From 281217b2c13d7f0ded40072b6082d6fe18277ab8 Mon Sep 17 00:00:00 2001
From: Kim-Anh Tran <[email protected]>
Date: Tue, 19 May 2026 16:44:23 +0200
Subject: [PATCH] Disallow function call on navigation

When the ContextSelectionAgent is active we don't have a context
and thus no 'locked' origin. It may happen that the user asks a
question and the page is navigated to a different page, ultimately
answering the question on the navigated-to page, at which point the
origin gets locked (if a function was called).

Since this may be unwanted, we listen to page navigated events and
set `allowedOrigin` to `{blocked: true}`. This will result in an
error, disallowing the agent to continue with the current tool call.

Bug: 513727626
Change-Id: I35cab5643e475573df4965b6446f0360ece16798
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/7852717
Reviewed-by: Nikolay Vitkov <[email protected]>
Reviewed-by: Jack Franklin <[email protected]>
Commit-Queue: Kim-Anh Tran <[email protected]>
---

diff --git a/front_end/models/ai_assistance/AiConversation.test.ts b/front_end/models/ai_assistance/AiConversation.test.ts
index 0670664..6b23d61 100644
--- a/front_end/models/ai_assistance/AiConversation.test.ts
+++ b/front_end/models/ai_assistance/AiConversation.test.ts
@@ -10,6 +10,7 @@
 import * as TextUtils from '../../models/text_utils/text_utils.js';
 import {createNetworkRequest, mockAidaClient} from '../../testing/AiAssistanceHelpers.js';
 import {
+  createTarget,
   describeWithEnvironment,
   updateHostConfig,
 } from '../../testing/EnvironmentHelpers.js';
@@ -472,4 +473,108 @@
     assert.strictEqual(serialized.history[2].type, AiAssistance.AiAgent.ResponseType.ACTION);
     assert.isUndefined((serialized.history[2] as AiAssistance.AiAgent.ActionResponse).widgets);
   });
+
+  async function testNavigationDuringRun({
+    navigationUrl,
+    expectBlocked,
+  }: {
+    navigationUrl: Platform.DevToolsPath.UrlString,
+    expectBlocked: boolean,
+  }) {
+    updateHostConfig({devToolsAiAssistanceContextSelectionAgent: {enabled: true}});
+
+    const origin = Platform.DevToolsPath.urlString`https://example.com`;
+
+    const target = createTarget({url: Platform.DevToolsPath.urlString`${origin}/`});
+    target.setInspectedURL(Platform.DevToolsPath.urlString`${origin}/`);
+
+    const request = SDK.NetworkRequest.NetworkRequest.create(
+        'requestId1' as Protocol.Network.RequestId,
+        Platform.DevToolsPath.urlString`${origin}/foo`,
+        Platform.DevToolsPath.urlString`${origin}/foo`,
+        null,
+        null,
+        null,
+    );
+    request.statusCode = 200;
+    request.setIssueTime(0, 0);
+    request.endTime = 1;
+
+    const networkLog = Logs.NetworkLog.NetworkLog.instance();
+    sinon.stub(networkLog, 'requests').returns([request]);
+
+    const aidaClient = mockAidaClient([
+      [{
+        functionCalls: [{
+          name: 'listNetworkRequests',
+          args: {},
+        }],
+        explanation: '',
+      }],
+      [{explanation: 'Done'}],
+    ]);
+    const conversation = new AiAssistance.AiConversation.AiConversation({
+      type: AiAssistance.AiHistoryStorage.ConversationType.NONE,
+      data: [],
+      id: 'test-id',
+      isReadOnly: false,
+      aidaClient,
+    });
+
+    const generator = conversation.run('test');
+
+    // First yield should be the UserQuery
+    const firstYield = await generator.next();
+    assert.strictEqual(firstYield.value?.type, AiAssistance.AiAgent.ResponseType.USER_QUERY);
+
+    // Simulate navigation BEFORE the tool call is processed
+    target.setInspectedURL(navigationUrl);
+    const resourceTreeModel = target.model(SDK.ResourceTreeModel.ResourceTreeModel);
+    assert.exists(resourceTreeModel);
+    resourceTreeModel.dispatchEventToListeners(SDK.ResourceTreeModel.Events.PrimaryPageChanged, {
+      frame: {
+        resourceTreeModel: () => resourceTreeModel,
+        unreachableUrl: () => '',
+      } as unknown as SDK.ResourceTreeModel.ResourceTreeFrame,
+      type: SDK.ResourceTreeModel.PrimaryPageChangeType.NAVIGATION
+    });
+
+    // Continue running the generator to completion
+    const results = [];
+    for await (const result of generator) {
+      results.push(result);
+    }
+
+    const errorResult = results.find(r => r.type === AiAssistance.AiAgent.ResponseType.ERROR);
+    if (expectBlocked) {
+      assert.exists(errorResult);
+      assert.strictEqual(errorResult.error, AiAssistance.AiAgent.ErrorType.CROSS_ORIGIN);
+      sinon.assert.callCount(aidaClient.doConversation, 1);
+    } else {
+      assert.isUndefined(errorResult);
+      sinon.assert.callCount(aidaClient.doConversation, 2);
+    }
+  }
+
+  it('blocks tool calls if navigation occurs during the run', async () => {
+    const otherOrigin = Platform.DevToolsPath.urlString`https://other.com`;
+    await testNavigationDuringRun({
+      navigationUrl: Platform.DevToolsPath.urlString`${otherOrigin}/`,
+      expectBlocked: true,
+    });
+  });
+
+  it('does NOT block tool calls if navigation is to about://', async () => {
+    await testNavigationDuringRun({
+      navigationUrl: Platform.DevToolsPath.urlString`about://`,
+      expectBlocked: false,
+    });
+  });
+
+  it('does NOT block tool calls if navigation is to chrome://terms', async () => {
+    await testNavigationDuringRun({
+      navigationUrl: Platform.DevToolsPath.urlString`chrome://terms`,
+      expectBlocked: false,
+    });
+  });
 });
diff --git a/front_end/models/ai_assistance/AiConversation.ts b/front_end/models/ai_assistance/AiConversation.ts
index addf3ca..f383549 100644
--- a/front_end/models/ai_assistance/AiConversation.ts
+++ b/front_end/models/ai_assistance/AiConversation.ts
@@ -14,6 +14,7 @@
 import {AccessibilityAgent, AccessibilityContext} from './agents/AccessibilityAgent.js';
 import {
   type AiAgent,
+  type AllowedOriginResult,
   type ContextDetail,
   type ConversationContext,
   ErrorType,
@@ -34,6 +35,17 @@
 export const NOT_FOUND_IMAGE_DATA = '';
 export const CONTEXT_TITLE = 'Analyzing data';
 const MAX_TITLE_LENGTH = 80;
+/**
+ * List of page navigations that are allowed during an AI agent run.
+ * These are page navigations triggered by agents themselves:
+ * - `about://` : Navigated to before initiating a trace recording to ensure a clean state.
+ * - `chrome://terms`: Navigated to by Lighthouse during its Back-Forward Cache
+ *    audit.
+ */
+export const ALLOWED_PAGE_NAVIGATIONS: Platform.DevToolsPath.UrlString[] = [
+  Platform.DevToolsPath.urlString`about://`,
+  Platform.DevToolsPath.urlString`chrome://terms`,
+];
 
 export function generateContextDetailsMarkdown(details: ContextDetail[]): string {
   const detailsMarkdown: string[] = [];
@@ -87,6 +99,7 @@
   #aidaClient: Host.AidaClient.AidaClient;
   #changeManager: ChangeManager|undefined;
   #origin?: string;
+  #navigationOccurredDuringRun = false;
 
   #contexts: Array<ConversationContext<unknown>> = [];
 
@@ -386,22 +399,43 @@
             multimodalInput?: MultimodalInput,
           } = {},
           ): AsyncGenerator<ResponseData, void, void> {
-    if (this.isBlockedByOrigin) {
-      // This error should not be reached. If it happens, some
-      // invariants do not hold anymore.
-      throw new Error('cross-origin context data should not be included');
-    }
-
-    const userQuery: UserQuery = {
-      type: ResponseType.USER_QUERY,
-      query: initialQuery,
-      imageInput: options.multimodalInput?.input,
-      imageId: options.multimodalInput?.id,
+    this.#navigationOccurredDuringRun = false;
+    const originAtRunStart = getPrimaryPageOrigin();
+    const listener = (): void => {