fix(security): CSS injection guard, timeout clamping, session validation, tests (#806)

Community PR #806 by @mr-k-man (security audit round 2, new parts only).

- CSS value validation (DANGEROUS_CSS) in cdp-inspector, write-commands, extension inspector
- Queue file permissions (0o700/0o600) in cli, server, sidebar-agent
- escapeRegExp for frame --url ReDoS fix
- Responsive screenshot path validation with validateOutputPath
- State load cookie filtering (reject localhost/.internal/metadata cookies)
- Session ID format validation in loadSession
- /health endpoint: remove currentUrl and currentMessage fields
- QueueEntry interface + isValidQueueEntry validator for sidebar-agent
- SIGTERM->SIGKILL escalation in timeout handler
- Viewport dimension clamping (1-16384), wait timeout clamping (1s-300s)
- Cookie domain validation in cookie-import and cookie-import-browser
- DocumentFragment-based tab switching (XSS fix in sidepanel)
- pollInProgress reentrancy guard for pollChat
- toggleClass/injectCSS input validation in extension inspector
- Snapshot annotated path validation with realpathSync
- 714-line security-audit-r2.test.ts + 33-line learnings-injection.test.ts

Co-Authored-By: mr-k-man <mr-k-man@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

browse/src/browser-manager.ts

@@ -826,11 +826,11 @@ export class BrowserManager {
         // a tampered URL could navigate to cloud metadata endpoints or file:// URIs.
         try {
           await validateNavigationUrl(saved.url);
-          await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {});
-        } catch {
-          // Invalid URL in saved state — skip navigation, leave blank page
-          console.log(`[browse] restoreState: skipping unsafe URL: ${saved.url}`);
+        } catch (err: any) {
+          console.warn(`[browse] Skipping invalid URL in state file: ${saved.url} — ${err.message}`);
+          continue;
         }
+        await page.goto(saved.url, { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {});
       }
 
       if (saved.storage) {

browse/src/cdp-inspector.ts

@@ -472,6 +472,12 @@ export async function modifyStyle(
     throw new Error(`Invalid CSS property name: ${property}. Only letters and hyphens allowed.`);
   }
 
+  // Validate CSS value — block data exfiltration patterns
+  const DANGEROUS_CSS = /url\s*\(|expression\s*\(|@import|javascript:|data:/i;
+  if (DANGEROUS_CSS.test(value)) {
+    throw new Error('CSS value rejected: contains potentially dangerous pattern.');
+  }
+
   let oldValue = '';
   let source = 'inline';
   let sourceLine = 0;

browse/src/cli.ts

@@ -588,7 +588,10 @@ Refs:           After 'snapshot', use @e1, @e2... as selectors:
         }
         // Clear old agent queue
         const agentQueue = path.join(process.env.HOME || '/tmp', '.gstack', 'sidebar-agent-queue.jsonl');
-        try { fs.writeFileSync(agentQueue, ''); } catch {}
+        try {
+          fs.mkdirSync(path.dirname(agentQueue), { recursive: true, mode: 0o700 });
+          fs.writeFileSync(agentQueue, '', { mode: 0o600 });
+        } catch {}
 
         // Resolve browse binary path the same way — execPath-relative
         let browseBin = path.resolve(__dirname, '..', 'dist', 'browse');

browse/src/meta-commands.ts

@@ -44,6 +44,11 @@ export function validateOutputPath(filePath: string): void {
   }
 }
 
+/** Escape special regex metacharacters in a user-supplied string to prevent ReDoS. */
+export function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 /** Tokenize a pipe segment respecting double-quoted strings. */
 function tokenizePipeSegment(segment: string): string[] {
   const tokens: string[] = [];
@@ -214,9 +219,10 @@ export async function handleMetaCommand(
 
       for (const vp of viewports) {
         await page.setViewportSize({ width: vp.width, height: vp.height });
-        const path = `${prefix}-${vp.name}.png`;
-        await page.screenshot({ path, fullPage: true });
-        results.push(`${vp.name} (${vp.width}x${vp.height}): ${path}`);
+        const screenshotPath = `${prefix}-${vp.name}.png`;
+        validateOutputPath(screenshotPath);
+        await page.screenshot({ path: screenshotPath, fullPage: true });
+        results.push(`${vp.name} (${vp.width}x${vp.height}): ${screenshotPath}`);
       }
 
       // Restore original viewport
@@ -257,7 +263,11 @@ export async function handleMetaCommand(
         try {
           let result: string;
           if (WRITE_COMMANDS.has(name)) {
-            result = await handleWriteCommand(name, cmdArgs, bm);
+            if (bm.isWatching()) {
+              result = 'BLOCKED: write commands disabled in watch mode';
+            } else {
+              result = await handleWriteCommand(name, cmdArgs, bm);
+            }
             lastWasWrite = true;
           } else if (READ_COMMANDS.has(name)) {
             result = await handleReadCommand(name, cmdArgs, bm);
@@ -462,8 +472,8 @@ export async function handleMetaCommand(
 
       for (const msg of messages) {
         const ts = msg.timestamp ? `[${msg.timestamp}]` : '[unknown]';
-        lines.push(`${ts} ${msg.url}`);
-        lines.push(`  "${msg.userMessage}"`);
+        lines.push(`${ts} ${wrapUntrustedContent(msg.url, 'inbox-url')}`);
+        lines.push(`  "${wrapUntrustedContent(msg.userMessage, 'inbox-message')}"`);
         lines.push('');
       }
 
@@ -514,6 +524,18 @@ export async function handleMetaCommand(
         if (!Array.isArray(data.cookies) || !Array.isArray(data.pages)) {
           throw new Error('Invalid state file: expected cookies and pages arrays');
         }
+        // Validate and filter cookies — reject malformed or internal-network cookies
+        const validatedCookies = data.cookies.filter((c: any) => {
+          if (typeof c !== 'object' || !c) return false;
+          if (typeof c.name !== 'string' || typeof c.value !== 'string') return false;
+          if (typeof c.domain !== 'string' || !c.domain) return false;
+          const d = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
+          if (d === 'localhost' || d.endsWith('.internal') || d === '169.254.169.254') return false;
+          return true;
+        });
+        if (validatedCookies.length < data.cookies.length) {
+          console.warn(`[browse] Filtered ${data.cookies.length - validatedCookies.length} invalid cookies from state file`);
+        }
         // Warn on state files older than 7 days
         if (data.savedAt) {
           const ageMs = Date.now() - new Date(data.savedAt).getTime();
@@ -526,7 +548,7 @@ export async function handleMetaCommand(
         bm.setFrame(null);
         await bm.closeAllPages();
         await bm.restoreState({
-          cookies: data.cookies,
+          cookies: validatedCookies,
           pages: data.pages.map((p: any) => ({ ...p, storage: null })),
         });
         return `State loaded: ${data.cookies.length} cookies, ${data.pages.length} pages`;
@@ -554,7 +576,7 @@ export async function handleMetaCommand(
         frame = page.frame({ name: args[1] });
       } else if (target === '--url') {
         if (!args[1]) throw new Error('Usage: frame --url <pattern>');
-        frame = page.frame({ url: new RegExp(args[1]) });
+        frame = page.frame({ url: new RegExp(escapeRegExp(args[1])) });
       } else {
         // CSS selector or @ref for the iframe element
         const resolved = await bm.resolveRef(target);

browse/src/server.ts

@@ -282,6 +282,10 @@ function loadSession(): SidebarSession | null {
   try {
     const activeFile = path.join(SESSIONS_DIR, 'active.json');
     const activeData = JSON.parse(fs.readFileSync(activeFile, 'utf-8'));
+    if (typeof activeData.id !== 'string' || !/^[a-zA-Z0-9_-]+$/.test(activeData.id)) {
+      console.warn('[browse] Invalid session ID in active.json — ignoring');
+      return null;
+    }
     const sessionFile = path.join(SESSIONS_DIR, activeData.id, 'session.json');
     const session = JSON.parse(fs.readFileSync(sessionFile, 'utf-8')) as SidebarSession;
     // Validate worktree still exists — crash may have left stale path
@@ -560,6 +564,7 @@ function spawnClaude(userMessage: string, extensionUrl?: string | null, forTabId
   try {
     fs.mkdirSync(gstackDir, { recursive: true, mode: 0o700 });
     fs.appendFileSync(agentQueue, entry + '\n');
+    try { fs.chmodSync(agentQueue, 0o600); } catch {}
   } catch (err: any) {
     addChatEntry({ ts: new Date().toISOString(), role: 'agent', type: 'agent_error', error: `Failed to queue: ${err.message}` });
     agentStatus = 'idle';
@@ -1117,7 +1122,6 @@ async function start() {
           mode: browserManager.getConnectionMode(),
           uptime: Math.floor((Date.now() - startTime) / 1000),
           tabs: browserManager.getTabCount(),
-          currentUrl: browserManager.getCurrentUrl(),
           // Auth token for extension bootstrap. Safe: /health is localhost-only.
           // Previously served unconditionally, but that leaks the token if the
           // server is tunneled to the internet (ngrok, SSH tunnel).
@@ -1130,7 +1134,6 @@ async function start() {
           agent: {
             status: agentStatus,
             runningFor: agentStartTime ? Date.now() - agentStartTime : null,
-            currentMessage,
             queueLength: messageQueue.length,
           },
           session: sidebarSession ? { id: sidebarSession.id, name: sidebarSession.name } : null,
@@ -1251,9 +1254,10 @@ async function start() {
         }
         try {
           // Sync active tab from Chrome extension — detects manual tab switches
-          const activeUrl = url.searchParams.get('activeUrl');
-          if (activeUrl) {
-            browserManager.syncActiveTabByUrl(activeUrl);
+          const rawActiveUrl = url.searchParams.get('activeUrl');
+          const sanitizedActiveUrl = sanitizeExtensionUrl(rawActiveUrl);
+          if (sanitizedActiveUrl) {
+            browserManager.syncActiveTabByUrl(sanitizedActiveUrl);
           }
           const tabs = await browserManager.getTabListWithTitles();
           return new Response(JSON.stringify({ tabs }), {
@@ -1322,11 +1326,12 @@ async function start() {
         // The Chrome extension sends the active tab's URL — prefer it over
         // Playwright's page.url() which can be stale in headed mode when
         // the user navigates manually.
-        const extensionUrl = body.activeTabUrl || null;
+        const rawExtensionUrl = body.activeTabUrl || null;
+        const sanitizedExtUrl = sanitizeExtensionUrl(rawExtensionUrl);
         // Sync active tab BEFORE reading the ID — the user may have switched
         // tabs manually and the server's activeTabId is stale.
-        if (extensionUrl) {
-          browserManager.syncActiveTabByUrl(extensionUrl);
+        if (sanitizedExtUrl) {
+          browserManager.syncActiveTabByUrl(sanitizedExtUrl);
         }
         const msgTabId = browserManager?.getActiveTabId?.() ?? 0;
         const ts = new Date().toISOString();
@@ -1336,12 +1341,12 @@ async function start() {
         // Per-tab agent: each tab can run its own agent concurrently
         const tabState = getTabAgent(msgTabId);
         if (tabState.status === 'idle') {
-          spawnClaude(msg, extensionUrl, msgTabId);
+          spawnClaude(msg, sanitizedExtUrl, msgTabId);
           return new Response(JSON.stringify({ ok: true, processing: true }), {
             status: 200, headers: { 'Content-Type': 'application/json' },
           });
         } else if (tabState.queue.length < MAX_QUEUE) {
-          tabState.queue.push({ message: msg, ts, extensionUrl });
+          tabState.queue.push({ message: msg, ts, extensionUrl: sanitizedExtUrl });
           return new Response(JSON.stringify({ ok: true, queued: true, position: tabState.queue.length }), {
             status: 200, headers: { 'Content-Type': 'application/json' },
           });

browse/src/sidebar-agent.ts

@@ -25,6 +25,38 @@ function cancelFileForTab(tabId: number): string {
   return path.join(CANCEL_DIR, `sidebar-agent-cancel-${tabId}`);
 }
 
+interface QueueEntry {
+  prompt: string;
+  args?: string[];
+  stateFile?: string;
+  cwd?: string;
+  tabId?: number | null;
+  message?: string | null;
+  pageUrl?: string | null;
+  sessionId?: string | null;
+  ts?: string;
+}
+
+function isValidQueueEntry(e: unknown): e is QueueEntry {
+  if (typeof e !== 'object' || e === null) return false;
+  const obj = e as Record<string, unknown>;
+  if (typeof obj.prompt !== 'string' || obj.prompt.length === 0) return false;
+  if (obj.args !== undefined && (!Array.isArray(obj.args) || !obj.args.every(a => typeof a === 'string'))) return false;
+  if (obj.stateFile !== undefined) {
+    if (typeof obj.stateFile !== 'string') return false;
+    if (obj.stateFile.includes('..')) return false;
+  }
+  if (obj.cwd !== undefined) {
+    if (typeof obj.cwd !== 'string') return false;
+    if (obj.cwd.includes('..')) return false;
+  }
+  if (obj.tabId !== undefined && obj.tabId !== null && typeof obj.tabId !== 'number') return false;
+  if (obj.message !== undefined && obj.message !== null && typeof obj.message !== 'string') return false;
+  if (obj.pageUrl !== undefined && obj.pageUrl !== null && typeof obj.pageUrl !== 'string') return false;
+  if (obj.sessionId !== undefined && obj.sessionId !== null && typeof obj.sessionId !== 'string') return false;
+  return true;
+}
+
 let lastLine = 0;
 let authToken: string | null = null;
 // Per-tab processing — each tab can run its own agent concurrently
@@ -234,7 +266,7 @@ async function handleStreamEvent(event: any, tabId?: number): Promise<void> {
   }
 }
 
-async function askClaude(queueEntry: any): Promise<void> {
+async function askClaude(queueEntry: QueueEntry): Promise<void> {
   const { prompt, args, stateFile, cwd, tabId } = queueEntry;
   const tid = tabId ?? 0;
 
@@ -350,9 +382,10 @@ async function askClaude(queueEntry: any): Promise<void> {
     // Timeout (default 300s / 5 min — multi-page tasks need time)
     const timeoutMs = parseInt(process.env.SIDEBAR_AGENT_TIMEOUT || '300000', 10);
     setTimeout(() => {
-      try { proc.kill(); } catch (killErr: any) {
+      try { proc.kill('SIGTERM'); } catch (killErr: any) {
         console.warn(`[sidebar-agent] Tab ${tid}: Failed to kill timed-out process:`, killErr.message);
       }
+      setTimeout(() => { try { proc.kill('SIGKILL'); } catch {} }, 3000);
       const timeoutMsg = stderrBuffer.trim()
         ? `Timed out after ${timeoutMs / 1000}s\nstderr: ${stderrBuffer.trim().slice(-500)}`
         : `Timed out after ${timeoutMs / 1000}s`;
@@ -394,12 +427,16 @@ async function poll() {
     const line = readLine(lastLine);
     if (!line) continue;
 
-    let entry: any;
-    try { entry = JSON.parse(line); } catch (err: any) {
+    let parsed: unknown;
+    try { parsed = JSON.parse(line); } catch (err: any) {
       console.warn(`[sidebar-agent] Skipping malformed queue entry at line ${lastLine}:`, line.slice(0, 80), err.message);
       continue;
     }
-    if (!entry.message && !entry.prompt) continue;
+    if (!isValidQueueEntry(parsed)) {
+      console.warn(`[sidebar-agent] Skipping invalid queue entry at line ${lastLine}: failed schema validation`);
+      continue;
+    }
+    const entry = parsed;
 
     const tid = entry.tabId ?? 0;
     // Skip if this tab already has an agent running — server queues per-tab
@@ -443,6 +480,7 @@ async function main() {
   const dir = path.dirname(QUEUE);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   if (!fs.existsSync(QUEUE)) fs.writeFileSync(QUEUE, '', { mode: 0o600 });
+  try { fs.chmodSync(QUEUE, 0o600); } catch {}
 
   lastLine = countLines();
   await refreshToken();

browse/src/snapshot.ts

@@ -313,11 +313,32 @@ export async function handleSnapshot(
   // ─── Annotated screenshot (-a) ────────────────────────────
   if (opts.annotate) {
     const screenshotPath = opts.outputPath || `${TEMP_DIR}/browse-annotated.png`;
-    // Validate output path (consistent with screenshot/pdf/responsive)
-    const resolvedPath = require('path').resolve(screenshotPath);
-    const safeDirs = [TEMP_DIR, process.cwd()];
-    if (!safeDirs.some((dir: string) => isPathWithin(resolvedPath, dir))) {
-      throw new Error(`Path must be within: ${safeDirs.join(', ')}`);
+    // Validate output path — resolve symlinks to prevent symlink traversal attacks
+    {
+      const nodePath = require('path') as typeof import('path');
+      const nodeFs = require('fs') as typeof import('fs');
+      const absolute = nodePath.resolve(screenshotPath);
+      const safeDirs = [TEMP_DIR, process.cwd()].map((d: string) => {
+        try { return nodeFs.realpathSync(d); } catch { return d; }
+      });
+      let realPath: string;
+      try {
+        realPath = nodeFs.realpathSync(absolute);
+      } catch (err: any) {
+        if (err.code === 'ENOENT') {
+          try {
+            const dir = nodeFs.realpathSync(nodePath.dirname(absolute));
+            realPath = nodePath.join(dir, nodePath.basename(absolute));
+          } catch {
+            realPath = absolute;
+          }
+        } else {
+          throw new Error(`Cannot resolve real path: ${screenshotPath} (${err.code})`);
+        }
+      }
+      if (!safeDirs.some((dir: string) => isPathWithin(realPath, dir))) {
+        throw new Error(`Path must be within: ${safeDirs.join(', ')}`);
+      }
     }
     try {
       // Inject overlay divs at each ref's bounding box

browse/src/write-commands.ts

@@ -14,7 +14,10 @@ import { TEMP_DIR, isPathWithin } from './platform';
 import { modifyStyle, undoModification, resetModifications, getModificationHistory } from './cdp-inspector';
 
 // Security: Path validation for screenshot output
-const SAFE_DIRECTORIES = [TEMP_DIR, process.cwd()];
+// Resolve safe directories through realpathSync to handle symlinks (e.g., macOS /tmp -> /private/tmp)
+const SAFE_DIRECTORIES = [TEMP_DIR, process.cwd()].map(d => {
+  try { return fs.realpathSync(d); } catch { return d; }
+});
 
 function validateOutputPath(filePath: string): void {
   const resolved = path.resolve(filePath);
@@ -326,7 +329,9 @@ export async function handleWriteCommand(
       const selector = args[0];
       if (!selector) throw new Error('Usage: browse wait <selector|--networkidle|--load|--domcontentloaded>');
       if (selector === '--networkidle') {
-        const timeout = args[1] ? parseInt(args[1], 10) : 15000;
+        const MAX_WAIT_MS = 300_000;
+        const MIN_WAIT_MS = 1_000;
+        const timeout = Math.min(Math.max(args[1] ? parseInt(args[1], 10) || MIN_WAIT_MS : 15000, MIN_WAIT_MS), MAX_WAIT_MS);
         await page.waitForLoadState('networkidle', { timeout });
         return 'Network idle';
       }
@@ -338,7 +343,9 @@ export async function handleWriteCommand(
         await page.waitForLoadState('domcontentloaded');
         return 'DOM content loaded';
       }
-      const timeout = args[1] ? parseInt(args[1], 10) : 15000;
+      const MAX_WAIT_MS = 300_000;
+      const MIN_WAIT_MS = 1_000;
+      const timeout = Math.min(Math.max(args[1] ? parseInt(args[1], 10) || MIN_WAIT_MS : 15000, MIN_WAIT_MS), MAX_WAIT_MS);
       const resolved = await bm.resolveRef(selector);
       if ('locator' in resolved) {
         await resolved.locator.waitFor({ state: 'visible', timeout });
@@ -351,7 +358,9 @@ export async function handleWriteCommand(
     case 'viewport': {
       const size = args[0];
       if (!size || !size.includes('x')) throw new Error('Usage: browse viewport <WxH> (e.g., 375x812)');
-      const [w, h] = size.split('x').map(Number);
+      const [rawW, rawH] = size.split('x').map(Number);
+      const w = Math.min(Math.max(Math.round(rawW) || 1280, 1), 16384);
+      const h = Math.min(Math.max(Math.round(rawH) || 720, 1), 16384);
       await bm.setViewport(w, h);
       return `Viewport set to ${w}x${h}`;
     }
@@ -403,7 +412,8 @@ export async function handleWriteCommand(
       for (const fp of filePaths) {
         if (!fs.existsSync(fp)) throw new Error(`File not found: ${fp}`);
         if (path.isAbsolute(fp)) {
-          const resolvedFp = path.resolve(fp);
+          let resolvedFp: string;
+          try { resolvedFp = fs.realpathSync(path.resolve(fp)); } catch { resolvedFp = path.resolve(fp); }
           if (!SAFE_DIRECTORIES.some(dir => isPathWithin(resolvedFp, dir))) {
             throw new Error(`Path must be within: ${SAFE_DIRECTORIES.join(', ')}`);
           }
@@ -468,7 +478,14 @@ export async function handleWriteCommand(
 
       for (const c of cookies) {
         if (!c.name || c.value === undefined) throw new Error('Each cookie must have "name" and "value" fields');
-        if (!c.domain) c.domain = defaultDomain;
+        if (!c.domain) {
+          c.domain = defaultDomain;
+        } else {
+          const cookieDomain = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
+          if (cookieDomain !== defaultDomain && !defaultDomain.endsWith('.' + cookieDomain)) {
+            throw new Error(`Cookie domain "${c.domain}" does not match current page domain "${defaultDomain}". Use the target site first.`);
+          }
+        }
         if (!c.path) c.path = '/';
       }
 
@@ -488,6 +505,12 @@ export async function handleWriteCommand(
       if (domainIdx !== -1 && domainIdx + 1 < args.length) {
         // Direct import mode — no UI
         const domain = args[domainIdx + 1];
+        // Validate --domain against current page hostname to prevent cross-site cookie injection
+        const pageHostname = new URL(page.url()).hostname;
+        const normalizedDomain = domain.startsWith('.') ? domain.slice(1) : domain;
+        if (normalizedDomain !== pageHostname && !pageHostname.endsWith('.' + normalizedDomain)) {
+          throw new Error(`--domain "${domain}" does not match current page domain "${pageHostname}". Navigate to the target site first.`);
+        }
         const browser = browserArg || 'comet';
         const result = await importCookies(browser, [domain], profile);
         if (result.cookies.length > 0) {
@@ -537,6 +560,12 @@ export async function handleWriteCommand(
         throw new Error(`Invalid CSS property name: ${property}. Only letters and hyphens allowed.`);
       }
 
+      // Validate CSS value — block data exfiltration patterns
+      const DANGEROUS_CSS = /url\s*\(|expression\s*\(|@import|javascript:|data:/i;
+      if (DANGEROUS_CSS.test(value)) {
+        throw new Error('CSS value rejected: contains potentially dangerous pattern.');
+      }
+
       const mod = await modifyStyle(page, selector, property, value);
       return `Style modified: ${selector} { ${property}: ${mod.oldValue || '(none)'} → ${value} } (${mod.method})`;
     }

browse/test/commands.test.ts

@@ -1577,7 +1577,8 @@ describe('Cookie import', () => {
   test('cookie-import preserves explicit domain', async () => {
     await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
     const tempFile = '/tmp/browse-test-cookies-domain.json';
-    const cookies = [{ name: 'explicit', value: 'domain', domain: 'example.com', path: '/foo' }];
+    // Domain must match page hostname (127.0.0.1) — cross-domain cookies are now rejected
+    const cookies = [{ name: 'explicit', value: 'domain', domain: '127.0.0.1', path: '/foo' }];
     fs.writeFileSync(tempFile, JSON.stringify(cookies));
 
     const result = await handleWriteCommand('cookie-import', [tempFile], bm);
@@ -1837,7 +1838,7 @@ describe('Chain with cookie-import', () => {
     await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
     const tmpCookies = '/tmp/test-chain-cookies.json';
     fs.writeFileSync(tmpCookies, JSON.stringify([
-      { name: 'chain_test', value: 'chain_value', domain: 'localhost', path: '/' }
+      { name: 'chain_test', value: 'chain_value', domain: '127.0.0.1', path: '/' }
     ]));
     try {
       const commands = JSON.stringify([

browse/test/learnings-injection.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'bun:test';
+import * as fs from 'fs';
+import * as path from 'path';
+import { spawnSync } from 'child_process';
+
+const SCRIPT_PATH = path.join(import.meta.dir, '../../bin/gstack-learnings-search');
+const SCRIPT = fs.readFileSync(SCRIPT_PATH, 'utf-8');
+const BIN_DIR = path.join(import.meta.dir, '../../bin');
+
+describe('gstack-learnings-search injection safety', () => {
+  it('must not interpolate variables into JS string literals', () => {
+    const jsBlock = SCRIPT.slice(SCRIPT.indexOf('bun -e'));
+    expect(jsBlock).not.toMatch(/const \w+ = '\$\{/);
+    expect(jsBlock).not.toMatch(/= \$\{[A-Z_]+\};/);
+    expect(jsBlock).not.toMatch(/'\$\{CROSS_PROJECT\}'/);
+  });
+
+  it('must use process.env for parameters', () => {
+    const jsBlock = SCRIPT.slice(SCRIPT.indexOf('bun -e'));
+    expect(jsBlock).toContain('process.env');
+  });
+});
+
+describe('gstack-learnings-search injection behavioral', () => {
+  it('handles single quotes in query safely', () => {
+    const result = spawnSync('bash', [
+      path.join(BIN_DIR, 'gstack-learnings-search'),
+      '--query', "test'; process.exit(99); //",
+      '--limit', '1'
+    ], { encoding: 'utf-8', timeout: 5000, env: { ...process.env, HOME: '/tmp/nonexistent-gstack-test' } });
+    expect(result.status).not.toBe(99);
+  });
+});

browse/test/security-audit-r2.test.ts

@@ -0,0 +1,717 @@
+/**
+ * Security audit round-2 tests — static source checks + behavioral verification.
+ *
+ * These tests verify that security fixes are present at the source level and
+ * behave correctly at runtime. Source-level checks guard against regressions
+ * that could silently remove a fix without breaking compilation.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'bun:test';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+// ─── Shared source reads (used across multiple test sections) ───────────────
+const META_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/meta-commands.ts'), 'utf-8');
+const WRITE_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/write-commands.ts'), 'utf-8');
+const SERVER_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/server.ts'), 'utf-8');
+const AGENT_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/sidebar-agent.ts'), 'utf-8');
+const SNAPSHOT_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/snapshot.ts'), 'utf-8');
+
+// ─── Helper ─────────────────────────────────────────────────────────────────
+
+/**
+ * Extract the source text between two string markers.
+ */
+function sliceBetween(src: string, startMarker: string, endMarker: string): string {
+  const start = src.indexOf(startMarker);
+  if (start === -1) return '';
+  const end = src.indexOf(endMarker, start + startMarker.length);
+  if (end === -1) return src.slice(start);
+  return src.slice(start, end + endMarker.length);
+}
+
+/**
+ * Extract a function body by name — finds `function name(` or `export function name(`
+ * and returns the full balanced-brace block.
+ */
+function extractFunction(src: string, name: string): string {
+  const pattern = new RegExp(`(?:export\\s+)?function\\s+${name}\\s*\\(`);
+  const match = pattern.exec(src);
+  if (!match) return '';
+  let depth = 0;
+  let inBody = false;
+  const start = match.index;
+  for (let i = start; i < src.length; i++) {
+    if (src[i] === '{') { depth++; inBody = true; }
+    else if (src[i] === '}') { depth--; }
+    if (inBody && depth === 0) return src.slice(start, i + 1);
+  }
+  return src.slice(start);
+}
+
+// ─── Task 4: Agent queue poisoning — full schema validation + permissions ───
+
+describe('Agent queue security', () => {
+  it('server queue directory must use restricted permissions', () => {
+    const queueSection = SERVER_SRC.slice(SERVER_SRC.indexOf('agentQueue'), SERVER_SRC.indexOf('agentQueue') + 2000);
+    expect(queueSection).toMatch(/0o700/);
+  });
+
+  it('sidebar-agent queue directory must use restricted permissions', () => {
+    // The mkdirSync for the queue dir lives in main() — search the main() body
+    const mainStart = AGENT_SRC.indexOf('async function main');
+    const queueSection = AGENT_SRC.slice(mainStart);
+    expect(queueSection).toMatch(/0o700/);
+  });
+
+  it('cli.ts queue file creation must use restricted permissions', () => {
+    const CLI_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/cli.ts'), 'utf-8');
+    const queueSection = CLI_SRC.slice(CLI_SRC.indexOf('queue') || 0, CLI_SRC.indexOf('queue') + 2000);
+    expect(queueSection).toMatch(/0o700|0o600|mode/);
+  });
+
+  it('queue reader must have a validator function covering all fields', () => {
+    // Extract ONLY the validator function body by walking braces
+    const validatorStart = AGENT_SRC.indexOf('function isValidQueueEntry');
+    expect(validatorStart).toBeGreaterThan(-1);
+    let depth = 0;
+    let bodyStart = AGENT_SRC.indexOf('{', validatorStart);
+    let bodyEnd = bodyStart;
+    for (let i = bodyStart; i < AGENT_SRC.length; i++) {
+      if (AGENT_SRC[i] === '{') depth++;
+      if (AGENT_SRC[i] === '}') depth--;
+      if (depth === 0) { bodyEnd = i + 1; break; }
+    }
+    const validatorBlock = AGENT_SRC.slice(validatorStart, bodyEnd);
+
+    expect(validatorBlock).toMatch(/prompt.*string/);
+    expect(validatorBlock).toMatch(/Array\.isArray/);
+    expect(validatorBlock).toMatch(/\.\./);
+    expect(validatorBlock).toContain('stateFile');
+    expect(validatorBlock).toContain('tabId');
+    expect(validatorBlock).toMatch(/number/);
+    expect(validatorBlock).toContain('null');
+    expect(validatorBlock).toContain('message');
+    expect(validatorBlock).toContain('pageUrl');
+    expect(validatorBlock).toContain('sessionId');
+  });
+});
+
+// ─── Shared source reads for CSS validator tests ────────────────────────────
+const CDP_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/cdp-inspector.ts'), 'utf-8');
+const EXTENSION_SRC = fs.readFileSync(
+  path.join(import.meta.dir, '../../extension/inspector.js'),
+  'utf-8'
+);
+
+// ─── Task 2: Shared CSS value validator ─────────────────────────────────────
+
+describe('Task 2: CSS value validator blocks dangerous patterns', () => {
+  describe('source-level checks', () => {
+    it('write-commands.ts style handler contains DANGEROUS_CSS url check', () => {
+      const styleBlock = sliceBetween(WRITE_SRC, "case 'style':", 'case \'cleanup\'');
+      expect(styleBlock).toMatch(/url\\s\*\\\(/);
+    });
+
+    it('write-commands.ts style handler blocks expression()', () => {
+      const styleBlock = sliceBetween(WRITE_SRC, "case 'style':", "case 'cleanup'");
+      expect(styleBlock).toMatch(/expression\\s\*\\\(/);
+    });
+
+    it('write-commands.ts style handler blocks @import', () => {
+      const styleBlock = sliceBetween(WRITE_SRC, "case 'style':", "case 'cleanup'");
+      expect(styleBlock).toContain('@import');
+    });
+
+    it('cdp-inspector.ts modifyStyle contains DANGEROUS_CSS url check', () => {
+      const fn = extractFunction(CDP_SRC, 'modifyStyle');
+      expect(fn).toBeTruthy();
+      expect(fn).toMatch(/url\\s\*\\\(/);
+    });
+
+    it('cdp-inspector.ts modifyStyle blocks @import', () => {
+      const fn = extractFunction(CDP_SRC, 'modifyStyle');
+      expect(fn).toContain('@import');
+    });
+
+    it('extension injectCSS validates id format', () => {
+      const fn = extractFunction(EXTENSION_SRC, 'injectCSS');
+      expect(fn).toBeTruthy();
+      // Should contain a regex test for valid id characters
+      expect(fn).toMatch(/\^?\[a-zA-Z0-9_-\]/);
+    });
+
+    it('extension injectCSS blocks dangerous CSS patterns', () => {
+      const fn = extractFunction(EXTENSION_SRC, 'injectCSS');
+      expect(fn).toMatch(/url\\s\*\\\(/);
+    });
+
+    it('extension toggleClass validates className format', () => {
+      const fn = extractFunction(EXTENSION_SRC, 'toggleClass');
+      expect(fn).toBeTruthy();
+      expect(fn).toMatch(/\^?\[a-zA-Z0-9_-\]/);
+    });
+  });
+});
+
+// ─── Task 1: Harden validateOutputPath to use realpathSync ──────────────────
+
+describe('Task 1: validateOutputPath uses realpathSync', () => {
+  describe('source-level checks', () => {
+    it('meta-commands.ts validateOutputPath contains realpathSync', () => {
+      const fn = extractFunction(META_SRC, 'validateOutputPath');
+      expect(fn).toBeTruthy();
+      expect(fn).toContain('realpathSync');
+    });
+
+    it('write-commands.ts validateOutputPath contains realpathSync', () => {
+      const fn = extractFunction(WRITE_SRC, 'validateOutputPath');
+      expect(fn).toBeTruthy();
+      expect(fn).toContain('realpathSync');
+    });
+
+    it('meta-commands.ts SAFE_DIRECTORIES resolves with realpathSync', () => {
+      const safeBlock = sliceBetween(META_SRC, 'const SAFE_DIRECTORIES', ';');
+      expect(safeBlock).toContain('realpathSync');
+    });
+
+    it('write-commands.ts SAFE_DIRECTORIES resolves with realpathSync', () => {
+      const safeBlock = sliceBetween(WRITE_SRC, 'const SAFE_DIRECTORIES', ';');
+      expect(safeBlock).toContain('realpathSync');
+    });
+  });
+
+  describe('behavioral checks', () => {
+    let tmpDir: string;
+    let symlinkPath: string;
+
+    beforeAll(() => {
+      tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-sec-test-'));
+      symlinkPath = path.join(tmpDir, 'evil-link');
+      try {
+        fs.symlinkSync('/etc', symlinkPath);
+      } catch {
+        symlinkPath = '';
+      }
+    });
+
+    afterAll(() => {
+      try {
+        if (symlinkPath) fs.unlinkSync(symlinkPath);
+        fs.rmdirSync(tmpDir);
+      } catch {
+        // best-effort cleanup
+      }
+    });
+
+    it('meta-commands validateOutputPath rejects path through /etc symlink', async () => {
+      if (!symlinkPath) {
+        console.warn('Skipping: symlink creation failed');
+        return;
+      }
+      const mod = await import('../src/meta-commands.ts');
+      const attackPath = path.join(symlinkPath, 'passwd');
+      expect(() => mod.validateOutputPath(attackPath)).toThrow();
+    });
+
+    it('realpathSync on symlink-to-/etc resolves to /etc (out of safe dirs)', () => {
+      if (!symlinkPath) {
+        console.warn('Skipping: symlink creation failed');
+        return;
+      }
+      const resolvedLink = fs.realpathSync(symlinkPath);
+      // macOS: /etc -> /private/etc
+      expect(resolvedLink).toBe(fs.realpathSync('/etc'));
+      const TEMP_DIR_VAL = process.platform === 'win32' ? os.tmpdir() : '/tmp';
+      const safeDirs = [TEMP_DIR_VAL, process.cwd()].map(d => {
+        try { return fs.realpathSync(d); } catch { return d; }
+      });
+      const passwdReal = path.join(resolvedLink, 'passwd');
+      const isSafe = safeDirs.some(d => passwdReal === d || passwdReal.startsWith(d + path.sep));
+      expect(isSafe).toBe(false);
+    });
+
+    it('meta-commands validateOutputPath accepts legitimate tmpdir paths', async () => {
+      const mod = await import('../src/meta-commands.ts');
+      // Use /tmp (which resolves to /private/tmp on macOS) — matches SAFE_DIRECTORIES
+      const tmpBase = process.platform === 'darwin' ? '/tmp' : os.tmpdir();
+      const legitimatePath = path.join(tmpBase, 'gstack-screenshot.png');
+      expect(() => mod.validateOutputPath(legitimatePath)).not.toThrow();
+    });
+
+    it('meta-commands validateOutputPath accepts paths in cwd', async () => {
+      const mod = await import('../src/meta-commands.ts');
+      const cwdPath = path.join(process.cwd(), 'output.png');
+      expect(() => mod.validateOutputPath(cwdPath)).not.toThrow();
+    });
+
+    it('meta-commands validateOutputPath rejects paths outside safe dirs', async () => {
+      const mod = await import('../src/meta-commands.ts');
+      expect(() => mod.validateOutputPath('/home/user/secret.png')).toThrow(/Path must be within/);
+      expect(() => mod.validateOutputPath('/var/log/access.log')).toThrow(/Path must be within/);
+    });
+  });
+});
+
+// ─── Round-2 review findings: applyStyle CSS check ──────────────────────────
+
+describe('Round-2 finding 1: extension applyStyle blocks dangerous CSS values', () => {
+  const INSPECTOR_SRC = fs.readFileSync(
+    path.join(import.meta.dir, '../../extension/inspector.js'),
+    'utf-8'
+  );
+
+  it('applyStyle function exists in inspector.js', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    expect(fn).toBeTruthy();
+  });
+
+  it('applyStyle validates CSS value with url() block', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    // Source contains literal regex /url\s*\(/ — match the source-level escape sequence
+    expect(fn).toMatch(/url\\s\*\\\(/);
+  });
+
+  it('applyStyle blocks expression()', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    expect(fn).toMatch(/expression\\s\*\\\(/);
+  });
+
+  it('applyStyle blocks @import', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    expect(fn).toContain('@import');
+  });
+
+  it('applyStyle blocks javascript: scheme', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    expect(fn).toContain('javascript:');
+  });
+
+  it('applyStyle blocks data: scheme', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    expect(fn).toContain('data:');
+  });
+
+  it('applyStyle value check appears before setProperty call', () => {
+    const fn = extractFunction(INSPECTOR_SRC, 'applyStyle');
+    // Check that the CSS value guard (url\s*\() appears before setProperty
+    const valueCheckIdx = fn.search(/url\\s\*\\\(/);
+    const setPropIdx = fn.indexOf('setProperty');
+    expect(valueCheckIdx).toBeGreaterThan(-1);
+    expect(setPropIdx).toBeGreaterThan(-1);
+    expect(valueCheckIdx).toBeLessThan(setPropIdx);
+  });
+});
+
+// ─── Round-2 finding 2: snapshot.ts annotated path uses realpathSync ────────
+
+describe('Round-2 finding 2: snapshot.ts annotated path uses realpathSync', () => {
+  it('snapshot.ts annotated screenshot section contains realpathSync', () => {
+    // Slice the annotated screenshot block from the source
+    const annotateStart = SNAPSHOT_SRC.indexOf('opts.annotate');
+    expect(annotateStart).toBeGreaterThan(-1);
+    const annotateBlock = SNAPSHOT_SRC.slice(annotateStart, annotateStart + 2000);
+    expect(annotateBlock).toContain('realpathSync');
+  });
+
+  it('snapshot.ts annotated path validation resolves safe dirs with realpathSync', () => {
+    const annotateStart = SNAPSHOT_SRC.indexOf('opts.annotate');
+    const annotateBlock = SNAPSHOT_SRC.slice(annotateStart, annotateStart + 2000);
+    // safeDirs array must be built with .map() that calls realpathSync
+    // Pattern: [TEMP_DIR, process.cwd()].map(...realpathSync...)
+    expect(annotateBlock).toContain('[TEMP_DIR, process.cwd()].map');
+    expect(annotateBlock).toContain('realpathSync');
+  });
+});
+
+// ─── Round-2 finding 3: stateFile path traversal check in isValidQueueEntry ─
+
+describe('Round-2 finding 3: isValidQueueEntry checks stateFile for path traversal', () => {
+  it('isValidQueueEntry checks stateFile for .. traversal sequences', () => {
+    const fn = extractFunction(AGENT_SRC, 'isValidQueueEntry');
+    expect(fn).toBeTruthy();
+    // Must check stateFile for '..' — find the stateFile block and look for '..' string
+    const stateFileIdx = fn.indexOf('stateFile');
+    expect(stateFileIdx).toBeGreaterThan(-1);
+    const stateFileBlock = fn.slice(stateFileIdx, stateFileIdx + 200);
+    // The block must contain a check for the two-dot traversal sequence
+    expect(stateFileBlock).toMatch(/'\.\.'|"\.\."|\.\./);
+  });
+
+  it('isValidQueueEntry stateFile block contains both type check and traversal check', () => {
+    const fn = extractFunction(AGENT_SRC, 'isValidQueueEntry');
+    const stateFileIdx = fn.indexOf('stateFile');
+    const stateBlock = fn.slice(stateFileIdx, stateFileIdx + 300);
+    // Must contain the type check
+    expect(stateBlock).toContain('typeof obj.stateFile');
+    // Must contain the includes('..') call
+    expect(stateBlock).toMatch(/includes\s*\(\s*['"]\.\.['"]\s*\)/);
+  });
+});
+
+// ─── Task 5: /health endpoint must not expose sensitive fields ───────────────
+
+describe('/health endpoint security', () => {
+  it('must not expose currentMessage', () => {
+    const block = sliceBetween(SERVER_SRC, "url.pathname === '/health'", "url.pathname === '/refs'");
+    expect(block).not.toContain('currentMessage');
+  });
+  it('must not expose currentUrl', () => {
+    const block = sliceBetween(SERVER_SRC, "url.pathname === '/health'", "url.pathname === '/refs'");
+    expect(block).not.toContain('currentUrl');
+  });
+});
+
+// ─── Task 6: frame --url ReDoS fix ──────────────────────────────────────────
+
+describe('frame --url ReDoS fix', () => {
+  it('frame --url section does not pass raw user input to new RegExp()', () => {
+    const block = sliceBetween(META_SRC, "target === '--url'", 'else {');
+    expect(block).not.toMatch(/new RegExp\(args\[/);
+  });
+
+  it('frame --url section uses escapeRegExp before constructing RegExp', () => {
+    const block = sliceBetween(META_SRC, "target === '--url'", 'else {');
+    expect(block).toContain('escapeRegExp');
+  });
+
+  it('escapeRegExp neutralizes catastrophic patterns (behavioral)', async () => {
+    const mod = await import('../src/meta-commands.ts');
+    const { escapeRegExp } = mod as any;
+    expect(typeof escapeRegExp).toBe('function');
+    const evil = '(a+)+$';
+    const escaped = escapeRegExp(evil);
+    const start = Date.now();
+    new RegExp(escaped).test('aaaaaaaaaaaaaaaaaaaaaaaaaaa!');
+    expect(Date.now() - start).toBeLessThan(100);
+  });
+});
+
+// ─── Task 7: watch-mode guard in chain command ───────────────────────────────
+
+describe('chain command watch-mode guard', () => {
+  it('chain loop contains isWatching() guard before write dispatch', () => {
+    const block = sliceBetween(META_SRC, 'for (const cmd of commands)', 'Wait for network to settle');
+    expect(block).toContain('isWatching');
+  });
+
+  it('chain loop BLOCKED message appears for write commands in watch mode', () => {
+    const block = sliceBetween(META_SRC, 'for (const cmd of commands)', 'Wait for network to settle');
+    expect(block).toContain('BLOCKED: write commands disabled in watch mode');
+  });
+});
+
+// ─── Task 8: Cookie domain validation ───────────────────────────────────────
+
+describe('cookie-import domain validation', () => {
+  it('cookie-import handler validates cookie domain against page domain', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'cookie-import':", "case 'cookie-import-browser':");
+    expect(block).toContain('cookieDomain');
+    expect(block).toContain('defaultDomain');
+    expect(block).toContain('does not match current page domain');
+  });
+
+  it('cookie-import-browser handler validates --domain against page hostname', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'cookie-import-browser':", "case 'style':");
+    expect(block).toContain('normalizedDomain');
+    expect(block).toContain('pageHostname');
+    expect(block).toContain('does not match current page domain');
+  });
+});
+
+// ─── Task 9: loadSession ID validation ──────────────────────────────────────
+
+describe('loadSession session ID validation', () => {
+  it('loadSession validates session ID format before using it in a path', () => {
+    const fn = extractFunction(SERVER_SRC, 'loadSession');
+    expect(fn).toBeTruthy();
+    // Must contain the alphanumeric regex guard
+    expect(fn).toMatch(/\[a-zA-Z0-9_-\]/);
+  });
+
+  it('loadSession returns null on invalid session ID', () => {
+    const fn = extractFunction(SERVER_SRC, 'loadSession');
+    const block = fn.slice(fn.indexOf('activeData.id'));
+    // Must warn and return null
+    expect(block).toContain('Invalid session ID');
+    expect(block).toContain('return null');
+  });
+});
+
+// ─── Task 10: Responsive screenshot path validation ──────────────────────────
+
+describe('Task 10: responsive screenshot path validation', () => {
+  it('responsive loop contains validateOutputPath before page.screenshot()', () => {
+    // Extract the responsive case block
+    const block = sliceBetween(META_SRC, "case 'responsive':", 'Restore original viewport');
+    expect(block).toBeTruthy();
+    expect(block).toContain('validateOutputPath');
+  });
+
+  it('responsive loop calls validateOutputPath on the per-viewport path, not just the prefix', () => {
+    const block = sliceBetween(META_SRC, 'for (const vp of viewports)', 'Restore original viewport');
+    expect(block).toContain('validateOutputPath');
+  });
+
+  it('validateOutputPath appears before page.screenshot() in the loop', () => {
+    const block = sliceBetween(META_SRC, 'for (const vp of viewports)', 'Restore original viewport');
+    const validateIdx = block.indexOf('validateOutputPath');
+    const screenshotIdx = block.indexOf('page.screenshot');
+    expect(validateIdx).toBeGreaterThan(-1);
+    expect(screenshotIdx).toBeGreaterThan(-1);
+    expect(validateIdx).toBeLessThan(screenshotIdx);
+  });
+
+  it('results.push is present in the loop block (loop structure intact)', () => {
+    const block = sliceBetween(META_SRC, 'for (const vp of viewports)', 'Restore original viewport');
+    expect(block).toContain('results.push');
+  });
+});
+
+// ─── Task 11: State load — cookie + page URL validation ──────────────────────
+
+const BROWSER_MANAGER_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/browser-manager.ts'), 'utf-8');
+
+describe('Task 11: state load cookie validation', () => {
+  it('state load block filters cookies by domain and type', () => {
+    const block = sliceBetween(META_SRC, "action === 'load'", "throw new Error('Usage: state save|load");
+    expect(block).toContain('cookie');
+    expect(block).toContain('domain');
+    expect(block).toContain('filter');
+  });
+
+  it('state load block checks for localhost and .internal in cookie domains', () => {
+    const block = sliceBetween(META_SRC, "action === 'load'", "throw new Error('Usage: state save|load");
+    expect(block).toContain('localhost');
+    expect(block).toContain('.internal');
+  });
+
+  it('state load block uses validatedCookies when calling restoreState', () => {
+    const block = sliceBetween(META_SRC, "action === 'load'", "throw new Error('Usage: state save|load");
+    expect(block).toContain('validatedCookies');
+    // Must pass validatedCookies to restoreState, not the raw data.cookies
+    const restoreIdx = block.indexOf('restoreState');
+    const restoreBlock = block.slice(restoreIdx, restoreIdx + 200);
+    expect(restoreBlock).toContain('validatedCookies');
+  });
+
+  it('browser-manager restoreState validates page URL before goto', () => {
+    // restoreState is a class method — use sliceBetween to extract the method body
+    const restoreFn = sliceBetween(BROWSER_MANAGER_SRC, 'async restoreState(', 'async recreateContext(');
+    expect(restoreFn).toBeTruthy();
+    expect(restoreFn).toContain('validateNavigationUrl');
+  });
+
+  it('browser-manager restoreState skips invalid URLs with a warning', () => {
+    const restoreFn = sliceBetween(BROWSER_MANAGER_SRC, 'async restoreState(', 'async recreateContext(');
+    expect(restoreFn).toContain('Skipping invalid URL');
+    expect(restoreFn).toContain('continue');
+  });
+
+  it('validateNavigationUrl call appears before page.goto in restoreState', () => {
+    const restoreFn = sliceBetween(BROWSER_MANAGER_SRC, 'async restoreState(', 'async recreateContext(');
+    const validateIdx = restoreFn.indexOf('validateNavigationUrl');
+    const gotoIdx = restoreFn.indexOf('page.goto');
+    expect(validateIdx).toBeGreaterThan(-1);
+    expect(gotoIdx).toBeGreaterThan(-1);
+    expect(validateIdx).toBeLessThan(gotoIdx);
+  });
+});
+
+// ─── Task 12: Validate activeTabUrl before syncActiveTabByUrl ─────────────────
+
+describe('Task 12: activeTabUrl sanitized before syncActiveTabByUrl', () => {
+  it('sidebar-tabs route sanitizes activeUrl before syncActiveTabByUrl', () => {
+    const block = sliceBetween(SERVER_SRC, "url.pathname === '/sidebar-tabs'", "url.pathname === '/sidebar-tabs/switch'");
+    expect(block).toContain('sanitizeExtensionUrl');
+    expect(block).toContain('syncActiveTabByUrl');
+    const sanitizeIdx = block.indexOf('sanitizeExtensionUrl');
+    const syncIdx = block.indexOf('syncActiveTabByUrl');
+    expect(sanitizeIdx).toBeLessThan(syncIdx);
+  });
+
+  it('sidebar-command route sanitizes extensionUrl before syncActiveTabByUrl', () => {
+    const block = sliceBetween(SERVER_SRC, "url.pathname === '/sidebar-command'", "url.pathname === '/sidebar-chat/clear'");
+    expect(block).toContain('sanitizeExtensionUrl');
+    expect(block).toContain('syncActiveTabByUrl');
+    const sanitizeIdx = block.indexOf('sanitizeExtensionUrl');
+    const syncIdx = block.indexOf('syncActiveTabByUrl');
+    expect(sanitizeIdx).toBeLessThan(syncIdx);
+  });
+
+  it('direct unsanitized syncActiveTabByUrl calls are not present (all calls go through sanitize)', () => {
+    // Every syncActiveTabByUrl call should be preceded by sanitizeExtensionUrl in the nearby code
+    // We verify there are no direct browserManager.syncActiveTabByUrl(activeUrl) or
+    // browserManager.syncActiveTabByUrl(extensionUrl) patterns (without sanitize wrapper)
+    const block1 = sliceBetween(SERVER_SRC, "url.pathname === '/sidebar-tabs'", "url.pathname === '/sidebar-tabs/switch'");
+    // Should NOT contain direct call with raw activeUrl
+    expect(block1).not.toMatch(/syncActiveTabByUrl\(activeUrl\)/);
+
+    const block2 = sliceBetween(SERVER_SRC, "url.pathname === '/sidebar-command'", "url.pathname === '/sidebar-chat/clear'");
+    // Should NOT contain direct call with raw extensionUrl
+    expect(block2).not.toMatch(/syncActiveTabByUrl\(extensionUrl\)/);
+  });
+});
+
+// ─── Task 13: Inbox output wrapped as untrusted ──────────────────────────────
+
+describe('Task 13: inbox output wrapped as untrusted content', () => {
+  it('inbox handler wraps userMessage with wrapUntrustedContent', () => {
+    const block = sliceBetween(META_SRC, "case 'inbox':", "case 'state':");
+    expect(block).toContain('wrapUntrustedContent');
+  });
+
+  it('inbox handler applies wrapUntrustedContent to userMessage', () => {
+    const block = sliceBetween(META_SRC, "case 'inbox':", "case 'state':");
+    // Should wrap userMessage
+    expect(block).toMatch(/wrapUntrustedContent.*userMessage|userMessage.*wrapUntrustedContent/);
+  });
+
+  it('inbox handler applies wrapUntrustedContent to url', () => {
+    const block = sliceBetween(META_SRC, "case 'inbox':", "case 'state':");
+    // Should also wrap url
+    expect(block).toMatch(/wrapUntrustedContent.*msg\.url|msg\.url.*wrapUntrustedContent/);
+  });
+
+  it('wrapUntrustedContent calls appear in the message formatting loop', () => {
+    const block = sliceBetween(META_SRC, 'for (const msg of messages)', 'Handle --clear flag');
+    expect(block).toContain('wrapUntrustedContent');
+  });
+});
+
+// ─── Task 14: DOM serialization round-trip replaced with DocumentFragment ─────
+
+const SIDEPANEL_SRC = fs.readFileSync(path.join(import.meta.dir, '../../extension/sidepanel.js'), 'utf-8');
+
+describe('Task 14: switchChatTab uses DocumentFragment, not innerHTML round-trip', () => {
+  it('switchChatTab does NOT use innerHTML to restore chat (string-based re-parse removed)', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'switchChatTab');
+    expect(fn).toBeTruthy();
+    // Must NOT have the dangerous pattern of assigning chatDomByTab value back to innerHTML
+    expect(fn).not.toMatch(/chatMessages\.innerHTML\s*=\s*chatDomByTab/);
+  });
+
+  it('switchChatTab uses createDocumentFragment to save chat DOM', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'switchChatTab');
+    expect(fn).toContain('createDocumentFragment');
+  });
+
+  it('switchChatTab moves nodes via appendChild/firstChild (not innerHTML assignment)', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'switchChatTab');
+    // Must use appendChild to restore nodes from fragment
+    expect(fn).toContain('chatMessages.appendChild');
+  });
+
+  it('chatDomByTab comment documents that values are DocumentFragments, not strings', () => {
+    // Check module-level comment on chatDomByTab
+    const commentIdx = SIDEPANEL_SRC.indexOf('chatDomByTab');
+    const commentLine = SIDEPANEL_SRC.slice(commentIdx, commentIdx + 120);
+    expect(commentLine).toMatch(/DocumentFragment|fragment/i);
+  });
+
+  it('welcome screen is built with DOM methods in the else branch (not innerHTML)', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'switchChatTab');
+    // The else branch must use createElement, not innerHTML template literal
+    expect(fn).toContain('createElement');
+    // The specific innerHTML template with chat-welcome must be gone
+    expect(fn).not.toMatch(/innerHTML\s*=\s*`[\s\S]*?chat-welcome/);
+  });
+});
+
+// ─── Task 15: pollChat/switchChatTab reentrancy guard ────────────────────────
+
+describe('Task 15: pollChat reentrancy guard and deferred call in switchChatTab', () => {
+  it('pollInProgress guard variable is declared at module scope', () => {
+    // Must be declared before any function definitions (within first 2000 chars)
+    const moduleTop = SIDEPANEL_SRC.slice(0, 2000);
+    expect(moduleTop).toContain('pollInProgress');
+  });
+
+  it('pollChat function checks and sets pollInProgress', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'pollChat');
+    expect(fn).toBeTruthy();
+    expect(fn).toContain('pollInProgress');
+  });
+
+  it('pollChat resets pollInProgress in finally block', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'pollChat');
+    // The finally block must contain the reset
+    const finallyIdx = fn.indexOf('finally');
+    expect(finallyIdx).toBeGreaterThan(-1);
+    const finallyBlock = fn.slice(finallyIdx, finallyIdx + 60);
+    expect(finallyBlock).toContain('pollInProgress');
+  });
+
+  it('switchChatTab calls pollChat via setTimeout (not directly)', () => {
+    const fn = extractFunction(SIDEPANEL_SRC, 'switchChatTab');
+    // Must use setTimeout to defer pollChat — no direct call at the end
+    expect(fn).toMatch(/setTimeout\s*\(\s*pollChat/);
+    // Must NOT have a bare direct call `pollChat()` at the end (outside setTimeout)
+    // We check that there is no standalone `pollChat()` call (outside setTimeout wrapper)
+    const withoutSetTimeout = fn.replace(/setTimeout\s*\(\s*pollChat[^)]*\)/g, '');
+    expect(withoutSetTimeout).not.toMatch(/\bpollChat\s*\(\s*\)/);
+  });
+});
+
+// ─── Task 16: SIGKILL escalation in sidebar-agent timeout ────────────────────
+
+describe('Task 16: sidebar-agent timeout handler uses SIGTERM→SIGKILL escalation', () => {
+  it('timeout block sends SIGTERM first', () => {
+    // Slice from "Timed out" / setTimeout block to processingTabs.delete
+    const timeoutStart = AGENT_SRC.indexOf("SIDEBAR_AGENT_TIMEOUT");
+    expect(timeoutStart).toBeGreaterThan(-1);
+    const timeoutBlock = AGENT_SRC.slice(timeoutStart, timeoutStart + 600);
+    expect(timeoutBlock).toContain('SIGTERM');
+  });
+
+  it('timeout block escalates to SIGKILL after delay', () => {
+    const timeoutStart = AGENT_SRC.indexOf("SIDEBAR_AGENT_TIMEOUT");
+    const timeoutBlock = AGENT_SRC.slice(timeoutStart, timeoutStart + 600);
+    expect(timeoutBlock).toContain('SIGKILL');
+  });
+
+  it('SIGTERM appears before SIGKILL in timeout block', () => {
+    const timeoutStart = AGENT_SRC.indexOf("SIDEBAR_AGENT_TIMEOUT");
+    const timeoutBlock = AGENT_SRC.slice(timeoutStart, timeoutStart + 600);
+    const sigtermIdx = timeoutBlock.indexOf('SIGTERM');
+    const sigkillIdx = timeoutBlock.indexOf('SIGKILL');
+    expect(sigtermIdx).toBeGreaterThan(-1);
+    expect(sigkillIdx).toBeGreaterThan(-1);
+    expect(sigtermIdx).toBeLessThan(sigkillIdx);
+  });
+});
+
+// ─── Task 17: viewport and wait bounds clamping ──────────────────────────────
+
+describe('Task 17: viewport dimensions and wait timeouts are clamped', () => {
+  it('viewport case clamps width and height with Math.min/Math.max', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'viewport':", "case 'cookie':");
+    expect(block).toBeTruthy();
+    expect(block).toMatch(/Math\.min|Math\.max/);
+  });
+
+  it('viewport case uses rawW/rawH before clamping (not direct destructure)', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'viewport':", "case 'cookie':");
+    expect(block).toContain('rawW');
+    expect(block).toContain('rawH');
+  });
+
+  it('wait case (networkidle branch) clamps timeout with MAX_WAIT_MS', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'wait':", "case 'viewport':");
+    expect(block).toBeTruthy();
+    expect(block).toMatch(/MAX_WAIT_MS/);
+  });
+
+  it('wait case (element branch) also clamps timeout', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'wait':", "case 'viewport':");
+    // Both the networkidle and element branches declare MAX_WAIT_MS
+    const maxWaitCount = (block.match(/MAX_WAIT_MS/g) || []).length;
+    expect(maxWaitCount).toBeGreaterThanOrEqual(2);
+  });
+
+  it('wait case uses MIN_WAIT_MS as a floor', () => {
+    const block = sliceBetween(WRITE_SRC, "case 'wait':", "case 'viewport':");
+    expect(block).toContain('MIN_WAIT_MS');
+  });
+});

browse/test/sidebar-ux.test.ts

@@ -441,7 +441,7 @@ describe('browser→sidebar tab sync', () => {
   test('/sidebar-tabs reads activeUrl param and calls syncActiveTabByUrl', () => {
     const handler = serverSrc.slice(
       serverSrc.indexOf("/sidebar-tabs'"),
-      serverSrc.indexOf("/sidebar-tabs'") + 500,
+      serverSrc.indexOf("/sidebar-tabs'") + 700,
     );
     expect(handler).toContain("get('activeUrl')");
     expect(handler).toContain('syncActiveTabByUrl');
@@ -626,7 +626,7 @@ describe('per-tab chat context (sidepanel.js)', () => {
       js.indexOf('function switchChatTab(') + 800,
     );
     expect(fn).toContain('chatDomByTab');
-    expect(fn).toContain('innerHTML');
+    expect(fn).toContain('createDocumentFragment');
   });
 
   test('sendMessage includes tabId in message', () => {
@@ -1253,13 +1253,15 @@ describe('server /welcome endpoint', () => {
     expect(welcomeSection).toContain("'Content-Type': 'text/html");
   });
 
-  test('/welcome redirects to about:blank if no welcome file found', () => {
+  test('/welcome serves fallback HTML if no welcome file found', () => {
     const welcomeSection = serverSrc.slice(
       serverSrc.indexOf("url.pathname === '/welcome'"),
       serverSrc.indexOf("url.pathname === '/health'"),
     );
-    expect(welcomeSection).toContain('302');
-    expect(welcomeSection).toContain('about:blank');
+    // Changed from 302 redirect to about:blank (ERR_UNSAFE_REDIRECT on Windows)
+    // to inline HTML fallback page (PR #822)
+    expect(welcomeSection).toContain('GStack Browser ready');
+    expect(welcomeSection).toContain('status: 200');
   });
 });
 

extension/inspector.js

@@ -355,6 +355,10 @@
   function applyStyle(selector, property, value) {
     // Validate property name: alphanumeric + hyphens only
     if (!/^[a-zA-Z-]+$/.test(property)) return { error: 'Invalid property name' };
+    // Validate CSS value: block exfiltration vectors (url(), expression(), @import, javascript:, data:)
+    if (/url\s*\(|expression\s*\(|@import|javascript:|data:/i.test(value)) {
+      return { error: 'CSS value contains blocked pattern' };
+    }
 
     const el = findElement(selector);
     if (!el) return { error: 'Element not found' };
@@ -373,6 +377,9 @@
   }
 
   function toggleClass(selector, className, action) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(className)) {
+      return { error: 'Invalid class name' };
+    }
     const el = findElement(selector);
     if (!el) return { error: 'Element not found' };
 
@@ -387,6 +394,12 @@
   }
 
   function injectCSS(id, css) {
+    if (!/^[a-zA-Z0-9_-]+$/.test(id)) {
+      return { error: 'Invalid CSS injection id' };
+    }
+    if (/url\s*\(|expression\s*\(|@import|javascript:|data:/i.test(css)) {
+      return { error: 'CSS contains blocked pattern (url, expression, @import)' };
+    }
     const styleId = `gstack-inject-${id}`;
     let styleEl = document.getElementById(styleId);
     if (!styleEl) {

extension/sidepanel.js

@@ -20,7 +20,8 @@ let connState = 'disconnected'; // disconnected | connected | reconnecting | dea
 let lastOptimisticMsg = null; // track optimistically rendered user msg to avoid dupes
 let sidebarActiveTabId = null; // which browser tab's chat we're showing
 const chatLineCountByTab = {}; // tabId -> last seen chatLineCount
-const chatDomByTab = {}; // tabId -> saved innerHTML
+const chatDomByTab = {}; // tabId -> saved DocumentFragment (never serialized HTML)
+let pollInProgress = false; // reentrancy guard — prevents concurrent/recursive pollChat calls
 let reconnectAttempts = 0;
 let reconnectTimer = null;
 const MAX_RECONNECT_ATTEMPTS = 30; // 30 * 2s = 60s before showing "dead"
@@ -390,7 +391,9 @@ document.getElementById('stop-agent-btn').addEventListener('click', stopAgent);
 let initialLoadDone = false;
 
 async function pollChat() {
-  if (!serverUrl || !serverToken) return;
+  if (pollInProgress) return;
+  pollInProgress = true;
+  if (!serverUrl || !serverToken) { pollInProgress = false; return; }
   try {
     // Request chat for the currently displayed tab
     const tabParam = sidebarActiveTabId !== null ? `&tabId=${sidebarActiveTabId}` : '';
@@ -449,6 +452,8 @@ async function pollChat() {
     updateStopButton(data.agentStatus === 'processing');
   } catch (err) {
     console.error('[gstack sidebar] Chat poll error:', err.message);
+  } finally {
+    pollInProgress = false;
   }
 }
 
@@ -458,7 +463,11 @@ function switchChatTab(newTabId) {
 
   // Save current tab's chat DOM + scroll position
   if (sidebarActiveTabId !== null) {
-    chatDomByTab[sidebarActiveTabId] = chatMessages.innerHTML;
+    const frag = document.createDocumentFragment();
+    while (chatMessages.firstChild) {
+      frag.appendChild(chatMessages.firstChild);
+    }
+    chatDomByTab[sidebarActiveTabId] = frag;
     chatLineCountByTab[sidebarActiveTabId] = chatLineCount;
   }
 
@@ -468,7 +477,8 @@ function switchChatTab(newTabId) {
   // mid-message (the server may have switched tabs because the user's
   // Chrome tab changed, but we still want to show the optimistic UI).
   if (chatDomByTab[newTabId]) {
-    chatMessages.innerHTML = chatDomByTab[newTabId];
+    while (chatMessages.firstChild) chatMessages.removeChild(chatMessages.firstChild);
+    chatMessages.appendChild(chatDomByTab[newTabId]);
     chatLineCount = chatLineCountByTab[newTabId] || 0;
     // Reset agent state for restored tab
     agentContainer = null;
@@ -480,12 +490,22 @@ function switchChatTab(newTabId) {
     chatLineCount = 0;
     // agentContainer/agentTextEl are already set from sendMessage()
   } else {
-    chatMessages.innerHTML = `
-      <div class="chat-welcome" id="chat-welcome">
-        <div class="chat-welcome-icon">G</div>
-        <p>Send a message about this page.</p>
-        <p class="muted">Each tab has its own conversation.</p>
-      </div>`;
+    while (chatMessages.firstChild) chatMessages.removeChild(chatMessages.firstChild);
+    const welcomeDiv = document.createElement('div');
+    welcomeDiv.className = 'chat-welcome';
+    welcomeDiv.id = 'chat-welcome';
+    const iconDiv = document.createElement('div');
+    iconDiv.className = 'chat-welcome-icon';
+    iconDiv.textContent = 'G';
+    welcomeDiv.appendChild(iconDiv);
+    const p1 = document.createElement('p');
+    p1.textContent = 'Send a message about this page.';
+    welcomeDiv.appendChild(p1);
+    const p2 = document.createElement('p');
+    p2.className = 'muted';
+    p2.textContent = 'Each tab has its own conversation.';
+    welcomeDiv.appendChild(p2);
+    chatMessages.appendChild(welcomeDiv);
     chatLineCount = 0;
     // Reset agent state for fresh tab
     agentContainer = null;
@@ -494,7 +514,7 @@ function switchChatTab(newTabId) {
   }
 
   // Immediately poll the new tab's chat
-  pollChat();
+  setTimeout(pollChat, 0);
 }
 
 function updateStopButton(agentRunning) {