chrome-devtools-frontend 1.0.1690116 → 1.0.1695017

package/front_end/models/ai_assistance/tools/ExecuteJavaScript.ts

@@ -13,6 +13,8 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
+  type OriginLockCapability,
   type PageExecutionCapability,
   type StyleMutationCapability,
   type ToolArgs,
@@ -30,7 +32,8 @@ export interface ExecuteJavaScriptArgs extends ToolArgs {
 }
 
 export class ExecuteJavaScriptTool implements
-    DataTool<ExecuteJavaScriptArgs, unknown, BaseToolCapability&PageExecutionCapability&StyleMutationCapability> {
+    DataTool<ExecuteJavaScriptArgs, unknown,
+             BaseToolCapability&PageExecutionCapability&StyleMutationCapability&OriginLockCapability> {
   readonly name: ToolName = ToolName.EXECUTE_JAVASCRIPT;
 
   readonly description: string =
@@ -120,7 +123,7 @@ const data = {
 
   async handler(
       params: ExecuteJavaScriptArgs,
-      context: BaseToolCapability&PageExecutionCapability&StyleMutationCapability,
+      context: BaseToolCapability&PageExecutionCapability&StyleMutationCapability&OriginLockCapability,
       options?: FunctionHandlerOptions,
       ): Promise<DataHandlerResult<unknown>> {
     const executionNode = context.getExecutionContextNode();
@@ -128,6 +131,10 @@ const data = {
       return {error: 'Error: Could not find the context node for execution.'};
     }
 
+    if (!isOriginAllowedByLock(context.getEstablishedOrigin(), executionNode.securityOrigin())) {
+      return {error: 'Error: Cannot execute JavaScript on cross-origin target.'};
+    }
+
     if (Root.Runtime.hostConfig.devToolsAiV2Architecture?.enabled) {
       const validationResult = await ExecuteJavaScriptTool.validateAndFormatCode(params.code);
       if (validationResult.error) {

package/front_end/models/ai_assistance/tools/GetCookieValues.ts

@@ -110,7 +110,7 @@ export class GetCookieValuesTool implements DataTool<GetCookieValuesArgs, GetCoo
     const cookiesByOrigin: GetCookieValuesResult['cookiesByOrigin'] = {};
 
     await Promise.all(targetOrigins.map(async origin => {
-      const result = await getCookiesForOrigin(origin, targetManager, primaryPageTarget);
+      const result = await getCookiesForOrigin(origin, primaryPageTarget);
       if ('error' in result) {
         cookiesByOrigin[origin] = {error: result.error};
         return;

package/front_end/models/ai_assistance/tools/GetElementAccessibilityDetails.ts

@@ -12,6 +12,7 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   type TargetCapability,
   type ToolArgs,
@@ -81,7 +82,7 @@ export class GetElementAccessibilityDetailsTool implements
       context: BaseToolCapability&TargetCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<string>> {
     const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin) {
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'Error: Origin lock is not established.'};
     }
 
@@ -101,7 +102,7 @@ export class GetElementAccessibilityDetailsTool implements
 
     const nodeContext = new DOMNodeContext(resolved);
     // Security check: Ensure the element matches the active conversation's origin lock.
-    if (!nodeContext.isOriginAllowed(establishedOrigin)) {
+    if (!isOriginAllowedByLock(establishedOrigin, nodeContext.getOrigin())) {
       return {error: 'Error: Node does not belong to the locked origin.'};
     }
 

package/front_end/models/ai_assistance/tools/GetFunctionCode.ts

@@ -5,7 +5,6 @@
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import type * as Platform from '../../../core/platform/platform.js';
-import {canResourceContentsBeReadForTrace} from '../AiOrigins.js';
 
 import {
   type BaseToolCapability,
@@ -77,7 +76,7 @@ export class GetFunctionCodeTool implements
       return {error: 'Performance trace context is not available.'};
     }
 
-    if (performanceTraceContext.getOrigin().startsWith('imported-trace://')) {
+    if (performanceTraceContext.isImported()) {
       return {error: 'Cannot use this tool on an imported file.'};
     }
 
@@ -85,9 +84,8 @@ export class GetFunctionCodeTool implements
       return {error: 'Missing arg: scriptUrl'};
     }
 
-    const allowedOrigin = performanceTraceContext.getOrigin();
-    if (!canResourceContentsBeReadForTrace(params.scriptUrl, allowedOrigin)) {
-      return {error: 'Script not found'};
+    if (!performanceTraceContext.canAccessResource(params.scriptUrl)) {
+      return {error: 'Resource not found'};
     }
 
     if (params.line === undefined) {

package/front_end/models/ai_assistance/tools/GetInsightDetails.ts

@@ -205,7 +205,7 @@ export class GetInsightDetailsTool implements
     }
 
     const widgets: AiWidget[] = [];
-    const isImportedTrace = performanceTraceContext.getOrigin().startsWith('imported-trace://');
+    const isImportedTrace = performanceTraceContext.isImported();
     if (!isImportedTrace) {
       const domTreeWidget = await this.#generateDOMTreeWidget(insight, insightSet, capabilities.getTarget());
       if (domTreeWidget) {

package/front_end/models/ai_assistance/tools/GetNetworkRequestDetails.ts

@@ -6,14 +6,13 @@ import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as Logs from '../../logs/logs.js';
 import * as NetworkTimeCalculator from '../../network_time_calculator/network_time_calculator.js';
-import {isOpaqueOrigin} from '../AiOrigins.js';
-import {getRequestContextOrigin} from '../contexts/RequestContext.js';
 import {NetworkRequestFormatter} from '../data_formatters/NetworkRequestFormatter.js';
 
 import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   type ToolArgs,
   ToolName,
@@ -78,10 +77,10 @@ export class GetNetworkRequestDetailsTool implements
       ): Promise<DataHandlerResult<unknown>> {
     // A conversation is locked to an origin once the first query is made.
     // We only allow inspecting requests matching the conversation's established origin.
-    const origin = context.getEstablishedOrigin();
+    const establishedOrigin = context.getEstablishedOrigin();
 
     // Opaque origins are never allowed to be used as context.
-    if (origin && isOpaqueOrigin(origin)) {
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {
         error: 'Opaque origin not allowed',
       };
@@ -94,13 +93,8 @@ export class GetNetworkRequestDetailsTool implements
         return false;
       }
 
-      // To prevent cross-origin prompt injection attacks, HAR-imported requests
-      // are assigned a virtual origin (e.g., `imported-har://${domain}`) rather than
-      // sharing the origin of live pages.
-      const requestOrigin = getRequestContextOrigin(req);
-
       // If the conversation is locked to an origin, only allow accessing requests from that origin.
-      return !origin || requestOrigin === origin;
+      return isOriginAllowedByLock(establishedOrigin, req.initiatorSecurityOrigin());
     });
 
     if (!request) {
@@ -110,7 +104,10 @@ export class GetNetworkRequestDetailsTool implements
     }
 
     const calculator = new NetworkTimeCalculator.NetworkTransferTimeCalculator();
-    const formatter = new NetworkRequestFormatter(request, calculator, networkLog);
+    const formatter = new NetworkRequestFormatter(request, calculator, {
+      accessingSecurityOrigin: establishedOrigin,
+      networkLog,
+    });
     const formattedDetails = await formatter.formatNetworkRequest();
 
     return {

package/front_end/models/ai_assistance/tools/GetResourceContent.ts

@@ -8,7 +8,6 @@ import type * as Platform from '../../../core/platform/platform.js';
 import * as Root from '../../../core/root/root.js';
 import * as SDK from '../../../core/sdk/sdk.js';
 import * as TextUtils from '../../../core/text_utils/text_utils.js';
-import {canResourceContentsBeReadForTrace} from '../AiOrigins.js';
 
 import {
   type BaseToolCapability,
@@ -69,12 +68,11 @@ export class GetResourceContentTool implements DataTool<
       return {error: 'Performance trace context is not available.'};
     }
 
-    if (performanceTraceContext.getOrigin().startsWith('imported-trace://')) {
+    if (performanceTraceContext.isImported()) {
       return {error: 'Cannot use this tool on an imported file.'};
     }
 
-    const allowedOrigin = performanceTraceContext.getOrigin();
-    if (!canResourceContentsBeReadForTrace(params.url, allowedOrigin)) {
+    if (!performanceTraceContext.canAccessResource(params.url)) {
       return {error: 'Resource not found'};
     }
 

package/front_end/models/ai_assistance/tools/GetSourceContent.ts

@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as TextUtils from '../../../core/text_utils/text_utils.js';
+import {FileContext} from '../contexts/FileContext.js';
 import {FileFormatter} from '../data_formatters/FileFormatter.js';
 
 import {ListSourcesTool} from './ListSources.js';
@@ -13,6 +13,7 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   type ToolArgs,
   ToolName,
@@ -65,10 +66,10 @@ export class GetSourceContentTool implements
       args: GetSourceContentArgs,
       context: BaseToolCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<{content: string}>> {
-    const origin = context.getEstablishedOrigin();
-    const file = ListSourcesTool.getUISourceCodes().find(
-        f => ListSourcesTool.uiSourceCodeId.get(f) === args.id,
-    );
+    const establishedOrigin = context.getEstablishedOrigin();
+    const file = ListSourcesTool.getUISourceCodes()
+                     .filter(f => isOriginAllowedByLock(establishedOrigin, FileContext.originForUISourceCode(f)))
+                     .find(f => ListSourcesTool.uiSourceCodeId.get(f) === args.id);
 
     if (!file) {
       return {
@@ -76,14 +77,6 @@ export class GetSourceContentTool implements
       };
     }
 
-    const fileUrl = file.url();
-    const fileOrigin = Common.ParsedURL.ParsedURL.extractOrigin(fileUrl);
-    if (origin && fileOrigin !== origin) {
-      return {
-        error: 'Cross-origin access blocked.',
-      };
-    }
-
     const contentData = await file.requestContentData();
     if (TextUtils.ContentData.ContentData.isError(contentData)) {
       return {

package/front_end/models/ai_assistance/tools/GetStorageBreakdown.ts

@@ -78,7 +78,7 @@ export class GetStorageBreakdownTool implements
       primaryPageTarget.storageAgent().invoke_getUsageAndQuota({origin: pageOrigin}),
       calculateDOMStoragesUsage(localStorages),
       calculateDOMStoragesUsage(sessionStorages),
-      getCookiesForOrigin(pageOrigin, targetManager, primaryPageTarget),
+      getCookiesForOrigin(pageOrigin, primaryPageTarget),
     ]);
 
     if (response.getError()) {

package/front_end/models/ai_assistance/tools/GetStorageValues.ts

@@ -2,13 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as Platform from '../../../core/platform/platform.js';
 import * as SDK from '../../../core/sdk/sdk.js';
 import type {FunctionHandlerOptions} from '../agents/AiAgent.js';
-import {areOriginsEquivalent, extractContextOrigin, isOpaqueOrigin} from '../AiOrigins.js';
 
 import {MAX_TARGET_ORIGINS, resolveDOMStorages} from './DOMStorageUtils.js';
 import {
@@ -116,8 +114,8 @@ export class GetStorageValuesTool implements DataTool<GetStorageValuesArgs, GetS
     const targetManager = SDK.TargetManager.TargetManager.instance();
     const primaryPageTarget = targetManager.primaryPageTarget();
 
-    const allowedOrigin = context.getEstablishedOrigin();
-    if (!allowedOrigin || isOpaqueOrigin(allowedOrigin)) {
+    const establishedOrigin = context.getEstablishedOrigin();
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'No origin available or not allowed.'};
     }
 
@@ -125,14 +123,16 @@ export class GetStorageValuesTool implements DataTool<GetStorageValuesArgs, GetS
       return {error: 'No origin available or not allowed.'};
     }
 
-    const pageOrigin = Common.ParsedURL.ParsedURL.extractOrigin(primaryPageTarget.inspectedURL());
-    if (!pageOrigin || !areOriginsEquivalent(pageOrigin, allowedOrigin)) {
+    const pageOrigin = primaryPageTarget.inspectedSecurityOrigin();
+    if (!pageOrigin.isSameOriginWith(establishedOrigin)) {
       return {error: 'No origin available or not allowed.'};
     }
 
-    const rawList = (args.origins && args.origins.length > 0) ? args.origins : [allowedOrigin];
-    const validOrigins = rawList.map(origin => extractContextOrigin(origin))
-                             .filter(origin => areOriginsEquivalent(origin, allowedOrigin));
+    const candidateOrigins: SDK.SecurityOrigin.SecurityOrigin[] = (args.origins && args.origins.length > 0) ?
+        args.origins.map(origin => SDK.SecurityOrigin.SecurityOrigin.create(origin)) :
+        [establishedOrigin];
+    const validOrigins =
+        candidateOrigins.filter(origin => origin.isSameOriginWith(establishedOrigin)).map(origin => origin.siteId());
     const targetOrigins = Array.from(new Set(validOrigins)).slice(0, MAX_TARGET_ORIGINS);
     if (targetOrigins.length === 0) {
       return {error: 'No valid origins found.'};

package/front_end/models/ai_assistance/tools/GetStyles.ts

@@ -12,6 +12,7 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   type TargetCapability,
   type ToolArgs,
@@ -92,7 +93,7 @@ export class GetStylesTool implements
     }
 
     const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin) {
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'Error: Origin lock is not established.'};
     }
 
@@ -104,7 +105,7 @@ export class GetStylesTool implements
         return {error: 'Error: Could not find the element with uid=' + uid};
       }
       const newContext = new DOMNodeContext(resolved);
-      if (!newContext.isOriginAllowed(establishedOrigin)) {
+      if (!isOriginAllowedByLock(establishedOrigin, newContext.getOrigin())) {
         return {error: 'Error: Node does not belong to the current origin.'};
       }
       const styles = await resolved.domModel().cssModel().getComputedStyle(resolved.id);

package/front_end/models/ai_assistance/tools/ListCookies.ts

@@ -78,7 +78,7 @@ export class ListCookiesTool implements
     const cookieNamesByOrigin: ListCookiesResult['cookieNamesByOrigin'] = {};
 
     await Promise.all(targetOrigins.map(async origin => {
-      const result = await getCookiesForOrigin(origin, targetManager, primaryPageTarget);
+      const result = await getCookiesForOrigin(origin, primaryPageTarget);
       if ('error' in result) {
         cookieNamesByOrigin[origin] = {error: result.error};
         return;

package/front_end/models/ai_assistance/tools/ListNetworkRequests.ts

@@ -6,14 +6,13 @@ import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import type * as SDK from '../../../core/sdk/sdk.js';
 import * as Logs from '../../logs/logs.js';
-import {isOpaqueOrigin} from '../AiOrigins.js';
-import {getRequestContextOrigin} from '../contexts/RequestContext.js';
 import {formatBytesToKb, seconds} from '../data_formatters/UnitFormatters.js';
 
 import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   ToolName,
 } from './Tool.js';
@@ -77,10 +76,8 @@ export class ListNetworkRequestsTool implements
     const requests: NetworkRequestSummary[] = [];
     // A conversation is locked to an origin once the first query is made.
     // We only allow inspecting requests matching the conversation's established origin.
-    const origin = context.getEstablishedOrigin();
-
-    // Opaque origins are never allowed to be used as context.
-    if (origin && isOpaqueOrigin(origin)) {
+    const establishedOrigin = context.getEstablishedOrigin();
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {
         error: 'Opaque origin not allowed',
       };
@@ -91,13 +88,8 @@ export class ListNetworkRequestsTool implements
     let hasCrossOriginRequest = false;
     const requestsToShow: SDK.NetworkRequest.NetworkRequest[] = [];
     for (const request of networkLog.requests()) {
-      // To prevent cross-origin prompt injection attacks, HAR-imported requests
-      // are assigned a virtual origin (e.g., `imported-har://${domain}`) rather than
-      // sharing the origin of live pages.
-      const requestOrigin = getRequestContextOrigin(request);
-
-      // If the conversation is locked to an origin, skip requests from other origins.
-      if (origin && requestOrigin !== origin) {
+      // If the request's initiator origin does not match the locked origin, skip it.
+      if (!isOriginAllowedByLock(establishedOrigin, request.initiatorSecurityOrigin())) {
         hasCrossOriginRequest = true;
         continue;
       }
@@ -115,7 +107,7 @@ export class ListNetworkRequestsTool implements
     if (requests.length === 0) {
       if (hasCrossOriginRequest) {
         return {
-          error: `No requests showing with origin ${origin}. Tell the user to start a new chat`,
+          error: `No requests showing with origin ${establishedOrigin.siteId()}. Tell the user to start a new chat`,
         };
       }
       return {

package/front_end/models/ai_assistance/tools/ListPageOrigins.ts

@@ -2,11 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as SDK from '../../../core/sdk/sdk.js';
-import {areOriginsEquivalent, isOpaqueOrigin} from '../AiOrigins.js';
 
 import {
   type BaseToolCapability,
@@ -59,37 +57,34 @@ export class ListPageOriginsTool implements
     const targetManager = SDK.TargetManager.TargetManager.instance();
     const primaryPageTarget = targetManager.primaryPageTarget();
 
-    const allowedOrigin = context.getEstablishedOrigin();
-    if (!allowedOrigin || isOpaqueOrigin(allowedOrigin)) {
+    const establishedOrigin = context.getEstablishedOrigin();
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'No origin available or not allowed.'};
     }
 
     const pageOrigin =
-        primaryPageTarget ? Common.ParsedURL.ParsedURL.extractOrigin(primaryPageTarget.inspectedURL()) : '';
-    const isAllowed = pageOrigin !== '' && areOriginsEquivalent(pageOrigin, allowedOrigin);
-
-    if (!isAllowed) {
+        primaryPageTarget ? SDK.SecurityOrigin.SecurityOrigin.create(primaryPageTarget.inspectedURL()) : null;
+    if (!pageOrigin || !pageOrigin.isSameOriginWith(establishedOrigin)) {
       return {error: 'No origin available or not allowed.'};
     }
 
-    const origins = new Set<string>();
+    const origins: SDK.SecurityOrigin.SecurityOrigin[] = [];
     for (const frame of SDK.ResourceTreeModel.ResourceTreeModel.frames(targetManager)) {
       if (frame.resourceTreeModel().target().outermostTarget() !== primaryPageTarget) {
         continue;
       }
-      const origin = frame.securityOrigin;
+      const frameOrigin = frame.securityOrigin();
       // Filter out frames that are not same-origin to the page's allowed origin.
       // Under site isolation, frames can be hosted on different targets/processes,
       // so we check the security origin of the frame directly instead of the target.
-      if (!origin || !areOriginsEquivalent(origin, allowedOrigin)) {
+      if (!frameOrigin.isSameOriginWith(establishedOrigin)) {
         continue;
       }
-      if (origins.has(origin)) {
-        continue;
+      if (!origins.some(existing => existing.isSameOriginWith(frameOrigin))) {
+        origins.push(frameOrigin);
       }
-      origins.add(origin);
     }
 
-    return {result: {origins: Array.from(origins)}};
+    return {result: {origins: origins.map(o => o.siteId())}};
   }
 }

package/front_end/models/ai_assistance/tools/ListSources.ts

@@ -2,16 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as Workspace from '../../workspace/workspace.js';
-import {isOpaqueOrigin} from '../AiOrigins.js';
+import {FileContext} from '../contexts/FileContext.js';
 
 import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   ToolName,
 } from './Tool.js';
@@ -93,17 +93,15 @@ export class ListSourcesTool implements
       _params: Record<string, never>,
       context: BaseToolCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<{files: SourceSummary[]}>> {
-    const origin = context.getEstablishedOrigin();
-    if (origin && isOpaqueOrigin(origin)) {
+    const establishedOrigin = context.getEstablishedOrigin();
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {
         error: 'Opaque origin not allowed',
       };
     }
 
     const files = ListSourcesTool.getUISourceCodes().filter(file => {
-      const fileUrl = file.url();
-      const fileOrigin = Common.ParsedURL.ParsedURL.extractOrigin(fileUrl);
-      return !origin || fileOrigin === origin;
+      return isOriginAllowedByLock(establishedOrigin, FileContext.originForUISourceCode(file));
     });
 
     return {

package/front_end/models/ai_assistance/tools/ListStorageKeys.ts

@@ -2,12 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import * as Common from '../../../core/common/common.js';
 import * as Host from '../../../core/host/host.js';
 import * as i18n from '../../../core/i18n/i18n.js';
 import * as Platform from '../../../core/platform/platform.js';
 import * as SDK from '../../../core/sdk/sdk.js';
-import {areOriginsEquivalent, extractContextOrigin, isOpaqueOrigin} from '../AiOrigins.js';
 
 import {MAX_TARGET_ORIGINS, resolveDOMStorages} from './DOMStorageUtils.js';
 import {
@@ -102,8 +100,8 @@ export class ListStorageKeysTool implements DataTool<ListStorageKeysArgs, ListSt
     const targetManager = SDK.TargetManager.TargetManager.instance();
     const primaryPageTarget = targetManager.primaryPageTarget();
 
-    const allowedOrigin = context.getEstablishedOrigin();
-    if (!allowedOrigin || isOpaqueOrigin(allowedOrigin)) {
+    const establishedOrigin = context.getEstablishedOrigin();
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'No origin available or not allowed.'};
     }
 
@@ -111,14 +109,16 @@ export class ListStorageKeysTool implements DataTool<ListStorageKeysArgs, ListSt
       return {error: 'No origin available or not allowed.'};
     }
 
-    const pageOrigin = Common.ParsedURL.ParsedURL.extractOrigin(primaryPageTarget.inspectedURL());
-    if (!pageOrigin || !areOriginsEquivalent(pageOrigin, allowedOrigin)) {
+    const pageOrigin = primaryPageTarget.inspectedSecurityOrigin();
+    if (!pageOrigin.isSameOriginWith(establishedOrigin)) {
       return {error: 'No origin available or not allowed.'};
     }
 
-    const rawList = (args.origins && args.origins.length > 0) ? args.origins : [allowedOrigin];
-    const validOrigins = rawList.map(origin => extractContextOrigin(origin))
-                             .filter(origin => areOriginsEquivalent(origin, allowedOrigin));
+    const candidateOrigins: SDK.SecurityOrigin.SecurityOrigin[] = (args.origins && args.origins.length > 0) ?
+        args.origins.map(origin => SDK.SecurityOrigin.SecurityOrigin.create(origin)) :
+        [establishedOrigin];
+    const validOrigins =
+        candidateOrigins.filter(origin => origin.isSameOriginWith(establishedOrigin)).map(origin => origin.siteId());
     const targetOrigins = Array.from(new Set(validOrigins)).slice(0, MAX_TARGET_ORIGINS);
     if (targetOrigins.length === 0) {
       return {error: 'No valid origins found.'};

package/front_end/models/ai_assistance/tools/README.md

@@ -16,8 +16,10 @@ Instead of passing a monolithic "grab-bag" context object to all tool handlers,
 - `BaseToolCapability`: Base interface providing access to the top-level conversation context step.
 - `PageExecutionCapability`: For tools executing JavaScript code on the inspected page.
 - `StyleMutationCapability`: For tools managing and applying style mutations via a `ChangeManager`.
-- `TargetCapability`: For tools requiring access to the page's current SDK `Target`.
-- `OriginLockCapability`: For tools enforcing cross-origin security via origin locks. Tools that fetch resources or state from the inspected page (such as styling or source code) must use this capability to verify that the target resource matches the conversation's established origin. This prevents the LLM from executing tools against out-of-origin elements or documents. Verification should be done by wrapping resolved resources in helper context classes (e.g., `DOMNodeContext`) and calling `isOriginAllowed(establishedOrigin)`.
+- `OriginLockCapability`: Enforces origin boundaries for tools that access inspected page state or resources. Tools verify targets against the established origin before reading data to prevent unauthorized cross-origin access.
+  - For DOM nodes and source files: wrap the target in a context helper (such as `DOMNodeContext` or `FileContext`) and call `isOriginAllowed(establishedOrigin)`.
+  - For cookies and DOM storage: validate target origins using `resolveAllowedTargetOrigins()`.
+  - For network requests: compare `request.initiatorSecurityOrigin()` to the established origin.
 
 ### Unified Context
 

package/front_end/models/ai_assistance/tools/ResolveDevtoolsNodePath.ts

@@ -10,6 +10,7 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
   type TargetCapability,
   type ToolArgs,
@@ -85,7 +86,7 @@ export class ResolveDevtoolsNodePathTool implements DataTool<ResolveDevtoolsNode
       context: BaseToolCapability&TargetCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<{backendNodeId: number}>> {
     const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin) {
+    if (!establishedOrigin || establishedOrigin.isOpaque()) {
       return {error: 'Error: Origin lock is not established.'};
     }
 
@@ -115,7 +116,7 @@ export class ResolveDevtoolsNodePathTool implements DataTool<ResolveDevtoolsNode
     const nodeContext = new DOMNodeContext(node);
     // Security check: Ensure the resolved node belongs to the same origin
     // that this AI assistance session is locked to, preventing cross-origin access.
-    if (!nodeContext.isOriginAllowed(establishedOrigin)) {
+    if (!isOriginAllowedByLock(establishedOrigin, nodeContext.getOrigin())) {
       return {error: 'Error: Node does not belong to the locked origin.'};
     }
 

package/front_end/models/ai_assistance/tools/Tool.ts

@@ -112,13 +112,37 @@ export interface TargetCapability {
 }
 
 /**
- * Capability for tools that need to enforce origin locking for security.
+ * Capability for tools that enforce conversation origin boundaries.
  */
 export interface OriginLockCapability {
   /**
-   * Returns the origin that the current conversation is locked to, if any.
+   * Returns the security origin locked for the current conversation.
+   *
+   * TODO: When V1 agents (StylingAgent, AccessibilityAgent) are removed,
+   * simplify getEstablishedOrigin() to return SDK.SecurityOrigin.SecurityOrigin
+   * non-optionally.
+   *
+   * @returns The established {@link SDK.SecurityOrigin.SecurityOrigin}, or `undefined`
+   * if the conversation is not yet locked to an origin (e.g. before the first query).
    */
-  getEstablishedOrigin(): string|undefined;
+  getEstablishedOrigin(): SDK.SecurityOrigin.SecurityOrigin|undefined;
+}
+
+/**
+ * Checks whether a target origin matches the established conversation origin lock.
+ * Fails closed (returns false) if established origin is missing/opaque or target is cross-origin.
+ */
+export function isOriginAllowedByLock(
+    establishedOrigin: SDK.SecurityOrigin.SecurityOrigin|undefined,
+    targetOrigin: SDK.SecurityOrigin.SecurityOrigin|null|undefined,
+    ): boolean {
+  if (!establishedOrigin || establishedOrigin.isOpaque()) {
+    return false;
+  }
+  if (!targetOrigin || targetOrigin.isOpaque()) {
+    return false;
+  }
+  return targetOrigin.isSameOriginWith(establishedOrigin);
 }
 
 /**