chrome-devtools-frontend 1.0.1696961 → 1.0.1697595

package/front_end/models/ai_assistance/agents/StylingAgent.ts

@@ -8,7 +8,10 @@ import type * as SDK from '../../../core/sdk/sdk.js';
 import {ChangeManager} from '../ChangeManager.js';
 import {ExtensionScope} from '../ExtensionScope.js';
 import {AI_ASSISTANCE_CSS_CLASS_NAME} from '../injected.js';
-import {ToolName} from '../tools/Tool.js';
+import {
+  type OriginLockState,
+  ToolName,
+} from '../tools/Tool.js';
 import {ToolRegistry} from '../tools/ToolRegistry.js';
 
 import {
@@ -154,8 +157,10 @@ export class StylingAgent extends AiAgent<SDK.DOMModel.DOMNode> {
         }
         return await getStylesTool.handler(args, {
           getTarget: () => this.targetManager.primaryPageTarget() ?? context.getItem().domModel().target(),
-          getEstablishedOrigin: () => {
-            return context.getOrigin();
+          getOriginLock: (): OriginLockState => {
+            // V1 StylingAgent adapts the selected DOM node's security origin to OriginLockState.
+            const origin = context.getOrigin();
+            return origin ? {status: 'ESTABLISHED_ORIGIN', origin} : {status: 'UNINITIALIZED'};
           },
         });
       },
@@ -176,7 +181,11 @@ export class StylingAgent extends AiAgent<SDK.DOMModel.DOMNode> {
             createExtensionScope: this.#createExtensionScope.bind(this),
             execJs: this.#execJs,
             getExecutionContextNode: () => this.context?.getItem() ?? null,
-            getEstablishedOrigin: () => this.context?.getOrigin(),
+            getOriginLock: (): OriginLockState => {
+              // V1 StylingAgent adapts the selected DOM node's security origin to OriginLockState.
+              const origin = this.context?.getOrigin();
+              return origin ? {status: 'ESTABLISHED_ORIGIN', origin} : {status: 'UNINITIALIZED'};
+            },
           },
           options,
           ),

package/front_end/models/ai_assistance/tools/CookieUtils.ts

@@ -6,7 +6,7 @@ import * as SDK from '../../../core/sdk/sdk.js';
 import type * as Protocol from '../../../generated/protocol.js';
 
 import {MAX_TARGET_ORIGINS} from './DOMStorageUtils.js';
-import type {OriginLockCapability} from './Tool.js';
+import {isOriginAllowedByLock, type OriginLockCapability, resolveOriginFromLock} from './Tool.js';
 
 export interface CookieDetails {
   name: string;
@@ -25,14 +25,14 @@ export interface CookieDetails {
 }
 
 /**
- * Resolves and validates target origins against the established context origin and primary page target.
+ * Resolves and validates target origins against the conversation's origin lock state and primary page target.
  *
  * When `requestedOrigins` is empty or omitted, defaults to the established context origin.
  * Rejects opaque origins, mismatches with the primary page origin, and cross-origin targets.
  * Limits results to at most `MAX_TARGET_ORIGINS` unique origins.
  *
  * @param requestedOrigins Optional list of origin URLs to validate.
- * @param context The origin lock capability containing the established origin.
+ * @param context The origin lock capability providing access to the conversation's origin lock state.
  * @param targetManager The target manager used to resolve the primary page target.
  * @returns An object with validated target origins and the primary page target, or an error object.
  */
@@ -44,10 +44,12 @@ export function resolveAllowedTargetOrigins(
   error: string,
 }
 {
-  const establishedOrigin = context.getEstablishedOrigin();
-  if (!establishedOrigin || establishedOrigin.isOpaque()) {
-    return {error: 'No origin available or not allowed.'};
+  const originLock = context.getOriginLock();
+  const originResult = resolveOriginFromLock(originLock);
+  if ('error' in originResult) {
+    return originResult;
   }
+  const establishedOrigin = originResult.origin;
 
   const primaryPageTarget = targetManager.primaryPageTarget();
   if (!primaryPageTarget) {
@@ -55,7 +57,7 @@ export function resolveAllowedTargetOrigins(
   }
 
   const pageOrigin = primaryPageTarget.inspectedSecurityOrigin();
-  if (!pageOrigin.isSameOriginWith(establishedOrigin)) {
+  if (!isOriginAllowedByLock(originLock, pageOrigin)) {
     return {error: 'Page origin does not match allowed origin.'};
   }
 
@@ -65,7 +67,7 @@ export function resolveAllowedTargetOrigins(
       [establishedOrigin];
 
   const validOrigins =
-      candidateOrigins.filter(origin => origin.isSameOriginWith(establishedOrigin)).map(origin => origin.siteId());
+      candidateOrigins.filter(origin => isOriginAllowedByLock(originLock, origin)).map(origin => origin.siteId());
 
   const targetOrigins = Array.from(new Set(validOrigins)).slice(0, MAX_TARGET_ORIGINS);
   if (targetOrigins.length === 0) {

package/front_end/models/ai_assistance/tools/ExecuteJavaScript.ts

@@ -131,7 +131,7 @@ const data = {
       return {error: 'Error: Could not find the context node for execution.'};
     }
 
-    if (!isOriginAllowedByLock(context.getEstablishedOrigin(), executionNode.securityOrigin())) {
+    if (!isOriginAllowedByLock(context.getOriginLock(), executionNode.securityOrigin())) {
       return {error: 'Error: Cannot execute JavaScript on cross-origin target.'};
     }
 

package/front_end/models/ai_assistance/tools/GetElementAccessibilityDetails.ts

@@ -80,8 +80,6 @@ export class GetElementAccessibilityDetailsTool implements
       params: GetElementAccessibilityDetailsArgs,
       context: BaseToolCapability&TargetCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<string>> {
-    const establishedOrigin = context.getEstablishedOrigin();
-
     const target = context.getTarget();
     if (!target) {
       return {error: 'Error: Inspected target not found.'};
@@ -99,7 +97,7 @@ export class GetElementAccessibilityDetailsTool implements
     // Security check: Ensure the element matches the active conversation's origin lock.
     // Because getTarget() returns the primary page target to support resolving elements
     // across frames, origin validation must be enforced directly on the resolved node.
-    if (!isOriginAllowedByLock(establishedOrigin, resolved.securityOrigin())) {
+    if (!isOriginAllowedByLock(context.getOriginLock(), resolved.securityOrigin())) {
       return {error: 'Error: Node does not belong to the current origin.'};
     }
 

package/front_end/models/ai_assistance/tools/GetNetworkRequestDetails.ts

@@ -14,6 +14,7 @@ import {
   type DataTool,
   isOriginAllowedByLock,
   type OriginLockCapability,
+  resolveOriginFromLock,
   type ToolArgs,
   ToolName,
 } from './Tool.js';
@@ -75,9 +76,12 @@ export class GetNetworkRequestDetailsTool implements
       args: GetNetworkRequestDetailsArgs,
       context: BaseToolCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<unknown>> {
-    // A conversation is locked to an origin once the first query is made.
-    // We only allow inspecting requests matching the conversation's established origin.
-    const establishedOrigin = context.getEstablishedOrigin();
+    const originLock = context.getOriginLock();
+    const originResult = resolveOriginFromLock(originLock);
+    if ('error' in originResult) {
+      return originResult;
+    }
+    const establishedOrigin = originResult.origin;
 
     // eslint-disable-next-line @devtools/no-instance-of-migrated-singletons
     const networkLog = this.#networkLog ?? Logs.NetworkLog.NetworkLog.instance();
@@ -87,13 +91,10 @@ export class GetNetworkRequestDetailsTool implements
       }
 
       // If the conversation is locked to an origin, only allow accessing requests from that origin.
-      return isOriginAllowedByLock(establishedOrigin, req.initiatorSecurityOrigin());
+      return isOriginAllowedByLock(originLock, req.initiatorSecurityOrigin());
     });
 
-    // If establishedOrigin is undefined or opaque, isOriginAllowedByLock() fails closed,
-    // so find() will never return a request. We check establishedOrigin here as a defensive
-    // guard and to narrow the type for NetworkRequestFormatter below.
-    if (!establishedOrigin || !request) {
+    if (!request) {
       return {
         error: 'No request found',
       };

package/front_end/models/ai_assistance/tools/GetSourceContent.ts

@@ -13,6 +13,7 @@ import {
   type DataHandlerResult,
   type DataTool,
   type OriginLockCapability,
+  resolveOriginFromLock,
   type ToolArgs,
   ToolName,
 } from './Tool.js';
@@ -64,14 +65,12 @@ export class GetSourceContentTool implements
       args: GetSourceContentArgs,
       context: BaseToolCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<{content: string}>> {
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin) {
-      return {
-        error: 'Unable to find file.',
-      };
+    const originResult = resolveOriginFromLock(context.getOriginLock());
+    if ('error' in originResult) {
+      return originResult;
     }
 
-    const file = ListSourcesTool.getSourceById(args.id, establishedOrigin);
+    const file = ListSourcesTool.getSourceById(args.id, originResult.origin);
 
     if (!file) {
       return {

package/front_end/models/ai_assistance/tools/GetStorageValues.ts

@@ -8,7 +8,8 @@ import * as Platform from '../../../core/platform/platform.js';
 import * as SDK from '../../../core/sdk/sdk.js';
 import type {FunctionHandlerOptions} from '../agents/AiAgent.js';
 
-import {MAX_TARGET_ORIGINS, resolveDOMStorages} from './DOMStorageUtils.js';
+import {resolveAllowedTargetOrigins} from './CookieUtils.js';
+import {resolveDOMStorages} from './DOMStorageUtils.js';
 import {
   type BaseToolCapability,
   type DataHandlerResult,
@@ -112,31 +113,11 @@ export class GetStorageValuesTool implements DataTool<GetStorageValuesArgs, GetS
 
     // eslint-disable-next-line @devtools/no-instance-of-migrated-singletons
     const targetManager = SDK.TargetManager.TargetManager.instance();
-    const primaryPageTarget = targetManager.primaryPageTarget();
-
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin || establishedOrigin.isOpaque()) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    if (!primaryPageTarget) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    const pageOrigin = primaryPageTarget.inspectedSecurityOrigin();
-    if (!pageOrigin.isSameOriginWith(establishedOrigin)) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    const candidateOrigins: SDK.SecurityOrigin.SecurityOrigin[] = (args.origins && args.origins.length > 0) ?
-        args.origins.map(origin => SDK.SecurityOrigin.SecurityOrigin.create(origin)) :
-        [establishedOrigin];
-    const validOrigins =
-        candidateOrigins.filter(origin => origin.isSameOriginWith(establishedOrigin)).map(origin => origin.siteId());
-    const targetOrigins = Array.from(new Set(validOrigins)).slice(0, MAX_TARGET_ORIGINS);
-    if (targetOrigins.length === 0) {
-      return {error: 'No valid origins found.'};
+    const targetOriginsResult = resolveAllowedTargetOrigins(args.origins, context, targetManager);
+    if ('error' in targetOriginsResult) {
+      return {error: targetOriginsResult.error};
     }
+    const {targetOrigins, primaryPageTarget} = targetOriginsResult;
 
     const storageKey = (targetOrigins.length === 1 && args.storageKey) ? args.storageKey : undefined;
 

package/front_end/models/ai_assistance/tools/GetStyles.ts

@@ -97,8 +97,6 @@ export class GetStylesTool implements
       return {error: 'Error: Could not find the inspected page.'};
     }
 
-    const establishedOrigin = context.getEstablishedOrigin();
-
     for (const uid of params.elements) {
       result[uid] = {computed: {}, authored: {}};
       const node = new SDK.DOMModel.DeferredDOMNode(target, uid as Protocol.DOM.BackendNodeId);
@@ -109,7 +107,7 @@ export class GetStylesTool implements
       // Security check: Ensure the resolved element belongs to the locked origin.
       // Because getTarget() returns the primary page target to support resolving elements
       // across frames, origin validation must be enforced directly on the resolved node.
-      if (!isOriginAllowedByLock(establishedOrigin, resolved.securityOrigin())) {
+      if (!isOriginAllowedByLock(context.getOriginLock(), resolved.securityOrigin())) {
         return {error: 'Error: Node does not belong to the current origin.'};
       }
       const styles = await resolved.domModel().cssModel().getComputedStyle(resolved.id);

package/front_end/models/ai_assistance/tools/ListNetworkRequests.ts

@@ -14,6 +14,7 @@ import {
   type DataTool,
   isOriginAllowedByLock,
   type OriginLockCapability,
+  resolveOriginFromLock,
   ToolName,
 } from './Tool.js';
 
@@ -76,12 +77,12 @@ export class ListNetworkRequestsTool implements
     const requests: NetworkRequestSummary[] = [];
     // A conversation is locked to an origin once the first query is made.
     // We only allow inspecting requests matching the conversation's established origin.
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin || establishedOrigin.isOpaque()) {
-      return {
-        error: 'Opaque origin not allowed',
-      };
+    const originLock = context.getOriginLock();
+    const originResult = resolveOriginFromLock(originLock);
+    if ('error' in originResult) {
+      return originResult;
     }
+    const establishedOrigin = originResult.origin;
 
     // eslint-disable-next-line @devtools/no-instance-of-migrated-singletons
     const networkLog = this.#networkLog ?? Logs.NetworkLog.NetworkLog.instance();
@@ -89,7 +90,7 @@ export class ListNetworkRequestsTool implements
     const requestsToShow: SDK.NetworkRequest.NetworkRequest[] = [];
     for (const request of networkLog.requests()) {
       // If the request's initiator origin does not match the locked origin, skip it.
-      if (!isOriginAllowedByLock(establishedOrigin, request.initiatorSecurityOrigin())) {
+      if (!isOriginAllowedByLock(originLock, request.initiatorSecurityOrigin())) {
         hasCrossOriginRequest = true;
         continue;
       }

package/front_end/models/ai_assistance/tools/ListPageOrigins.ts

@@ -10,7 +10,9 @@ import {
   type BaseToolCapability,
   type DataHandlerResult,
   type DataTool,
+  isOriginAllowedByLock,
   type OriginLockCapability,
+  resolveOriginFromLock,
   ToolName,
 } from './Tool.js';
 
@@ -57,14 +59,15 @@ export class ListPageOriginsTool implements
     const targetManager = SDK.TargetManager.TargetManager.instance();
     const primaryPageTarget = targetManager.primaryPageTarget();
 
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin || establishedOrigin.isOpaque()) {
-      return {error: 'No origin available or not allowed.'};
+    const originLock = context.getOriginLock();
+    const originResult = resolveOriginFromLock(originLock);
+    if ('error' in originResult) {
+      return originResult;
     }
 
     const pageOrigin =
         primaryPageTarget ? SDK.SecurityOrigin.SecurityOrigin.create(primaryPageTarget.inspectedURL()) : null;
-    if (!pageOrigin || !pageOrigin.isSameOriginWith(establishedOrigin)) {
+    if (!pageOrigin || !isOriginAllowedByLock(originLock, pageOrigin)) {
       return {error: 'No origin available or not allowed.'};
     }
 
@@ -77,7 +80,7 @@ export class ListPageOriginsTool implements
       // Filter out frames that are not same-origin to the page's allowed origin.
       // Under site isolation, frames can be hosted on different targets/processes,
       // so we check the security origin of the frame directly instead of the target.
-      if (!frameOrigin.isSameOriginWith(establishedOrigin)) {
+      if (!isOriginAllowedByLock(originLock, frameOrigin)) {
         continue;
       }
       if (!origins.some(existing => existing.isSameOriginWith(frameOrigin))) {

package/front_end/models/ai_assistance/tools/ListSources.ts

@@ -14,6 +14,8 @@ import {
   type DataTool,
   isOriginAllowedByLock,
   type OriginLockCapability,
+  type OriginLockState,
+  resolveOriginFromLock,
   ToolName,
 } from './Tool.js';
 
@@ -75,8 +77,9 @@ export class ListSourcesTool implements
       }
     }
 
+    const originLock: OriginLockState = {status: 'ESTABLISHED_ORIGIN', origin: establishedOrigin};
     return [...uiSourceCodes.values()].filter(
-        file => isOriginAllowedByLock(establishedOrigin, FileContext.originForUISourceCode(file)));
+        file => isOriginAllowedByLock(originLock, FileContext.originForUISourceCode(file)));
   }
 
   static getSourceById(
@@ -85,9 +88,6 @@ export class ListSourcesTool implements
       // eslint-disable-next-line @devtools/no-instance-of-migrated-singletons
       workspace: Workspace.Workspace.WorkspaceImpl = Workspace.Workspace.WorkspaceImpl.instance(),
       ): Workspace.UISourceCode.UISourceCode|undefined {
-    if (establishedOrigin.isOpaque()) {
-      return undefined;
-    }
     return ListSourcesTool.getUISourceCodes(establishedOrigin, workspace)
         .find(file => ListSourcesTool.uiSourceCodeId.get(file) === id);
   }
@@ -114,14 +114,12 @@ export class ListSourcesTool implements
       _params: Record<string, never>,
       context: BaseToolCapability&OriginLockCapability,
       ): Promise<DataHandlerResult<{files: SourceSummary[]}>> {
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin || establishedOrigin.isOpaque()) {
-      return {
-        error: 'Opaque origin not allowed',
-      };
+    const originResult = resolveOriginFromLock(context.getOriginLock());
+    if ('error' in originResult) {
+      return originResult;
     }
 
-    const files = ListSourcesTool.getUISourceCodes(establishedOrigin);
+    const files = ListSourcesTool.getUISourceCodes(originResult.origin);
 
     return {
       result: {

package/front_end/models/ai_assistance/tools/ListStorageKeys.ts

@@ -7,7 +7,8 @@ import * as i18n from '../../../core/i18n/i18n.js';
 import * as Platform from '../../../core/platform/platform.js';
 import * as SDK from '../../../core/sdk/sdk.js';
 
-import {MAX_TARGET_ORIGINS, resolveDOMStorages} from './DOMStorageUtils.js';
+import {resolveAllowedTargetOrigins} from './CookieUtils.js';
+import {resolveDOMStorages} from './DOMStorageUtils.js';
 import {
   type BaseToolCapability,
   type DataHandlerResult,
@@ -98,31 +99,11 @@ export class ListStorageKeysTool implements DataTool<ListStorageKeysArgs, ListSt
 
     // eslint-disable-next-line @devtools/no-instance-of-migrated-singletons
     const targetManager = SDK.TargetManager.TargetManager.instance();
-    const primaryPageTarget = targetManager.primaryPageTarget();
-
-    const establishedOrigin = context.getEstablishedOrigin();
-    if (!establishedOrigin || establishedOrigin.isOpaque()) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    if (!primaryPageTarget) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    const pageOrigin = primaryPageTarget.inspectedSecurityOrigin();
-    if (!pageOrigin.isSameOriginWith(establishedOrigin)) {
-      return {error: 'No origin available or not allowed.'};
-    }
-
-    const candidateOrigins: SDK.SecurityOrigin.SecurityOrigin[] = (args.origins && args.origins.length > 0) ?
-        args.origins.map(origin => SDK.SecurityOrigin.SecurityOrigin.create(origin)) :
-        [establishedOrigin];
-    const validOrigins =
-        candidateOrigins.filter(origin => origin.isSameOriginWith(establishedOrigin)).map(origin => origin.siteId());
-    const targetOrigins = Array.from(new Set(validOrigins)).slice(0, MAX_TARGET_ORIGINS);
-    if (targetOrigins.length === 0) {
-      return {error: 'No valid origins found.'};
+    const targetOriginsResult = resolveAllowedTargetOrigins(args.origins, context, targetManager);
+    if ('error' in targetOriginsResult) {
+      return {error: targetOriginsResult.error};
     }
+    const {targetOrigins, primaryPageTarget} = targetOriginsResult;
 
     const storageKey = (targetOrigins.length === 1 && args.storageKey) ? args.storageKey : undefined;
     const storageKeysByOrigin: ListStorageKeysResult['storageKeysByOrigin'] = {};

package/front_end/models/ai_assistance/tools/README.md

@@ -16,10 +16,12 @@ Instead of passing a monolithic "grab-bag" context object to all tool handlers,
 - `BaseToolCapability`: Base interface providing access to the top-level conversation context step.
 - `PageExecutionCapability`: For tools executing JavaScript code on the inspected page.
 - `StyleMutationCapability`: For tools managing and applying style mutations via a `ChangeManager`.
-- `OriginLockCapability`: Enforces origin boundaries for tools that access inspected page state or resources. Tools verify targets against the established origin before reading data to prevent unauthorized cross-origin access.
-  - For DOM nodes and source files: wrap the target in a context helper (such as `DOMNodeContext` or `FileContext`) and call `isOriginAllowed(establishedOrigin)`.
+- `OriginLockCapability`: Enforces origin boundaries for tools that access inspected page state or resources via `getOriginLock(): OriginLockState` (`ESTABLISHED_ORIGIN`, `BLOCKED_BY_NAVIGATION`, or `UNINITIALIZED`).
+  - Tools check for `BLOCKED_BY_NAVIGATION` (cross-origin navigation during the run) and `UNINITIALIZED` (no lock established yet) states and return appropriate errors.
+  - For DOM nodes, source files, and execution contexts: validate target origins using `isOriginAllowedByLock(originLock, targetOrigin)`.
   - For cookies and DOM storage: validate target origins using `resolveAllowedTargetOrigins()`.
-  - For network requests: compare `request.initiatorSecurityOrigin()` to the established origin.
+  - For network requests: compare request initiators using `isOriginAllowedByLock(originLock, request.initiatorSecurityOrigin())`.
+  - Transition from legacy V1: Tools no longer inspect context wrappers (such as `DOMNodeContext.isOriginAllowed()`). Tools validate `SecurityOrigin` instances directly against `OriginLockState`. Legacy V1 agents provide an adapter callback in their tool invocation contexts to satisfy `OriginLockCapability`.
 
 ### Unified Context
 

package/front_end/models/ai_assistance/tools/ResolveDevtoolsNodePath.ts

@@ -108,10 +108,9 @@ export class ResolveDevtoolsNodePathTool implements DataTool<ResolveDevtoolsNode
       return {error: 'Error: Could not retrieve resolved node.'};
     }
 
-    const establishedOrigin = context.getEstablishedOrigin();
     // Security check: Ensure the resolved node belongs to the same origin
     // that this AI assistance session is locked to, preventing cross-origin access.
-    if (!isOriginAllowedByLock(establishedOrigin, node.securityOrigin())) {
+    if (!isOriginAllowedByLock(context.getOriginLock(), node.securityOrigin())) {
       return {error: 'Error: Node does not belong to the current origin.'};
     }
 

package/front_end/models/ai_assistance/tools/Tool.ts

@@ -113,43 +113,81 @@ export interface TargetCapability {
    * so tools can resolve DOM nodes and frame hierarchies across frames.
    *
    * Tools that consume this target must independently validate the security origin of
-   * any resolved entities (e.g. via `node.securityOrigin()`) against `getEstablishedOrigin()`.
+   * any resolved entities (e.g. via `node.securityOrigin()`) against `getOriginLock()`.
    */
   getTarget(): SDK.Target.Target|null;
 }
 
+/**
+ * Origin-locking state for AI Assistance:
+ * - `ESTABLISHED_ORIGIN`: The conversation is bound to a specific origin. Operations are
+ *   limited to this origin.
+ * - `BLOCKED_BY_NAVIGATION`: An unapproved cross-origin navigation occurred during the
+ *   active run. Origin-restricted operations are blocked and must return an error.
+ * - `UNINITIALIZED`: No origin lock has been established yet. Operations requiring a locked
+ *   origin must return an error.
+ */
+export type OriginLockState = {
+  status: 'ESTABLISHED_ORIGIN',
+  origin: SDK.SecurityOrigin.SecurityOrigin,
+}|{
+  status: 'BLOCKED_BY_NAVIGATION',
+}|{
+  status: 'UNINITIALIZED',
+};
+
 /**
  * Capability for tools that enforce conversation origin boundaries.
  */
 export interface OriginLockCapability {
   /**
-   * Returns the security origin locked for the current conversation.
-   *
-   * TODO: When V1 agents (StylingAgent, AccessibilityAgent) are removed,
-   * simplify getEstablishedOrigin() to return SDK.SecurityOrigin.SecurityOrigin
-   * non-optionally.
-   *
-   * @returns The established {@link SDK.SecurityOrigin.SecurityOrigin}, or `undefined`
-   * if the conversation is not yet locked to an origin (e.g. before the first query).
+   * Returns the current origin-locking state for the active conversation.
    */
-  getEstablishedOrigin(): SDK.SecurityOrigin.SecurityOrigin|undefined;
+  getOriginLock(): OriginLockState;
 }
 
 /**
  * Checks whether a target origin matches the established conversation origin lock.
- * Fails closed (returns false) if established origin is missing/opaque or target is cross-origin.
+ * Returns `false` if the lock is not established, either origin is opaque, or the
+ * target origin does not match the established origin.
  */
 export function isOriginAllowedByLock(
-    establishedOrigin: SDK.SecurityOrigin.SecurityOrigin|undefined,
+    originLock: OriginLockState,
     targetOrigin: SDK.SecurityOrigin.SecurityOrigin|null|undefined,
     ): boolean {
-  if (!establishedOrigin || establishedOrigin.isOpaque()) {
+  if (originLock.status !== 'ESTABLISHED_ORIGIN') {
+    return false;
+  }
+  if (originLock.origin.isOpaque()) {
     return false;
   }
   if (!targetOrigin || targetOrigin.isOpaque()) {
     return false;
   }
-  return targetOrigin.isSameOriginWith(establishedOrigin);
+  return targetOrigin.isSameOriginWith(originLock.origin);
+}
+
+/**
+ * Resolves the conversation's established origin from the origin lock state.
+ * Returns an error object if origin access is blocked by navigation, the lock
+ * is uninitialized, or the established origin is opaque.
+ */
+export function resolveOriginFromLock(
+    originLock: OriginLockState,
+    ): {origin: SDK.SecurityOrigin.SecurityOrigin}|{
+  error: string,
+}
+{
+  if (originLock.status === 'BLOCKED_BY_NAVIGATION') {
+    return {error: 'Cross-origin access blocked due to navigation.'};
+  }
+  if (originLock.status === 'UNINITIALIZED') {
+    return {error: 'No origin established for this conversation.'};
+  }
+  if (originLock.origin.isOpaque()) {
+    return {error: 'No origin available or not allowed.'};
+  }
+  return {origin: originLock.origin};
 }
 
 /**

package/front_end/models/change_tracker/ChangeTracker.ts

@@ -0,0 +1,89 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as Root from '../../core/root/root.js';
+import type * as CommentManager from '../comment_manager/comment_manager.js';
+
+export type ChangeRecord = CommentManager.CommentManager.ChangeRecord;
+
+export const MAX_RECORDS = 1000;
+
+export class ChangeTracker {
+  readonly #records = new Map<string, ChangeRecord>();
+  readonly #commentManager: CommentManager.CommentManager.CommentManager;
+  readonly #maxRecords: number;
+  #lastRecord?: ChangeRecord;
+
+  constructor(commentManager: CommentManager.CommentManager.CommentManager, maxRecords: number = MAX_RECORDS) {
+    this.#commentManager = commentManager;
+    this.#maxRecords = Math.max(1, maxRecords);
+  }
+
+  get maxRecords(): number {
+    return this.#maxRecords;
+  }
+
+  get isTracking(): boolean {
+    return Boolean(Root.Runtime.hostConfig.devToolsComments?.enabled);
+  }
+
+  trackChange(
+      description: string,
+      anchor: CommentManager.CommentManager.CommentAnchorSignature,
+      ): ChangeRecord|null {
+    if (!this.isTracking) {
+      return null;
+    }
+    const record: ChangeRecord = {
+      id: crypto.randomUUID(),
+      description,
+      timestamp: Date.now(),
+    };
+    while (this.#records.size >= this.#maxRecords) {
+      this.#evictOldestRecord();
+    }
+
+    const thread = this.#commentManager.createCommentThread(anchor, undefined, undefined, [record]);
+    this.#records.set(thread.id, record);
+    this.#lastRecord = record;
+    return record;
+  }
+
+  #evictOldestRecord(): void {
+    // Delete the oldest record for which the comment thread has no user comments.
+    // If all comment threads have user comments, delete the oldest record.
+    for (const threadId of this.#records.keys()) {
+      const thread = this.#commentManager.getCommentThread(threadId);
+      if (!thread || thread.comments.length === 0) {
+        this.#commentManager.removeCommentThread(threadId);
+        this.#records.delete(threadId);
+        return;
+      }
+    }
+
+    const oldestThreadId = this.#records.keys().next().value;
+    if (oldestThreadId) {
+      this.#records.delete(oldestThreadId);
+    }
+  }
+
+  getChanges(): ChangeRecord[] {
+    return Array.from(this.#records.values());
+  }
+
+  getLastChange(): ChangeRecord|undefined {
+    return this.#lastRecord;
+  }
+
+  clear(): void {
+    for (const threadId of this.#records.keys()) {
+      const thread = this.#commentManager.getCommentThread(threadId);
+      if (!thread || thread.comments.length === 0) {
+        this.#commentManager.removeCommentThread(threadId);
+      }
+    }
+    this.#records.clear();
+    this.#lastRecord = undefined;
+  }
+}

package/front_end/models/change_tracker/change_tracker.ts

@@ -0,0 +1,9 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ChangeTracker from './ChangeTracker.js';
+
+export {
+  ChangeTracker,
+};