@mono-agent/agent-runtime 0.20.14 → 0.21.1

package/src/agent/tools/web-browser-render.js

@@ -7,11 +7,37 @@ import { passthroughSandbox } from "../sandbox-seam.js";
 import { runPreparedProcess } from "./shared/process-runner.js";
 import { readToolRuntime } from "./shared/runtime-context.js";
 import { resolveSandboxPolicy } from "./shared/tool-context.js";
+import { assertNoWebAccessInterstitial } from "./web-access-interstitial.js";
 
 const BROWSER_TIMEOUT_MS = 20_000;
 const BROWSER_CLOSE_TIMEOUT_MS = 5_000;
 const BROWSER_OUTPUT_BYTES = 2 * 1024 * 1024;
 const MAX_BROWSER_NAMESPACE_CHARS = 16;
+const BROWSER_HOST_ENV_KEYS = [
+  "COMSPEC", "HOME", "LANG", "LC_ALL", "LC_CTYPE", "LOGNAME", "PATH", "PATHEXT",
+  "SHELL", "SystemRoot", "TEMP", "TMP", "TMPDIR", "USER", "WINDIR",
+];
+const BLOCKED_BROWSER_ENV_KEYS = [
+  "ALL_PROXY", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY",
+  "all_proxy", "http_proxy", "https_proxy", "no_proxy",
+  "AGENT_BROWSER_ACTION_POLICY", "AGENT_BROWSER_ALLOWED_DOMAINS", "AGENT_BROWSER_ALLOW_FILE_ACCESS",
+  "AGENT_BROWSER_ANNOTATE", "AGENT_BROWSER_ARGS", "AGENT_BROWSER_CDP", "AGENT_BROWSER_COLOR_SCHEME",
+  "AGENT_BROWSER_CONFIRM_ACTIONS", "AGENT_BROWSER_CONFIRM_INTERACTIVE", "AGENT_BROWSER_CONTENT_BOUNDARIES",
+  "AGENT_BROWSER_DEFAULT_TIMEOUT", "AGENT_BROWSER_DOWNLOAD_PATH", "AGENT_BROWSER_ENABLE",
+  "AGENT_BROWSER_ENCRYPTION_KEY", "AGENT_BROWSER_ENGINE", "AGENT_BROWSER_EXECUTABLE_PATH",
+  "AGENT_BROWSER_EXTENSIONS", "AGENT_BROWSER_HEADED", "AGENT_BROWSER_HIDE_SCROLLBARS",
+  "AGENT_BROWSER_IDLE_TIMEOUT_MS", "AGENT_BROWSER_IGNORE_HTTPS_ERRORS", "AGENT_BROWSER_INIT_SCRIPTS",
+  "AGENT_BROWSER_IOS_DEVICE", "AGENT_BROWSER_IOS_UDID", "AGENT_BROWSER_MAX_OUTPUT",
+  "AGENT_BROWSER_NAMESPACE", "AGENT_BROWSER_NO_AUTO_DIALOG", "AGENT_BROWSER_NO_XVFB",
+  "AGENT_BROWSER_PLUGINS", "AGENT_BROWSER_PROFILE", "AGENT_BROWSER_PROVIDER", "AGENT_BROWSER_PROXY",
+  "AGENT_BROWSER_PROXY_BYPASS", "AGENT_BROWSER_RESTORE", "AGENT_BROWSER_RESTORE_CHECK_FN",
+  "AGENT_BROWSER_RESTORE_CHECK_TEXT", "AGENT_BROWSER_RESTORE_CHECK_URL", "AGENT_BROWSER_SANDBOX_VERSION",
+  "AGENT_BROWSER_SCREENSHOT_DIR", "AGENT_BROWSER_SCREENSHOT_FORMAT", "AGENT_BROWSER_SCREENSHOT_QUALITY",
+  "AGENT_BROWSER_SESSION", "AGENT_BROWSER_SESSION_NAME", "AGENT_BROWSER_SKILLS_DIR",
+  "AGENT_BROWSER_SNAPSHOT_ID", "AGENT_BROWSER_SOCKET_DIR", "AGENT_BROWSER_STATE",
+  "AGENT_BROWSER_STATE_EXPIRE_DAYS", "AGENT_BROWSER_STREAM_PORT", "AGENT_BROWSER_USER_AGENT",
+  "AGENT_BROWSER_WEBGPU",
+];
 
 /**
  * Render one public page in a fresh anonymous agent-browser session.
@@ -42,6 +68,13 @@ export async function renderWithAgentBrowser(
   let tempDir = null;
   let unregister = () => {};
   let closed = false;
+  const renderDeadlineAt = Date.now() + BROWSER_TIMEOUT_MS;
+
+  function remainingRenderMs() {
+    const remaining = renderDeadlineAt - Date.now();
+    if (remaining <= 0) throw Object.assign(new Error(`agent-browser timed out after ${BROWSER_TIMEOUT_MS}ms`), { code: "browser_render_failed" });
+    return remaining;
+  }
 
   async function closeSession() {
     if (closed) return;
@@ -85,59 +118,9 @@ export async function renderWithAgentBrowser(
         args: [...baseArgs, ...commandArgs],
         cwd: workspace,
         env: {
-          // Delete every documented agent-browser behavior/auth/persistence
-          // override inherited from the host. Empty strings are not safe here:
-          // agent-browser treats some of them (notably SESSION_NAME) as
-          // configured-but-invalid values.
-          AGENT_BROWSER_ACTION_POLICY: undefined,
-          AGENT_BROWSER_ALLOWED_DOMAINS: undefined,
-          AGENT_BROWSER_ANNOTATE: undefined,
-          AGENT_BROWSER_ARGS: undefined,
-          AGENT_BROWSER_COLOR_SCHEME: undefined,
-          AGENT_BROWSER_CONFIRM_ACTIONS: undefined,
-          AGENT_BROWSER_CONFIRM_INTERACTIVE: undefined,
-          AGENT_BROWSER_CONTENT_BOUNDARIES: undefined,
-          AGENT_BROWSER_DEFAULT_TIMEOUT: undefined,
-          AGENT_BROWSER_DOWNLOAD_PATH: undefined,
-          AGENT_BROWSER_ENABLE: undefined,
-          AGENT_BROWSER_ENCRYPTION_KEY: undefined,
-          AGENT_BROWSER_ENGINE: undefined,
-          AGENT_BROWSER_EXECUTABLE_PATH: undefined,
-          AGENT_BROWSER_EXTENSIONS: undefined,
-          AGENT_BROWSER_HEADED: undefined,
-          AGENT_BROWSER_HIDE_SCROLLBARS: undefined,
-          AGENT_BROWSER_IDLE_TIMEOUT_MS: undefined,
-          AGENT_BROWSER_INIT_SCRIPTS: undefined,
-          AGENT_BROWSER_IOS_DEVICE: undefined,
-          AGENT_BROWSER_IOS_UDID: undefined,
-          AGENT_BROWSER_MAX_OUTPUT: undefined,
-          AGENT_BROWSER_NAMESPACE: undefined,
-          AGENT_BROWSER_NO_AUTO_DIALOG: undefined,
-          AGENT_BROWSER_NO_XVFB: undefined,
-          AGENT_BROWSER_PLUGINS: undefined,
-          AGENT_BROWSER_PROFILE: undefined,
-          AGENT_BROWSER_PROVIDER: undefined,
-          AGENT_BROWSER_PROXY: undefined,
-          AGENT_BROWSER_PROXY_BYPASS: undefined,
-          AGENT_BROWSER_RESTORE: undefined,
-          AGENT_BROWSER_RESTORE_CHECK_FN: undefined,
-          AGENT_BROWSER_RESTORE_CHECK_TEXT: undefined,
-          AGENT_BROWSER_RESTORE_CHECK_URL: undefined,
-          AGENT_BROWSER_SCREENSHOT_DIR: undefined,
-          AGENT_BROWSER_SCREENSHOT_FORMAT: undefined,
-          AGENT_BROWSER_SCREENSHOT_QUALITY: undefined,
-          AGENT_BROWSER_SESSION: undefined,
-          AGENT_BROWSER_SESSION_NAME: undefined,
-          AGENT_BROWSER_SKILLS_DIR: undefined,
-          AGENT_BROWSER_SOCKET_DIR: undefined,
-          AGENT_BROWSER_STATE: undefined,
-          AGENT_BROWSER_STATE_EXPIRE_DAYS: undefined,
-          AGENT_BROWSER_STREAM_PORT: undefined,
-          AGENT_BROWSER_USER_AGENT: undefined,
-          AGENT_BROWSER_WEBGPU: undefined,
+          ...isolatedBrowserEnvironment(),
           AGENT_BROWSER_AUTO_CONNECT: "false",
           AGENT_BROWSER_AUTOSAVE_INTERVAL_MS: "0",
-          AGENT_BROWSER_CDP: undefined,
           AGENT_BROWSER_CONFIG: configPath,
           AGENT_BROWSER_RESTORE_SAVE: "never",
           NO_COLOR: "1",
@@ -145,10 +128,14 @@ export async function renderWithAgentBrowser(
       },
     });
     try {
-      const result = await runPreparedProcess(prepared, {
+      const result = await runPreparedProcess({
+        ...prepared,
+        env: isolatedBrowserEnvironment(prepared.env, configPath),
+      }, {
         timeoutMs,
         signal: abortSignal,
         maxBufferBytes: BROWSER_OUTPUT_BYTES,
+        exactEnvironment: true,
       });
       if (result.timedOut) throw new Error(`agent-browser timed out after ${timeoutMs}ms`);
       if (result.aborted) throw new Error("agent-browser was aborted");
@@ -156,7 +143,7 @@ export async function renderWithAgentBrowser(
       if (result.spawnError) throw result.spawnError;
       if (result.signal) throw new Error(`agent-browser terminated by ${result.signal}`);
       if (result.code !== 0) {
-        throw new Error(`agent-browser exited ${result.code}: ${String(result.stderr || result.stdout).trim()}`);
+        throw new Error(`agent-browser exited ${result.code}`);
       }
       return String(result.stdout || "").trim();
     } finally {
@@ -168,17 +155,55 @@ export async function renderWithAgentBrowser(
     tempDir = await mkdtemp(join(workspace, ".mono-agent-web-"));
     await writeFile(join(tempDir, "agent-browser.json"), "{}\n", { encoding: "utf8", mode: 0o600 });
     unregister = registerCleanup?.(closeSession) ?? (() => {});
-    await run(["open", parsed.href]);
-    await run(["wait", "--load", "domcontentloaded"]);
-    const output = await run(["read"]);
+    await run(["open", parsed.href], remainingRenderMs());
+    await run(["wait", "--load", "domcontentloaded"], remainingRenderMs());
+    const finalUrlOutput = await run(["get", "url"], remainingRenderMs());
+    const finalUrl = validateFinalUrl(extractBrowserText(finalUrlOutput), parsed, sandbox, policy);
+    const output = await run(["read"], remainingRenderMs());
     const text = extractBrowserText(output);
     if (!text) throw new Error("agent-browser returned no readable rendered content");
-    return text;
+    assertNoWebAccessInterstitial({ url: finalUrl, text });
+    return { text, finalUrl };
   } finally {
     await closeSession();
   }
 }
 
+function validateFinalUrl(value, requested, sandbox, policy) {
+  let finalUrl;
+  try { finalUrl = new URL(String(value || "").trim()); }
+  catch { throw Object.assign(new Error("agent-browser returned an invalid final URL"), { code: "browser_render_failed" }); }
+  if (!["http:", "https:"].includes(finalUrl.protocol) || finalUrl.username || finalUrl.password) {
+    throw Object.assign(new Error("agent-browser navigated to an unsupported final URL"), { code: "network_denied" });
+  }
+  const requestedHost = requested.hostname.toLowerCase();
+  const finalHost = finalUrl.hostname.toLowerCase();
+  if (!(finalHost === requestedHost || finalHost.endsWith(`.${requestedHost}`))
+    || !sandbox.networkAllowsUrl(policy, finalUrl.href)) {
+    throw Object.assign(new Error("agent-browser final URL is outside the allowed domain policy"), { code: "network_denied" });
+  }
+  return finalUrl.href;
+}
+
+function isolatedBrowserEnvironment(source = process.env, configPath) {
+  /** @type {Record<string, string|undefined>} */
+  const env = {};
+  for (const key of BROWSER_HOST_ENV_KEYS) {
+    const value = source?.[key];
+    if (value !== undefined) env[key] = value;
+  }
+  // Undefined means deletion to the sandbox seam. runPreparedProcess then
+  // receives this map as an exact environment, so omitted host variables
+  // cannot reappear during its ordinary process.env merge.
+  for (const key of BLOCKED_BROWSER_ENV_KEYS) env[key] = undefined;
+  env.AGENT_BROWSER_AUTO_CONNECT = "false";
+  env.AGENT_BROWSER_AUTOSAVE_INTERVAL_MS = "0";
+  if (configPath !== undefined) env.AGENT_BROWSER_CONFIG = configPath;
+  env.AGENT_BROWSER_RESTORE_SAVE = "never";
+  env.NO_COLOR = "1";
+  return env;
+}
+
 function compactBrowserNamespace(value) {
   const candidate = String(value || "").trim();
   if (/^[A-Za-z0-9_-]+$/u.test(candidate) && candidate.length <= MAX_BROWSER_NAMESPACE_CHARS) {
@@ -206,7 +231,7 @@ function findText(value, depth = 0) {
     return value.map((entry) => findText(entry, depth + 1)).filter(Boolean).join("\n").trim();
   }
   if (typeof value !== "object") return "";
-  for (const key of ["markdown", "content", "text", "result", "output", "data"]) {
+  for (const key of ["markdown", "content", "text", "url", "result", "output", "data"]) {
     if (!(key in value)) continue;
     const text = findText(value[key], depth + 1);
     if (text) return text;

package/src/agent/tools/web-controller.js

@@ -1,10 +1,11 @@
 // @ts-check
 
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { readToolRuntime } from "./shared/runtime-context.js";
 import { resolveSandboxPolicy } from "./shared/tool-context.js";
-import { performWebFetch } from "./web-fetch.js";
+import { performWebFetch, formatWebFetchDocument } from "./web-fetch.js";
 import { performWebSearch } from "./web-search.js";
+import { createWebSearchRunState, webSearchBudgetSnapshot } from "./web-search-state.js";
 
 const MAX_CACHE_ENTRIES = 64;
 const MAX_SHARED_SEARCH_ENTRIES = 256;
@@ -28,10 +29,12 @@ const sharedSearchCache = new Map();
  * cleanup. Search results are the exception: they live in the process-wide
  * cache above so sibling subagents and later turns can reuse them.
  *
- * @param {{searchConfig?: any, fetchConfig?: any, sandboxPolicy?: any, sandboxEngine?: any, ctx?: any, fetchImpl?: typeof fetch, browserRenderer?: any, codexSearch?: any}} [options]
+ * @param {{coordinator?: any, searchConfig?: any, searchState?: any, fetchConfig?: any, sandboxPolicy?: any, sandboxEngine?: any, ctx?: any, fetchImpl?: typeof fetch, browserRenderer?: any, codexSearch?: any}} [options]
  */
 export function createWebToolController({
+  coordinator,
   searchConfig,
+  searchState: suppliedSearchState,
   fetchConfig,
   sandboxPolicy,
   sandboxEngine,
@@ -46,6 +49,7 @@ export function createWebToolController({
   const fetchInFlight = new Map();
   const cleanups = new Set();
   let closed = false;
+  const searchState = createWebSearchRunState(searchConfig, suppliedSearchState);
 
   function registerCleanup(cleanup) {
     if (closed) {
@@ -74,7 +78,7 @@ export function createWebToolController({
       const result = await task;
       if (!result.error) {
         cache.set(key, cloneResult(result));
-        while (cache.size > MAX_CACHE_ENTRIES) {
+        while (cache.size > MAX_CACHE_ENTRIES || [...cache.values()].reduce((n, r) => n + Buffer.byteLength(r.document?.body || "", "utf8"), 0) > 32 * 1024 * 1024) {
           cache.delete(cache.keys().next().value);
         }
       }
@@ -88,12 +92,15 @@ export function createWebToolController({
    * @param {string} key
    * @param {() => Promise<any>} execute
    */
-  async function cachedSearch(key, execute) {
+  async function cachedSearch(key, query, execute) {
     if (closed) return closedResult();
     const cached = readSharedSearch(key);
-    if (cached) return withCacheHit(cached);
+    if (cached) return withSearchCacheHit(cached, searchState, query);
     const active = searchInFlight.get(key);
-    if (active) return withCacheHit(await active);
+    if (active) {
+      const result = await active;
+      return result.error ? withCacheHit(result) : withSearchCacheHit(result, searchState, query);
+    }
     const task = Promise.resolve().then(execute);
     searchInFlight.set(key, task);
     try {
@@ -111,6 +118,7 @@ export function createWebToolController({
     namespace,
 
     async search(params, execution = {}) {
+      if (execution.signal?.aborted) return { text: "Error: WebSearch was aborted.", error: true, outcome: { status: "error", code: "aborted" } };
       // The key must pin the backend, the endpoint AND the network policy the
       // search actually ran under. A params-only key was safe while the cache
       // lived and died with one run; process-wide it would let controllers with
@@ -132,30 +140,37 @@ export function createWebToolController({
       // strict as the key claims.
       const resolvedCtx = ctx ?? readToolRuntime();
       const policy = resolveSandboxPolicy(resolvedCtx, sandboxPolicy);
-      const key = stableKey({ params, searchConfig, policy });
-      return cachedSearch(key, async () => performWebSearch(params, {
+      const key = stableKey({ params, searchConfig: safeSearchCacheIdentity(searchConfig), policy, coordination: coordinator?.scope });
+      return cachedSearch(key, params.query, async () => performWebSearch(params, {
+        coordinator,
         searchConfig,
         sandboxPolicy: policy,
         ctx: resolvedCtx,
         fetchImpl,
         codexSearch,
+        searchState,
         signal: execution.signal,
       }));
     },
 
     async fetch(params, execution = {}) {
-      const key = stableKey(params);
-      return cachedRun(fetchCache, fetchInFlight, key, async () => performWebFetch(params, {
-        fetchConfig,
-        sandboxPolicy,
-        sandboxEngine,
-        ctx,
-        fetchImpl,
-        browserRenderer,
-        signal: execution.signal,
-        namespace,
-        registerCleanup,
+      if (execution.signal?.aborted) return { text: "Error: WebFetch was aborted.", error: true, outcome: { status: "error", code: "aborted" } };
+      const resolvedCtx = ctx ?? readToolRuntime();
+      const policy = resolveSandboxPolicy(resolvedCtx, sandboxPolicy);
+      const { start_line, max_lines, max_output_chars, ...request } = params;
+      if ((start_line !== undefined && (!Number.isSafeInteger(start_line) || start_line < 1))
+        || (max_lines !== undefined && (!Number.isSafeInteger(max_lines) || max_lines < 1 || max_lines > 10000))) {
+        return { text: "Error: Invalid WebFetch line range.", error: true, outcome: { status: "error", code: "invalid_range" } };
+      }
+      const key = stableKey({ request, fetchConfig, policy, coordination: coordinator?.scope });
+      const result = await cachedRun(fetchCache, fetchInFlight, key, async () => performWebFetch(request, {
+        documentOnly: true, coordinator, fetchConfig, sandboxPolicy: policy, sandboxEngine,
+        ctx: resolvedCtx, fetchImpl, browserRenderer, signal: execution.signal,
+        namespace, registerCleanup,
       }));
+      if (result.error || !result.document) return result;
+      const sliced = formatWebFetchDocument({ ...result.document, outcome: result.outcome }, params, resolvedCtx);
+      return { ...sliced, document: undefined, outcome: { ...sliced.outcome, cacheHit: result.outcome.cacheHit } };
     },
 
     async close() {
@@ -174,6 +189,19 @@ export function createWebToolController({
   };
 }
 
+function safeSearchCacheIdentity(searchConfig) {
+  if (!searchConfig || typeof searchConfig !== "object") return searchConfig;
+  const { maxRequestsPerRun: _budget, ...identity } = searchConfig;
+  if (typeof searchConfig?.ollama?.apiKey !== "string") return identity;
+  return {
+    ...identity,
+    ollama: {
+      ...searchConfig.ollama,
+      apiKey: `sha256:${createHash("sha256").update(searchConfig.ollama.apiKey).digest("hex")}`,
+    },
+  };
+}
+
 function readSharedSearch(key) {
   const entry = sharedSearchCache.get(key);
   if (!entry) return null;
@@ -218,7 +246,15 @@ function sortValue(value) {
 function cloneResult(result) {
   return {
     ...result,
-    outcome: result.outcome ? { ...result.outcome } : result.outcome,
+    outcome: result.outcome ? {
+      ...result.outcome,
+      ...(Array.isArray(result.outcome.providerAttempts)
+        ? { providerAttempts: result.outcome.providerAttempts.map((entry) => ({ ...entry })) }
+        : {}),
+      ...(Array.isArray(result.outcome.failureMetadata)
+        ? { failureMetadata: result.outcome.failureMetadata.map((entry) => ({ ...entry })) }
+        : {}),
+    } : result.outcome,
   };
 }
 
@@ -228,10 +264,65 @@ function withCacheHit(result) {
     outcome: {
       ...(result.outcome || {}),
       cacheHit: true,
+      attempts: 0, durationMs: 0, queueWaitMs: 0, backendDurationMs: 0,
+      cooldownSkipCount: 0, quotaSkipCount: 0,
+      ...(Number.isSafeInteger(result.outcome?.requestsThisCall) ? { requestsThisCall: 0 } : {}),
     },
   };
 }
 
+function withSearchCacheHit(result, searchState, requestedQuery) {
+  const cloned = withCacheHit(result);
+  const budget = webSearchBudgetSnapshot(searchState, 0);
+  const resultCount = Number.isSafeInteger(cloned.outcome?.resultCount) ? cloned.outcome.resultCount : 0;
+  const nextAction = resultCount > 0
+    ? "fetch_existing_sources"
+    : budget.requestsRemaining > 0 ? "refine_query" : "use_available_evidence";
+  const action = nextAction === "fetch_existing_sources"
+    ? "Use WebFetch on the strongest returned URLs before searching again."
+    : nextAction === "refine_query"
+      ? "Refine the query only for a material evidence gap."
+      : "Do not retry WebSearch in this run; use available evidence and state the limitation.";
+  const control = `[Search control: requests=${budget.requestsUsed}/${budget.maxRequestsPerRun}; remaining=${budget.requestsRemaining}; ${action}]`;
+  const query = collapseWhitespace(requestedQuery).slice(0, 500);
+  const metadata = `[Search metadata: backend=${cloned.outcome?.backend || "unknown"}; attempted=none; actual_query=${JSON.stringify(query)}; fallback=none]`;
+  const textWithControl = typeof cloned.text === "string" && cloned.text.startsWith("[Search control:")
+    ? cloned.text.replace(/^\[Search control:[^\n]*\]/u, control)
+    : `${control}\n${cloned.text}`;
+  const text = textWithControl.includes("[Search metadata:")
+    ? textWithControl.replace(/^\[Search metadata:[^\n]*\]/mu, metadata)
+    : textWithControl.replace("[BEGIN UNTRUSTED WEB SEARCH RESULTS]", `[BEGIN UNTRUSTED WEB SEARCH RESULTS]\n${metadata}`);
+  const {
+    retryAfterMs: _retryAfterMs,
+    retryAt: _retryAt,
+    retryAtMs: _retryAtMs,
+    ...cachedOutcome
+  } = cloned.outcome || {};
+  return {
+    ...cloned,
+    text,
+    outcome: {
+      ...cachedOutcome,
+      ...budget,
+      bytes: Buffer.byteLength(text, "utf8"),
+      attemptedBackends: [],
+      actualQueries: [],
+      providerAttempts: [],
+      failureMetadata: [],
+      providerFailureCount: 0,
+      rateLimited: false,
+      cooldownBackends: [],
+      fallbackUsed: false,
+      retryInRun: budget.requestsRemaining > 0,
+      nextAction,
+    },
+  };
+}
+
+function collapseWhitespace(value) {
+  return typeof value === "string" ? value.replace(/\s+/gu, " ").trim() : "";
+}
+
 function closedResult() {
   const text = "Error: Web tool controller has already closed.";
   return {