chrome-devtools-frontend 1.0.1690116 → 1.0.1695017

package/front_end/models/ai_assistance/AiConversation.ts

@@ -1,7 +1,6 @@
 // Copyright 2024 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-import * as Common from '../../core/common/common.js';
 import * as Host from '../../core/host/host.js';
 import * as Platform from '../../core/platform/platform.js';
 import * as Root from '../../core/root/root.js';
@@ -46,14 +45,13 @@ export const NOT_FOUND_IMAGE_DATA = '';
 export const CONTEXT_TITLE = 'Analyzing data';
 const MAX_TITLE_LENGTH = 80;
 /**
- * List of page navigations that are allowed during an AI agent run.
- * These are page navigations triggered by agents themselves:
- * - `about://` : Navigated to before initiating a trace recording to ensure a clean state.
- * - `chrome://terms`: Navigated to by Lighthouse during its Back-Forward Cache
- *    audit.
+ * Page URL prefixes permitted during an AI agent run.
+ * Agents trigger these navigations internally:
+ * - `about:blank`: Used before recording a performance trace to ensure a clean state.
+ * - `chrome://terms`: Used by Lighthouse during Back-Forward Cache audits.
  */
 export const ALLOWED_PAGE_NAVIGATIONS: Platform.DevToolsPath.UrlString[] = [
-  Platform.DevToolsPath.urlString`about://`,
+  Platform.DevToolsPath.urlString`about:blank`,
   Platform.DevToolsPath.urlString`chrome://terms`,
 ];
 
@@ -107,7 +105,7 @@ export class AiConversation {
 
   #aidaClient: Host.AidaClient.AidaClient;
   #changeManager: ChangeManager|undefined;
-  #origin?: string|SDK.SecurityOrigin.SecurityOrigin;
+  #origin?: SDK.SecurityOrigin.SecurityOrigin;
   #navigationOccurredDuringRun = false;
 
   #contexts: Array<ConversationContext<unknown>> = [];
@@ -181,7 +179,7 @@ export class AiConversation {
     return this.history.length === 0;
   }
 
-  #setOriginIfEmpty(newOrigin: string|SDK.SecurityOrigin.SecurityOrigin|undefined): void {
+  #setOriginIfEmpty(newOrigin: SDK.SecurityOrigin.SecurityOrigin|undefined): void {
     if (!this.#origin) {
       this.#origin = newOrigin;
     }
@@ -431,14 +429,17 @@ export class AiConversation {
           } = {},
           ): AsyncGenerator<ResponseData, void, void> {
     this.#navigationOccurredDuringRun = false;
-    const originAtRunStart = getPrimaryPageOrigin(this.#targetManager);
+    const originAtRunStart = getPrimaryPageSecurityOrigin(this.#targetManager);
     const listener = (): void => {
-      // If an unexpected navigation to a different origin occurred
-      // during processing the user's request, we don't want to allow
-      // the agent to run any function calls and retrieve data from the new origin.
-      // Performance agent and accessibility agent navigate to 'about://' or 'chrome://terms'
-      const newOrigin = getPrimaryPageOrigin(this.#targetManager);
-      if (originAtRunStart !== newOrigin && newOrigin && !ALLOWED_PAGE_NAVIGATIONS.includes(newOrigin)) {
+      // Prevent the agent from executing tools or reading data from an untrusted origin
+      // if the page navigates unexpectedly during execution.
+      const newInspectedURL = this.#targetManager.primaryPageTarget()?.inspectedURL();
+      const newOrigin = newInspectedURL ? SDK.SecurityOrigin.SecurityOrigin.create(newInspectedURL) : undefined;
+      const isSameOrigin = Boolean(originAtRunStart && newOrigin && originAtRunStart.isSameOriginWith(newOrigin));
+      const isAllowedNavigation =
+          Boolean(newInspectedURL && ALLOWED_PAGE_NAVIGATIONS.some(allowed => newInspectedURL.startsWith(allowed)));
+
+      if (!isSameOrigin && !isAllowedNavigation) {
         this.#navigationOccurredDuringRun = true;
       }
     };
@@ -543,24 +544,28 @@ export class AiConversation {
     return !this.#contexts.every(context => context.isOriginAllowed(this.#origin));
   }
 
-  get origin(): string|undefined {
-    return this.#origin instanceof SDK.SecurityOrigin.SecurityOrigin ? this.#origin.siteId() : this.#origin;
+  get origin(): SDK.SecurityOrigin.SecurityOrigin|undefined {
+    return this.#origin;
   }
 
   get type(): ConversationType {
     return this.#type;
   }
 
+  /**
+   * Returns the permitted origin for agent tool execution, or blocks execution
+   * if an unapproved cross-origin navigation occurred during the current run.
+   */
   allowedOrigin = (): AllowedOriginResult => {
     if (this.#navigationOccurredDuringRun) {
       return {blocked: true};
     }
     if (this.#origin) {
-      return {origin: this.origin};
+      return {origin: this.#origin};
     }
-    this.#origin = getPrimaryPageOrigin(this.#targetManager);
+    this.#origin = getPrimaryPageSecurityOrigin(this.#targetManager);
 
-    return {origin: this.origin};
+    return {origin: this.#origin};
   };
 }
 
@@ -574,10 +579,16 @@ function isAiAssistanceServerSideLoggingAllowed(): boolean {
   return !Root.Runtime.hostConfig.aidaAvailability?.disallowLogging;
 }
 
-function getPrimaryPageOrigin(
+/**
+ * Returns the security origin of the primary page target.
+ *
+ * @param targetManager Target manager used to locate the primary page target.
+ * @returns The parsed SecurityOrigin, or undefined if no target or inspected URL exists.
+ */
+function getPrimaryPageSecurityOrigin(
     targetManager: SDK.TargetManager.TargetManager,
-    ): Platform.DevToolsPath.UrlString|undefined {
+    ): SDK.SecurityOrigin.SecurityOrigin|undefined {
   const target = targetManager.primaryPageTarget();
   const inspectedURL = target?.inspectedURL();
-  return inspectedURL ? new Common.ParsedURL.ParsedURL(inspectedURL).securityOrigin() : undefined;
+  return inspectedURL ? SDK.SecurityOrigin.SecurityOrigin.create(inspectedURL) : undefined;
 }

package/front_end/models/ai_assistance/README.md

@@ -60,10 +60,12 @@ Example from `PerformanceAgent`:
 To prevent prompt injection attacks and cross-origin data leaks, the AI Assistance panel enforces strict origin-lock boundaries:
 
 - **Origin Locking**: Once a conversation session begins, it locks to the origin of the initial data context (e.g. `https://google.com` or a specific file path).
-- **Opaque Origins**: Any origin classified as opaque (e.g. `data:`, `about:`, `detached` nodes, unparsed `undefined://` or empty origins) is blocked from starting AI assistance (`isOpaqueOrigin()`).
+- **Opaque Origins**: Any origin classified as opaque (e.g. `data:`, `about:`, `detached` nodes, or synthetic opaque origins) is blocked from starting AI assistance (`SecurityOrigin.isOpaque()`).
 - **File Isolation**: Local files (`file://`) do not share a single wildcard origin. Instead, the path is appended (e.g. `file:///path/to/file.js`) to treat each local file as its own unique origin. Swapping local files in the same conversation is blocked.
-- **Trace Isolation**: Imported performance trace recordings are isolated using the virtual origin `imported-trace://${domain}`. This ensures that loaded local trace files do not share origins with live pages, preventing potential cross-origin prompt injection attacks when switching contexts.
-- **Equivalence**: `areOriginsEquivalent()` ensures opaque origins are never equivalent to anything (including themselves), forcing a conversation reset on transitions.
+- **Trace Isolation**: Imported performance trace recordings are isolated using the virtual origin `imported-trace://${host}`. This ensures that loaded local trace files do not share origins with live pages, preventing potential cross-origin prompt injection attacks when switching contexts.
+- **HAR Isolation**: Imported HAR network recordings use the virtual origin `imported-har://${host}` to isolate imported network traffic from live pages.
+- **CORS Response Gating**: Network requests initiated cross-origin without valid CORS authorization (`Access-Control-Allow-Origin`) are classified as `OPAQUE_CROSS_ORIGIN`. DevTools redacts the response body and restricts response headers to CORS-safelisted names to prevent cross-origin data disclosure (b/513821237).
+- **Equivalence**: `SecurityOrigin.isSameOriginWith()` ensures opaque origins never match any other origin (even with identical URL representations), forcing a conversation reset on context switch.
 
 ## AIAgentV2 (Unified Architecture)
 

package/front_end/models/ai_assistance/agents/AccessibilityAgent.ts

@@ -253,6 +253,7 @@ export class AccessibilityAgent extends AiAgent<LHModel.ReporterTypes.ReportJSON
               createExtensionScope: this.#createExtensionScope.bind(this),
               execJs: this.#execJs,
               getExecutionContextNode: () => this.#getDocumentBodyNode(),
+              getEstablishedOrigin: () => this.context?.getOrigin(),
             },
             options,
         );

package/front_end/models/ai_assistance/agents/AiAgent.ts

@@ -11,7 +11,6 @@ import type * as Protocol from '../../../generated/protocol.js';
 import type * as LHModel from '../../lighthouse/lighthouse.js';
 import type * as Trace from '../../trace/trace.js';
 import type * as Workspace from '../../workspace/workspace.js';
-import {areOriginsEquivalent, extractContextOrigin, isOpaqueOrigin} from '../AiOrigins.js';
 import {debugLog, isStructuredLogEnabled} from '../debug.js';
 import type {ContextHandlerResult, DataHandlerResult} from '../tools/Tool.js';
 
@@ -158,7 +157,7 @@ export interface RequestOptions {
 }
 
 export type AllowedOriginResult = {
-  origin: string|undefined,
+  origin: SDK.SecurityOrigin.SecurityOrigin|undefined,
 }|{
   blocked: true,
 };
@@ -193,7 +192,6 @@ export interface ConversationSuggestion {
 export type ConversationSuggestions = [ConversationSuggestion, ...ConversationSuggestion[]];
 
 export abstract class ConversationContext<T> {
-  abstract getURL(): string;
   abstract getItem(): T;
   abstract getTitle(): string;
 
@@ -205,47 +203,43 @@ export abstract class ConversationContext<T> {
     return true;
   }
 
-  getOrigin(): string|SDK.SecurityOrigin.SecurityOrigin {
-    return extractContextOrigin(this.getURL());
-  }
+  /**
+   * Returns the security origin that owns this context data.
+   *
+   * The AI Assistance panel locks each conversation to the origin of the initial
+   * context. If the user selects a context with a different origin, DevTools
+   * blocks access to prevent unauthorized cross-origin data exposure.
+   *
+   * Subclasses must implement this method. If a context is detached, invalid,
+   * or anonymous, the method must return a unique opaque origin
+   * (`SDK.SecurityOrigin.SecurityOrigin.createUniqueOpaque()`).
+   *
+   * @returns The {@link SDK.SecurityOrigin.SecurityOrigin} that owns this context.
+   */
+  abstract getOrigin(): SDK.SecurityOrigin.SecurityOrigin;
 
   /**
-   * Returns true if this data context (e.g., a DOM node or Network Request) is
-   * allowed to be included in a conversation that is locked to the provided
-   * `establishedOrigin`.
+   * Checks whether this context can participate in a conversation locked to `establishedOrigin`.
    *
-   * A conversation is "locked" to an origin once the first query is made.
-   * This method ensures that we don't mix data from different origins in the
-   * same conversation.
+   * Evaluation rules:
+   * 1. Returns `false` if this context origin is opaque. Opaque contexts can never
+   *    participate in AI conversations.
+   * 2. Returns `true` if `establishedOrigin` is `undefined` (conversation is not yet locked).
+   * 3. Returns `true` if this context origin is same-origin with `establishedOrigin`.
    *
-   * @param establishedOrigin The origin that the current conversation is locked to.
-   * If undefined, the conversation has not yet been locked to an origin.
+   * @param establishedOrigin The locked origin of the current conversation, or `undefined`
+   * if the conversation has not made its first query.
    */
-  isOriginAllowed(establishedOrigin: string|SDK.SecurityOrigin.SecurityOrigin|undefined): boolean {
+  isOriginAllowed(establishedOrigin: SDK.SecurityOrigin.SecurityOrigin|undefined): boolean {
     const origin = this.getOrigin();
 
-    if (origin instanceof SDK.SecurityOrigin.SecurityOrigin) {
-      if (origin.isOpaque()) {
-        return false;
-      }
-      if (!establishedOrigin) {
-        return true;
-      }
-      const established = establishedOrigin instanceof SDK.SecurityOrigin.SecurityOrigin ?
-          establishedOrigin :
-          SDK.SecurityOrigin.SecurityOrigin.create(establishedOrigin);
-      return origin.isSameOriginWith(established);
+    if (origin.isOpaque()) {
+      return false;
     }
-
-    // If no origin is established yet, this context will be the one to lock the conversation.
-    // Opaque origins are never allowed to be used as context.
     if (!establishedOrigin) {
-      return !isOpaqueOrigin(origin);
+      return true;
     }
-    // Only allow data that matches the origin the conversation is already locked to.
-    const establishedString =
-        establishedOrigin instanceof SDK.SecurityOrigin.SecurityOrigin ? establishedOrigin.siteId() : establishedOrigin;
-    return areOriginsEquivalent(origin, establishedString);
+    return origin.isSameOriginWith(establishedOrigin);
   }
 
   /**

package/front_end/models/ai_assistance/agents/ContextSelectionAgent.ts

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as Root from '../../../core/root/root.js';
@@ -12,12 +11,11 @@ import * as Logs from '../../logs/logs.js';
 import * as NetworkTimeCalculator from '../../network_time_calculator/network_time_calculator.js';
 import type * as Trace from '../../trace/trace.js';
 import * as Workspace from '../../workspace/workspace.js';
-import {isOpaqueOrigin} from '../AiOrigins.js';
 import {AccessibilityContext} from '../contexts/AccessibilityContext.js';
 import {DOMNodeContext} from '../contexts/DOMNodeContext.js';
 import {FileContext} from '../contexts/FileContext.js';
 import {PerformanceTraceContext} from '../contexts/PerformanceTraceContext.js';
-import {getRequestContextOrigin, RequestContext} from '../contexts/RequestContext.js';
+import {RequestContext} from '../contexts/RequestContext.js';
 import {StorageContext} from '../contexts/StorageContext.js';
 import {formatBytesToKb, seconds} from '../data_formatters/UnitFormatters.js';
 import {debugLog} from '../debug.js';
@@ -149,16 +147,16 @@ export class ContextSelectionAgent extends AiAgent<never> {
           };
         }
         const origin = allowedOriginResult.origin;
-        if (origin && isOpaqueOrigin(origin)) {
+        if (origin?.isOpaque()) {
           return {
             error: 'No requests recorded by DevTools',
           };
         }
 
+        const allowedSecurityOrigin = origin ?? null;
         let hasCrossOriginRequest = false;
         const requestsToShow: NetworkRequest[] = [];
         for (const request of this.#networkLog.requests()) {
-          const requestOrigin = getRequestContextOrigin(request);
           /**
            * NOTE: this origin check does not ensure that all the requests are
            * from the same origin as the target page. Instead, it ensures that
@@ -167,7 +165,7 @@ export class ContextSelectionAgent extends AiAgent<never> {
            * during the loading of the target page, and do not leak URLs from
            * other pages.
            */
-          if (origin && requestOrigin !== origin) {
+          if (allowedSecurityOrigin && !request.initiatorSecurityOrigin().isSameOriginWith(allowedSecurityOrigin)) {
             hasCrossOriginRequest = true;
             continue;
           }
@@ -185,7 +183,7 @@ export class ContextSelectionAgent extends AiAgent<never> {
         if (requests.length === 0) {
           return {
             error: hasCrossOriginRequest ?
-                `No requests showing with origin ${origin}. Tell the user to start a new chat` :
+                `No requests showing with origin ${origin?.siteId() ?? ''}. Tell the user to start a new chat` :
                 'No requests recorded by DevTools',
           };
         }
@@ -232,18 +230,18 @@ export class ContextSelectionAgent extends AiAgent<never> {
           };
         }
         const origin = allowedOriginResult.origin;
-        if (origin && isOpaqueOrigin(origin)) {
+        if (origin?.isOpaque()) {
           return {
             error: 'No request found',
           };
         }
+        const allowedSecurityOrigin = origin ?? null;
         const request = this.#networkLog.requests().find(req => {
           if (req.requestId() !== id) {
             return false;
           }
 
-          const requestOrigin = getRequestContextOrigin(req);
-          return !origin || requestOrigin === origin;
+          return !allowedSecurityOrigin || req.initiatorSecurityOrigin().isSameOriginWith(allowedSecurityOrigin);
         });
 
         if (request) {
@@ -293,10 +291,9 @@ export class ContextSelectionAgent extends AiAgent<never> {
         const files: Array<{file: string, id: number | undefined}> = [];
         const uiSourceCodes: Workspace.UISourceCode.UISourceCode[] = [];
         for (const file of ContextSelectionAgent.getUISourceCodes(this.#workspace)) {
-          const fileUrl = file.url();
-          const fileOrigin = Common.ParsedURL.ParsedURL.extractOrigin(fileUrl);
+          const fileSecurityOrigin = FileContext.originForUISourceCode(file);
 
-          if (origin && fileOrigin !== origin) {
+          if (origin && !fileSecurityOrigin.isSameOriginWith(origin)) {
             continue;
           }
 
@@ -354,9 +351,8 @@ export class ContextSelectionAgent extends AiAgent<never> {
           if (ContextSelectionAgent.uiSourceCodeId.get(file) !== params.id) {
             return false;
           }
-          const fileUrl = file.url();
-          const fileOrigin = Common.ParsedURL.ParsedURL.extractOrigin(fileUrl);
-          return !origin || fileOrigin === origin;
+          const fileSecurityOrigin = FileContext.originForUISourceCode(file);
+          return !origin || fileSecurityOrigin.isSameOriginWith(origin);
         });
 
         if (!file) {
@@ -534,7 +530,7 @@ export class ContextSelectionAgent extends AiAgent<never> {
           }
 
           return {
-            context: new StorageContext(new StorageItem(origin, origin)),
+            context: new StorageContext(new StorageItem(origin.siteId(), origin.siteId())),
             description: 'User selected page storage',
           };
         },

package/front_end/models/ai_assistance/agents/PerformanceAgent.ts

@@ -12,7 +12,6 @@ import * as TextUtils from '../../../core/text_utils/text_utils.js';
 import * as Tracing from '../../../services/tracing/tracing.js';
 import * as Logs from '../../logs/logs.js';
 import * as Trace from '../../trace/trace.js';
-import {canResourceContentsBeReadForTrace} from '../AiOrigins.js';
 import type {MainThreadSectionLabel, PerformanceTraceContext} from '../contexts/PerformanceTraceContext.js';
 import {
   PerformanceInsightFormatter,
@@ -1053,6 +1052,10 @@ export class PerformanceAgent extends AiAgent<AgentFocus> {
           return {error: 'Missing arg: column'};
         }
 
+        if (!context.canAccessResource(args.scriptUrl)) {
+          return {error: 'Resource not found'};
+        }
+
         if (!this.#formatter) {
           throw new Error('missing formatter');
         }
@@ -1115,8 +1118,7 @@ export class PerformanceAgent extends AiAgent<AgentFocus> {
         }
 
         const url = args.url;
-        const allowedOrigin = context.getOrigin();
-        if (!canResourceContentsBeReadForTrace(url, allowedOrigin)) {
+        if (!context.canAccessResource(url)) {
           return {error: 'Resource not found'};
         }
 

package/front_end/models/ai_assistance/agents/StorageAgent.ts

@@ -71,16 +71,19 @@ export function isSamePageOrigin(target: SDK.Target.Target|null, context?: Conve
   if (!target || !context) {
     return false;
   }
-  const pageOrigin = Common.ParsedURL.ParsedURL.extractOrigin(target.inspectedURL());
-  return pageOrigin !== '' && context.isOriginAllowed(pageOrigin);
+  const inspectedURL = target.inspectedURL();
+  if (!inspectedURL) {
+    return false;
+  }
+  const pageOrigin = SDK.SecurityOrigin.SecurityOrigin.create(inspectedURL);
+  return !pageOrigin.isOpaque() && context.isOriginAllowed(pageOrigin);
 }
 
 const MAX_TARGET_ORIGINS = 100;
 
 function resolveTargetOrigins(context?: ConversationContext<StorageItem>, origins?: string[]): string[] {
   const primaryOrigin = context?.getOrigin();
-  const primaryString =
-      primaryOrigin instanceof SDK.SecurityOrigin.SecurityOrigin ? primaryOrigin.siteId() : primaryOrigin;
+  const primaryString = primaryOrigin?.siteId();
   const rawList = (origins && origins.length > 0) ? origins : (primaryString ? [primaryString] : []);
   const uniqueOrigins = Array.from(new Set(rawList));
   return uniqueOrigins.slice(0, MAX_TARGET_ORIGINS);
@@ -145,19 +148,21 @@ export class StorageAgent extends AiAgent<StorageItem> {
           return {error: 'No origin available or not allowed.'};
         }
 
-        const origins = new Set<string>();
+        const origins: SDK.SecurityOrigin.SecurityOrigin[] = [];
         for (const frame of SDK.ResourceTreeModel.ResourceTreeModel.frames(this.targetManager)) {
           if (!isSamePageOrigin(frame.resourceTreeModel().target().outermostTarget(), this.context)) {
             continue;
           }
-          const origin = frame.securityOrigin;
-          if (!origin || origins.has(origin)) {
+          const origin = frame.securityOrigin();
+          if (origin.isOpaque()) {
             continue;
           }
-          origins.add(origin);
+          if (!origins.some(existing => existing.isSameOriginWith(origin))) {
+            origins.push(origin);
+          }
         }
 
-        return {result: {origins: Array.from(origins)}};
+        return {result: {origins: origins.map(o => o.siteId())}};
       },
     });
 
@@ -679,8 +684,9 @@ export async function getCookiesForDomain(target: SDK.Target.Target,
 export function findFrameForOrigin(
     context: ConversationContext<StorageItem>|undefined, origin: string,
     targetManager: SDK.TargetManager.TargetManager): SDK.ResourceTreeModel.ResourceTreeFrame|null {
+  const parsedOrigin = SDK.SecurityOrigin.SecurityOrigin.create(origin);
   for (const frame of SDK.ResourceTreeModel.ResourceTreeModel.frames(targetManager)) {
-    if (frame.securityOrigin === origin) {
+    if (frame.securityOrigin().isSameOriginWith(parsedOrigin)) {
       const target = frame.resourceTreeModel().target();
       if (isSamePageOrigin(target.outermostTarget(), context)) {
         return frame;

package/front_end/models/ai_assistance/agents/StylingAgent.ts

@@ -4,7 +4,7 @@
 
 import * as Host from '../../../core/host/host.js';
 import * as Root from '../../../core/root/root.js';
-import * as SDK from '../../../core/sdk/sdk.js';
+import type * as SDK from '../../../core/sdk/sdk.js';
 import {ChangeManager} from '../ChangeManager.js';
 import {ExtensionScope} from '../ExtensionScope.js';
 import {AI_ASSISTANCE_CSS_CLASS_NAME} from '../injected.js';
@@ -155,8 +155,7 @@ export class StylingAgent extends AiAgent<SDK.DOMModel.DOMNode> {
         return await getStylesTool.handler(args, {
           getTarget: () => this.targetManager.primaryPageTarget() ?? context.getItem().domModel().target(),
           getEstablishedOrigin: () => {
-            const origin = context.getOrigin();
-            return origin instanceof SDK.SecurityOrigin.SecurityOrigin ? origin.siteId() : origin;
+            return context.getOrigin();
           },
         });
       },
@@ -177,11 +176,11 @@ export class StylingAgent extends AiAgent<SDK.DOMModel.DOMNode> {
             createExtensionScope: this.#createExtensionScope.bind(this),
             execJs: this.#execJs,
             getExecutionContextNode: () => this.context?.getItem() ?? null,
+            getEstablishedOrigin: () => this.context?.getOrigin(),
           },
           options,
           ),
     });
-
   }
 
   override preambleFeatures(): string[] {

package/front_end/models/ai_assistance/ai_assistance.ts

@@ -12,7 +12,6 @@ import * as StylingAgent from './agents/StylingAgent.js';
 import * as AiAgent2 from './AiAgent2.js';
 import * as AiConversation from './AiConversation.js';
 import * as AiHistoryStorage from './AiHistoryStorage.js';
-import * as AiOrigins from './AiOrigins.js';
 import * as AiSetting from './AiSetting.js';
 import * as AiUtils from './AiUtils.js';
 import * as BuiltInAi from './BuiltInAi.js';
@@ -80,7 +79,6 @@ export {
   AIContext,
   AiConversation,
   AiHistoryStorage,
-  AiOrigins,
   AIQueries,
   AiSetting,
   AiUtils,

package/front_end/models/ai_assistance/contexts/AccessibilityContext.ts

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import * as SDK from '../../../core/sdk/sdk.js';
 import type * as LHModel from '../../lighthouse/lighthouse.js';
 import {
   type AiWidget,
@@ -23,8 +24,16 @@ export class AccessibilityContext extends ConversationContext<LHModel.ReporterTy
     return this.#lh.finalUrl ?? this.#lh.finalDisplayedUrl;
   }
 
-  override getURL(): string {
-    return this.#url();
+  /**
+   * Returns the security origin of the audited page from the Lighthouse report.
+   *
+   * Derives the origin from the report URL (`finalUrl` or `finalDisplayedUrl`).
+   * If the report does not contain a valid URL, returns a unique opaque origin.
+   *
+   * @returns The security origin of the audited page.
+   */
+  override getOrigin(): SDK.SecurityOrigin.SecurityOrigin {
+    return SDK.SecurityOrigin.SecurityOrigin.create(this.#url());
   }
 
   override getItem(): LHModel.ReporterTypes.ReportJSON {

package/front_end/models/ai_assistance/contexts/DOMNodeContext.ts

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 import * as i18n from '../../../core/i18n/i18n.js';
-import type * as SDK from '../../../core/sdk/sdk.js';
+import * as SDK from '../../../core/sdk/sdk.js';
 import {
   type ContextDetail,
   ConversationContext,
@@ -21,19 +21,31 @@ const lockedString = i18n.i18n.lockedString;
 
 export class DOMNodeContext extends ConversationContext<SDK.DOMModel.DOMNode> {
   #node: SDK.DOMModel.DOMNode;
+  #opaqueOrigin?: SDK.SecurityOrigin.SecurityOrigin;
 
   constructor(node: SDK.DOMModel.DOMNode) {
     super();
     this.#node = node;
   }
 
-  override getURL(): string {
+  /**
+   * Returns the security origin of the node's owner document.
+   *
+   * If the node is detached from a document, returns a unique opaque origin to
+   * prevent unauthorized cross-origin access in AI conversations.
+   *
+   * @returns The security origin of the owner document, or a unique opaque origin.
+   */
+  override getOrigin(): SDK.SecurityOrigin.SecurityOrigin {
     const ownerDocument = this.#node.ownerDocument;
     if (!ownerDocument) {
-      // The node is detached from a document.
-      return 'detached';
+      // Detached nodes have no security document; isolate them with a unique opaque origin.
+      if (!this.#opaqueOrigin) {
+        this.#opaqueOrigin = SDK.SecurityOrigin.SecurityOrigin.createUniqueOpaque();
+      }
+      return this.#opaqueOrigin;
     }
-    return ownerDocument.documentURL;
+    return SDK.SecurityOrigin.SecurityOrigin.create(ownerDocument.documentURL);
   }
 
   getItem(): SDK.DOMModel.DOMNode {

package/front_end/models/ai_assistance/contexts/FileContext.ts

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import type * as SDK from '../../../core/sdk/sdk.js';
+import * as SDK from '../../../core/sdk/sdk.js';
 import type * as Bindings from '../../bindings/bindings.js';
 import type * as Workspace from '../../workspace/workspace.js';
 import {type ContextDetail, ConversationContext} from '../agents/AiAgent.js';
@@ -19,13 +19,20 @@ export class FileContext extends ConversationContext<Workspace.UISourceCode.UISo
     this.#debuggerWorkspaceBinding = debuggerWorkspaceBinding;
   }
 
-  override getOrigin(): string|SDK.SecurityOrigin.SecurityOrigin {
-    const fallbackOrigin = super.getOrigin();
-    return this.#file.project()?.securityOrigin?.() ?? fallbackOrigin;
+  /**
+   * Resolves the security origin of a given UISourceCode.
+   * Prefers the project security origin, falling back to the origin of the file URL.
+   */
+  static originForUISourceCode(file: Workspace.UISourceCode.UISourceCode): SDK.SecurityOrigin.SecurityOrigin {
+    return file.project()?.securityOrigin?.() ?? SDK.SecurityOrigin.SecurityOrigin.create(file.url());
   }
 
-  override getURL(): string {
-    return this.#file.url();
+  /**
+   * Returns the security origin of the project containing the file, falling
+   * back to the origin derived from the file URL.
+   */
+  override getOrigin(): SDK.SecurityOrigin.SecurityOrigin {
+    return FileContext.originForUISourceCode(this.#file);
   }
 
   override getItem(): Workspace.UISourceCode.UISourceCode {