chrome-devtools-frontend 1.0.1650232 → 1.0.1650677

package/front_end/panels/common/ExtensionServer.ts

@@ -85,7 +85,8 @@ export class HostsPolicy {
 }
 
 class RegisteredExtension {
-  constructor(readonly name: string, readonly hostsPolicy: HostsPolicy, readonly allowFileAccess: boolean) {
+  constructor(readonly origin: string, readonly name: string, readonly hostsPolicy: HostsPolicy,
+              readonly allowFileAccess: boolean) {
   }
 
   isAllowedOnTarget(inspectedURL?: Platform.DevToolsPath.UrlString): boolean {
@@ -104,6 +105,14 @@ class RegisteredExtension {
       return false;
     }
 
+    if (parsedURL.protocol === 'chrome-extension:') {
+      if (parsedURL.origin !== this.origin) {
+        if (!Root.Runtime.hostConfig.extensionsOnChromeUrls?.enabled) {
+          return false;
+        }
+      }
+    }
+
     if (!ExtensionServer.canInspectURL(inspectedURL)) {
       return false;
     }
@@ -953,27 +962,45 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
    */
   private extensionAllowedOnContentProvider(
       contentProvider: TextUtils.ContentProvider.ContentProvider, port: MessagePort): boolean {
-    if (!(contentProvider instanceof Workspace.UISourceCode.UISourceCode)) {
-      return this.extensionAllowedOnURL(contentProvider.contentURL(), port);
+    // 1. Exception for Scripts with sourceURL
+    if (contentProvider instanceof Workspace.UISourceCode.UISourceCode &&
+        contentProvider.contentType() === Common.ResourceType.resourceTypes.Script) {
+      const scripts =
+          Bindings.DebuggerWorkspaceBinding.DebuggerWorkspaceBinding.instance().scriptsForUISourceCode(contentProvider);
+      if (scripts.length > 0) {
+        const uiSourceCodeTarget =
+            Bindings.NetworkProject.NetworkProject.targetForUISourceCode(contentProvider) ?? undefined;
+        if (uiSourceCodeTarget && !this.extensionAllowedOnTarget(uiSourceCodeTarget, port)) {
+          return false;
+        }
+        return scripts.every(script => {
+          if (script.hasSourceURL) {
+            return this.extensionAllowedOnTarget(script.target(), port);
+          }
+          return this.extensionAllowedOnURL(script.contentURL(), port) &&
+              this.extensionAllowedOnTarget(script.target(), port);
+        });
+      }
     }
 
-    if (contentProvider.contentType() !== Common.ResourceType.resourceTypes.Script) {
-      // We only check sourceURL magic comments for scripts (excluding ones coming from source maps).
-      return this.extensionAllowedOnURL(contentProvider.contentURL(), port);
+    // 2. Standard Policy: Both URL and Target must be allowed
+
+    // 2a. Check URL
+    if (!this.extensionAllowedOnURL(contentProvider.contentURL(), port)) {
+      return false;
     }
 
-    const scripts =
-        Bindings.DebuggerWorkspaceBinding.DebuggerWorkspaceBinding.instance().scriptsForUISourceCode(contentProvider);
-    if (scripts.length === 0) {
-      return this.extensionAllowedOnURL(contentProvider.contentURL(), port);
+    // 2b. Check Target (if one can be identified)
+    let target: SDK.Target.Target|undefined;
+    if (contentProvider instanceof SDK.NetworkRequest.NetworkRequest) {
+      target = SDK.NetworkManager.NetworkManager.forRequest(contentProvider)?.target();
+    } else if (contentProvider instanceof SDK.Resource.Resource) {
+      target = contentProvider.frame()?.resourceTreeModel().target();
+    } else if (contentProvider instanceof Workspace.UISourceCode.UISourceCode) {
+      target = Bindings.NetworkProject.NetworkProject.targetForUISourceCode(contentProvider) ?? undefined;
     }
 
-    return scripts.every(script => {
-      if (script.hasSourceURL) {
-        return this.extensionAllowedOnTarget(script.target(), port);
-      }
-      return this.extensionAllowedOnURL(script.contentURL(), port);
-    });
+    return !target || this.extensionAllowedOnTarget(target, port);
   }
 
   /**
@@ -998,7 +1025,10 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
     return {uiSourceCode};
   }
 
-  private extensionAllowedOnTarget(target: SDK.Target.Target, port: MessagePort): boolean {
+  private extensionAllowedOnTarget(target: SDK.Target.Target|undefined, port: MessagePort): boolean {
+    if (!target) {
+      return false;
+    }
     return this.extensionAllowedOnURL(target.inspectedURL(), port);
   }
 
@@ -1061,7 +1091,7 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
       return this.status.E_BADARG('command', `expected ${Extensions.ExtensionAPI.PrivateAPI.Commands.GetHAR}`);
     }
     const requests =
-        Logs.NetworkLog.NetworkLog.instance().requests().filter(r => this.extensionAllowedOnURL(r.url(), port));
+        Logs.NetworkLog.NetworkLog.instance().requests().filter(r => this.extensionAllowedOnContentProvider(r, port));
     const harLog = await HAR.Log.Log.build(requests, {sanitize: false});
     for (let i = 0; i < harLog.entries.length; ++i) {
       // @ts-expect-error
@@ -1310,26 +1340,34 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
 
   private notifyResourceAdded(event: Common.EventTarget.EventTargetEvent<Workspace.UISourceCode.UISourceCode>): void {
     const uiSourceCode = event.data;
-    this.postNotification(
-        Extensions.ExtensionAPI.PrivateAPI.Events.ResourceAdded, [this.makeResource(uiSourceCode)],
-        extension => extension.isAllowedOnTarget(uiSourceCode.url()));
+    const target = Bindings.NetworkProject.NetworkProject.targetForUISourceCode(uiSourceCode);
+    const targetUrl = target?.inspectedURL();
+    this.postNotification(Extensions.ExtensionAPI.PrivateAPI.Events.ResourceAdded, [this.makeResource(uiSourceCode)],
+                          extension => extension.isAllowedOnTarget(uiSourceCode.url()) &&
+                              (!targetUrl || extension.isAllowedOnTarget(targetUrl)));
   }
 
   private notifyUISourceCodeContentCommitted(
       event: Common.EventTarget.EventTargetEvent<Workspace.Workspace.WorkingCopyCommittedEvent>): void {
     const {uiSourceCode, content} = event.data;
-    this.postNotification(
-        Extensions.ExtensionAPI.PrivateAPI.Events.ResourceContentCommitted, [this.makeResource(uiSourceCode), content],
-        extension => extension.isAllowedOnTarget(uiSourceCode.url()));
+    const target = Bindings.NetworkProject.NetworkProject.targetForUISourceCode(uiSourceCode);
+    const targetUrl = target?.inspectedURL();
+    this.postNotification(Extensions.ExtensionAPI.PrivateAPI.Events.ResourceContentCommitted,
+                          [this.makeResource(uiSourceCode), content],
+                          extension => extension.isAllowedOnTarget(uiSourceCode.url()) &&
+                              (!targetUrl || extension.isAllowedOnTarget(targetUrl)));
   }
 
   private async notifyRequestFinished(event: Common.EventTarget.EventTargetEvent<SDK.NetworkRequest.NetworkRequest>):
       Promise<void> {
     const request = event.data;
     const entry = await HAR.Log.Entry.build(request, {sanitize: false});
+    const networkManager = SDK.NetworkManager.NetworkManager.forRequest(request);
+    const targetUrl = networkManager?.target()?.inspectedURL();
     this.postNotification(
         Extensions.ExtensionAPI.PrivateAPI.Events.NetworkRequestFinished, [this.requestId(request), entry],
-        extension => extension.isAllowedOnTarget(entry.request.url));
+        extension => extension.isAllowedOnTarget(entry.request.url as Platform.DevToolsPath.UrlString) &&
+            (!targetUrl || extension.isAllowedOnTarget(targetUrl)));
   }
 
   private notifyElementsSelectionChanged(): void {
@@ -1388,7 +1426,8 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
       const startPageURL = new URL((startPage));
       const extensionOrigin = startPageURL.origin;
       const name = extensionInfo.name || `Extension ${extensionOrigin}`;
-      const extensionRegistration = new RegisteredExtension(name, hostsPolicy, Boolean(extensionInfo.allowFileAccess));
+      const extensionRegistration =
+          new RegisteredExtension(extensionOrigin, name, hostsPolicy, Boolean(extensionInfo.allowFileAccess));
       if (!extensionRegistration.isAllowedOnTarget(inspectedURL)) {
         this.#pendingExtensions.push(extensionInfo);
         return;
@@ -1494,11 +1533,11 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
   private registerAutosubscriptionTargetManagerHandler<Events, T extends keyof Events>(
       eventTopic: string, modelClass: new(arg1: SDK.Target.Target) => SDK.SDKModel.SDKModel<Events>,
       frontendEventType: T, handler: Common.EventTarget.EventListener<Events, T>): void {
-    this.registerSubscriptionHandler(
-        eventTopic,
-        () => SDK.TargetManager.TargetManager.instance().addModelListener(modelClass, frontendEventType, handler, this),
-        () => SDK.TargetManager.TargetManager.instance().removeModelListener(
-            modelClass, frontendEventType, handler, this));
+    this.registerSubscriptionHandler(eventTopic,
+                                     () => SDK.TargetManager.TargetManager.instance().addModelListener(
+                                         modelClass, frontendEventType, handler, this, {scoped: true}),
+                                     () => SDK.TargetManager.TargetManager.instance().removeModelListener(
+                                         modelClass, frontendEventType, handler, this));
   }
 
   private registerResourceContentCommittedHandler(
@@ -1609,25 +1648,6 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
       return this.status.E_FAILED('Permission denied');
     }
 
-    try {
-      const parsedUrl = new URL(frame.url);
-      let targetType = Host.UserMetrics.ExtensionEvalTarget.WEB_PAGE;
-      if (parsedUrl.protocol === 'chrome-extension:') {
-        if (parsedUrl.origin === securityOrigin) {
-          targetType = Host.UserMetrics.ExtensionEvalTarget.SAME_EXTENSION;
-        } else {
-          targetType = Host.UserMetrics.ExtensionEvalTarget.OTHER_EXTENSION;
-          if (!Root.Runtime.hostConfig.extensionsOnChromeUrls?.enabled) {
-            return this.status.E_FAILED(
-                'Access to extension URLs is restricted; use --extensions-on-chrome-urls to enable.');
-          }
-        }
-      }
-      Host.userMetrics.extensionEvalTarget(targetType);
-    } catch {
-      // Ignore invalid URLs.
-    }
-
     void context
         .evaluate(
             {

package/front_end/panels/elements/ElementsPanel.ts

@@ -1627,7 +1627,7 @@ export class PseudoStateMarkerDecorator implements MarkerDecorator {
       return null;
     }
     return {
-      color: '--sys-color-orange-bright',
+      color: 'var(--sys-color-orange-bright)',
       title: i18nString(UIStrings.elementStateS, {PH1: ':' + pseudoState.join(', :')}),
     };
   }

package/front_end/panels/js_timeline/js_timeline-meta.ts

@@ -4,7 +4,6 @@
 
 import * as Common from '../../core/common/common.js';
 import * as i18n from '../../core/i18n/i18n.js';
-import * as SDK from '../../core/sdk/sdk.js';
 import * as UI from '../../ui/legacy/legacy.js';
 import type * as Timeline from '../timeline/timeline.js';
 
@@ -72,7 +71,7 @@ UI.ViewManager.registerViewExtension({
   isPreviewFeature: true,
   async loadView(universe) {
     const Timeline = await loadTimelineModule();
-    const resourceLoader = universe.context.get(SDK.PageResourceLoader.PageResourceLoader);
+    const {pageResourceLoader: resourceLoader} = universe;
     return Timeline.TimelinePanel.TimelinePanel.instance({forceNew: true, resourceLoader});
   },
 });

package/front_end/panels/network/RequestHeadersView.ts

@@ -412,7 +412,7 @@ function renderHeaderOverridesLink(input: ViewInput): Lit.LitTemplate {
           class="link devtools-link"
           jslogcontext="devtools-override"
       >
-        <devtools-icon name="help" class="inline-icon medium">
+        <devtools-icon name="help" class="inline-icon">
         </devtools-icon>
       </devtools-link>
       <devtools-link
@@ -424,7 +424,7 @@ function renderHeaderOverridesLink(input: ViewInput): Lit.LitTemplate {
         ${fileIcon}${Persistence.NetworkPersistenceManager.HEADERS_FILENAME}
       </devtools-link>
     `;
-  // clang-format on
+    // clang-format on
 }
 
 function renderRawHeaders(text: string): Lit.TemplateResult {

package/front_end/panels/network/components/RequestHeadersView.css

@@ -153,6 +153,7 @@ devtools-link {
 
 devtools-link .inline-icon {
   padding-right: 3px;
+  vertical-align: middle;
 }
 
 .purple.dot::before {

package/front_end/panels/network/components/ResponseHeaderSection.css

@@ -17,5 +17,9 @@ devtools-header-section-row:first-of-type {
 }
 
 .add-header-button {
-  margin: -4px 0 10px 5px;
+  margin: var(--sys-size-5) 0 var(--sys-size-5) var(--sys-size-4);
+}
+
+devtools-header-section-row + .add-header-button {
+  margin-top: calc(-1 * var(--sys-size-3));
 }

package/front_end/panels/recorder/testing/RecorderHelpers.ts

@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import sinon from 'sinon';
+
 import * as SDK from '../../../core/sdk/sdk.js';
 import * as Models from '../models/models.js';
 

package/front_end/panels/timeline/timeline-meta.ts

@@ -101,7 +101,7 @@ UI.ViewManager.registerViewExtension({
   order: 50,
   async loadView(universe) {
     const Timeline = await loadTimelineModule();
-    const resourceLoader = universe.context.get(SDK.PageResourceLoader.PageResourceLoader);
+    const {pageResourceLoader: resourceLoader} = universe;
     return Timeline.TimelinePanel.TimelinePanel.instance({forceNew: true, resourceLoader});
   },
 });

package/front_end/third_party/chromium/README.chromium

@@ -1,7 +1,7 @@
 Name: Dependencies sourced from the upstream `chromium` repository
 URL: Internal
 Version: N/A
-Revision: 497ce88cb71102650c4ed3ec5fa40ddd45c28c26
+Revision: 2f1db9960be2f98ba060d8856277091dc61ee03d
 Update Mechanism: Manual (https://crbug.com/428069060)
 License: BSD-3-Clause
 License File: LICENSE

package/front_end/third_party/puppeteer/README.chromium

@@ -1,10 +1,10 @@
 Name: Puppeteer Core
 Short Name: Puppeteer Core
 URL: https://github.com/puppeteer/puppeteer/tree/main/packages/puppeteer-core
-Version: 25.1.0
+Version: 25.2.1
 License: Apache-2.0
 License File: LICENSE
-Revision: ede66693bc0a6d9a8029f66288d13e26966173ce
+Revision: 4a56c699e50f0cd5ff87dd10e43f7defaf3d95a0
 Security Critical: no
 Shipped: yes
 Update Mechanism: Autoroll

package/front_end/third_party/puppeteer/package/README.md

@@ -19,6 +19,20 @@ npm i puppeteer # Downloads compatible Chrome during installation.
 npm i puppeteer-core # Alternatively, install as a library, without downloading Chrome.
 ```
 
+:::note
+
+Modern package managers (including npm (see the [RFC](https://github.com/npm/rfcs/pull/868)), pnpm, Yarn, Bun, and Deno) block dependency install scripts by default. If the install script is blocked, Puppeteer will not download the browser during installation, leading to runtime errors.
+
+You can manually download the required browsers after installation by running:
+
+```bash npm2yarn
+npx puppeteer browsers install
+```
+
+Alternatively, you can configure your package manager to allow the install script to run (for example, with npm, by adding `"puppeteer"` to `"allowScripts"` in your `package.json`).
+
+:::
+
 ## MCP
 
 Install [`chrome-devtools-mcp`](https://github.com/ChromeDevTools/chrome-devtools-mcp),

package/front_end/third_party/puppeteer/package/lib/es5-iife/puppeteer-core-browser.d.ts

@@ -557,15 +557,11 @@ export declare abstract class Browser extends EventEmitter<BrowserEvents> {
     }>
   ): Promise<void>;
   /**
-   * Installs an extension and returns the ID. In Chrome, this is only
-   * available if the browser was created using `pipe: true` and the
-   * `--enable-unsafe-extension-debugging` flag is set.
+   * Installs an extension and returns the ID.
    */
   abstract installExtension(path: string): Promise<string>;
   /**
-   * Uninstalls an extension. In Chrome, this is only available if the browser
-   * was created using `pipe: true` and the
-   * `--enable-unsafe-extension-debugging` flag is set.
+   * Uninstalls an extension.
    */
   abstract uninstallExtension(id: string): Promise<void>;
   /**
@@ -1179,9 +1175,11 @@ export declare interface Configuration {
    */
   temporaryDirectory?: string;
   /**
-   * Tells Puppeteer to not download during installation.
+   * Tells Puppeteer to not download any of the browsers during installation.
    *
-   * Can be overridden by `PUPPETEER_SKIP_DOWNLOAD`.
+   * Can be overridden by `PUPPETEER_SKIP_DOWNLOAD` or by specifying either
+   * `skipDownload` property in each browser specific config or by providing
+   * `PUPPETEER_FIREFOX_SKIP_DOWNLOAD` and `PUPPETEER_CHROME_SKIP_DOWNLOAD`.
    */
   skipDownload?: boolean;
   /**
@@ -1369,26 +1367,32 @@ export declare interface ConnectOptions {
   /**
    * A list of URL patterns to block.
    *
-   * This option allows you to restrict the browser from accessing specific
-   * URLs or origins. It uses the standard [URLPattern](https://urlpattern.spec.whatwg.org/) API to match URLs.
+   * This option allows you to restrict the browser from accessing specific URLs
+   * or origins. It uses the standard
+   * [URLPattern](https://urlpattern.spec.whatwg.org/) API to match URLs.
    *
-   * When connecting to an existing browser, Puppeteer will silently detach from any
-   * already open targets that violate the patterns.
+   * When connecting to an existing browser, Puppeteer will silently detach from
+   * any already open targets that violate the patterns.
    *
    * For any network requests made by the browser (including navigations and
    * subresources like images or scripts), the request will fail with an error
    * if the URL matches a blocked pattern.
    *
-   * @example Pattern to block a specific domain:
-   * `*://example.com/*`
+   * @example Pattern to block a specific domain: `*://example.com/*`
    *
-   * @example Pattern to block all subdomains:
-   * `*://*.evil.com/*`
+   * @example Pattern to block all subdomains: `*://*.evil.com/*`
    *
    * @remarks
-   * Currently only supported for CDP connections.
+   * Currently only supported for Chrome.
    *
-   * Inner `<iframe>` content loading is currently not blocked.
+   * The feature works while Puppeteer is attached to the CDP targets.
+   * It intercepts requests in the network service in Chrome.
+   * Chrome may perform some network access in other ways or
+   * some web features may omit the network service.
+   * The feature is meant as an additional guardrails to LLM-based
+   * usage under Puppeteer control and not a complete network sandbox.
+   * For complete network sandboxing, we recommend using
+   * container/OS-level sandbox mechanism.
    *
    * Cannot be used along with {@link ConnectOptions.allowlist}.
    *
@@ -1418,9 +1422,16 @@ export declare interface ConnectOptions {
    * `*://*.example.com/*`
    *
    * @remarks
-   * Currently only supported for CDP connections.
+   * Currently only supported for Chrome.
    *
-   * Inner `<iframe>` content loading is currently not blocked.
+   * The feature works while Puppeteer is attached to the CDP targets.
+   * It intercepts requests in the network service in Chrome.
+   * Chrome may perform some network access in other ways or
+   * some web features may omit the network service.
+   * The feature is meant as an additional guardrails to LLM-based
+   * usage under Puppeteer control and not a complete network sandbox.
+   * For complete network sandboxing, we recommend using
+   * container/OS-level sandbox mechanism.
    *
    * Cannot be used along with {@link ConnectOptions.blocklist}.
    *
@@ -5753,7 +5764,8 @@ export declare abstract class Page extends EventEmitter<PageEvents> {
   /**
    * A target this page was created from.
    *
-   * @deprecated Use {@link Page.createCDPSession} directly.
+   * @deprecated To create CDP session use {@link Page.createCDPSession} directly. To
+   * identify pages spawned by this one, use {@link PageEvent.Popup} event instead.
    */
   abstract target(): Target;
   /**
@@ -5789,9 +5801,8 @@ export declare abstract class Page extends EventEmitter<PageEvents> {
    */
   abstract get tracing(): Tracing;
   /**
-   * Experimental API for {@link https://github.com/webmachinelearning/webmcp
-   * | WebMCP}. Requires Chrome 149+ with the
-   * `--enable-features=WebMCPTesting,DevToolsWebMCPSupport` flags enabled.
+   * Experimental API for {@link https://github.com/webmachinelearning/webmcp| WebMCP}.
+   * Requires Chrome 150+ with the `--enable-features=WebMCP` flag enabled.
    *
    * @experimental
    */
@@ -6829,6 +6840,11 @@ export declare abstract class Page extends EventEmitter<PageEvents> {
    * ```
    */
   abstract emulateMediaFeatures(features?: MediaFeature[]): Promise<void>;
+  /**
+   * @param locale - Locale to emulate on the page. Passing no locale disables
+   * locale emulation.
+   */
+  abstract emulateLocale(locale?: string): Promise<void>;
   /**
    * @param timezoneId - Changes the timezone of the page. See
    * {@link https://source.chromium.org/chromium/chromium/deps/icu.git/+/faee8bc70570192d82d2978a71e2a615788597d1:source/data/misc/metaZones.txt | ICU’s metaZones.txt}
@@ -9762,6 +9778,26 @@ export declare abstract class WebWorker extends EventEmitter<WebWorkerEvents> {
     func: Func | string,
     ...args: Params
   ): Promise<HandleFor<Awaited<ReturnType<Func>>>>;
+  /**
+   * Waits for the provided function, `workerFunction`, to return a truthy value when
+   * evaluated in the page's context.
+   *
+   * @param workerFunction - Function to be evaluated in browser context until it
+   * returns a truthy value.
+   * @param options - Options for configuring waiting behavior.
+   */
+  waitForFunction<
+    Params extends unknown[],
+    Func extends EvaluateFunc<Params> = EvaluateFunc<Params>,
+  >(
+    workerFunction: Func | string,
+    options?: {
+      polling?: number;
+      timeout?: number;
+      signal?: AbortSignal;
+    },
+    ...args: Params
+  ): Promise<HandleFor<Awaited<ReturnType<Func>>>>;
   close(): Promise<void>;
 }