fix(browser): guard Camofox eval private pages (salvage #56764)

[hashbender]

Summary

Camofox eval can no longer read private/internal pages via browser_console(expression=...) — it now goes through the same SSRF guard the other browser backends already enforce.

Root cause: _browser_eval() returned _camofox_eval(...) at the very top, before the private-network guard block, so Camofox mode skipped both the private-URL literal pre-scan (fetch('http://127.0.0.1/secret')) and the post-eval page-URL recheck (navigate-then-read the DOM). This closes the eval sibling of the browser hardening in NousResearch#56173, NousResearch#56526, NousResearch#56664.

Salvage of NousResearch#56764 by @rayjun (rayoo) — cherry-picked to preserve authorship, with small maintainer follow-ups folded in (see Follow-ups).

Changes

• tools/browser_tool.py:
  • Move the eval private-URL literal pre-scan above the Camofox early return so it runs for both backends.
  • Add _camofox_current_page_private_url() — a Camofox analogue of _current_page_private_url() that probes window.location.href via the /evaluate endpoint.
  • In _camofox_eval(), after eval, withhold the result when the page is now private/internal (same _eval_ssrf_guard_active gating and error envelope as the non-Camofox path).
• tests/tools/test_browser_eval_ssrf.py: TestCamofoxEvalGuard — regression coverage for (a) private-URL literal blocked before any Camofox request fires, and (b) private current-page blocked without leaking the eval result.

Follow-ups (maintainer, on top of the salvage)

• Pass the raw task_id into _camofox_eval (not the _last_session_key-resolved key) so it matches every other Camofox tool — Camofox keeps its own raw-task_id-keyed session map; the resolved agent-browser key could mint a foreign tab after a mid-process backend switch.
• Fix the reorder-orphaned guard comment + the stale /eval → /evaluate docstring; add the fail-open rationale to the new probe's docstring to keep parity with the sibling.

Validation

	Before	After
Camofox fetch('http://127.0.0.1/…') via eval	executed, result returned	blocked before request
Camofox navigate-then-read private DOM	result returned	result withheld, page-URL recheck fires
Targeted SSRF/guard suite (4 files)	—	65 passed
Mutation check (both new guards neutered)	—	both new tests fail as expected
ruff	—	clean

Trust model: the guard is only active for non-local backends (_eval_ssrf_guard_active), unchanged for local/sidecar/allow_private_urls sessions. Soundness is at parity with the non-Camofox guard it mirrors (same navigate-then-read TOCTOU characteristics; the literal pre-scan covers the primary direct-fetch vector).

Closes NousResearch#56764.

---

Mirror-of: NousResearch#56874
NousResearch#56874