RFC: deterministic egress & secret-read guard for the browser CLI (Grimdall) #21

Summary

Propose an opt-in guard on the browser-act CLI that adds deterministic, below-the-model controls on what leaves the machine: an egress allowlist plus secret-read denial. Shadow-mode (log-only) by default.

Why browser-act

The CLI drives a real, logged-in browser and moves files and network data on the user's behalf — a prime exfiltration surface. Secrets exposed to the agent (e.g. the env-var exposure tracked in #18) are only half the problem; the other half is stopping the agent from sending them anywhere. An egress allowlist closes that half deterministically.

Proposal

Grimdall (MIT) is a <2ms deterministic policy checkpoint. Wrapped around the CLI's network/file boundaries, it would:

1. Egress allowlist — block network egress not explicitly allowed.
2. Secret-read denial — refuse reads of ~/.ssh, ~/.aws, .env, *.pem.
3. Shell policy — AST-parse any shell it invokes and block destructive patterns.

Default is shadow mode: log what it would block; enforcement is opt-in.

Questions

1. What's the canonical seam for intercepting outbound network/file actions in the CLI — a middleware, a hook, or the command dispatcher?
2. Would you accept a PR, or prefer it as a separate integration?
3. OK with a shadow-mode default?

Non-goals

• No core rewrites; additive guard.
• Opt-in; no behavior change by default.
• Doesn't replace fixing the Security: command_daemon leaks environment variables into argv via --data-dir (v1.1.0) #18 argv leak — complementary defense-in-depth.

I'm a maintainer of Grimdall and happy to build and test this against browser-act.