venice-cli 0.83.0__tar.gz → 0.83.2__tar.gz

{venice_cli-0.83.0 → venice_cli-0.83.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: venice-cli
-Version: 0.83.0
+Version: 0.83.2
 Summary: A stdlib-only Python CLI for the Venice.ai API: audio, video, images, chat, and embeddings.
 Project-URL: Homepage, https://github.com/gobha-me/venice-cli
 Project-URL: Repository, https://github.com/gobha-me/venice-cli
@@ -905,9 +905,9 @@ Details and safety:
 | `--shell-allow CMD` | allow only these commands for `--shell` (repeatable; adds to config `shell.allow`) |
 | `--shell-deny PATTERN` | refuse commands matching these globs (repeatable; adds to config `shell.deny`) |
 | `--shell-unrestricted` | acknowledge an empty allowlist under `--yes` (required for that combination) |
-| `--browser` | add `web_fetch` + `browser_capture` tools (fetch a URL / headless-render a page); implies `--tools` |
-| `--browser-allow HOST` | allow only these hosts for the browser tools (repeatable; adds to config `browser.allow`) |
-| `--browser-deny PATTERN` | refuse URLs whose host/URL matches these globs (repeatable; adds to config `browser.deny`) |
+| `--browser` | reserved; temporarily exits 2 without network access while the browser rail is security-disabled |
+| `--browser-allow HOST` | retained browser-policy config for compatibility; inert while `--browser` is disabled |
+| `--browser-deny PATTERN` | retained browser-policy config for compatibility; inert while `--browser` is disabled |
 | `--memory` | add persistent memory + task tools (durable notes + a checklist); implies `--tools` (see [Memory & tasks](#memory--tasks---memory)) |
 | `--mcp NAME` | attach a registered external MCP server's tools (repeatable) |
 | `--no-mcp` | attach no MCP servers (overrides a configured default) |
@@ -948,66 +948,32 @@ venice config set shell.allow '["git", "gh", "ls", "cat"]'
 
 #### Web & browser tools (`--browser`)
 
-`--browser` adds two tools so the agent can look at the web — useful for verifying a page
-it (or you) just built. Implies `--tools`. Both are read-only and **not** spend-gated;
-the URL policy below is the guard.
-
-- **`web_fetch`** — a stdlib `urllib` GET that returns the page as text (tags stripped) or
-  raw HTML (`mode=html`). Zero extra dependencies; good for non-JS "read this page."
-- **`browser_capture`** — headless-renders the page with a **Chromium-family browser**
-  (`chromium`/`chrome`/`brave`) and returns the **post-JS DOM** (`mode=dom`/`text`) and/or
-  a **screenshot PNG** (`mode=screenshot`/`both`, written to `--output` and returned as a
-  path, never inline). Pass `assert_contains="…"` to deterministically check the rendered
-  DOM contains a string — the robust "did the JS actually appear" check (beats eyeballing a
-  screenshot). If only **Firefox** is installed it degrades to screenshot-only (its
-  headless CLI can't dump the DOM); with no browser at all it reports "no headless browser
-  available," like the `git` rail.
+`web_fetch` and `browser_capture` are temporarily unavailable while
+[GHSA-mqjr-2vh8-6fvg](https://github.com/sirkitree/venice/security/advisories/GHSA-mqjr-2vh8-6fvg)
+is contained. In v0.83.2, passing `--browser` exits with status 2 before loading the SDK,
+credentials, or any network client. The direct implementation seams also return an error,
+and the agent does not advertise either tool.
 
-```sh
-venice chat --browser "Fetch https://example.com and summarize it."
-venice chat --browser --browser-allow 'localhost' \
-  "Open http://localhost:8123/ and confirm the game cards rendered (assert_contains)."
-```
-
-**URL safety.** The scheme must be `http`/`https` and the cloud-metadata endpoint
-(`169.254.169.254`) is **always** blocked — these hard stops are not configurable. `file://`
-and everything non-http is refused. On top of that, an operator **allow/deny** policy (CLI
-flags add to a shared top-level `browser` section in [config](#config)) scopes which hosts
-are reachable:
-
-```sh
-venice config set browser.deny  '["*.internal", "10.*"]'
-venice config set browser.allow '["localhost", "*.example.com"]'
-```
-
-- **Deny** globs match the URL host and the full URL, are always enforced, and win over
-  allow. A non-empty **allow** list restricts to matching hosts; empty = any host (still
-  subject to the hard stops + deny). `localhost` is reachable by default (the common case is
-  verifying a locally-served page).
-- The headless browser runs untrusted page JS under an **allowlisted environment** (the
-  Venice API key and other ambient tokens are dropped) and a throwaway profile dir.
-- DOM/text output and downloads are size-capped; tune with `defaults.browser.*`
-  (`wait_ms`, `timeout`, `max_bytes`).
-- **Not exposed over `venice mcp-serve`** in this release (chat/code only), like
-  `project_search`/`reindex`.
+The `--browser-allow`, `--browser-deny`, and `browser.*` config keys remain accepted only
+to preserve existing configuration. They do not enable network access. Restoring this rail
+requires an enforced egress boundary that covers redirects, DNS rebinding, browser
+subresources, and page scripts—not another URL-only filter.
 
 #### Web search (`--web-search`)
 
-`--browser` can only fetch a URL the agent **already knows**. `--web-search` closes the
-other half of the loop — **discovery**. It adds one tool, `venice_web_search`, so the coding
+`--web-search` adds one discovery tool, `venice_web_search`, so the coding
 agent can look something up on the web when a fix needs documentation it doesn't have a link
 for (an API's docs, a library's usage, an error message).
 
 `venice_web_search(query)` makes **one** Venice web-search completion (server-side
 `enable_web_search` + `enable_web_citations`, the same feature behind `venice chat
 --web-search`) and returns a short **answer** plus the **cited URLs**. To then read a cited
-page in full, follow up with `web_fetch` — so pair `--web-search` with `--browser`, and every
-fetched URL stays under the `browser.*` allow/deny policy above. **Search discovers; the
-browser policy still governs what gets read.**
+page in full, open it outside Venice: the direct `web_fetch` follow-up rail is temporarily
+disabled as described above.
 
 ```sh
-# discover + read: search finds the doc, the browser fetches it (under browser.* policy)
-venice code --web-search --browser --auto \
+# discover: search returns an answer and its cited URLs
+venice code --web-search --auto \
   "The stripe SDK call is failing with an idempotency error — look up the fix and apply it."
 ```
 
@@ -1060,7 +1026,7 @@ venice memory tasks              # the project checklist (--status filters)
 - **Locations:** project notes/tasks at `<root>/.venice/memory/` (git-ignored by default,
   like the semantic index); global notes at `~/.config/venice/memory/`
   (`$VENICE_MEMORY_DIR` overrides). All store files are `0600`.
-- **Hygiene (CLAUDE.md):** a note **name** is refused if it's secret-shaped
+- **Hygiene (AGENTS.md):** a note **name** is refused if it's secret-shaped
   (`credentials`, `id_rsa*`, `*.key`, `.env`, `*secrets*`, …), so the store can't be used
   to label or stash a credential.
 - **Not exposed over `venice mcp-serve`** (chat/code only), like the browser rails.
@@ -1465,7 +1431,7 @@ jq '.usage.billed_total' ~/.config/venice/sessions/<id>.json
 | `run` | run a shell command (`/bin/sh -c`) at the **active** root | yes |
 | `attach_root` | register another directory as a project root (for work spanning repos) and, by default, switch the active root into it so relative paths and `run`/`git` follow — writes outside the writable roots fail loudly | no |
 | `venice_image` / `venice_image_edit` / `venice_sfx` / `venice_music` / `venice_tts` / `venice_upscale` / `venice_bg_remove` / `venice_video` | generate/edit images, audio & video into the project — **opt-in with `--assets`** | yes |
-| `web_fetch` / `browser_capture` | fetch a URL (text/HTML) or headless-render a page (post-JS DOM + screenshot) to verify its own work — **opt-in with `--browser`** (see [Web & browser tools](#web--browser-tools---browser)) | no |
+| `web_fetch` / `browser_capture` | temporarily unavailable for security; not advertised to the agent (see [Web & browser tools](#web--browser-tools---browser)) | no |
 | `memory_write` / `memory_read` / `memory_search` / `memory_list` | durable notes the agent recalls across turns/sessions (two tiers: project + global) — **opt-in with `--memory`** (see [Memory & tasks](#memory--tasks---memory)) | no |
 | `task_add` / `task_update` / `task_list` | a project-only checklist the agent tracks (`pending`/`in_progress`/`done`) — **opt-in with `--memory`** | no |
 | `venice_scout` | delegate a read-only investigation to a disposable subagent with a fresh context; returns a structured report so exploration doesn't pollute the main context — **opt-in with `--scout`** (see [Scout subagent](#scout-subagent---scout)) | no |
@@ -1503,7 +1469,7 @@ it unrestricted (unchanged behavior).
 | `--max-tool-calls N` | cap tool invocations before forcing a final answer (default 25) |
 | `--exec-timeout SECS` | timeout for `run`/`git` (default 120) |
 | `--shell-allow CMD` / `--shell-deny PATTERN` | scope the `run` tool with the shared allow/deny policy (repeatable; adds to config `shell.*`) |
-| `--browser` / `--browser-allow HOST` / `--browser-deny PATTERN` | expose `web_fetch` + `browser_capture` so the agent can verify a rendered page; scope hosts with the `browser.*` allow/deny policy (see [Web & browser tools](#web--browser-tools---browser)) |
+| `--browser` / `--browser-allow HOST` / `--browser-deny PATTERN` | compatibility flags for the security-disabled browser rail; `--browser` exits 2 without network access (see [Web & browser tools](#web--browser-tools---browser)) |
 | `--assets` | also expose the in-process asset-generation tools (image / image-edit / sfx / music / tts / upscale / bg-remove / video) so the agent can create images, audio & video in the project; paid — each confirms per call unless `--auto` |
 | `--scout` | expose `venice_scout`: delegate a read-only investigation to a disposable subagent with a fresh context; keeps exploration out of the main context (see [Scout subagent](#scout-subagent---scout)) |
 | `--spawn` | expose `venice_spawn`: delegate a bounded **write/paid** task to a disposable **worker** subagent with a fresh context and a role-scoped subset of your tools; edit churn stays quarantined and it returns a structured report to merge (see [Worker subagent](#worker-subagent---spawn)) |
@@ -1511,7 +1477,7 @@ it unrestricted (unchanged behavior).
 | `--subagent-max-tokens N` | per-subagent cap on the cumulative prompt+completion **tokens** a `venice_scout` **or** `venice_spawn` subagent spends across its turns (default **off**; `<= 0` disables); once crossed the subagent is asked to wrap up and its report carries the token count. A cumulative-usage ceiling, **not** a context-window size limit, and distinct from `--max-tokens` (per-turn output); config `defaults.code.subagent_max_tokens` |
 | `--planner` | planner harness: implies `--scout --spawn --memory`, mandates the decompose → dispatch → track → **merge** protocol, and adds `venice_merge` — a consolidated rollup of every dispatch (see [Planner harness](#planner-harness---planner)) |
 | `--parallel` | dispatch **independent** `venice_scout`/`venice_spawn` subagents **concurrently** (bounded pool) instead of one at a time, so a planner's independent units overlap in wall-clock; opt-in, serial otherwise; config `defaults.code.parallel` (see [Parallel dispatch](#parallel-dispatch---parallel)) |
-| `--web-search` / `--web-search-model MODEL` | expose `venice_web_search` so the agent can **discover** documentation on the web (answer + cited URLs); pairs with `--browser` to then read a cited page under the `browser.*` policy (see [Web search](#web-search---web-search)) |
+| `--web-search` / `--web-search-model MODEL` | expose `venice_web_search` so the agent can **discover** documentation on the web (answer + cited URLs; see [Web search](#web-search---web-search)) |
 | `--review` | expose `venice_review`: hand the current diff to a **cold-context reviewer** (fresh context, read-only tools, a different model where one exists) and fix what it reports before handing work back. Capped at **3 reviews per session**. Findings only — a review is not a merge gate (see [Reviewer rail](#reviewer-rail---review)) |
 | `--review-model MODEL` | model for `--review` (default: a function-calling model from a **different family** than the coding model; falls back to the coding model with a warning); config `defaults.code.review_model` |
 | `--review-rounds N` | passes `venice_review` makes over the same diff (default **1**, max 3); config `defaults.code.review_rounds` |

{venice_cli-0.83.0 → venice_cli-0.83.2}/README.md

@@ -865,9 +865,9 @@ Details and safety:
 | `--shell-allow CMD` | allow only these commands for `--shell` (repeatable; adds to config `shell.allow`) |
 | `--shell-deny PATTERN` | refuse commands matching these globs (repeatable; adds to config `shell.deny`) |
 | `--shell-unrestricted` | acknowledge an empty allowlist under `--yes` (required for that combination) |
-| `--browser` | add `web_fetch` + `browser_capture` tools (fetch a URL / headless-render a page); implies `--tools` |
-| `--browser-allow HOST` | allow only these hosts for the browser tools (repeatable; adds to config `browser.allow`) |
-| `--browser-deny PATTERN` | refuse URLs whose host/URL matches these globs (repeatable; adds to config `browser.deny`) |
+| `--browser` | reserved; temporarily exits 2 without network access while the browser rail is security-disabled |
+| `--browser-allow HOST` | retained browser-policy config for compatibility; inert while `--browser` is disabled |
+| `--browser-deny PATTERN` | retained browser-policy config for compatibility; inert while `--browser` is disabled |
 | `--memory` | add persistent memory + task tools (durable notes + a checklist); implies `--tools` (see [Memory & tasks](#memory--tasks---memory)) |
 | `--mcp NAME` | attach a registered external MCP server's tools (repeatable) |
 | `--no-mcp` | attach no MCP servers (overrides a configured default) |
@@ -908,66 +908,32 @@ venice config set shell.allow '["git", "gh", "ls", "cat"]'
 
 #### Web & browser tools (`--browser`)
 
-`--browser` adds two tools so the agent can look at the web — useful for verifying a page
-it (or you) just built. Implies `--tools`. Both are read-only and **not** spend-gated;
-the URL policy below is the guard.
-
-- **`web_fetch`** — a stdlib `urllib` GET that returns the page as text (tags stripped) or
-  raw HTML (`mode=html`). Zero extra dependencies; good for non-JS "read this page."
-- **`browser_capture`** — headless-renders the page with a **Chromium-family browser**
-  (`chromium`/`chrome`/`brave`) and returns the **post-JS DOM** (`mode=dom`/`text`) and/or
-  a **screenshot PNG** (`mode=screenshot`/`both`, written to `--output` and returned as a
-  path, never inline). Pass `assert_contains="…"` to deterministically check the rendered
-  DOM contains a string — the robust "did the JS actually appear" check (beats eyeballing a
-  screenshot). If only **Firefox** is installed it degrades to screenshot-only (its
-  headless CLI can't dump the DOM); with no browser at all it reports "no headless browser
-  available," like the `git` rail.
+`web_fetch` and `browser_capture` are temporarily unavailable while
+[GHSA-mqjr-2vh8-6fvg](https://github.com/sirkitree/venice/security/advisories/GHSA-mqjr-2vh8-6fvg)
+is contained. In v0.83.2, passing `--browser` exits with status 2 before loading the SDK,
+credentials, or any network client. The direct implementation seams also return an error,
+and the agent does not advertise either tool.
 
-```sh
-venice chat --browser "Fetch https://example.com and summarize it."
-venice chat --browser --browser-allow 'localhost' \
-  "Open http://localhost:8123/ and confirm the game cards rendered (assert_contains)."
-```
-
-**URL safety.** The scheme must be `http`/`https` and the cloud-metadata endpoint
-(`169.254.169.254`) is **always** blocked — these hard stops are not configurable. `file://`
-and everything non-http is refused. On top of that, an operator **allow/deny** policy (CLI
-flags add to a shared top-level `browser` section in [config](#config)) scopes which hosts
-are reachable:
-
-```sh
-venice config set browser.deny  '["*.internal", "10.*"]'
-venice config set browser.allow '["localhost", "*.example.com"]'
-```
-
-- **Deny** globs match the URL host and the full URL, are always enforced, and win over
-  allow. A non-empty **allow** list restricts to matching hosts; empty = any host (still
-  subject to the hard stops + deny). `localhost` is reachable by default (the common case is
-  verifying a locally-served page).
-- The headless browser runs untrusted page JS under an **allowlisted environment** (the
-  Venice API key and other ambient tokens are dropped) and a throwaway profile dir.
-- DOM/text output and downloads are size-capped; tune with `defaults.browser.*`
-  (`wait_ms`, `timeout`, `max_bytes`).
-- **Not exposed over `venice mcp-serve`** in this release (chat/code only), like
-  `project_search`/`reindex`.
+The `--browser-allow`, `--browser-deny`, and `browser.*` config keys remain accepted only
+to preserve existing configuration. They do not enable network access. Restoring this rail
+requires an enforced egress boundary that covers redirects, DNS rebinding, browser
+subresources, and page scripts—not another URL-only filter.
 
 #### Web search (`--web-search`)
 
-`--browser` can only fetch a URL the agent **already knows**. `--web-search` closes the
-other half of the loop — **discovery**. It adds one tool, `venice_web_search`, so the coding
+`--web-search` adds one discovery tool, `venice_web_search`, so the coding
 agent can look something up on the web when a fix needs documentation it doesn't have a link
 for (an API's docs, a library's usage, an error message).
 
 `venice_web_search(query)` makes **one** Venice web-search completion (server-side
 `enable_web_search` + `enable_web_citations`, the same feature behind `venice chat
 --web-search`) and returns a short **answer** plus the **cited URLs**. To then read a cited
-page in full, follow up with `web_fetch` — so pair `--web-search` with `--browser`, and every
-fetched URL stays under the `browser.*` allow/deny policy above. **Search discovers; the
-browser policy still governs what gets read.**
+page in full, open it outside Venice: the direct `web_fetch` follow-up rail is temporarily
+disabled as described above.
 
 ```sh
-# discover + read: search finds the doc, the browser fetches it (under browser.* policy)
-venice code --web-search --browser --auto \
+# discover: search returns an answer and its cited URLs
+venice code --web-search --auto \
   "The stripe SDK call is failing with an idempotency error — look up the fix and apply it."
 ```
 
@@ -1020,7 +986,7 @@ venice memory tasks              # the project checklist (--status filters)
 - **Locations:** project notes/tasks at `<root>/.venice/memory/` (git-ignored by default,
   like the semantic index); global notes at `~/.config/venice/memory/`
   (`$VENICE_MEMORY_DIR` overrides). All store files are `0600`.
-- **Hygiene (CLAUDE.md):** a note **name** is refused if it's secret-shaped
+- **Hygiene (AGENTS.md):** a note **name** is refused if it's secret-shaped
   (`credentials`, `id_rsa*`, `*.key`, `.env`, `*secrets*`, …), so the store can't be used
   to label or stash a credential.
 - **Not exposed over `venice mcp-serve`** (chat/code only), like the browser rails.
@@ -1425,7 +1391,7 @@ jq '.usage.billed_total' ~/.config/venice/sessions/<id>.json
 | `run` | run a shell command (`/bin/sh -c`) at the **active** root | yes |
 | `attach_root` | register another directory as a project root (for work spanning repos) and, by default, switch the active root into it so relative paths and `run`/`git` follow — writes outside the writable roots fail loudly | no |
 | `venice_image` / `venice_image_edit` / `venice_sfx` / `venice_music` / `venice_tts` / `venice_upscale` / `venice_bg_remove` / `venice_video` | generate/edit images, audio & video into the project — **opt-in with `--assets`** | yes |
-| `web_fetch` / `browser_capture` | fetch a URL (text/HTML) or headless-render a page (post-JS DOM + screenshot) to verify its own work — **opt-in with `--browser`** (see [Web & browser tools](#web--browser-tools---browser)) | no |
+| `web_fetch` / `browser_capture` | temporarily unavailable for security; not advertised to the agent (see [Web & browser tools](#web--browser-tools---browser)) | no |
 | `memory_write` / `memory_read` / `memory_search` / `memory_list` | durable notes the agent recalls across turns/sessions (two tiers: project + global) — **opt-in with `--memory`** (see [Memory & tasks](#memory--tasks---memory)) | no |
 | `task_add` / `task_update` / `task_list` | a project-only checklist the agent tracks (`pending`/`in_progress`/`done`) — **opt-in with `--memory`** | no |
 | `venice_scout` | delegate a read-only investigation to a disposable subagent with a fresh context; returns a structured report so exploration doesn't pollute the main context — **opt-in with `--scout`** (see [Scout subagent](#scout-subagent---scout)) | no |
@@ -1463,7 +1429,7 @@ it unrestricted (unchanged behavior).
 | `--max-tool-calls N` | cap tool invocations before forcing a final answer (default 25) |
 | `--exec-timeout SECS` | timeout for `run`/`git` (default 120) |
 | `--shell-allow CMD` / `--shell-deny PATTERN` | scope the `run` tool with the shared allow/deny policy (repeatable; adds to config `shell.*`) |
-| `--browser` / `--browser-allow HOST` / `--browser-deny PATTERN` | expose `web_fetch` + `browser_capture` so the agent can verify a rendered page; scope hosts with the `browser.*` allow/deny policy (see [Web & browser tools](#web--browser-tools---browser)) |
+| `--browser` / `--browser-allow HOST` / `--browser-deny PATTERN` | compatibility flags for the security-disabled browser rail; `--browser` exits 2 without network access (see [Web & browser tools](#web--browser-tools---browser)) |
 | `--assets` | also expose the in-process asset-generation tools (image / image-edit / sfx / music / tts / upscale / bg-remove / video) so the agent can create images, audio & video in the project; paid — each confirms per call unless `--auto` |
 | `--scout` | expose `venice_scout`: delegate a read-only investigation to a disposable subagent with a fresh context; keeps exploration out of the main context (see [Scout subagent](#scout-subagent---scout)) |
 | `--spawn` | expose `venice_spawn`: delegate a bounded **write/paid** task to a disposable **worker** subagent with a fresh context and a role-scoped subset of your tools; edit churn stays quarantined and it returns a structured report to merge (see [Worker subagent](#worker-subagent---spawn)) |
@@ -1471,7 +1437,7 @@ it unrestricted (unchanged behavior).
 | `--subagent-max-tokens N` | per-subagent cap on the cumulative prompt+completion **tokens** a `venice_scout` **or** `venice_spawn` subagent spends across its turns (default **off**; `<= 0` disables); once crossed the subagent is asked to wrap up and its report carries the token count. A cumulative-usage ceiling, **not** a context-window size limit, and distinct from `--max-tokens` (per-turn output); config `defaults.code.subagent_max_tokens` |
 | `--planner` | planner harness: implies `--scout --spawn --memory`, mandates the decompose → dispatch → track → **merge** protocol, and adds `venice_merge` — a consolidated rollup of every dispatch (see [Planner harness](#planner-harness---planner)) |
 | `--parallel` | dispatch **independent** `venice_scout`/`venice_spawn` subagents **concurrently** (bounded pool) instead of one at a time, so a planner's independent units overlap in wall-clock; opt-in, serial otherwise; config `defaults.code.parallel` (see [Parallel dispatch](#parallel-dispatch---parallel)) |
-| `--web-search` / `--web-search-model MODEL` | expose `venice_web_search` so the agent can **discover** documentation on the web (answer + cited URLs); pairs with `--browser` to then read a cited page under the `browser.*` policy (see [Web search](#web-search---web-search)) |
+| `--web-search` / `--web-search-model MODEL` | expose `venice_web_search` so the agent can **discover** documentation on the web (answer + cited URLs; see [Web search](#web-search---web-search)) |
 | `--review` | expose `venice_review`: hand the current diff to a **cold-context reviewer** (fresh context, read-only tools, a different model where one exists) and fix what it reports before handing work back. Capped at **3 reviews per session**. Findings only — a review is not a merge gate (see [Reviewer rail](#reviewer-rail---review)) |
 | `--review-model MODEL` | model for `--review` (default: a function-calling model from a **different family** than the coding model; falls back to the coding model with a warning); config `defaults.code.review_model` |
 | `--review-rounds N` | passes `venice_review` makes over the same diff (default **1**, max 3); config `defaults.code.review_rounds` |

venice_cli-0.83.2/src/venice/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.83.2"

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/client.py

@@ -70,7 +70,6 @@ class VeniceClient:
             url += "?" + urllib.parse.urlencode(params, doseq=True)
 
         headers = {
-            "Authorization": f"Bearer {self.api_key}",
             "Accept": "application/json, audio/*, image/*, video/*",
             "User-Agent": self.user_agent,
         }
@@ -80,6 +79,12 @@ class VeniceClient:
             headers["Content-Type"] = "application/json"
 
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        # Bind the credential to this request.  urllib copies regular headers
+        # when it constructs a redirected request, but deliberately leaves
+        # unredirected headers behind.
+        req.add_unredirected_header(
+            "Authorization", f"Bearer {self.api_key}"
+        )
         try:
             with urllib.request.urlopen(req, timeout=self.timeout) as resp:
                 body = resp.read()

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_agent.py

@@ -1695,8 +1695,8 @@ def dispatch_map(tools: List[Tool]) -> Dict[str, Tool]:
 
 # --------------------------------------------------------------------------- #
 # Web search (#77): one server-side Venice completion with `enable_web_search`, so
-# the coding agent / scout can DISCOVER documentation -- not just fetch a URL it
-# already knows (the `--browser` rail, #71). Rides the normal completion path (same
+# the coding agent / scout can DISCOVER documentation and return citations. Rides the
+# normal completion path (same
 # key, same billing), so the per-agent tool-call budget bounds it. The `venice_web_search`
 # rail Tool wrapper + `supportsWebSearch` model resolution live in `_code`; this module
 # owns only the profile-agnostic completion helper.
@@ -2435,67 +2435,13 @@ def _tool_section(name: str) -> str:
     return name[len("venice_"):] if name.startswith("venice_") else name
 
 
-def _browser_args(arguments) -> dict:
-    """Model-supplied browser-tool args with policy/loop-controlled keys stripped: the
-    model must not set `allow`/`deny` (widen its URL policy) or the loop-controlled keys."""
-    return {k: v for k, v in _clean(arguments).items() if k not in ("allow", "deny")}
-
-
 def browser_tools(*, allow=(), deny=(), output_dir=None, config=None) -> List[Tool]:
-    """The `web_fetch` + `browser_capture` rails (issue #71).
+    """Return no browser tools while the browser rail is security-disabled.
 
-    The URL allow/deny policy is bound HERE (from the operator's config/flags), so the
-    model can't widen it via tool arguments -- same discipline as the `shell` rail. Safe
-    knobs still honor `defaults.browser.*` (#58), layered under the model's arguments.
-    Both tools are free (no spend gate) and never require confirmation; the URL policy is
-    the guard.
+    Keep this compatibility seam so callers cannot accidentally re-expose the direct
+    tool implementations while GHSA-mqjr-2vh8-6fvg is contained.
     """
-    fetch_defaults = userconfig.config_defaults_for("browser", _mcp.web_fetch_tool, config)
-    cap_defaults = userconfig.config_defaults_for("browser", _mcp.browser_capture_tool, config)
-
-    def _web_fetch_invoke(arguments, *, confirm: bool = False):
-        return _mcp.web_fetch_tool(
-            allow=allow, deny=deny, **{**fetch_defaults, **_browser_args(arguments)})
-
-    def _browser_capture_invoke(arguments, *, confirm: bool = False):
-        return _mcp.browser_capture_tool(
-            allow=allow, deny=deny, output_dir=output_dir,
-            **{**cap_defaults, **_browser_args(arguments)})
-
-    return [
-        Tool(
-            name="web_fetch",
-            description=(
-                "Fetch an http(s) URL with stdlib urllib and return its text (mode=text, "
-                "default) or raw HTML (mode=html). Zero-dep; good for non-SPA pages. For "
-                "JS-rendered pages use browser_capture. Read-only; not spend-gated. "
-                "file://, the cloud metadata endpoint, and any host the operator denies "
-                "are refused."
-            ),
-            parameters=_WEB_FETCH_SCHEMA,
-            invoke=_web_fetch_invoke,
-            paid=False,
-            category="web",
-            tags=("read", "network"),
-        ),
-        Tool(
-            name="browser_capture",
-            description=(
-                "Headless-render an http(s) URL and return the post-JS DOM (mode=dom/text) "
-                "and/or a screenshot PNG path (mode=screenshot/both) -- use it to verify a "
-                "page's JS-injected content actually appeared. Pass assert_contains to "
-                "check the DOM contains a substring (deterministic). DOM modes need a "
-                "Chromium-family browser (Firefox is screenshot-only); reports 'no "
-                "headless browser available' when none is installed. Read-only; not "
-                "spend-gated."
-            ),
-            parameters=_BROWSER_CAPTURE_SCHEMA,
-            invoke=_browser_capture_invoke,
-            paid=False,
-            category="web",
-            tags=("read", "network"),
-        ),
-    ]
+    return []
 
 
 def memory_tools() -> List[Tool]:
@@ -2646,8 +2592,8 @@ def builtin_tools(
     rail, not a venice API tool, so it isn't part of the selectable `_BUILTINS`
     set) and is never exposed via `mcp-serve`, which builds its own wrappers.
 
-    `browser` (issue #71) likewise appends the `web_fetch`/`browser_capture` rails,
-    scoped by the `browser_allow`/`browser_deny` URL policy (see `browser_tools`).
+    `browser` (issue #71) is retained as a compatibility argument but appends no tools
+    while GHSA-mqjr-2vh8-6fvg is contained (see `browser_tools`).
 
     `memory` (issue #49) appends the persistent memory + task rails (`memory_tools`):
     free, local notes (two tiers) + a project task list. Also a rail (added after the

venice_cli-0.83.2/src/venice/commands/_browser.py

@@ -0,0 +1,29 @@
+"""Fail-closed browser rail containment.
+
+The former implementation launched a headless browser after checking only the
+initial URL. Redirects, DNS resolution, subresources, and page-script requests
+then escaped that policy boundary. Until the rail has an enforced egress
+boundary, keep every entry point unavailable and dependency-free.
+"""
+from __future__ import annotations
+
+
+UNAVAILABLE_MESSAGE = (
+    "web and browser tools are temporarily disabled for security; "
+    "see GHSA-mqjr-2vh8-6fvg"
+)
+
+
+def web_fetch(
+    url, *, mode="text", max_bytes=None, timeout=None, allow=(), deny=()
+) -> dict:
+    """Fail closed without parsing, resolving, or opening ``url``."""
+    return {"ok": False, "error": UNAVAILABLE_MESSAGE}
+
+
+def capture(
+    url, *, out_path=None, mode="dom", wait_ms=None, window=None,
+    timeout=None, assert_contains=None, allow=(), deny=(),
+) -> dict:
+    """Fail closed without probing or launching a browser."""
+    return {"ok": False, "error": UNAVAILABLE_MESSAGE}

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_code.py

@@ -812,8 +812,8 @@ def code_tools(
     Empty lists leave `run` unrestricted (only the confirm gate), preserving the prior
     behavior of autonomous `venice code` runs.
 
-    `browser` (#71) appends the `web_fetch`/`browser_capture` rails, scoped by the
-    `browser_allow`/`browser_deny` URL policy (see `_agent.browser_tools`).
+    `browser` (#71) is retained for call compatibility but appends no tools while
+    GHSA-mqjr-2vh8-6fvg is contained (see `_agent.browser_tools`).
 
     `memory` (#49) appends the persistent memory + task rails (`_agent.memory_tools`):
     free, local notes (two tiers) + a project task list the agent maintains across
@@ -956,8 +956,8 @@ def code_tools(
         ))
 
     if browser:
-        # web_fetch/browser_capture rails (#71): no Venice API, so no client needed.
-        # Screenshots land in $VENICE_MCP_OUTPUT_DIR or under the project root.
+        # Compatibility seam only: browser_tools returns [] while the rail is disabled
+        # for GHSA-mqjr-2vh8-6fvg.
         tools.extend(_agent.browser_tools(
             allow=browser_allow, deny=browser_deny,
             output_dir=os.environ.get("VENICE_MCP_OUTPUT_DIR") or root,
@@ -1135,9 +1135,8 @@ def web_search_tool(oai, model: str, *, models=None, search_model=None,
 
     Makes one Venice web-search completion (via `_agent.run_web_search`) against a
     `supportsWebSearch` model and returns the answer plus the cited URLs. The agent
-    follows a citation with `web_fetch` (the `--browser` rail, #71), which keeps every
-    fetched URL under the operator's `browser.*` policy -- search discovers, the browser
-    policy governs what gets read.
+    returns citations for the operator to inspect. The former direct `web_fetch` follow-up
+    rail is disabled while GHSA-mqjr-2vh8-6fvg is contained.
 
     `paid=False` mirrors `venice_chat` (a bounded, billed sub-completion, not a media
     purchase): it MUST be free so a read-only SCOUT can carry it (`_agent.run_scout`
@@ -1181,9 +1180,8 @@ def web_search_tool(oai, model: str, *, models=None, search_model=None,
         _agent.WEB_SEARCH_TOOL_NAME,
         "Search the web for documentation or answers and get back a short summary plus "
         "the source URLs it cited. Use it to DISCOVER pages you do not already have a URL "
-        "for (API docs, library usage, an error message). To read a cited page in full, "
-        "follow up with web_fetch (needs --browser). Read-only; cannot edit files or run "
-        "commands.",
+        "for (API docs, library usage, an error message). Read-only; cannot edit files "
+        "or run commands.",
         _agent._WEB_SEARCH_SCHEMA, invoke, paid=False,
         category="web", tags=("read", "network"),
     )

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_exec.py

@@ -37,7 +37,7 @@ from typing import Optional
 MAX_OUTPUT_CHARS = 20_000                      # cap per stdout/stderr stream
 DEFAULT_EXEC_TIMEOUT = 120                     # seconds
 
-# Secrets never inherited into an exec'd child (CLAUDE.md credential hygiene).
+# Secrets never inherited into an exec'd child (AGENTS.md credential hygiene).
 _SECRET_ENV = ("VENICE_API_KEY", "VENICE_EMBED_API_KEY")
 
 # Substrings that turn `/bin/sh -c` into more than a single simple command. When an

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_index.py

@@ -61,7 +61,7 @@ _DIR_DENYLIST = frozenset({
     "env", ".idea", ".vscode", "dist", "build", ".egg-info",
 })
 
-# Exact filenames never indexed (credential/secret-shaped -- CLAUDE.md invariant).
+# Exact filenames never indexed (credential/secret-shaped -- AGENTS.md invariant).
 _SECRET_NAMES = frozenset({"credentials", ".env", ".netrc", ".pgpass"})
 # Glob patterns (matched on basename) never indexed.
 _SECRET_GLOBS = (

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_mailbox.py

@@ -18,7 +18,7 @@ channel):
 * Consumed in ``(mtime, name)`` order and deleted on read; a queued message
   survives an agent restart -- ``--resume`` drains it on the loop's first turn.
 
-Trust model (CLAUDE.md): a steer is *additive user input* at the same trust level
+Trust model (AGENTS.md): a steer is *additive user input* at the same trust level
 as the original task author. The mailbox is a local, owner-only directory, NOT a
 remote-control channel; nothing here reads or writes the API key.
 """

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_mcp.py

@@ -1205,32 +1205,8 @@ def web_fetch_tool(
     url, *, mode: str = "text", max_bytes: Optional[int] = None,
     timeout: Optional[int] = None, allow=(), deny=(),
 ) -> dict:
-    """Fetch an http(s) URL with stdlib urllib and return its text or raw HTML (issue #71).
-
-    Read-only, no browser, zero extra deps -- good for non-SPA "read this page". For
-    JS-rendered pages use `browser_capture`. Not spend-gated. URL safety: only http/https,
-    the cloud metadata endpoint is always blocked, redirects are re-checked against the
-    policy, and the operator's browser allow/deny globs apply. `allow`/`deny` are supplied
-    by the tool wiring (bound from config), never by the model.
-    """
-    if not url or not str(url).strip():
-        return _err("web_fetch: url is required")
-    res = _browser.web_fetch(str(url), mode=(mode or "text"), max_bytes=max_bytes,
-                             timeout=timeout, allow=allow, deny=deny)
-    if not res.get("ok"):
-        return _err(f"web_fetch: {res.get('error', 'failed')}")
-    out = {
-        "status": "ok",
-        "url": str(url),
-        "final_url": res.get("final_url"),
-        "content_type": res.get("content_type"),
-        "truncated": res.get("truncated", False),
-    }
-    if "text" in res:
-        out["text"] = res["text"]
-    if "html" in res:
-        out["html"] = res["html"]
-    return out
+    """Fail closed while the browser rail has no enforced egress boundary."""
+    return _err(f"web_fetch: {_browser.UNAVAILABLE_MESSAGE}")
 
 
 def browser_capture_tool(
@@ -1238,48 +1214,8 @@ def browser_capture_tool(
     assert_contains: Optional[str] = None, output_dir: Optional[str] = None,
     allow=(), deny=(),
 ) -> dict:
-    """Headless-render an http(s) URL: post-JS DOM and/or a screenshot PNG (issue #71).
-
-    Chromium-family browsers (chromium/chrome/brave) give a post-JS DOM (mode `dom`/`text`)
-    and/or a screenshot; Firefox is a screenshot-only fallback. Writes any screenshot to the
-    output dir and returns its PATH (never an inline blob, like `venice_image`); returns the
-    DOM inline (capped). Pass `assert_contains` to deterministically check the rendered DOM
-    contains a substring -- the robust "did the JS land" check (beats eyeballing a shot).
-    Degrades gracefully ("no headless browser available") when no browser is installed. Not
-    spend-gated. URL safety mirrors `web_fetch`; `allow`/`deny` come from the wiring, not the
-    model.
-    """
-    if not url or not str(url).strip():
-        return _err("browser_capture: url is required")
-    m = mode or "dom"
-    out_path = None
-    if m in ("screenshot", "both"):
-        out_dir = resolve_output_dir(output_dir)
-        try:
-            out_dir.mkdir(parents=True, exist_ok=True)
-        except OSError as e:
-            return _err(f"browser_capture: cannot create output dir {out_dir}: {e}")
-        out_path = str(out_dir / _browser.capture_filename(url))
-    res = _browser.capture(str(url), out_path=out_path, mode=m, wait_ms=wait_ms,
-                           timeout=timeout, assert_contains=assert_contains,
-                           allow=allow, deny=deny)
-    if not res.get("ok"):
-        return _err(f"browser_capture: {res.get('error', 'failed')}")
-    out = {"status": "ok", "url": str(url), "mode": m,
-           "browser": res.get("browser"), "family": res.get("family")}
-    if res.get("screenshot_path"):
-        out["screenshot_path"] = res["screenshot_path"]
-    if "dom" in res:
-        out["dom"] = res["dom"]
-        out["truncated"] = res.get("truncated", False)
-    if "contains" in res:
-        out["assert_contains"] = res.get("assert_contains")
-        out["contains"] = res["contains"]
-    elif assert_contains is not None:
-        out["assert_contains"] = str(assert_contains)
-        out["contains"] = None
-        out["note"] = "assert_contains needs a DOM (mode dom/text/both on a Chromium browser)"
-    return out
+    """Fail closed while the browser rail has no enforced egress boundary."""
+    return _err(f"browser_capture: {_browser.UNAVAILABLE_MESSAGE}")
 
 
 def models_tool(client, *, type: str) -> dict:

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_memory.py

@@ -28,7 +28,7 @@ file. The lock is **in-process only**: two separate ``venice`` processes writing
 store remain last-writer-wins (like ``secrets.json`` / ``sessions`` / the index) -- guard
 that with per-entry files or an OS lock if it ever becomes real; callers need not change.
 
-Hygiene (CLAUDE.md): an entry NAME is validated like a persona/secret name (no
+Hygiene (AGENTS.md): an entry NAME is validated like a persona/secret name (no
 traversal) and refused if secret-shaped (``is_secret_path``) so the store can't be
 used to label/stash credentials; the name is only ever a dict key, so there is no
 filesystem-path surface. The store lives under ``.venice/`` -- already pruned by

{venice_cli-0.83.0 → venice_cli-0.83.2}/src/venice/commands/_repl.py

@@ -17,7 +17,7 @@ Slash-commands (minimal set): ``/system`` ``/model`` ``/reset`` ``/save``
 ``/exit`` (plus ``/help`` and the ``/quit`` alias). Transcripts round-trip as a
 JSON list of messages via ``--resume FILE`` and ``/save``.
 
-Secret hygiene (CLAUDE.md): the REPL prints only model output and message
+Secret hygiene (AGENTS.md): the REPL prints only model output and message
 content; it never echoes the API key. A saved transcript holds only the
 ``messages`` array (roles + content), never auth material.
 """