feat(web-security): include wrangler (Cloudflare Workers) in web-security tooling (CAP-1190)

[GangGreenTemperTatum]

Summary

Adds the wrangler CLI (Cloudflare Workers) to the web-security capability, closing CAP-1190. Wrangler deploys Cloudflare Workers as custom OAST endpoints — attacker-controlled, programmable callback infrastructure that complements the existing OOB tooling (interactsh, webhook.site): those can only receive callbacks, a worker can also serve — blind XSS payload hosting, custom response bodies, and 302 redirectors for SSRF chain escalation.

新建 toolset — tools/wrangler.py (auto-discovered, 5 tools)

Tool	Purpose
wrangler_status	Verify binary + non-interactive token auth (whoami --json)
wrangler_deploy	Templates: callback (request logger), blind-xss (JS probe + /collect exfil), redirect (302 for SSRF chains), custom
wrangler_tail	Bounded log-stream capture; parses console.log JSON events and raw request events
wrangler_list	Account workers via the Cloudflare REST API (wrangler has no list command), pagination-aware
wrangler_delete	Teardown (delete <name> --force)

Auth carries from the environment per wrangler's own contract: CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID, with the CF_API_TOKEN / CF_ACCOUNT_ID aliases (flareprox's env contract in this capability) accepted as fallbacks so one credential pair drives both tools. Nothing is persisted — no wrangler login state. Telemetry (WRANGLER_SEND_METRICS=false) is suppressed in subprocesses so disconnected deployments make no extra outbound calls.

Runtime install

• scripts/install_tools.sh — guarded (have wrangler) and pinned (wrangler@4.127.0) npm install with the standard non-fatal WARN fallback; the offline-guard test suite now enforces guard+pin discipline on all npm installs. Drive-by: as a result agent-browser is pinned to its current latest (0.35.1, behavior-preserving today) — flagging in case maintainers want that split out.
• docker/Dockerfile.runtime — matching pinned layer, header comment updated
• capability.yaml — wrangler preflight check, description/keywords, version 1.14.0 → 1.15.0

Docs

• 新建 skills/wrangler-oast/SKILL.md — activation gate on env vars (fall back to get_callback_url, which needs no credentials, when unset), workflow, template details, mandatory cleanup
• agents/web-security.md — tool guidance routes credential-less detection to get_callback_url, wrangler only for payload serving / custom responses / redirects
• skills/blind-ssrf-chains/SKILL.md — cross-references the new tools behind the skill's existing approval gate

Ground truth (verified against wrangler 4.125/4.127, not guessed)

• whoami --json exits non-zero when unauthenticated (plain whoami exits 0 with a notice — the reliable check is --json)
• delete takes the worker name positionally (--name is not an option)
• there is no top-level wrangler list command → REST API for listing
• CLOUDFLARE_ACCOUNT_ID is honored from the env with no account_id in wrangler.toml (so the account id never lands in a temp file)
• --var=KEY:VALUE works with --no-bundle; name validation regex is ^[a-z0-9_][a-z0-9_-]*$ (mirrored client-side, also blocks toml injection)
• wrangler colorizes even when piped → ANSI codes are stripped from all tool output

Testing

• 67 new unit tests (tests/test_wrangler.py): tool discovery, auth resolution incl. CF-alias mapping, name validation (incl. injection attempts), deploy config generation, --var routing, tail timeout-as-designed-stop, tail JSON/request/exception parsing, list pagination, teardown; extended offline-guard tests for the wrangler install
• SDK end-to-end (real loader, real binary): capability discovered via load_capabilities_from_search_paths, all 5 tools registered (64 total), schema correct, full handle_tool_call round-trip against the real wrangler CLI
• Real-CLI integration: status/deploy/tail exercised against genuine wrangler with an invalid token — config parsing passes (proves generated wrangler.toml + flags are valid), API rejection surfaces cleanly and ANSI-free
• Pinned install wrangler@4.127.0 verified installable/runnable; bash -n + shellcheck clean; just validate, pre-commit (ruff, gitleaks, yaml) all pass; full capability suite: 700 tests passing

Notes for reviewers

• wrangler_list uses the REST API rather than the CLI because no wrangler list exists — same API surface flareprox already uses in this capability
• The agent-browser pin is enforced by the strengthened npm-guard test; happy to split it into its own PR if preferred
• 安全-scan findings on the new files are the same classes as the existing capability baseline (cloud-metadata references, exfil patterns) inherent to offensive tooling