CVE-2026-45244

@@ -8,6 +8,7 @@ export async function runChatAgentLoop({
   chatController,
   chatSession,
   createStreamingAssistantMessage,
+  confirmToolCall,
   executeToolCall,
   getAutomationToolNames,
   hasDebuggerPermission,
@@ -37,6 +38,7 @@ export async function runChatAgentLoop({
     ) => Promise<{ ok: boolean; assistant?: Message; error?: string }>;
   };
   createStreamingAssistantMessage: () => ChatMessage;
+  confirmToolCall?: (call: ToolCall) => boolean | Promise<boolean>;
   executeToolCall: (call: ToolCall) => Promise<ToolResultMessage>;
   getAutomationToolNames: () => string[];
   hasDebuggerPermission: () => Promise<boolean>;
@@ -96,6 +98,29 @@ export async function runChatAgentLoop({
 
     for (const call of toolCalls) {
       if (chatSession.isAbortRequested()) return;
+      if (confirmToolCall) {
+        const confirmed = await confirmToolCall(call);
+        if (!confirmed) {
+          const toolCallId =
+            (call as { toolCallId?: string; id?: string }).toolCallId ??
+            (call as { id?: string }).id ??
+            `${call.name}-${Date.now()}`;
+          chatController.addMessage(
+            wrapMessage({
+              role: "toolResult",
+              toolCallId,
+              toolName: call.name,
+              content: [
+                { type: "text", text: `Tool call ${call.name} was cancelled by the user.` },
+              ],
+              isError: true,
+              timestamp: Date.now(),
+            }),
+          );
+          scrollToBottom(true);
+          continue;
+        }
+      }
       if (call.name === "navigate") {
         const args = call.arguments as { url?: string };
         markAgentNavigationIntent(args?.url);

@@ -1,4 +1,4 @@
-import type { Message, ToolCall } from "@mariozechner/pi-ai";
+import type { Message, ToolCall, ToolResultMessage } from "@mariozechner/pi-ai";
 import { extractYouTubeVideoId } from "@steipete/summarize-core/content/url";
 import MarkdownIt from "markdown-it";
 import { executeToolCall, getAutomationToolNames } from "../../automation/tools";
@@ -1530,11 +1530,28 @@ function seedPlannedSlidesForRun(run: RunStart) {
   return true;
 }
 
+function describeAutomationToolCall(call: ToolCall): string {
+  const args = call.arguments ? JSON.stringify(call.arguments, null, 2) : "{}";
+  return `${call.name}\n\n${args}`;
+}
+
+async function confirmAutomationToolCall(call: ToolCall): Promise<boolean> {
+  return window.confirm(
+    [
+      "Summarize agent wants to run an automation tool.",
+      "Only approve this if you expected the current task to control the browser or extension automation.",
+      "",
+      describeAutomationToolCall(call),
+    ].join("\n"),
+  );
+}
+
 async function runAgentLoop() {
   await runChatAgentLoop({
     automationEnabled: automationEnabledValue,
     chatController,
     chatSession,
+    confirmToolCall: confirmAutomationToolCall,
     createStreamingAssistantMessage: buildStreamingAssistantMessage,
     executeToolCall: async (call) => (await executeToolCall(call)) as ToolResultMessage,
     getAutomationToolNames,

@@ -0,0 +1,135 @@
+import { describe, expect, it, vi } from "vitest";
+import { runChatAgentLoop } from "../apps/chrome-extension/src/entrypoints/sidepanel/chat-agent-loop.js";
+
+function buildHarness({
+  confirmToolCall,
+  toolCall = {
+    type: "toolCall",
+    id: "call-1",
+    name: "debugger",
+    arguments: { action: "eval", expression: "document.body.innerText" },
+  },
+}: {
+  confirmToolCall?: () => Promise<boolean> | boolean;
+  toolCall?: {
+    type: "toolCall";
+    id: string;
+    name: string;
+    arguments: Record<string, unknown>;
+  };
+} = {}) {
+  const executeToolCall = vi.fn(async (call) => ({
+    role: "toolResult" as const,
+    toolCallId: call.id,
+    toolName: call.name,
+    content: [{ type: "text" as const, text: "executed" }],
+    isError: false,
+    timestamp: Date.now(),
+  }));
+
+  const chatController = {
+    addMessage: vi.fn(),
+    buildRequestMessages: vi.fn(() => [
+      {
+        role: "user",
+        content: "Summarize this page with attacker-controlled content.",
+        timestamp: Date.now(),
+      },
+    ]),
+    finishStreamingMessage: vi.fn(),
+    removeMessage: vi.fn(),
+    replaceMessage: vi.fn(),
+    updateStreamingMessage: vi.fn(),
+  };
+
+  let calls = 0;
+  const chatSession = {
+    isAbortRequested: () => false,
+    requestAgent: vi.fn(async () => {
+      calls += 1;
+      if (calls === 1) {
+        return {
+          ok: true,
+          assistant: {
+            role: "assistant",
+            content: [toolCall],
+            timestamp: Date.now(),
+          },
+        };
+      }
+      return {
+        ok: true,
+        assistant: { role: "assistant", content: "done", timestamp: Date.now() },
+      };
+    }),
+  };
+
+  return {
+    executeToolCall,
+    chatController,
+    chatSession,
+    args: {
+      automationEnabled: true,
+      summaryMarkdown: "Attacker-controlled page content can be included here.",
+      chatController,
+      chatSession,
+      createStreamingAssistantMessage: () => ({
+        id: "streaming",
+        role: "assistant" as const,
+        content: "",
+        timestamp: Date.now(),
+      }),
+      executeToolCall,
+      getAutomationToolNames: () => [toolCall.name],
+      hasDebuggerPermission: async () => true,
+      markAgentNavigationIntent: vi.fn(),
+      markAgentNavigationResult: vi.fn(),
+      scrollToBottom: vi.fn(),
+      wrapMessage: (message: unknown) => ({ id: "wrapped", ...(message as object) }),
+      confirmToolCall,
+    },
+  };
+}
+
+describe("chat agent automation tool confirmation", () => {
+  it("does not execute a dangerous tool call when confirmation is denied", async () => {
+    const confirmToolCall = vi.fn(async () => false);
+    const harness = buildHarness({ confirmToolCall });
+
+    await runChatAgentLoop(harness.args as never);
+
+    expect(confirmToolCall).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "debugger",
+        arguments: { action: "eval", expression: "document.body.innerText" },
+      }),
+    );
+    expect(harness.executeToolCall).not.toHaveBeenCalled();
+    expect(harness.chatController.addMessage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        role: "toolResult",
+        toolName: "debugger",
+        isError: true,
+      }),
+    );
+  });
+
+  it("does not mark navigation intent before a denied navigate call", async () => {
+    const confirmToolCall = vi.fn(async () => false);
+    const harness = buildHarness({
+      confirmToolCall,
+      toolCall: {
+        type: "toolCall",
+        id: "call-1",
+        name: "navigate",
+        arguments: { url: "https://example.com/phishing" },
+      },
+    });
+
+    await runChatAgentLoop(harness.args as never);
+
+    expect(harness.args.markAgentNavigationIntent).not.toHaveBeenCalled();
+    expect(harness.args.markAgentNavigationResult).not.toHaveBeenCalled();
+    expect(harness.executeToolCall).not.toHaveBeenCalled();
+  });
+});