feat: add fail-closed command inspection with Veltra

IT
11d ago
+862-1

Agent-generated shell commands currently have no configurable inspection step at the shared process boundary. This adds an opt-in BUT_COMMAND_GUARD executable that receives the proposed argv, working directory, per-command environment overrides, and call ID as JSON before a process starts. It must exit successfully with an explicit {"continue":true} verdict. Denials, malformed output, checker failures, oversized responses, and timeouts prevent execution. Cancellation interrupts a pending check. Nonempty write_stdin calls are checked too; output polling is unchanged.

Includes a local adapter for veltra-agent==0.4.0, using its command, filesystem, outbound-port, and environment-leak checks without executing the submitted payload. The adapter ignores task-controlled policy files and removes temporary audit data. It rejects interactive input because checking independent fragments can miss a command split across writes. It also rejects per-command environment overrides, whose execution effects Veltra's text checks cannot validate. Setup, UTF-8 configuration for Windows, the checker contract, and detection limits are documented in docs/command-guard.md; no new default dependency is required.

Invalid guard configuration and checker failures report fixed diagnostic categories without forwarding raw checker output or command secrets. The adapter distinguishes operational failures from ordinary policy denials through its exit status.

Related to browser-use/browser-use#6119. The beta Python agent delegates its built-in shell tools to this Rust core, so enforcement belongs here. The hosted scan URL was rechecked on 18 October 2026 after the author reported a route fix: synthetic POSTs still return HTTP 404 while the health endpoint returns HTTP 200, and the published OpenAPI schema has no scan route. This adapter continues to use the published local inspection functions. Details and the request for a corrected deployment are in https://github.com/browser-use/browser-use/issues/6119#issuecomment-6247441498.

Validation:

  • Eight focused Rust guard tests pass, including denial before side effects, environment payload fidelity, prompt cancellation, and valid JSON responses at/above the 8 KiB boundary.
  • The end-to-end Rust test with the real Veltra package passes.
  • All 48 Python tests pass on Windows and Linux, including the optional Veltra cases, UTF-8 input under legacy stdin encoding, environment overrides, and exact 1 MiB / 1 MiB + 1 byte boundaries.
  • Rust formatting, the new Python adapter's lint/format checks, and whitespace checks pass.
  • cargo test --workspace --no-fail-fast is not green: the agent crate has six existing prompt/browser-recovery failures, and the browser crate has an existing wait-default assertion failure followed by poisoned-lock failures. The seven root failures reproduce on a clean checkout of upstream 16cdd3a; those files are unchanged by this PR.