feat: v0.7.2 安全收口 · 断链接线 · 观测补洞 — 230 用例扩充与全量回归

P1 修复面收口: /clear 全链路根治(前端清空联动 DB messages+摘要游标+TRACE 快照,
IPC 语义改"操作完成"; 流式中拒绝); web_browser open 补 SSRF 校验(Chromium 旁路关闭,
与 web_fetch/http_request 同源 validateSSRF); MCP 工具结果纳入注入扫描(mcp_* 前缀
按网络来源同级 full 模式, 收敛 resolveScanMode 单点); Trace 落库/入 store 双重瘦身
(tool_result base64/超长字段剥离, metadata 防 MB 级膨胀); 文本附件 512KB 闸门
(file.slice 首段读取+truncated 标志随消息持久化+主进程附件提示感知截断);
单实例锁(requestSingleInstanceLock + second-instance 聚焦已有窗口)

P2 安全纵深: ConfirmationHook 多窗口化(确认请求/超时提示改全窗口广播,
getAllWindows 空时回退 mainWindow, fail-closed 判定升级双通道); mcp_servers.headers
全链路接线(safeParseHeaders 容错解析+SSE/StreamableHTTP requestInit 注入+IPC 逐项
校验+设置页 JSON 输入, 远程 MCP 鉴权头可用)

P3 断链接线: llm:listModels IPC(六家 adapter 动态模型发现首次接线, 配置完整性
前置校验); Ollama pullModel IPC+设置页下载卡片(进度/取消/能力徽标, v0.7.0 死代码
激活); 后台会话运行指示(sessionRunStates 图+Sidebar 状态点, 多会话并发可见);
IR 卫生(移除 THINKING_START/END 死枚举, constraints 标注预留)

P4 质量与文档: i18n 第二阶段(确认弹框/侧栏/状态栏/AgentMonitor/终止原因出层,
外观设置 zh-CN/en-US 切换, ui.locale 持久化, 渲染时求值规避异步注册); README/D1
文档对齐(http_request 风险等级/用例数/实现状态注记); 版本号 0.7.2

测试: 507 → 737 用例(+230, 11 个新文件)。覆盖补齐: context-builder/consolidator/
orchestrator/workspace.service/session-recorder/config-layering/secure-config/
network-proxy + IPC mcp/tasks/memory/app/data 域 + 渲染层 store 与流事件管线纯函数。
测试驱动修复: workspace.appendMemory 中文分区 \b 词边界失效(JS \b 不含 CJK),
固化条目恒追加文件末尾产生重复分区头 → (?=\n|$) 前瞻断言根治

回归: typecheck 双端 0 错误; ESLint 0/0; 系统 Node 687 通过 50 跳过;
Electron ABI 全量 737/737 零跳过

electron/harness/tools/built-in/__tests__/ssrf-guard.test.ts

@@ -22,7 +22,7 @@ const dnsTable: Record<string, Array<{ address: string; family: number }>> = {
     { address: '2606:2800:220:1:248:1893:25c8:1946', family: 6 },
   ],
   'v4mapped.example.com': [{ address: '::ffff:127.0.0.1', family: 6 }],
-  'localhost': [{ address: '127.0.0.1', family: 4 }],
+  localhost: [{ address: '127.0.0.1', family: 4 }],
   'nx.example.com': [],
 };
 
@@ -37,6 +37,7 @@ vi.mock('node:dns/promises', () => ({
 
 import { isPrivateIP, validateSSRF } from '../ssrf-guard';
 import { WebFetchTool } from '../web-fetch';
+import { WebBrowserTool } from '../browser';
 import type { ToolExecutionContext } from '../../../types/metona-tool';
 
 describe('isPrivateIP 表格化判定', () => {
@@ -142,7 +143,10 @@ describe('WebFetchTool — SSRF 入口拦截（v0.6.4 安全不对称根治）',
 
   it('拒绝云元数据地址', async () => {
     const tool = new WebFetchTool();
-    const result = (await tool.execute({ url: 'http://169.254.169.254/latest/meta-data/' }, context)) as {
+    const result = (await tool.execute(
+      { url: 'http://169.254.169.254/latest/meta-data/' },
+      context,
+    )) as {
       success?: boolean;
       error?: string;
     };
@@ -160,3 +164,71 @@ describe('WebFetchTool — SSRF 入口拦截（v0.6.4 安全不对称根治）',
     expect(result.error ?? '').toContain('Blocked SSRF');
   });
 });
+
+describe('WebBrowserTool — open 动作 SSRF 入口拦截（v0.7.2 A2）', () => {
+  const context: ToolExecutionContext = {
+    sessionId: 't',
+    workspacePath: process.cwd(),
+    iteration: 1,
+    requestId: 'r',
+  };
+
+  /**
+   * 契约背景：隐藏浏览器（Chromium 网络栈）此前是 SSRF 防线的唯一旁路 ——
+   * web_fetch/http_request 均有校验，而 web_browser open 可直接导航内网。
+   * 根治后 open 必须在创建任何 BrowserWindow 之前完成校验；
+   * 以下用例断言私有地址在触达 getManager()（首个 Electron API 调用点）前即被拒绝。
+   */
+  it('拒绝回环地址且不创建任何浏览器窗口', async () => {
+    const tool = new WebBrowserTool();
+    const result = (await tool.execute(
+      { action: 'open', url: 'http://127.0.0.1:9222/devtools' },
+      context,
+    )) as { success?: boolean; action?: string; error?: string };
+    expect(result.success).toBe(false);
+    expect(result.action).toBe('open');
+    expect(result.error ?? '').toContain('Blocked SSRF');
+  });
+
+  it('拒绝云元数据地址', async () => {
+    const tool = new WebBrowserTool();
+    const result = (await tool.execute(
+      { action: 'open', url: 'http://169.254.169.254/latest/meta-data/' },
+      context,
+    )) as { success?: boolean; error?: string };
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('Blocked SSRF');
+  });
+
+  it('拒绝解析为内网的域名（如 localhost）', async () => {
+    const tool = new WebBrowserTool();
+    const result = (await tool.execute(
+      { action: 'open', url: 'http://localhost/admin' },
+      context,
+    )) as { success?: boolean; error?: string };
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('Blocked SSRF');
+  });
+
+  it('拒绝内网 IP 段（192.168/10/172.16-31）', async () => {
+    const tool = new WebBrowserTool();
+    for (const url of ['http://192.168.1.1/', 'http://10.0.0.2/', 'http://172.20.0.5/']) {
+      const result = (await tool.execute({ action: 'open', url }, context)) as {
+        success?: boolean;
+        error?: string;
+      };
+      expect(result.success).toBe(false);
+      expect(result.error ?? '').toContain('Blocked SSRF');
+    }
+  });
+
+  it('非法协议仍走原有协议白名单拒绝（错误信息不变）', async () => {
+    const tool = new WebBrowserTool();
+    const result = (await tool.execute({ action: 'open', url: 'file:///etc/passwd' }, context)) as {
+      success?: boolean;
+      error?: string;
+    };
+    expect(result.success).toBe(false);
+    expect(result.error ?? '').toContain('URL must start with');
+  });
+});