@vellumai/assistant 0.11.0 → 0.11.1-staging.1

package/src/tools/browser/browser-execution.ts

@@ -2,6 +2,7 @@ import { optimizeImageForTransport } from "../../agent/image-optimize.js";
 import { getConfig } from "../../config/loader.js";
 import { HostBrowserProxy } from "../../daemon/host-browser-proxy.js";
 import type { ImageContent } from "../../providers/types.js";
+import { wrapUntrustedContent } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
 import { truncate } from "../../util/truncate.js";
 import { safeStringSlice } from "../../util/unicode.js";
@@ -13,9 +14,11 @@ import {
   resolveHostAddresses,
   resolveRequestAddress,
   sanitizeUrlForOutput,
+  sanitizeUrlStringForOutput,
 } from "../network/url-safety.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 import {
+  type AuthChallenge,
   detectAuthChallenge,
   detectCaptchaChallenge,
   formatAuthChallenge,
@@ -87,6 +90,105 @@ const MAX_WAIT_MS = 30_000;
 
 const MAX_EXTRACT_LENGTH = 50_000;
 
+/**
+ * Character budget for the fenced payload returned by `browser_extract`.
+ * Sized above {@link MAX_EXTRACT_LENGTH} so the innerText cap stays the
+ * effective limit for body text, while still bounding the header and the
+ * page-controlled (otherwise unbounded) links list.
+ */
+const MAX_EXTRACT_FENCE_CHARS = MAX_EXTRACT_LENGTH + 10_000;
+
+/**
+ * Caps on the link list `browser_extract` returns with `include_links`.
+ * Anchor text and hrefs are page-authored and unbounded (a data-URI href
+ * runs to megabytes), so one link could otherwise spend the whole extract
+ * budget and truncate away every link after it.
+ */
+const MAX_EXTRACTED_LINKS = 200;
+const MAX_LINK_TEXT_CHARS = 80;
+const MAX_LINK_HREF_CHARS = 200;
+
+/**
+ * Character budget for the fenced payload returned by `browser_snapshot`.
+ *
+ * A snapshot's usefulness is all-or-nothing per element: truncating the
+ * list drops trailing element ids the model needs to act on. The AX
+ * transform bounds a snapshot to 150 elements with capped names, values
+ * and attribute strings, so this sits above that worst case and the fence
+ * cannot cut the element list short — while still bounding what a
+ * pathological page can push into context.
+ */
+const MAX_SNAPSHOT_FENCE_CHARS = 100_000;
+
+/**
+ * Maximum length of a page-authored URL or title echoed into a tool
+ * result.
+ *
+ * These render ahead of the payload they head, and the page controls both
+ * (`history.pushState` to a megabyte-long URL, a `document.title` of
+ * arbitrary length). Left unbounded, a hostile page could push the header
+ * alone past a tool's fence budget and truncate away the element list or
+ * body text that follows.
+ */
+const MAX_PAGE_HEADER_CHARS = 500;
+
+/** Read the current page URL, credential-stripped and length-bounded. */
+async function readPageUrl(
+  cdp: CdpClient,
+  signal?: AbortSignal,
+): Promise<string> {
+  const url = sanitizeUrlStringForOutput(await getCurrentUrl(cdp, signal));
+  return truncate(url, MAX_PAGE_HEADER_CHARS);
+}
+
+/** Read the current page title, length-bounded. */
+async function readPageTitle(
+  cdp: CdpClient,
+  signal?: AbortSignal,
+): Promise<string> {
+  return truncate(await getPageTitle(cdp, signal), MAX_PAGE_HEADER_CHARS);
+}
+
+/**
+ * Fence page-derived text before it reaches the model.
+ *
+ * Everything a browser tool reads out of a live page — titles, accessible
+ * names, body text, link labels, form-field labels — is authored by
+ * whoever controls that page, so it carries the same prompt-injection risk
+ * as an inbound email or a fetched web page. `wrapUntrustedContent` marks
+ * it as third-party data, escapes attempts to close the fence from inside,
+ * and caps its size.
+ */
+function fencePageContent(
+  content: string,
+  pageUrl: string,
+  maxChars?: number,
+): string {
+  return wrapUntrustedContent(content, {
+    source: "web",
+    sourceDetail: pageUrl,
+    ...(maxChars === undefined ? {} : { maxChars }),
+  });
+}
+
+/**
+ * Origin to attribute a detected auth challenge to.
+ *
+ * The detector reads the live DOM, which may sit at a different URL than
+ * the one navigation settled on (an SPA login redirect, a modal, the
+ * post-CAPTCHA page). Prefer the URL the detector actually inspected so
+ * the fence metadata names the origin that authored the labels, falling
+ * back to the navigation's final URL when the detector reports none.
+ */
+function authChallengeOrigin(
+  challenge: AuthChallenge,
+  fallbackUrl: string,
+): string {
+  return challenge.url
+    ? sanitizeUrlStringForOutput(challenge.url)
+    : fallbackUrl;
+}
+
 type StatusCheckMode = BrowserStatusMode;
 
 const MODE_TRADEOFFS: Record<StatusCheckMode, string[]> = {
@@ -310,7 +412,9 @@ function collectRemediationHints(
 
   const addHints = (key: string) => {
     const list = REMEDIATION_HINTS[key];
-    if (!list) return;
+    if (!list) {
+      return;
+    }
     for (const hint of list) {
       if (!seen.has(hint)) {
         seen.add(hint);
@@ -320,7 +424,9 @@ function collectRemediationHints(
   };
 
   for (const diag of diagnostics) {
-    if (diag.stage === "success") continue;
+    if (diag.stage === "success") {
+      continue;
+    }
     if (diag.discoveryCode) {
       addHints(`${diag.candidateKind}:${diag.discoveryCode}`);
     }
@@ -679,7 +785,9 @@ export async function executeBrowserNavigate(
 
   // URL validation passed — acquire the CDP client.
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const { cdp, browserMode } = acquired;
 
   // Tab routing on the extension backend. By default the assistant
@@ -1035,12 +1143,17 @@ export async function executeBrowserNavigate(
       // Page may have navigated during evaluate - safe to ignore
     }
 
-    const safeFinalUrl = sanitizeUrlForOutput(new URL(finalUrl));
-    const title = await getPageTitle(cdp, context.signal);
+    const safeFinalUrl = truncate(
+      sanitizeUrlForOutput(new URL(finalUrl)),
+      MAX_PAGE_HEADER_CHARS,
+    );
+    const title = await readPageTitle(cdp, context.signal);
+    // The document title is page-authored, so it is fenced separately
+    // from the tool's own scaffolding lines.
     const lines: string[] = [
       `Requested URL: ${safeRequestedUrl}`,
       `Final URL: ${safeFinalUrl}`,
-      `Title: ${title || "(none)"}`,
+      fencePageContent(`Title: ${title || "(none)"}`, safeFinalUrl),
     ];
 
     if (navigationTimedOut) {
@@ -1099,12 +1212,11 @@ export async function executeBrowserNavigate(
                 "Cloudflare verification detected. Please solve the CAPTCHA in the Chrome window. The browser will automatically detect when you're done and resume.",
               bringToFront: true,
             });
-            const newUrl = await getCurrentUrl(cdp, context.signal);
-            const newTitle = await getPageTitle(cdp, context.signal);
+            const newUrl = await readPageUrl(cdp, context.signal);
+            const newTitle = await readPageTitle(cdp, context.signal);
             lines.push("");
-            lines.push(
-              `CAPTCHA solved by user. Current page: ${newTitle} (${newUrl})`,
-            );
+            lines.push("CAPTCHA solved by user. Current page:");
+            lines.push(fencePageContent(`${newTitle} (${newUrl})`, newUrl));
 
             // Re-check for auth challenges - the page behind the CAPTCHA may have a login form
             const postCaptchaAuth = await detectAuthChallenge(
@@ -1113,7 +1225,12 @@ export async function executeBrowserNavigate(
             );
             if (postCaptchaAuth) {
               lines.push("");
-              lines.push(formatAuthChallenge(postCaptchaAuth));
+              lines.push(
+                fencePageContent(
+                  formatAuthChallenge(postCaptchaAuth),
+                  authChallengeOrigin(postCaptchaAuth, safeFinalUrl),
+                ),
+              );
               lines.push("");
               lines.push("Handle this by interacting with the login form:");
               lines.push(
@@ -1141,8 +1258,16 @@ export async function executeBrowserNavigate(
         } else {
           // Login / 2FA / OAuth - the agent should handle these itself
           // using browser operations + stored credentials. Don't hand off.
+          // The service name and field labels come from the page, so the
+          // formatted challenge is fenced; the remediation steps below are
+          // the tool's own instructions and stay outside.
           lines.push("");
-          lines.push(formatAuthChallenge(challenge));
+          lines.push(
+            fencePageContent(
+              formatAuthChallenge(challenge),
+              authChallengeOrigin(challenge, safeFinalUrl),
+            ),
+          );
           lines.push("");
           lines.push("Handle this by interacting with the login form:");
           lines.push("1. Take a snapshot to find the sign-in form elements");
@@ -1205,12 +1330,14 @@ export async function executeBrowserSnapshot(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const acquired = await acquireCdpClientWithMode(_input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const { cdp, browserMode } = acquired;
 
   try {
-    const currentUrl = await getCurrentUrl(cdp, context.signal);
-    const title = await getPageTitle(cdp, context.signal);
+    const currentUrl = await readPageUrl(cdp, context.signal);
+    const title = await readPageTitle(cdp, context.signal);
 
     // Pull the full accessibility tree via CDP and fold it into typed
     // interactive elements + an `eid → backendNodeId` map. Interaction
@@ -1230,10 +1357,18 @@ export async function executeBrowserSnapshot(
       backendNodeMap,
     );
 
+    // The whole snapshot is page-authored — element roles, accessible
+    // names, attribute values and the title all come from the DOM — so
+    // the entire payload goes inside the fence. Element ids stay usable:
+    // fencing marks the block as data, it does not hide it.
     return {
-      content: formatAxSnapshot(
-        { elements, selectorMap: backendNodeMap },
-        { url: currentUrl, title },
+      content: fencePageContent(
+        formatAxSnapshot(
+          { elements, selectorMap: backendNodeMap },
+          { url: currentUrl, title },
+        ),
+        currentUrl,
+        MAX_SNAPSHOT_FENCE_CHARS,
       ),
       isError: false,
     };
@@ -1257,7 +1392,9 @@ export async function executeBrowserScreenshot(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const { cdp, browserMode } = acquired;
   const fullPage = input.full_page === true;
 
@@ -1314,7 +1451,9 @@ export async function executeBrowserAttach(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const acquired = await acquireCdpClientWithMode(_input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     if (cdp.kind === "extension") {
@@ -1367,7 +1506,9 @@ export async function executeBrowserDetach(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const acquired = await acquireCdpClientWithMode(_input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     if (cdp.kind === "extension") {
@@ -1417,7 +1558,9 @@ export async function executeBrowserClose(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     if (cdp.kind === "local") {
@@ -1485,10 +1628,14 @@ export async function executeBrowserClick(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const { resolved, error } = resolveElement(context.conversationId, input);
-  if (error) return { content: error, isError: true };
+  if (error) {
+    return { content: error, isError: true };
+  }
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     let backendNodeId: number;
@@ -1593,7 +1740,9 @@ export async function executeBrowserType(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const { resolved, error } = resolveElement(context.conversationId, input);
-  if (error) return { content: error, isError: true };
+  if (error) {
+    return { content: error, isError: true };
+  }
 
   const text = typeof input.text === "string" ? input.text : "";
   if (!text) {
@@ -1609,7 +1758,9 @@ export async function executeBrowserType(
       : resolved!.selector;
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     let backendNodeId: number;
@@ -1635,8 +1786,12 @@ export async function executeBrowserType(
     }
 
     const lines = [`Typed into element: ${targetDescription}`];
-    if (clearFirst) lines.push("(cleared existing content first)");
-    if (pressEnter) lines.push("(pressed Enter after typing)");
+    if (clearFirst) {
+      lines.push("(cleared existing content first)");
+    }
+    if (pressEnter) {
+      lines.push("(pressed Enter after typing)");
+    }
     return { content: lines.join("\n"), isError: false };
   } catch (err) {
     const diagnosticMessage = formatCdpSendDiagnostics(
@@ -1686,7 +1841,9 @@ export async function executeBrowserPressKey(
   }
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     if (resolved) {
@@ -1763,7 +1920,9 @@ export async function executeBrowserScroll(
   }
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     // Fetch viewport dimensions so we can dispatch the wheel event at
@@ -1807,7 +1966,9 @@ export async function executeBrowserSelectOption(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const { resolved, error } = resolveElement(context.conversationId, input);
-  if (error) return { content: error, isError: true };
+  if (error) {
+    return { content: error, isError: true };
+  }
 
   const value = typeof input.value === "string" ? input.value : undefined;
   const label = typeof input.label === "string" ? input.label : undefined;
@@ -1826,7 +1987,9 @@ export async function executeBrowserSelectOption(
       : resolved!.selector;
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     let backendNodeId: number;
@@ -1939,10 +2102,14 @@ export async function executeBrowserHover(
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
   const { resolved, error } = resolveElement(context.conversationId, input);
-  if (error) return { content: error, isError: true };
+  if (error) {
+    return { content: error, isError: true };
+  }
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     let backendNodeId: number;
@@ -2036,7 +2203,9 @@ export async function executeBrowserWaitFor(
   }
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     if (selector) {
@@ -2085,11 +2254,13 @@ export async function executeBrowserExtract(
   const includeLinks = input.include_links === true;
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
-    const currentUrl = await getCurrentUrl(cdp, context.signal);
-    const title = await getPageTitle(cdp, context.signal);
+    const currentUrl = await readPageUrl(cdp, context.signal);
+    const title = await readPageTitle(cdp, context.signal);
 
     let textContent = await evaluateExpression<string>(
       cdp,
@@ -2119,13 +2290,30 @@ export async function executeBrowserExtract(
       if (links.length > 0) {
         lines.push("");
         lines.push("Links:");
-        for (const link of links) {
-          lines.push(`  [${link.text || "(no text)"}](${link.href})`);
+        // Bound both fields here rather than trusting the caps in
+        // EXTRACT_LINKS_EXPRESSION: that runs inside the page, so its
+        // return value is as page-controlled as the DOM it reads. A
+        // single unbounded href would otherwise spend the fence budget
+        // and truncate away every link after it.
+        for (const link of links.slice(0, MAX_EXTRACTED_LINKS)) {
+          const text = truncate(String(link.text ?? ""), MAX_LINK_TEXT_CHARS);
+          const href = truncate(
+            sanitizeUrlStringForOutput(String(link.href ?? "")),
+            MAX_LINK_HREF_CHARS,
+          );
+          lines.push(`  [${text || "(no text)"}](${href})`);
         }
       }
     }
 
-    return { content: lines.join("\n"), isError: false };
+    return {
+      content: fencePageContent(
+        lines.join("\n"),
+        currentUrl,
+        MAX_EXTRACT_FENCE_CHARS,
+      ),
+      isError: false,
+    };
   } catch (err) {
     const diagnosticMessage = formatCdpSendDiagnostics(
       err,
@@ -2159,7 +2347,9 @@ export async function executeBrowserFillCredential(
   }
 
   const { resolved, error } = resolveElement(context.conversationId, input);
-  if (error) return { content: error, isError: true };
+  if (error) {
+    return { content: error, isError: true };
+  }
 
   const pressEnter = input.press_enter === true;
   const targetDescription =
@@ -2168,7 +2358,9 @@ export async function executeBrowserFillCredential(
       : resolved!.selector;
 
   const acquired = await acquireCdpClientWithMode(input, context);
-  if (acquired.errorResult) return acquired.errorResult;
+  if (acquired.errorResult) {
+    return acquired.errorResult;
+  }
   const cdp = acquired.cdp;
   try {
     let backendNodeId: number;
@@ -2277,8 +2469,12 @@ function dedupeStrings(values: string[]): string[] {
   const seen = new Set<string>();
   const out: string[] = [];
   for (const value of values) {
-    if (!value) continue;
-    if (seen.has(value)) continue;
+    if (!value) {
+      continue;
+    }
+    if (seen.has(value)) {
+      continue;
+    }
     seen.add(value);
     out.push(value);
   }
@@ -2314,7 +2510,9 @@ function extractDiscoveryCodes(error: CdpError): string[] {
   const diagnostics = error.attemptDiagnostics ?? [];
   const codes: string[] = [];
   for (const diag of diagnostics) {
-    if (diag.discoveryCode) codes.push(diag.discoveryCode);
+    if (diag.discoveryCode) {
+      codes.push(diag.discoveryCode);
+    }
   }
   return dedupeStrings(codes);
 }