@analitikisler/ai-tag-debugger 0.22.2 → 0.22.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.22.3 (2026-11-04)
+
+- Runs can report a finding 0.22.2 did not on the same site (`widget_events_unshared`). A baseline written with 0.22.2 can then list new entries; `--update-baseline` rewrites it.
+- New **Embedded widgets** card under the inventory and a table in `report.md`: per third-party widget (a booking, chat or payment widget, a video), the pages it was embedded in, the containers it loaded, the tracking it sent to its own accounts and to the site's, the events and consent commands in its own dataLayer, and the events it pushed that never reached the site's accounts.
+- New check `widget_events_unshared` (info): a widget pushed events to its own dataLayer, such as a completed booking, that none of its hits to the site's accounts carried. The page's tags can't read a widget's dataLayer, so those conversions can be missing from the site's analytics and ad accounts.
+- MCP: the new `get_widgets` tool lists the embedded widgets an open audit's pages had so far. `finish_audit` and `run_audit` end with them, `get_report` returns them with `part: "widgets"`, and the JSON timeline lists a widget's dataLayer events per step under `widget_pushes`.
+
 ## 0.22.2 (2026-11-04)
 
 - Runs can report a finding 0.22.1 did not on the same site (`container_failed`). A baseline written with 0.22.1 can then list new entries; `--update-baseline` rewrites it.

package/README.md

@@ -335,6 +335,8 @@ Hits, dataLayer pushes, vendor calls and container loads sent from inside an ifr
 
 A widget's own hits are left out of everything that judges the site's tracking: plan matching, coverage, duplicates, unplanned events and the scores. A widget's `purchase` to its vendor's property can't pass for the site's, and its events aren't listed as the site's. They still count for consent and personal data, since the site answers for what the widgets it embeds collect; those findings begin with "In an embedded widget from …". Each widget that tracked is named once in a `widget_tracking` (info) finding with its accounts and events, and a container running in a same-site iframe beside one in the page is noted as `iframe_container` (info): the page's dataLayer pushes and consent never reach it. A widget's dataLayer pushes are kept apart too, so its consent commands don't stand in for the site's.
 
+Each widget also gets a line in the **Embedded widgets** card under the inventory and a table in `report.md`: the pages it was embedded in, the containers it loaded itself, the tracking it sent to its own accounts and to the site's, and the events and consent commands in its own dataLayer. The page's tags can't read a widget's dataLayer, so an event the widget pushed there (a `booking_complete`, say) reaches the site's accounts only if the widget sends it to them. The events no hit to the site's accounts carried are listed as not sent, and reported as `widget_events_unshared` (info): a booking or payment completed in the widget can be missing from the site's analytics and ad accounts.
+
 `capture.json` keeps the widget's hits under `widgetHits` and its pushes under `widgetDataLayerLog`, and every iframe entry has a `frame`. The Google containers card says which ran in an iframe. Over MCP, step results mark each hit from an iframe and whether the plan checks will count it, pushes from an iframe are prefixed with it, and the JSON timeline lists a widget's hits per step under `widget_hits`. Captures from older versions have no frames, so all of their hits stay the site's.
 
 ### Folder layout and plan IDs
@@ -666,7 +668,8 @@ Tools the server offers:
 | `finish_audit` | Checks everything against your measurement plan (JSON), a saved one given as `against` (`latest`, `first`, a plan ID, or on a local server a path), or the ready-made journey's events, optionally only the `events` you name, and writes the full HTML report with the timeline. The site comes from the audit. The result ends with a compact JSON timeline, one entry per step: the hits with their consent, consent commands, other tracking calls, the Google tag's consent when it changed, and the cookies and ids that changed. |
 | `consent_matrix` | Opens a site's start page like an ad click once per consent choice (no choice and on to the next page, accept all, reject all, analytics only), each in a fresh browser, and returns which tags sent after each choice and the [consent matrix](#consent-scenarios). `campaign` takes the campaign parameters to check (as in `start_audit`), `concurrency` how many choices run at once (default 2, at most 4). About half a minute. |
 | `get_containers` | Lists every GTM container and Google tag the open audit's pages loaded so far, with how each reached the page (see [Google containers](#google-containers)), its dataLayer, host, GTM environment and the step it loaded at, as text and JSON. |
-| `get_report` | Reads a report this server wrote, by the name `finish_audit` or `run_audit` gave: `part` `markdown` (default, `report.md`), `summary` (`summary.json`), `timeline` (the JSON timeline of every journey, with the containers each step loaded) or `containers` (every Google container with how it reached the page, as JSON). Only this server's own reports, over HTTP too. |
+| `get_widgets` | Lists every embedded third-party widget the open audit's pages had so far (see [Embedded widgets and iframes](#embedded-widgets-and-iframes)): where it was embedded, its containers, the tracking it sent to its own accounts and to the site's, its own dataLayer events, and the events that never reached the site's accounts, as text and JSON. |
+| `get_report` | Reads a report this server wrote, by the name `finish_audit` or `run_audit` gave: `part` `markdown` (default, `report.md`), `summary` (`summary.json`), `timeline` (the JSON timeline of every journey, with the containers each step loaded) `containers` (every Google container with how it reached the page, as JSON) or `widgets` (every embedded widget with its tracking and dataLayer events, as JSON). Only this server's own reports, over HTTP too. |
 | `run_audit` | Runs a config file end to end. With `against`, it checks the run against a saved plan and, when the config has no journeys, walks the journeys derived from that plan. `concurrency` runs that many journeys at once, each in its own browser (default 1), and `baseline` names a file of accepted findings written with `--update-baseline` (default: the config's `baseline`; see [Accept known findings](#accept-known-findings)). Local only for file paths. |
 
 `against` takes the same values as the CLI's `--against`. Over HTTP it takes only `latest`, `first` or a plan ID, never a path. Plans are the ones saved by `aitd plan --site <url>` or by `make_plan`. Ask for a plan when you want to know what to track, and for an audit when you want to know what the site sends.

package/README.tr.md

@@ -335,6 +335,8 @@ Bir iframe içinden gönderilen istekler, dataLayer push'ları, sağlayıcı ça
 
 Bir widget'ın kendi istekleri, sitenin izlemesini değerlendiren her şeyin dışında tutulur: plan eşleştirme, kapsam, tekrarlar, planda olmayan olaylar ve puanlar. Widget'ın sağlayıcısının mülküne giden bir `purchase` sitenin yerine geçemez ve olayları sitenin olayları olarak listelenmez. Yine de onay ve kişisel veri için sayılırlar, çünkü site gömdüğü widget'ların topladıklarından sorumludur; bu bulgular "… kaynaklı gömülü bir widget içinde:" ile başlar. İzleme yapan her widget, hesapları ve olaylarıyla bir kez `widget_tracking` (bilgi) bulgusunda adlandırılır; sayfadakinin yanında aynı sitedeki bir iframe'de çalışan container ise `iframe_container` (bilgi) olarak not edilir: sayfanın dataLayer push'ları ve onayı ona hiç ulaşmaz. Widget'ın dataLayer push'ları da ayrı tutulur, böylece onay komutları sitenin komutlarının yerine geçmez.
 
+Her widget ayrıca envanterin altındaki **Gömülü widget'lar** kartında bir satır, `report.md` içinde de bir tablo alır: gömülü olduğu sayfalar, kendi yüklediği container'lar, kendi hesaplarına ve sitenin hesaplarına gönderdiği izleme ve kendi dataLayer'ındaki olaylar ve onay komutları. Sayfanın etiketleri bir widget'ın dataLayer'ını okuyamaz; bu yüzden widget'ın oraya gönderdiği bir olay (örneğin `booking_complete`) sitenin hesaplarına ancak widget onu oraya gönderirse ulaşır. Sitenin hesaplarına giden hiçbir isteğin taşımadığı olaylar gönderilmemiş olarak listelenir ve `widget_events_unshared` (bilgi) olarak bildirilir: widget içinde tamamlanan bir rezervasyon ya da ödeme sitenin analitik ve reklam hesaplarında eksik kalabilir.
+
 `capture.json` widget'ın isteklerini `widgetHits`, push'larını `widgetDataLayerLog` altında saklar ve her iframe kaydında bir `frame` bulunur. Google container'ları kartı hangilerinin bir iframe'de çalıştığını söyler. MCP'de adım sonuçları iframe'den gelen her isteği ve plan kontrollerinin onu sayıp saymayacağını işaretler, iframe'den gelen push'ların başına iframe yazılır ve JSON zaman akışı bir widget'ın isteklerini adım adım `widget_hits` altında listeler. Eski sürümlerin kayıtlarında frame bilgisi yoktur, bu yüzden tüm istekleri sitenin olarak kalır.
 
 ### Klasör yapısı ve plan kimlikleri
@@ -666,7 +668,8 @@ Sunucunun sunduğu araçlar:
 | `finish_audit` | Her şeyi ölçümleme planınıza (JSON) ya da `against` olarak verilen kayıtlı bir plana (`latest`, `first`, bir plan kimliği ya da yerel bir sunucuda bir yol) ya da hazır yolculuğun event'lerine karşı kontrol eder; isterseniz yalnızca adını verdiğiniz `events` için, ve zaman akışıyla birlikte tam HTML raporunu yazar. Site denetimden alınır. Sonuç, adım başına bir kayıt içeren kısa bir JSON zaman akışıyla biter: onay durumlarıyla istekler, onay komutları, diğer takip çağrıları, değiştiğinde Google etiketinin onay durumu, değişen çerezler ve kimlikler. |
 | `consent_matrix` | Bir sitenin başlangıç sayfasını her onay seçimi için (seçim yapmadan sonraki sayfa, tümünü kabul, tümünü reddet, yalnızca analitik) bir reklam tıklaması gibi, her seferinde yeni bir tarayıcıda açar; her seçimden sonra hangi etiketlerin gönderdiğini ve [onay matrisini](#onay-senaryoları) döndürür. `campaign` kontrol edilecek kampanya parametrelerini (`start_audit`'teki gibi), `concurrency` aynı anda kaç seçimin çalışacağını alır (varsayılan 2, en fazla 4). Yaklaşık yarım dakika sürer. |
 | `get_containers` | Açık denetimin sayfalarının şimdiye kadar yüklediği her GTM container'ını ve Google etiketini, her birinin sayfaya nasıl geldiğiyle ([Google container'ları](#google-containerları)), dataLayer'ı, sunucusu, GTM ortamı ve yüklendiği adımla birlikte metin ve JSON olarak listeler. |
-| `get_report` | Bu sunucunun yazdığı bir raporu, `finish_audit` ya da `run_audit`'in verdiği adla okur: `part` `markdown` (varsayılan, `report.md`), `summary` (`summary.json`), `timeline` (her yolculuğun JSON zaman akışı; her adımın yüklediği container'larla) ya da `containers` (sayfaya nasıl geldiğiyle her Google container'ı, JSON olarak). Yalnızca bu sunucunun kendi raporları, HTTP üzerinden de. |
+| `get_widgets` | Açık denetimin sayfalarında şimdiye kadar bulunan her gömülü üçüncü taraf widget'ı ([Gömülü widget'lar ve iframe'ler](#gömülü-widgetlar-ve-iframeler)) listeler: gömülü olduğu yer, container'ları, kendi hesaplarına ve sitenin hesaplarına gönderdiği izleme, kendi dataLayer olayları ve sitenin hesaplarına hiç ulaşmayan olaylar; metin ve JSON olarak. |
+| `get_report` | Bu sunucunun yazdığı bir raporu, `finish_audit` ya da `run_audit`'in verdiği adla okur: `part` `markdown` (varsayılan, `report.md`), `summary` (`summary.json`), `timeline` (her yolculuğun JSON zaman akışı; her adımın yüklediği container'larla) `containers` (sayfaya nasıl geldiğiyle her Google container'ı, JSON olarak) ya da `widgets` (izlemesi ve dataLayer olaylarıyla her gömülü widget, JSON olarak). Yalnızca bu sunucunun kendi raporları, HTTP üzerinden de. |
 | `run_audit` | Bir ayar dosyasını baştan sona çalıştırır. `against` ile çalıştırmayı kayıtlı bir plana karşı kontrol eder; ayar dosyasında yolculuk yoksa, plandan türetilen yolculukları gezer. `concurrency` o kadar yolculuğu aynı anda, her birini kendi tarayıcısında çalıştırır (varsayılan 1); `baseline`, `--update-baseline` ile yazılmış kabul edilen bulgular dosyasını adlandırır (varsayılan: ayar dosyasındaki `baseline`; bkz. [Bilinen bulguları kabul edin](#bilinen-bulguları-kabul-edin)). Dosya yolları yalnızca yerelde çalışır. |
 
 `against`, CLI'deki `--against` ile aynı değerleri alır. HTTP üzerinden yalnızca `latest`, `first` ya da bir plan kimliği kabul edilir, asla bir yol değil. Planlar, `aitd plan --site <url>` ya da `make_plan` ile kaydedilmiş olanlardır. Neyin takip edileceğini öğrenmek için plan, sitenin ne gönderdiğini öğrenmek için denetim isteyin.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
   "mcpName": "io.github.analitikisler/ai-tag-debugger",
-  "version": "0.22.2",
+  "version": "0.22.3",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/checks.js

@@ -6,7 +6,7 @@ import { isOwnAddress } from "./redact.js";
 import { campaignParamsIn } from "./campaign.js";
 import { CONSENT_SIGNALS } from "./parsers.js";
 import { duplicateLoads, loadSources, scriptFailed, splitLayers } from "./containers.js";
-import { widgetsOf } from "./frames.js";
+import { widgetSummaries, widgetsOf } from "./frames.js";
 
 const platformName = (p) => ({ meta: "Meta", tiktok: "TikTok" })[p] ?? p;
 const NON_GOOGLE_AD_PLATFORMS = new Set(["meta", "tiktok"]);
@@ -399,6 +399,10 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     const first = (run.widgetHits ?? []).find((h) => h.frame.origin === w.origin);
     findings.push({ ...base, severity: "info", check: "widget_tracking", step: stepLabel(first.step), detail: d.widgetTracking(w.origin, w.platforms) });
   }
+  // Events a widget pushed to its own dataLayer that never reached the site's accounts: the page's tags can't see them.
+  for (const w of widgetSummaries([run], (a, b) => canonicalEvent(a) === canonicalEvent(b)).filter((x) => x.unshared.length)) {
+    findings.push({ ...base, severity: "info", check: "widget_events_unshared", step: stepLabel(w.step), detail: d.widgetEventsUnshared(w.origin, w.unshared.slice(0, 10)) });
+  }
   // A container in a same-site iframe beside one in the page: two documents, two dataLayers.
   const iframeLoad = loads.find((l) => l.frame?.party === "site" && loads.some((t) => !t.frame && t.step <= l.step));
   if (iframeLoad) findings.push({ ...base, severity: "info", check: "iframe_container", step: stepLabel(iframeLoad.step), detail: d.iframeContainer(iframeLoad.id, iframeLoad.frame.origin, iframeLoad.frame.parent) });

package/src/frames.js

@@ -88,3 +88,69 @@ export function widgetsOf(widgetHits = []) {
     platforms: [...w.platforms.values()].map((p) => ({ platform: p.platform, ids: [...p.ids], events: [...p.events] })),
   }));
 }
+
+/** The event a dataLayer push names, { event: "x" } or gtag's ["event", "x", ...], or null. GTM's own (gtm.js, gtm.dom...) are left out. */
+export function pushedEvent(value) {
+  const name = Array.isArray(value) ? (value[0] === "event" ? value[1] : null) : value?.event;
+  return typeof name === "string" && name && !name.startsWith("gtm.") ? name : null;
+}
+
+const plainName = (n) => String(n).toLowerCase().replace(/[^a-z0-9]/g, "");
+const isConsentPush = (v) => Array.isArray(v) && v[0] === "consent";
+
+/**
+ * One summary per embedded widget (third-party iframe origin) across runs: { origin, parents, containers,
+ * own, shared, pushes, unshared, step }.
+ * - parents: the pages it was embedded in; containers: [{ id, script }] it loaded itself
+ * - own: [{ platform, id, events }] it sent to its own accounts; shared: the same for what it sent to the site's
+ * - pushes: { total, consent, events: [{ name, count }] } of its own dataLayer
+ * - unshared: the events it pushed that none of its hits to the site's accounts carried
+ * - step: the first step it was seen at, in the first run it was seen in
+ * same(a, b) compares event names; checks.js passes canonicalEvent so add_to_cart and addToCart are one event.
+ */
+export function widgetSummaries(runs, same = (a, b) => plainName(a) === plainName(b)) {
+  const byOrigin = new Map();
+  const of = (frame, step) => {
+    const w = byOrigin.get(frame.origin) ?? {
+      origin: frame.origin, parents: new Set(), containers: new Map(), own: new Map(), shared: new Map(),
+      total: 0, consent: 0, events: new Map(), step,
+    };
+    if (frame.parent) w.parents.add(frame.parent);
+    byOrigin.set(frame.origin, w);
+    return w;
+  };
+  const addHit = (map, h) => {
+    const k = `${h.platform}|${h.id ?? ""}`;
+    const e = map.get(k) ?? { platform: h.platform, ...(h.id ? { id: h.id } : {}), events: new Set() };
+    e.events.add(h.name);
+    map.set(k, e);
+  };
+  for (const run of runs) {
+    for (const l of run.containerLoads ?? []) if (l.frame?.party === "third") of(l.frame, l.step).containers.set(l.id, { id: l.id, script: l.script });
+    for (const h of run.widgetHits ?? []) addHit(of(h.frame, h.step).own, h);
+    for (const h of run.hits ?? []) if (h.frame?.party === "third") addHit(of(h.frame, h.step).shared, h);
+    for (const e of run.widgetDataLayerLog ?? []) {
+      if (!e.frame) continue;
+      const w = of(e.frame, e.step);
+      w.total++;
+      if (isConsentPush(e.value)) w.consent++;
+      const name = pushedEvent(e.value);
+      if (name) w.events.set(name, (w.events.get(name) ?? 0) + 1);
+    }
+  }
+  const list = (map) => [...map.values()].map((e) => ({ ...e, events: [...e.events] }));
+  return [...byOrigin.values()].map((w) => {
+    const shared = list(w.shared);
+    const sent = shared.flatMap((e) => e.events);
+    return {
+      origin: w.origin,
+      parents: [...w.parents].sort(),
+      containers: [...w.containers.values()],
+      own: list(w.own),
+      shared,
+      pushes: { total: w.total, consent: w.consent, events: [...w.events].map(([name, count]) => ({ name, count })) },
+      unshared: [...w.events.keys()].filter((name) => !sent.some((s) => same(s, name))),
+      step: w.step,
+    };
+  });
+}

package/src/html/scope.js

@@ -4,6 +4,8 @@
 // vendors, the trend) is the 0.17 renderer's, so the numbers match the Markdown report and the CLI.
 import { buildInventory } from "../inventory.js";
 import { containerRows } from "../containers.js";
+import { widgetSummaries } from "../frames.js";
+import { canonicalEvent } from "../checks.js";
 import { providerOf } from "../parsers.js";
 import { siteOf } from "../redact.js";
 import { VERSION, BUCKET_ORDER, coverageLines, pcSort, planChangeItems, routeList } from "../report-shared.js";
@@ -205,13 +207,35 @@ function containersCard(ctx) {
   return `<li><details class="card inv" id="inv-containers"><summary><span class="t">${esc(m.ui.containersTitle)}</span>${plain(n(ids.length))}<span class="inv-m">${esc(ids.slice(0, 3).join(", "))}${ids.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.containersIntro)}</p><ul class="inv-list">${items}</ul></div></details></li>`;
 }
 
+/** The embedded widgets card: per third-party iframe, where it was embedded, its containers, its tracking and its dataLayer. Null when none. */
+function widgetsCard(ctx) {
+  const { m, runs } = ctx;
+  const widgets = widgetSummaries(runs, (a, b) => canonicalEvent(a) === canonicalEvent(b));
+  if (!widgets.length) return null;
+  const w = m.ui.widgets;
+  const line = (label, html) => `<li><span class="inv-n">${esc(label)}</span>${html}</li>`;
+  const hits = (list) => (list.length ? list.map((e) => code(w.hits(e.platform, e.id, e.events))).join(" ") : `<span class="muted xs">${esc(w.none)}</span>`);
+  const items = widgets.map((x) => {
+    const events = x.pushes.events.map((e) => code(w.event(e.name, e.count))).join(" ");
+    return `<li><details class="card inv"><summary><code>${esc(x.origin)}</code>${plain(esc(w.pushes(x.pushes.total, x.pushes.consent)))}${x.unshared.length ? badge("info", `${m.ui.widgets.unshared}: ${x.unshared.length}`) : ""}</summary><div class="body"><ul class="inv-list">
+${line(m.ui.embeddedCol, x.parents.map((p) => `${use("ui-page", 13)}<code>${esc(p)}</code>`).join(" ") || `<span class="muted xs">${esc(w.none)}</span>`)}
+${line(w.containers, x.containers.length ? x.containers.map((c) => code(c.id)).join(" ") : `<span class="muted xs">${esc(w.none)}</span>`)}
+${line(m.ui.ownCol, hits(x.own))}
+${line(m.ui.sharedCol, hits(x.shared))}
+${line(m.ui.pushesCol, events || `<span class="muted xs">${esc(w.none)}</span>`)}
+${x.unshared.length ? line(w.unshared, x.unshared.map(code).join(" ")) : ""}</ul></div></details></li>`;
+  }).join("");
+  return `<li><details class="card inv" id="inv-widgets"><summary><span class="t">${esc(m.ui.widgetsTitle)}</span>${plain(n(widgets.length))}<span class="inv-m">${esc(widgets.slice(0, 3).map((x) => x.origin.replace(/^https?:\/\//, "")).join(", "))}${widgets.length > 3 ? " …" : ""}</span></summary><div class="body"><p class="xs muted">${esc(m.ui.widgetsIntro)}</p><ul class="inv-rows">${items}</ul></div></details></li>`;
+}
+
 function inventorySection(ctx) {
   const { m, runs } = ctx;
   const t = m.html.scope;
   const { lines, otherCookies } = inventoryLines(ctx);
   const skipped = skippedTotals(runs);
   const containers = containersCard(ctx);
-  if (!lines.length && !skipped.length && !containers) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
+  const widgets = widgetsCard(ctx);
+  if (!lines.length && !skipped.length && !containers && !widgets) return sectionBlock("inventory", esc(m.html.shell.sections.inventory), `<p class="muted">${esc(m.ui.noInventory)}</p>`);
   const counts = (x) => `<span class="inv-m">${t.requests(x.requests, bold(x.requests))}</span><span class="inv-m">${t.pages(x.pages.size, bold(x.pages.size))}</span><span class="inv-m${x.cookies.length ? "" : " zero"}">${t.cookies(x.cookies.length, bold(x.cookies.length))}</span>`;
   const out = lines.map((x) => {
     const id = `inv-${safeKey(x.p)}`;
@@ -227,6 +251,7 @@ function inventorySection(ctx) {
 <div role="tabpanel" id="${tid("pages")}" data-label="${esc(m.ui.pagesCol)}">${pages ? `<ul class="inv-list">${pages}</ul>` : none}</div>
 <div role="tabpanel" id="${tid("cookies")}" data-label="${esc(m.ui.cookiesCol)}">${x.cookies.length ? `<ul class="inv-list">${x.cookies.map((ck) => `<li>${code(ck)}</li>`).join("")}</ul>` : none}</div></div></div></details></li>`;
   });
+  if (widgets) out.unshift(widgets);
   if (containers) out.unshift(containers);
   const skippedN = skipped.reduce((a, [, k]) => a + k, 0);
   if (skipped.length) {

package/src/i18n.js

@@ -210,6 +210,21 @@ const en = {
     layerCol: "dataLayer",
     servedCol: "Served from",
     scriptCol: "Version and size",
+    widgetsTitle: "Embedded widgets",
+    widgetsIntro: "Third-party iframes on the site's pages, such as booking, chat or payment widgets: the containers they loaded, the tracking they sent to their own accounts and to the site's, and the events in their own dataLayer, which the page's tags never see.",
+    widgetCol: "Widget",
+    embeddedCol: "Embedded in",
+    ownCol: "Own tracking",
+    sharedCol: "To the site's accounts",
+    pushesCol: "dataLayer events",
+    widgets: {
+      containers: "Containers",
+      unshared: "Not sent to the site's accounts",
+      pushes: (n, consent) => `${n} ${n === 1 ? "push" : "pushes"}${consent ? `, ${consent} consent ${consent === 1 ? "command" : "commands"}` : ""}`,
+      event: (name, count) => (count > 1 ? `${name} ×${count}` : name),
+      hits: (platform, id, events) => `${label(platform)}${id ? ` ${id}` : ""}: ${events.join(", ")}`,
+      none: "none",
+    },
     containers: {
       script: { gtm: "GTM container", gtag: "Google tag" },
       served: { google: "Google", site: "The site's own domain" },
@@ -360,6 +375,7 @@ const en = {
     widgetTracking: (origin, platforms) => `An embedded widget from ${origin} sent its own tracking: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. It goes to accounts the site's own tags don't use, so it was left out of the plan, coverage and duplicate checks; the consent and personal data checks still include it.`,
     iframeContainer: (id, origin, parent) => `${id} runs in an iframe from ${origin} embedded in ${parent}. The iframe has its own dataLayer: events and consent commands pushed in the page never reach it, so it needs its own.`,
     containerFailed: (id, host, status) => `The ${id} script from ${host} ${status === "failed" ? "failed to load" : `was answered with HTTP ${status}`}, so none of its tags ran on that page.`,
+    widgetEventsUnshared: (origin, names) => `An embedded widget from ${origin} pushed ${names.map(q).join(", ")} to its own dataLayer, but none of its hits to the site's accounts carried ${names.length === 1 ? "it" : "them"}. The page's tags can't read a widget's dataLayer, so ${names.length === 1 ? "this event reaches" : "these events reach"} only the widget's own tracking.`,
     consentDefaultMissing: () => "No Google Consent Mode default command (gtag('consent', 'default', ...)) was found in the dataLayer.",
     consentDefaultLate: () => "The Consent Mode default was set after the first tracking hit was sent.",
     consentDefaultNotApplied: () => "The page pushed a Consent Mode default, but the Google tag never applied it, so its tags ran without one. Tag Assistant shows Consent Mode as not configured.",
@@ -422,6 +438,7 @@ const en = {
     widget_tracking: "Nothing is wrong with the site's tracking: the widget's own hits were kept out of the plan checks so they can't pass for the site's.",
     iframe_container: "Tags in the iframe miss what the page pushes, so conversions completed in it can go untracked or be sent without the visitor's consent.",
     container_failed: "None of the container's tags ran: page views, conversions and consent signals it sends were all lost on that page.",
+    widget_events_unshared: "Conversions completed in the widget, such as a booking, a payment or a form, can be missing from the site's analytics and ad accounts.",
     campaign_params: "Campaign parameters survived the landing redirect and reached the hits, so paid clicks are credited to their campaigns.",
     event_id_reused: "Two different events share one event ID, so the platform keeps the first and silently drops the other: a real event is lost.",
     event_id_mismatch: "The browser and server copies of this event carry different IDs, so Meta cannot pair them and counts the conversion twice.",
@@ -471,6 +488,7 @@ const en = {
     widget_tracking: "Nothing to fix for the plan. If the widget sets cookies or sends data before consent, the consent findings name it; ask its vendor how to hold it back.",
     iframe_container: "Push the events and the consent state inside the iframe as well (or pass them in with postMessage), or track the iframe's steps from the page.",
     container_failed: "Check the container ID and the address in the snippet; for a server container or the Google tag gateway, check that it serves gtm.js and gtag/js.",
+    widget_events_unshared: "If the site needs these events, have the widget send them to the site's accounts (most booking and form widgets take a GA4 or GTM ID), or pass them to the page with postMessage and push them to the page's dataLayer.",
     campaign_params: "Nothing to fix. Check the redirects again when the landing pages change.",
     event_id_reused: "Generate a new event ID for every event, not once per page load.",
     event_id_mismatch: "Use one event ID for the pixel event and the server copy: pass the same value to both tags.",
@@ -520,6 +538,7 @@ const en = {
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
     container_failed: "money",
+    widget_events_unshared: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",
@@ -1046,6 +1065,21 @@ const tr = {
     layerCol: "dataLayer",
     servedCol: "Sunulduğu yer",
     scriptCol: "Sürüm ve boyut",
+    widgetsTitle: "Gömülü widget'lar",
+    widgetsIntro: "Sitenin sayfalarındaki üçüncü taraf iframe'ler, örneğin rezervasyon, sohbet ya da ödeme widget'ları: yükledikleri container'lar, kendi hesaplarına ve sitenin hesaplarına gönderdikleri izleme ve sayfanın etiketlerinin hiç görmediği kendi dataLayer'larındaki olaylar.",
+    widgetCol: "Widget",
+    embeddedCol: "Gömülü olduğu yer",
+    ownCol: "Kendi izlemesi",
+    sharedCol: "Sitenin hesaplarına",
+    pushesCol: "dataLayer olayları",
+    widgets: {
+      containers: "Container'lar",
+      unshared: "Sitenin hesaplarına gönderilmeyen",
+      pushes: (n, consent) => `${n} push${consent ? `, ${consent} onay komutu` : ""}`,
+      event: (name, count) => (count > 1 ? `${name} ×${count}` : name),
+      hits: (platform, id, events) => `${label(platform)}${id ? ` ${id}` : ""}: ${events.join(", ")}`,
+      none: "yok",
+    },
     containers: {
       script: { gtm: "GTM container'ı", gtag: "Google etiketi" },
       served: { google: "Google", site: "Sitenin kendi alan adı" },
@@ -1192,6 +1226,7 @@ const tr = {
     widgetTracking: (origin, platforms) => `${origin} kaynaklı gömülü bir widget kendi izlemesini gönderdi: ${platforms.map((p) => `${label(p.platform)}${p.ids.length ? ` (${p.ids.join(", ")})` : ""} ${p.events.map(q).join(", ")}`).join("; ")}. Bunlar sitenin kendi etiketlerinin kullanmadığı hesaplara gidiyor; bu yüzden plan, kapsam ve tekrar kontrollerinin dışında tutuldu, onay ve kişisel veri kontrolleri ise onları yine içeriyor.`,
     iframeContainer: (id, origin, parent) => `${id}, ${parent} içine gömülü ${origin} kaynaklı bir iframe içinde çalışıyor. iframe'in kendi dataLayer'ı var: sayfada gönderilen olaylar ve onay komutları ona hiç ulaşmaz, bu yüzden kendi olaylarına ve onayına ihtiyacı var.`,
     containerFailed: (id, host, status) => `${host} adresinden gelen ${id} betiği ${status === "failed" ? "yüklenemedi" : `HTTP ${status} ile yanıtlandı`}; bu yüzden o sayfada etiketlerinin hiçbiri çalışmadı.`,
+    widgetEventsUnshared: (origin, names) => `${origin} kaynaklı gömülü bir widget kendi dataLayer'ına ${names.map(q).join(", ")} gönderdi, ancak sitenin hesaplarına giden isteklerinin hiçbiri ${names.length === 1 ? "onu" : "onları"} taşımadı. Sayfanın etiketleri bir widget'ın dataLayer'ını okuyamaz; bu yüzden ${names.length === 1 ? "bu olay" : "bu olaylar"} yalnızca widget'ın kendi izlemesine ulaşıyor.`,
     consentDefaultMissing: () => "dataLayer'da Google Consent Mode varsayılan komutu (gtag('consent', 'default', ...)) bulunamadı.",
     consentDefaultLate: () => "Consent Mode varsayılanı, ilk izleme isteği gönderildikten sonra ayarlandı.",
     consentDefaultNotApplied: () => "Sayfa bir Consent Mode varsayılanı gönderdi, ancak Google etiketi onu hiç uygulamadı; etiketleri varsayılan olmadan çalıştı. Tag Assistant, Consent Mode'u yapılandırılmamış gösterir.",
@@ -1253,6 +1288,7 @@ const tr = {
     widget_tracking: "Sitenin izlemesinde bir sorun yok: widget'ın kendi istekleri sitenin isteklerinin yerine geçmesin diye plan kontrollerinin dışında tutuldu.",
     iframe_container: "iframe içindeki etiketler sayfanın gönderdiklerini görmez; içinde tamamlanan dönüşümler izlenmeyebilir ya da ziyaretçinin onayı olmadan gönderilebilir.",
     container_failed: "Container'ın etiketlerinin hiçbiri çalışmadı: gönderdiği sayfa görüntülemeleri, dönüşümler ve onay sinyalleri o sayfada kayboldu.",
+    widget_events_unshared: "Widget içinde tamamlanan dönüşümler, örneğin bir rezervasyon, ödeme ya da form, sitenin analitik ve reklam hesaplarında eksik kalabilir.",
     campaign_params: "Kampanya parametreleri açılış yönlendirmesinden geçip isteklere ulaştı; ücretli tıklamalar kendi kampanyalarına yazılıyor.",
     event_id_reused: "İki farklı olay tek bir olay kimliğini paylaşıyor; platform ilkini tutup diğerini sessizce atıyor, gerçek bir olay kayboluyor.",
     event_id_mismatch: "Bu olayın tarayıcı ve sunucu kopyaları farklı kimlik taşıyor; Meta ikisini eşleştiremiyor ve dönüşümü iki kez sayıyor.",
@@ -1300,6 +1336,7 @@ const tr = {
     widget_tracking: "Plan için düzeltilecek bir şey yok. Widget onaydan önce çerez yazıyor ya da veri gönderiyorsa onay bulguları onu adlandırır; nasıl durdurulacağını sağlayıcısına sorun.",
     iframe_container: "Olayları ve onay durumunu iframe içinde de gönderin (ya da postMessage ile iletin) veya iframe'deki adımları sayfadan izleyin.",
     container_failed: "Snippet'teki container kimliğini ve adresi kontrol edin; sunucu container'ı ya da Google etiket ağ geçidi için gtm.js ve gtag/js sunduğunu kontrol edin.",
+    widget_events_unshared: "Site bu olaylara ihtiyaç duyuyorsa widget'ın onları sitenin hesaplarına göndermesini sağlayın (çoğu rezervasyon ve form widget'ı bir GA4 ya da GTM kimliği kabul eder) ya da onları postMessage ile sayfaya iletip sayfanın dataLayer'ına gönderin.",
     campaign_params: "Düzeltilecek bir şey yok. Açılış sayfaları değiştiğinde yönlendirmeleri yeniden kontrol edin.",
     event_id_reused: "Her olay için yeni bir olay kimliği üretin; sayfa yüklemesi başına bir kez değil.",
     event_id_mismatch: "Piksel olayı ve sunucu kopyası için tek bir olay kimliği kullanın: aynı değeri iki etikete de verin.",
@@ -1348,6 +1385,7 @@ const tr = {
     widget_tracking: "hygiene",
     iframe_container: "hygiene",
     container_failed: "money",
+    widget_events_unshared: "money",
     campaign_params: "money",
     event_id_reused: "money",
     event_id_mismatch: "money",

package/src/mcp.js

@@ -17,7 +17,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { AuditSession } from "./browser.js";
 import { navigationError, privateHostChecker } from "./guard.js";
 import { collect, pageView, SYSTEM_PROMPT } from "./agent.js";
-import { checkRun, groupFindings, isConsentCommand, summarize } from "./checks.js";
+import { canonicalEvent, checkRun, groupFindings, isConsentCommand, summarize } from "./checks.js";
 import { LANGUAGES, messages } from "./i18n.js";
 import { loadConfig, readJson, runAudit, writeReports } from "./audit.js";
 import { validatePlan } from "./schema.js";
@@ -34,7 +34,7 @@ import { hitParams } from "./hit-params.js";
 import { CAMPAIGN_PARAMS, campaignParamsIn, withCampaignParams } from "./campaign.js";
 import { cmpFacts } from "./cmp.js";
 import { containerRows, loadSources } from "./containers.js";
-import { isWidgetHit, siteIds } from "./frames.js";
+import { isWidgetHit, pushedEvent, siteIds, splitRun, widgetSummaries } from "./frames.js";
 import { consentMatrixMarkdown, consentTable, runConsentScenarios } from "./consent.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
@@ -269,6 +269,27 @@ export function containerLines(runs) {
   ];
 }
 
+/** The embedded widgets of the runs as summaries (see widgetSummaries), compared by canonical event name. */
+const widgetsIn = (runs) => widgetSummaries(runs, (a, b) => canonicalEvent(a) === canonicalEvent(b));
+
+/** The embedded widgets as lines for a tool result; [] when there were none. */
+export function widgetLines(runs) {
+  const widgets = widgetsIn(runs);
+  if (!widgets.length) return [];
+  const w = messages("en").ui.widgets;
+  const hits = (list) => list.map((e) => w.hits(e.platform, e.id, e.events)).join("; ") || w.none;
+  return [
+    "Embedded widgets (third-party iframes; their own dataLayer is invisible to the page's tags):",
+    ...widgets.map((x) => [
+      `  ${x.origin}, embedded in ${x.parents.join(", ") || "?"}${x.containers.length ? `; containers ${x.containers.map((c) => c.id).join(", ")}` : ""}`,
+      `    own tracking: ${hits(x.own)}`,
+      `    to the site's accounts: ${hits(x.shared)}`,
+      `    dataLayer: ${w.pushes(x.pushes.total, x.pushes.consent)}${x.pushes.events.length ? `: ${x.pushes.events.map((e) => w.event(e.name, e.count)).join(", ")}` : ""}`,
+      ...(x.unshared.length ? [`    not sent to the site's accounts: ${x.unshared.join(", ")}`] : []),
+    ].join("\n")),
+  ];
+}
+
 export function timelineOf(run) {
   let lastIds = null;
   return (run.steps ?? []).map((st) => {
@@ -282,6 +303,8 @@ export function timelineOf(run) {
     if (hits.length) entry.hits = hits.map((h) => ({ platform: h.platform, event: h.name, ...(h.consent ? { consent: h.consent } : {}), ...(h.late ? { late_ms: h.late.ms } : {}), ...(h.frame ? { iframe: h.frame.origin } : {}) }));
     // An embedded widget's own hits, kept apart from the site's (see src/frames.js).
     const widget = (run.widgetHits ?? []).filter((h) => h.step === st.index);
+    const widgetPushes = (run.widgetDataLayerLog ?? []).filter((e) => e.step === st.index && e.frame && pushedEvent(e.value));
+    if (widgetPushes.length) entry.widget_pushes = widgetPushes.map((e) => ({ widget: e.frame.origin, event: pushedEvent(e.value) }));
     if (widget.length) entry.widget_hits = widget.map((h) => ({ widget: h.frame.origin, platform: h.platform, event: h.name, ...(h.id ? { id: h.id } : {}), ...(h.consent ? { consent: h.consent } : {}) }));
     if (others.length) entry.other_tracking_calls = others.length;
     if (commands.length) entry.consent_commands = commands.map((e) => ({ [e.value[1]]: e.value[2] }));
@@ -544,15 +567,33 @@ export function buildServer(opts) {
     },
   );
 
+  server.registerTool(
+    "get_widgets",
+    {
+      title: "List the embedded widgets seen so far",
+      description:
+        "Returns every third-party iframe (a booking, chat or payment widget, a video) this audit's pages embedded that tracked or loaded a Google container so far: the pages it was embedded in, the containers it loaded, the tracking it sent to its own accounts and to the site's, the events and consent commands in its own dataLayer, and the events it pushed that never reached the site's accounts. The page's tags can't read a widget's dataLayer, so those events only reach the widget's own tracking. Widgets' own hits are left out of the plan checks; finish_audit still checks them for consent and personal data.",
+      inputSchema: { audit_id: z.string() },
+      annotations: { readOnlyHint: true },
+    },
+    async ({ audit_id }) => {
+      const { session } = getAudit(audit_id);
+      const run = { ...splitRun(session), containerLoads: session.containerLoads };
+      const lines = widgetLines([run]);
+      if (!lines.length) return text("No embedded third-party widget has tracked or loaded a Google container on this audit's pages yet.");
+      return text(`${lines.join("\n")}\n\nAs JSON: ${JSON.stringify(widgetsIn([run]))}`);
+    },
+  );
+
   server.registerTool(
     "get_report",
     {
       title: "Read a report this server wrote",
       description:
-        "Returns a report finish_audit or run_audit wrote, so it can be read without access to the computer running this server. part markdown (default): report.md, the verdict, findings, consent and journeys in about 120 lines. summary: summary.json, the counts, journeys and findings as JSON. timeline: one JSON entry per step of each journey (hits with their consent, consent commands, the Google tag's consent, cookies and ids, the Google containers loaded). containers: every GTM container and Google tag the journeys loaded as JSON, with how each reached the page (source html, inline, script, custom_html, google_tag, nested, config, send_to or destination, and by: the container or script that loaded it), its dataLayer, host, GTM environment and pages.",
+        "Returns a report finish_audit or run_audit wrote, so it can be read without access to the computer running this server. part markdown (default): report.md, the verdict, findings, consent and journeys in about 120 lines. summary: summary.json, the counts, journeys and findings as JSON. timeline: one JSON entry per step of each journey (hits with their consent, consent commands, the Google tag's consent, cookies and ids, the Google containers loaded). containers: every GTM container and Google tag the journeys loaded as JSON, with how each reached the page (source html, inline, script, custom_html, google_tag, nested, config, send_to or destination, and by: the container or script that loaded it), its dataLayer, host, GTM environment, version, size, load time and pages. widgets: every embedded third-party widget as JSON: where it was embedded, the containers it loaded, the tracking it sent to its own accounts and to the site's, its own dataLayer events, and the events it pushed that never reached the site's accounts (unshared).",
       inputSchema: {
         report: z.string().describe("The report name finish_audit or run_audit gave."),
-        part: z.enum(["markdown", "summary", "timeline", "containers"]).optional().describe("Default markdown."),
+        part: z.enum(["markdown", "summary", "timeline", "containers", "widgets"]).optional().describe("Default markdown."),
       },
       annotations: { readOnlyHint: true },
     },
@@ -564,6 +605,7 @@ export function buildServer(opts) {
         if (part === "summary") return text(await readFile(path.join(dir, "summary.json"), "utf8"));
         const capture = JSON.parse(await readFile(path.join(dir, "capture.json"), "utf8"));
         if (part === "containers") return text(JSON.stringify(containerRows(capture.runs ?? []).map(containerJson)));
+        if (part === "widgets") return text(JSON.stringify(widgetsIn(capture.runs ?? [])));
         return text(JSON.stringify((capture.runs ?? []).map((r) => ({ journey: r.journeyId, viewport: r.viewport, steps: timelineOf(r) }))));
       } catch (err) {
         return fail(`Could not read the report: ${err.message}`);
@@ -674,13 +716,14 @@ export function buildServer(opts) {
         skippedLine(run),
         ...((platform) => (platform ? [`Consent platform: ${platform.vendor}. ${platform.facts.join(" ")}`] : []))(cmpFacts(messages("en"), [run])),
         ...containerLines([run]),
+        ...widgetLines([run]),
         opts.allowFiles
           ? `Full report with the event timeline: ${reportPath}`
           : opts.reportsUrl
             ? `Full report with the event timeline: ${opts.reportsUrl}/${path.basename(outDir)}/report.html`
             : "",
         "",
-        `To read the report here: get_report with report "${path.basename(outDir)}" (markdown, summary, timeline or containers).`,
+        `To read the report here: get_report with report "${path.basename(outDir)}" (markdown, summary, timeline, containers or widgets).`,
         "Explain each problem to the user with its likely cause and fix.",
       ];
       return {
@@ -827,8 +870,9 @@ export function buildServer(opts) {
             ...result.runs.map((r) => `${r.journeyId} (${r.viewport}): ${r.completed ? "completed" : "not completed"}, ${r.note}`),
             ...grouped.map((f) => `- ${m.severity[f.severity]}${f.accepted ? ` (${m.ui.accepted})` : ""}: ${f.detail}`),
             ...containerLines(result.runs),
+            ...widgetLines(result.runs),
             `Report: ${result.reportPath}`,
-            `To read the report here: get_report with report "${path.basename(result.outDir)}" (markdown, summary, timeline or containers).`,
+            `To read the report here: get_report with report "${path.basename(result.outDir)}" (markdown, summary, timeline, containers or widgets).`,
           ].join("\n"),
         );
       },

package/src/report.js

@@ -6,6 +6,7 @@ import { canonicalEvent, groupFindings, summarize } from "./checks.js";
 import { messages } from "./i18n.js";
 import { buildInventory } from "./inventory.js";
 import { containerRows } from "./containers.js";
+import { widgetSummaries } from "./frames.js";
 import { computeMetrics } from "./metrics.js";
 import { historySummaryLines, sparkline } from "./history.js";
 import { cardIds } from "./html/lib.js";
@@ -403,6 +404,23 @@ export function scriptCell(c, r) {
   return [r.version && c.version(r.version), r.bytes && c.size(r.bytes), r.ms != null && c.loadTime(r.ms)].filter(Boolean).join(", ");
 }
 
+/** The embedded widgets, one row each: where they were embedded, their tracking and their own dataLayer events. Omitted when none. */
+function mdWidgets(m, runs) {
+  const widgets = widgetSummaries(runs, (a, b) => canonicalEvent(a) === canonicalEvent(b));
+  if (!widgets.length) return [];
+  const w = m.ui.widgets;
+  const hits = (list) => list.map((e) => w.hits(e.platform, e.id, e.events)).join("; ") || w.none;
+  const lines = [`## ${m.ui.widgetsTitle}`, "", `| ${m.ui.widgetCol} | ${m.ui.embeddedCol} | ${m.ui.ownCol} | ${m.ui.sharedCol} | ${m.ui.pushesCol} |`, "|---|---|---|---|---|"];
+  for (const x of widgets.slice(0, MD_INVENTORY_ROWS)) {
+    const events = x.pushes.events.map((e) => w.event(e.name, e.count)).join(", ") || w.none;
+    const unshared = x.unshared.length ? ` (${w.unshared}: ${x.unshared.join(", ")})` : "";
+    lines.push(`| ${mdText(x.origin)} | ${mdText(x.parents.join(", ")) || "–"} | ${mdText(hits(x.own))} | ${mdText(hits(x.shared))} | ${mdText(events + unshared)} |`);
+  }
+  if (widgets.length > MD_INVENTORY_ROWS) lines.push("", m.ui.md.moreIn(widgets.length - MD_INVENTORY_ROWS, "report.html"));
+  lines.push("");
+  return lines;
+}
+
 /** The Google containers and how each reached the page, one row per container and source. Omitted when none loaded. */
 function mdContainers(m, runs) {
   const rows = containerRows(runs);
@@ -470,6 +488,7 @@ export function renderMarkdown({ title, site = null, generatedAt, findings, expl
   lines.push(...mdNotChecked(m, runs, rows, plan, consentScenarios));
   lines.push(...mdInventory(m, runs));
   lines.push(...mdContainers(m, runs));
+  lines.push(...mdWidgets(m, runs));
   // A report with its own name or logo carries no Analitik İşler credit; the ai tag debugger one stays.
   if (brand?.name || brand?.logo) lines.push("---", "", `_${brand.name ? `${brand.name} · ` : ""}${m.ui.generatedBy}_`, "");
   else if (branding) lines.push("---", "", `_${m.ui.generatedBy} · [analitikisler.com](https://analitikisler.com)_`, "");