v155 · extensions · labelled simulation
Attach gate simulator
Compose the policy environment an IT admin would deploy, then run an extension's attach-and-command timeline against it — once with Chrome 155's up-front gate, once with the old scattered enforcement. The match-pattern parsing below is real code following the documented grammar; the attach verdict is a simulation of the documented contract, because chrome.debugger only exists inside an extension with the debugger permission.
Why this one is a simulation — and what is real. A web page has no chrome.debugger (prove it on the observability probe). The pattern validation and matching here run for real in your browser; the attach/command outcomes replay the contract documented in the chrome.debugger reference. To exercise the real thing you need a managed Chrome 155+ profile, an extension with the debugger permission, and the ExtensionSettings policy applied.
1 · The policy environment
2 · Run the timeline
Press "Replay timeline".
the all-or-nothing rule, spelled out
// Chrome 155+: the gate runs when attach() is called.
// 1. Does ExtensionSettings give THIS extension any
// runtime_blocked_hosts at all?
// → attach() rejects: "Host access is restricted by policy."
// EVEN IF the current target is not in the blocked list, and
// EVEN IF it appears in runtime_allowed_hosts. A debugger
// session could navigate anywhere, so partial host access
// cannot be honoured.
// 2. Is screenshot capture restricted (DisableScreenshots / DLP)?
// → attach() rejects: "Screenshot capture is restricted by policy."
// Otherwise: attach() resolves and every CDP command is available.