Add inspected agent viewport export with policy-bound final release
This commit is contained in:
Karl committed
1 parent
c8b6ff9cdd
commit
e7d778aeac
24 files changed
+483
-32
No files matched your search
@@ -0,0 +1,101 @@
|
||||
# Inspected page viewport export for local agents
|
||||
|
||||
Administrators separately enable the `screenshot` action scope in the signed
|
||||
central baseline and individual grant. The capability starts unchecked; new
|
||||
grants start disabled with no scopes. Destination restrictions, expiry,
|
||||
generation rotation and targeted revocation still apply. Remove the scope or
|
||||
disable agents and publish to revoke access once the policy reaches the browser.
|
||||
Policy changes must follow the configured independent review workflow; auditor
|
||||
controls are read-only.
|
||||
|
||||
The action accepts only an optional native `sessionId`. Omission captures the
|
||||
foreground tab once; explicitly selecting a background tab is refused. Its
|
||||
internal transport scope is `browser:screenshot`. A successful protected reply
|
||||
has exactly these fields:
|
||||
|
||||
```json
|
||||
{"mime":"image/png","width":1280,"height":720,"data":"<canonical base64 PNG>"}
|
||||
```
|
||||
|
||||
This exports the current foreground managed HTTPS webpage viewport. There is no
|
||||
clip rectangle, resizing, full-page scroll capture, offscreen target, desktop,
|
||||
other-window or browser-chrome capture API. PNG bytes are bounded to 2 MiB,
|
||||
dimensions to 4096 each, and pixels to 8 Mi. The example describes the reply shape,
|
||||
not a real image. Agents receive sensitive image data and must handle it as such;
|
||||
this API does not authorize onward cloud transfer.
|
||||
|
||||
Before and after capture/inspection, privileged code checks the current native
|
||||
context, document/view revision, actor/generation, policy, destination,
|
||||
foreground identity and cancellation. Returning to the same URL or tab does not
|
||||
restore a changed context. A fixed isolated-world probe rejects credential,
|
||||
card and authentication-bearing controls, including hidden/offscreen controls.
|
||||
Open shadow trees are recursively observed; queued mutation records are drained
|
||||
before comparison, and newly discovered roots advance the revision. Native closed/declarative shadow roots and child
|
||||
frames are initially refused; their presence is a compatibility limitation, not
|
||||
an implicit permission to capture their pixels.
|
||||
|
||||
Local image inspection with complete OCR coverage is mandatory. Enabled central
|
||||
YARA and semantic checks, plus upload ICAP when configured, remain required.
|
||||
The exact bounded PNG is inspected before return; byte binding and repeated
|
||||
context probes prevent reuse of a changed buffer or inspected context.
|
||||
An opaque private release guard, absent from the API projection, rechecks the
|
||||
original policy, native frame/process/routing identity, loading state, context
|
||||
token, actor and foreground activation after final authorization/encryption and
|
||||
immediately before the protected reply is sent. Legacy callers receive the same
|
||||
original-context check.
|
||||
|
||||
`allowSensitiveRead` does not override visual inspection. Unavailable required
|
||||
inspection, incomplete coverage, sensitive content or changed authority denies
|
||||
the export. Disabling supplemental manual document scanning does not grant this
|
||||
capability or waive required inspection.
|
||||
|
||||
OCR/classifiers can miss rendered secrets, tiny text, image-based secrets or
|
||||
steganography and can produce false positives. Complete reported OCR coverage is
|
||||
not proof of absence of confidential information. Shadow/frame refusals do not
|
||||
establish a universal browser side-channel guarantee. No claim is made for arbitrary
|
||||
animated pages, accessibility surfaces, OS overlays or independent security review.
|
||||
|
||||
Security audit records fixed action/scope/outcome/session/principal metadata.
|
||||
Only required image chunks and a supported standard sRGB marker are accepted;
|
||||
arbitrary ancillary text/EXIF/profile metadata are refused. The successful reply
|
||||
is encrypted on the wire, but the trusted helper decrypts it for its caller. Byte
|
||||
buffers are wiped best effort; immutable base64 strings and caller copies cannot
|
||||
be guaranteed erased.
|
||||
|
||||
PNG/base64, OCR text, page URLs and extracted secrets must not enter ordinary
|
||||
audit or diagnostic fields. Named debug stages cover probe, capture, local and
|
||||
enterprise inspection and audit. Diagnostics are separately centrally disableable;
|
||||
a failed export is not permission to retry a protected operation automatically.
|
||||
|
||||
## Verification status
|
||||
|
||||
The central unchecked capability and individual-grant/read-only controls have
|
||||
focused UI tests. The actual Windows/Electron admin fixture proves separate
|
||||
author/reviewer publication, self-approval denial, auditor read-only controls and
|
||||
reviewed removal from both baseline and grant at version 5. All 200 completed API
|
||||
requests exported parent-correlated backend spans; no requests failed. Evidence:
|
||||
`artifacts/agent-grants-history-admin-proof.json` and
|
||||
`artifacts/agent-grants-history-admin-traces.json`.
|
||||
|
||||
The first expanded fixture runs exceeded the shared IP rate bucket because their
|
||||
short synthetic cookie values did not meet the real per-session bucket length
|
||||
criteria. The fixture now uses realistic-length synthetic capabilities; production
|
||||
rate limits and deadlines were not weakened. Those failed diagnostics are retained.
|
||||
|
||||
The existing actual Windows/Electron proof exercised public viewport export,
|
||||
mandatory OCR even with supplemental document scanning disabled, confidential
|
||||
canvas rejection, mandatory PNG antivirus rejection, offscreen sensitive controls,
|
||||
closed shadows, public open shadows, child frames, foreground/policy races and
|
||||
central revocation (`artifacts/agent-visual-export-native-proof.json`).
|
||||
The latest native run also rejects a policy change after classification despite
|
||||
remaining screenshot/grant/host permissions, a foreground change after helper
|
||||
return and an open-shadow mutation/revert. Its final release remains a child of
|
||||
the outer request. Trace `aad45c8a85f25619a233b78e132d7bad` contains all eight
|
||||
visual stages; final release took 0.2507 ms. ICAP recorded 26 scans, five PNG scans
|
||||
and one expected block; the protected collector rejected no writes.
|
||||
|
||||
695 tests and syntax checks pass (`artifacts/agent-visual-final-suite.log`,
|
||||
`artifacts/agent-visual-final-syntax.log`). The final stable Windows build and exact packaged-source/runtime verification pass
|
||||
(`artifacts/agent-visual-release-windows-build.log`,
|
||||
`artifacts/agent-visual-final-package-proof.log`). The executable remains `NotSigned`. These narrow proofs do not establish universal secret detection
|
||||
or independent security certification.
|
||||
@@ -193,3 +193,32 @@ fragments rather than relying on all-values concatenation. Current trace
|
||||
collector rejected writes remain zero. Evidence: `artifacts/controlled-login-native-proof.json`
|
||||
and `artifacts/controlled-login-receiver-proof-native.log`. Earlier native failures
|
||||
and the prior successful proof remain distinct local evidence.
|
||||
|
||||
|
||||
The screenshot increment used actual traces to separate capture, structural PNG
|
||||
validation, OCR, enterprise inspection, audit, projection and final release.
|
||||
The first native run (`2a2507264480c9ed8fdb585a5608d292`) spent 6953.918 ms in
|
||||
local inspection, with OCR 6469.757 ms, capture 358.558 ms and AV 5.039 ms.
|
||||
These local cold-run observations identify OCR as the largest measured child;
|
||||
they do not prove the cause of all remaining IPC/containment overhead.
|
||||
|
||||
Independent review found unobserved open-shadow mutations and a late policy/tab
|
||||
release gap after the helper returned. Shadow roots now have private observers
|
||||
and pending-record draining; final encrypted reply requires a private actor-bound
|
||||
policy/native-frame release guard checked synchronously beside reply. Latest
|
||||
native trace `aad45c8a85f25619a233b78e132d7bad` verifies eight stages. The final
|
||||
`visual.release` takes 0.2507 ms under the outer agent request; the seven helper
|
||||
stages retain the inner screenshot action ancestry. Real tests reclassify the
|
||||
page while retaining the screenshot grants, switch the foreground after helper
|
||||
return and mutate/revert open-shadow content; all suppress image delivery.
|
||||
|
||||
The native fixture also proves real contained OCR of a confidential canvas,
|
||||
mandatory ICAP PNG blocking and secret exclusion from ordinary ECS/OTLP output.
|
||||
Five PNG AV scans include one expected block; collector rejected writes are zero.
|
||||
Real OTLP regression tests prove responsible-stage ERROR status, redaction and
|
||||
central disable. No pixels, encoded images, raw DOM attributes or extracted OCR
|
||||
text are diagnostic attributes. The local receiver is protected and bounded,
|
||||
not a production forensic archive. The admin fixture's earlier 429 failure came
|
||||
from short synthetic cookies sharing the IP bucket; realistic-length synthetic
|
||||
capabilities resolved it without changing production limits. Its subsequent
|
||||
200 completed API requests all have correlated traces.
|
||||
@@ -3,8 +3,8 @@
|
||||
## Aktuelle nächste Abnahmen
|
||||
|
||||
Gespeicherte Agent-Sitzungen und kontrollierte Credential-Vorbereitung sind für
|
||||
ihre dokumentierten nativen Pfade integriert und nachgewiesen. Der aktuelle
|
||||
Abgleich umfasst 668 bestandene Tests, Syntaxprüfung, stabilen Windows-Build,
|
||||
ihre dokumentierten nativen Pfade integriert und nachgewiesen. Die vorangegangene
|
||||
Controlled-Login-Abnahme umfasste 668 bestandene Tests, Syntaxprüfung, stabilen Windows-Build,
|
||||
exakten Paket-/Runtime-Vergleich und den abschließenden Receiver-/Trace-Proof
|
||||
(`artifacts/controlled-login-final-suite.log`,
|
||||
`artifacts/controlled-login-final-syntax.log`,
|
||||
@@ -12,8 +12,14 @@ exakten Paket-/Runtime-Vergleich und den abschließenden Receiver-/Trace-Proof
|
||||
`artifacts/controlled-login-final-package-proof.log`,
|
||||
`artifacts/controlled-login-native-proof.json`). Das Executable ist unsigniert.
|
||||
|
||||
Nächste Implementierungsabnahmen: sicher geprüfter visueller Agent-Export,
|
||||
beweisbare Actor-Ownership für Hintergrund-Worker, breitere lokale Medienprüfung,
|
||||
Der aktuelle begrenzte Visual-Export-Increment besteht mit 695 Tests, Syntax und
|
||||
dem abschließenden nativen Late-Policy-/Foreground-/Shadow-Proof. Der aktuelle
|
||||
Windows-Build und der exakte Paket-/Runtime-Vergleich bestehen ebenfalls. Nachweise:
|
||||
`artifacts/agent-visual-final-suite.log`, `artifacts/agent-visual-final-syntax.log`,
|
||||
`artifacts/agent-visual-export-native-proof.json`,
|
||||
`artifacts/agent-visual-release-windows-build.log`, `artifacts/agent-visual-final-package-proof.log`.
|
||||
|
||||
Nächste Implementierungsabnahmen nach dieser Prüfung: beweisbare Actor-Ownership für Hintergrund-Worker, breitere lokale Medienprüfung,
|
||||
vollständige Analysten-Inhaltsbelege und weitergehende Datei-/Admin-Steuerung.
|
||||
Bereits vorhanden sind begrenzte geschützte Browser-Metadaten und eine
|
||||
zweckgebundene Analystenansicht; vollständige Aufzeichnung oder Replay bleiben
|
||||
@@ -89,7 +95,9 @@ Windows zuerst: einen zentral verwalteten Browser mit lokaler Inhaltsprüfung, f
|
||||
|
||||
| KI als First Class, kontrolliertes Gateway | Teilweise | `apps/server/app.mjs`, `inspection.mjs`, Browser-AI-UI, `tests/enterprise-gateway.test.mjs`: freigegebene lokale Ollama/kompatible Provider, serverseitige Credentials, Prompt-/Outputprüfung. Kein vollständiges Berechtigungs-RAG, Modellinventar, Provider-Tenantnachweis oder umfassendes KI-Tool-Autorisierungsmodell. |
|
||||
|
||||
| Lokale Agenten steuern Sessions | Teilweise; geschützte unterstützte Aktionen geprüft | Individuelle zentral genehmigte Identitäten, Generation/Expiry, Zielhostbindung, DPAPI-Pairing, ML-KEM-1024/AES-GCM und gepinnte Ed25519/ML-DSA-87-Challenges, HMAC/Replay-Abwehr. Native Tab-UUIDs, Seiteninteraktion, Inspektion, Bookmarks, Appearance, gruppierte Tabs, geprüfte History-Navigation und begrenzte Fenstersteuerung sowie menschenentsperrtes Vault-Autofill, separat kontrollierte Login-Vorbereitung und verschlüsselte gespeicherte Sitzungen implementiert. `docs/individual-agent-grants.md`, `docs/agent-history-window.md`, `docs/agent-vault-controls.md`, `docs/agent-session-controls.md`, `docs/controlled-credential-policy.md`, jeweilige echte Native-Proofs. Sichere Screenshots, Datei-/Vault-Mutationen, umfassende Widgets und attribuierte Worker-Steuerung bleiben offen; keine freie JS/CDP- oder Credential-Export-API. |
|
||||
| Lokale Agenten steuern Sessions | Teilweise; geschützte unterstützte Aktionen geprüft | Individuelle zentral genehmigte Identitäten, Generation/Expiry, Zielhostbindung, DPAPI-Pairing, ML-KEM-1024/AES-GCM und gepinnte Ed25519/ML-DSA-87-Challenges, HMAC/Replay-Abwehr. Native Tab-UUIDs, Seiteninteraktion, Inspektion, Bookmarks, Appearance, gruppierte Tabs, geprüfte History-Navigation und begrenzte Fenstersteuerung sowie menschenentsperrtes Vault-Autofill, separat kontrollierte Login-Vorbereitung und verschlüsselte gespeicherte Sitzungen implementiert. `docs/individual-agent-grants.md`, `docs/agent-history-window.md`, `docs/agent-vault-controls.md`, `docs/agent-session-controls.md`, `docs/controlled-credential-policy.md`, jeweilige echte Native-Proofs. Begrenzter geprüfter Foreground-PNG-Export ist implementiert (`apps/browser/agent-visual-export.cjs`, `agent-visual-probe.cjs`, `docs/agent-visual-export.md`); aktueller 695-Test-/Native-Proof bestanden; Build/Paket noch ausstehend. Vollständige visuelle Erfassung, Datei-/Vault-Mutationen, umfassende Widgets und attribuierte Worker-Steuerung bleiben offen; keine freie JS/CDP- oder Credential-Export-API. |
|
||||
| Kontrollierter visueller Agent-Export | Eng begrenzt nativ geprüft; aktueller Build/Paket ausstehend | `apps/browser/agent-visual-export.cjs`, `agent-visual-probe.cjs`, `agent-control.cjs`, `docs/agent-visual-export.md`: optional native Session-ID, foreground HTTPS-Viewport, kanonischer PNG (2 MiB/4096/8 Mi Pixel), Pflicht-OCR und konfigurierte Scanner, kein Sensitive-Read-Override. Credential/Card/Auth-Controls auch verborgen/offscreen verweigert; Open-Shadow-Mutationen beobachtet/drained, neue Roots revisioniert; geschlossene Roots und alle Childframes blockiert. Privater Release-Guard prüft ursprüngliche Policy/Frame/Process/Routing/Loading/Token/Actor/Foreground vor finalem verschlüsseltem Reply, auch Legacy. Keine Desktop-/Chrome-/Resize-/Fullpage-API; PNG-Payload/Extraktionsdaten nicht in gewöhnlichen Logs, Buffer-Wipe nur best effort. Aktueller Late-Policy-/Foreground-/Open-Shadow-Race-Proof in `artifacts/agent-visual-export-native-proof.json`, 695 Tests und Syntax bestehen; Windows-Build/Paket noch zu verifizieren. |
|
||||
|
||||
| Verschlüsselte gespeicherte Sitzungen | Native Integration und finales Windows-Paket geprüft | `session-snapshot.cjs`, `agent-session-adapters.cjs`, `session-restore.cjs`, `docs/agent-session-controls.md`: benannte lokale URL/Titel/Gruppen-Sammlungen, Gerät/Principal/Generation-Bindung, DLP vor Save/List/Restore, CAS und einmalige Restore-Pläne. Echter Zwei-Prozess-Windows-Proof mit erhaltenen bestehenden Tabs; keine Formulare, Passwörter oder pageState. Kein Cross-Device-Sync oder vollständiges Session-Backup. |
|
||||
|
||||
| Passwortmanager mit Post-Quantum-Kryptografie | Teilweise | `apps/browser/vault.cjs`, `password-fill.cjs`, `tests/vault.test.mjs`, `tests/password-fill.test.mjs`: ML-KEM-1024/AES-GCM/scrypt und Windows-DPAPI, Idle-/Blur-Lock, gebundene HTTPS-Formfüllung. Separat default-off kontrollierter nativer Login-POST in `apps/browser/credential-submission.cjs`, `tests/controlled-login-audit.test.mjs`, `artifacts/controlled-login-native-proof.json`; Vorbereitung sendet nicht. Gefüllte Passwörter sind für die freigegebene Webseite/deren JavaScript im DOM lesbar; keine Passwort-Isolation oder beliebige JS-Login-Unterstützung. Kein Sync/Recovery/Passkeys, keine unabhängige Kryptografieprüfung oder FIPS-Modulvalidierung. |
|
||||
@@ -800,3 +808,33 @@ Collector meldet null abgewiesene Schreibvorgänge. Diese kontrollierten Fixture
|
||||
beweisen ihre Szenarien; sie schließen weder Worker-Ownership noch allgemeine
|
||||
JavaScript-Logins, Passwort-Isolation, vollständige Exfiltrationsabdeckung oder
|
||||
die ursprünglichen Produktions-/Kundenabnahmen. Das Gesamtziel bleibt offen.
|
||||
|
||||
|
||||
## Visual-Export-Increment: aktuelle native Abnahme und Paketprüfung
|
||||
|
||||
Die tatsächliche Admin-UI prüfte `screenshot` unchecked, getrennte Baseline-/Grant-
|
||||
Freigabe, Read-only-Auditor und geprüften Widerruf beider Scopes als v5. Alle 200
|
||||
abgeschlossenen API-Requests exportierten Parent-korrelierte Traces. Frühere
|
||||
Fixture-Fehler durch kurze synthetische Sessioncookies im gemeinsamen IP-Bucket
|
||||
bleiben dokumentiert; realistische Cookie-Längen korrigierten nur das Fixture,
|
||||
keine Produktionslimits/Deadlines.
|
||||
|
||||
Die neue begrenzte Pixel-API und der letzte native Release-/Policy-/Shadow-Proof
|
||||
sind bestanden. 695 Tests und Syntaxprüfung bestehen. Trace
|
||||
`aad45c8a85f25619a233b78e132d7bad` enthält alle acht benannten Visual-Stufen;
|
||||
der endgültige Release liegt unter dem äußeren Request und dauert 0,2507 ms.
|
||||
Policyänderung nach Klassifikation bei verbleibenden Screenshot-/Grant-/Hostrechten,
|
||||
Foreground-Wechsel nach Helper-Rückkehr und Open-Shadow-Mutation mit Rückänderung
|
||||
verweigern Pixel. ICAP: 26 Scans, fünf PNG-Scans, ein erwarteter Block. Collector:
|
||||
42,7 MB aktiv, null abgewiesene Writes. Der stabile Windows-Build und exakte
|
||||
Paket-/Runtime-Vergleich bestehen ebenfalls. OCR-Falschnegative,
|
||||
Steganografie, Frame-/Closed-Shadow-Kompatibilität, vollständige Visual-Coverage,
|
||||
Worker-Ownership und alle Produktions-/Kunden-Gates bleiben Grenzen. Aktuelle
|
||||
Proof-Ergebnisse stammen aus terminal abgeschlossenen Läufen.
|
||||
|
||||
|
||||
Der finale stabile Windows-Build und der exakte Paket-/Runtime-Vergleich des
|
||||
aktuellen Visual-Export-Codes bestehen: `artifacts/agent-visual-release-windows-build.log`
|
||||
und `artifacts/agent-visual-final-package-proof.log`. Syntax und alle 695 Tests
|
||||
bestehen. Das Executable bleibt `NotSigned`; Installer-/Update-Signierung und
|
||||
Produktionsabnahmen sind damit nicht abgeschlossen.
|
||||
Reference in new issue
Block a user