fix: taint prefetched web context

src/chat_processor.py

@@ -465,6 +465,7 @@ class ChatProcessor:
                     preface.append(untrusted_context_message(
                         f"web page: {url}",
                         f"Content from {url}:\n\n{content}",
+                        provenance_origin="external",
                     ))
 
         # Skills index — progressive disclosure. Only injected when the

src/prompt_security.py

@@ -61,7 +61,12 @@ def _sanitize_label(label: str) -> str:
     return label
 
 
-def untrusted_context_message(label: str, content: Any) -> Dict[str, Any]:
+def untrusted_context_message(
+    label: str,
+    content: Any,
+    *,
+    provenance_origin: str | None = None,
+) -> Dict[str, Any]:
     """Return an LLM message that keeps retrieved/source text out of system role.
 
     The template is structured so that *only* the hardcoded
@@ -73,6 +78,9 @@ def untrusted_context_message(label: str, content: Any) -> Dict[str, Any]:
     safe_label = _sanitize_label(label)
     text = "" if content is None else str(content)
     text = _escape_guard_markers(text)
+    metadata: Dict[str, Any] = {"trusted": False, "source": label}
+    if provenance_origin:
+        metadata["provenance_origin"] = provenance_origin
     return {
         "role": "user",
         "content": (
@@ -82,5 +90,5 @@ def untrusted_context_message(label: str, content: Any) -> Dict[str, Any]:
             f"{text}\n"
             f"{GUARD_CLOSE}"
         ),
-        "metadata": {"trusted": False, "source": label},
+        "metadata": metadata,
     }

src/tool_capabilities.py

@@ -280,6 +280,7 @@ _EXTERNAL_MESSAGE_SOURCES = frozenset(
         "youtube transcript",
     }
 )
+_EXTERNAL_MESSAGE_SOURCE_PREFIXES = ("web page:",)
 
 
 def messages_contain_external_untrusted_context(messages: Iterable[dict]) -> bool:
@@ -293,7 +294,12 @@ def messages_contain_external_untrusted_context(messages: Iterable[dict]) -> boo
         if metadata.get("provenance_origin") == "external":
             return True
         source = metadata.get("source")
-        if isinstance(source, str) and source.strip().casefold() in _EXTERNAL_MESSAGE_SOURCES:
+        if not isinstance(source, str):
+            continue
+        normalized_source = source.strip().casefold()
+        if normalized_source in _EXTERNAL_MESSAGE_SOURCES:
+            return True
+        if normalized_source.startswith(_EXTERNAL_MESSAGE_SOURCE_PREFIXES):
             return True
     return False