feat(web-security): add frontend_honeypot_guard hook for agent-target…

[GangGreenTemperTatum]

…ed lure detection

Some web applications deliberately embed instructions aimed at AI agents in frontend HTML — hidden comments, display:none divs, JS strings, image alt text, data-* attributes, SSE streams, or JSON payloads. The canonical lure tells the agent to POST its prompt, current task, and local dev/setup details to a "helper" endpoint and claims the page itself grants permission. This hook detects those lures in tool output and denies the follow-on exfiltration requests.

Two coordinated reactions:

• ToolEnd: scans external tool output for high-confidence honeypot shapes and injects a corrective Continue reminder (URL-redacted excerpt, framed as untrusted evidence). Deduped per digest; warns once per unique lure.
• ToolStart: denies side-effecting HTTP calls (POST/PUT/PATCH/DELETE, and GET with data-carrying query strings) that target a previously detected honeypot endpoint or independently match the exfiltration shape, across execute_http, curl/wget/httpie, python requests/httpx, JS fetch/axios, raw HTTP replay, and agent-browser run argument lists.

Detection model: composable signal categories gated on genuine agent address (second-person, vocative, or labelled "note for AI agents" forms — determiner-qualified third-person mentions do not count) or a contiguous live exfiltration verb chain. Homoglyphs (Cyrillic/Greek/fullwidth), zero-width characters, leet substitutions, and whitespace-split keywords are folded before matching. Meta-discussion guards keep articles, payload libraries (code-fenced), and reported speech ("telling the model to post your prompt") silent.

Adversarial hardening from peer review:

• Endpoint tracking pins the lure's own primary URL so URL-flood pages cannot evict it from the bounded tracking list.
• GET-based exfiltration via query-string carriers is blocked.
• The warning excerpt strips backticks (no feedback-string breakout) and redacts URLs; attacker text is always framed as data.
• Malformed bracketed-host URLs no longer crash the scan (found by scanning this capability's own skill corpus.

Performance: ~1.3ms for a typical 5KB tool result, ~43ms worst-case for a 160KB lure-laden page, with a capped tail-gate pass for lures buried deep in oversized pages. State is per-agent, lock-guarded, cleared on AgentEnd.

Validated against a 25-case malicious mutation corpus and a 22-case benign lookalike corpus (API docs, support pages, third-person articles, research prose, quoted payloads, benign agent onboarding docs), plus a full sweep of this capability's own 127 skill/agent/tool files: zero false positives. EOF
)