chrome-devtools-frontend 1.0.1703574 → 1.0.1704172

package/AUTHORS

@@ -99,6 +99,7 @@ Ryuhei Shima <shimaryuhei@gmail.com>
 Samuel Maddock <samuelmaddock@electronjs.org>
 Satvic Dhawan <satvicdhawan14@gmail.com>
 Sebastian Markbåge <sebastian@calyptus.eu>
+Semih Dogan <semih702do@gmail.com>
 Serg Kryvonos <sergeikrivonos@gmail.com>
 Sergio Avalos <sergio.avalos@gmail.com>
 Shelley Vohr <shelley.vohr@gmail.com>

package/front_end/core/common/ParsedURL.ts

@@ -46,6 +46,60 @@ export function schemeIs(url: Platform.DevToolsPath.UrlString|URL, scheme: strin
   }
 }
 
+/**
+ * Schemes safe for unprivileged web contexts (matching ChildProcessSecurityPolicyImpl::RegisterDefaultSchemes).
+ */
+const WEB_SAFE_SCHEMES = new Set([
+  'http:',
+  'https:',
+  'ws:',
+  'wss:',
+  'data:',
+]);
+
+/**
+ * Returns true if the URL uses an unprivileged web-safe scheme (or is a `blob:` URL wrapping one).
+ */
+export function hasWebSafeScheme(url: Platform.DevToolsPath.UrlString|URL|string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === 'blob:') {
+      return hasWebSafeScheme(parsed.pathname);
+    }
+    return WEB_SAFE_SCHEMES.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Privileged browser and local schemes that must not be opened via external/new-tab links by default.
+ */
+const PRIVILEGED_SCHEMES = new Set([
+  'chrome:',
+  'chrome-extension:',
+  'chrome-search:',
+  'chrome-untrusted:',
+  'devtools:',
+  'file:',
+  'isolated-app:',
+]);
+
+/**
+ * Returns true if the URL uses a privileged scheme (or is a `blob:` URL wrapping one).
+ */
+export function isPrivilegedScheme(url: Platform.DevToolsPath.UrlString|URL|string): boolean {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol === 'blob:') {
+      return isPrivilegedScheme(parsed.pathname);
+    }
+    return PRIVILEGED_SCHEMES.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * File paths in DevTools that are represented either as unencoded absolute or relative paths, or encoded paths, or URLs.
  * @example

package/front_end/core/platform/StringUtilities.ts

@@ -740,3 +740,68 @@ export const concatBase64 = function(lhs: string, rhs: string): string {
   const lhsToDecode = lhs.substring(lhs.length - 4);
   return lhsLeaveAsIs + globalThis.btoa(globalThis.atob(lhsToDecode) + globalThis.atob(rhs));
 };
+
+/**
+ * Characters that cause spreadsheet viewers (Excel, Google Sheets, LibreOffice
+ * Calc) to evaluate a cell as a formula rather than rendering it as plain text
+ * when they appear at the start of a cell.
+ */
+const CSV_FORMULA_TRIGGERS = new Set(['=', '+', '-', '@', '\t', '\r']);
+
+/**
+ * Matches plain numeric literals (e.g. `-42`, `+3.14`, `-1e-3`).
+ * Even though negative/signed numbers start with `-` or `+`, spreadsheets parse
+ * them as numbers rather than formulas, so we exempt them from `'` prefixing to
+ * keep numeric columns usable.
+ */
+const CSV_PLAIN_NUMBER = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+
+/**
+ * Returns true if a spreadsheet viewer could interpret `value` as a formula
+ * (for example `=SUM(A1:A2)`, `"- Loading..."`, or `"@alice"`).
+ */
+function isCsvFormula(value: string): boolean {
+  // Check both the raw string and the leading-whitespace-trimmed string, since
+  // some spreadsheet parsers ignore leading spaces before `=`, `+`, `-`, or `@`.
+  const trimmed = value.trimStart();
+  if (!CSV_FORMULA_TRIGGERS.has(value[0]) && !CSV_FORMULA_TRIGGERS.has(trimmed[0])) {
+    return false;
+  }
+  return !CSV_PLAIN_NUMBER.test(trimmed.trimEnd());
+}
+
+/**
+ * Formats and escapes `value` so it can be safely written as a single CSV cell.
+ *
+ * This handles two separate layers of escaping:
+ * 1. Spreadsheet formula escaping (CWE-1236 & viewer fidelity):
+ *    RFC 4180 double-quoting (`"=1+1"` or `"- Loading..."`) only groups text
+ *    into a single CSV column; spreadsheet apps strip the outer `"` and still
+ *    evaluate cells starting with `=`, `+`, `-`, or `@` as formulas (often
+ *    resulting in `#NAME?` errors or unintended formula execution). Prefixing
+ *    the value with a single quote (`'`) tells spreadsheet apps to treat the
+ *    cell as literal text (and they hide the leading `'` when displaying it).
+ *    - Example without commas: `=SUM(A1:A2)` -> `'=SUM(A1:A2)`
+ * 2. RFC 4180 structural CSV quoting:
+ *    If the cell also contains commas (`,`), double quotes (`"`), or newlines,
+ *    it is wrapped in `"..."` (with inner `"` doubled to `""`) so CSV parsers
+ *    do not split the cell across columns or rows.
+ *    - Example with commas: `=SUM(1,2)` -> `"'=SUM(1,2)"`
+ *    - Example starting with a literal quote: `"=SUM(1,2)"` -> `"""=SUM(1,2)"""`
+ *      (not treated as a formula since the first character is `"`, not `=`).
+ */
+export const escapeCsvCell = function(value: string): string {
+  // Step 1: Prefix formula-like text with `'` so spreadsheets render it as literal text.
+  let escaped = isCsvFormula(value) ? `'${value}` : value;
+
+  // Step 2: Apply standard RFC 4180 double-quoting if the cell contains quotes,
+  // commas, or line breaks so the CSV structure stays intact.
+  if (escaped.includes('"')) {
+    escaped = escaped.replace(/"/g, '""');
+    return `"${escaped}"`;
+  }
+  if (escaped.includes(',') || escaped.includes('\n') || escaped.includes('\r')) {
+    return `"${escaped}"`;
+  }
+  return escaped;
+};

package/front_end/core/sdk/CPUThrottlingManager.ts

@@ -282,9 +282,9 @@ export class CPUThrottlingManager extends Common.ObjectWrapper.ObjectWrapper<Eve
   }
 
   async updateHostDefaultCPUPerformanceTier(): Promise<void> {
-    if (this.#manualCPUPerformanceOverride !== undefined) {
-      // We do not want to update the host default tier when it is manually overridden
-      // via the sensors panel (in which case, `navigator.cpuPerformance` would return the override).
+    if (this.#isCPUPerformanceOverrideActive()) {
+      // We do not want to update the host default tier when it is overridden
+      // (in which case, `navigator.cpuPerformance` would return the override).
       return;
     }
     const target = this.#targetManager.primaryPageTarget();

package/front_end/core/sdk/SourceMap.ts

@@ -12,7 +12,7 @@ import {scopeTreeForScript} from './ScopeTreeCache.js';
 import type {Script} from './Script.js';
 import {buildOriginalScopes, decodePastaRanges, type NamedFunctionRange} from './SourceMapFunctionRanges.js';
 import {decodeRangeMappings} from './SourceMapRangeMappings.js';
-import {SourceMapScopesInfo, type TranslatedFrame} from './SourceMapScopesInfo.js';
+import {scriptRelativePosition, SourceMapScopesInfo, type TranslatedFrame} from './SourceMapScopesInfo.js';
 
 /**
  * Type of the base source map JSON object, which contains the sources and the mappings at the very least, plus
@@ -850,8 +850,8 @@ export class SourceMap {
       return null;
     }
 
-    return this.#scopesInfo.resolveMappedVariablesAtPosition(location.lineNumber, location.columnNumber,
-                                                             ignoreInnerBlockScopes);
+    const {line, column} = scriptRelativePosition(location);
+    return this.#scopesInfo.resolveMappedVariablesAtPosition(line, column, ignoreInnerBlockScopes);
   }
 
   findOriginalFunctionName(position: ScopesCodec.Position): string|null {

package/front_end/core/sdk/SourceMapScopeChainEntry.ts

@@ -8,7 +8,7 @@ import * as i18n from '../i18n/i18n.js';
 
 import type {CallFrame, LocationRange, ScopeChainEntry} from './DebuggerModel.js';
 import {type GetPropertiesResult, type RemoteObject, RemoteObjectImpl, RemoteObjectProperty} from './RemoteObject.js';
-import {findExpression} from './SourceMapScopesInfo.js';
+import {findExpression, scriptRelativePosition} from './SourceMapScopesInfo.js';
 
 const UIStrings = {
   /**
@@ -263,8 +263,9 @@ class SourceMapScopeRemoteObject extends RemoteObjectImpl {
 
   /** @returns null if the variable is unavailable at the current paused location */
   #findExpression(index: number): string|null {
-    const pausedPosition = this.#callFrame.location();
-    return findExpression(this.#range, index, pausedPosition?.lineNumber, pausedPosition?.columnNumber);
+    const pausedLocation = this.#callFrame.location();
+    const pausedPosition = pausedLocation ? scriptRelativePosition(pausedLocation) : undefined;
+    return findExpression(this.#range, index, pausedPosition?.line, pausedPosition?.column);
   }
 
   static #unavailableProperty(name: string): RemoteObjectProperty {

package/front_end/core/sdk/SourceMapScopesInfo.ts

@@ -8,7 +8,7 @@ import type * as ScopesCodec from '../../third_party/source-map-scopes-codec/sou
 import type * as Platform from '../platform/platform.js';
 import type * as TextUtils from '../text_utils/text_utils.js';
 
-import type {CallFrame, Scope, ScopeChainEntry} from './DebuggerModel.js';
+import type {CallFrame, Location, Scope, ScopeChainEntry} from './DebuggerModel.js';
 import type {SourceMap} from './SourceMap.js';
 import {SourceMapScopeChainEntry} from './SourceMapScopeChainEntry.js';
 
@@ -389,8 +389,8 @@ export class SourceMapScopesInfo {
 
   /** Similar to #findGeneratedRangeChain, but takes inlineFrameIndex of virtual call frames into account */
   #findGeneratedRangeChainForFrame(callFrame: CallFrame): ScopesCodec.GeneratedRange[] {
-    const rangeChain =
-        this.#findGeneratedRangeChain(callFrame.location().lineNumber, callFrame.location().columnNumber);
+    const {line, column} = scriptRelativePosition(callFrame.location());
+    const rangeChain = this.#findGeneratedRangeChain(line, column);
     if (callFrame.inlineFrameIndex === 0) {
       return rangeChain;
     }
@@ -611,6 +611,18 @@ export function comparePositions(a: ScopesCodec.Position, b: ScopesCodec.Positio
   return a.column - b.column;
 }
 
+/**
+ * Converts a raw V8 {@link location} into a generated position relative to the start of its script.
+ *
+ * Positions in source maps (mappings and generated ranges) are relative to the start of the script,
+ * while V8 reports locations in inline `<script>`s (without `//# sourceURL`) relative to the start of
+ * the surrounding document.
+ */
+export function scriptRelativePosition(location: Location): ScopesCodec.Position {
+  const {lineNumber, columnNumber} = location.script()?.rawLocationToRelativeLocation(location) ?? location;
+  return {line: lineNumber, column: columnNumber};
+}
+
 function positionRange(callFrame: CallFrame, scope: Scope): {start: ScopesCodec.Position, end: ScopesCodec.Position}|
     null {
   const range = scope.range();
@@ -619,8 +631,8 @@ function positionRange(callFrame: CallFrame, scope: Scope): {start: ScopesCodec.
     return null;
   }
   return {
-    start: {line: range.start.lineNumber, column: range.start.columnNumber},
-    end: {line: range.end.lineNumber, column: range.end.columnNumber},
+    start: scriptRelativePosition(range.start),
+    end: scriptRelativePosition(range.end),
   };
 }
 

package/front_end/entrypoints/main/MainImpl.ts

@@ -121,9 +121,9 @@ const UIStrings = {
    */
   aiModelDownloaded: 'AI model downloaded',
   /**
-   * @description Title of the menu item in the customize and control menu leading to the DevTools MCP repository.
+   * @description Title of the menu item in the customize and control menu leading to the Chrome DevTools for agents repository.
    */
-  getDevToolsMcp: 'Get `DevTools MCP`',
+  getChromeDevToolsForAgents: 'Give your agent access to `DevTools`',
 } as const;
 const str_ = i18n.i18n.registerUIStrings('entrypoints/main/MainImpl.ts', UIStrings);
 const i18nString = i18n.i18n.getLocalizedString.bind(undefined, str_);
@@ -893,7 +893,7 @@ export class MainMenuItem implements UI.Toolbar.Provider {
 
     contextMenu.defaultSection().appendAction('freestyler.main-menu', undefined, /* optional */ true);
 
-    contextMenu.defaultSection().appendItem(i18nString(UIStrings.getDevToolsMcp), () => {
+    contextMenu.defaultSection().appendItem(i18nString(UIStrings.getChromeDevToolsForAgents), () => {
       UIHelpers.openInNewTab('https://github.com/ChromeDevTools/chrome-devtools-mcp');
     }, {
       additionalElement: UI.UIUtils.maybeCreateNewBadge('get-devtools-mcp'),

package/front_end/models/bindings/CompilerScriptMapping.ts

@@ -348,7 +348,7 @@ export class CompilerScriptMapping implements DebuggerSourceMapping {
       return false;
     }
     const {sourceMap, script} = sourceMapAndScript;
-    const {lineNumber, columnNumber} = script.relativeLocationToRawLocation(frame);
+    const {lineNumber, columnNumber} = script.rawLocationToRelativeLocation(frame);
 
     if (!sourceMap.isOutlinedFrame(lineNumber, columnNumber)) {
       const frames = sourceMap.translateCallSite(lineNumber, columnNumber);

package/front_end/models/har/HARFormat.ts

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+import * as Common from '../../core/common/common.js';
 import type * as Platform from '../../core/platform/platform.js';
 import * as SDK from '../../core/sdk/sdk.js';
 import type * as Protocol from '../../generated/protocol.js';
@@ -420,7 +421,9 @@ export class HARInitiator extends HARBase {
     super(data);
     this.type = (HARBase.optionalString(data['type']) ?? SDK.NetworkRequest.InitiatorType.OTHER) as
         Protocol.Network.InitiatorType;
-    this.url = HARBase.optionalString(data['url']);
+    const url = HARBase.optionalString(data['url']);
+    // Ignore privileged/non-web schemes in imported HARs.
+    this.url = url && Common.ParsedURL.hasWebSafeScheme(url) ? url : undefined;
     this.lineNumber = HARBase.optionalNumber(data['lineNumber']);
     this.requestId = HARBase.optionalString(data['requestId']) as Protocol.Network.RequestId;
     if (data['stack']) {
@@ -477,7 +480,9 @@ export class HARCallFrame extends HARBase {
 
     this.functionName = HARBase.optionalString(data['functionName']) ?? '';
     this.scriptId = (HARBase.optionalString(data['scriptId']) ?? '') as Protocol.Runtime.ScriptId;
-    this.url = HARBase.optionalString(data['url']) ?? '';
+    const url = HARBase.optionalString(data['url']) ?? '';
+    // Ignore privileged/non-web schemes in imported HARs.
+    this.url = Common.ParsedURL.hasWebSafeScheme(url) ? url : '';
     this.lineNumber = HARBase.optionalNumber(data['lineNumber']) ?? -1;
     this.columnNumber = HARBase.optionalNumber(data['columnNumber']) ?? -1;
   }

package/front_end/models/source_map_scopes/NamesResolver.ts

@@ -119,9 +119,11 @@ export async function findScopeChainForDebuggerScope(scope: SDK.DebuggerModel.Sc
   const {scopeTree, text} = scopeTreeAndText;
 
   // Compute the offset within the scope tree coordinate space.
+  const start = script.rawLocationToRelativeLocation(startLocation);
+  const end = script.rawLocationToRelativeLocation(endLocation);
   const scopeOffsets = {
-    start: text.offsetFromPosition(startLocation.lineNumber, startLocation.columnNumber),
-    end: text.offsetFromPosition(endLocation.lineNumber, endLocation.columnNumber),
+    start: text.offsetFromPosition(start.lineNumber, start.columnNumber),
+    end: text.offsetFromPosition(end.lineNumber, end.columnNumber),
   };
 
   return findScopeChain(scopeTree, scopeOffsets);
@@ -482,7 +484,8 @@ export const allVariablesAtPosition =
           }
 
           const {scopeTree, text} = scopeTreeAndText;
-          const locationOffset = text.offsetFromPosition(location.lineNumber, location.columnNumber);
+          const {lineNumber, columnNumber} = script.rawLocationToRelativeLocation(location);
+          const locationOffset = text.offsetFromPosition(lineNumber, columnNumber);
           const scopeChain = findScopeChain(scopeTree, {start: locationOffset, end: locationOffset});
 
           while (scopeChain.length > 0) {
@@ -746,8 +749,8 @@ export class RemoteObject extends SDK.RemoteObject.RemoteObject {
  * start or if the function scope does not start with a left paren (e.g., arrow
  * function with one parameter), the resolution returns null.
  **/
-async function getFunctionNameFromScopeStart(
-    script: SDK.Script.Script, lineNumber: number, columnNumber: number): Promise<string|null> {
+async function getFunctionNameFromScopeStart(script: SDK.Script.Script, rawLineNumber: number,
+                                             rawColumnNumber: number): Promise<string|null> {
   // To reduce the overhead of resolving function names,
   // we check for source maps first and immediately leave
   // this function if the script doesn't have a sourcemap.
@@ -756,6 +759,11 @@ async function getFunctionNameFromScopeStart(
     return null;
   }
 
+  // The source map and the script text are relative to the start of the script, whereas
+  // raw V8 positions in inline scripts are relative to the start of the document.
+  const {lineNumber, columnNumber} =
+      script.rawLocationToRelativeLocation({lineNumber: rawLineNumber, columnNumber: rawColumnNumber});
+
   const scopeName = sourceMap.findOriginalFunctionName({line: lineNumber, column: columnNumber});
   if (scopeName !== null) {
     return scopeName;

package/front_end/panels/accessibility/AccessibilityAnnouncementRecordingListView.ts

@@ -4,6 +4,7 @@
 
 import '../../ui/legacy/components/data_grid/data_grid.js';
 
+import * as Host from '../../core/host/host.js';
 import * as i18n from '../../core/i18n/i18n.js';
 import * as UI from '../../ui/legacy/legacy.js';
 import * as Lit from '../../ui/lit/lit.js';
@@ -45,6 +46,14 @@ const UIStrings = {
    * @description Accessible title for the announcements data grid.
    */
   ariaLiveRecordingList: 'Accessibility Announcements',
+  /**
+   * @description Context menu item for copying the announcement message text to the clipboard.
+   */
+  copyMessage: 'Copy message',
+  /**
+   * @description Context menu item for copying the announcement element HTML snippet to the clipboard.
+   */
+  copyElementHtml: 'Copy element HTML',
 } as const;
 const str_ =
     i18n.i18n.registerUIStrings('panels/accessibility/AccessibilityAnnouncementRecordingListView.ts', UIStrings);
@@ -53,6 +62,7 @@ const i18nString = i18n.i18n.getLocalizedString.bind(undefined, str_);
 export interface ViewInput {
   items: readonly A11yAnnouncement[];
   selectedItem: A11yAnnouncement|null;
+  onContextMenu: (menu: UI.ContextMenu.ContextMenu, item: A11yAnnouncement) => void;
   onSelect: (item: A11yAnnouncement) => void;
   onDeselect: () => void;
 }
@@ -92,7 +102,12 @@ export const DEFAULT_VIEW: View = (input, _output, target) => {
           return html`
             <tr
               ?selected=${item === input.selectedItem}
-              @select=${() => input.onSelect(item)}>
+              @select=${() => input.onSelect(item)}
+              @contextmenu=${(e: CustomEvent<UI.ContextMenu.ContextMenu>) => {
+                if (e.detail instanceof UI.ContextMenu.ContextMenu) {
+                  input.onContextMenu(e.detail, item);
+                }
+              }}>
               <td data-value=${item.time}>
                 <span>${timeString}</span>
               </td>
@@ -159,10 +174,27 @@ export class AccessibilityAnnouncementRecordingListView extends UI.Widget.VBox {
     this.requestUpdate();
   }
 
+  #populateContextMenu(contextMenu: UI.ContextMenu.ContextMenu, item: A11yAnnouncement): void {
+    if (item.message) {
+      contextMenu.clipboardSection().appendItem(i18nString(UIStrings.copyMessage), () => {
+        Host.InspectorFrontendHost.InspectorFrontendHostInstance.copyText(item.message);
+      }, {jslogContext: 'copy-message'});
+    }
+
+    if (item.element) {
+      contextMenu.clipboardSection().appendItem(i18nString(UIStrings.copyElementHtml), () => {
+        Host.InspectorFrontendHost.InspectorFrontendHostInstance.copyText(item.element);
+      }, {jslogContext: 'copy-element-html'});
+    }
+  }
+
   override performUpdate(): void {
     const input: ViewInput = {
       items: this.#items,
       selectedItem: this.#selectedItem,
+      onContextMenu: (contextMenu: UI.ContextMenu.ContextMenu, item: A11yAnnouncement) => {
+        this.#populateContextMenu(contextMenu, item);
+      },
       onSelect: (item: A11yAnnouncement) => {
         this.selectedItem = item;
         this.#onSelect?.(item);

package/front_end/panels/accessibility/AccessibilityAnnouncementRecordingView.ts

@@ -744,14 +744,6 @@ export function validateAndSanitizeAnnouncement(payload: unknown): A11yAnnouncem
   };
 }
 
-export function escapeCsvValue(val: string): string {
-  const escaped = val.replace(/"/g, '""');
-  if (escaped.includes(',') || escaped.includes('\n') || escaped.includes('\r') || escaped.includes('"')) {
-    return `"${escaped}"`;
-  }
-  return escaped;
-}
-
 export function buildCsvContent(announcements: readonly A11yAnnouncement[]): string {
   const csvRows: string[] = [];
   csvRows.push(['Time', 'API', 'Politeness', 'Message'].join(','));
@@ -759,10 +751,10 @@ export function buildCsvContent(announcements: readonly A11yAnnouncement[]): str
   for (const item of announcements) {
     const timeString = new Date(item.time).toISOString();
     const row = [
-      escapeCsvValue(timeString),
-      escapeCsvValue(item.api),
-      escapeCsvValue(item.politeness),
-      escapeCsvValue(item.message),
+      Platform.StringUtilities.escapeCsvCell(timeString),
+      Platform.StringUtilities.escapeCsvCell(item.api),
+      Platform.StringUtilities.escapeCsvCell(item.politeness),
+      Platform.StringUtilities.escapeCsvCell(item.message),
     ];
     csvRows.push(row.join(','));
   }