chrome-devtools-frontend 1.0.1689415 → 1.0.1690531

package/.gitmodules

@@ -1,3 +1,7 @@
+[submodule "test/ai_evals/eval_data"]
+	path = test/ai_evals/eval_data
+	url = https://chrome-internal.googlesource.com/devtools/chrome-devtools-evals
+	gclient-condition = checkout_ai_evals == True
 [submodule "third_party/clang-format/script"]
 	path = third_party/clang-format/script
 	url = https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format

package/eslint.config.mjs

@@ -536,8 +536,6 @@ export default defineConfig([
       // certain TypeScript compilation errors after fixes
       '@typescript-eslint/no-unnecessary-type-assertion': 'off',
 
-      '@typescript-eslint/no-inferrable-types': 'error',
-
       '@typescript-eslint/consistent-generic-constructors': 'off',
 
       // This is more performant
@@ -856,6 +854,14 @@ export default defineConfig([
     files: ['front_end/legacy_test_runner/**/*'],
     rules: {
       '@devtools/es-modules-import': 'off',
+      '@typescript-eslint/ban-ts-comment': 'off',
+      '@typescript-eslint/explicit-function-return-type': 'off',
+      '@typescript-eslint/naming-convention': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-floating-promises': 'off',
+      '@typescript-eslint/no-unused-vars': 'off',
+      '@devtools/no-imperative-dom-api': 'off',
+      'jsdoc/require-returns-description': 'off',
     },
   },
   {

package/front_end/core/common/Object.ts

@@ -119,10 +119,16 @@ export type EventMixinBase = {
   dispatchDOMEvent ? (event: Event) : void,
 }&object;
 
-export function eventMixin<Events, Base extends Platform.Constructor.Constructor<EventMixinBase>>(base: Base):
-    Platform.Constructor.Constructor<EventTarget<Events>>&Base {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  console.assert(base as any !== HTMLElement);
+export type EventMixin<
+  Events,
+  Base extends Platform.Constructor.Constructor<EventMixinBase>,
+> = Base & Platform.Constructor.Constructor<EventTarget<Events>>;
+
+export function eventMixin<
+  Events,
+  Base extends Platform.Constructor.Constructor<EventMixinBase>,
+>(base: Base): EventMixin<Events, Base> {
+  console.assert((base as unknown) !== HTMLElement);
   return class EventHandling extends base implements EventTarget<Events> {
     // Note that the weird name is due to TSC disallowing private/protected fields in
     // anonmous exported classes. We use a `__` prefix to prevent clashes with `base`.

package/front_end/core/i18n/collect-ui-strings.js

@@ -37,7 +37,7 @@ const yargsObject = yargs(hideBin(process.argv))
  * @param locale
  * @param strings
  */
-function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
+async function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
   const outputPath = path.join(outputDirectory, `${locale}.json`);
 
   /** @type {Record<string, CtcMessage>} */
@@ -50,7 +50,7 @@ function convertCtcToLhLAndSave(outputDirectory, locale, strings) {
   }
 
   const convertedStrings = bakePlaceholders(sortedCtcStrings);
-  writeIfChanged(outputPath, JSON.stringify(convertedStrings, null, 2) + '\n');
+  await writeIfChanged(outputPath, JSON.stringify(convertedStrings, null, 2) + '\n');
 }
 
 const inputDirectories = yargsObject['input-directories'];
@@ -76,9 +76,9 @@ for (const directory of inputDirectories) {
 }
 
 const outputDirectory = yargsObject['output-directory'];
-convertCtcToLhLAndSave(outputDirectory, 'en-US', collectedStrings);
+await convertCtcToLhLAndSave(outputDirectory, 'en-US', collectedStrings);
 if (yargsObject['include-en-xl']) {
-  convertCtcToLhLAndSave(
+  await convertCtcToLhLAndSave(
       outputDirectory,
       'en-XL',
       createPsuedoLocaleStrings(collectedStrings),
@@ -92,4 +92,4 @@ const depfile = `
 ${path.join(outputDirectory, 'en-US.json')}: ${files.join(' ')}
 `;
 
-writeIfChanged(path.join(outputDirectory, 'collected-ui-strings.d'), depfile);
+await writeIfChanged(path.join(outputDirectory, 'collected-ui-strings.d'), depfile);

package/front_end/core/i18n/generate-locales-js.js

@@ -53,4 +53,4 @@ export const REMOTE_FETCH_PATTERN = '${yargsObject['remote-fetch-pattern']}';
 export const LOCAL_FETCH_PATTERN = '${yargsObject['local-fetch-pattern']}';
 `;
 
-writeIfChanged(path.join(yargsObject['target-gen-dir'], 'locales.js'), content);
+await writeIfChanged(path.join(yargsObject['target-gen-dir'], 'locales.js'), content);

package/front_end/core/i18n/i18n.ts

@@ -2,12 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import type * as Platform from '../platform/platform.js';
+
 import * as ByteUtilities from './ByteUtilities.js';
 import * as DevToolsLocale from './DevToolsLocale.js';
 import * as i18n from './i18nImpl.js';
+import type * as i18nTypes from './i18nTypes.js';
 import * as NumberFormatter from './NumberFormatter.js';
 import * as TimeUtilities from './time-utilities.js';
 
+export type LocalizeString = (id: string, values?: i18nTypes.Values) => Platform.UIString.LocalizedString;
+export type LazyLocalizeString = () => Platform.UIString.LocalizedString;
+
 export {
   ByteUtilities,
   DevToolsLocale,

package/front_end/core/root/Runtime.ts

@@ -515,16 +515,13 @@ interface UseGcaApi {
 
 interface DevToolsAiV2Architecture {
   enabled: boolean;
+  userTier?: string;
 }
 
 interface DevToolsProtocolMonitor {
   enabled: boolean;
 }
 
-interface DevToolsWebMCPSupport {
-  enabled: boolean;
-}
-
 interface DevToolsAdsPanel {
   enabled: boolean;
 }
@@ -599,7 +596,6 @@ export type HostConfig = Platform.TypeScriptUtilities.RecursivePartial<{
   devToolsConsoleInsightsTeasers: ConsoleInsightsTeasers,
   devToolsGeminiRebranding: HostConfigGeminiRebranding,
   devToolsProtocolMonitor: DevToolsProtocolMonitor,
-  devToolsWebMCPSupport: DevToolsWebMCPSupport,
   devToolsAdsPanel: DevToolsAdsPanel,
   devToolsUseGcaApi: UseGcaApi,
   devToolsPlusButton: DevToolsPlusButton,

package/front_end/core/sdk/CSSMetadata.ts

@@ -440,13 +440,12 @@ export const PositionTryOrderKeywords: PositionTryOrderKeyword[] = [
   PositionTryOrderKeyword.MOST_INLINE_SIZE,
 ];
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const VariableNameRegex: RegExp = /(\s*--.*?)/gs;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const VariableRegex: RegExp = /(var\(\s*--.*?\))/gs;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const CustomVariableRegex: RegExp = /(var\(*--[\w\d]+-([\w]+-[\w]+)\))/g;
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
+
 export const URLRegex: RegExp = /url\(\s*('.+?'|".+?"|[^)]+)\s*\)/g;
 
 /**
@@ -457,7 +456,6 @@ export const URLRegex: RegExp = /url\(\s*('.+?'|".+?"|[^)]+)\s*\)/g;
  * 'grid', 'grid-template', e.g.
  *    [track-#name] "a a ." minmax(50px, auto) [track-#name]
  */
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const GridAreaRowRegex: RegExp = /((?:\[[\w\- ]+\]\s*)*(?:"[^"]+"|'[^']+'))[^'"\[]*\[?[^'"\[]*/;
 
 let cssMetadataInstance: CSSMetadata|null = null;

package/front_end/core/sdk/DOMModel.ts

@@ -48,6 +48,7 @@ import {RemoteObject} from './RemoteObject.js';
 import {Events as ResourceTreeModelEvents, type ResourceTreeFrame, ResourceTreeModel} from './ResourceTreeModel.js';
 import {RuntimeModel} from './RuntimeModel.js';
 import {SDKModel} from './SDKModel.js';
+import {SecurityOrigin} from './SecurityOrigin.js';
 import {Capability, type Target} from './Target.js';
 import type {TargetManager} from './TargetManager.js';
 
@@ -387,6 +388,14 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
     return this.#topLayerIndex;
   }
 
+  /**
+   * Returns the security origin of the document owning this node, or `null` if
+   * this node is not attached to a document.
+   */
+  securityOrigin(): SecurityOrigin|null {
+    return this.ownerDocument?.securityOrigin() ?? null;
+  }
+
   adProvenance(): Protocol.Network.AdProvenance|undefined {
     if (this.#adProvenance !== undefined) {
       return this.#adProvenance;
@@ -1424,6 +1433,8 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
       nodeName: this.nodeName(),
       localName: this.localName(),
       nodeValue: this.nodeValueInternal,
+      documentURL: this.documentURL,
+      baseURL: this.baseURL,
     } as Protocol.DOM.Node) :
                                                      new DOMNodeSnapshot(this.domModel());
     snapshot.id = this.id;
@@ -1445,11 +1456,6 @@ export class DOMNode extends Common.ObjectWrapper.ObjectWrapper<DOMNodeEventType
     snapshot.#isInShadowTree = this.#isInShadowTree;
     snapshot.childNodeCountInternal = this.childNodeCountInternal;
 
-    if (snapshot instanceof DOMDocument && this instanceof DOMDocument) {
-      snapshot.documentURL = this.documentURL;
-      snapshot.baseURL = this.baseURL;
-    }
-
     if (!this.childrenInternal && this.childNodeCountInternal > 0) {
       await this.getSubtree(1, false);
     }
@@ -1600,15 +1606,45 @@ export class DOMNodeShortcut {
 export class DOMDocument extends DOMNode {
   body: DOMNode|null;
   documentElement: DOMNode|null;
-  documentURL: Platform.DevToolsPath.UrlString;
-  baseURL: Platform.DevToolsPath.UrlString;
+  #documentURL: Platform.DevToolsPath.UrlString;
+  #baseURL: Platform.DevToolsPath.UrlString;
+  #securityOrigin: SecurityOrigin;
+
   constructor(domModel: DOMModel, payload: Protocol.DOM.Node) {
     super(domModel);
     this.body = null;
     this.documentElement = null;
     this.init(this, false, payload);
-    this.documentURL = (payload.documentURL || '') as Platform.DevToolsPath.UrlString;
-    this.baseURL = (payload.baseURL || '') as Platform.DevToolsPath.UrlString;
+    this.#documentURL = (payload.documentURL || '') as Platform.DevToolsPath.UrlString;
+    this.#baseURL = (payload.baseURL || '') as Platform.DevToolsPath.UrlString;
+    this.#securityOrigin = SecurityOrigin.create(this.#documentURL);
+  }
+
+  get documentURL(): Platform.DevToolsPath.UrlString {
+    return this.#documentURL;
+  }
+
+  get baseURL(): Platform.DevToolsPath.UrlString {
+    return this.#baseURL;
+  }
+
+  /**
+   * Returns the security origin of this document.
+   *
+   * The security origin is derived from the document URL and is recomputed
+   * when the document navigates to a new URL via `setDocumentURL`.
+   */
+  override securityOrigin(): SecurityOrigin {
+    return this.#securityOrigin;
+  }
+
+  /**
+   * Updates the document and base URLs, and recomputes the document's security origin.
+   */
+  setDocumentURL(url: Platform.DevToolsPath.UrlString): void {
+    this.#documentURL = url;
+    this.#baseURL = url;
+    this.#securityOrigin = SecurityOrigin.create(url);
   }
 }
 
@@ -1694,8 +1730,7 @@ export class DOMModel extends SDKModel<EventTypes> {
     if (node) {
       const contentDocument = node.contentDocument();
       if (contentDocument && contentDocument.documentURL !== frame.url) {
-        contentDocument.documentURL = frame.url;
-        contentDocument.baseURL = frame.url;
+        contentDocument.setDocumentURL(frame.url);
         this.dispatchEventToListeners(Events.DocumentURLChanged, contentDocument);
       }
     }

package/front_end/core/sdk/EmulationModel.ts

@@ -4,6 +4,7 @@
 
 import type * as ProtocolProxyApi from '../../generated/protocol-proxy-api.js';
 import * as Protocol from '../../generated/protocol.js';
+import type * as Common from '../common/common.js';
 
 import {CSSModel} from './CSSModel.js';
 import type {MultitargetNetworkManager} from './NetworkManager.js';
@@ -12,6 +13,7 @@ import {SDKModel} from './SDKModel.js';
 import {
   avifFormatDisabledSettingDescriptor,
   cpuPressureSettingDescriptor,
+  dataSaverSettingDescriptor,
   emulateAutoDarkModeSettingDescriptor,
   emulatedCSSMediaFeatureColorGamutSettingDescriptor,
   emulatedCSSMediaFeatureForcedColorsSettingDescriptor,
@@ -56,6 +58,8 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
   };
   #screenOrientationLocked: boolean;
   #lockedOrientation: Protocol.Emulation.ScreenOrientation|null;
+  readonly #dataSaverSetting: Common.Settings.Setting<DataSaverOverride>;
+  readonly #dataSaverChangeListener: () => void;
 
   constructor(target: Target) {
     super(target);
@@ -239,6 +243,15 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
       updateDisabledImageFormats();
     }
 
+    this.#dataSaverSetting = settings.resolve(dataSaverSettingDescriptor);
+    this.#dataSaverChangeListener = () => {
+      void this.setDataSaverOverride(this.#dataSaverSetting.get());
+    };
+    this.#dataSaverSetting.addChangeListener(this.#dataSaverChangeListener, this);
+    if (this.#dataSaverSetting.get() !== DataSaverOverride.UNSET) {
+      void this.setDataSaverOverride(this.#dataSaverSetting.get());
+    }
+
     this.#cpuPressureEnabled = false;
     this.#touchEmulationAllowed = true;
     this.#touchEnabled = false;
@@ -251,6 +264,11 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
     target.registerEmulationDispatcher(this);
   }
 
+  override dispose(): void {
+    super.dispose();
+    this.#dataSaverSetting.removeChangeListener(this.#dataSaverChangeListener, this);
+  }
+
   setTouchEmulationAllowed(touchEmulationAllowed: boolean): void {
     this.#touchEmulationAllowed = touchEmulationAllowed;
   }

package/front_end/core/sdk/NetworkRequest.ts

@@ -16,6 +16,7 @@ import {
   Events as NetworkManagerEvents,
   NetworkManager,
 } from './NetworkManager.js';
+import {SecurityOrigin} from './SecurityOrigin.js';
 import {ServerSentEvents} from './ServerSentEvents.js';
 import {ServerTiming} from './ServerTiming.js';
 import {Type} from './Target.js';
@@ -388,6 +389,55 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
     return this.#backendRequestId;
   }
 
+  /**
+   * Returns the security origin of the target resource URL (`request.url()`) for this network request.
+   *
+   * For example, if an inspected document at `https://example.com/index.html` initiates a fetch
+   * to `https://api.github.com/users`, `requestURLSecurityOrigin()` returns the origin for
+   * `https://api.github.com`.
+   *
+   * For imported HAR files, the origin is mapped to an isolated virtual domain
+   * (`imported-har://${authority}`) to ensure recorded network traffic never collides with
+   * live web origins.
+   *
+   * @see {@link initiatorSecurityOrigin} to obtain the origin of the document that initiated the request.
+   */
+  requestURLSecurityOrigin(): SecurityOrigin {
+    return this.#resolveSecurityOrigin(this.#url);
+  }
+
+  /**
+   * Returns the security origin of the document or context (`request.documentURL`) that initiated
+   * this network request.
+   *
+   * For example, if an inspected document at `https://example.com/index.html` initiates a fetch
+   * to `https://api.github.com/users`, `initiatorSecurityOrigin()` returns the origin for
+   * `https://example.com`.
+   *
+   * If `documentURL` is empty, invalid, or an opaque context (such as a `data:` URL or sandboxed
+   * iframe), this returns a unique opaque `SecurityOrigin`.
+   *
+   * For imported HAR files, the origin is mapped to an isolated virtual domain
+   * (`imported-har://${authority}`) matching the imported initiating document.
+   *
+   * @see {@link requestURLSecurityOrigin} to obtain the origin of the target resource URL being requested.
+   */
+  initiatorSecurityOrigin(): SecurityOrigin {
+    return this.#resolveSecurityOrigin(this.#documentURL);
+  }
+
+  #resolveSecurityOrigin(url: Platform.DevToolsPath.UrlString): SecurityOrigin {
+    if (this.#isImportedHar) {
+      const parsed = Common.ParsedURL.ParsedURL.fromString(url);
+      if (!parsed || !parsed.host) {
+        return SecurityOrigin.createUniqueOpaque();
+      }
+      const authority = parsed.host + (parsed.port ? ':' + parsed.port : '');
+      return SecurityOrigin.create(`imported-har://${authority}`);
+    }
+    return SecurityOrigin.create(url);
+  }
+
   url(): Platform.DevToolsPath.UrlString {
     return this.#url;
   }
@@ -486,10 +536,6 @@ export class NetworkRequest extends Common.ObjectWrapper.ObjectWrapper<EventType
     return this.#securityDetails;
   }
 
-  securityOrigin(): string {
-    return this.#parsedURL.securityOrigin();
-  }
-
   setSecurityDetails(securityDetails: Protocol.Network.SecurityDetails): void {
     this.#securityDetails = securityDetails;
   }

package/front_end/core/sdk/NetworkRequestAccess.ts

@@ -0,0 +1,172 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import type * as NetworkRequest from './NetworkRequest.js';
+import * as SecurityOrigin from './SecurityOrigin.js';
+
+/**
+ * Specifies how a network request's response data (body and headers) can be accessed
+ * relative to the initiating context's security origin.
+ *
+ * DevTools features that inspect network requests (such as AI Assistance) must respect
+ * the browser Same-Origin Policy (SOP) and Cross-Origin Resource Sharing (CORS) rules:
+ * - Same-origin responses are fully readable by the initiating document.
+ * - Cross-origin responses with valid CORS headers (`Access-Control-Allow-Origin`) are readable.
+ * - Opaque cross-origin responses (such as `no-cors` fetches to third-party endpoints) are NOT
+ *   readable by the page and must never have their response bodies or restricted headers exposed
+ *   to unauthorized contexts (b/513821237).
+ */
+export const enum ResponseAccessMode {
+  /** The request target URL is same-origin with the initiator context. */
+  SAME_ORIGIN = 'SAME_ORIGIN',
+  /** The request is cross-origin, but explicit CORS response headers permit access by the initiator. */
+  CORS_ALLOWED = 'CORS_ALLOWED',
+  /** The request is cross-origin without CORS authorization; response body and unexposed headers are restricted. */
+  OPAQUE_CROSS_ORIGIN = 'OPAQUE_CROSS_ORIGIN',
+}
+
+/**
+ * Standard CORS-safelisted response headers that are exposed on cross-origin requests
+ * without requiring explicit `Access-Control-Expose-Headers`.
+ *
+ * @see https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
+ */
+export const CORS_SAFELISTED_RESPONSE_HEADERS: ReadonlySet<string> = new Set([
+  'cache-control',
+  'content-language',
+  'content-length',
+  'content-type',
+  'expires',
+  'last-modified',
+  'pragma',
+]);
+
+/**
+ * Placeholder text replacing response body content when cross-origin access is forbidden.
+ */
+export const REDACTED_RESPONSE_BODY = '<redacted cross-origin response body>';
+
+/**
+ * Returns whether a network request used credentials (cookies, authorization headers,
+ * or server-indicated credentials mode).
+ *
+ * @param request The network request to inspect.
+ * @returns True if the request included credentials or requires credentialed CORS.
+ * @see https://fetch.spec.whatwg.org/#credentials
+ */
+export function isRequestCredentialed(request: NetworkRequest.NetworkRequest): boolean {
+  const hasAuthHeaders = Boolean(
+      request.requestHeaderValue('authorization') || request.requestHeaderValue('proxy-authorization'),
+  );
+  const hasCookies = request.includedRequestCookies().length > 0 || request.responseCookies.length > 0 ||
+      Boolean(request.requestHeaderValue('cookie')) || Boolean(request.responseHeaderValue('set-cookie'));
+  const hasAllowCredentials =
+      request.responseHeaderValue('access-control-allow-credentials')?.trim().toLowerCase() === 'true';
+
+  return hasAuthHeaders || hasCookies || hasAllowCredentials;
+}
+
+/**
+ * Evaluates the response access mode for a network request relative to an initiator origin.
+ *
+ * Evaluation rules:
+ * 1. If `initiatorOrigin` is omitted, the origin is derived from `request.documentURL`. If
+ *    `documentURL` is invalid or opaque, access mode defaults to `OPAQUE_CROSS_ORIGIN`.
+ * 2. If the initiator origin is opaque (e.g. sandboxed iframe or `data:` URL), returns `OPAQUE_CROSS_ORIGIN`.
+ * 3. If the initiator origin is same-origin with the request URL, returns `SAME_ORIGIN`.
+ * 4. If Chrome's network stack flagged a CORS error (`corsErrorStatus`), returns `OPAQUE_CROSS_ORIGIN`.
+ * 5. If the server provided an `Access-Control-Allow-Origin` header:
+ *    - Wildcard `*` grants `CORS_ALLOWED` only if the request does not include credentials. Under the
+ *      Fetch specification, wildcard `*` is invalid for credentialed requests.
+ *    - An explicit match against the initiator origin grants `CORS_ALLOWED`.
+ * 6. Otherwise, returns `OPAQUE_CROSS_ORIGIN`.
+ *
+ * @param request The network request being inspected.
+ * @param initiatorOrigin The security origin of the initiating context (e.g. page or conversation origin).
+ * @returns The evaluated `ResponseAccessMode`.
+ */
+export function evaluateResponseAccessMode(
+    request: NetworkRequest.NetworkRequest,
+    initiatorOrigin?: SecurityOrigin.SecurityOrigin,
+    ): ResponseAccessMode {
+  const effectiveInitiatorOrigin = initiatorOrigin ?? SecurityOrigin.SecurityOrigin.create(request.documentURL);
+
+  // Opaque initiator contexts (e.g. data: URLs, sandboxed iframes) are never permitted
+  // to inspect cross-origin response content.
+  if (effectiveInitiatorOrigin.isOpaque()) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const resourceOrigin = SecurityOrigin.SecurityOrigin.create(request.url());
+  if (effectiveInitiatorOrigin.isSameOriginWith(resourceOrigin)) {
+    return ResponseAccessMode.SAME_ORIGIN;
+  }
+
+  // If the browser blocked the request with a CORS error, treat the response
+  // as opaque regardless of any Access-Control-Allow-Origin header value.
+  if (request.corsErrorStatus()) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const allowOriginHeader = request.responseHeaderValue('access-control-allow-origin')?.trim();
+  if (!allowOriginHeader) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const isCredentialed = isRequestCredentialed(request);
+
+  // Under the Fetch specification, wildcard '*' is forbidden from exposing responses if credentials are used.
+  if (allowOriginHeader === '*' && !isCredentialed) {
+    return ResponseAccessMode.CORS_ALLOWED;
+  }
+
+  if (allowOriginHeader.toLowerCase() === effectiveInitiatorOrigin.siteId().toLowerCase()) {
+    return ResponseAccessMode.CORS_ALLOWED;
+  }
+
+  return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+}
+
+/**
+ * Filters the response headers of a network request based on its access mode.
+ *
+ * - `SAME_ORIGIN`: Returns all response headers.
+ * - `CORS_ALLOWED`: Returns CORS-safelisted headers plus headers exposed via
+ *   `Access-Control-Expose-Headers`.
+ * - `OPAQUE_CROSS_ORIGIN`: Returns only CORS-safelisted response headers. Under the Fetch
+ *   specification, opaque responses do not expose headers configured by `Access-Control-Expose-Headers`.
+ *
+ * @param request The network request whose headers are being filtered.
+ * @param accessMode The evaluated response access mode for this request.
+ * @returns Array of allowed header name/value pairs.
+ */
+export function getFilterableResponseHeaders(
+    request: NetworkRequest.NetworkRequest,
+    accessMode: ResponseAccessMode,
+    ): Array<{name: string, value: string}> {
+  if (accessMode === ResponseAccessMode.SAME_ORIGIN) {
+    return request.responseHeaders;
+  }
+
+  if (accessMode === ResponseAccessMode.OPAQUE_CROSS_ORIGIN) {
+    return request.responseHeaders.filter(header => {
+      const lowerName = header.name.toLowerCase().trim();
+      return CORS_SAFELISTED_RESPONSE_HEADERS.has(lowerName);
+    });
+  }
+
+  // For CORS_ALLOWED requests, parse Access-Control-Expose-Headers.
+  const exposeHeadersValue = request.responseHeaderValue('access-control-expose-headers')?.trim() || '';
+  const exposedSet = new Set(
+      exposeHeadersValue.split(',').map(h => h.trim().toLowerCase()).filter(Boolean),
+  );
+
+  const isCredentialed = isRequestCredentialed(request);
+  const allowWildcardExposure = !isCredentialed && exposedSet.has('*');
+
+  return request.responseHeaders.filter(header => {
+    const lowerName = header.name.toLowerCase().trim();
+    return CORS_SAFELISTED_RESPONSE_HEADERS.has(lowerName) || allowWildcardExposure || exposedSet.has(lowerName);
+  });
+}

package/front_end/core/sdk/SDKSettings.ts

@@ -5,6 +5,8 @@
 import type * as Protocol from '../../generated/protocol.js';
 import * as Common from '../common/common.js';
 
+import {DataSaverOverride} from './EmulationModel.js';
+
 export const jsSourceMapsEnabledSettingDescriptor: Common.Settings.SettingDescriptor<boolean> = {
   name: 'js-source-maps-enabled',
   type: Common.Settings.SettingType.BOOLEAN,
@@ -221,6 +223,13 @@ export const emulatedCSSMediaFeaturePrefersReducedDataSettingDescriptor: Common.
   storageType: Common.Settings.SettingStorageType.SESSION,
 };
 
+export const dataSaverSettingDescriptor: Common.Settings.SettingDescriptor<DataSaverOverride> = {
+  name: 'emulation.data-saver',
+  type: Common.Settings.SettingType.ENUM,
+  defaultValue: DataSaverOverride.UNSET,
+  storageType: Common.Settings.SettingStorageType.SESSION,
+};
+
 export const emulatedCSSMediaFeaturePrefersReducedTransparencySettingDescriptor:
     Common.Settings.SettingDescriptor<string> = {
   name: 'emulated-css-media-feature-prefers-reduced-transparency',

package/front_end/core/sdk/Script.ts

@@ -457,7 +457,6 @@ function frameIdForScript(script: Script): Protocol.Page.FrameId|null {
   return resourceTreeModel.mainFrame.id;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-inferrable-types
 export const sourceURLRegex: RegExp = /^[\x20\t]*\/\/[@#] sourceURL=\s*(\S*?)\s*$/;
 
 export async function disassembleWasm(content: string): Promise<TextUtils.WasmDisassembly.WasmDisassembly> {