chrome-devtools-frontend 1.0.1689415 → 1.0.1690116

package/eslint.config.mjs

@@ -536,8 +536,6 @@ export default defineConfig([
       // certain TypeScript compilation errors after fixes
       '@typescript-eslint/no-unnecessary-type-assertion': 'off',
 
-      '@typescript-eslint/no-inferrable-types': 'error',
-
       '@typescript-eslint/consistent-generic-constructors': 'off',
 
       // This is more performant
@@ -856,6 +854,14 @@ export default defineConfig([
     files: ['front_end/legacy_test_runner/**/*'],
     rules: {
       '@devtools/es-modules-import': 'off',
+      '@typescript-eslint/ban-ts-comment': 'off',
+      '@typescript-eslint/explicit-function-return-type': 'off',
+      '@typescript-eslint/naming-convention': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-floating-promises': 'off',
+      '@typescript-eslint/no-unused-vars': 'off',
+      '@devtools/no-imperative-dom-api': 'off',
+      'jsdoc/require-returns-description': 'off',
     },
   },
   {

package/front_end/core/common/Object.ts

@@ -119,10 +119,16 @@ export type EventMixinBase = {
   dispatchDOMEvent ? (event: Event) : void,
 }&object;
 
-export function eventMixin<Events, Base extends Platform.Constructor.Constructor<EventMixinBase>>(base: Base):
-    Platform.Constructor.Constructor<EventTarget<Events>>&Base {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  console.assert(base as any !== HTMLElement);
+export type EventMixin<
+  Events,
+  Base extends Platform.Constructor.Constructor<EventMixinBase>,
+> = Base & Platform.Constructor.Constructor<EventTarget<Events>>;
+
+export function eventMixin<
+  Events,
+  Base extends Platform.Constructor.Constructor<EventMixinBase>,
+>(base: Base): EventMixin<Events, Base> {
+  console.assert((base as unknown) !== HTMLElement);
   return class EventHandling extends base implements EventTarget<Events> {
     // Note that the weird name is due to TSC disallowing private/protected fields in
     // anonmous exported classes. We use a `__` prefix to prevent clashes with `base`.

package/front_end/core/i18n/collect-ui-strings.js

@@ -37,7 +37,7 @@ const yargsObject = yargs(hideBin(process.argv))
  * @param locale
  * @param strings
  */
-function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
+async function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
   const outputPath = path.join(outputDirectory, `${locale}.json`);
 
   /** @type {Record<string, CtcMessage>} */
@@ -50,7 +50,7 @@ function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
   }
 
   const convertedStrings = bakePlaceholders(sortedCtcStrings);
-  writeIfChanged(outputPath, JSON.stringify(convertedStrings, null, 2) + '\n');
+  await writeIfChanged(outputPath, JSON.stringify(convertedStrings, null, 2) + '\n');
 }
 
 const inputDirectories = yargsObject['input-directories'];
@@ -76,9 +76,9 @@ for (const directory of inputDirectories) {
 }
 
 const outputDirectory = yargsObject['output-directory'];
-convertCtcToLhLAndSave(outputDirectory, 'en-US', collectedStrings);
+await convertCtcToLhLAndSave(outputDirectory, 'en-US', collectedStrings);
 if (yargsObject['include-en-xl']) {
-  convertCtcToLhLAndSave(
+  await convertCtcToLhLAndSave(
       outputDirectory,
       'en-XL',
       createPsuedoLocaleStrings(collectedStrings),
@@ -92,4 +92,4 @@ const depfile = `
 ${path.join(outputDirectory, 'en-US.json')}: ${files.join(' ')}
 `;
 
-writeIfChanged(path.join(outputDirectory, 'collected-ui-strings.d'), depfile);
+await writeIfChanged(path.join(outputDirectory, 'collected-ui-strings.d'), depfile);

package/front_end/core/i18n/generate-locales-js.js

@@ -53,4 +53,4 @@ export const REMOTE_FETCH_PATTERN = '${yargsObject['remote-fetch-pattern']}';
 export const LOCAL_FETCH_PATTERN = '${yargsObject['local-fetch-pattern']}';
 `;
 
-writeIfChanged(path.join(yargsObject['target-gen-dir'], 'locales.js'), content);
+await writeIfChanged(path.join(yargsObject['target-gen-dir'], 'locales.js'), content);

package/front_end/core/i18n/i18n.ts

@@ -2,12 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import type * as Platform from '../platform/platform.js';
+
 import * as ByteUtilities from './ByteUtilities.js';
 import * as DevToolsLocale from './DevToolsLocale.js';
 import * as i18n from './i18nImpl.js';
+import type * as i18nTypes from './i18nTypes.js';
 import * as NumberFormatter from './NumberFormatter.js';
 import * as TimeUtilities from './time-utilities.js';
 
+export type LocalizeString = (id: string, values?: i18nTypes.Values) => Platform.UIString.LocalizedString;
+export type LazyLocalizeString = () => Platform.UIString.LocalizedString;
+
 export {
   ByteUtilities,
   DevToolsLocale,

package/front_end/core/root/Runtime.ts

@@ -521,10 +521,6 @@ interface DevToolsProtocolMonitor {
   enabled: boolean;
 }
 
-interface DevToolsWebMCPSupport {
-  enabled: boolean;
-}
-
 interface DevToolsAdsPanel {
   enabled: boolean;
 }
@@ -599,7 +595,6 @@ export type HostConfig = Platform.TypeScriptUtilities.RecursivePartial<{
   devToolsConsoleInsightsTeasers: ConsoleInsightsTeasers,
   devToolsGeminiRebranding: HostConfigGeminiRebranding,
   devToolsProtocolMonitor: DevToolsProtocolMonitor,
-  devToolsWebMCPSupport: DevToolsWebMCPSupport,
   devToolsAdsPanel: DevToolsAdsPanel,
   devToolsUseGcaApi: UseGcaApi,
   devToolsPlusButton: DevToolsPlusButton,

package/front_end/core/sdk/CSSMetadata.ts

@@ -440,13 +440,12 @@ export const PositionTryOrderKeywords: PositionTryOrderKeyword[] = [
   PositionTryOrderKeyword.MOST_INLINE_SIZE,
 ];
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const VariableNameRegex: RegExp = /(\s*--.*?)/gs;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const VariableRegex: RegExp = /(var\(\s*--.*?\))/gs;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const CustomVariableRegex: RegExp = /(var\(*--[\w\d]+-([\w]+-[\w]+)\))/g;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const URLRegex: RegExp = /url\(\s*('.+?'|".+?"|[^)]+)\s*\)/g;
 
 /**
@@ -457,7 +456,6 @@ export const URLRegex: RegExp = /url\(\s*('.+?'|".+?"|[^)]+)\s*\)/g;
  * 'grid', 'grid-template', e.g.
  *    [track-#name] "a a ." minmax(50px, auto) [track-#name]
  */
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const GridAreaRowRegex: RegExp = /((?:\[[\w\- ]+\]\s*)*(?:"[^"]+"|'[^']+'))[^'"\[]*\[?[^'"\[]*/;
 
 let cssMetadataInstance: CSSMetadata|null = null;

package/front_end/core/sdk/DOMModel.ts

@@ -48,6 +48,7 @@ import {RemoteObject} from './RemoteObject.js';
 import {Events as ResourceTreeModelEvents, type ResourceTreeFrame, ResourceTreeModel} from './ResourceTreeModel.js';
 import {RuntimeModel} from './RuntimeModel.js';
 import {SDKModel} from './SDKModel.js';
+import {SecurityOrigin} from './SecurityOrigin.js';
 import {Capability, type Target} from './Target.js';
 import type {TargetManager} from './TargetManager.js';
 
@@ -387,6 +388,14 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
     return this.#topLayerIndex;
   }
 
+  /**
+   * Returns the security origin of the document owning this node, or `null` if
+   * this node is not attached to a document.
+   */
+  securityOrigin(): SecurityOrigin|null {
+    return this.ownerDocument?.securityOrigin() ?? null;
+  }
+
   adProvenance(): Protocol.Network.AdProvenance|undefined {
     if (this.#adProvenance !== undefined) {
       return this.#adProvenance;
@@ -1424,6 +1433,8 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
       nodeName: this.nodeName(),
       localName: this.localName(),
       nodeValue: this.nodeValueInternal,
+      documentURL: this.documentURL,
+      baseURL: this.baseURL,
     } as Protocol.DOM.Node) :
                                                      new DOMNodeSnapshot(this.domModel());
     snapshot.id = this.id;
@@ -1445,11 +1456,6 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
     snapshot.#isInShadowTree = this.#isInShadowTree;
     snapshot.childNodeCountInternal = this.childNodeCountInternal;
 
-    if (snapshot instanceof DOMDocument && this instanceof DOMDocument) {
-      snapshot.documentURL = this.documentURL;
-      snapshot.baseURL = this.baseURL;
-    }
-
     if (!this.childrenInternal && this.childNodeCountInternal > 0) {
       await this.getSubtree(1, false);
     }
@@ -1600,15 +1606,45 @@ export class DOMNodeShortcut {
 export class DOMDocument extends DOMNode {
   body: DOMNode|null;
   documentElement: DOMNode|null;
-  documentURL: Platform.DevToolsPath.UrlString;
-  baseURL: Platform.DevToolsPath.UrlString;
+  #documentURL: Platform.DevToolsPath.UrlString;
+  #baseURL: Platform.DevToolsPath.UrlString;
+  #securityOrigin: SecurityOrigin;
+
   constructor(domModel: DOMModel, payload: Protocol.DOM.Node) {
     super(domModel);
     this.body = null;
     this.documentElement = null;
     this.init(this, false, payload);
-    this.documentURL = (payload.documentURL || '') as Platform.DevToolsPath.UrlString;
-    this.baseURL = (payload.baseURL || '') as Platform.DevToolsPath.UrlString;
+    this.#documentURL = (payload.documentURL || '') as Platform.DevToolsPath.UrlString;
+    this.#baseURL = (payload.baseURL || '') as Platform.DevToolsPath.UrlString;
+    this.#securityOrigin = SecurityOrigin.create(this.#documentURL);
+  }
+
+  get documentURL(): Platform.DevToolsPath.UrlString {
+    return this.#documentURL;
+  }
+
+  get baseURL(): Platform.DevToolsPath.UrlString {
+    return this.#baseURL;
+  }
+
+  /**
+   * Returns the security origin of this document.
+   *
+   * The security origin is derived from the document URL and is recomputed
+   * when the document navigates to a new URL via `setDocumentURL`.
+   */
+  override securityOrigin(): SecurityOrigin {
+    return this.#securityOrigin;
+  }
+
+  /**
+   * Updates the document and base URLs, and recomputes the document's security origin.
+   */
+  setDocumentURL(url: Platform.DevToolsPath.UrlString): void {
+    this.#documentURL = url;
+    this.#baseURL = url;
+    this.#securityOrigin = SecurityOrigin.create(url);
   }
 }
 
@@ -1694,8 +1730,7 @@ export class DOMModel extends SDKModel<EventTypes> {
     if (node) {
       const contentDocument = node.contentDocument();
       if (contentDocument && contentDocument.documentURL !== frame.url) {
-        contentDocument.documentURL = frame.url;
-        contentDocument.baseURL = frame.url;
+        contentDocument.setDocumentURL(frame.url);
         this.dispatchEventToListeners(Events.DocumentURLChanged, contentDocument);
       }
     }

package/front_end/core/sdk/EmulationModel.ts

@@ -4,6 +4,7 @@
 
 import type * as ProtocolProxyApi from '../../generated/protocol-proxy-api.js';
 import * as Protocol from '../../generated/protocol.js';
+import type * as Common from '../common/common.js';
 
 import {CSSModel} from './CSSModel.js';
 import type {MultitargetNetworkManager} from './NetworkManager.js';
@@ -12,6 +13,7 @@ import {SDKModel} from './SDKModel.js';
 import {
   avifFormatDisabledSettingDescriptor,
   cpuPressureSettingDescriptor,
+  dataSaverSettingDescriptor,
   emulateAutoDarkModeSettingDescriptor,
   emulatedCSSMediaFeatureColorGamutSettingDescriptor,
   emulatedCSSMediaFeatureForcedColorsSettingDescriptor,
@@ -56,6 +58,8 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
   };
   #screenOrientationLocked: boolean;
   #lockedOrientation: Protocol.Emulation.ScreenOrientation|null;
+  readonly #dataSaverSetting: Common.Settings.Setting<DataSaverOverride>;
+  readonly #dataSaverChangeListener: () => void;
 
   constructor(target: Target) {
     super(target);
@@ -239,6 +243,15 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
       updateDisabledImageFormats();
     }
 
+    this.#dataSaverSetting = settings.resolve(dataSaverSettingDescriptor);
+    this.#dataSaverChangeListener = () => {
+      void this.setDataSaverOverride(this.#dataSaverSetting.get());
+    };
+    this.#dataSaverSetting.addChangeListener(this.#dataSaverChangeListener, this);
+    if (this.#dataSaverSetting.get() !== DataSaverOverride.UNSET) {
+      void this.setDataSaverOverride(this.#dataSaverSetting.get());
+    }
+
     this.#cpuPressureEnabled = false;
     this.#touchEmulationAllowed = true;
     this.#touchEnabled = false;
@@ -251,6 +264,11 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
     target.registerEmulationDispatcher(this);
   }
 
+  override dispose(): void {
+    super.dispose();
+    this.#dataSaverSetting.removeChangeListener(this.#dataSaverChangeListener, this);
+  }
+
   setTouchEmulationAllowed(touchEmulationAllowed: boolean): void {
     this.#touchEmulationAllowed = touchEmulationAllowed;
   }

package/front_end/core/sdk/SDKSettings.ts

@@ -5,6 +5,8 @@
 import type * as Protocol from '../../generated/protocol.js';
 import * as Common from '../common/common.js';
 
+import {DataSaverOverride} from './EmulationModel.js';
+
 export const jsSourceMapsEnabledSettingDescriptor: Common.Settings.SettingDescriptor<boolean> = {
   name: 'js-source-maps-enabled',
   type: Common.Settings.SettingType.BOOLEAN,
@@ -221,6 +223,13 @@ export const emulatedCSSMediaFeaturePrefersReducedDataSettingDescriptor: Common.
   storageType: Common.Settings.SettingStorageType.SESSION,
 };
 
+export const dataSaverSettingDescriptor: Common.Settings.SettingDescriptor<DataSaverOverride> = {
+  name: 'emulation.data-saver',
+  type: Common.Settings.SettingType.ENUM,
+  defaultValue: DataSaverOverride.UNSET,
+  storageType: Common.Settings.SettingStorageType.SESSION,
+};
+
 export const emulatedCSSMediaFeaturePrefersReducedTransparencySettingDescriptor:
     Common.Settings.SettingDescriptor<string> = {
   name: 'emulated-css-media-feature-prefers-reduced-transparency',

package/front_end/core/sdk/Script.ts

@@ -457,7 +457,6 @@ function frameIdForScript(script: Script): Protocol.Page.FrameId|null {
   return resourceTreeModel.mainFrame.id;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const sourceURLRegex: RegExp = /^[\x20\t]*\/\/[@#] sourceURL=\s*(\S*?)\s*$/;
 
 export async function disassembleWasm(content: string): Promise<TextUtils.WasmDisassembly.WasmDisassembly> {

package/front_end/core/sdk/SecurityOrigin.ts

@@ -2,47 +2,157 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import * as Common from '../common/common.js';
+import type * as Platform from '../platform/platform.js';
+
+/**
+ * Internal representation of a security origin:
+ * - `origin`: A comparable origin string (`<scheme>://<host>[:<port>]` or path-scoped `file://<host>/<path>`).
+ * - `opaque`: An isolated opaque origin uniquely identified by a UUID that never matches any other origin.
+ */
+type InternalOrigin =
+    |{readonly type: 'origin', readonly value: string}|{readonly type: 'opaque', readonly uuid: string};
+
+/** Exact string matches that represent an invalid or opaque origin. */
+const OPAQUE_EXACT_MATCHES = new Set([
+  '',
+  'null',
+  'undefined',
+  'data:',
+  'detached',
+]);
+
+/** String prefixes for origins that must be treated as opaque (e.g. `about:blank`, `blob:data`). */
+const OPAQUE_PREFIXES = [
+  'about:',
+  'blob:about',
+  'blob:data',
+  'blob:null',
+] as const;
+
+function isOpaqueUrlString(url: string): boolean {
+  const lower = url.trim().toLowerCase();
+  if (OPAQUE_EXACT_MATCHES.has(lower)) {
+    return true;
+  }
+  return OPAQUE_PREFIXES.some(prefix => lower.startsWith(prefix));
+}
+
+/**
+ * An immutable security origin for an entity in DevTools (such as a document,
+ * network request, or storage key).
+ *
+ * DevTools features that handle user data or execute commands on behalf of the user
+ * (such as DevTools AI Assistance and Extensions) must enforce strict origin boundaries
+ * to prevent prompt injection and cross-origin data exfiltration.
+ *
+ * This class serves as the single source of truth for origin comparison and classification:
+ *
+ * 1. **Standard Origins**: Web URLs (HTTP, HTTPS, WSS) resolve to `<scheme>://<host>[:<port>]`.
+ *    Two standard origins are same-origin if their scheme, host, and port match.
+ *
+ * 2. **File URLs (`file://`)**: In the WHATWG web security model, `file://` URLs are assigned
+ *    opaque origins. In DevTools, however, users frequently debug local files (`file:///path/index.html`).
+ *    Treating all `file://` URLs as opaque would block the user from inspecting elements or styles within
+ *    the same file. Conversely, treating all `file://` URLs as a single shared origin would allow a malicious
+ *    local file to traverse into other local files via iframes (b/524362513).
+ *    Therefore, DevTools treats `file://` URLs as **path-scoped origins** (`file://<authority><path>`).
+ *    `isOpaque()` returns `false` for `file://` URLs, and two `file://` URLs are considered same-origin
+ *    only if their full file path and host match exactly.
+ *
+ * 3. **Opaque Origins**: Opaque contexts (`data:`, `about:blank`, invalid URLs, or synthetic
+ *    opaque origins) are backed by unique UUIDs. An opaque origin never matches any other origin,
+ *    even another opaque origin created from the same URL string.
+ */
 export class SecurityOrigin {
-  #urlOrigin?: string;
-  #opaqueUuid?: string;
+  readonly #origin: InternalOrigin;
 
-  private constructor(urlOrigin?: string, opaqueUuid?: string) {
-    this.#urlOrigin = urlOrigin;
-    this.#opaqueUuid = opaqueUuid;
+  private constructor(origin: InternalOrigin) {
+    this.#origin = origin;
   }
 
-  static create(urlOrigin: string): SecurityOrigin {
-    return new SecurityOrigin(urlOrigin, undefined);
+  /**
+   * Creates a `SecurityOrigin` instance from a raw URL or origin string.
+   *
+   * - If the URL is determined to be opaque (e.g. `data:`, `about:blank`, empty, `null`),
+   *   a new unique opaque origin is returned.
+   * - If the URL is a `file://` URL, a path-scoped origin (`file://<authority><path>`) is returned.
+   * - Otherwise, the standard origin (`<scheme>://<host>[:<port>]`) is extracted and returned.
+   *
+   * @param rawUrl The raw URL or origin string to evaluate.
+   */
+  static create(rawUrl: string): SecurityOrigin {
+    if (isOpaqueUrlString(rawUrl)) {
+      return SecurityOrigin.createUniqueOpaque();
+    }
+
+    if (rawUrl.toLowerCase().startsWith('file://')) {
+      const parsed = Common.ParsedURL.ParsedURL.fromString(rawUrl as Platform.DevToolsPath.UrlString);
+      if (!parsed) {
+        return SecurityOrigin.createUniqueOpaque();
+      }
+      const authority = parsed.host + (parsed.port ? ':' + parsed.port : '');
+      return new SecurityOrigin({type: 'origin', value: `file://${authority}${parsed.path}`});
+    }
+
+    const origin = Common.ParsedURL.ParsedURL.extractOrigin(rawUrl as Platform.DevToolsPath.UrlString);
+    if (!origin || isOpaqueUrlString(origin)) {
+      return SecurityOrigin.createUniqueOpaque();
+    }
+
+    return new SecurityOrigin({type: 'origin', value: origin});
   }
 
+  /**
+   * Creates a synthetic, unique opaque origin.
+   *
+   * Useful when an entity (like a sandboxed iframe or detached DOM tree) needs an
+   * isolated origin that will never match any other origin in the session.
+   */
   static createUniqueOpaque(): SecurityOrigin {
-    return new SecurityOrigin(undefined, crypto.randomUUID());
+    return new SecurityOrigin({type: 'opaque', uuid: crypto.randomUUID()});
   }
 
-  isSameOriginWith(other: SecurityOrigin): boolean {
-    if (this.#opaqueUuid || other.#opaqueUuid) {
-      return this.#opaqueUuid === other.#opaqueUuid;
-    }
-    if (this.isOpaque() || other.isOpaque()) {
+  /**
+   * Checks whether this security origin is equivalent to another security origin.
+   *
+   * - Standard origins return `true` if their scheme, host, and port match.
+   * - File origins return `true` if their full file path and host match.
+   * - Opaque origins return `true` only if both instances have identical UUIDs.
+   * - Passing `null` always returns `false`.
+   *
+   * @param other The other `SecurityOrigin` to compare with.
+   */
+  isSameOriginWith(other: SecurityOrigin|null): boolean {
+    if (!other) {
       return false;
     }
-    return this.#urlOrigin === other.#urlOrigin && this.#urlOrigin !== undefined;
+    if (this.#origin.type === 'opaque' || other.#origin.type === 'opaque') {
+      return this.#origin.type === 'opaque' && other.#origin.type === 'opaque' &&
+          this.#origin.uuid === other.#origin.uuid;
+    }
+    return this.#origin.value === other.#origin.value;
   }
 
+  /**
+   * Returns whether this origin is opaque.
+   *
+   * Opaque origins include `data:` URLs, `about:blank`, invalid URLs, and instances
+   * created via `createUniqueOpaque()`.
+   */
   isOpaque(): boolean {
-    if (this.#opaqueUuid !== undefined) {
-      return true;
-    }
-    if (this.#urlOrigin) {
-      const lower = this.#urlOrigin.toLowerCase();
-      return lower === '' || lower === 'null' || lower === 'data:' || lower.startsWith('about') ||
-          lower.startsWith('blob:about') || lower.startsWith('blob:data') || lower.startsWith('blob:null') ||
-          lower.startsWith('detached') || lower.startsWith('undefined');
-    }
-    return false;
+    return this.#origin.type === 'opaque';
   }
 
+  /**
+   * Returns a stable string representation of this origin for identification, storage keys,
+   * or debugging logs.
+   *
+   * - For standard origins, returns the serialized origin string (e.g. `https://example.com:8080`).
+   * - For file origins, returns the path-scoped origin (e.g. `file:///path/to/file.html`).
+   * - For opaque origins, returns the unique UUID string.
+   */
   siteId(): string {
-    return this.#opaqueUuid ?? (this.#urlOrigin ?? 'unknown-origin');
+    return this.#origin.type === 'opaque' ? this.#origin.uuid : this.#origin.value;
   }
 }

package/front_end/core/sdk/Target.ts

@@ -6,7 +6,6 @@ import type * as Protocol from '../../generated/protocol.js';
 import * as Common from '../common/common.js';
 import * as Platform from '../platform/platform.js';
 import * as ProtocolClient from '../protocol_client/protocol_client.js';
-import * as Root from '../root/root.js';
 
 import {SDKModel, type SDKModelConstructor} from './SDKModel.js';
 import type {TargetManager} from './TargetManager.js';
@@ -50,10 +49,7 @@ export class Target extends ProtocolClient.InspectorBackend.TargetBase {
         this.#capabilitiesMask = Capability.BROWSER | Capability.STORAGE | Capability.DOM | Capability.JS |
             Capability.LOG | Capability.NETWORK | Capability.TARGET | Capability.TRACING | Capability.EMULATION |
             Capability.INPUT | Capability.INSPECTOR | Capability.AUDITS | Capability.WEB_AUTHN | Capability.IO |
-            Capability.MEDIA | Capability.EVENT_BREAKPOINTS | Capability.DOM_STORAGE;
-        if (Root.Runtime.hostConfig.devToolsWebMCPSupport?.enabled) {
-          this.#capabilitiesMask |= Capability.WEB_MCP;
-        }
+            Capability.MEDIA | Capability.EVENT_BREAKPOINTS | Capability.DOM_STORAGE | Capability.WEB_MCP;
         if (parentTarget?.type() !== Type.FRAME) {
           // This matches backend exposing certain capabilities only for the main frame.
           this.#capabilitiesMask |=

package/front_end/models/ai_assistance/AiUtils.ts

@@ -5,7 +5,6 @@
 import * as Common from '../../core/common/common.js';
 import * as Host from '../../core/host/host.js';
 import * as i18n from '../../core/i18n/i18n.js';
-import type * as Platform from '../../core/platform/platform.js';
 import * as Root from '../../core/root/root.js';
 
 import {debugLog} from './debug.js';
@@ -187,15 +186,6 @@ export function getIconName(): string {
   return isGeminiBranding() ? 'spark' : 'smart-assistant';
 }
 
-export function isSameOrigin(url1: Platform.DevToolsPath.UrlString, url2: Platform.DevToolsPath.UrlString): boolean {
-  if (url1.startsWith('data:') || url2.startsWith('data:')) {
-    return url1 === url2;
-  }
-  const origin1 = Common.ParsedURL.ParsedURL.extractOrigin(url1);
-  const origin2 = Common.ParsedURL.ParsedURL.extractOrigin(url2);
-  return origin1 !== '' && origin1 === origin2;
-}
-
 export interface OneShotPromptRequest {
   aidaClient: Host.AidaClient.AidaClient;
   preamble: string;

package/front_end/models/ai_assistance/agents/AccessibilityAgent.ts

@@ -4,11 +4,9 @@
 
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
-import type * as Platform from '../../../core/platform/platform.js';
 import * as Root from '../../../core/root/root.js';
 import * as SDK from '../../../core/sdk/sdk.js';
 import type * as LHModel from '../../lighthouse/lighthouse.js';
-import {isSameOrigin} from '../AiUtils.js';
 import {ChangeManager} from '../ChangeManager.js';
 import {LighthouseFormatter} from '../data_formatters/LighthouseFormatter.js';
 import {debugLog} from '../debug.js';
@@ -155,11 +153,15 @@ export class AccessibilityAgent extends AiAgent<LHModel.ReporterTypes.ReportJSON
       return;
     }
 
-    const details = await lhr.getUserFacingDetails();
+    const [details, widgets] = await Promise.all([
+      lhr.getUserFacingDetails(),
+      lhr.getWidgets(),
+    ]);
     if (details) {
       yield {
         type: ResponseType.CONTEXT,
         details,
+        widgets,
       };
     }
   }
@@ -183,13 +185,7 @@ export class AccessibilityAgent extends AiAgent<LHModel.ReporterTypes.ReportJSON
     }
 
     const mainDocument = domModel.existingDocument();
-    if (!mainDocument) {
-      return null;
-    }
-    const mainDocumentURL = mainDocument.documentURL;
-    const nodeDocumentURL = node.ownerDocument?.documentURL ?? '' as Platform.DevToolsPath.UrlString;
-
-    if (!isSameOrigin(mainDocumentURL, nodeDocumentURL)) {
+    if (!mainDocument || !mainDocument.securityOrigin().isSameOriginWith(node.securityOrigin())) {
       return null;
     }
 

package/front_end/models/ai_assistance/agents/StylingAgent.ts

@@ -94,7 +94,6 @@ const MULTIMODAL_ENHANCEMENT_PROMPTS: Record<MultimodalInputType, string> = {
   [MultimodalInputType.UPLOADED_IMAGE]: promptForUploadedImage + considerationsForMultimodalInputEvaluation,
 };
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const AI_ASSISTANCE_FILTER_REGEX: string = `\\.${AI_ASSISTANCE_CSS_CLASS_NAME}-.*&`;
 
 /**

package/front_end/models/ai_assistance/injected.ts

@@ -90,7 +90,6 @@ function freestylerBindingFunc(bindingName: string): void {
   }
 }
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const freestylerBinding: string = `(${String(freestylerBindingFunc)})('${FREESTYLER_BINDING_NAME}')`;
 
 export const PAGE_EXPOSED_FUNCTIONS: string[] = ['setElementStyles'];
@@ -172,5 +171,4 @@ const setupSetElementStyles = `function setupSetElementStyles(prefix) {
   global.setElementStyles = setElementStyles;
 }`;
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const injectedFunctions: string = `(${setupSetElementStyles})('${AI_ASSISTANCE_CSS_CLASS_NAME}')`;

package/front_end/models/javascript_metadata/NativeFunctions.ts

@@ -7282,7 +7282,7 @@ export const NativeFunctions: readonly NativeFunctionValue[] = [
   },
   {
     name: "RTCDTMFToneChangeEvent",
-    signatures: [["type","eventInitDict"]]
+    signatures: [["type","?eventInitDict"]]
   },
   {
     name: "RTCEncodedAudioFrame",

package/front_end/models/trace/insights/CLSCulprits.ts

@@ -72,8 +72,7 @@ export const UIStrings = {
 } as const;
 
 const str_ = i18n.i18n.registerUIStrings('models/trace/insights/CLSCulprits.ts', UIStrings);
-export const i18nString: (id: string, values?: Record<string, string|number|boolean>) =>
-    Platform.UIString.LocalizedString = i18n.i18n.getLocalizedString.bind(undefined, str_);
+export const i18nString: i18n.LocalizeString = i18n.i18n.getLocalizedString.bind(undefined, str_);
 
 export type CLSCulpritsInsightModel = InsightModel<typeof UIStrings, {
   animationFailures: readonly NoncompositedAnimationFailure[],