feat: add rotating User-Agent headers & pre-tool-call guardrail authorization layer

[programming-pupil]

Summary

This PR combines two improvements to OpenManus's tool infrastructure:

1. Rotating User-Agent for WebSearch — WebContentFetcher now randomly selects from a pool of 5 realistic User-Agent strings (Chrome/Firefox/Safari across Windows/macOS/Linux) on each request, preventing web servers from detecting and blocking automated scraping based on a fixed header.

2. Pre-tool-call Guardrail Authorization — Adds a pluggable authorization layer to BaseTool, implementing the OAP before_tool_call pattern. A GuardrailProvider protocol is evaluated in BaseTool.__call__() before execute(), returning allow/deny with reasons. Denied calls return a ToolResult(error=...) without executing the underlying tool logic. Fully backward compatible — if no guardrail provider is set, all calls are allowed by default.

Changes

• app/tool/web_search.py: Added random import and _USER_AGENTS pool; WebContentFetcher now rotates User-Agent per request
• app/tool/base.py: Added GuardrailCheckResult model, GuardrailProvider Protocol, AllowlistGuardrail built-in implementation, and _run_with_guardrail() hook in BaseTool
• app/tool/__init__.py: Updated exports to include GuardrailCheckResult, AllowlistGuardrail, CLIResult, ToolFailure, ToolResult

Why this matters

• User-Agent rotation avoids request blocking on content-heavy web search tasks
• Guardrail layer enables blocking dangerous operations, rate-limiting expensive calls, audit logging, and enterprise compliance — without modifying any existing tool subclass

Backward compatibility

• No changes required to any BaseTool subclass
• Existing tools without guardrail_provider continue to work as before
• WebContentFetcher API unchanged, only internal header selection logic updated

[programming-pupil]

Hi @appleboy @zhoupeng @Shellmode @cnJasonZ , just a gentle ping on this PR when you have some free cycles. All checks have passed. Please let me know if you need any additional context or changes from my end. Thanks!

[programming-pupil]

@appleboy @zhoupeng @Shellmode @cnJasonZ Hi, I’m a big fan of OpenManus and would love to see it keep evolving. Since it’s been a while since the last update, I wanted to offer my help. Beyond this PR, I’m very much open to helping with issue triaging or ongoing maintenance if you’re looking for a co-maintainer. Let me know your thoughts!