feat(browser): prove pristine Agent Task profile admission - #136
feat(browser): prove pristine Agent Task profile admission#136seonghobae wants to merge 9 commits into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| def _probe_agent_task_ambient_state(driver_port: int, session_id: str) -> dict[str, bool]: | ||
| """Require no browser-visible cookies or Web Storage before the controlled action.""" | ||
|
|
||
| cookies = _json_request( | ||
| driver_port, | ||
| "GET", | ||
| _webdriver_path(session_id, "/cookie"), | ||
| ).get("value") | ||
| if not isinstance(cookies, list): | ||
| raise RuntimeError("Agent Task cookie inspection returned malformed evidence") | ||
| if cookies: | ||
| raise RuntimeError("Agent Task profile exposed ambient cookies") | ||
|
|
||
| storage = _execute( | ||
| driver_port, | ||
| session_id, | ||
| """ | ||
| return { | ||
| localStorageLength: window.localStorage.length, | ||
| sessionStorageLength: window.sessionStorage.length | ||
| }; | ||
| """, | ||
| ) | ||
| if not isinstance(storage, dict): | ||
| raise RuntimeError("Agent Task Web Storage inspection returned malformed evidence") | ||
| local_storage_length = storage.get("localStorageLength") | ||
| session_storage_length = storage.get("sessionStorageLength") | ||
| for value in (local_storage_length, session_storage_length): | ||
| if isinstance(value, bool) or not isinstance(value, int) or value < 0: | ||
| raise RuntimeError("Agent Task Web Storage inspection returned malformed evidence") | ||
| if local_storage_length or session_storage_length: | ||
| raise RuntimeError("Agent Task profile exposed ambient Web Storage") | ||
| return { | ||
| "ambient_cookies_absent": True, | ||
| "ambient_web_storage_absent": True, | ||
| } |
There was a problem hiding this comment.
📝 Info: Ambient-state probe is origin-scoped only
_probe_agent_task_ambient_state reads cookies via GET /cookie and Web Storage from the current document, both scoped to the fixture origin. State belonging to other origins in a reused profile goes undetected. Harmless here since the profile is a fresh empty tempdir enforced by _require_pristine_agent_task_profile, and the PR's Truth boundary acknowledges this limit.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Partial implementation of #28, stacked on the current canonical forced-close prerequisite PR #132.
Buyer/security gap
The pinned-Chromium Agent Task used a temporary profile and disabled extensions, but the executable acceptance boundary did not prove that the profile directory was pristine before launch or that browser-visible cookies and Web Storage were empty before the controlled action. A reused or pre-populated task profile could therefore carry ambient state while still producing a superficially successful workflow. The runner also needed explicit saved-credential service disablement and one aggregate isolation gate.
Dependency
This Draft currently targets exact #132 head
0e035858298b1abefec45c8fe522f3a49f1f7bfband must remain Draft while #132 and its prerequisites remain active. A fresh comparison shows the current contributor head1cffb2e23d4002f12e8462c4c8c24f404a4eeee7is 9 commits ahead / 0 behind that exact live base, with merge base exactly0e035858298b1abefec45c8fe522f3a49f1f7bfb. No prerequisite check, review, status, artifact, coverage, mergeability, or synthetic-merge evidence transfers.TDD and RCA sequence
c9016da784d3a3cafbe8ffb84a38ca686e9e5314required explicit pristine-profile admission, ambient cookie/Web Storage inspection, saved-credential disablement, per-trial evidence, and an aggregate fail-closed isolation gate before runner support existed. CI run31648194541, Rust contracts job94286512210, failed in the Python repository-contract suite when a controlled result withprofile_pristine_before_launch = falsewas still accepted with return code 0. This is historical RED evidence only.40700a739905bf079e4dc1e43ac6d078f81974aaadded the profile-admission and ambient-state boundaries, Chrome credential-manager preferences, evidence propagation, and aggregate gate.a805af6ff8bef3e974ea3a4e0a5cdc4ec4dee30fcompleted the source/test boundary and reached exact-green.5fac5b5c61462f415caadb98a2428907acc0c745added a release-note entry, but semantic review found that its initial wording overclaimed a browser-observed extension count that the implementation does not collect.Implemented contract
The controlled Agent Task runner now:
credentials_enable_service = falseandprofile.password_manager_enabled = false;--disable-extensionslaunch policy;localStorage.lengthandsessionStorage.lengthin the controlled page and fails closed unless both are valid non-negative integers equal to zero;Hostile tests cover a pre-populated profile, ambient cookies, ambient local storage, malformed probe behavior, missing isolation evidence, and exact configuration/gate wiring.
Exact-current proof
On unchanged exact head
1cffb2e23d4002f12e8462c4c8c24f404a4eeee7against exact live prerequisite0e035858298b1abefec45c8fe522f3a49f1f7bfb:31942708821: success;95154082914: exact-head checkout path, repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;95154082895: exact-head checkout path and exact owned production function/line/region/branch enforcement success;31942708783: success;No SAST or Security Scan result is claimed for this exact stacked head because its exact-head workflow inventory exposes only CI and Manifest V3 Compatibility. No predecessor/prerequisite check, status, review, synthetic merge, queued/skipped/cancelled evidence, or model output is promoted as current-head proof.
Truth boundary
This is controlled compatibility/acceptance evidence, not a general browser-attestation mechanism. It does not inspect the human browser profile, prove absence of every Chrome credential store, service worker, cache, IndexedDB, filesystem artifact, operating-system keychain entry, enterprise policy, injected browser component, or out-of-process influence. It does not authenticate the browser/adapter process, authorize Agent actions, disclose secrets, or complete #28. Extensions are disabled by reviewed launch policy; no browser-observed extension-count claim is made.
Protected-main
AGENTS.mdremains authoritative. This scheduled writer does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, tag, release, or publish.