@analitikisler/ai-tag-debugger 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.7.2 (2026-10-13)
+
+- **GA4 and Google Ads hits sent through Google tag gateway are captured.** Sites using the gateway send GA4 to a short path on their own domain (`/<prefix>/ag/g/c`, `/<prefix>/ga/g/c`) and Google Ads to `/<prefix>/as/p/c/<id>/`. These were neither recognized nor answered locally, so their events were reported as missing and the audit's visits reached the site's real accounts. A `/g/c` path counts as GA4 only with a GA4 measurement id (`tid=G-…`).
+- Google Tag Manager and gtag.js loaded from the site's own domain are labelled as such in the network timeline.
+- Two more Google pings are answered locally instead of reaching Google: `www.google.com/measurement/conversion` and `google.<tld>/ads/ga-audiences`.
+- Saved sites also leave out cookies named like a login or token (`auth_token`, `sid`, `csrftoken`, …) and cookies holding an email address, even when they aren't HttpOnly.
+- Writing a saved site's recording can no longer stall a run: the page is left first, so what it is still loading is cancelled, and after 30 seconds the recording is skipped (the site is then not saved). The log says when the recording is being written. Reading the browser's cookies at the end of a journey has a time limit too.
+- `replay` no longer crashes with "Target page, context or browser has been closed" when a request is still being answered as the browser closes.
+- A saved journey whose start page could not be opened (a redirect to another site, a bot check) can be replayed; it stays unfinished with its saved note.
+- When a site can't be saved, a `site.json` from an earlier save is removed so it can't be replayed against the new recordings, and `run` exits with code 1.
+
+## 0.7.1 (2026-10-13)
+
+- A page whose script stops responding after a step can no longer stall a run. Reading the page now has a 1 minute limit too, and when it runs out the journey ends as incomplete with a note. Before, only the model call and the browser action itself had a limit.
+- When a saved site's recording can't be cleaned, a warning now says so before the file is deleted.
+
+Replays of saved sites are closer to the saved run, after the first save of 18 real shops:
+
+- Scripted runs, and so replays, wait 3 seconds after the last step, so tags that send a moment after the last click (GA4 batches events) are captured as in an AI run.
+- A step that failed in the saved run is tried again on replay without ending the journey there.
+- A journey the AI could not finish (no cart, a bot check) stays unfinished on replay, so its missing events are not reported as broken.
+- Cookies the server sets for the page's scripts, such as a country, are kept in the recording; HttpOnly cookies, where sessions and logins live, are still left out. Some sites don't render without them, for example a cookie banner that never appears.
+- Images, fonts and video left out of the recording get an empty answer on replay instead of failing, since a failed image can stop a script.
+- Requests that had no answer yet when the browser closed are left out of the recording. On replay they made the page that asked for them again never finish loading.
+- A site whose recording is missing (the browser closed early) is not saved, and `replay` reports a saved site it can't replay and goes on with the next one instead of stopping.
+
 ## 0.7.0 (2026-10-12)
 
 Fixes from the first audit run across 18 real shops.

package/README.md

@@ -45,7 +45,7 @@ Manual tag QA catches this, but it's tedious, so it rarely happens after every r
 | Personal data | An email address sent to an ad platform in plain text |
 | Unplanned events | Events firing that aren't in your measurement plan |
 
-Platforms: GA4 (including server-side GTM endpoints), Google Ads conversions, Meta Pixel, TikTok Pixel, and basic X Pixel events.
+Platforms: GA4 (including server-side GTM endpoints and Google tag gateway paths on the site's own domain), Google Ads conversions, Meta Pixel, TikTok Pixel, and basic X Pixel events.
 
 ### Choose the providers to check
 
@@ -180,7 +180,7 @@ npx @analitikisler/ai-tag-debugger replay saved/*
     - warning duplicate purchase desktop ga4 page_view
 ```
 
-The first run's findings become the expected ones. When a change is right, for example a false alarm that is fixed, `replay --update` makes the new findings the expected ones. Use it to check a new version of the tool against sites you know, or a site change against its last good run. A saved site is usually a few MB. It leaves out tracking requests, images and video, cookies, authorization headers, form data, and requests with an email or other user data in their address. It still holds the site's pages and scripts, so keep sites you don't own out of public repositories.
+The first run's findings become the expected ones. When a change is right, for example a false alarm that is fixed, `replay --update` makes the new findings the expected ones. Use it to check a new version of the tool against sites you know, or a site change against its last good run. A saved site is usually a few MB. It leaves out tracking requests, images and video, HttpOnly and login cookies and the cookies the browser sent, authorization headers, form data, and requests with an email or other user data in their address. It still holds the site's pages and scripts, so keep sites you don't own out of public repositories.
 
 ## Configure your site
 

package/README.tr.md

@@ -45,7 +45,7 @@ Tag'leri elle test etmek bunu yakalar, ama zahmetli olduğu için her sürümden
 | Kişisel veri | Bir e-posta adresi reklam platformuna açık metin olarak gönderildi |
 | Planda olmayan event'ler | Ölçümleme planınızda bulunmayan event'ler gönderiliyor |
 
-Platformlar: GA4 (server-side GTM adresleri dahil), Google Ads dönüşümleri, Meta Pixel, TikTok Pixel ve temel X Pixel event'leri.
+Platformlar: GA4 (server-side GTM adresleri ve sitenin kendi alan adındaki Google tag gateway yolları dahil), Google Ads dönüşümleri, Meta Pixel, TikTok Pixel ve temel X Pixel event'leri.
 
 ### Kontrol edilecek platformları seçin
 
@@ -182,7 +182,7 @@ npx @analitikisler/ai-tag-debugger replay saved/*
     - warning duplicate purchase desktop ga4 page_view
 ```
 
-İlk çalıştırmanın bulguları beklenen bulgular olur. Bir değişiklik doğruysa (örneğin düzeltilmiş bir yanlış alarm), `replay --update` yeni bulguları beklenen bulgular yapar. Aracın yeni bir sürümünü bildiğiniz sitelerle ya da bir site değişikliğini son sağlıklı çalıştırmayla karşılaştırmak için kullanın. Kaydedilmiş bir site genellikle birkaç MB'tır. İzleme isteklerini, görselleri ve videoları, çerezleri, yetkilendirme başlıklarını, form verilerini ve adresinde e-posta ya da başka kullanıcı verisi olan istekleri içermez. Yine de sitenin sayfalarını ve betiklerini içerdiği için size ait olmayan siteleri herkese açık depolara koymayın.
+İlk çalıştırmanın bulguları beklenen bulgular olur. Bir değişiklik doğruysa (örneğin düzeltilmiş bir yanlış alarm), `replay --update` yeni bulguları beklenen bulgular yapar. Aracın yeni bir sürümünü bildiğiniz sitelerle ya da bir site değişikliğini son sağlıklı çalıştırmayla karşılaştırmak için kullanın. Kaydedilmiş bir site genellikle birkaç MB'tır. İzleme isteklerini, görselleri ve videoları, HttpOnly ve oturum açma çerezlerini ve tarayıcının gönderdiği çerezleri, yetkilendirme başlıklarını, form verilerini ve adresinde e-posta ya da başka kullanıcı verisi olan istekleri içermez. Yine de sitenin sayfalarını ve betiklerini içerdiği için size ait olmayan siteleri herkese açık depolara koymayın.
 
 ## Sitenizi ayarlayın
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -88,9 +88,11 @@ export function validateAction(input) {
   return null;
 }
 
-// One hung page or model request must not stall a whole run.
-const MODEL_TIMEOUT_MS = 180_000;
-const ACTION_TIMEOUT_MS = 120_000;
+// One hung page or model request must not stall a whole run. A page whose script never
+// stops (an endless loop after a click, for example) can't be read, so reading it has a limit too.
+const TIMEOUTS = { model: 180_000, action: 120_000, page: 60_000 };
+
+const LAST_STEP_WAIT_MS = 3000;
 
 class StepTimeout extends Error {}
 
@@ -105,14 +107,18 @@ function withTimeout(promise, ms, message) {
  * Lets the AI model drive the browser through one journey.
  * @param {AuditSession} session
  * @param {{ id: string, goal: string }} journey
- * @param {{ provider?: any, providerName?: string, client?: any, model?: string, maxSteps?: number, lang?: string, log?: (msg: string) => void }} opts
+ * @param {{ provider?: any, providerName?: string, client?: any, model?: string, maxSteps?: number, lang?: string, log?: (msg: string) => void, timeouts?: { model?: number, action?: number, page?: number } }} opts
+ *   timeouts: milliseconds for one model answer, one browser action and one read of the page.
  */
 export async function runAgentJourney(session, journey, opts = {}) {
   const provider = opts.provider ?? (await createProvider({ name: opts.providerName, model: opts.model, client: opts.client }));
   const maxSteps = opts.maxSteps ?? 30;
   const log = opts.log ?? (() => {});
+  const limit = { ...TIMEOUTS, ...opts.timeouts };
+  const seconds = (ms) => (ms % 60_000 ? `${Math.round(ms / 1000)} seconds` : ms === 60_000 ? "a minute" : `${ms / 60_000} minutes`);
+  const readPage = () => withTimeout(session.snapshot(), limit.page, `The page stopped responding: it could not be read for ${seconds(limit.page)}.`);
 
-  const first = await session.snapshot();
+  const first = await readPage();
   const chat = provider.conversation({
     system: systemPrompt(opts.lang ?? "en"),
     tools: TOOLS,
@@ -120,7 +126,7 @@ export async function runAgentJourney(session, journey, opts = {}) {
   });
 
   for (let turn = 0; turn < maxSteps; turn++) {
-    const { toolCalls, stop } = await withTimeout(chat.next(), MODEL_TIMEOUT_MS, "The model did not answer within 3 minutes.");
+    const { toolCalls, stop } = await withTimeout(chat.next(), limit.model, `The model did not answer within ${seconds(limit.model)}.`);
     if (stop === "refusal") return { completed: false, note: "The model declined to continue this journey." };
     if (toolCalls.length === 0) {
       if (stop === "max_tokens") return { completed: false, note: "The model response was cut off." };
@@ -146,8 +152,8 @@ export async function runAgentJourney(session, journey, opts = {}) {
         continue;
       }
       log(`  ${call.input.reason}`);
-      const error = await withTimeout(session.act(call.input), ACTION_TIMEOUT_MS, "The browser action did not finish within 2 minutes.");
-      results.push({ id: call.id, content: pageView(await session.snapshot(), error) });
+      const error = await withTimeout(session.act(call.input), limit.action, `The browser action did not finish within ${seconds(limit.action)}.`);
+      results.push({ id: call.id, content: pageView(await readPage(), error) });
     }
     if (finished) return finished;
     chat.addToolResults(results);
@@ -158,12 +164,16 @@ export async function runAgentJourney(session, journey, opts = {}) {
 /** Replays fixed steps from the config, without calling an AI model. */
 export async function runScriptedJourney(session, journey, opts = {}) {
   const log = opts.log ?? (() => {});
-  if (!journey.steps?.length) throw new Error(`Journey "${journey.id}" has no "steps" for --scripted mode.`);
-  for (const step of journey.steps) {
+  if (!journey.steps?.length && !journey.incomplete) throw new Error(`Journey "${journey.id}" has no "steps" for --scripted mode.`);
+  for (const step of journey.steps ?? []) {
     log(`  ${step.reason ?? `${step.action} ${step.selector ?? step.url ?? ""}`}`);
     const error = await session.act(step);
     if (error && !step.optional) return { completed: false, note: `Step "${step.reason ?? step.action}" failed: ${error}` };
   }
+  // Tags often send a moment after the last click (GA4 batches events). An AI run gives them that time
+  // while the model answers; a scripted run would otherwise close the browser first.
+  await session.page.waitForTimeout(LAST_STEP_WAIT_MS).catch(() => {});
+  if (journey.incomplete) return { completed: false, note: journey.incomplete };
   return { completed: true, note: "All scripted steps completed." };
 }
 
@@ -184,7 +194,8 @@ export async function runJourney(config, journey, viewport, opts = {}) {
     await session.start();
     const startUrl = new URL(journey.start ?? "/", config.site).href;
     const startError = await session.act({ action: "goto", url: startUrl, reason: `Open ${startUrl}` });
-    if (startError) return { ...collect(session, journey, viewport), completed: false, note: `Could not open the start page: ${startError}` };
+    // A replayed journey that was unfinished when saved keeps its saved note, however it fails this time.
+    if (startError) return { ...collect(session, journey, viewport), completed: false, note: journey.incomplete ?? `Could not open the start page: ${startError}` };
 
     const outcome = await (opts.scripted ? runScriptedJourney(session, journey, opts) : runAgentJourney(session, journey, opts)).catch((err) => {
       if (err instanceof StepTimeout) return { completed: false, note: err.message };
@@ -192,6 +203,7 @@ export async function runJourney(config, journey, viewport, opts = {}) {
     });
     return { ...collect(session, journey, viewport), ...outcome, cookies: await session.cookies() };
   } finally {
+    if (opts.saveSite) opts.log?.("  Writing the recording…");
     await session.close();
   }
 }

package/src/audit.js

@@ -1,6 +1,6 @@
 // A full audit from a config file: run every journey, check, explain, write the reports.
 // Shared by the CLI and the MCP server's run_audit tool.
-import { readFile, mkdir, writeFile } from "node:fs/promises";
+import { readFile, mkdir, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { runJourney } from "./agent.js";
 import { checkRun, groupFindings, summarize } from "./checks.js";
@@ -9,7 +9,7 @@ import { LANGUAGES, messages } from "./i18n.js";
 import { createProvider } from "./providers.js";
 import { filterFindings, planRun } from "./journeys.js";
 import { resolveProviders } from "./parsers.js";
-import { writeSavedSite } from "./replay.js";
+import { SAVED_SITE_FILE, writeSavedSite } from "./replay.js";
 
 export async function readJson(file, baseDir = ".") {
   const full = path.resolve(baseDir, file);
@@ -72,7 +72,7 @@ export async function runAudit(opts) {
   const viewports = opts.viewports?.length ? opts.viewports : config.viewports ?? ["desktop"];
   if (!journeys.length) throw new Error("No journeys to run. Pick one with --journey (e.g. purchase) or describe one with --goal.");
   if (opts.scripted) {
-    const unscripted = journeys.filter((j) => !j.steps?.length).map((j) => j.id);
+    const unscripted = journeys.filter((j) => !j.steps?.length && !j.incomplete).map((j) => j.id);
     if (unscripted.length) throw new Error(`Journeys without fixed steps can't be replayed with --scripted: ${unscripted.join(", ")}.`);
   }
 
@@ -91,9 +91,17 @@ export async function runAudit(opts) {
   }
 
   const findings = filterFindings(runs.flatMap((run) => checkRun(plan, run, { lang })), events);
+  let saveError = null;
   if (opts.saveSite) {
-    await writeSavedSite(opts.saveSite, { config, plan, runs, findings });
-    log(`\nSaved the site for offline replay in ${opts.saveSite}`);
+    try {
+      await writeSavedSite(opts.saveSite, { config, plan, runs, findings });
+      log(`\nSaved the site for offline replay in ${opts.saveSite}`);
+    } catch (err) {
+      // A site.json from an earlier save would no longer match the recordings next to it.
+      await rm(path.join(opts.saveSite, SAVED_SITE_FILE), { force: true });
+      saveError = err.message;
+      log(`\nCould not save the site in ${opts.saveSite}: ${err.message}`);
+    }
   }
   let explained = null;
   if (provider) {
@@ -104,5 +112,5 @@ export async function runAudit(opts) {
   const outDir = path.resolve(opts.outDir ?? defaultOutDir());
   const reportPath = await writeReports({ outDir, config, plan, runs, findings, explained, lang, branding: opts.branding ?? config.branding !== false });
   const counts = summarize(groupFindings(findings));
-  return { runs, findings, explained, counts, reportPath, outDir, lang };
+  return { runs, findings, explained, counts, reportPath, outDir, lang, ...(saveError ? { saveError } : {}) };
 }

package/src/browser.js

@@ -227,18 +227,41 @@ async function replayTarget(a, locator) {
 // Images, fonts and video don't change what tracking sends, and are most of a recording's size.
 const MEDIA = /^(image|font|video|audio)\//;
 
+const MEDIA_FILE = /\.(png|jpe?g|gif|webp|avif|svg|ico|bmp|woff2?|ttf|otf|eot|mp4|webm|mov|mp3|m4a|ogg|wav)$/i;
+const isDroppedMedia = (request) =>
+  ["image", "font", "media"].includes(request.resourceType()) || MEDIA_FILE.test(new URL(request.url()).pathname);
+
+// Cookies the server sets for the page's scripts (a country or language, for example) are kept, since
+// sites often need them to render. HttpOnly ones, where sessions and logins usually live, are dropped,
+// and so are ones named or holding like a login. Replay applies only one Set-Cookie header, so the
+// kept ones are joined into one, one cookie per line.
+const LOGIN_COOKIE = /sess|sid|token|auth|jwt|login|csrf|xsrf|remember/i;
+function keptHeaders(headers) {
+  const isSetCookie = (h) => /^set-cookie$/i.test(h.name);
+  const isPrivate = (cookie) => {
+    const [pair] = cookie.split(";");
+    const name = pair.slice(0, pair.indexOf("=")).trim();
+    return /;\s*httponly\s*(;|$)/i.test(cookie) || LOGIN_COOKIE.test(name) || /@|%40/.test(pair);
+  };
+  const cookies = headers.filter(isSetCookie).flatMap((h) => h.value.split("\n")).filter((c) => !isPrivate(c));
+  return [...headers.filter((h) => !isSetCookie(h)), ...(cookies.length ? [{ name: "Set-Cookie", value: cookies.join("\n") }] : [])];
+}
+
+const CLOSE_TIMEOUT_MS = 30_000;
+
 const SECRET_REQUEST_HEADER = /^(cookie|authorization|proxy-authorization)$/i;
 
 /**
  * Drops images, fonts, video and tracking requests from a recording (they are answered locally on replay, and their
- * URLs can hold the user data redacted everywhere else), requests with user data in their address, form bodies,
- * cookies both ways and authorization headers.
+ * URLs can hold the user data redacted everywhere else), unanswered requests, requests with user data in their address, form bodies,
+ * the cookies the browser sent, HttpOnly cookies the server set, and authorization headers.
  */
-
 async function cleanRecording(file) {
   const har = JSON.parse(await readFile(file, "utf8"));
   har.log.entries = har.log.entries
     .filter((e) => !isCollectionEndpoint(e.request.url) && !MEDIA.test(e.response?.content?.mimeType ?? ""))
+    // A request that had no answer yet when the browser closed would never finish on replay either.
+    .filter((e) => e.response?.status > 0)
     // A request whose address holds user data (an email in a form GET, for example) is left out whole.
     .filter((e) => redactUrl(e.request.url).url === e.request.url)
     .map((e) => {
@@ -247,7 +270,7 @@ async function cleanRecording(file) {
       return {
         ...e,
         request: { ...request, cookies: [], headers: request.headers.filter((h) => !SECRET_REQUEST_HEADER.test(h.name)) },
-        response: { ...e.response, cookies: [], headers: e.response.headers.filter((h) => !/^set-cookie$/i.test(h.name)) },
+        response: { ...e.response, cookies: [], headers: keptHeaders(e.response.headers) },
       };
     });
   await writeFile(file, JSON.stringify(har));
@@ -262,6 +285,7 @@ export class AuditSession {
    *     others are still answered locally, but only counted, per step, in this.skipped.
    *   site: navigation is limited to this site's host and its subdomains, plus allowedHosts.
    *   recordHar: save every response the site sends into this .har file, so the journey can be replayed offline later.
+   *     closeTimeoutMs: how long close() waits for the recording to be written (default 30 s) before skipping it.
    *   replayHar: answer requests from a .har file saved with recordHar instead of the network; requests it lacks fail.
    *   blockPrivate: refuse loopback, private and link-local addresses (used when the MCP server is reachable over HTTP).
    *     All browser traffic then goes through the egress proxy. A function decides which addresses count as private (for tests).
@@ -376,7 +400,14 @@ export class AuditSession {
     // cancelled before its route handler runs, but its request event has already fired.
     this.context.on("request", onRequest);
     // Registered first, so the routes below run before it and tracking requests are still answered locally.
-    if (this.opts.replayHar) await this.context.routeFromHAR(this.opts.replayHar, { notFound: "abort" });
+    if (this.opts.replayHar) {
+      // Requests the recording lacks fail, except the media left out of it: those get an empty answer,
+      // since a failed image or icon can stop a script (a consent banner waiting for its logo, for example).
+      await this.context.route("**/*", (route) =>
+        (isDroppedMedia(route.request()) ? route.fulfill({ status: 200, body: "" }) : route.abort()).catch(() => {}),
+      );
+      await this.context.routeFromHAR(this.opts.replayHar, { notFound: "fallback" });
+    }
     if (this.opts.blockHits) {
       await this.context.route((url) => isCollectionEndpoint(url.href), async (route) => {
         await route.fulfill({ status: 204, body: "" });
@@ -658,6 +689,13 @@ export class AuditSession {
    * @param {{ action: string, ref?: number, selector?: string, text?: string, value?: string, url?: string, reason?: string, accepts_consent?: boolean }} a
    */
   async act(a) {
+    const error = await this.perform(a);
+    // A scripted replay of this step may fail the same way, which must not end the journey there.
+    if (error) this.steps[this.currentStep].error = error;
+    return error;
+  }
+
+  async perform(a) {
     const describe = a.reason || `${a.action} ${a.selector ?? (a.ref != null ? `#${a.ref}` : a.text != null ? `"${a.text}"` : a.url ?? "")}`.trim();
     this.beginStep(describe, { action: a.action, acceptsConsent: !!a.accepts_consent });
     const step = this.steps[this.currentStep];
@@ -665,9 +703,9 @@ export class AuditSession {
       switch (a.action) {
         case "goto": {
           const target = new URL(a.url, this.page.url() === "about:blank" ? undefined : this.page.url()).href;
+          step.replay = { action: "goto", url: target };
           const refused = await this.checkUrl(target);
           if (refused) return refused;
-          step.replay = { action: "goto", url: target };
           await this.page.goto(target, { waitUntil: "domcontentloaded", timeout: 30000 });
           break;
         }
@@ -717,15 +755,46 @@ export class AuditSession {
   }
 
   async cookies() {
-    return (await this.context.cookies()).map((c) => ({ name: c.name, domain: c.domain }));
+    let timer;
+    const tooLong = new Promise((resolve) => (timer = setTimeout(() => resolve([]), 10_000)));
+    const cookies = await Promise.race([this.context.cookies().catch(() => []), tooLong]);
+    clearTimeout(timer);
+    return cookies.map((c) => ({ name: c.name, domain: c.domain }));
   }
 
   async close() {
+    // Leaving the page first cancels what it is still loading (the recording would otherwise wait for it),
+    // while tracking requests sent on the way out are still answered locally.
+    if (this.opts.recordHar) await this.page?.goto("about:blank", { timeout: 5000 }).catch(() => {});
+    // Requests still in flight then get no route callback that would throw once the browser is gone.
+    // A page stuck in a script never answers, so this waits at most 5 seconds.
+    let unrouteTimer;
+    await Promise.race([
+      this.context?.unrouteAll({ behavior: "ignoreErrors" }).catch(() => {}),
+      new Promise((resolve) => (unrouteTimer = setTimeout(resolve, 5000))),
+    ]);
+    clearTimeout(unrouteTimer);
     if (this.opts.recordHar && this.context) {
-      // Writes the recording. If the browser already went away, there is none to clean.
-      const written = await this.context.close().then(() => true, () => false);
+      // Writes the recording. If the browser already went away, or writing it takes too long, there is
+      // none to clean: closing the browser below then ends the run's wait.
+      let timer;
+      const limit = this.opts.closeTimeoutMs ?? CLOSE_TIMEOUT_MS;
+      const tooLong = new Promise((resolve) => (timer = setTimeout(() => resolve("timeout"), limit)));
+      const closed = await Promise.race([this.context.close().then(() => "closed", () => "gone"), tooLong]);
+      clearTimeout(timer);
+      if (closed === "timeout") {
+        console.warn(`Writing the recording ${this.opts.recordHar} took over ${Math.round(limit / 1000)} seconds, so it was skipped.`);
+        await this.browser?.close().catch(() => {});
+        await rm(this.opts.recordHar, { force: true }); // a partly written file
+      }
+      const written = closed === "closed";
       // A recording that could not be cleaned may hold cookies or form data, so it is deleted.
-      if (written) await cleanRecording(this.opts.recordHar).catch(() => rm(this.opts.recordHar, { force: true }));
+      if (written) {
+        await cleanRecording(this.opts.recordHar).catch(async (err) => {
+          console.warn(`Could not clean the recording ${this.opts.recordHar}, so it was deleted: ${err.message}`);
+          await rm(this.opts.recordHar, { force: true });
+        });
+      }
     }
     await this.browser?.close();
     await this.egress?.close();

package/src/cli.js

@@ -113,7 +113,12 @@ async function main() {
     if (!dirs.length) throw new Error("replay needs the folder of at least one site saved with --save-site.");
     let changed = false;
     for (const dir of dirs) {
-      const r = await replaySavedSite(dir, { update: values.update, outDir: dirs.length === 1 ? values.out : undefined });
+      const r = await replaySavedSite(dir, { update: values.update, outDir: dirs.length === 1 ? values.out : undefined }).catch((err) => {
+        console.log(`✗ ${dir}: could not replay: ${err.message.split("\n")[0]}`);
+        changed = true;
+        return null;
+      });
+      if (!r) continue;
       const same = !r.missing.length && !r.extra.length;
       changed ||= !same;
       console.log(`${same ? "✓" : values.update ? "↻" : "✗"} ${r.site} (${dir}): ${same ? "same findings" : `${r.extra.length} new, ${r.missing.length} gone${values.update ? ", saved as expected" : ""}`}`);
@@ -175,6 +180,7 @@ async function main() {
     const threshold = levels.indexOf(failOn);
     if (levels.slice(0, threshold + 1).some((l) => result.counts[l] > 0)) process.exitCode = 1;
   }
+  if (result.saveError) process.exitCode = 1;
 }
 
 main().catch((err) => {

package/src/parsers.js

@@ -29,12 +29,19 @@ function ga4Consent(searchParams) {
 // Only www.google.<tld> and doubleclick.net: analytics.google.com is a primary GA4 endpoint.
 const GOOGLE_COMPANION_HOST = /^(www\.)?google\.[a-z]{2,3}(\.[a-z]{2})?$|(^|\.)doubleclick\.net$/;
 
+/**
+ * Google tag gateway serves Google's endpoints from a path on the site's own domain, with
+ * short names: /<prefix>/ag/g/c or /<prefix>/ga/g/c for GA4's /g/collect. Only accepted with a
+ * GA4 measurement id, since "/g/c" alone is too common a path.
+ */
+const isGa4Path = (u) => u.pathname.endsWith("/g/collect") || (/\/g\/c$/.test(u.pathname) && /^G-[A-Z0-9]+$/.test(u.searchParams.get("tid") ?? ""));
+
 /** @returns {Hit[] | null} */
 export function parseGa4(url, postData) {
   const u = new URL(url);
   // Matched on the GA4 protocol rather than the host, so server-side GTM
   // endpoints on first-party domains are captured too.
-  if (!u.pathname.endsWith("/g/collect") || u.searchParams.get("v") !== "2") return null;
+  if (!isGa4Path(u) || u.searchParams.get("v") !== "2") return null;
   // gtag.js resends a hit to www.google.com/g/collect when the first send seems lost, and
   // copies some to doubleclick.net. GA4 doesn't count these twice, so they aren't hits.
   // (Primary hits can carry gaf too, e.g. gaf=2, so the host decides, not the parameter.)
@@ -74,11 +81,14 @@ export function parseMeta(url) {
 /** @returns {Hit[] | null} */
 export function parseGoogleAds(url) {
   const u = new URL(url);
+  // Google tag gateway serves /pagead/conversion/<id>/ as /<prefix>/as/p/c/<id>/ on the site's own domain.
+  const gateway = u.pathname.match(/\/as\/p\/c\/(\d+)\/?$/);
   const isAds =
     (u.hostname === "www.googleadservices.com" && u.pathname.startsWith("/pagead/conversion/")) ||
-    (/(^|\.)google\.[a-z.]+$/.test(u.hostname) && u.pathname.startsWith("/pagead/1p-conversion/"));
+    (/(^|\.)google\.[a-z.]+$/.test(u.hostname) && u.pathname.startsWith("/pagead/1p-conversion/")) ||
+    (gateway && u.searchParams.has("cv"));
   if (!isAds) return null;
-  const conversionId = u.pathname.split("/").filter(Boolean)[2];
+  const conversionId = gateway ? gateway[1] : u.pathname.split("/").filter(Boolean)[2];
   const params = {};
   for (const key of ["label", "value", "currency_code", "oid"]) {
     if (u.searchParams.has(key)) params[key === "currency_code" ? "currency" : key === "oid" ? "transaction_id" : key] = u.searchParams.get(key);
@@ -136,7 +146,7 @@ export function parseTrackingRequest(url, postData) {
 // hits: Google Ads remarketing and consent pings, and the other common ad pixels.
 const OTHER_BEACONS = [
   [/(^|\.)(doubleclick\.net|googleadservices\.com|google\.[a-z.]+)$/, /^\/pagead\/(viewthroughconversion|1p-user-list|landing)\//],
-  [/(^|\.)google\.[a-z.]+$/, /^\/rmkt\/collect\//],
+  [/(^|\.)google\.[a-z.]+$/, /^\/(rmkt\/collect\/|measurement\/conversion|ads\/ga-audiences)/],
   [GOOGLE_COMPANION_HOST, /\/g\/collect$/],
   [/(^|\.)merchant-center-analytics\.goog$/, /^\/mc\/collect/],
   // Google tag pings on any host: consent mode (ccm), the Google tag's own /g/s/collect, and
@@ -217,8 +227,12 @@ export function providerOf(url) {
   if (/(^|\.)(doubleclick\.net|google\.[a-z.]+)$/.test(host) && /^\/(pagead|ccm)\//.test(u.pathname)) return of("google_ads");
   if (/(^|\.)doubleclick\.net$/.test(host)) return of("doubleclick");
   for (const [pattern, key] of HOSTS) if (pattern.test(host)) return of(key);
-  if (u.pathname.endsWith("/g/collect")) return of("ga4");
-  if (u.pathname.startsWith("/pagead/")) return of("google_ads");
+  if (isGa4Path(u)) return of("ga4");
+  if (u.pathname.startsWith("/pagead/") || /\/as\/p\/c\/\d+\/?$/.test(u.pathname)) return of("google_ads");
+  // Google Tag Manager and gtag.js served from the site's own domain (server-side GTM, Google tag gateway).
+  const id = u.searchParams.get("id") ?? "";
+  if (/^GTM-[A-Z0-9]+$/.test(id)) return of("gtm");
+  if (/\/gtag\/js$/.test(u.pathname) && id.startsWith("G-")) return of("ga4");
   return null;
 }
 

package/src/replay.js

@@ -1,8 +1,9 @@
 // Saved sites: the responses a site sent during an audit and the steps taken, so a later
 // version of the tool can audit the same pages offline and show what it now reports
 // differently. Replays need no network and no AI model, so they cost nothing.
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { harName } from "./agent.js";
 import { runAudit } from "./audit.js";
 
 export const SAVED_SITE_FILE = "site.json";
@@ -15,9 +16,11 @@ export function replayableJourney(run) {
     id: run.journeyId,
     viewport: run.viewport,
     ...(start ? { start } : {}),
+    // A journey the AI could not finish (no cart, a bot check) is still incomplete when its steps replay.
+    ...(run.completed ? {} : { incomplete: run.note }),
     steps: (start ? steps.slice(1) : steps)
       .filter((s) => s.replay)
-      .map((s) => ({ ...s.replay, reason: s.label, ...(s.acceptsConsent ? { accepts_consent: true } : {}) })),
+      .map((s) => ({ ...s.replay, reason: s.label, ...(s.acceptsConsent ? { accepts_consent: true } : {}), ...(s.error ? { optional: true } : {}) })),
   };
 }
 
@@ -41,6 +44,12 @@ export function compareKeys(expected, actual) {
 /** Writes site.json next to the recorded responses. The findings of this run become the expected ones. */
 export async function writeSavedSite(dir, { config, plan, runs, findings }) {
   await mkdir(dir, { recursive: true });
+  for (const run of runs) {
+    const har = path.join(dir, harName(run.journeyId, run.viewport));
+    if (!(await stat(har).catch(() => null))) {
+      throw new Error(`The recording of ${run.journeyId} (${run.viewport}) is missing, probably because the browser closed early. Save the site again.`);
+    }
+  }
   const { journeys: _journeys, plan: _plan, gtm_container: _gtm, ...site } = config;
   const saved = {
     version: 1,
@@ -86,7 +95,9 @@ export async function replaySavedSite(dir, { update = false, outDir, log = () =>
     });
     findings.push(...result.findings);
     reportPaths.push(result.reportPath);
-    incomplete.push(...result.runs.filter((r) => !r.completed).map((r) => `${r.journeyId} (${r.viewport}): ${r.note}`));
+    // Journeys that were already unfinished when saved are compared through their findings only.
+    const wasIncomplete = (r) => journeys.find((j) => j.id === r.journeyId)?.incomplete === r.note;
+    incomplete.push(...result.runs.filter((r) => !r.completed && !wasIncomplete(r)).map((r) => `${r.journeyId} (${r.viewport}): ${r.note}`));
   }
   const actual = findingKeys(findings);
   const { missing, extra } = compareKeys(saved.expected ?? [], actual);