feat(harness): WAF bypass header for browser tools on deco-owned hosts

[vibe-dex]

Why

take_screenshot / scrape_url / inspect_page run on Browserless (headless Chrome, datacenter egress). Cloudflare bot management on deco's own zones scores that as a bot and blocks it — so agents doing QA/verification of deco previews (envs-*.decocdn.com) and storefronts consistently get 403 "Sorry, you have been blocked". Observed live on the osklen AI-Services flow: QA runs honest-blocked twice purely on the WAF.

What

Both production zones already carry a shared-secret skip rule matching the x-deco-probe-bypass header (same mechanism as the commerce-discovery probe bypass). When DECO_WAF_BYPASS_TOKEN is set in the environment, the three browser tools now send that header.

Security scoping: the header is attached only when the target host is a deco zone (*.decocdn.com / *.deco.site) — browser tools can be pointed at arbitrary third-party URLs, and sending the secret there would leak it. See waf-bypass.ts.

• /screenshot and /content payloads gain setExtraHTTPHeaders
• the /function (inspect_page) puppeteer template calls page.setExtraHTTPHeaders before goto

Deploy note

Requires DECO_WAF_BYPASS_TOKEN in the cluster env — value is the existing x-deco-probe-bypass rule secret on the decocdn.com custom firewall ruleset (rule [SKIP] commerce-discovery probe bypass).

Verification

packages/harness tsc --noEmit clean · bun test packages/harness/src/decopilot/built-in-tools 75/75 pass.

🤖 Generated with Claude Code

---

Summary by cubic

Adds a WAF bypass for browser tools hitting deco-owned hosts to prevent Cloudflare 403s. Sends the x-deco-probe-bypass header using DECO_WAF_BYPASS_TOKEN, but only for *.decocdn.com and *.deco.site.

• New Features

  • Added waf-bypass.ts to generate bypass headers when the target host is a deco zone.
  • Attached headers in take_screenshot, scrape_url, and inspect_page via setExtraHTTPHeaders.
  • Never sends the header to third-party hosts.

• Migration

  • Set DECO_WAF_BYPASS_TOKEN in the cluster environment to the existing secret used by the Cloudflare rule.

^{Written for commit 31efea2. Summary will update on new commits.}

[vibe-dex]

Known limitation observed live (osklen QA run): the "antes" side of a de-para renders production pages on customer custom domains (e.g. www.osklen.com.br). Those ride deco's zone via Cloudflare for SaaS, so the skip rule would match the header — but this helper only trusts *.decocdn.com / *.deco.site hostnames and won't send the secret to a customer domain it can't verify is deco-served. Options if prod-antes rendering matters: an env-provided allowlist of customer hostnames, or resolving the host's CNAME before attaching. Left out of this PR to keep the secret-handling conservative.