TAB-1104: hide caller data from the model (fill by key at the sink)

[srbiv]

Caller data (from /v1/automate) was JSON.stringify'd into the task prompt (prompts.ts {{ data }}), so the model could read a secret and place it into a goto URL, a Tabstack URL, or done(). Hiding the value is the root fix — the model cannot leak what it never sees.

Change

• prompts.ts: render only the data KEYS, not values; buildTaskAndPlanPrompt takes dataKeys; hasUserData threaded into the tool list and the step-error feedback prompt.
• New fill_user_data(ref, key) tool (in webActionTools): resolves data[key] and substitutes it at browser.performAction; the value is never returned or emitted (only a {{key}} mask).
  • Runs the same assessFill gate as regular fill (blocked on untrusted hosts) and records agentFilledRefs/operationalRefs — never approvedRefs, so the form-submit gate still applies.
  • Maps select/checkbox/radio to the right browser action.
• webAgent.ts: pass data to the tools; pass keys (not values) to the prompt.

Why hide, not scrub

Detecting the secret in an outbound URL is a blocklist — encoding/param/method evade it. The model never receiving the value is structural: no domain, encoding, or sink matters.

Testing

• fill_user_data unit tests: blocked on untrusted host (no performAction, SECURITY_BLOCKED_UNAUTHORIZED_FILL), allowed on trusted host (value masked, ref in agentFilledRefs not approvedRefs), unknown key, select field, BrowserException.
• prompts test: keys rendered, values absent.
• Live-verified on this branch: same-domain attack, model fully cooperating — the real canary never left (collector saw only the literal placeholder); agent aborted, stating it could not substitute a data key into goto.
• Full suite: core 918, cli/server/extension typecheck all pass.

Complements #595 (destination allowlist). Related: TAB-1104.