chrome-devtools-frontend 1.0.1697595 → 1.0.1698733

package/front_end/models/extensions/ExtensionAPI.ts

@@ -404,6 +404,8 @@ declare global {
     chrome: PublicAPI.Chrome.DevTools.Chrome;
     webInspector?: APIImpl.InspectorExtensionAPI;
   }
+  var injectedExtensionAPI: Window['injectedExtensionAPI'];
+  var buildExtensionAPIInjectedScript: Window['buildExtensionAPIInjectedScript'];
 }
 
 export interface ExtensionDescriptor {
@@ -511,7 +513,7 @@ namespace APIImpl {
   }
 }
 
-self.injectedExtensionAPI = function(
+globalThis.injectedExtensionAPI = function(
     extensionInfo: ExtensionDescriptor, inspectedTabId: string, themeName: string, keysToForward: number[],
     testHook: (extensionServer: APIImpl.ExtensionServerClient, extensionAPI: APIImpl.InspectorExtensionAPI) => unknown,
     injectedScriptId: number, targetWindowForTest?: Window): void {
@@ -1763,22 +1765,22 @@ self.injectedExtensionAPI = function(
   testHook(extensionServer, coreAPI);
 };
 
-self.buildExtensionAPIInjectedScript = function(
+globalThis.buildExtensionAPIInjectedScript = function(
     extensionInfo: {
       startPage: string,
       name: string,
       exposeExperimentalAPIs: boolean,
     },
     inspectedTabId: string, themeName: string, keysToForward: number[],
-    testHook:
-        ((extensionServer: APIImpl.ExtensionServerClient, extensionAPI: APIImpl.InspectorExtensionAPI) => unknown)|
-    undefined): string {
+    testHook: ((extensionServer: APIImpl.ExtensionServerClient, extensionAPI: APIImpl.InspectorExtensionAPI) =>
+                   unknown)|undefined): string {
   const argumentsJSON =
       [extensionInfo, inspectedTabId || null, themeName, keysToForward].map(_ => JSON.stringify(_)).join(',');
   if (!testHook) {
     testHook = (): void => {};
   }
   return '(function(injectedScriptId){ ' +
-      '(' + self.injectedExtensionAPI.toString() + ')(' + argumentsJSON + ',' + testHook + ', injectedScriptId);' +
+      '(' + globalThis.injectedExtensionAPI.toString() + ')(' + argumentsJSON + ',' + testHook +
+      ', injectedScriptId);' +
       '})';
 };

package/front_end/models/extensions/ExtensionEndpoint.ts

@@ -2,29 +2,31 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import type * as Platform from '../../core/platform/platform.js';
+
 interface Response {
   requestId: number;
   result: unknown;
   error: Error|null;
 }
 
-interface Event {
+interface EventMessage {
   event: string;
 }
 
-type Message = MessageEvent<Response|Event>;
-
 export class ExtensionEndpoint {
-  private readonly port: MessagePort;
+  private readonly port: Platform.HostRuntime.WorkerMessagePort;
   private nextRequestId = 0;
   private pendingRequests: Map<number, {
     resolve: (arg: unknown) => void,
     reject: (error: Error) => void,
   }>;
 
-  constructor(port: MessagePort) {
+  constructor(port: Platform.HostRuntime.WorkerMessagePort) {
     this.port = port;
-    this.port.onmessage = this.onResponse.bind(this);
+    this.port.addEventListener('message', (event: unknown) => this.onResponse(event as MessageEvent));
+    (this.port as {start?: () => void}).start?.();
+    (this.port as {unref?: () => void}).unref?.();
     this.pendingRequests = new Map();
   }
 
@@ -44,7 +46,8 @@ export class ExtensionEndpoint {
     this.port.close();
   }
 
-  private onResponse({data}: Message): void {
+  private onResponse(event: MessageEvent): void {
+    const data = event.data as Response | EventMessage;
     if ('event' in data) {
       this.handleEvent(data);
       return;
@@ -63,7 +66,7 @@ export class ExtensionEndpoint {
     }
   }
 
-  protected handleEvent(_event: Event): void {
+  protected handleEvent(_event: EventMessage): void {
     throw new Error('handleEvent is not implemented');
   }
 }

package/front_end/models/extensions/HostUrlPattern.ts

@@ -77,8 +77,9 @@ function parseHostAndPort(pattern: string, scheme: string): {host: string, port:
     asUrl.hostname = asUrl.hostname.substr(0, asUrl.hostname.length - 1);
   }
 
-  // The URL constructor is happy to accept '*', but it gets replaced with %2A
-  if (asUrl.hostname !== '%2A' && asUrl.hostname.includes('%2A')) {
+  // The URL constructor in Chrome replaces '*' with '%2A', whereas Node preserves '*'.
+  const isWildcardHost = asUrl.hostname === '%2A' || asUrl.hostname === '*';
+  if (!isWildcardHost && (asUrl.hostname.includes('%2A') || asUrl.hostname.includes('*'))) {
     return undefined;
   }
 
@@ -93,7 +94,7 @@ function parseHostAndPort(pattern: string, scheme: string): {host: string, port:
     return undefined;
   }
 
-  const host = asUrl.hostname !== '%2A' ? (pattern.startsWith('*.') ? `*.${asUrl.hostname}` : asUrl.hostname) : '*';
+  const host = !isWildcardHost ? (pattern.startsWith('*.') ? `*.${asUrl.hostname}` : asUrl.hostname) : '*';
   return {
     host,
     port,

package/front_end/models/extensions/LanguageExtensionEndpoint.ts

@@ -13,7 +13,7 @@ import {ExtensionEndpoint} from './ExtensionEndpoint.js';
 class LanguageExtensionEndpointImpl extends ExtensionEndpoint {
   private plugin: LanguageExtensionEndpoint;
   #pluginManager: Bindings.DebuggerLanguagePlugins.DebuggerLanguagePluginManager;
-  constructor(plugin: LanguageExtensionEndpoint, port: MessagePort,
+  constructor(plugin: LanguageExtensionEndpoint, port: Platform.HostRuntime.WorkerMessagePort,
               pluginManager: Bindings.DebuggerLanguagePlugins.DebuggerLanguagePluginManager) {
     super(port);
     this.plugin = plugin;
@@ -46,7 +46,8 @@ export class LanguageExtensionEndpoint implements Bindings.DebuggerLanguagePlugi
     // eslint-disable-next-line @typescript-eslint/naming-convention
     symbol_types: string[],
   },
-              port: MessagePort, pluginManager: Bindings.DebuggerLanguagePlugins.DebuggerLanguagePluginManager) {
+              port: Platform.HostRuntime.WorkerMessagePort,
+              pluginManager: Bindings.DebuggerLanguagePlugins.DebuggerLanguagePluginManager) {
     this.name = name;
     this.extensionOrigin = extensionOrigin;
     this.supportedScriptTypes = supportedScriptTypes;

package/front_end/models/extensions/RecorderExtensionEndpoint.ts

@@ -15,7 +15,8 @@ export class RecorderExtensionEndpoint extends ExtensionEndpoint {
   readonly #extensionOrigin: Platform.DevToolsPath.UrlString;
   readonly #recorderPluginManager: RecorderPluginManager;
 
-  constructor(name: string, port: MessagePort, capabilities: PrivateAPI.RecordingExtensionPluginCapability[],
+  constructor(name: string, port: Platform.HostRuntime.WorkerMessagePort,
+              capabilities: PrivateAPI.RecordingExtensionPluginCapability[],
               extensionOrigin: Platform.DevToolsPath.UrlString, recorderPluginManager: RecorderPluginManager,
               mediaType?: string) {
     super(port);

package/front_end/models/formatter/FormatterWorkerPool.ts

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import type * as PlatformApi from '../../core/platform/api/api.js';
 import * as Platform from '../../core/platform/platform.js';
 import * as FormatterActions from '../../entrypoints/formatter_actions/formatter_actions.js';
 
@@ -12,7 +11,7 @@ let formatterWorkerPoolInstance: FormatterWorkerPool|undefined;
 
 export class FormatterWorkerPool {
   private taskQueue: Task[];
-  private workerTasks: Map<PlatformApi.HostRuntime.Worker, Task|null>;
+  private workerTasks: Map<Platform.HostRuntime.Worker, Task|null>;
   private entrypointURL: string;
 
   constructor(entrypointURL?: string) {
@@ -46,7 +45,7 @@ export class FormatterWorkerPool {
     formatterWorkerPoolInstance = undefined;
   }
 
-  private createWorker(): PlatformApi.HostRuntime.Worker {
+  private createWorker(): Platform.HostRuntime.Worker {
     const worker = Platform.HostRuntime.HOST_RUNTIME.createWorker(this.entrypointURL);
     worker.onmessage = this.onWorkerMessage.bind(this, worker);
     worker.onerror = this.onWorkerError.bind(this, worker);
@@ -75,8 +74,7 @@ export class FormatterWorkerPool {
     }
   }
 
-  private onWorkerMessage(worker: PlatformApi.HostRuntime.Worker, event: PlatformApi.HostRuntime.WorkerMessageEvent):
-      void {
+  private onWorkerMessage(worker: Platform.HostRuntime.Worker, event: Platform.HostRuntime.WorkerMessageEvent): void {
     const task = this.workerTasks.get(worker);
     if (!task) {
       return;
@@ -91,7 +89,7 @@ export class FormatterWorkerPool {
     task.callback(event.data ? event.data : null);
   }
 
-  private onWorkerError(worker: PlatformApi.HostRuntime.Worker, event: Event): void {
+  private onWorkerError(worker: Platform.HostRuntime.Worker, event: Event): void {
     console.error(event);
     const task = this.workerTasks.get(worker);
     worker.terminate();

package/front_end/models/heap_snapshot/HeapSnapshotModel.ts

@@ -363,6 +363,61 @@ export interface ObjectInfo {
   retainerCount: number;
 }
 
+export interface ContextAnalysisResult {
+  /** Scopes with dead fields, sorted by their highest-ranked context. */
+  scopes: ScopeAnalysis[];
+  /** Scripts with live contexts that could not be analyzed because they lack embedded scope metadata. */
+  scriptsWithoutScopes: ScriptWithoutScopes[];
+}
+
+export interface ScopeAnalysis {
+  scopeInfoNodeIndex: number;
+  scopeInfoNodeId: number;
+  scriptNodeIndex: number;
+  scriptNodeId: number;
+  scriptName: string;
+  /** Source name of the scope, when available. */
+  scopeName?: string;
+  scopeStart: number;
+  scopeEnd: number;
+  /** Number of context-typed fields in each context belonging to this scope. */
+  contextFieldCount: number;
+  /** Contexts with dead fields, sorted descending by deadFieldsRetainedSizeSum. */
+  contexts: ContextAnalysis[];
+}
+
+export interface ContextAnalysis {
+  contextNodeIndex: number;
+  contextNodeId: number;
+  retainedSize: number;
+  /**
+   * The sum of the retained sizes of values in fields classified as dead.
+   * This is a ranking heuristic, not the number of bytes that would be
+   * reclaimed by clearing the fields.
+   */
+  deadFieldsRetainedSizeSum: number;
+  /** Fields classified as dead in this context, sorted descending by retainedSize. */
+  deadFields: ContextField[];
+}
+
+export interface ContextField {
+  name: string;
+  valueNodeIndex: number;
+  valueNodeId: number;
+  valueName: string;
+  valueType: string;
+  selfSize: number;
+  retainedSize: number;
+}
+
+export interface ScriptWithoutScopes {
+  scriptNodeIndex: number;
+  scriptNodeId: number;
+  scriptName: string;
+  /** Number of live context instances belonging to this script. */
+  contextCount: number;
+}
+
 export interface HeapQueryOptions {
   className?: string;
   propertyName?: string;

package/front_end/models/heap_snapshot/HeapSnapshotProxy.ts

@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 import * as Common from '../../core/common/common.js';
-import type * as PlatformApi from '../../core/platform/api/api.js';
 import * as Platform from '../../core/platform/platform.js';
 
 import type {ChildrenProvider} from './ChildrenProvider.js';
@@ -17,7 +16,7 @@ export class HeapSnapshotWorkerProxy extends Common.ObjectWrapper.ObjectWrapper<
   callbacks: Map<number, (error?: string, result?: unknown) => void> =
       new Map<number, (error?: string, result?: unknown) => void>();
   readonly previousCallbacks: Set<number> = new Set<number>();
-  readonly worker: PlatformApi.HostRuntime.Worker;
+  readonly worker: Platform.HostRuntime.Worker;
   interval?: ReturnType<typeof setInterval>;
   readonly workerUrl?: string;
 
@@ -69,17 +68,18 @@ export class HeapSnapshotWorkerProxy extends Common.ObjectWrapper.ObjectWrapper<
     this.postMessage({callId, disposition: 'evaluateForTest', source: script});
   }
 
-  callFactoryMethod<T extends Object>(
-      callback: null, objectId: string, methodName: string, proxyConstructor: new(...arg1: any[]) => T,
-      transfer: PlatformApi.HostRuntime.WorkerTransferable[], ...methodArguments: any[]): T;
+  callFactoryMethod<T extends Object>(callback: null, objectId: string, methodName: string,
+                                      proxyConstructor: new(...arg1: any[]) => T,
+                                      transfer: Platform.HostRuntime.WorkerTransferable[],
+                                      ...methodArguments: any[]): T;
   callFactoryMethod<T extends Object>(callback: ((error?: string, result?: T) => void), objectId: string,
                                       methodName: string, proxyConstructor: new(...arg1: any[]) => T,
-                                      transfer: PlatformApi.HostRuntime.WorkerTransferable[],
+                                      transfer: Platform.HostRuntime.WorkerTransferable[],
                                       ...methodArguments: any[]): null;
   callFactoryMethod<T extends Object>(callback: ((error?: string, result?: T) => void)|null, objectId: string,
                                       methodName: string, proxyConstructor: new(...arg1: any[]) => T,
-                                      transfer: PlatformApi.HostRuntime.WorkerTransferable[],
-                                      ...methodArguments: any[]): T|null {
+                                      transfer: Platform.HostRuntime.WorkerTransferable[], ...methodArguments: any[]): T
+      |null {
     const callId = this.nextCallId++;
     const newObjectId = this.nextObjectId++;
 
@@ -154,7 +154,7 @@ export class HeapSnapshotWorkerProxy extends Common.ObjectWrapper.ObjectWrapper<
     }
   }
 
-  setupForSecondaryInit(port: PlatformApi.HostRuntime.WorkerMessagePort): Promise<void> {
+  setupForSecondaryInit(port: Platform.HostRuntime.WorkerMessagePort): Promise<void> {
     const callId = this.nextCallId++;
     const done = new Promise<void>((resolve, reject) => {
       this.callbacks.set(callId, error => {
@@ -175,7 +175,7 @@ export class HeapSnapshotWorkerProxy extends Common.ObjectWrapper.ObjectWrapper<
     return done;
   }
 
-  messageReceived(event: PlatformApi.HostRuntime.WorkerMessageEvent): void {
+  messageReceived(event: Platform.HostRuntime.WorkerMessageEvent): void {
     const data = event.data;
     if (data.eventName) {
       if (this.eventHandler) {
@@ -199,7 +199,7 @@ export class HeapSnapshotWorkerProxy extends Common.ObjectWrapper.ObjectWrapper<
     callback(undefined, data.result);
   }
 
-  postMessage(message: unknown, transfer?: PlatformApi.HostRuntime.WorkerTransferable[]): void {
+  postMessage(message: unknown, transfer?: Platform.HostRuntime.WorkerTransferable[]): void {
     this.worker.postMessage(message, transfer);
   }
 }
@@ -231,9 +231,9 @@ export class HeapSnapshotProxyObject {
     return this.worker.callFactoryMethod(null, String(this.objectId), methodName, proxyConstructor, [], ...args);
   }
 
-  callFactoryMethodPromise<T extends Object>(
-      methodName: string, proxyConstructor: new(...arg1: any[]) => T,
-      transfer: PlatformApi.HostRuntime.WorkerTransferable[], ...args: any[]): Promise<T> {
+  callFactoryMethodPromise<T extends Object>(methodName: string, proxyConstructor: new(...arg1: any[]) => T,
+                                             transfer: Platform.HostRuntime.WorkerTransferable[],
+                                             ...args: any[]): Promise<T> {
     return new Promise((resolve, reject) => this.worker.callFactoryMethod((error, result) => {
       if (error) {
         reject(new Error(error));
@@ -348,6 +348,10 @@ export class HeapSnapshotProxy extends HeapSnapshotProxyObject {
     return this.callMethodPromise('getObjectInfo', nodeIndex);
   }
 
+  analyzeContexts(): Promise<HeapSnapshotModel.ContextAnalysisResult> {
+    return this.callMethodPromise('analyzeContexts');
+  }
+
   createEdgesProvider(nodeIndex: number, options?: HeapSnapshotModel.HeapEdgesQueryOptions): HeapSnapshotProviderProxy {
     return this.callFactoryMethod('createEdgesProvider', HeapSnapshotProviderProxy, nodeIndex, options);
   }

package/front_end/models/issues_manager/IssuesManager.ts

@@ -38,6 +38,7 @@ import {SourceFrameIssuesManager} from './SourceFrameIssuesManager.js';
 import {SRIMessageSignatureIssue} from './SRIMessageSignatureIssue.js';
 import {StylesheetLoadingIssue} from './StylesheetLoadingIssue.js';
 import {UnencodedDigestIssue} from './UnencodedDigestIssue.js';
+import {WebInstallIssue} from './WebInstallIssue.js';
 
 export {Events} from './IssuesManagerEvents.js';
 
@@ -149,6 +150,10 @@ const issueCodeHandlers =
             Protocol.Audits.InspectorIssueCode.ConnectionAllowlistIssue,
             ConnectionAllowlistIssue.fromInspectorIssue,
           ],
+          [
+            Protocol.Audits.InspectorIssueCode.WebInstallIssue,
+            WebInstallIssue.fromInspectorIssue,
+          ],
           [
             Protocol.Audits.InspectorIssueCode.PermissionElementIssue,
             PermissionElementIssue.fromInspectorIssue,

package/front_end/models/issues_manager/WebInstallIssue.ts

@@ -0,0 +1,63 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import type * as SDK from '../../core/sdk/sdk.js';
+import * as Protocol from '../../generated/protocol.js';
+
+import {Issue, IssueCategory, IssueKind} from './Issue.js';
+import type {MarkdownIssueDescription} from './MarkdownIssueDescription.js';
+
+export class WebInstallIssue extends Issue<Protocol.Audits.WebInstallIssueDetails> {
+  constructor(issueDetails: Protocol.Audits.WebInstallIssueDetails, issuesModel: SDK.IssuesModel.IssuesModel|null) {
+    super(`${Protocol.Audits.InspectorIssueCode.WebInstallIssue}::${issueDetails.reason}`, issueDetails, issuesModel);
+  }
+
+  override requests(): Protocol.Audits.AffectedRequest[] {
+    const {manifestUrl, reason} = this.details();
+    if (reason === Protocol.Audits.WebInstallIssueReason.NoManifest || !manifestUrl) {
+      return [];
+    }
+    return [{url: manifestUrl}];
+  }
+
+  getCategory(): IssueCategory {
+    return IssueCategory.OTHER;
+  }
+
+  getDescription(): MarkdownIssueDescription|null {
+    switch (this.details().reason) {
+      case Protocol.Audits.WebInstallIssueReason.ManifestParsingOrNetworkError:
+        return {file: 'webInstallManifestParsingOrNetworkError.md', links: []};
+      case Protocol.Audits.WebInstallIssueReason.StartUrlInvalid:
+        return {file: 'webInstallStartUrlInvalid.md', links: []};
+      case Protocol.Audits.WebInstallIssueReason.ManifestMissingNameOrShortName:
+        return {file: 'webInstallManifestMissingNameOrShortName.md', links: []};
+      case Protocol.Audits.WebInstallIssueReason.ManifestMissingId:
+        return {file: 'webInstallManifestMissingId.md', links: []};
+      case Protocol.Audits.WebInstallIssueReason.NoManifest:
+        return {file: 'webInstallNoManifest.md', links: []};
+      default:
+        console.warn('Unknown WebInstallIssueReason:', this.details().reason);
+        return null;
+    }
+  }
+
+  getKind(): IssueKind {
+    return IssueKind.PAGE_ERROR;
+  }
+
+  primaryKey(): string {
+    return JSON.stringify(this.details());
+  }
+
+  static fromInspectorIssue(issuesModel: SDK.IssuesModel.IssuesModel|null,
+                            inspectorIssue: Protocol.Audits.InspectorIssue): WebInstallIssue[] {
+    const details = inspectorIssue.details.webInstallIssueDetails;
+    if (!details) {
+      console.warn('Web install issue without details received.');
+      return [];
+    }
+    return [new WebInstallIssue(details, issuesModel)];
+  }
+}

package/front_end/models/issues_manager/descriptions/webInstallManifestMissingId.md

@@ -0,0 +1,3 @@
+# Manifest does not contain an `id` field
+
+Add an `id` to the manifest. Alternatively, for installs using an explicit manifest URL, provide the computed manifest ID as `manifestId` alongside the manifest URL.

package/front_end/models/issues_manager/descriptions/webInstallManifestMissingNameOrShortName.md

@@ -0,0 +1,3 @@
+# Manifest does not contain a 'name' or 'short_name' field
+
+Add a `name` or `short_name` field to the manifest.

package/front_end/models/issues_manager/descriptions/webInstallManifestParsingOrNetworkError.md

@@ -0,0 +1,3 @@
+# Manifest could not be fetched, is empty, or could not be parsed
+
+Check that the web app manifest can be fetched and that it contains valid, non-empty JSON.

package/front_end/models/issues_manager/descriptions/webInstallNoManifest.md

@@ -0,0 +1,3 @@
+# No manifest detected
+
+Provide a web app manifest for this page.

package/front_end/models/issues_manager/descriptions/webInstallStartUrlInvalid.md

@@ -0,0 +1,3 @@
+# Manifest 'start_url' is not valid
+
+Provide a valid `start_url` in the manifest.

package/front_end/models/issues_manager/issues_manager.ts

@@ -36,6 +36,7 @@ import * as SourceFrameIssuesManager from './SourceFrameIssuesManager.js';
 import * as SRIMessageSignatureIssue from './SRIMessageSignatureIssue.js';
 import * as StylesheetLoadingIssue from './StylesheetLoadingIssue.js';
 import * as UnencodedDigestIssue from './UnencodedDigestIssue.js';
+import * as WebInstallIssue from './WebInstallIssue.js';
 
 export {
   ClientHintIssue,
@@ -72,4 +73,5 @@ export {
   SRIMessageSignatureIssue,
   StylesheetLoadingIssue,
   UnencodedDigestIssue,
+  WebInstallIssue,
 };

package/front_end/models/workspace/UISourceCode.ts

@@ -7,6 +7,7 @@
 import * as Common from '../../core/common/common.js';
 import * as i18n from '../../core/i18n/i18n.js';
 import * as Platform from '../../core/platform/platform.js';
+import * as SDK from '../../core/sdk/sdk.js';
 import * as TextUtils from '../../core/text_utils/text_utils.js';
 
 import {IgnoreListManager} from './IgnoreListManager.js';
@@ -29,6 +30,7 @@ export class UISourceCode extends Common.ObjectWrapper.ObjectWrapper<EventTypes>
     TextUtils.ContentProvider.ContentProvider {
   readonly #origin: Platform.DevToolsPath.UrlString;
   readonly #parentURL: Platform.DevToolsPath.UrlString;
+  #securityOrigin?: SDK.SecurityOrigin.SecurityOrigin;
   #project: Project;
   #url: Platform.DevToolsPath.UrlString;
   #name: string;
@@ -110,6 +112,23 @@ export class UISourceCode extends Common.ObjectWrapper.ObjectWrapper<EventTypes>
     return this.#origin;
   }
 
+  /**
+   * Returns the security origin for this source code.
+   * Prefers the project security origin if available. If the project does not
+   * define a security origin, derives it from the source code's URL and caches
+   * the result until the source code is renamed.
+   */
+  securityOrigin(): SDK.SecurityOrigin.SecurityOrigin {
+    const projectOrigin = this.#project.securityOrigin?.();
+    if (projectOrigin) {
+      return projectOrigin;
+    }
+    if (!this.#securityOrigin) {
+      this.#securityOrigin = SDK.SecurityOrigin.SecurityOrigin.create(this.#url);
+    }
+    return this.#securityOrigin;
+  }
+
   fullDisplayName(): string {
     return this.#project.fullDisplayName(this);
   }
@@ -150,6 +169,7 @@ export class UISourceCode extends Common.ObjectWrapper.ObjectWrapper<EventTypes>
   #updateName(
       name: Platform.DevToolsPath.RawPathString, url: Platform.DevToolsPath.UrlString,
       contentType?: Common.ResourceType.ResourceType): void {
+    this.#securityOrigin = undefined;
     const oldURL = this.#url;
     this.#name = name;
     if (url) {

package/front_end/panels/ai_assistance/AiAssistancePanel.ts

@@ -282,12 +282,10 @@ async function getEmptyStateSuggestions(conversation?: AiAssistanceModel.AiConve
   }
 }
 
-function createV2MarkdownRenderer(conversation?: AiAssistanceModel.AiConversation.AiConversation):
-    AIv2MarkdownRenderer {
-  const options: AIv2MarkdownRendererOptions = {};
-  if (conversation) {
-    options.getEstablishedOrigin = () => conversation.origin;
-  }
+function createV2MarkdownRenderer(conversation: AiAssistanceModel.AiConversation.AiConversation): AIv2MarkdownRenderer {
+  const options: AIv2MarkdownRendererOptions = {
+    getOriginLock: () => conversation.getOriginLock(),
+  };
   const primaryTarget = SDK.TargetManager.TargetManager.instance().primaryPageTarget();
   const domModel = primaryTarget?.model(SDK.DOMModel.DOMModel);
   const resourceTreeModel = primaryTarget?.model(SDK.ResourceTreeModel.ResourceTreeModel);
@@ -337,7 +335,9 @@ function getMarkdownRenderer(conversation?: AiAssistanceModel.AiConversation.AiC
     return new AccessibilityAgentMarkdownRenderer(mainDocumentURL);
   }
 
-  return new MarkdownRendererWithCodeBlock();
+  return new MarkdownRendererWithCodeBlock({
+    getEstablishedOrigin: () => conversation?.origin,
+  });
 }
 
 interface ToolbarViewInput {

package/front_end/panels/ai_assistance/components/AIv2MarkdownRenderer.ts

@@ -21,13 +21,10 @@ export interface AIv2MarkdownRendererOptions {
   mainFrameId?: string;
   mainDocumentURL?: Platform.DevToolsPath.UrlString;
   /**
-   * Retrieves the established origin locked for the active conversation.
+   * Retrieves the origin lock for the active conversation.
    * Required to authorize #file-<id> links and prevent cross-origin file leakage.
-   *
-   * TODO(crbug.com/559522248): Defer renderer instantiation until a conversation
-   * starts so this origin can be passed as a mandatory, non-getter property.
    */
-  getEstablishedOrigin?: () => SDK.SecurityOrigin.SecurityOrigin | undefined;
+  getOriginLock: () => AiAssistanceModel.Tool.OriginLockState;
   lookupTraceEvent?: (key: string) => Trace.Types.Events.Event | null;
 }
 
@@ -45,7 +42,7 @@ type ParsedLink = {
  * the only markdown renderer used by AI assistance.
  */
 export class AIv2MarkdownRenderer extends MarkdownView.MarkdownView.MarkdownInsightRenderer {
-  constructor(private readonly options: AIv2MarkdownRendererOptions = {}) {
+  constructor(private readonly options: AIv2MarkdownRendererOptions) {
     super();
   }
 
@@ -119,10 +116,7 @@ export class AIv2MarkdownRenderer extends MarkdownView.MarkdownView.MarkdownInsi
     }
     if (href.startsWith('#file-')) {
       const fileId = Number(href.substring(6));
-      const origin = this.options.getEstablishedOrigin?.();
-      const file = (origin && Number.isInteger(fileId) && fileId > 0) ?
-          AiAssistanceModel.ListSources.ListSourcesTool.getSourceById(fileId, origin) :
-          undefined;
+      const file = AiAssistanceModel.ListSources.ListSourcesTool.getSourceById(fileId, this.options.getOriginLock());
 
       if (file) {
         return this.#revealableLink(file, file.name());

package/front_end/panels/ai_assistance/components/MarkdownRendererWithCodeBlock.ts

@@ -4,6 +4,7 @@
 
 import * as Common from '../../../core/common/common.js';
 import * as Platform from '../../../core/platform/platform.js';
+import type * as SDK from '../../../core/sdk/sdk.js';
 import * as AiAssistanceModel from '../../../models/ai_assistance/ai_assistance.js';
 import * as Logs from '../../../models/logs/logs.js';
 import type * as Marked from '../../../third_party/marked/marked.js';
@@ -12,7 +13,18 @@ import * as Lit from '../../../ui/lit/lit.js';
 
 const {html} = Lit;
 
+export interface MarkdownRendererWithCodeBlockOptions {
+  /**
+   * Retrieves the established origin locked for the active conversation.
+   * Required to authorize #file-<id> links and prevent cross-origin file leakage.
+   * When omitted or unauthorized, file links safely render as plain inert text.
+   */
+  getEstablishedOrigin?: () => SDK.SecurityOrigin.SecurityOrigin | undefined;
+}
+
 /**
+ * Markdown renderer for AI assistance conversations.
+ *
  * The model returns multiline code blocks in an erroneous way with the language being in new line.
  * This renderer takes that into account and correctly updates the parsed multiline token with the language
  * correctly identified and stripped from the content.
@@ -23,8 +35,13 @@ const {html} = Lit;
  * color: red;
  * }
  * ```
- **/
+ *
+ * Also handles linkifying DevTools internal resource links (#req- and origin-locked #file-).
+ */
 export class MarkdownRendererWithCodeBlock extends MarkdownView.MarkdownView.MarkdownInsightRenderer {
+  constructor(private readonly options: MarkdownRendererWithCodeBlockOptions = {}) {
+    super();
+  }
   #revealableLink(revealable: unknown, label: string): Lit.LitTemplate {
     return html`<devtools-link @click=${(e: Event) => {
       e.preventDefault();
@@ -48,13 +65,16 @@ export class MarkdownRendererWithCodeBlock extends MarkdownView.MarkdownView.Mar
       return html`${fallbackText}`;
     }
     if (href.startsWith('#file-')) {
-      const file = AiAssistanceModel.ContextSelectionAgent.ContextSelectionAgent.getUISourceCodes().find(
-          file => AiAssistanceModel.ContextSelectionAgent.ContextSelectionAgent.uiSourceCodeId.get(file) ===
-              Number(href.substring(6)));
+      const fileId = Number(href.substring(6));
+      const file = AiAssistanceModel.ContextSelectionAgent.ContextSelectionAgent.getSourceById(
+          fileId,
+          this.options.getEstablishedOrigin?.(),
+      );
 
       if (file) {
         return this.#revealableLink(file, file.name());
       }
+      // Fall back to plain text to prevent rendering unauthorized or unverified links.
       return html`${fallbackText}`;
     }
     return null;
@@ -78,7 +98,7 @@ export class MarkdownRendererWithCodeBlock extends MarkdownView.MarkdownView.Mar
 
     if (token.type === 'codespan') {
       // LLM likes outputting the link inside a codespan block.
-      // Remove the codespan and render the link directly
+      // Remove the codespan and render the link directly.
       const matches = token.text.match(/^\[(.*)\]\((.+)\)$/);
       if (matches?.[2]) {
         const link = this.#renderLink(