🔒 Security Fix: Disable default browser evaluation

[mgabrielramos]

🎯 What:

• Changed DEFAULT_BROWSER_EVALUATE_ENABLED to false in src/browser/constants.ts.

⚠️ Risk:

• The previous default value of true allowed browser agents to execute arbitrary JavaScript code via evaluate or wait --fn commands by default. This could be exploited if an attacker gains control over the agent's input or configuration context, leading to potential Remote Code Execution (RCE) within the browser context.

🛡️ Solution:

• By setting the default to false, the dangerous evaluation feature is now opt-in. Users must explicitly enable it in their configuration if they need this capability. This follows the principle of "secure by default".

Verification:

• Validated the fix using a reproduction script (verify_fix.ts) that confirmed resolveBrowserConfig now defaults evaluateEnabled to false.
• Ran existing unit tests for configuration (src/browser/config.test.ts) which passed, ensuring no regression in configuration parsing logic.

---

PR created automatically by Jules for task 16627281928261300111 started by @mgabrielramos

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.