chrome-devtools-frontend 1.0.1631386 → 1.0.1632065

package/SECURITY.md

@@ -0,0 +1,55 @@
+# Chrome DevTools Frontend Security Policy & Threat Model
+
+This document outlines the security goals, boundaries, and threat model for the Chrome DevTools frontend.
+
+## Architectural Philosophy & Trust Boundaries
+
+Chrome DevTools is a privileged web app running in a sandboxed renderer process, communicating via the Chrome DevTools Protocol (CDP).
+
+* **Intended Capabilities:** DevTools is designed to inspect, mutate, and control debug targets (tabs, workers, remote nodes). Actions like code execution (Console, Snippets) or filesystem binding are intended behaviors, not vulnerabilities.
+* **Data Processing:** The frontend does not execute untrusted user-space code in its own processes. It may instruct the debug target to execute code. It parses structured data from the CDP target. While a target page may be compromised, DevTools must safely display this data without escalating privileges to the browser process or host OS.
+
+## Threat Model Boundaries
+
+### Inside Threat Model
+* Compromising the DevTools frontend renderer process.
+* Compromising the CDP backend via tampered protocol messages.
+* Unauthorized exfiltration of sensitive local files or user data outside the debugging scope.
+* Triggering Chrome memory corruption exploits.
+
+### Outside Threat Model
+* **Social Engineering:** Convincing developers to paste payloads into the Console or connect to malicious remote debugging ports.
+* **Legitimate Data Exposure:** Displaying local user data, cookies, tokens, or auth headers within UI panels.
+* **Local Data Persistence:** Saving user-initiated traces, heaps, profiles, or logs to disk.
+* **Correctness & Availability:** Stale, misleading, or missing UI information (classified as functional bugs).
+* **Disabled-by-default Experimental Features:** Experimental features or capabilities that are disabled by default, e.g. requiring a command-line flag to be activated, or a specific runtime setting within DevTools to be manually turned on.
+
+## Specific Severity Classification Rules (S1–S4)
+
+### S0 (Critical)
+* Exploits affecting users without Chrome DevTools being open.
+
+### S1 (High)
+* Exploits requiring only standard user actions within an open DevTools window.
+* HTML injection or rendering untrusted content within the DevTools UI.
+* Persistent exploits (e.g., manipulating service worker source code).
+
+### S2 (Medium)
+* Exploits strictly dependent on explicit, non-standard user interactions.
+* Targets leveraging parsing flaws to compromise another renderer process without escaping the browser sandbox.
+
+### S3 (Low)
+* Exploits requiring a malicious, highly-privileged Chrome Extension to interact with DevTools APIs, including bypassing extension host policy.
+* Spoofing links in DevTools that navigate to restricted internal URLs (e.g., `chrome://`).
+* Vulnerabilities requiring specific command-line arguments, third-party tools, or loading tampered local files.
+* Other exploits in features which are marked as experimental, but enabled by default.
+
+## Specific Aspects
+
+### AI & LLM Features
+* **Trusted Backend:** The remote Google LLM backend is trusted; data sent to it is not an exfiltration vulnerability.
+* **AI Safety:** Prompt injection, jailbreaks, or offensive/incorrect AI output are functional bugs, not vulnerabilities.
+* **Exception:** Prompt injection is only a vulnerability if it crosses cross-origin boundaries or executes unauthorized CDP commands.
+
+### Side-Effect Free Evaluation
+* Side-effect free JavaScript evaluation is a best-effort developer heuristic to prevent accidental state changes, not a security boundary. Bypassing it to cause side effects on the debugged page is not a vulnerability.

package/front_end/core/common/Revealer.ts

@@ -54,6 +54,10 @@ const UIStrings = {
    * @description The UI destination when revealing loaded resources through the Animations panel
    */
   animationsPanel: 'Animations panel',
+  /**
+   * @description The UI destination when revealing an item in the Lighthouse panel
+   */
+  lighthousePanel: 'Lighthouse panel',
 } as const;
 const str_ = i18n.i18n.registerUIStrings('core/common/Revealer.ts', UIStrings);
 const i18nLazyString = i18n.i18n.getLazilyComputedLocalizedString.bind(undefined, str_);
@@ -187,6 +191,7 @@ export const RevealerDestination = {
   SOURCES_PANEL: i18nLazyString(UIStrings.sourcesPanel),
   MEMORY_INSPECTOR_PANEL: i18nLazyString(UIStrings.memoryInspectorPanel),
   ANIMATIONS_PANEL: i18nLazyString(UIStrings.animationsPanel),
+  LIGHTHOUSE_PANEL: i18nLazyString(UIStrings.lighthousePanel),
 };
 
 export type RevealerDestination = () => Platform.UIString.LocalizedString;

package/front_end/core/host/AidaClient.ts

@@ -9,7 +9,7 @@ import * as Root from '../root/root.js';
 import {
   AidaAccessPreconditions,
   type AidaChunkResponse,
-  type AidaFunctionCallResponse,
+  type AidaFunctionCall,
   AidaInferenceLanguage,
   type AidaRegisterClientEvent,
   ClientFeature,
@@ -211,7 +211,7 @@ export class AidaClient {
     let chunk;
     const text = [];
     let inCodeChunk = false;
-    const functionCalls: AidaFunctionCallResponse[] = [];
+    const functionCalls: AidaFunctionCall[] = [];
     let metadata: ResponseMetadata = {rpcGlobalId: 0};
     while ((chunk = await stream.read())) {
       debugLog('doConversation stream chunk:', chunk);
@@ -246,6 +246,7 @@ export class AidaClient {
           functionCalls.push({
             name: result.functionCallChunk.functionCall.name,
             args: result.functionCallChunk.functionCall.args,
+            thoughtSignature: result.functionCallChunk.functionCall.thoughtSignature,
           });
         } else if ('error' in result) {
           throw new Error(`Server responded: ${JSON.stringify(result)}`);
@@ -264,8 +265,7 @@ export class AidaClient {
     yield {
       explanation: text.join('') + (inCodeChunk ? CODE_CHUNK_SEPARATOR() : ''),
       metadata,
-      functionCalls: functionCalls.length ? functionCalls as [AidaFunctionCallResponse, ...AidaFunctionCallResponse[]] :
-                                            undefined,
+      functionCalls: functionCalls.length ? functionCalls as [AidaFunctionCall, ...AidaFunctionCall[]] : undefined,
       completed: true,
     };
   }

package/front_end/core/host/AidaClientTypes.ts

@@ -32,10 +32,7 @@ export interface Content {
 export type Part = {
   text: string,
 }|{
-  functionCall: {
-    name: string,
-    args: Record<string, unknown>,
-  },
+  functionCall: AidaFunctionCall,
 }|{
   functionResponse: {
     name: string,
@@ -375,9 +372,10 @@ export interface AttributionMetadata {
   citations: Citation[];
 }
 
-export interface AidaFunctionCallResponse {
+export interface AidaFunctionCall {
   name: string;
   args: Record<string, unknown>;
+  thoughtSignature?: string;
 }
 
 export interface FactualityFact {
@@ -402,7 +400,7 @@ export interface ResponseMetadata {
 export interface DoConversationResponse {
   explanation: string;
   metadata: ResponseMetadata;
-  functionCalls?: [AidaFunctionCallResponse, ...AidaFunctionCallResponse[]];
+  functionCalls?: [AidaFunctionCall, ...AidaFunctionCall[]];
   completed: boolean;
 }
 
@@ -461,10 +459,7 @@ export interface AidaChunkResponse {
     inferenceLanguage: AidaInferenceLanguage,
   };
   functionCallChunk?: {
-    functionCall: {
-      name: string,
-      args: Record<string, unknown>,
-    },
+    functionCall: AidaFunctionCall,
   };
   error?: string;
 }

package/front_end/core/host/AidaGcaTranslation.ts

@@ -48,7 +48,7 @@ export function aidaDoConversationRequestToGcaRequest(request: AIDA.DoConversati
                                                 })),
       }];
     }
-    AIDA.debugLog('Translation succeded:', JSON.stringify(request), JSON.stringify(gcaRequest));
+    AIDA.debugLog('Translation succeeded:', JSON.stringify(request), JSON.stringify(gcaRequest));
     return gcaRequest;
   } catch (e) {
     AIDA.debugLog('Translation error:', JSON.stringify(request), e);
@@ -70,15 +70,19 @@ function mapCommonAidaRequestFields(aidaRequest: AidaRequest, gcaRequest: GCA.Ge
 
 export function gcaResponseToAidaDoConversationResponse(response: GCA.GenerateContentResponse):
     AIDA.DoConversationResponse {
-  const functionCalls: AIDA.AidaFunctionCallResponse[] = [];
+  const functionCalls: AIDA.AidaFunctionCall[] = [];
 
   if (response.candidates?.[0].content?.parts) {
     for (const part of response.candidates[0].content.parts) {
       if (part.functionCall) {
-        functionCalls.push({
+        const functionCall: AIDA.AidaFunctionCall = {
           name: part.functionCall.name,
           args: part.functionCall.args || {},
-        });
+        };
+        if (part.thoughtSignature) {
+          functionCall.thoughtSignature = part.thoughtSignature;
+        }
+        functionCalls.push(functionCall);
       }
     }
   }
@@ -88,9 +92,8 @@ export function gcaResponseToAidaDoConversationResponse(response: GCA.GenerateCo
     metadata: {
       rpcGlobalId: response.responseId,
     },
-    functionCalls: functionCalls.length > 0 ?
-        (functionCalls as [AIDA.AidaFunctionCallResponse, ...AIDA.AidaFunctionCallResponse[]]) :
-        undefined,
+    functionCalls: functionCalls.length > 0 ? (functionCalls as [AIDA.AidaFunctionCall, ...AIDA.AidaFunctionCall[]]) :
+                                              undefined,
     completed: true,
   };
 }
@@ -387,12 +390,16 @@ function convertAidaPartToGcaPart(part: AIDA.Part): GCA.Part {
     return {text: part.text};
   }
   if ('functionCall' in part) {
-    return {
+    const gcaPart: GCA.Part = {
       functionCall: {
         name: part.functionCall.name,
         args: part.functionCall.args,
       },
     };
+    if (part.functionCall.thoughtSignature) {
+      gcaPart.thoughtSignature = part.functionCall.thoughtSignature;
+    }
+    return gcaPart;
   }
   if ('functionResponse' in part) {
     const fResponse: Record<string, unknown> = {};
@@ -451,6 +458,9 @@ function convertAidaParamToGcaSchema<T extends string|number|symbol = string>(pa
 
 export function gcaChunkResponseToAidaChunkResponse(response: GCA.GenerateContentResponse): AIDA.AidaChunkResponse[] {
   try {
+    if (response.error) {
+      throw new Error(JSON.stringify(response.error));
+    }
     const candidate = response.candidates?.[0];
     const parts = candidate?.content?.parts || [];
     const metadata: AIDA.ResponseMetadata = {
@@ -482,6 +492,9 @@ export function gcaChunkResponseToAidaChunkResponse(response: GCA.GenerateConten
             args: part.functionCall.args || {},
           },
         };
+        if (part.thoughtSignature) {
+          aidaChunkResponse.functionCallChunk.functionCall.thoughtSignature = part.thoughtSignature;
+        }
       }
       if (part.executableCode) {
         aidaChunkResponse.codeChunk = {

package/front_end/core/host/GcaTypes.ts

@@ -333,6 +333,7 @@ export interface GenerateContentResponse {
   usageMetadata: UsageMetadata;
   modelVersion: string;
   responseId: string;
+  error?: Record<string, unknown>;
 }
 
 export interface Candidate {

package/front_end/core/protocol_client/DevToolsCDPConnection.ts

@@ -137,6 +137,15 @@ export class DevToolsCDPConnection implements CDPConnection {
         return;
       }
 
+      // DevTools inconsistently uses empty string or undefined to denote root
+      // session. Generally, empty string should not be used for the root
+      // session but to avoid potentially breaking callers we use '' for
+      // comparison here if the sessionId is undefined.
+      if ((callback.sessionId ?? '') !== (messageObject.sessionId ?? '')) {
+        // Ignore messages where ID does not match the session.
+        return;
+      }
+
       callback.resolve(messageObject);
       --this.#pendingResponsesCount;
       this.#pendingLongPollingMessageIds.delete(messageObject.id);

package/front_end/core/sdk/CSSRule.ts

@@ -411,7 +411,12 @@ export class CSSFunctionRule extends CSSRule {
   constructor(cssModel: CSSModel, payload: Protocol.CSS.CSSFunctionRule) {
     super(cssModel, {
       origin: payload.origin,
-      style: {cssProperties: [], shorthandEntries: []},
+      style: {
+        cssProperties: [],
+        shorthandEntries: [],
+        range: CSSFunctionRule.mergeRanges(payload.children),
+        styleSheetId: payload.styleSheetId
+      },
       header: styleSheetHeaderForRule(cssModel, payload),
     });
     this.#name = new CSSValue(payload.name);
@@ -479,4 +484,67 @@ export class CSSFunctionRule extends CSSRule {
     console.error('A function rule node must have a style or condition');
     return;
   }
+
+  override rebase(edit: Edit): void {
+    super.rebase(edit);
+    if (edit.styleSheetId !== this.style.styleSheetId) {
+      return;
+    }
+    this.rebaseChildren(this.#children, edit);
+  }
+
+  rebaseChildren(children: CSSNestedStyle[], edit: Edit): void {
+    for (const child of children) {
+      if ('style' in child) {
+        child.style.rebase(edit);
+      }
+      if ('children' in child) {
+        if ('media' in child) {
+          child.media.rebase(edit);
+        }
+        if ('container' in child) {
+          child.container.rebase(edit);
+        }
+        if ('supports' in child) {
+          child.supports.rebase(edit);
+        }
+        if ('navigation' in child) {
+          child.navigation.rebase(edit);
+        }
+        this.rebaseChildren(child.children, edit);
+      }
+    }
+  }
+
+  static mergeRanges(nodes: Protocol.CSS.CSSFunctionNode[]): Protocol.CSS.SourceRange|undefined {
+    let mergedRange: Protocol.CSS.SourceRange|undefined;
+    const nodeQueue = [...nodes];
+    while (nodeQueue.length > 0) {
+      const node = nodeQueue.pop() as Protocol.CSS.CSSFunctionNode;
+
+      if (node.condition) {
+        nodeQueue.push(...node.condition.children);
+      }
+      if (node.style) {
+        if (!node.style.range) {
+          return;
+        }
+        const {startLine, startColumn, endLine, endColumn} = node.style.range;
+        if (!mergedRange) {
+          mergedRange = {startLine, startColumn, endLine, endColumn};
+          continue;
+        }
+        if (startLine < mergedRange.startLine ||
+            (startLine === mergedRange.startLine && startColumn < mergedRange.startColumn)) {
+          mergedRange.startLine = startLine;
+          mergedRange.startColumn = startColumn;
+        }
+        if (endLine > mergedRange.endLine || (endLine === mergedRange.endLine && endColumn > mergedRange.endColumn)) {
+          mergedRange.endLine = endLine;
+          mergedRange.endColumn = endColumn;
+        }
+      }
+    }
+    return mergedRange;
+  }
 }

package/front_end/core/sdk/RemoteObject.ts

@@ -210,14 +210,15 @@ export abstract class RemoteObject {
     return null;
   }
 
-  callFunction<T, U>(_functionDeclaration: (this: U, ...args: any[]) => T, _args?: Protocol.Runtime.CallArgument[]):
-      Promise<CallFunctionResult> {
+  callFunction<T, U>(
+      _functionDeclaration: (this: U, ...args: any[]) => T, _args?: Protocol.Runtime.CallArgument[],
+      _params?: {throwOnSideEffect?: boolean}|undefined): Promise<CallFunctionResult> {
     throw new Error('Not implemented');
   }
 
   callFunctionJSON<T, U>(
-      _functionDeclaration: (this: U, ...args: any[]) => T,
-      _args: Protocol.Runtime.CallArgument[]|undefined): Promise<T|null> {
+      _functionDeclaration: (this: U, ...args: any[]) => T, _args: Protocol.Runtime.CallArgument[]|undefined,
+      _params?: {throwOnSideEffect?: boolean}|undefined): Promise<T|null> {
     throw new Error('Not implemented');
   }
 
@@ -523,13 +524,14 @@ export class RemoteObjectImpl extends RemoteObject {
   }
 
   override async callFunction<T, U>(
-      functionDeclaration: (this: U, ...args: any[]) => T,
-      args?: Protocol.Runtime.CallArgument[]): Promise<CallFunctionResult> {
+      functionDeclaration: (this: U, ...args: any[]) => T, args?: Protocol.Runtime.CallArgument[],
+      params?: {throwOnSideEffect?: boolean}): Promise<CallFunctionResult> {
     const response = await this.#runtimeAgent.invoke_callFunctionOn({
       objectId: this.#objectId,
       functionDeclaration: functionDeclaration.toString(),
       arguments: args,
       silent: true,
+      throwOnSideEffect: params?.throwOnSideEffect,
     });
     if (response.getError()) {
       return {object: null, wasThrown: false};
@@ -542,14 +544,15 @@ export class RemoteObjectImpl extends RemoteObject {
   }
 
   override async callFunctionJSON<T, U>(
-      functionDeclaration: (this: U, ...args: any[]) => T,
-      args: Protocol.Runtime.CallArgument[]|undefined): Promise<T|null> {
+      functionDeclaration: (this: U, ...args: any[]) => T, args: Protocol.Runtime.CallArgument[]|undefined,
+      params?: {throwOnSideEffect?: boolean}): Promise<T|null> {
     const response = await this.#runtimeAgent.invoke_callFunctionOn({
       objectId: this.#objectId,
       functionDeclaration: functionDeclaration.toString(),
       arguments: args,
       silent: true,
       returnByValue: true,
+      throwOnSideEffect: params?.throwOnSideEffect,
     });
     if (response.getError() || response.exceptionDetails) {
       return null;

package/front_end/generated/InspectorBackendCommands.ts

@@ -1212,7 +1212,7 @@ inspectorBackend.registerEnum("Preload.SpeculationAction", {Prefetch: "Prefetch"
 inspectorBackend.registerEnum("Preload.SpeculationTargetHint", {Blank: "Blank", Self: "Self"});
 inspectorBackend.registerEnum("Preload.PrerenderFinalStatus", {Activated: "Activated", Destroyed: "Destroyed", LowEndDevice: "LowEndDevice", InvalidSchemeRedirect: "InvalidSchemeRedirect", InvalidSchemeNavigation: "InvalidSchemeNavigation", NavigationRequestBlockedByCsp: "NavigationRequestBlockedByCsp", MojoBinderPolicy: "MojoBinderPolicy", RendererProcessCrashed: "RendererProcessCrashed", RendererProcessKilled: "RendererProcessKilled", Download: "Download", TriggerDestroyed: "TriggerDestroyed", NavigationNotCommitted: "NavigationNotCommitted", NavigationBadHttpStatus: "NavigationBadHttpStatus", ClientCertRequested: "ClientCertRequested", NavigationRequestNetworkError: "NavigationRequestNetworkError", CancelAllHostsForTesting: "CancelAllHostsForTesting", DidFailLoad: "DidFailLoad", Stop: "Stop", SslCertificateError: "SslCertificateError", LoginAuthRequested: "LoginAuthRequested", UaChangeRequiresReload: "UaChangeRequiresReload", BlockedByClient: "BlockedByClient", AudioOutputDeviceRequested: "AudioOutputDeviceRequested", MixedContent: "MixedContent", TriggerBackgrounded: "TriggerBackgrounded", MemoryLimitExceeded: "MemoryLimitExceeded", DataSaverEnabled: "DataSaverEnabled", TriggerUrlHasEffectiveUrl: "TriggerUrlHasEffectiveUrl", ActivatedBeforeStarted: "ActivatedBeforeStarted", InactivePageRestriction: "InactivePageRestriction", StartFailed: "StartFailed", TimeoutBackgrounded: "TimeoutBackgrounded", CrossSiteRedirectInInitialNavigation: "CrossSiteRedirectInInitialNavigation", CrossSiteNavigationInInitialNavigation: "CrossSiteNavigationInInitialNavigation", SameSiteCrossOriginRedirectNotOptInInInitialNavigation: "SameSiteCrossOriginRedirectNotOptInInInitialNavigation", SameSiteCrossOriginNavigationNotOptInInInitialNavigation: "SameSiteCrossOriginNavigationNotOptInInInitialNavigation", ActivationNavigationParameterMismatch: "ActivationNavigationParameterMismatch", ActivatedInBackground: "ActivatedInBackground", EmbedderHostDisallowed: "EmbedderHostDisallowed", ActivationNavigationDestroyedBeforeSuccess: "ActivationNavigationDestroyedBeforeSuccess", TabClosedByUserGesture: "TabClosedByUserGesture", TabClosedWithoutUserGesture: "TabClosedWithoutUserGesture", PrimaryMainFrameRendererProcessCrashed: "PrimaryMainFrameRendererProcessCrashed", PrimaryMainFrameRendererProcessKilled: "PrimaryMainFrameRendererProcessKilled", ActivationFramePolicyNotCompatible: "ActivationFramePolicyNotCompatible", PreloadingDisabled: "PreloadingDisabled", BatterySaverEnabled: "BatterySaverEnabled", ActivatedDuringMainFrameNavigation: "ActivatedDuringMainFrameNavigation", PreloadingUnsupportedByWebContents: "PreloadingUnsupportedByWebContents", CrossSiteRedirectInMainFrameNavigation: "CrossSiteRedirectInMainFrameNavigation", CrossSiteNavigationInMainFrameNavigation: "CrossSiteNavigationInMainFrameNavigation", SameSiteCrossOriginRedirectNotOptInInMainFrameNavigation: "SameSiteCrossOriginRedirectNotOptInInMainFrameNavigation", SameSiteCrossOriginNavigationNotOptInInMainFrameNavigation: "SameSiteCrossOriginNavigationNotOptInInMainFrameNavigation", MemoryPressureOnTrigger: "MemoryPressureOnTrigger", MemoryPressureAfterTriggered: "MemoryPressureAfterTriggered", PrerenderingDisabledByDevTools: "PrerenderingDisabledByDevTools", SpeculationRuleRemoved: "SpeculationRuleRemoved", ActivatedWithAuxiliaryBrowsingContexts: "ActivatedWithAuxiliaryBrowsingContexts", MaxNumOfRunningEagerPrerendersExceeded: "MaxNumOfRunningEagerPrerendersExceeded", MaxNumOfRunningNonEagerPrerendersExceeded: "MaxNumOfRunningNonEagerPrerendersExceeded", MaxNumOfRunningEmbedderPrerendersExceeded: "MaxNumOfRunningEmbedderPrerendersExceeded", PrerenderingUrlHasEffectiveUrl: "PrerenderingUrlHasEffectiveUrl", RedirectedPrerenderingUrlHasEffectiveUrl: "RedirectedPrerenderingUrlHasEffectiveUrl", ActivationUrlHasEffectiveUrl: "ActivationUrlHasEffectiveUrl", JavaScriptInterfaceAdded: "JavaScriptInterfaceAdded", JavaScriptInterfaceRemoved: "JavaScriptInterfaceRemoved", AllPrerenderingCanceled: "AllPrerenderingCanceled", WindowClosed: "WindowClosed", SlowNetwork: "SlowNetwork", OtherPrerenderedPageActivated: "OtherPrerenderedPageActivated", V8OptimizerDisabled: "V8OptimizerDisabled", PrerenderFailedDuringPrefetch: "PrerenderFailedDuringPrefetch", BrowsingDataRemoved: "BrowsingDataRemoved", PrerenderHostReused: "PrerenderHostReused", FormSubmitWhenPrerendering: "FormSubmitWhenPrerendering", CrossDocumentRestart: "CrossDocumentRestart"});
 inspectorBackend.registerEnum("Preload.PreloadingStatus", {Pending: "Pending", Running: "Running", Ready: "Ready", Success: "Success", Failure: "Failure", NotSupported: "NotSupported"});
-inspectorBackend.registerEnum("Preload.PrefetchStatus", {PrefetchAllowed: "PrefetchAllowed", PrefetchFailedIneligibleRedirect: "PrefetchFailedIneligibleRedirect", PrefetchFailedInvalidRedirect: "PrefetchFailedInvalidRedirect", PrefetchFailedMIMENotSupported: "PrefetchFailedMIMENotSupported", PrefetchFailedNetError: "PrefetchFailedNetError", PrefetchFailedNon2XX: "PrefetchFailedNon2XX", PrefetchEvictedAfterBrowsingDataRemoved: "PrefetchEvictedAfterBrowsingDataRemoved", PrefetchEvictedAfterCandidateRemoved: "PrefetchEvictedAfterCandidateRemoved", PrefetchEvictedForNewerPrefetch: "PrefetchEvictedForNewerPrefetch", PrefetchHeldback: "PrefetchHeldback", PrefetchIneligibleRetryAfter: "PrefetchIneligibleRetryAfter", PrefetchIsPrivacyDecoy: "PrefetchIsPrivacyDecoy", PrefetchIsStale: "PrefetchIsStale", PrefetchNotEligibleBrowserContextOffTheRecord: "PrefetchNotEligibleBrowserContextOffTheRecord", PrefetchNotEligibleDataSaverEnabled: "PrefetchNotEligibleDataSaverEnabled", PrefetchNotEligibleExistingProxy: "PrefetchNotEligibleExistingProxy", PrefetchNotEligibleHostIsNonUnique: "PrefetchNotEligibleHostIsNonUnique", PrefetchNotEligibleNonDefaultStoragePartition: "PrefetchNotEligibleNonDefaultStoragePartition", PrefetchNotEligibleSameSiteCrossOriginPrefetchRequiredProxy: "PrefetchNotEligibleSameSiteCrossOriginPrefetchRequiredProxy", PrefetchNotEligibleSchemeIsNotHttps: "PrefetchNotEligibleSchemeIsNotHttps", PrefetchNotEligibleUserHasCookies: "PrefetchNotEligibleUserHasCookies", PrefetchNotEligibleUserHasServiceWorker: "PrefetchNotEligibleUserHasServiceWorker", PrefetchNotEligibleUserHasServiceWorkerNoFetchHandler: "PrefetchNotEligibleUserHasServiceWorkerNoFetchHandler", PrefetchNotEligibleRedirectFromServiceWorker: "PrefetchNotEligibleRedirectFromServiceWorker", PrefetchNotEligibleRedirectToServiceWorker: "PrefetchNotEligibleRedirectToServiceWorker", PrefetchNotEligibleBatterySaverEnabled: "PrefetchNotEligibleBatterySaverEnabled", PrefetchNotEligiblePreloadingDisabled: "PrefetchNotEligiblePreloadingDisabled", PrefetchNotFinishedInTime: "PrefetchNotFinishedInTime", PrefetchNotStarted: "PrefetchNotStarted", PrefetchNotUsedCookiesChanged: "PrefetchNotUsedCookiesChanged", PrefetchProxyNotAvailable: "PrefetchProxyNotAvailable", PrefetchResponseUsed: "PrefetchResponseUsed", PrefetchSuccessfulButNotUsed: "PrefetchSuccessfulButNotUsed", PrefetchNotUsedProbeFailed: "PrefetchNotUsedProbeFailed"});
+inspectorBackend.registerEnum("Preload.PrefetchStatus", {PrefetchAllowed: "PrefetchAllowed", PrefetchFailedIneligibleRedirect: "PrefetchFailedIneligibleRedirect", PrefetchFailedInvalidRedirect: "PrefetchFailedInvalidRedirect", PrefetchFailedMIMENotSupported: "PrefetchFailedMIMENotSupported", PrefetchFailedNetError: "PrefetchFailedNetError", PrefetchFailedNon2XX: "PrefetchFailedNon2XX", PrefetchEvictedAfterBrowsingDataRemoved: "PrefetchEvictedAfterBrowsingDataRemoved", PrefetchEvictedAfterCandidateRemoved: "PrefetchEvictedAfterCandidateRemoved", PrefetchEvictedForNewerPrefetch: "PrefetchEvictedForNewerPrefetch", PrefetchHeldback: "PrefetchHeldback", PrefetchIneligibleRetryAfter: "PrefetchIneligibleRetryAfter", PrefetchIsPrivacyDecoy: "PrefetchIsPrivacyDecoy", PrefetchIsStale: "PrefetchIsStale", PrefetchNotEligibleBrowserContextOffTheRecord: "PrefetchNotEligibleBrowserContextOffTheRecord", PrefetchNotEligibleDataSaverEnabled: "PrefetchNotEligibleDataSaverEnabled", PrefetchNotEligibleExistingProxy: "PrefetchNotEligibleExistingProxy", PrefetchNotEligibleHostIsNonUnique: "PrefetchNotEligibleHostIsNonUnique", PrefetchNotEligibleNonDefaultStoragePartition: "PrefetchNotEligibleNonDefaultStoragePartition", PrefetchNotEligibleSameSiteCrossOriginPrefetchRequiredProxy: "PrefetchNotEligibleSameSiteCrossOriginPrefetchRequiredProxy", PrefetchNotEligibleSchemeIsNotHttps: "PrefetchNotEligibleSchemeIsNotHttps", PrefetchNotEligibleUserHasCookies: "PrefetchNotEligibleUserHasCookies", PrefetchNotEligibleUserHasServiceWorker: "PrefetchNotEligibleUserHasServiceWorker", PrefetchNotEligibleUserHasServiceWorkerNoFetchHandler: "PrefetchNotEligibleUserHasServiceWorkerNoFetchHandler", PrefetchNotEligibleRedirectFromServiceWorker: "PrefetchNotEligibleRedirectFromServiceWorker", PrefetchNotEligibleRedirectToServiceWorker: "PrefetchNotEligibleRedirectToServiceWorker", PrefetchNotEligibleBatterySaverEnabled: "PrefetchNotEligibleBatterySaverEnabled", PrefetchNotEligiblePreloadingDisabled: "PrefetchNotEligiblePreloadingDisabled", PrefetchNotFinishedInTime: "PrefetchNotFinishedInTime", PrefetchNotStarted: "PrefetchNotStarted", PrefetchNotUsedCookiesChanged: "PrefetchNotUsedCookiesChanged", PrefetchProxyNotAvailable: "PrefetchProxyNotAvailable", PrefetchResponseUsed: "PrefetchResponseUsed", PrefetchSuccessfulButNotUsed: "PrefetchSuccessfulButNotUsed", PrefetchNotUsedProbeFailed: "PrefetchNotUsedProbeFailed", PrefetchCancelledOnUserNavigation: "PrefetchCancelledOnUserNavigation"});
 inspectorBackend.registerEvent("Preload.ruleSetUpdated", ["ruleSet"]);
 inspectorBackend.registerEvent("Preload.ruleSetRemoved", ["id"]);
 inspectorBackend.registerEvent("Preload.preloadEnabledStateUpdated", ["disabledByPreference", "disabledByDataSaver", "disabledByBatterySaver", "disabledByHoldbackPrefetchSpeculationRules", "disabledByHoldbackPrerenderSpeculationRules"]);

package/front_end/generated/protocol.ts

@@ -17136,6 +17136,7 @@ export namespace Preload {
     PrefetchResponseUsed = 'PrefetchResponseUsed',
     PrefetchSuccessfulButNotUsed = 'PrefetchSuccessfulButNotUsed',
     PrefetchNotUsedProbeFailed = 'PrefetchNotUsedProbeFailed',
+    PrefetchCancelledOnUserNavigation = 'PrefetchCancelledOnUserNavigation',
   }
 
   /**

package/front_end/models/ai_assistance/AiConversation.ts

@@ -14,6 +14,7 @@ import type * as NetworkTimeCalculator from '../network_time_calculator/network_
 import {AccessibilityAgent, AccessibilityContext} from './agents/AccessibilityAgent.js';
 import {
   type AiAgent,
+  type AllowedOriginResult,
   type ContextDetail,
   type ConversationContext,
   ErrorType,
@@ -27,6 +28,7 @@ import {ContextSelectionAgent} from './agents/ContextSelectionAgent.js';
 import {FileAgent, FileContext} from './agents/FileAgent.js';
 import {NetworkAgent, RequestContext} from './agents/NetworkAgent.js';
 import {PerformanceAgent, PerformanceTraceContext} from './agents/PerformanceAgent.js';
+import {StorageAgent, StorageContext} from './agents/StorageAgent.js';
 import {NodeContext, StylingAgent} from './agents/StylingAgent.js';
 import {AiHistoryStorage, ConversationType, type SerializedConversation} from './AiHistoryStorage.js';
 import type {ChangeManager} from './ChangeManager.js';
@@ -34,6 +36,17 @@ import type {ChangeManager} from './ChangeManager.js';
 export const NOT_FOUND_IMAGE_DATA = '';
 export const CONTEXT_TITLE = 'Analyzing data';
 const MAX_TITLE_LENGTH = 80;
+/**
+ * List of page navigations that are allowed during an AI agent run.
+ * These are page navigations triggered by agents themselves:
+ * - `about://` : Navigated to before initiating a trace recording to ensure a clean state.
+ * - `chrome://terms`: Navigated to by Lighthouse during its Back-Forward Cache
+ *    audit.
+ */
+export const ALLOWED_PAGE_NAVIGATIONS: Platform.DevToolsPath.UrlString[] = [
+  Platform.DevToolsPath.urlString`about://`,
+  Platform.DevToolsPath.urlString`chrome://terms`,
+];
 
 export function generateContextDetailsMarkdown(details: ContextDetail[]): string {
   const detailsMarkdown: string[] = [];
@@ -87,6 +100,7 @@ export class AiConversation {
   #aidaClient: Host.AidaClient.AidaClient;
   #changeManager: ChangeManager|undefined;
   #origin?: string;
+  #navigationOccurredDuringRun = false;
 
   #contexts: Array<ConversationContext<unknown>> = [];
 
@@ -175,6 +189,8 @@ export class AiConversation {
         this.#updateAgent(ConversationType.PERFORMANCE);
       } else if (updateContext instanceof AccessibilityContext) {
         this.#updateAgent(ConversationType.ACCESSIBILITY);
+      } else if (updateContext instanceof StorageContext) {
+        this.#updateAgent(ConversationType.STORAGE);
       }
     }
   }
@@ -369,6 +385,10 @@ export class AiConversation {
         this.#agent = new AccessibilityAgent(options);
         break;
       }
+      case ConversationType.STORAGE: {
+        this.#agent = new StorageAgent(options);
+        break;
+      }
       case ConversationType.NONE: {
         this.#agent = new ContextSelectionAgent(options);
         break;
@@ -386,22 +406,43 @@ export class AiConversation {
             multimodalInput?: MultimodalInput,
           } = {},
           ): AsyncGenerator<ResponseData, void, void> {
-    if (this.isBlockedByOrigin) {
-      // This error should not be reached. If it happens, some
-      // invariants do not hold anymore.
-      throw new Error('cross-origin context data should not be included');
-    }
-
-    const userQuery: UserQuery = {
-      type: ResponseType.USER_QUERY,
-      query: initialQuery,
-      imageInput: options.multimodalInput?.input,
-      imageId: options.multimodalInput?.id,
+    this.#navigationOccurredDuringRun = false;
+    const originAtRunStart = getPrimaryPageOrigin();
+    const listener = (): void => {
+      // If an unexpected navigation to a different origin occurred
+      // during processing the user's request, we don't want to allow
+      // the agent to run any function calls and retrieve data from the new origin.
+      // Performance agent and accessibility agent navigate to 'about://' or 'chrome://terms'
+      const newOrigin = getPrimaryPageOrigin();
+      if (originAtRunStart !== newOrigin && newOrigin && !ALLOWED_PAGE_NAVIGATIONS.includes(newOrigin)) {
+        this.#navigationOccurredDuringRun = true;
+      }
     };
-    void this.addHistoryItem(userQuery);
-    yield userQuery;
+    const targetManager = SDK.TargetManager.TargetManager.instance();
+    targetManager.addModelListener(
+        SDK.ResourceTreeModel.ResourceTreeModel, SDK.ResourceTreeModel.Events.PrimaryPageChanged, listener, this);
+
+    try {
+      if (this.isBlockedByOrigin) {
+        // This error should not be reached. If it happens, some
+        // invariants do not hold anymore.
+        throw new Error('cross-origin context data should not be included');
+      }
 
-    yield* this.#runAgent(initialQuery, options);
+      const userQuery: UserQuery = {
+        type: ResponseType.USER_QUERY,
+        query: initialQuery,
+        imageInput: options.multimodalInput?.input,
+        imageId: options.multimodalInput?.id,
+      };
+      void this.addHistoryItem(userQuery);
+      yield userQuery;
+
+      yield* this.#runAgent(initialQuery, options);
+    } finally {
+      targetManager.removeModelListener(
+          SDK.ResourceTreeModel.ResourceTreeModel, SDK.ResourceTreeModel.Events.PrimaryPageChanged, listener, this);
+    }
   }
 
   #getQueryAfterSelection(initialQuery: string, selection: string): string {
@@ -481,15 +522,16 @@ export class AiConversation {
     return this.#type;
   }
 
-  allowedOrigin = (): string|undefined => {
+  allowedOrigin = (): AllowedOriginResult => {
+    if (this.#navigationOccurredDuringRun) {
+      return {blocked: true};
+    }
     if (this.#origin) {
-      return this.#origin;
+      return {origin: this.#origin};
     }
-    const target = SDK.TargetManager.TargetManager.instance().primaryPageTarget();
-    const inspectedURL = target?.inspectedURL();
-    this.#origin = inspectedURL ? new Common.ParsedURL.ParsedURL(inspectedURL).securityOrigin() : undefined;
+    this.#origin = getPrimaryPageOrigin();
 
-    return this.#origin;
+    return {origin: this.#origin};
   };
 }
 
@@ -500,3 +542,9 @@ function isAiAssistanceServerSideLoggingEnabled(): boolean {
 function isAiAssistanceContextSelectionAgentEnabled(): boolean {
   return Boolean(Root.Runtime.hostConfig.devToolsAiAssistanceContextSelectionAgent?.enabled);
 }
+
+function getPrimaryPageOrigin(): Platform.DevToolsPath.UrlString|undefined {
+  const target = SDK.TargetManager.TargetManager.instance().primaryPageTarget();
+  const inspectedURL = target?.inspectedURL();
+  return inspectedURL ? new Common.ParsedURL.ParsedURL(inspectedURL).securityOrigin() : undefined;
+}

package/front_end/models/ai_assistance/AiHistoryStorage.ts

@@ -15,6 +15,7 @@ export const enum ConversationType {
   PERFORMANCE = 'drjones-performance-full',
   BREAKPOINT = 'breakpoint',
   ACCESSIBILITY = 'accessibility',
+  STORAGE = 'storage',
 }
 
 export interface SerializedConversation {

package/front_end/models/ai_assistance/EvaluateAction.ts

@@ -19,12 +19,13 @@ export interface GetErrorStackOutput {
 
 /* istanbul ignore next */
 export function getErrorStackOnThePage(this: Error): GetErrorStackOutput {
-  return {stack: this.stack, message: this.message};
+  // Using this.stack causes side effect checks to throw.
+  return {stack: '', message: this.message};
 }
 
 /* istanbul ignore next */
 export function stringifyObjectOnThePage(this: unknown): string {
-  const seenBefore = new WeakMap();
+  const seenBefore = new Map();
   return JSON.stringify(this, function replacer(this: unknown, key: string, value: unknown) {
     if (typeof value === 'object' && value !== null) {
       if (seenBefore.has(value)) {
@@ -70,7 +71,7 @@ export async function stringifyRemoteObject(
       return `${object.description}`;
     case Protocol.Runtime.RemoteObjectType.Object: {
       if (object.subtype === 'error') {
-        const res = await object.callFunctionJSON(getErrorStackOnThePage, []);
+        const res = await object.callFunctionJSON(getErrorStackOnThePage, [], {throwOnSideEffect: true});
 
         if (!res) {
           throw new Error('Could not stringify the object' + object);
@@ -78,8 +79,9 @@ export async function stringifyRemoteObject(
 
         return EvaluateAction.stringifyError(res, functionDeclaration);
       }
-      const res = await object.callFunction(stringifyObjectOnThePage);
-
+      const res = await object.callFunction(stringifyObjectOnThePage, undefined, {
+        throwOnSideEffect: true,
+      });
       if (!res.object || res.object.type !== Protocol.Runtime.RemoteObjectType.String) {
         throw new Error('Could not stringify the object' + object);
       }