chrome-devtools-frontend 1.0.1702515 → 1.0.1704172

package/AUTHORS

@@ -99,6 +99,7 @@ Ryuhei Shima <shimaryuhei@gmail.com>
 Samuel Maddock <samuelmaddock@electronjs.org>
 Satvic Dhawan <satvicdhawan14@gmail.com>
 Sebastian Markbåge <sebastian@calyptus.eu>
+Semih Dogan <semih702do@gmail.com>
 Serg Kryvonos <sergeikrivonos@gmail.com>
 Sergio Avalos <sergio.avalos@gmail.com>
 Shelley Vohr <shelley.vohr@gmail.com>

package/front_end/core/common/ParsedURL.ts

@@ -46,6 +46,60 @@ export function schemeIs(url: Platform.DevToolsPath.UrlString|URL, scheme: strin
   }
 }
 
+/**
+ * Schemes safe for unprivileged web contexts (matching ChildProcessSecurityPolicyImpl::RegisterDefaultSchemes).
+ */
+const WEB_SAFE_SCHEMES = new Set([
+  'http:',
+  'https:',
+  'ws:',
+  'wss:',
+  'data:',
+]);
+
+/**
+ * Returns true if the URL uses an unprivileged web-safe scheme (or is a `blob:` URL wrapping one).
+ */
+export function hasWebSafeScheme(url: Platform.DevToolsPath.UrlString|URL|string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === 'blob:') {
+      return hasWebSafeScheme(parsed.pathname);
+    }
+    return WEB_SAFE_SCHEMES.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Privileged browser and local schemes that must not be opened via external/new-tab links by default.
+ */
+const PRIVILEGED_SCHEMES = new Set([
+  'chrome:',
+  'chrome-extension:',
+  'chrome-search:',
+  'chrome-untrusted:',
+  'devtools:',
+  'file:',
+  'isolated-app:',
+]);
+
+/**
+ * Returns true if the URL uses a privileged scheme (or is a `blob:` URL wrapping one).
+ */
+export function isPrivilegedScheme(url: Platform.DevToolsPath.UrlString|URL|string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === 'blob:') {
+      return isPrivilegedScheme(parsed.pathname);
+    }
+    return PRIVILEGED_SCHEMES.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * File paths in DevTools that are represented either as unencoded absolute or relative paths, or encoded paths, or URLs.
  * @example
@@ -179,7 +233,11 @@ export class ParsedURL {
         preEncodedPath = 'file:///' + preEncodedPath;
       }
     }
-    return new URL(preEncodedPath).toString() as Platform.DevToolsPath.UrlString;
+    let url = new URL(preEncodedPath).toString();
+    while (url.endsWith('/') && url.length > 'file:///'.length) {
+      url = url.substring(0, url.length - 1);
+    }
+    return url as Platform.DevToolsPath.UrlString;
   }
 
   static relativePathToUrlString(

package/front_end/core/platform/StringUtilities.ts

@@ -740,3 +740,68 @@ export const concatBase64 = function(lhs: string, rhs: string): string {
   const lhsToDecode = lhs.substring(lhs.length - 4);
   return lhsLeaveAsIs + globalThis.btoa(globalThis.atob(lhsToDecode) + globalThis.atob(rhs));
 };
+
+/**
+ * Characters that cause spreadsheet viewers (Excel, Google Sheets, LibreOffice
+ * Calc) to evaluate a cell as a formula rather than rendering it as plain text
+ * when they appear at the start of a cell.
+ */
+const CSV_FORMULA_TRIGGERS = new Set(['=', '+', '-', '@', '\t', '\r']);
+
+/**
+ * Matches plain numeric literals (e.g. `-42`, `+3.14`, `-1e-3`).
+ * Even though negative/signed numbers start with `-` or `+`, spreadsheets parse
+ * them as numbers rather than formulas, so we exempt them from `'` prefixing to
+ * keep numeric columns usable.
+ */
+const CSV_PLAIN_NUMBER = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+
+/**
+ * Returns true if a spreadsheet viewer could interpret `value` as a formula
+ * (for example `=SUM(A1:A2)`, `"- Loading..."`, or `"@alice"`).
+ */
+function isCsvFormula(value: string): boolean {
+  // Check both the raw string and the leading-whitespace-trimmed string, since
+  // some spreadsheet parsers ignore leading spaces before `=`, `+`, `-`, or `@`.
+  const trimmed = value.trimStart();
+  if (!CSV_FORMULA_TRIGGERS.has(value[0]) && !CSV_FORMULA_TRIGGERS.has(trimmed[0])) {
+    return false;
+  }
+  return !CSV_PLAIN_NUMBER.test(trimmed.trimEnd());
+}
+
+/**
+ * Formats and escapes `value` so it can be safely written as a single CSV cell.
+ *
+ * This handles two separate layers of escaping:
+ * 1. Spreadsheet formula escaping (CWE-1236 & viewer fidelity):
+ *    RFC 4180 double-quoting (`"=1+1"` or `"- Loading..."`) only groups text
+ *    into a single CSV column; spreadsheet apps strip the outer `"` and still
+ *    evaluate cells starting with `=`, `+`, `-`, or `@` as formulas (often
+ *    resulting in `#NAME?` errors or unintended formula execution). Prefixing
+ *    the value with a single quote (`'`) tells spreadsheet apps to treat the
+ *    cell as literal text (and they hide the leading `'` when displaying it).
+ *    - Example without commas: `=SUM(A1:A2)` -> `'=SUM(A1:A2)`
+ * 2. RFC 4180 structural CSV quoting:
+ *    If the cell also contains commas (`,`), double quotes (`"`), or newlines,
+ *    it is wrapped in `"..."` (with inner `"` doubled to `""`) so CSV parsers
+ *    do not split the cell across columns or rows.
+ *    - Example with commas: `=SUM(1,2)` -> `"'=SUM(1,2)"`
+ *    - Example starting with a literal quote: `"=SUM(1,2)"` -> `"""=SUM(1,2)"""`
+ *      (not treated as a formula since the first character is `"`, not `=`).
+ */
+export const escapeCsvCell = function(value: string): string {
+  // Step 1: Prefix formula-like text with `'` so spreadsheets render it as literal text.
+  let escaped = isCsvFormula(value) ? `'${value}` : value;
+
+  // Step 2: Apply standard RFC 4180 double-quoting if the cell contains quotes,
+  // commas, or line breaks so the CSV structure stays intact.
+  if (escaped.includes('"')) {
+    escaped = escaped.replace(/"/g, '""');
+    return `"${escaped}"`;
+  }
+  if (escaped.includes(',') || escaped.includes('\n') || escaped.includes('\r')) {
+    return `"${escaped}"`;
+  }
+  return escaped;
+};

package/front_end/core/sdk/CPUThrottlingManager.ts

@@ -282,9 +282,9 @@ export class CPUThrottlingManager extends Common.ObjectWrapper.ObjectWrapper<Eve
   }
 
   async updateHostDefaultCPUPerformanceTier(): Promise<void> {
-    if (this.#manualCPUPerformanceOverride !== undefined) {
-      // We do not want to update the host default tier when it is manually overridden
-      // via the sensors panel (in which case, `navigator.cpuPerformance` would return the override).
+    if (this.#isCPUPerformanceOverrideActive()) {
+      // We do not want to update the host default tier when it is overridden
+      // (in which case, `navigator.cpuPerformance` would return the override).
       return;
     }
     const target = this.#targetManager.primaryPageTarget();

package/front_end/core/sdk/SourceMap.ts

@@ -12,7 +12,7 @@ import {scopeTreeForScript} from './ScopeTreeCache.js';
 import type {Script} from './Script.js';
 import {buildOriginalScopes, decodePastaRanges, type NamedFunctionRange} from './SourceMapFunctionRanges.js';
 import {decodeRangeMappings} from './SourceMapRangeMappings.js';
-import {SourceMapScopesInfo, type TranslatedFrame} from './SourceMapScopesInfo.js';
+import {scriptRelativePosition, SourceMapScopesInfo, type TranslatedFrame} from './SourceMapScopesInfo.js';
 
 /**
  * Type of the base source map JSON object, which contains the sources and the mappings at the very least, plus
@@ -850,8 +850,8 @@ export class SourceMap {
       return null;
     }
 
-    return this.#scopesInfo.resolveMappedVariablesAtPosition(location.lineNumber, location.columnNumber,
-                                                             ignoreInnerBlockScopes);
+    const {line, column} = scriptRelativePosition(location);
+    return this.#scopesInfo.resolveMappedVariablesAtPosition(line, column, ignoreInnerBlockScopes);
   }
 
   findOriginalFunctionName(position: ScopesCodec.Position): string|null {

package/front_end/core/sdk/SourceMapScopeChainEntry.ts

@@ -8,7 +8,7 @@ import * as i18n from '../i18n/i18n.js';
 
 import type {CallFrame, LocationRange, ScopeChainEntry} from './DebuggerModel.js';
 import {type GetPropertiesResult, type RemoteObject, RemoteObjectImpl, RemoteObjectProperty} from './RemoteObject.js';
-import {findExpression} from './SourceMapScopesInfo.js';
+import {findExpression, scriptRelativePosition} from './SourceMapScopesInfo.js';
 
 const UIStrings = {
   /**
@@ -263,8 +263,9 @@ class SourceMapScopeRemoteObject extends RemoteObjectImpl {
 
   /** @returns null if the variable is unavailable at the current paused location */
   #findExpression(index: number): string|null {
-    const pausedPosition = this.#callFrame.location();
-    return findExpression(this.#range, index, pausedPosition?.lineNumber, pausedPosition?.columnNumber);
+    const pausedLocation = this.#callFrame.location();
+    const pausedPosition = pausedLocation ? scriptRelativePosition(pausedLocation) : undefined;
+    return findExpression(this.#range, index, pausedPosition?.line, pausedPosition?.column);
   }
 
   static #unavailableProperty(name: string): RemoteObjectProperty {

package/front_end/core/sdk/SourceMapScopesInfo.ts

@@ -8,7 +8,7 @@ import type * as ScopesCodec from '../../third_party/source-map-scopes-codec/sou
 import type * as Platform from '../platform/platform.js';
 import type * as TextUtils from '../text_utils/text_utils.js';
 
-import type {CallFrame, Scope, ScopeChainEntry} from './DebuggerModel.js';
+import type {CallFrame, Location, Scope, ScopeChainEntry} from './DebuggerModel.js';
 import type {SourceMap} from './SourceMap.js';
 import {SourceMapScopeChainEntry} from './SourceMapScopeChainEntry.js';
 
@@ -389,8 +389,8 @@ export class SourceMapScopesInfo {
 
   /** Similar to #findGeneratedRangeChain, but takes inlineFrameIndex of virtual call frames into account */
   #findGeneratedRangeChainForFrame(callFrame: CallFrame): ScopesCodec.GeneratedRange[] {
-    const rangeChain =
-        this.#findGeneratedRangeChain(callFrame.location().lineNumber, callFrame.location().columnNumber);
+    const {line, column} = scriptRelativePosition(callFrame.location());
+    const rangeChain = this.#findGeneratedRangeChain(line, column);
     if (callFrame.inlineFrameIndex === 0) {
       return rangeChain;
     }
@@ -611,6 +611,18 @@ export function comparePositions(a: ScopesCodec.Position, b: ScopesCodec.Positio
   return a.column - b.column;
 }
 
+/**
+ * Converts a raw V8 {@link location} into a generated position relative to the start of its script.
+ *
+ * Positions in source maps (mappings and generated ranges) are relative to the start of the script,
+ * while V8 reports locations in inline `<script>`s (without `//# sourceURL`) relative to the start of
+ * the surrounding document.
+ */
+export function scriptRelativePosition(location: Location): ScopesCodec.Position {
+  const {lineNumber, columnNumber} = location.script()?.rawLocationToRelativeLocation(location) ?? location;
+  return {line: lineNumber, column: columnNumber};
+}
+
 function positionRange(callFrame: CallFrame, scope: Scope): {start: ScopesCodec.Position, end: ScopesCodec.Position}|
     null {
   const range = scope.range();
@@ -619,8 +631,8 @@ function positionRange(callFrame: CallFrame, scope: Scope): {start: ScopesCodec.
     return null;
   }
   return {
-    start: {line: range.start.lineNumber, column: range.start.columnNumber},
-    end: {line: range.end.lineNumber, column: range.end.columnNumber},
+    start: scriptRelativePosition(range.start),
+    end: scriptRelativePosition(range.end),
   };
 }
 

package/front_end/core/text_utils/Markdown.ts

@@ -0,0 +1,73 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as Marked from '../../third_party/marked/marked.js';
+
+export interface PlaceholderToken extends Marked.Marked.Tokens.Generic {
+  type: 'placeholder';
+  raw: string;
+  key: string;
+}
+
+export const VALID_PLACEHOLDER_MATCH_PATTERN: RegExp = /\{(PLACEHOLDER_[a-zA-Z][a-zA-Z0-9_]*)\}/g;
+const VALID_PLACEHOLDER_NAME_PATTERN = /^PLACEHOLDER_[a-zA-Z][a-zA-Z0-9_]*$/;
+
+const placeholderExtension: Marked.Marked.TokenizerExtension = {
+  name: 'placeholder',
+  level: 'inline',
+  start(src: string): number |
+      undefined {
+        return src.match(/\{PLACEHOLDER_[a-zA-Z][a-zA-Z0-9_]*\}/)?.index;
+      },
+  tokenizer(src: string): PlaceholderToken |
+      undefined {
+        const match = /^\{(PLACEHOLDER_[a-zA-Z][a-zA-Z0-9_]*)\}/.exec(src);
+        if (match) {
+          return {
+            type: 'placeholder',
+            raw: match[0],
+            key: match[1],
+          };
+        }
+        return undefined;
+      },
+};
+
+export function validateSubstitutions(rawMarkdown: string, substitutions?: Map<string, string>): void {
+  if (!substitutions) {
+    return;
+  }
+  const unusedPlaceholders = new Set(substitutions.keys());
+  for (const key of unusedPlaceholders) {
+    if (!VALID_PLACEHOLDER_NAME_PATTERN.test(key)) {
+      throw new Error(`Invalid placeholder '${key}' provided in the substitutions map.`);
+    }
+  }
+  for (const [, placeholder] of rawMarkdown.matchAll(VALID_PLACEHOLDER_MATCH_PATTERN)) {
+    if (!substitutions.has(placeholder)) {
+      throw new Error(`No replacement provided for placeholder '${placeholder}'.`);
+    }
+    unusedPlaceholders.delete(placeholder);
+  }
+  if (unusedPlaceholders.size > 0) {
+    throw new Error(`Unused replacements provided: ${[...unusedPlaceholders]}`);
+  }
+}
+
+/**
+ * Tokenizes markdown into a Marked AST while preserving `{PLACEHOLDER_*}` tokens
+ * as `PlaceholderToken` AST nodes instead of substituting strings before lexing.
+ */
+export function tokenizeWithPlaceholders(markdown: string|Marked.Marked.Token[],
+                                         substitutions?: Map<string, string>): Marked.Marked.Token[] {
+  const rawMarkdown = typeof markdown === 'string' ? markdown : markdown.map(token => token.raw).join('');
+  validateSubstitutions(rawMarkdown, substitutions);
+  if (typeof markdown !== 'string' && !rawMarkdown.includes('{PLACEHOLDER_')) {
+    return markdown;
+  }
+  const markedInstance = new Marked.Marked.Marked({
+    extensions: [placeholderExtension],
+  });
+  return markedInstance.lexer(rawMarkdown);
+}

package/front_end/core/text_utils/text_utils.ts

@@ -5,6 +5,7 @@
 import * as CodeMirrorUtils from './CodeMirrorUtils.js';
 import * as ContentData from './ContentData.js';
 import * as ContentProvider from './ContentProvider.js';
+import * as Markdown from './Markdown.js';
 import * as StaticContentProvider from './StaticContentProvider.js';
 import * as StreamingContentData from './StreamingContentData.js';
 import * as Text from './Text.js';
@@ -17,6 +18,7 @@ export {
   CodeMirrorUtils,
   ContentData,
   ContentProvider,
+  Markdown,
   StaticContentProvider,
   StreamingContentData,
   Text,

package/front_end/entrypoints/main/MainImpl.ts

@@ -121,9 +121,9 @@ const UIStrings = {
    */
   aiModelDownloaded: 'AI model downloaded',
   /**
-   * @description Title of the menu item in the customize and control menu leading to the DevTools MCP repository.
+   * @description Title of the menu item in the customize and control menu leading to the Chrome DevTools for agents repository.
    */
-  getDevToolsMcp: 'Get `DevTools MCP`',
+  getChromeDevToolsForAgents: 'Give your agent access to `DevTools`',
 } as const;
 const str_ = i18n.i18n.registerUIStrings('entrypoints/main/MainImpl.ts', UIStrings);
 const i18nString = i18n.i18n.getLocalizedString.bind(undefined, str_);
@@ -893,7 +893,7 @@ export class MainMenuItem implements UI.Toolbar.Provider {
 
     contextMenu.defaultSection().appendAction('freestyler.main-menu', undefined, /* optional */ true);
 
-    contextMenu.defaultSection().appendItem(i18nString(UIStrings.getDevToolsMcp), () => {
+    contextMenu.defaultSection().appendItem(i18nString(UIStrings.getChromeDevToolsForAgents), () => {
       UIHelpers.openInNewTab('https://github.com/ChromeDevTools/chrome-devtools-mcp');
     }, {
       additionalElement: UI.UIUtils.maybeCreateNewBadge('get-devtools-mcp'),

package/front_end/generated/InspectorBackendCommands.ts

@@ -1183,7 +1183,7 @@ inspectorBackend.registerType("Page.FrameResource", [{"name": "url", "type": "st
 inspectorBackend.registerType("Page.FrameResourceTree", [{"name": "frame", "type": "object", "optional": false, "description": "Frame information for this tree item.", "typeRef": "Page.Frame"}, {"name": "childFrames", "type": "array", "optional": true, "description": "Child frames.", "typeRef": "Page.FrameResourceTree"}, {"name": "resources", "type": "array", "optional": false, "description": "Information about frame resources.", "typeRef": "Page.FrameResource"}]);
 inspectorBackend.registerType("Page.FrameTree", [{"name": "frame", "type": "object", "optional": false, "description": "Frame information for this tree item.", "typeRef": "Page.Frame"}, {"name": "childFrames", "type": "array", "optional": true, "description": "Child frames.", "typeRef": "Page.FrameTree"}]);
 inspectorBackend.registerType("Page.NavigationEntry", [{"name": "id", "type": "number", "optional": false, "description": "Unique id of the navigation history entry.", "typeRef": null}, {"name": "url", "type": "string", "optional": false, "description": "URL of the navigation history entry.", "typeRef": null}, {"name": "userTypedURL", "type": "string", "optional": false, "description": "URL that the user typed in the url bar.", "typeRef": null}, {"name": "title", "type": "string", "optional": false, "description": "Title of the navigation history entry.", "typeRef": null}, {"name": "transitionType", "type": "string", "optional": false, "description": "Transition type.", "typeRef": "Page.TransitionType"}]);
-inspectorBackend.registerType("Page.ScreencastFrameMetadata", [{"name": "offsetTop", "type": "number", "optional": false, "description": "Top offset in DIP.", "typeRef": null}, {"name": "pageScaleFactor", "type": "number", "optional": false, "description": "Page scale factor.", "typeRef": null}, {"name": "deviceWidth", "type": "number", "optional": false, "description": "Device screen width in DIP.", "typeRef": null}, {"name": "deviceHeight", "type": "number", "optional": false, "description": "Device screen height in DIP.", "typeRef": null}, {"name": "scrollOffsetX", "type": "number", "optional": false, "description": "Position of horizontal scroll in CSS pixels.", "typeRef": null}, {"name": "scrollOffsetY", "type": "number", "optional": false, "description": "Position of vertical scroll in CSS pixels.", "typeRef": null}, {"name": "timestamp", "type": "number", "optional": true, "description": "Frame swap timestamp.", "typeRef": "Network.TimeSinceEpoch"}]);
+inspectorBackend.registerType("Page.ScreencastFrameMetadata", [{"name": "offsetTop", "type": "number", "optional": false, "description": "Top offset in DIP.", "typeRef": null}, {"name": "pageScaleFactor", "type": "number", "optional": false, "description": "Page scale factor.", "typeRef": null}, {"name": "deviceWidth", "type": "number", "optional": false, "description": "Device screen width in DIP.", "typeRef": null}, {"name": "deviceHeight", "type": "number", "optional": false, "description": "Device screen height in DIP.", "typeRef": null}, {"name": "scrollOffsetX", "type": "number", "optional": false, "description": "Position of horizontal scroll in CSS pixels.", "typeRef": null}, {"name": "scrollOffsetY", "type": "number", "optional": false, "description": "Position of vertical scroll in CSS pixels.", "typeRef": null}, {"name": "timestamp", "type": "number", "optional": true, "description": "Frame swap timestamp.", "typeRef": "Network.TimeSinceEpoch"}, {"name": "monotonicTimestamp", "type": "number", "optional": true, "description": "Frame swap timestamp as monotonic time.", "typeRef": "Network.MonotonicTime"}]);
 inspectorBackend.registerType("Page.AppManifestError", [{"name": "message", "type": "string", "optional": false, "description": "Error message.", "typeRef": null}, {"name": "critical", "type": "number", "optional": false, "description": "If critical, this is a non-recoverable parse error.", "typeRef": null}, {"name": "line", "type": "number", "optional": false, "description": "Error line.", "typeRef": null}, {"name": "column", "type": "number", "optional": false, "description": "Error column.", "typeRef": null}]);
 inspectorBackend.registerType("Page.AppManifestParsedProperties", [{"name": "scope", "type": "string", "optional": false, "description": "Computed scope value", "typeRef": null}]);
 inspectorBackend.registerType("Page.LayoutViewport", [{"name": "pageX", "type": "number", "optional": false, "description": "Horizontal offset relative to the document (CSS pixels).", "typeRef": null}, {"name": "pageY", "type": "number", "optional": false, "description": "Vertical offset relative to the document (CSS pixels).", "typeRef": null}, {"name": "clientWidth", "type": "number", "optional": false, "description": "Width (CSS pixels), excludes scrollbar if present.", "typeRef": null}, {"name": "clientHeight", "type": "number", "optional": false, "description": "Height (CSS pixels), excludes scrollbar if present.", "typeRef": null}]);
@@ -1362,6 +1362,7 @@ inspectorBackend.registerCommand("Storage.untrackIndexedDBForStorageKey", [{"nam
 inspectorBackend.registerCommand("Storage.getTrustTokens", [], ["tokens"], "Returns the number of stored Trust Tokens per issuer for the current browsing context.");
 inspectorBackend.registerCommand("Storage.clearTrustTokens", [{"name": "issuerOrigin", "type": "string", "optional": false, "description": "", "typeRef": null}], ["didDeleteTokens"], "Removes all Trust Tokens issued by the provided issuerOrigin. Leaves other stored data, including the issuer's Redemption Records, intact.");
 inspectorBackend.registerCommand("Storage.getPrivateVerificationTokens", [], ["tokens"], "Returns all stored Private Verification Tokens for the current browsing context.");
+inspectorBackend.registerCommand("Storage.getPrivateVerificationTokensIssuerConfigs", [], ["configs"], "Returns the configured Private Verification Tokens issuers and their redeemer origins.");
 inspectorBackend.registerCommand("Storage.clearPrivateVerificationTokens", [{"name": "issuerOrigin", "type": "string", "optional": false, "description": "", "typeRef": null}], [], "Removes all Private Verification Tokens issued by the provided issuerOrigin.");
 inspectorBackend.registerCommand("Storage.deletePrivateVerificationToken", [{"name": "tokenId", "type": "string", "optional": false, "description": "", "typeRef": null}], [], "Removes a specific Private Verification Token by its ID.");
 inspectorBackend.registerCommand("Storage.setPrivateVerificationTokensTracking", [{"name": "enable", "type": "boolean", "optional": false, "description": "", "typeRef": null}], [], "Set tracking for Private Verification Tokens.");
@@ -1371,6 +1372,7 @@ inspectorBackend.registerCommand("Storage.runBounceTrackingMitigations", [], ["d
 inspectorBackend.registerType("Storage.UsageForType", [{"name": "storageType", "type": "string", "optional": false, "description": "Name of storage type.", "typeRef": "Storage.StorageType"}, {"name": "usage", "type": "number", "optional": false, "description": "Storage usage (bytes).", "typeRef": null}]);
 inspectorBackend.registerType("Storage.TrustTokens", [{"name": "issuerOrigin", "type": "string", "optional": false, "description": "", "typeRef": null}, {"name": "count", "type": "number", "optional": false, "description": "", "typeRef": null}]);
 inspectorBackend.registerType("Storage.PrivateVerificationToken", [{"name": "id", "type": "string", "optional": false, "description": "Unique identifier of the token in the database.", "typeRef": null}, {"name": "issuerOrigin", "type": "string", "optional": false, "description": "Origin of the token issuer.", "typeRef": null}, {"name": "keyId", "type": "number", "optional": false, "description": "Public key ID used to issue the token.", "typeRef": null}, {"name": "expiration", "type": "number", "optional": false, "description": "Expiration timestamp in seconds since the epoch.", "typeRef": "Network.TimeSinceEpoch"}, {"name": "creationTime", "type": "number", "optional": false, "description": "Token creation timestamp in seconds since the epoch.", "typeRef": "Network.TimeSinceEpoch"}, {"name": "version", "type": "number", "optional": false, "description": "Token protocol version.", "typeRef": null}, {"name": "token", "type": "string", "optional": false, "description": "Base64-encoded serialized token.", "typeRef": null}]);
+inspectorBackend.registerType("Storage.PrivateVerificationTokensIssuerConfig", [{"name": "issuerOrigin", "type": "string", "optional": false, "description": "Origin of the token issuer.", "typeRef": null}, {"name": "redeemerOrigins", "type": "array", "optional": false, "description": "Origins authorized to redeem tokens from this issuer.", "typeRef": "string"}]);
 inspectorBackend.registerType("Storage.StorageBucket", [{"name": "storageKey", "type": "string", "optional": false, "description": "", "typeRef": "Storage.SerializedStorageKey"}, {"name": "name", "type": "string", "optional": true, "description": "If not specified, it is the default bucket of the storageKey.", "typeRef": null}]);
 inspectorBackend.registerType("Storage.StorageBucketInfo", [{"name": "bucket", "type": "object", "optional": false, "description": "", "typeRef": "Storage.StorageBucket"}, {"name": "id", "type": "string", "optional": false, "description": "", "typeRef": null}, {"name": "expiration", "type": "number", "optional": false, "description": "", "typeRef": "Network.TimeSinceEpoch"}, {"name": "quota", "type": "number", "optional": false, "description": "Storage quota (bytes).", "typeRef": null}, {"name": "persistent", "type": "boolean", "optional": false, "description": "", "typeRef": null}, {"name": "durability", "type": "string", "optional": false, "description": "", "typeRef": "Storage.StorageBucketsDurability"}]);
 

package/front_end/generated/protocol-mapping.d.ts

@@ -4954,6 +4954,14 @@ export namespace ProtocolMapping {
       paramsType: [];
       returnType: Protocol.Storage.GetPrivateVerificationTokensResponse;
     };
+    /**
+     * Returns the configured Private Verification Tokens issuers and their redeemer
+     * origins.
+     */
+    'Storage.getPrivateVerificationTokensIssuerConfigs': {
+      paramsType: [];
+      returnType: Protocol.Storage.GetPrivateVerificationTokensIssuerConfigsResponse;
+    };
     /**
      * Removes all Private Verification Tokens issued by the provided issuerOrigin.
      */

package/front_end/generated/protocol-proxy-api.d.ts

@@ -4331,6 +4331,12 @@ declare namespace ProtocolProxyApi {
      */
     invoke_getPrivateVerificationTokens(): Promise<Protocol.Storage.GetPrivateVerificationTokensResponse>;
 
+    /**
+     * Returns the configured Private Verification Tokens issuers and their redeemer
+     * origins.
+     */
+    invoke_getPrivateVerificationTokensIssuerConfigs(): Promise<Protocol.Storage.GetPrivateVerificationTokensIssuerConfigsResponse>;
+
     /**
      * Removes all Private Verification Tokens issued by the provided issuerOrigin.
      */

package/front_end/generated/protocol.ts

@@ -15133,6 +15133,10 @@ export namespace Page {
      * Frame swap timestamp.
      */
     timestamp?: Network.TimeSinceEpoch;
+    /**
+     * Frame swap timestamp as monotonic time.
+     */
+    monotonicTimestamp?: Network.MonotonicTime;
   }
 
   /**
@@ -18504,6 +18508,20 @@ export namespace Storage {
     token: string;
   }
 
+  /**
+   * Configuration for a Private Verification Tokens issuer.
+   */
+  export interface PrivateVerificationTokensIssuerConfig {
+    /**
+     * Origin of the token issuer.
+     */
+    issuerOrigin: string;
+    /**
+     * Origins authorized to redeem tokens from this issuer.
+     */
+    redeemerOrigins: string[];
+  }
+
   export const enum StorageBucketsDurability {
     Relaxed = 'relaxed',
     Strict = 'strict',
@@ -18717,6 +18735,10 @@ export namespace Storage {
     tokens: PrivateVerificationToken[];
   }
 
+  export interface GetPrivateVerificationTokensIssuerConfigsResponse extends ProtocolResponseWithError {
+    configs: PrivateVerificationTokensIssuerConfig[];
+  }
+
   export interface ClearPrivateVerificationTokensRequest {
     issuerOrigin: string;
   }

package/front_end/models/bindings/CompilerScriptMapping.ts

@@ -348,7 +348,7 @@ export class CompilerScriptMapping implements DebuggerSourceMapping {
       return false;
     }
     const {sourceMap, script} = sourceMapAndScript;
-    const {lineNumber, columnNumber} = script.relativeLocationToRawLocation(frame);
+    const {lineNumber, columnNumber} = script.rawLocationToRelativeLocation(frame);
 
     if (!sourceMap.isOutlinedFrame(lineNumber, columnNumber)) {
       const frames = sourceMap.translateCallSite(lineNumber, columnNumber);

package/front_end/models/comment_manager/CD4ABridge.ts

@@ -87,8 +87,13 @@ export class CD4ABridge extends Common.ObjectWrapper.ObjectWrapper<EventTypes> {
 
   #formatCommentText(thread: CommentManager.CommentThread): string {
     const rawText = thread.comments[0]?.text ?? '';
+
     const details: string[] = [];
 
+    if (thread.anchor.vePath) {
+      details.push(`- DevTools VEPath: ${thread.anchor.vePath}`);
+    }
+
     if (thread.anchor.textSignature) {
       details.push(`- DevTools element: ${thread.anchor.textSignature}`);
     }

package/front_end/models/har/HARFormat.ts

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import * as Common from '../../core/common/common.js';
 import type * as Platform from '../../core/platform/platform.js';
 import * as SDK from '../../core/sdk/sdk.js';
 import type * as Protocol from '../../generated/protocol.js';
@@ -420,7 +421,9 @@ export class HARInitiator extends HARBase {
     super(data);
     this.type = (HARBase.optionalString(data['type']) ?? SDK.NetworkRequest.InitiatorType.OTHER) as
         Protocol.Network.InitiatorType;
-    this.url = HARBase.optionalString(data['url']);
+    const url = HARBase.optionalString(data['url']);
+    // Ignore privileged/non-web schemes in imported HARs.
+    this.url = url && Common.ParsedURL.hasWebSafeScheme(url) ? url : undefined;
     this.lineNumber = HARBase.optionalNumber(data['lineNumber']);
     this.requestId = HARBase.optionalString(data['requestId']) as Protocol.Network.RequestId;
     if (data['stack']) {
@@ -477,7 +480,9 @@ export class HARCallFrame extends HARBase {
 
     this.functionName = HARBase.optionalString(data['functionName']) ?? '';
     this.scriptId = (HARBase.optionalString(data['scriptId']) ?? '') as Protocol.Runtime.ScriptId;
-    this.url = HARBase.optionalString(data['url']) ?? '';
+    const url = HARBase.optionalString(data['url']) ?? '';
+    // Ignore privileged/non-web schemes in imported HARs.
+    this.url = Common.ParsedURL.hasWebSafeScheme(url) ? url : '';
     this.lineNumber = HARBase.optionalNumber(data['lineNumber']) ?? -1;
     this.columnNumber = HARBase.optionalNumber(data['columnNumber']) ?? -1;
   }

package/front_end/models/issues_manager/MarkdownIssueDescription.ts

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 import * as Platform from '../../core/platform/platform.js';
+import * as TextUtils from '../../core/text_utils/text_utils.js';
 import * as Marked from '../../third_party/marked/marked.js';
 
 /**
@@ -75,9 +76,8 @@ export async function getMarkdownFileContent(filename: string): Promise<string>
 
 export async function createIssueDescriptionFromMarkdown(description: MarkdownIssueDescription):
     Promise<IssueDescription> {
-  const rawMarkdown = await getMarkdownFileContent(description.file);
-  const rawMarkdownWithPlaceholdersReplaced = substitutePlaceholders(rawMarkdown, description.substitutions);
-  return createIssueDescriptionFromRawMarkdown(rawMarkdownWithPlaceholdersReplaced, description);
+  const markdown = await getMarkdownFileContent(description.file);
+  return createIssueDescriptionFromRawMarkdown(markdown, description);
 }
 
 /**
@@ -85,7 +85,7 @@ export async function createIssueDescriptionFromMarkdown(description: MarkdownIs
  */
 export function createIssueDescriptionFromRawMarkdown(
     markdown: string, description: MarkdownIssueDescription): IssueDescription {
-  const markdownAst = Marked.Marked.lexer(markdown);
+  const markdownAst = TextUtils.Markdown.tokenizeWithPlaceholders(markdown, description.substitutions);
   const markdownTitle = findTitleFromMarkdownAst(markdownAst);
   if (!markdownTitle) {
     throw new Error('Markdown issue descriptions must start with a heading');
@@ -99,49 +99,6 @@ export function createIssueDescriptionFromRawMarkdown(
   };
 }
 
-const validPlaceholderMatchPattern = /\{(PLACEHOLDER_[a-zA-Z][a-zA-Z0-9]*)\}/g;
-const validPlaceholderNamePattern = /PLACEHOLDER_[a-zA-Z][a-zA-Z0-9]*/;
-
-/**
- * Replaces placeholders in markdown text with a string provided by the
- * `substitutions` map. To keep mental overhead to a minimum, the same
- * syntax is used as for l10n placeholders. Please note that the
- * placeholders require a mandatory 'PLACEHOLDER_' prefix.
- *
- * Example:
- *   const str = "This is markdown with `code` and two placeholders, namely {PLACEHOLDER_PH1} and {PLACEHOLDER_PH2}".
- *   const result = substitutePlaceholders(str, new Map([['PLACEHOLDER_PH1', 'foo'], ['PLACEHOLDER_PH2', 'bar']]));
- *
- * Exported only for unit testing.
- */
-export function substitutePlaceholders(markdown: string, substitutions?: Map<string, string>): string {
-  const unusedPlaceholders = new Set(substitutions ? substitutions.keys() : []);
-  validatePlaceholders(unusedPlaceholders);
-
-  const result = markdown.replace(validPlaceholderMatchPattern, (_, placeholder) => {
-    const replacement = substitutions ? substitutions.get(placeholder) : undefined;
-    if (replacement === undefined) {
-      throw new Error(`No replacement provided for placeholder '${placeholder}'.`);
-    }
-    unusedPlaceholders.delete(placeholder);
-    return replacement;
-  });
-
-  if (unusedPlaceholders.size > 0) {
-    throw new Error(`Unused replacements provided: ${[...unusedPlaceholders]}`);
-  }
-
-  return result;
-}
-
-/** Ensure that all provided placeholders match the naming pattern. **/
-function validatePlaceholders(placeholders: Set<string>): void {
-  const invalidPlaceholders = [...placeholders].filter(placeholder => !validPlaceholderNamePattern.test(placeholder));
-  if (invalidPlaceholders.length > 0) {
-    throw new Error(`Invalid placeholders provided in the substitutions map: ${invalidPlaceholders}`);
-  }
-}
-
 export function findTitleFromMarkdownAst(markdownAst: Marked.Marked.Token[]): string|null {
   if (markdownAst.length === 0 || markdownAst[0].type !== 'heading' || markdownAst[0].depth !== 1) {
     return null;

package/front_end/models/persistence/AutomaticFileSystemWorkspaceBinding.ts

@@ -64,7 +64,7 @@ export class FileSystem implements Workspace.Workspace.Project {
   }
 
   displayName(): string {
-    const {root} = this.automaticFileSystem;
+    const root = this.automaticFileSystem.root.replace(Host.Platform.isWin() ? /[/\\]+$/ : /\/+$/, '');
     let slash = root.lastIndexOf('/');
     if (slash === -1 && Host.Platform.isWin()) {
       slash = root.lastIndexOf('\\');