fix(browser): refuse a coordinate hover across a navigation

The coordinate hover captures the navigation epoch before its page probes and rejects a cross-document navigation before moving the pointer, as browser_click_at and browser_drag do. The overlay helper skips the empty registry slots earlier snapshots leave.

Author: waleedlatif1

apps/desktop/src/main/browser-agent/driver.test.ts

@@ -3783,6 +3783,36 @@ describe('credential protection', () => {
     expect(cdpCalls(contents, 'Input.dispatchKeyEvent').length).toBeGreaterThan(0)
   })
 
+  it('aborts a coordinate hover when a cross-document navigation lands mid-flight', async () => {
+    const contents = await openPage()
+    let navigated = false
+    vi.mocked(contents.executeJavaScript).mockImplementation((expression: string) => {
+      if (isPageCall(expression, 'describePointTarget')) return Promise.resolve({ found: true })
+      if (isPageCall(expression, 'readActiveElementState')) return Promise.resolve({})
+      if (isPageCall(expression, 'readPageActionState')) {
+        if (!navigated) {
+          navigated = true
+          emitContentsEvent(contents, 'did-navigate')
+        }
+        return Promise.resolve({
+          url: 'https://example.com/login',
+          title: 'Example',
+          focus: 'body',
+          mutationRevision: 0,
+          dialogs: [],
+          scroll: [0],
+        })
+      }
+      return Promise.resolve(undefined)
+    })
+
+    const result = await driver.executeTool('chat-test', 'browser_hover', { x: 40, y: 50 })
+
+    expect(result.ok).toBe(false)
+    expect(result.error).toMatch(/active tab or page changed/)
+    expect(cdpCalls(contents, 'Input.dispatchMouseEvent')).toHaveLength(0)
+  })
+
   it('aborts a keypress when a cross-document navigation lands mid-flight', async () => {
     const contents = await openPage()
     let navigated = false

apps/desktop/src/main/browser-agent/driver.ts

@@ -4509,6 +4509,7 @@ async function executeToolInner(
     case 'browser_hover': {
       const contents = session.requireAutomationTab().view.webContents
       if (params.elementId === undefined) {
+        const hoverNavigationEpoch = navigationEpoch(contents)
         const x = requireNum(params, 'x')
         const y = requireNum(params, 'y')
         const path = pointerPath(params)
@@ -4518,7 +4519,7 @@ async function executeToolInner(
           )
         }
         assertCurrentExecution()
-        assertActiveContents(contents)
+        assertActiveContents(contents, hoverNavigationEpoch)
         const pointTarget = unwrapPageResult(
           await execInPage(contents, describePointTarget, [x, y], false, executionDeadline)
         )
@@ -4528,7 +4529,7 @@ async function executeToolInner(
         const beforePage = await pageActionState(contents, true)
         const beforeElement = await activeElementState(contents)
         assertCurrentExecution()
-        assertActiveContents(contents)
+        assertActiveContents(contents, hoverNavigationEpoch)
         await cdp.movePointer(contents, path, { x, y }, signal)
         await sleep(150)
         const afterElement = await activeElementState(contents)

apps/desktop/src/main/browser-agent/page-functions.ts

@@ -125,6 +125,7 @@ export function installPageHelpers(): void {
     const registry = window.__simAgentElements ?? []
     for (let id = 0; id < registry.length && controls.length < 4; id++) {
       const element = registry[id]
+      if (!element) continue
       let inOverlay = false
       for (
         let current: Element | null = element;