@analitikisler/ai-tag-debugger 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.6.2 (2026-10-12)
+
+Fixes from Bahadır's audit of analitikisler.com.
+
+- GA4 resends (`gaf=1`, which gtag.js sends when it thinks the first send was lost) are not counted as hits on any host. Copies to `www.google.com` are labelled "Google Analytics (resend)" instead of "server-side".
+- The duplicate check counts per page load (GA4's `_p`, or the page address). A step that opens a new page no longer adds the previous page's last `page_view` to the new one.
+- A `page_view` sent while its page unloads is filed under the step that loaded that page, not the next step. A `page_view` for the page that is still open (for example GTM resending it after consent) stays in the step that sent it.
+- dataLayer entries holding DOM elements or objects that refer to themselves (such as GTM click events) are kept, with the element shown as `<tag#id>` and only true cycles cut, instead of becoming "[object Object]".
+
 ## 0.6.1 (2026-10-12)
 
 - GA4 events were reported as "sent 2 times" on sites with Google signals or ads features. gtag.js also sends a copy of those events to `www.google.com/g/collect` (or `doubleclick.net`), which GA4 doesn't count. Those copies are now still answered locally and listed under network requests, but no longer counted as hits. Requests to `analytics.google.com` still count: it is a primary GA4 endpoint.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/browser.js

@@ -20,13 +20,43 @@ export const VIEWPORTS = {
 // Runs in the page before any site script: reports every dataLayer push
 // (including gtag consent commands) to Node through an exposed binding, so the
 // log survives page navigations.
+/** A page address without its hash, for matching page_location to navigations. */
+const pageKey = (url) => String(url ?? "").split("#")[0];
+
 const INIT_SCRIPT = `(() => {
   const record = (entry) => {
     let value = entry;
     try {
       // gtag() pushes an arguments object; store it as a plain array.
       if (entry && typeof entry === "object" && typeof entry.length === "number" && !Array.isArray(entry)) value = Array.from(entry);
-      value = JSON.parse(JSON.stringify(value));
+      // GTM click and form events carry DOM elements and objects that refer to themselves.
+      // Copied by hand so only true cycles (an object inside itself) are cut, not shared objects.
+      const copy = (v, parents) => {
+        if (typeof v === "bigint") return String(v);
+        if (typeof v === "function" || typeof v === "symbol") return undefined;
+        if (!v || typeof v !== "object") return v;
+        if (typeof Element !== "undefined" && v instanceof Element) return "<" + v.tagName.toLowerCase() + (v.id ? "#" + v.id : "") + ">";
+        if (typeof Node !== "undefined" && v instanceof Node) return "[node]";
+        if (v === window) return "[window]";
+        if (parents.includes(v)) return "[circular]";
+        if (parents.length > 20) return "[too deep]";
+        if (typeof v.toJSON === "function") { try { return copy(v.toJSON(), parents); } catch { return String(v); } }
+        parents.push(v);
+        let out;
+        if (Array.isArray(v)) out = v.map((x) => { const c = copy(x, parents); return c === undefined ? null : c; });
+        else {
+          out = {};
+          for (const k of Object.keys(v)) {
+            let x;
+            try { x = v[k]; } catch { continue; }
+            const c = copy(x, parents);
+            if (c !== undefined) out[k] = c;
+          }
+        }
+        parents.pop();
+        return out;
+      };
+      value = JSON.parse(JSON.stringify(copy(value, [])));
     } catch { value = String(entry); }
     if (window.__atdRecord) window.__atdRecord({ url: location.href, value });
   };
@@ -183,6 +213,8 @@ export class AuditSession {
     this.network = [];
     this.providers = resolveProviders(this.opts.providers);
     this.skipped = {}; // step index -> { vendor label: requests }
+    this.loadedIn = new Map(); // page address -> the last step whose main-frame navigation reached it
+    this.leaving = null; // the page address being navigated away from, until the next page commits
     this.bodyBytes = 0;
     this.bodyBudgetStep = null; // the step at which POST bodies stopped being stored
     this.startedAt = Date.now();
@@ -207,6 +239,15 @@ export class AuditSession {
     await this.context.addInitScript(INIT_SCRIPT);
     this.page = await this.context.newPage();
     this.page.on("pageerror", (err) => this.errors.push({ step: this.currentStep, message: err.message }));
+    this.page.on("framenavigated", (frame) => {
+      if (frame !== this.page.mainFrame()) return;
+      this.loadedIn.set(pageKey(frame.url()), this.currentStep);
+      this.leaving = null;
+    });
+    // From the moment the main frame starts loading another document, the open page is leaving.
+    this.page.on("request", (request) => {
+      if (request.isNavigationRequest() && request.frame() === this.page.mainFrame()) this.leaving = pageKey(this.page.url());
+    });
 
     const onRequest = (request) => {
       const hits = parseTrackingRequest(request.url(), request.postData());
@@ -214,7 +255,7 @@ export class AuditSession {
       const recorded = [];
       for (const hit of hits) {
         if (!this.providers.includes(hit.platform)) continue;
-        const entry = { ...this.redactHit(hit), step: this.currentStep, pageUrl: this.page.url(), t: Date.now() };
+        const entry = { ...this.redactHit(hit), step: this.stepForHit(hit), pageUrl: this.page.url(), t: Date.now() };
         if (this.record("hits", entry)) recorded.push(entry);
       }
       if (recorded.length) hitsOf.set(request, recorded);
@@ -296,6 +337,20 @@ export class AuditSession {
     this.beginStep("start");
   }
 
+  /**
+   * The step a hit belongs to. A page_view sent as the page unloads arrives after the next
+   * step has started, so it goes to the step that loaded its page, when that was earlier.
+   */
+  stepForHit(hit) {
+    if (hit.name !== "page_view" || !hit.params?.page_location) return this.currentStep;
+    // Only when its page is going or gone: a page_view for the page still open (GTM resending
+    // it after consent, a virtual page view) belongs to the current step.
+    const page = pageKey(hit.params.page_location);
+    if (page === pageKey(this.page.url()) && page !== this.leaving) return this.currentStep;
+    const loaded = this.loadedIn.get(page);
+    return loaded !== undefined && loaded < this.currentStep ? loaded : this.currentStep;
+  }
+
   /** The hit with user data for ad matching redacted, and userData: { fields, plain } when there was any. */
   redactHit({ userFields, ...hit }) {
     const found = { fields: [], plain: [] };
@@ -366,6 +421,7 @@ export class AuditSession {
   }
 
   beginStep(label, extra = {}) {
+    this.leaving = null; // a navigation that never committed (a download, a 204) ends with its step
     this.steps.push({ index: this.steps.length, label, t: Date.now(), ...extra });
   }
 

package/src/checks.js

@@ -15,6 +15,15 @@ const SEVERITY_ORDER = { broken: 0, risk: 1, warning: 2, info: 3, ok: 4 };
 
 const key = (platform, name) => `${platform}:${name}`;
 
+/** The page load a hit came from: GA4's page load id (_p) when it has one, else the page address. */
+function pageOf(hit) {
+  try {
+    const p = new URL(hit.url).searchParams.get("_p");
+    if (p) return p;
+  } catch { /* no URL */ }
+  return hit.params?.page_location ?? hit.pageUrl ?? "";
+}
+
 function expectedIn(planEvent, journeyId) {
   return !planEvent.journeys || planEvent.journeys.includes(journeyId);
 }
@@ -95,10 +104,11 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
     }
   }
 
-  // The same event sent more than once by a single action.
+  // The same event sent more than once by a single action on one page. A step that loads a
+  // new page can also carry the previous page's last hits, so the page is part of the key.
   const perStep = new Map();
   for (const hit of run.hits) {
-    const k = `${hit.step}|${key(hit.platform, hit.name)}`;
+    const k = `${hit.step}|${key(hit.platform, hit.name)}|${pageOf(hit)}`;
     perStep.set(k, [...(perStep.get(k) ?? []), hit]);
   }
   for (const [, hits] of perStep) {

package/src/mcp.js

@@ -22,7 +22,7 @@ import { loadConfig, readJson, runAudit, writeReports } from "./audit.js";
 import { DEFAULT_PROVIDERS, PROVIDERS as TRACKING_PROVIDERS } from "./parsers.js";
 import { expectEvents, filterFindings, JOURNEY_PRESETS, onlyEvents, presetFor, withPresetEvents } from "./journeys.js";
 
-const VERSION = "0.6.1";
+const VERSION = "0.6.2";
 const MAX_OPEN_AUDITS = 4;
 const IDLE_MS = 15 * 60 * 1000; // an audit untouched this long is closed
 const MAX_BODY_BYTES = 1024 * 1024;

package/src/parsers.js

@@ -35,9 +35,9 @@ export function parseGa4(url, postData) {
   // Matched on the GA4 protocol rather than the host, so server-side GTM
   // endpoints on first-party domains are captured too.
   if (!u.pathname.endsWith("/g/collect") || u.searchParams.get("v") !== "2") return null;
-  // gtag.js sends a copy of some events to www.google.com/g/collect (and doubleclick.net)
-  // for Google signals and ads features. GA4 doesn't count those, so they aren't hits.
-  if (GOOGLE_COMPANION_HOST.test(u.hostname)) return null;
+  // gtag.js resends a hit to www.google.com/g/collect (marked gaf=1) when the first send
+  // seems lost, and copies some to doubleclick.net. GA4 doesn't count these twice, so they aren't hits.
+  if (GOOGLE_COMPANION_HOST.test(u.hostname) || u.searchParams.has("gaf")) return null;
   const base = new URLSearchParams(u.search);
   const lines = postData ? postData.split("\n").filter(Boolean) : [""];
   return lines.map((line) => {
@@ -236,6 +236,10 @@ export function resolveProviders(list, plan) {
 export function vendorOf(url) {
   const p = providerOf(url);
   if (!p) return null;
-  if (p.key === "ga4") return /(^|\.)(google-analytics|analytics\.google|googletagmanager)\.com$/.test(new URL(url).hostname) ? "Google Analytics" : "Google Analytics (server-side)";
+  if (p.key === "ga4") {
+    const host = new URL(url).hostname;
+    if (/(^|\.)(google-analytics|analytics\.google|googletagmanager)\.com$/.test(host)) return "Google Analytics";
+    return GOOGLE_COMPANION_HOST.test(host) ? "Google Analytics (resend)" : "Google Analytics (server-side)";
+  }
   return p.label;
 }