#3531 · the safety hook only guarded 3 of 10 URL doors

extractUrl in agent-browser-safety.ts matched only navigate | goto | open. Every other URL-accepting form of agent-browser 0.34.0 walked straight past the URL blocklist, the per-domain rate limiter, and robots.txt enforcement. All forms below verified against the live CLI's --help.

What a URL passes through (after this fix, for every form)

command string | v extractUrls() <- was extractUrl(): singular, 3 verbs only | v [1] URL blocklist per URL [2] per-domain rate limit per URL (rate-limits.json, machine-wide) [3] robots.txt enforcement per URL | v [6] CDP attack-surface warning <- connect <port|url> now included

Coverage by command form

form	URLs it carries	state

The deliberate exemption

connect <port|url> gets the CDP attack-surface warning (check 6) but NOT the blocklist: it is a CDP attach, not a page fetch, and blocking it would break legitimate local connect ws://127.0.0.1:9222 flows. A (?:^|\s) guard keeps --auto-connect from tripping it.

Known limitation, scoped out

rate-limits.json lives under CLAUDE_PLUGIN_ROOT: ONE shared
per-domain budget across all sessions and worktrees on the
machine. Documented in this PR; fixing the shared budget is
a separate, larger change.