@analitikisler/ai-tag-debugger 0.7.6 → 0.7.8

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.7.8 (2026-10-14)
+
+- Unnamed TikTok pings are left out of the duplicate check. TikTok sends them on its own timing, so their count changed between a save and its replay without the site changing.
+- A replay skips a malformed address in a recording instead of stopping, and reads the recording once.
+
+## 0.7.7 (2026-10-14)
+
+- A replay answers a request from the recording when the address only differs by a timestamp (`_=1791977697130`, `ts`, `timestamp`, `cb`, `nocache`). Magento sites reload the basket this way after "add to basket", so the replay never got the answer that makes the page send `add_to_cart`. Exact matches still come from the recording as before.
+- A click found without a saved path no longer keeps its text when it looks like an email address or phone number.
+
 ## 0.7.6 (2026-10-14)
 
 - `replay` says when a saved click was found by its text rather than its saved place (`~` lines), since that may not be the element that was saved.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@analitikisler/ai-tag-debugger",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "Open-source AI agent that QA-tests your website's analytics, ad and consent tracking (GA4, GTM, Google Ads, Meta, TikTok). Bring your own model (Claude, OpenAI, Gemini) or use it from your chat app over MCP.",
   "type": "module",
   "bin": {

package/src/browser.js

@@ -201,6 +201,41 @@ function trackingBody(request) {
  * How a scripted run can find the element an action used again: the selector it was given,
  * else a CSS path to the element, else its visible text. Refs only mean something in one run.
  */
+/** Query parameters that only carry the time or a cache-buster, so they differ between a recording and its replay. */
+const STAMP_PARAMS = /^(_|_t|ts|timestamp|cb|cachebust|nocache)$/i;
+/** The address without its timestamp parameters. */
+function unstamped(href) {
+  let url;
+  try { url = new URL(href); } catch { return href; }
+  for (const name of [...url.searchParams.keys()]) if (STAMP_PARAMS.test(name)) url.searchParams.delete(name);
+  return url.href;
+}
+/**
+ * The GET answers in a recording whose address carries a timestamp, by address without it.
+ * Entries the recording has no body for (still loading when the page was left) are not included.
+ */
+function restampedAnswers(har) {
+  const answers = new Map();
+  answers.exact = new Set();
+  for (const e of har.log.entries) {
+    const { request, response } = e;
+    answers.exact.add(request.url);
+    if (request.method !== "GET" || response.status < 200 || response.status >= 300 || typeof response.content?.text !== "string") continue;
+    const key = unstamped(request.url);
+    if (key === request.url) continue;
+    const headers = {};
+    for (const h of response.headers ?? []) {
+      const name = h.name.toLowerCase();
+      if (["content-encoding", "content-length", "transfer-encoding"].includes(name)) continue;
+      headers[name] = name === "set-cookie" && headers[name] ? `${headers[name]}\n${h.value}` : h.value;
+    }
+    const body = response.content.encoding === "base64" ? Buffer.from(response.content.text, "base64") : response.content.text;
+    const entry = answers.get(key) ?? { queue: [] };
+    entry.queue.push({ status: response.status, headers, body });
+    answers.set(key, entry);
+  }
+  return answers;
+}
 // Text that looks like an email address or phone number is not saved with a click.
 const savableText = (text) => (typeof text === "string" && text && !/@|\d[\d\s().+-]{6,}\d/.test(text) ? text : undefined);
 
@@ -228,7 +263,7 @@ async function replayTarget(a, locator) {
   const text = found?.text || a.text;
   // The text too, since a path through the page's layout breaks when a banner or overlay shifts it.
   if (found?.selector) return { selector: found.selector, ...(keepText && savableText(text) ? { text } : {}) };
-  return text ? { text } : {};
+  return keepText && savableText(text) ? { text } : {};
 }
 
 // Images, fonts and video don't change what tracking sends, and are most of a recording's size.
@@ -419,9 +454,25 @@ export class AuditSession {
         (isDroppedMedia(route.request()) ? route.fulfill({ status: 200, body: "" }) : route.abort()).catch(() => {}),
       );
       await this.context.routeFromHAR(this.opts.replayHar, { notFound: "fallback" });
+      const har = JSON.parse(await readFile(this.opts.replayHar, "utf8"));
+      // A page asks again for what it asked when saved, with a new timestamp on the address. Registered
+      // after the recording, so it runs first and leaves every exact match to the recording.
+      const restamped = restampedAnswers(har);
+      if (restamped.size) {
+        await this.context.route(
+          (url) => restamped.has(unstamped(url.href)),
+          (route) => {
+            const request = route.request();
+            const answers = restamped.get(unstamped(request.url()));
+            if (request.method() !== "GET" || restamped.exact.has(request.url())) return route.fallback().catch(() => {});
+            const answer = answers.queue.length > 1 ? answers.queue.shift() : answers.queue[0];
+            return route.fulfill(answer).catch(() => {});
+          },
+        );
+      }
       // A saved redirect to a page the browser may not open fails here, as it did when saved. Left to the
       // recording, the redirect would be followed outside any handler, and its failure would end the run.
-      const refusedRedirects = await this.refusedRedirects(this.opts.replayHar);
+      const refusedRedirects = await this.refusedRedirects(har);
       if (refusedRedirects.size) {
         await this.context.route((url) => refusedRedirects.has(url.href), (route) => route.abort("blockedbyclient").catch(() => {}));
       }
@@ -514,15 +565,15 @@ export class AuditSession {
   }
 
   /** Addresses whose saved answer redirects somewhere the browser may not go. */
-  async refusedRedirects(file) {
+  async refusedRedirects(har) {
     const refused = new Set();
-    const har = JSON.parse(await readFile(file, "utf8"));
     for (const e of har.log.entries) {
       const status = e.response?.status;
       if (status < 300 || status >= 400) continue;
       const location = e.response.redirectURL || e.response.headers?.find((h) => /^location$/i.test(h.name))?.value;
       if (!location) continue;
-      const target = new URL(location, e.request.url).href;
+      let target;
+      try { target = new URL(location, e.request.url).href; } catch { continue; }
       if (await this.checkUrl(target)) refused.add(e.request.url);
     }
     return refused;

package/src/checks.js

@@ -133,6 +133,8 @@ export function checkRun(plan, run, { lang = "en" } = {}) {
   for (const [, hits] of perStep) {
     const ev = planByKey.get(key(hits[0].platform, hits[0].name));
     if (hits.length < 2 || ev?.allow_multiple) continue;
+    // TikTok sends unnamed pings (no event name) on its own schedule, so their count varies between runs.
+    if (hits[0].platform === "tiktok" && hits[0].name === "(unnamed)") continue;
     findings.push({
       ...base,
       severity: "warning",