[Security] Enforce DNS-pinned browser policy across redirects and subresources

[fettpl]

Summary

Enforce one fail-closed network policy across interactive Playwright browsing and reading mode. Every hostname is resolved and every returned IPv4/IPv6 address is classified before a connection is allowed. Public browsing remains public-only; an explicitly selected loopback page may reach loopback or public destinations, but never LAN, link-local, metadata-like, multicast, documentation, or other special-use ranges.

The final implementation is adapted to main's Playwright browser architecture. Chromium is forced through mode-specific local pinning proxies, with no implicit loopback bypass, while Playwright HTTP and WebSocket routes provide an additional preflight guard. The proxy performs the authoritative resolve-and-dial operation, connects only to the selected address, preserves the original Host and TLS SNI, and never disables certificate verification.

Closes #235

Final design

• Extend the shared browser URL contract with typed public and loopback modes plus complete IPv4/IPv6 special-use classification, including mapped IPv4 forms and malformed or zoned IPv6 rejection.
• Fail closed on resolver errors, timeouts, empty answers, malformed answers, mixed address classes, and any address incompatible with the page's initial mode.
• Launch mode-specific Playwright persistent contexts with service workers blocked, QUIC disabled, non-proxied WebRTC disabled, and the implicit Chromium loopback proxy bypass removed.
• Guard HTTP(S) and WebSocket requests in Playwright, then route HTTP, HTTPS CONNECT, and WebSocket traffic through a local proxy that resolves once per connection and dials only the approved address.
• Retain the top-level trust mode across redirects, frames, images, scripts, fetch/XHR, EventSource, workers, downloads, service-worker attempts, and WebSockets.
• Serialize context transitions and navigation with Effect semaphores. A trust-mode change must confirm the previous context is closed before replacement; a rejected or timed-out revocation poisons the manager and prevents a second context from launching.
• Bind BrowserHost pages to a context generation, clear stale pages on replacement, make shutdown terminal and idempotent, and recheck terminal state after both context creation and asynchronous page creation so no page is published after stop().
• Make reading-mode redirects consume the same policy and pin every transport connection while retaining existing byte, redirect, and timeout limits.

Validation

• Final reviewed commit: 480a9dbcafe3c6b2c37159794679fe1fd37f908b.
• npm --prefix services/agent-runtime run build: passed.
• Focused BrowserHost concurrency suite: 8/8 passed, including shutdown during context creation and page creation.
• npm run test:integration: 27/27 passed. This includes real Playwright zero-connection coverage for redirects and browser request classes, proxy HTTP/CONNECT/WebSocket pinning, reader redirect pinning, context revocation/poisoning, and BrowserHost races.
• Real-browser regression confirmed blocked destinations accepted zero connections, allowed public/loopback dials preserved the original host, trust-mode replacement changed context generation, and service-worker registration could not escape the policy.
• npm --prefix frontend run check:quality: passed, including package integrity, ESLint, frontend and desktop typechecks, cycle/UI/dead-code/duplicate/dependency checks, runtime bundle, and production Next.js build.
• Shared-contract and repository-structure gates passed. The controller typecheck/lint/knip/jscpd/depcheck/standards gate passed after installing the current frozen controller dependencies.
• git diff --check: passed; final worktree is clean.
• npm --prefix frontend run test: 31/31 passed.
• npm --prefix frontend run desktop:dist: passed and produced the macOS DMG and ZIP.
• A Developer ID identity was unavailable locally, so signing was skipped by the packaging workflow; no release asset was published.
• Canonical /Applications/Local Studio.app bundle identifier: org.local.studio.desktop.
• Canonical app reinstall and relaunch passed; GET /api/desktop-health returned HTTP 200 with {"ok":true}.
• Packaged policy acceptance drove both a public 302 redirect and a public HTML subresource toward a counted loopback canary; the canary recorded exactly 0 TCP connections and 0 HTTP requests.
• Independent P0/P1 review approved exact commit 480a9dbcafe3c6b2c37159794679fe1fd37f908b with no findings after inspecting address classification, fail-closed DNS behavior, proxy pinning and bypass resistance, Playwright guards, reader redirects, revocation poisoning, and shutdown races.

UI changes

No intentional visual changes. Existing browser controls select a protected public or explicit-loopback context from the entered URL, and the visible page remains bound to the active protected context generation.

Risks and rollout notes

• Public browsing now fails closed when a destination cannot be proven public. This can surface previously silent DNS or network-policy failures as blocked navigation.
• Explicit loopback mode grants loopback and public access only; redirects and page scripts cannot upgrade a public context or reach private-network ranges.
• The proxy does not terminate HTTPS. TLS verification remains end to end, with the original hostname preserved for certificate validation and SNI.
• Trust-mode replacement is deliberately conservative: failure to confirm revocation permanently blocks relaunch in that manager instance.
• The special-use address table and Chromium request-class coverage are security-sensitive and should be extended with tests before policy changes.