feat(safety): probe browser that clicks, and sibling links in the bundle

The investigator judged what a button does from script tags, because its
only render was a one-shot snapshot. A fake video player wired to ad
networks became "designed to trigger malicious downloads" without anyone
clicking it. The new browser service loads the page in our own Chromium,
clicks its prominent controls and records pop-ups, navigations, downloads,
dialogs, clipboard writes and notification prompts; fetch_page reports
that under Observed behaviour and the prompt makes it the only source for
what a click does. Small hosts also get every sibling link resolved into
the bundle, so nine links from one creator in three minutes reads as one
campaign. Cloudflare snapshots stay as the fallback.

Author: Zingzy

.github/workflows/deploy.yml

@@ -78,6 +78,29 @@ jobs:
           cache-to: type=gha,mode=max
           platforms: linux/amd64
 
+      # The safety tier's probe browser ships beside the app under the same
+      # tags, so one IMAGE_TAG names a working pair.
+      - name: Extract metadata (browser)
+        id: meta_browser
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-browser
+          tags: |
+            type=semver,pattern={{version}}
+            type=sha,prefix=,format=short
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+
+      - name: Build and push (browser)
+        uses: docker/build-push-action@v7
+        with:
+          context: browser
+          push: true
+          tags: ${{ steps.meta_browser.outputs.tags }}
+          labels: ${{ steps.meta_browser.outputs.labels }}
+          cache-from: type=gha,scope=browser
+          cache-to: type=gha,mode=max,scope=browser
+          platforms: linux/amd64
+
   deploy:
     needs: build
     # run when build succeeded OR was skipped (rollback path)
@@ -125,7 +148,10 @@ jobs:
             }
 
             set_tag "${IMAGE_TAG}"
-            docker compose --env-file .env -f docker-compose.prod.yml pull app
+            docker compose --env-file .env -f docker-compose.prod.yml pull app browser
+            # The probe browser is stateless and health-gated by the worker's
+            # fallback to Cloudflare snapshots, so it swaps first, ungated.
+            docker compose --env-file .env -f docker-compose.prod.yml up -d --no-deps browser
             docker compose --env-file .env -f docker-compose.prod.yml up -d --no-deps app
 
             if ! wait_healthy spoo_app; then

.github/workflows/image.yml

@@ -74,3 +74,25 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64
+
+      # The safety tier's probe browser ships beside the app under the same
+      # tags, so one IMAGE_TAG names a working pair.
+      - name: Extract metadata (browser)
+        id: meta_browser
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-browser
+          tags: |
+            type=raw,value=edge,enable=${{ github.event_name == 'push' }}
+            type=sha,prefix=,format=short
+
+      - name: Build and push (browser)
+        uses: docker/build-push-action@v7
+        with:
+          context: browser
+          push: true
+          tags: ${{ steps.meta_browser.outputs.tags }}
+          labels: ${{ steps.meta_browser.outputs.labels }}
+          cache-from: type=gha,scope=browser
+          cache-to: type=gha,mode=max,scope=browser
+          platforms: linux/amd64

browser/Dockerfile

@@ -0,0 +1,10 @@
+FROM mcr.microsoft.com/playwright/python:v1.62.0-noble
+
+RUN pip install --no-cache-dir playwright==1.62.0 starlette==1.6.0 uvicorn==0.52.4
+
+WORKDIR /srv
+COPY probe.py /srv/probe.py
+
+USER pwuser
+EXPOSE 8011
+CMD ["uvicorn", "probe:app", "--host", "0.0.0.0", "--port", "8011", "--no-access-log"]