From 9941c96253f79cc448fdf31250f852d638c7cb98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Beaufort?= <beaufort.francois@gmail.com>
Date: Fri, 5 Jun 2026 16:13:28 +0200
Subject: [PATCH 1/2] Gate registerTool on document.domain being disabled

---
 index.bs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/index.bs b/index.bs
index 50d688d..4750dc2 100644
--- a/index.bs
+++ b/index.bs
@@ -332,6 +332,9 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
 1. If |tool owner| is not [=Document/fully active=], then [=exception/throw=] an
    "{{InvalidStateError}}" {{DOMException}}.
 
+1. If [=this=]'s [=relevant global object=]'s {{Window/originAgentCluster}} is false, then
+  [=exception/throw=] a "{{SecurityError}}" {{DOMException}}.
+
 1. If |tool owner| is not [=allowed to use=] the "{{tools}}" feature, then [=exception/throw=] a
    "{{NotAllowedError}}" {{DOMException}}.
 

From 9065910d26a691ca3a8f0b52a6ddcdf8892c08e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Beaufort?= <beaufort.francois@gmail.com>
Date: Fri, 5 Jun 2026 17:26:46 +0200
Subject: [PATCH 2/2] Don't use getter and check file scheme

---
 index.bs | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/index.bs b/index.bs
index 4750dc2..45b4dce 100644
--- a/index.bs
+++ b/index.bs
@@ -92,11 +92,16 @@ spec:html; type:dfn;
   text:form-associated element
   text:browsing context group set
   text:unique internal value
+  text:is origin-keyed
 </pre>
 <pre class="anchors">
 spec: SECURE-CONTEXTS; urlPrefix: https://w3c.github.io/webappsec-secure-contexts/
   type: abstract-op
     text: is origin potentially trustworthy?; url: is-origin-trustworthy
+spec: ECMASCRIPT; urlPrefix: https://tc39.es/ecma262/
+  type: dfn
+    text: surrounding agent; url: surrounding-agent
+    text: agent cluster; url: sec-agent-clusters
 </pre>
 
 <h2 id="intro">Introduction</h2>
@@ -332,8 +337,10 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
 1. If |tool owner| is not [=Document/fully active=], then [=exception/throw=] an
    "{{InvalidStateError}}" {{DOMException}}.
 
-1. If [=this=]'s [=relevant global object=]'s {{Window/originAgentCluster}} is false, then
-  [=exception/throw=] a "{{SecurityError}}" {{DOMException}}.
+1. If this's [=surrounding agent=]'s [=agent cluster=]'s [=is origin-keyed=] is false
+   and this's [=relevant settings object=]'s [=environment settings object/origin=]'s
+   [=origin/scheme=] is not <code>"file"</code>, then [=exception/throw=] a "{{SecurityError}}"
+   {{DOMException}}.
 
 1. If |tool owner| is not [=allowed to use=] the "{{tools}}" feature, then [=exception/throw=] a
    "{{NotAllowedError}}" {{DOMException}}.