Greptile Summary

This PR adds click timeout and abort-signal propagation for the Chrome MCP existing-session path: callTool races the MCP client call against a timeout/abort promise and tears down the session on failure so the next request reconnects cleanly. The Chrome MCP changes and the new tests are correct.

However, the PR also removes assertInteractionNavigationCompletedSafely, scheduleDelayedInteractionNavigationGuard, and the ssrfPolicy parameter from clickViaPlaywright in pw-tools-core.interactions.ts, and drops the corresponding ssrfPolicy pass-through in agent.act.ts. These were the SSRF post-click navigation guards for the managed-browser (Playwright) path; their removal allows a click to navigate to a private-network URL without being caught by the configured SSRF policy.

Confidence Score: 4/5

Not safe to merge as-is: the SSRF post-click navigation guard for the Playwright browser path was inadvertently removed.

The existing-session click timeout fix is correct and well-tested. However, the large deletion in pw-tools-core.interactions.ts removes assertInteractionNavigationCompletedSafely and the ssrfPolicy parameter from clickViaPlaywright, which was the SSRF guard for managed-browser click-triggered navigations. The base branch passed ssrfPolicy: ctx.state().resolved.ssrfPolicy to the click request; the new code omits it entirely. This is a current security-boundary regression that needs to be restored before landing.

extensions/browser/src/browser/pw-tools-core.interactions.ts and extensions/browser/src/browser/routes/agent.act.ts — the SSRF navigation guard and ssrfPolicy threading must be restored for the Playwright click path.

This is a comment left during a code review.
Path: extensions/browser/src/browser/pw-tools-core.interactions.ts
Line: 80-161

Comment:
**SSRF post-click navigation guard removed from Playwright path**

`clickViaPlaywright` previously accepted `ssrfPolicy` and wrapped the locator click inside `assertInteractionNavigationCompletedSafely`, which detected any navigation triggered by the click and enforced the SSRF policy against it. Both the `ssrfPolicy` parameter and the navigation guard wrapper have been removed in this PR, and the route handler (`agent.act.ts`) no longer passes `ssrfPolicy` to click requests.

Concretely: if a managed-browser page has a link or button that navigates to a private network URL (e.g. `http://192.168.1.1/admin`), clicking it via the Playwright path now bypasses the SSRF check that previously blocked such navigations when `dangerouslyAllowPrivateNetwork` is not set. The base branch passed `ssrfPolicy: ctx.state().resolved.ssrfPolicy` to `clickViaPlaywright` (old `agent.act.ts` line 542); this PR removes that field entirely.

The fix for click timeouts in the existing-session path is unrelated to this guard. `assertInteractionNavigationCompletedSafely`, `scheduleDelayedInteractionNavigationGuard`, and the `ssrfPolicy` parameter should be restored to `clickViaPlaywright` (and threaded back through from the route handler) before merging.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(browser): propagate click aborts thr..." | Re-trigger Greptile}

Addressed the review follow-ups in 33864003ae4cf20c4a52e17258c4b35afa84aaf5. The rebase onto current main preserved the Playwright SSRF post-click navigation guard and ssrfPolicy threading, while the Chrome MCP path now skips side-effecting click dispatch when the request signal is already aborted. I also updated the PR body to tag #57158 and reran the targeted browser tests plus pnpm build.

Landed via rebase onto latest main.\n\nGate before merge:\n- pnpm test extensions/browser/src/browser/chrome-mcp.test.ts extensions/browser/src/browser/routes/agent.existing-session.test.ts extensions/browser/src/browser/pw-tools-core.interactions.evaluate.abort.test.ts: 25 passed\n- pnpm check:changed: 80 files / 717 tests passed\n- note: one prior changed-gate run hit a transient chrome.test.ts diagnostic race; rerun of extensions/browser/src/browser/chrome.test.ts passed 27/27, then final pnpm check:changed passed\n\nLand commit: aadd692\nMerge commit: e92079b\n\nThanks @dongseok0!