+ lHj(" aR4t#0tRt^RIt^RIHt^RIHt^RIHt ^RI H t ^RI H tRRltR R lt]P"!R ]P$4tR R ltRRlt]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$4R3]P"!R]P$]P,,4R3]P"!R ]P$]P,,4R33 t]^k]P"!R!]P,4tR5t]^kR"R#ltR$R%ltR&R'ltR(R)ltR*R+ltR,R-ltR.R/lt R0R1lt!R2R3lt"R#)6ubrowser_console(expression=...) policy: SSRF guard gating, private-URL probes, and the opt-in sensitive-primitive denylist. Facade-owned state is read through ``_bt`` (``tools.browser_tool``, resolved per call) — no import cycle. N)Optionalis_truthy_value) origin_module)browser_tool_cloud)browser_tool_sessionc0V^8dQhR\R\/#effective_task_idreturnstrbool)formats"C/home/ubuntu/.hermes/hermes-agent/tools/browser_tool_eval_policy.py __annotate__rsDDsDtDc\4p\P!4'*;'d9VPV4'*;'d\P!4'*#)agReturn True when eval-driven private-network access must be guarded. Same gating as ``browser_navigate`` / ``browser_snapshot`` / ``browser_vision``: the SSRF guard only matters for non-local backends (cloud browser, or a containerized terminal whose browser-on-host reaches networks the terminal can't); skipped for local sidecars / ``allow_private_urls``. )_origin_cloud_is_local_backend_is_local_sidecar_key_allow_private_urls)r _bts& r_eval_ssrf_guard_activersh )C'') ) D D#2K2KL]2^.^ D DgmhBhBhDdDDrc0V^8dQhR\R\/#)r urlr r )rs"rrrsHH3H4Hrc`VPV4;'gVPV4'*#)zWTrue when ``url`` hits the always-blocked cloud-metadata floor or fails the SSRF guard.)_is_always_blocked_url _is_safe_url)rrs&&r _url_blockedr!s)  % %c * G G#2B2B32G.GGrzhttps?://[^\s'"`)\]<>]+cFV^8dQhR\R\\,/#r expressionr rr)rs"rrr%s"``` `rca\4o\V\4'd\P V4M.p\ V3RlRV44R4#)zkReturn the first private/always-blocked ``http(s)://`` literal in a JS expression (best-effort), else None.c3P<"TFp\SV4'gKVxK R#5iN)r!).0crs& r 2_expression_targets_private_url..)s X?q>) $ $$..4882FLLNTTUXY__`cdK|C==""  N GMM NsBB*B** C5CCz\bdocument\s*\.\s*cookie\bdocument.cookiez#\b(?:localStorage|sessionStorage)\b web storagez \bindexedDB\b IndexedDBz%\bcaches\s*\.\s*(?:open|match|keys)\b Cache Storagez<\bnavigator\s*\.\s*(?:clipboard|credentials|serviceWorker)\bnavigator sensitive APIz5\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(network requestz"\bnavigator\s*\.\s*sendBeacon\s*\(network beaconz$\bdocument\s*\.\s*forms\b.*\bvalue\bzform value extractionzN\bquerySelector(?:All)?\s*\([^)]*(?:input|textarea|password)[^)]*\).*\bvalue\bz8'(?:\\.|[^'\\])*'|\"(?:\\.|[^\"\\])*\"|`(?:\\.|[^`\\])*`c0V^8dQhR\R\/#)r keyr r )rs"rrrVsssCsDsrcH\4pVPVRRRV R24#)zRRead boolean ``browser.`` (default False) through the origin's config reader.Fc\VRR7#)F)defaultr)vs&r$_browser_eval_flag..Ys /!U2Srzbrowser.z from config)r _browser_cfg)rVrs& r_browser_eval_flagr^Vs. )C   C(SW_`c_ddpUq rrrc$V^8dQhR\/#r r r)rs"rrr\s777rc\R4#)z`Whether sensitive browser JS evaluation is explicitly allowed (overrides ``restrict_evaluate``).allow_unsafe_evaluater^rr_allow_unsafe_browser_evaluaterf\s 5 66rc$V^8dQhR\/#r`ra)rs"rrras33D3rc\R4#)aWhether the sensitive-primitive eval denylist is enabled (off by default). It blocks the *names* of common primitives (``fetch``, ``cookie``, ``querySelector(...input...)``), not actual exfiltration, so it also blocks much legitimate DOM extraction; egress is still gated by the SSRF/private-URL guards in ``_browser_eval`` regardless. Opt in via ``browser.restrict_evaluate: true`` (e.g. hostile pages with a logged-in profile). restrict_evaluaterdrerr_restrict_browser_evaluaterjas 1 22rc0V^8dQhR\R\/#)r literalr )r)rs"rrrlsssrc\V4^8dV#\V^RR4PR4# \d T^Ru#i;i)zbBest-effort decode of a JS string literal (not a parser): normalizes escapes like ``"co\x6fkie"``.zutf-8unicode_escape)lenbytesdecoderG)rls&r_decode_js_string_literalrslsR 7|aWQr]G,334DEE q}s2AAcFV^8dQhR\R\\,/#r#)rlist)rs"rrrvs"ooCoDIorc\PV4Uu.uFp\VP^44NK up#uupi))_JS_STRING_LITERAL_REfinditerrsgroup)r$matchs& r_decoded_js_string_literalsr|vs6CXCaCablCm nCm% %ekk!n 5Cm nn ns#>cFV^8dQhR\R\\,/#r#r%)rs"rrrzs"zzSzXc]zrcaaRP\S44P4o\VV3Rl\4R4#)zRisk reason for direct or quoted sensitive primitives: direct spellings alone miss ``document["cookie"]`` / ``globalThis["fetch"]``, so tokens are also matched inside the decoded, concatenated string literals (catches ``document["coo" + "kie"]``).r@c3<"TFdwr\P!R\P!V4 R2S\P4'gVP 4S9gK`VxKf R#5i)z\bN)researchescape IGNORECASElower)r)tokenreasonr$r4s& rr+7_sensitive_browser_eval_token_reason..sYs-KMEIIBIIe$4#5R8*bmmTTX]XcXcXeiqXq-Ks AA/% A/N)joinr|rr3_SENSITIVE_BROWSER_EVAL_TOKENS)r$r4sf@r$_sensitive_browser_eval_token_reasonrzsCww2:>?EEGH s-Kstx zzrcFV^8dQhR\R\\,/#r#r%)rs"rrrs"CC3C8C=CrcvaS'gR#\V3Rl\4R4pT;'g \S4#)zHReturn a human-readable reason if a JS expression uses risky primitives.Nc3^<"TF"wrVPS4'gKVxK$ R#5ir()r)r)patternrr$s& rr+-_risky_browser_eval_reason..s#i.J?7gnn]gNh.Js- -)r3_RISKY_BROWSER_EVAL_PATTERNSr)r$hitsf r_risky_browser_eval_reasonrs1  i.Jiko pC  B B6zBBrcFV^8dQhR\R\\,/#r#r%)rs"rrrs" a aS aXc] arc|\4'd\4'dR#\V4pV'gR#RV R2#)zBlock sensitive browser JS evaluation when the opt-in denylist is on (opt-in because it gates on primitive *names*; private-address egress is enforced separately in ``_browser_eval``).Nz^Blocked: browser_console(expression=...) tried to use sensitive browser JavaScript primitive (z) while browser.restrict_evaluate is enabled. Use browser_snapshot/browser_get_images/browser_console without expression for normal inspection, or set browser.restrict_evaluate: false in config.yaml to allow programmatic evaluation.)rjrfr)r$rs& r_enforce_browser_eval_policyrsE & ' '+I+K+K ' 3F  %%+H-` `arcRV^8dQhR\R\R\\,/#)r tab_iduser_idr r%)rs"rrrs%  c C HSM rc\4p^RIHpV!RV R2RRRV/R7p\\ V\ 4'dVP R4M T;'gR 4pVP4PR 4PR 4pV'd\W%4'dV#R # \d(pTPPR T4R p?R #R p?ii;i)uCamofox analogue of ``_current_page_private_url`` (evaluate endpoint instead of the CLI). Fail-open on probe failure, matching the snapshot/vision guards — do not make fail-closed without the sibling.)_postz/tabs/z /evaluater$r9userId)bodyr?r@rArBz4_camofox_current_page_private_url: probe failed (%s)N) rtools.browser_camofoxrrr0dictrErFr!rGrHrI)rrrrr>rKrLs&& r!_camofox_current_page_private_urlrs )CV/vfXY/|E[]egn6op 40F0F$((8,DJJTVW !'')//4::3? <99   V OQTUU Vs$A B+$?$DE uR  eCHos&: ; Sr) )cookierN) localStoragerO)sessionStoragerO) indexedDBrP)cachesrQ) clipboardrR) credentialsrR) serviceWorkerrR)fetchrS)XMLHttpRequestrS) WebSocketrS) EventSourcerS) sendBeaconrT)$r__doc__rtypingrutilsrtools.browser_tool_originrrtoolsrrrrCrr!compilerr1r5rMDOTALLrrxrr^rfrjrsr|rrrrr)rs@rrs  !>.2DHZZ > N`  ZZ-r}}=?PQZZ6 F VZZ "--0+>ZZ8"--H/ZZZOQSQ^Q^_az{ZZH"--XZklZZ5r}}EGWXZZ79RSUlmZZacecpcpsus|s|c|}@WX I  #bdfdmdmn ? s 7 3ozC a r