch is focused, merges cleanly into current main, and keeps public-page plus guard-inactive behavior unchanged while closing the private-page Camofox input path.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Merged via PR #57660 — your commit was cherry-picked onto current main with your authorship preserved in git log (rebase-merge). Thanks for the fix!