[AI Assistance] Fail-closed origin locking in network and DOM tools

Network tools (ListNetworkRequests, GetNetworkRequestDetails) previously
checked if an origin lock was established, but fell back to allowing all
requests when conversationOrigin was null or undefined, causing them to
fail open. Similarly, DOM and accessibility tools (GetStyles,
GetElementAccessibilityDetails, ResolveDevtoolsNodePath) relied on
ConversationContext.isOriginAllowed(), which returns true when the
origin lock is not established.

This change migrates all remaining tools to isOriginAllowedByLock and
ensures they fail closed when the origin lock is undefined or opaque:
- ListNetworkRequestsTool and GetNetworkRequestDetailsTool reject
  execution when the origin lock is missing or opaque, and filter
  requests strictly via isOriginAllowedByLock against the initiator origin.
- GetStylesTool, GetElementAccessibilityDetailsTool, and
  ResolveDevtoolsNodePathTool require an established non-opaque origin lock
  and validate target node origins using isOriginAllowedByLock.

Fixed: 559156499
TAG=agy
CONV=401d6ddf-8863-46c0-b0da-516acd8cbdda
Change-Id: I281a52888fd35490ff11e96ac48bcdc6d49a6244
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/8378726
Reviewed-by: Simon Zünd <szuend@chromium.org>
Auto-Submit: Jack Franklin <jacktfranklin@chromium.org>
Commit-Queue: Jack Franklin <jacktfranklin@chromium.org>
8 files changed
tree: 221c8e7914596d947451afabc652fabe3d67b667
  1. .agents/
  2. .gemini/
  3. .github/
  4. .vscode/
  5. build_overrides/
  6. config/
  7. docs/
  8. extension-api/
  9. extensions/
  10. front_end/
  11. inspector_overlay/
  12. mcp/
  13. node_modules/
  14. scripts/
  15. test/
  16. third_party/
  17. v8/
  18. .clang-format
  19. .clang-format-ignore
  20. .editorconfig
  21. .env.template
  22. .geminiignore
  23. .git-blame-ignore-revs
  24. .gitallowed
  25. .gitattributes
  26. .gitignore
  27. .gitmodules
  28. .gn
  29. .mailmap
  30. .npmignore
  31. .npmrc
  32. .style.yapf
  33. .stylelintignore
  34. .stylelintrc.json
  35. AUTHORS
  36. BUILD.gn
  37. codereview.settings
  38. CONTRIBUTING.md
  39. DEPS
  40. DIR_METADATA
  41. eslint.config.mjs
  42. favicon.ico
  43. LICENSE
  44. OWNERS
  45. package-lock.json
  46. package.json
  47. PRESUBMIT.py
  48. README.md
  49. SECURITY.md
  50. WATCHLISTS
README.md

Chrome DevTools frontend

npm package

The client-side of the Chrome DevTools, including all TypeScript & CSS to run the DevTools webapp.

Source code and documentation

The frontend is available on chromium.googlesource.com. Check out the Chromium DevTools documentation for instructions to set up, use, and maintain a DevTools front-end checkout, as well as design guidelines, and architectural documentation.

Source mirrors

DevTools frontend repository is mirrored on GitHub.

DevTools frontend is also available on NPM as the chrome-devtools-frontend package. It's not currently available via CJS or ES modules, so consuming this package in other tools may require some effort.

The version number of the npm package (e.g. 1.0.373466) refers to the Chromium commit position of latest frontend git commit. It's incremented with every Chromium commit, however the package is updated roughly daily.

Getting in touch

There are a few options to keep an eye on the latest and greatest of DevTools development: