fix(policy): block navigate in ReadOnly; trim crate description

Cargo.toml

@@ -2,7 +2,7 @@
 name = "neurobrowser"
 version = "0.1.0"
 edition = "2021"
-description = "AI-native browser with custom rendering engine"
+description = "HTTP scraper and policy-gated browser agent library"
 
 [dependencies]
 serde = { version = "1", features = ["derive"] }

src/agent/policy.rs

@@ -274,7 +274,7 @@ impl ActionPolicy {
 
         match self.autonomy_level {
             AutonomyLevel::ReadOnly => match tool_risk.action {
-                ToolAction::Read | ToolAction::Wait | ToolAction::Scroll | ToolAction::Navigate => {
+                ToolAction::Read | ToolAction::Wait | ToolAction::Scroll => {
                     PolicyDecision::allow(redacted_arguments)
                 }
                 _ => {
@@ -359,10 +359,8 @@ fn is_sensitive_key(key: &str) -> bool {
 }
 
 fn snapshot_contains_prompt_injection(snapshot: &PageSnapshot) -> bool {
-    // Scan BOTH the rendered text AND the raw HTML. Injection payloads are often
-    // hidden in attributes/comments that never become DOM text nodes; the previous
-    // `text.or(html)` left the HTML branch dead (text is virtually always present),
-    // so attribute/comment-hidden payloads were invisible to the detector.
+    // Scan both the rendered text and the raw HTML. Injection payloads are often
+    // hidden in attributes/comments that never become DOM text nodes.
     let mut haystack = String::new();
     if let Some(text) = snapshot.text.as_deref() {
         haystack.push_str(text);

tests/action_policy.rs

@@ -127,6 +127,28 @@ fn injection_hidden_in_html_attribute_is_detected() {
     assert!(decision.risk_flags.contains(&RiskFlag::PromptInjection));
 }
 
+#[test]
+fn readonly_mode_blocks_navigate() {
+    let snapshot = snapshot("https://current.example", "Ready");
+    let mut args = HashMap::new();
+    args.insert("url".to_string(), "https://other.example".to_string());
+
+    let policy = ActionPolicy {
+        autonomy_level: AutonomyLevel::ReadOnly,
+        ..ActionPolicy::default()
+    };
+
+    let decision = policy.evaluate(
+        "navigate",
+        &ToolRisk::new(ToolAction::Navigate, RiskLevel::Medium),
+        &args,
+        &snapshot,
+    );
+
+    assert_eq!(decision.outcome, PolicyOutcome::Block);
+    assert!(decision.risk_flags.contains(&RiskFlag::ReadOnlyMode));
+}
+
 #[test]
 fn navigation_to_javascript_scheme_is_blocked() {
     // A hostless dangerous scheme must not slip past the domain allow/deny check.