@agent-native/core 0.84.67 → 0.85.1

package/dist/client/session-replay.js

@@ -41,6 +41,39 @@ const DEFAULT_MAX_EVENTS_PER_BATCH = 50;
 const DEFAULT_MAX_BATCH_BYTES = 256 * 1024;
 const MAX_KEEPALIVE_REPLAY_UPLOAD_BYTES = 60 * 1024;
 const RRWEB_FULL_SNAPSHOT_EVENT_TYPE = 2;
+/** rrweb custom-event tag for captured console/window-error entries. */
+export const SESSION_REPLAY_CONSOLE_EVENT_TAG = "agent-native.console";
+/** rrweb custom-event tag for captured fetch/XHR request summaries. */
+export const SESSION_REPLAY_NETWORK_EVENT_TAG = "agent-native.network";
+const DEFAULT_MAX_CONSOLE_EVENTS = 1000;
+const DEFAULT_MAX_NETWORK_EVENTS = 2000;
+const MAX_CONSOLE_MESSAGE_LENGTH = 500;
+const MAX_CONSOLE_ARGS = 10;
+const MAX_CONSOLE_STACK_LENGTH = 2000;
+const MAX_CONSOLE_SERIALIZE_DEPTH = 4;
+const MAX_CONSOLE_SERIALIZE_ENTRIES = 20;
+/**
+ * Re-entrancy guard: true while the recorder itself is emitting custom events
+ * or flushing (synchronously) so the console/fetch/XHR wrappers never capture
+ * the recorder's own work and feed it back into the replay stream.
+ */
+let replayCaptureInternal = false;
+// Credential-looking token redaction for captured console/network text,
+// adapted from the clips template's browser-diagnostics redaction helper.
+const CAPTURE_SECRET_KEY_FRAGMENT = "(?:authorization|cookie|set[-_]?cookie|token|secret|password|passwd|pwd|api[-_]?key|apikey|session|credential)";
+const CAPTURE_AUTHORIZATION_SCHEME_RE = /\b(authorization)\b(\s*[:=]\s*)(?:bearer|basic)\s+[a-z0-9._~+/-]+=*/gi;
+const CAPTURE_BEARER_RE = /\b(bearer|basic)\s+[a-z0-9._~+/-]+=*/gi;
+const CAPTURE_DOUBLE_QUOTED_SECRET_RE = new RegExp(`(["']?)([A-Za-z0-9_$.-]*${CAPTURE_SECRET_KEY_FRAGMENT}[A-Za-z0-9_$.-]*)\\1(\\s*[:=]\\s*)"(?:[^"\\\\]|\\\\.)*"`, "gi");
+const CAPTURE_SINGLE_QUOTED_SECRET_RE = new RegExp(`(["']?)([A-Za-z0-9_$.-]*${CAPTURE_SECRET_KEY_FRAGMENT}[A-Za-z0-9_$.-]*)\\1(\\s*[:=]\\s*)'(?:[^'\\\\]|\\\\.)*'`, "gi");
+const CAPTURE_UNQUOTED_SECRET_RE = new RegExp(`(["']?)([A-Za-z0-9_$.-]*${CAPTURE_SECRET_KEY_FRAGMENT}[A-Za-z0-9_$.-]*)\\1(\\s*[:=]\\s*)([^"',\\s;}\\]]+)`, "gi");
+function redactCaptureText(value) {
+    return value
+        .replace(CAPTURE_AUTHORIZATION_SCHEME_RE, "$1$2<redacted>")
+        .replace(CAPTURE_BEARER_RE, "$1 <redacted>")
+        .replace(CAPTURE_DOUBLE_QUOTED_SECRET_RE, '$1$2$1$3"<redacted>"')
+        .replace(CAPTURE_SINGLE_QUOTED_SECRET_RE, "$1$2$1$3'<redacted>'")
+        .replace(CAPTURE_UNQUOTED_SECRET_RE, "$1$2$1$3<redacted>");
+}
 const URL_LIKE_KEYS = new Set([
     "url",
     "uri",
@@ -69,6 +102,8 @@ function getState() {
             stopRecorder: null,
             restoreUrlMonitor: null,
             removeLifecycleListeners: null,
+            addCustomEvent: null,
+            restoreCaptures: null,
             options: null,
             lastAuthenticatedProperties: null,
         };
@@ -319,9 +354,25 @@ function normalizeOptions(options) {
         collectFonts: options.collectFonts ?? false,
         inlineImages: options.inlineImages ?? false,
         eventSampling: options.eventSampling ?? DEFAULT_EVENT_SAMPLING,
+        console: normalizeCaptureToggle(options.console, DEFAULT_MAX_CONSOLE_EVENTS),
+        network: normalizeCaptureToggle(options.network, DEFAULT_MAX_NETWORK_EVENTS),
         extraProperties: options.extraProperties,
     };
 }
+/**
+ * Console/network capture default to ON whenever session replay records;
+ * `false` disables a category, an object form overrides its caps.
+ */
+function normalizeCaptureToggle(value, defaultMaxEvents) {
+    if (value === false)
+        return null;
+    const overrides = typeof value === "object" && value !== null ? value : {};
+    const maxEvents = typeof overrides.maxEvents === "number" &&
+        Number.isFinite(overrides.maxEvents)
+        ? Math.max(1, Math.floor(overrides.maxEvents))
+        : defaultMaxEvents;
+    return { maxEvents };
+}
 function scrubStringValue(key, value) {
     const lowerKey = key.toLowerCase();
     const isUrlKey = URL_LIKE_KEYS.has(key) || URL_LIKE_KEYS.has(lowerKey);
@@ -689,7 +740,16 @@ export async function flushSessionReplay(reason = "manual") {
         if (reservedSequence)
             rollbackReplaySequenceReservation(state, payload);
         restoreReplayEvents(state, events);
-        console.warn("[session-replay] upload failed", error);
+        // Guard the recorder's own warning so console capture never records it
+        // (a captured warning would enqueue an event and retrigger a flush).
+        const previousInternal = replayCaptureInternal;
+        replayCaptureInternal = true;
+        try {
+            console.warn("[session-replay] upload failed", error);
+        }
+        finally {
+            replayCaptureInternal = previousInternal;
+        }
     }
     finally {
         state.flushing = false;
@@ -746,6 +806,500 @@ function installLifecycleListeners(state) {
         state.removeLifecycleListeners = null;
     };
 }
+function truncateCaptureText(value, maxLength) {
+    return value.length > maxLength ? value.slice(0, maxLength) : value;
+}
+/** Circular-safe, depth/length-limited plain value for JSON.stringify. */
+function toCaptureSerializable(value, depth, seen) {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return value;
+    if (typeof value === "bigint")
+        return `${value}n`;
+    if (typeof value === "function")
+        return "[function]";
+    if (typeof value === "symbol")
+        return String(value);
+    if (value instanceof Error)
+        return `${value.name}: ${value.message}`;
+    if (typeof value !== "object")
+        return String(value);
+    if (seen.has(value))
+        return "[circular]";
+    if (depth >= MAX_CONSOLE_SERIALIZE_DEPTH) {
+        return Array.isArray(value) ? "[array]" : "[object]";
+    }
+    seen.add(value);
+    if (Array.isArray(value)) {
+        const items = value
+            .slice(0, MAX_CONSOLE_SERIALIZE_ENTRIES)
+            .map((item) => toCaptureSerializable(item, depth + 1, seen));
+        if (value.length > MAX_CONSOLE_SERIALIZE_ENTRIES)
+            items.push("[truncated]");
+        return items;
+    }
+    const out = {};
+    let count = 0;
+    for (const [key, child] of Object.entries(value)) {
+        if (count >= MAX_CONSOLE_SERIALIZE_ENTRIES) {
+            out["[truncated]"] = true;
+            break;
+        }
+        out[key] = toCaptureSerializable(child, depth + 1, seen);
+        count += 1;
+    }
+    return out;
+}
+function serializeConsoleArg(value) {
+    try {
+        if (typeof value === "string")
+            return value;
+        if (value instanceof Error)
+            return `${value.name}: ${value.message}`;
+        if (value === null ||
+            value === undefined ||
+            typeof value === "number" ||
+            typeof value === "boolean" ||
+            typeof value === "bigint") {
+            return String(value);
+        }
+        return (JSON.stringify(toCaptureSerializable(value, 0, new WeakSet())) ??
+            String(value));
+    }
+    catch {
+        try {
+            return Object.prototype.toString.call(value);
+        }
+        catch {
+            return "[unserializable]";
+        }
+    }
+}
+/**
+ * Emit an rrweb custom event while recording. Sets the re-entrancy guard so
+ * synchronous work triggered by the emit (enqueue -> flush -> fetch of the
+ * ingest endpoint) is never re-captured by the interceptors below.
+ */
+function emitReplayCustomEvent(state, tag, payload) {
+    const addCustomEvent = state.addCustomEvent;
+    if (!state.active || !addCustomEvent)
+        return;
+    const previous = replayCaptureInternal;
+    replayCaptureInternal = true;
+    try {
+        addCustomEvent(tag, payload);
+    }
+    catch {
+        // recorder already stopped -- drop the event
+    }
+    finally {
+        replayCaptureInternal = previous;
+    }
+}
+function captureCurrentUrl() {
+    try {
+        return scrubUrl(window.location.href);
+    }
+    catch {
+        return undefined;
+    }
+}
+const CAPTURE_CONSOLE_LEVELS = [
+    "log",
+    "info",
+    "warn",
+    "error",
+    "debug",
+];
+function installConsoleCapture(state, captureOptions) {
+    let emitted = 0;
+    let stopped = false;
+    let pending = null;
+    const emitPayload = (payload) => {
+        if (stopped)
+            return;
+        if (emitted >= captureOptions.maxEvents) {
+            stopped = true;
+            emitReplayCustomEvent(state, SESSION_REPLAY_CONSOLE_EVENT_TAG, {
+                level: "warn",
+                source: "console",
+                message: "session replay console capture truncated",
+                truncated: true,
+            });
+            return;
+        }
+        emitted += 1;
+        emitReplayCustomEvent(state, SESSION_REPLAY_CONSOLE_EVENT_TAG, payload);
+    };
+    /**
+     * The first occurrence of a message is emitted immediately; consecutive
+     * identical messages accumulate here and are flushed as one event whose
+     * `repeat` is the number of collapsed duplicates.
+     */
+    const flushPending = () => {
+        const entry = pending;
+        pending = null;
+        if (!entry || entry.repeat <= 0)
+            return;
+        emitPayload({ ...entry.payload, repeat: entry.repeat });
+    };
+    const capture = (level, source, args, stackOverride) => {
+        if (stopped || replayCaptureInternal)
+            return;
+        try {
+            const message = truncateCaptureText(redactCaptureText(args.length ? serializeConsoleArg(args[0]) : ""), MAX_CONSOLE_MESSAGE_LENGTH);
+            const extraArgs = args
+                .slice(1, 1 + MAX_CONSOLE_ARGS)
+                .map((arg) => truncateCaptureText(redactCaptureText(serializeConsoleArg(arg)), MAX_CONSOLE_MESSAGE_LENGTH));
+            const errorArg = args.find((arg) => arg instanceof Error);
+            const rawStack = stackOverride ?? errorArg?.stack;
+            const stack = typeof rawStack === "string" && rawStack
+                ? truncateCaptureText(redactCaptureText(rawStack), MAX_CONSOLE_STACK_LENGTH)
+                : undefined;
+            const url = captureCurrentUrl();
+            const payload = {
+                level,
+                source,
+                message,
+                ...(extraArgs.length ? { args: extraArgs } : {}),
+                ...(stack ? { stack } : {}),
+                ...(url ? { url } : {}),
+            };
+            const key = `${level}${source}${message}`;
+            if (pending && pending.key === key) {
+                pending.repeat += 1;
+                return;
+            }
+            flushPending();
+            emitPayload(payload);
+            pending = { key, payload, repeat: 0 };
+        }
+        catch {
+            // capture must never break the host page
+        }
+    };
+    const originals = {};
+    const wrappers = {};
+    for (const level of CAPTURE_CONSOLE_LEVELS) {
+        const original = console[level];
+        if (typeof original !== "function")
+            continue;
+        originals[level] = original;
+        const wrapper = (...args) => {
+            original.apply(console, args);
+            try {
+                capture(level, "console", args);
+            }
+            catch {
+                // never throw from the wrapper
+            }
+        };
+        wrappers[level] = wrapper;
+        console[level] = wrapper;
+    }
+    const onWindowError = (event) => {
+        try {
+            const error = event?.error;
+            capture("error", "window-error", [error instanceof Error ? error : (event?.message ?? "Error")], error instanceof Error ? error.stack : undefined);
+        }
+        catch {
+            // never throw from the listener
+        }
+    };
+    const onUnhandledRejection = (event) => {
+        try {
+            const reason = event?.reason;
+            capture("error", "unhandledrejection", [reason instanceof Error ? reason : reason], reason instanceof Error ? reason.stack : undefined);
+        }
+        catch {
+            // never throw from the listener
+        }
+    };
+    window.addEventListener("error", onWindowError);
+    window.addEventListener("unhandledrejection", onUnhandledRejection);
+    return () => {
+        try {
+            flushPending();
+        }
+        catch {
+            // best-effort duplicate flush
+        }
+        stopped = true;
+        for (const level of CAPTURE_CONSOLE_LEVELS) {
+            const original = originals[level];
+            // Restore only what we installed: if another library patched on top of
+            // our wrapper, leave the current function in place.
+            if (original && console[level] === wrappers[level]) {
+                console[level] = original;
+            }
+        }
+        window.removeEventListener("error", onWindowError);
+        window.removeEventListener("unhandledrejection", onUnhandledRejection);
+    };
+}
+function captureRequestUrl(input) {
+    if (typeof input === "string")
+        return input;
+    if (typeof URL !== "undefined" && input instanceof URL) {
+        return input.toString();
+    }
+    if (input && typeof input === "object" && "url" in input) {
+        const url = input.url;
+        if (typeof url === "string")
+            return url;
+    }
+    return "";
+}
+function captureRequestMethod(input, init) {
+    const initMethod = init?.method;
+    if (typeof initMethod === "string" && initMethod) {
+        return initMethod.toUpperCase();
+    }
+    if (input && typeof input === "object" && "method" in input) {
+        const method = input.method;
+        if (typeof method === "string" && method)
+            return method.toUpperCase();
+    }
+    return "GET";
+}
+/**
+ * Requests the recorder must never record: its own ingest endpoint and the
+ * core analytics tracking endpoint (either would create a flush -> event ->
+ * flush feedback loop), plus non-network schemes.
+ */
+function isCaptureExcludedUrl(rawUrl, ingestEndpoint) {
+    const trimmed = rawUrl.trim();
+    if (!trimmed)
+        return true;
+    const lower = trimmed.toLowerCase();
+    if (lower.startsWith("data:") ||
+        lower.startsWith("blob:") ||
+        lower.startsWith("about:")) {
+        return true;
+    }
+    try {
+        const resolved = new URL(trimmed, window.location.href);
+        const ingest = new URL(ingestEndpoint, window.location.href);
+        if (resolved.origin === ingest.origin &&
+            resolved.pathname === ingest.pathname) {
+            return true;
+        }
+        if (resolved.pathname.endsWith("/api/analytics/replay"))
+            return true;
+        if (resolved.pathname.endsWith("/api/analytics/track"))
+            return true;
+    }
+    catch {
+        // Unresolvable URL -- skip capture rather than risk recording junk.
+        return true;
+    }
+    return false;
+}
+function installNetworkCapture(state, captureOptions) {
+    const options = state.options;
+    if (!options)
+        return () => { };
+    const ingestEndpoint = options.endpoint;
+    let emitted = 0;
+    let stopped = false;
+    const emitPayload = (payload) => {
+        if (stopped)
+            return;
+        if (emitted >= captureOptions.maxEvents) {
+            stopped = true;
+            emitReplayCustomEvent(state, SESSION_REPLAY_NETWORK_EVENT_TAG, {
+                message: "session replay network capture truncated",
+                truncated: true,
+            });
+            return;
+        }
+        emitted += 1;
+        emitReplayCustomEvent(state, SESSION_REPLAY_NETWORK_EVENT_TAG, payload);
+    };
+    const recordRequest = (api, method, rawUrl, status, ok, durationMs, error) => {
+        if (stopped)
+            return;
+        try {
+            if (isCaptureExcludedUrl(rawUrl, ingestEndpoint))
+                return;
+            const absolute = new URL(rawUrl, window.location.href).toString();
+            const url = scrubUrl(absolute) ?? absolute;
+            emitPayload({
+                api,
+                method: method.toUpperCase(),
+                url,
+                status,
+                ok,
+                durationMs: Math.max(0, Math.round(durationMs)),
+                ...(error
+                    ? {
+                        error: truncateCaptureText(redactCaptureText(error), MAX_CONSOLE_MESSAGE_LENGTH),
+                    }
+                    : {}),
+            });
+        }
+        catch {
+            // capture must never break the host page
+        }
+    };
+    const restores = [];
+    if (typeof window.fetch === "function") {
+        const originalFetch = window.fetch;
+        const wrappedFetch = function (input, init) {
+            const self = this ?? window;
+            if (stopped || replayCaptureInternal) {
+                return originalFetch.call(self, input, init);
+            }
+            let method = "GET";
+            let url = "";
+            let skip = true;
+            try {
+                method = captureRequestMethod(input, init);
+                url = captureRequestUrl(input);
+                skip = isCaptureExcludedUrl(url, ingestEndpoint);
+            }
+            catch {
+                skip = true;
+            }
+            if (skip) {
+                return originalFetch.call(self, input, init);
+            }
+            const startedAt = performance.now();
+            // Call the original exactly as the page did; never read bodies, never
+            // replace the response, propagate rejections untouched.
+            const result = originalFetch.call(self, input, init);
+            if (!result || typeof result.then !== "function") {
+                return result;
+            }
+            return result.then((response) => {
+                try {
+                    recordRequest("fetch", method, url, response.status, response.ok, performance.now() - startedAt);
+                }
+                catch {
+                    // never affect the caller
+                }
+                return response;
+            }, (error) => {
+                try {
+                    recordRequest("fetch", method, url, 0, false, performance.now() - startedAt, error instanceof Error ? error.message : String(error));
+                }
+                catch {
+                    // never affect the caller
+                }
+                throw error;
+            });
+        };
+        window.fetch = wrappedFetch;
+        restores.push(() => {
+            // Restore only what we installed (another lib may have patched on top).
+            if (window.fetch === wrappedFetch) {
+                window.fetch = originalFetch;
+            }
+        });
+    }
+    if (typeof XMLHttpRequest !== "undefined" && XMLHttpRequest.prototype) {
+        const originalOpen = XMLHttpRequest.prototype.open;
+        const originalSend = XMLHttpRequest.prototype.send;
+        const xhrInfo = new WeakMap();
+        const wrappedOpen = function (method, url, async, username, password) {
+            try {
+                xhrInfo.set(this, { method: String(method), url: String(url) });
+            }
+            catch {
+                // never throw from the wrapper
+            }
+            return originalOpen.call(this, method, url, async ?? true, username, password);
+        };
+        const wrappedSend = function (body) {
+            try {
+                const info = xhrInfo.get(this);
+                if (info && !stopped && !replayCaptureInternal) {
+                    const startedAt = performance.now();
+                    let errorMessage;
+                    const markError = (message) => () => {
+                        errorMessage = message;
+                    };
+                    this.addEventListener("error", markError("XMLHttpRequest failed"), {
+                        once: true,
+                    });
+                    this.addEventListener("abort", markError("XMLHttpRequest aborted"), {
+                        once: true,
+                    });
+                    this.addEventListener("timeout", markError("XMLHttpRequest timed out"), { once: true });
+                    this.addEventListener("loadend", () => {
+                        const status = typeof this.status === "number" ? this.status : 0;
+                        recordRequest("xhr", info.method, info.url, errorMessage ? 0 : status, !errorMessage && status >= 200 && status < 300, performance.now() - startedAt, errorMessage);
+                        xhrInfo.delete(this);
+                    }, { once: true });
+                }
+            }
+            catch {
+                // never throw from the wrapper
+            }
+            return originalSend.call(this, body ?? null);
+        };
+        XMLHttpRequest.prototype.open =
+            wrappedOpen;
+        XMLHttpRequest.prototype.send =
+            wrappedSend;
+        restores.push(() => {
+            if (XMLHttpRequest.prototype.open ===
+                wrappedOpen) {
+                XMLHttpRequest.prototype.open = originalOpen;
+            }
+            if (XMLHttpRequest.prototype.send ===
+                wrappedSend) {
+                XMLHttpRequest.prototype.send = originalSend;
+            }
+        });
+    }
+    return () => {
+        stopped = true;
+        for (const restore of restores) {
+            try {
+                restore();
+            }
+            catch {
+                // best-effort restore
+            }
+        }
+    };
+}
+function installCaptureInterceptors(state) {
+    const options = state.options;
+    if (!options || state.restoreCaptures || !state.addCustomEvent)
+        return;
+    if (!options.console && !options.network)
+        return;
+    const restores = [];
+    try {
+        if (options.console) {
+            restores.push(installConsoleCapture(state, options.console));
+        }
+        if (options.network) {
+            restores.push(installNetworkCapture(state, options.network));
+        }
+    }
+    catch {
+        // keep whatever installed cleanly; restores below still uninstall it
+    }
+    if (restores.length === 0)
+        return;
+    state.restoreCaptures = () => {
+        state.restoreCaptures = null;
+        for (const restore of restores) {
+            try {
+                restore();
+            }
+            catch {
+                // best-effort restore
+            }
+        }
+    };
+}
 export async function startSessionReplay(options = {}) {
     if (options.enabled === false)
         return { started: false, reason: "disabled" };
@@ -873,6 +1427,11 @@ async function startSessionReplayRecorder(state, normalized, sessionId, sampled,
         state.maxDurationTimer = window.setTimeout(() => stopSessionReplay("max-duration"), normalized.maxDurationMs);
         installUrlMonitor(state);
         installLifecycleListeners(state);
+        state.addCustomEvent =
+            typeof rrweb.record.addCustomEvent === "function"
+                ? rrweb.record.addCustomEvent
+                : null;
+        installCaptureInterceptors(state);
         return {
             started: true,
             replayId: state.replayId,
@@ -881,6 +1440,14 @@ async function startSessionReplayRecorder(state, normalized, sessionId, sampled,
         };
     }
     catch {
+        try {
+            state.restoreCaptures?.();
+        }
+        catch {
+            // best-effort interceptor teardown
+        }
+        state.restoreCaptures = null;
+        state.addCustomEvent = null;
         state.active = false;
         state.options = null;
         state.replayId = null;
@@ -893,7 +1460,18 @@ export async function stopSessionReplay(reason = "manual") {
     const state = getState();
     if (!state.active)
         return;
+    // Restore console/fetch/XHR before tearing down the recorder: the restore
+    // flushes any pending collapsed console duplicate, which must still be able
+    // to emit through rrweb while it is recording.
+    try {
+        state.restoreCaptures?.();
+    }
+    catch {
+        // best-effort interceptor teardown
+    }
+    state.restoreCaptures = null;
     state.active = false;
+    state.addCustomEvent = null;
     try {
         state.stopRecorder?.();
     }