Allow selected-text custom questions to opt into general knowledge

[alectimison-maker]

This was generated by AI during triage.

Classification

Enhancement / design discussion. The current behavior is intentional and security-motivated, but it blocks a common selected-text question shape.

User scenario

A user selects text that mentions or implies a concept, then types a trusted custom question such as:

这里的跨平台框架我很感兴趣，现在有哪些跨平台框架？

The selected excerpt discusses the idea of cross-platform frameworks but does not enumerate names. WebBrain responds that the selection is insufficient and asks the user to reselect text or start a new conversation, even though the model could answer the user-authored general question from its own knowledge.

Current behavior and root cause

On current main (9aa969c3), buildSelectionPrompt(..., 'custom', question) applies the same source contract as fixed actions:

Use only the text inside the selection block as source material for this action.
If the selection is insufficient, say so and ask the user to select more text.

The run is then structurally marked selection_only. Agent.selectionGroundingScopes persists that boundary across follow-up turns, disables browser tools, hides earlier conversation/page context, and appends a system note instructing the model not to answer beyond the selection. The only ordinary UI exit is New conversation.

This correctly protects fixed actions such as Summarize and Proofread from inventing source claims, but it conflates two different intents:

1. Answer from the selection only.
2. Use the selection as an untrusted reference, while answering the trusted user question with general model knowledge.

The distinction is especially visible because the popup already separates fixed action buttons from a custom “Ask WebBrain…” field.

Design direction for discussion

Introduce an explicit structured grounding policy rather than weakening selection_only. For example, a selection_context policy could:

• keep the selected page bytes inside <untrusted_page_content> and never treat them as instructions;
• keep the user-authored question trusted;
• allow intrinsic model knowledge when answering that question;
• continue excluding the live page, screenshots, tools, attachments, and pre-selection conversation unless separately authorized;
• make the chosen scope visible in the UI and durable for follow-ups.

The safest UX is an explicit choice near the custom question field (for example, “Selection only” versus “Selection + general knowledge”), with selection_only as the conservative default. Another possible product choice is to make only the custom Ask field use selection_context, while all fixed action buttons remain selection_only; that is simpler but changes the default semantics and should be a maintainer decision.

Acceptance criteria

• A user can explicitly ask a general-knowledge question anchored to selected text without clearing the conversation.
• Selected page text remains wrapped and treated as untrusted data.
• The broader mode does not silently expose the live page, browser tools, screenshots, attachments, or pre-selection history.
• Fixed source-bound actions retain their current selection-only guarantees.
• The active scope and the way to leave it are clear in the UI.
• Follow-up turns preserve the selected scope policy without accidental escalation.
• Chrome and Firefox behavior and regression coverage remain aligned.

Out of scope

• Automatically inferring broader scope from page text.
• Weakening prompt-injection protections around selected content.
• Giving a selection-scoped run browser-action capabilities.