@pendo/agent 2.345.0 → 2.346.0

package/dist/pendo.module.js

@@ -668,7 +668,7 @@ function loadStagingAgent(config, pendo, debuggingEnabled) {
         var altAgentUrl = getAlternateAgentUrl(config, true, debuggingEnabled);
         if (altAgentUrl) {
             setupMethodCapture(pendo);
-            includeScript(altAgentUrl, pendo);
+            includeScript(altAgentUrl, pendo, config.pendoGlobalKey);
             return true;
         }
     }
@@ -679,7 +679,7 @@ function loadUnminifiedAgent(config, pendo, debuggingEnabled) {
         var altAgentUrl = getAlternateAgentUrl(config, false, debuggingEnabled);
         if (altAgentUrl) {
             setupMethodCapture(pendo);
-            includeScript(altAgentUrl, pendo);
+            includeScript(altAgentUrl, pendo, config.pendoGlobalKey);
             return true;
         }
     }
@@ -688,11 +688,16 @@ function loadUnminifiedAgent(config, pendo, debuggingEnabled) {
 function loadAlternateAgent(config, pendo, debuggingEnabled) {
     return loadStagingAgent(config, pendo, debuggingEnabled) || loadUnminifiedAgent(config, pendo, debuggingEnabled);
 }
-function includeScript(scriptUrl, pendo) {
+function includeScript(scriptUrl, pendo, globalKey) {
     var scriptTagName = 'script';
     var stagingScriptTag = document.createElement(scriptTagName);
     stagingScriptTag.async = true;
     stagingScriptTag.src = getPolicy(pendo).createScriptURL(scriptUrl);
+    // The alternate agent reads its global key from its own script tag, and its
+    // bundled PendoConfig doesn't carry the key the snippet set.
+    if (globalKey) {
+        stagingScriptTag.setAttribute('data-pendo-global-key', globalKey);
+    }
     var otherScriptTag = document.getElementsByTagName(scriptTagName)[0];
     if (otherScriptTag && otherScriptTag.parentNode) {
         otherScriptTag.parentNode.insertBefore(stagingScriptTag, otherScriptTag);
@@ -4009,6 +4014,9 @@ function shouldWrapHashChange() {
 function isMobileUserAgent() {
     return (/Android|webOS|iPhone|iPod|BlackBerry|IEMobile|Opera Mini/i).test(getUA());
 }
+function supportsPopover() {
+    return !!window.HTMLElement && isNativeCode(window.HTMLElement.prototype.showPopover);
+}
 function isSafari(userAgent = getUA()) {
     return userAgent.indexOf('Safari') >= 0 && !isChromium(userAgent);
 }
@@ -4021,6 +4029,7 @@ function isChromium(userAgent = getUA()) {
 const sniffer = {
     supportsHistoryApi: shouldWrapNativeHistory,
     supportsHashChange: shouldWrapHashChange,
+    supportsPopover,
     hasEvent(event) {
         // IE9 implements 'input' event it's so fubared that we rather pretend that it doesn't have
         // it. In particular the event is not fired when backspace or delete key are pressed or
@@ -4129,8 +4138,8 @@ let SERVER = '';
 let ASSET_HOST = '';
 let ASSET_PATH = '';
 let DESIGNER_SERVER = '';
-let VERSION = '2.345.0_';
-let PACKAGE_VERSION = '2.345.0';
+let VERSION = '2.346.0_';
+let PACKAGE_VERSION = '2.346.0';
 let LOADER = 'xhr';
 /* eslint-enable web-sdk-eslint-rules/no-gulp-env-references */
 /**
@@ -23855,6 +23864,78 @@ var backdropVisibilityStep = {
     script: backdropVisibilityRuntimeScript
 };
 
+// ":modal" also matches a fullscreen element, which cannot take children
+const MODAL_DIALOG = 'dialog:modal';
+function queryModalDialogs() {
+    try {
+        return document.querySelectorAll(MODAL_DIALOG);
+    }
+    catch (e) {
+        return [];
+    }
+}
+function closestModalDialog(element) {
+    try {
+        return element && _.isFunction(element.closest) ? element.closest(MODAL_DIALOG) : null;
+    }
+    catch (e) {
+        return null;
+    }
+}
+function queryConfiguredSelector(step) {
+    const selector = _.get(step, 'attributes.popover.selector');
+    if (!selector)
+        return null;
+    try {
+        return dom(selector)[0] || null;
+    }
+    catch (e) {
+        log.info('Invalid popover selector', { contexts: ['error', 'guide', 'render'] });
+        return null;
+    }
+}
+function findHost(step) {
+    const host = queryConfiguredSelector(step) ||
+        closestModalDialog(step.targetElement) ||
+        _.last(queryModalDialogs());
+    // a host inside a shadow root would change the guide's root node
+    return host && host.getRootNode() === document ? host : null;
+}
+function promoteToPopover(element) {
+    element.setAttribute('popover', 'manual');
+    try {
+        element.showPopover();
+    }
+    catch (e) {
+        element.removeAttribute('popover');
+        log.info('Failed to render guide as popover', { contexts: ['error', 'guide', 'render'] });
+    }
+}
+// Registered ahead of backdrop-visibility-step and autofocus-step, which mark the siblings of the
+// guide's ancestors: the guide must already be inside the dialog or the dialog ends up hidden.
+function popoverRuntimeScript(step, guide, pendo) {
+    if (pendo.designer || !step.guideElement)
+        return;
+    if (!_.get(step, 'attributes.popover.enabled') || !sniffer.supportsPopover())
+        return;
+    if (_.get(guide, 'attributes.resourceCenter') || _.get(guide, 'attributes.embedConfig'))
+        return;
+    const guideContainer = step.guideElement.find(`#${step.containerId}`);
+    if (!guideContainer.length)
+        return;
+    // positioned in document coordinates, which a fixed root in the top layer breaks
+    if (guideContainer.attr('data-vertical-alignment') === 'Relative to Element')
+        return;
+    const host = findHost(step);
+    if (!host)
+        return;
+    host.appendChild(step.guideElement[0]);
+    promoteToPopover(step.guideElement[0]);
+}
+var popoverStep = {
+    script: popoverRuntimeScript
+};
+
 function isTooltip({ _ }, step) {
     const tooltip = 'tooltip';
     return _.get(step, 'attributes.calculatedType') === tooltip ||
@@ -24011,6 +24092,7 @@ function registerPostrenderScripts(runtime) {
     _.each([
         advanceOnElement,
         announcementMarkSeen,
+        popoverStep,
         autofocusStep,
         backdropVisibilityStep,
         repositionOnScroll,
@@ -25966,8 +26048,14 @@ var MESSAGE_ENDED = 'pendo-live-preview::ended';
 var MESSAGE_END_ACK = 'pendo-live-preview::end-ack';
 var RELAY_END_MESSAGE_TIMEOUT = 2000;
 var activeRelay = null;
+// event.source alone is not enough: an ancestor page can navigate the relay frame to its own
+// document and keep the same window object, so the sender's origin has to be the relay's too.
+// An unknown relay origin ('*') cannot be matched, so it never authenticates a message.
 function isRelayMessage(event, relay) {
-    return event.source === relay.frame.contentWindow && !!event.data;
+    return relay.origin !== '*' &&
+        event.origin === relay.origin &&
+        event.source === relay.frame.contentWindow &&
+        !!event.data;
 }
 function sendConfig(relay) {
     if (!relay.frame.contentWindow)
@@ -28502,7 +28590,8 @@ class NetworkRequestIntercept {
                         return MAX_RESPONSE_SIZE_MESSAGE;
                     }
                 }
-                const text = yield config.text();
+                const canStream = config.body && _.isFunction(config.body.getReader) && typeof TextDecoder !== 'undefined';
+                const text = canStream ? yield this.readBodyStream(config.body) : yield config.text();
                 if (text.length > MAX_RESPONSE_SIZE) {
                     return MAX_RESPONSE_SIZE_MESSAGE;
                 }
@@ -28513,6 +28602,26 @@ class NetworkRequestIntercept {
             }
         });
     }
+    // Reads chunk by chunk so a long or never-ending stream stops buffering once it passes the cap
+    readBodyStream(body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const reader = body.getReader();
+            const decoder = new TextDecoder();
+            let text = '';
+            let bytesRead = 0;
+            let chunk = yield reader.read();
+            while (!chunk.done) {
+                bytesRead += chunk.value.byteLength;
+                if (bytesRead > MAX_RESPONSE_SIZE) {
+                    reader.cancel().catch(_.noop);
+                    return MAX_RESPONSE_SIZE_MESSAGE;
+                }
+                text += decoder.decode(chunk.value, { stream: true });
+                chunk = yield reader.read();
+            }
+            return text + decoder.decode();
+        });
+    }
     extractConfigHeaders(config) {
         let headers = {};
         if (config.headers) {
@@ -28585,33 +28694,7 @@ class NetworkRequestIntercept {
                 // Make the actual fetch call and capture response
                 try {
                     const res = yield networkInterceptor._originalFetch.apply(this, args);
-                    // Clone the response to avoid consuming the body
-                    const responseClone = res.clone();
-                    try {
-                        // Capture response data
-                        const responseBody = yield networkInterceptor.safelyReadBody(responseClone, 'response');
-                        const { status, statusText } = res;
-                        const headers = networkInterceptor.extractConfigHeaders(res);
-                        _.each(networkInterceptor.callbackFns, ({ response }) => {
-                            if (_.isFunction(response)) {
-                                response({
-                                    requestId,
-                                    status,
-                                    statusText,
-                                    body: responseBody,
-                                    headers,
-                                    url: transformedUrl,
-                                    method
-                                });
-                            }
-                        });
-                    }
-                    catch (e) {
-                        _.each(networkInterceptor.callbackFns, ({ error }) => {
-                            if (_.isFunction(error))
-                                error({ context: 'fetchResponse', error: e });
-                        });
-                    }
+                    networkInterceptor.captureResponse(res, { requestId, url: transformedUrl, method });
                     return res;
                 }
                 catch (error) {
@@ -28635,6 +28718,29 @@ class NetworkRequestIntercept {
             });
         };
     }
+    // Not awaited by the fetch wrapper: the app gets its response before the body is read
+    captureResponse(res, { requestId, url, method }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // Clone synchronously, before the app can consume the body
+                const responseClone = res.clone();
+                const body = yield this.safelyReadBody(responseClone, 'response');
+                const { status, statusText } = res;
+                const headers = this.extractConfigHeaders(res);
+                _.each(this.callbackFns, ({ response }) => {
+                    if (_.isFunction(response)) {
+                        response({ requestId, status, statusText, body, headers, url, method });
+                    }
+                });
+            }
+            catch (e) {
+                _.each(this.callbackFns, ({ error }) => {
+                    if (_.isFunction(error))
+                        error({ context: 'fetchResponse', error: e });
+                });
+            }
+        });
+    }
     patchXHR() {
         const networkInterceptor = this;
         networkInterceptor._originalSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
@@ -42167,7 +42273,7 @@ class PromptPlugin {
         });
         const currentlyActiveIds = this._.map(this._.filter(this.prompts, prompt => prompt.isActive), prompt => prompt.id);
         this._.each(allAgents, aiAgent => {
-            if (this.isConversationAgent(aiAgent)) {
+            if (this.isConversationAgent(aiAgent) || this.isNetworkAgent(aiAgent)) {
                 return;
             }
             const isCurrentlyActive = this._.contains(currentlyActiveIds, aiAgent.id);
@@ -42192,30 +42298,21 @@ class PromptPlugin {
     isConversationAgent(agent) {
         return agent.preset && agent.preset != 'chatgpt';
     }
+    // network tracking is not supported; these agents are ignored rather than falling back to DOM.
+    isNetworkAgent(agent) {
+        return agent.trackingMethod === 'network';
+    }
     onConfigLoaded(aiAgents = []) {
         if (!aiAgents || !this._.isArray(aiAgents) || aiAgents.length === 0) {
             return;
         }
-        const networkAgents = [];
         const domAgents = [];
         for (const agent of aiAgents) {
-            if (this.isConversationAgent(agent)) {
+            if (this.isConversationAgent(agent) || this.isNetworkAgent(agent)) {
                 continue;
             }
-            if (agent.trackingMethod === 'network') {
-                networkAgents.push(agent);
-            }
-            else if (agent.trackingMethod === 'dom') {
-                domAgents.push(agent);
-            }
-            else {
-                // Default to DOM if no trackingMethod specified
-                domAgents.push(agent);
-            }
-        }
-        if (networkAgents.length > 0) {
-            this.networkAgents = networkAgents;
-            this.api.NetworkRequest.on({ request: this.handleRequest, error: this.handleError });
+            // Default to DOM if no trackingMethod specified
+            domAgents.push(agent);
         }
         // Cache agents for fast lookup
         if (!this.agentsCache) {
@@ -42236,29 +42333,6 @@ class PromptPlugin {
             }
         });
     }
-    handleRequest({ method, url, body }) {
-        const currentUrl = getNormalizedUrl();
-        this._.each(this.networkAgents, aiAgent => {
-            if (!this.testPageRule(aiAgent.pageRule, currentUrl, aiAgent.id)) {
-                return;
-            }
-            const originalBody = body || '';
-            this.api.analytics.collectEvent('prompt', {
-                prompt: originalBody,
-                agentId: aiAgent.id,
-                promptType: method,
-                url
-            }, undefined, 'agentic');
-        });
-    }
-    handleError({ error, context }) {
-        if (context == 'fetch') {
-            this.api.log.debug('[PromptPlugin] Fetch tracking failed:', error);
-        }
-        if (context == 'xhr') {
-            this.api.log.debug('[PromptPlugin] XHR tracking failed:', error);
-        }
-    }
     observePrompt(config) {
         const { id, cssSelectors } = config;
         // Check if agent already exists
@@ -42297,7 +42371,6 @@ class PromptPlugin {
         if (this.agentsCache) {
             this.agentsCache.clear();
         }
-        this.api.NetworkRequest.off({ request: this.handleRequest, error: this.handleError });
     }
 }
 var PromptAnalytics = new PromptPlugin();
@@ -43650,6 +43723,13 @@ function encodeMetadataForUrl(value, urlBeforePlaceholder = '') {
     }
     return window.encodeURI(str);
 }
+// Resolve through the browser's own URL parser: it strips tabs/newlines inside the scheme
+// (e.g. "java\tscript:"), which a regex over the raw string would miss.
+function hasDangerousUrlScheme(url) {
+    const anchor = document.createElement('a');
+    anchor.href = url;
+    return DANGEROUS_URL_SCHEME.test(anchor.protocol);
+}
 
 const MetadataSubstitution = {
     name: 'MetadataSubstitution',
@@ -43736,27 +43816,37 @@ function processPlaceholder(placeholder, pendo) {
     let match;
     const { data, target } = placeholder;
     const subRegex = new RegExp(guideMarkdownUtil.substitutionRegex);
+    const isUrlTarget = target === 'href' || target === 'value';
+    const startedWithDangerousScheme = isUrlTarget && hasDangerousUrlScheme(getRawTargetValue(data, target));
     while ((match = matchPlaceholder(placeholder, subRegex))) {
         const usedArrayPath = Array.isArray(match) && match.length >= 2;
         const currentStr = target === 'textContent'
             ? data[target]
-            : decodeURI((data.getAttribute && (target === 'href' || target === 'value') ? (data.getAttribute(target) || '') : data[target]));
+            : decodeURI(getRawTargetValue(data, target));
         const matched = usedArrayPath ? match : subRegex.exec(currentStr);
         if (!matched)
             continue;
         const mdValue = getSubstituteValue(matched, pendo);
         substituteMetadataByTarget(data, target, mdValue, matched);
+        // Substituted values can carry new placeholders into the next pass, so a dangerous
+        // scheme can be assembled across passes. Check the whole URL, not each fragment.
+        if (isUrlTarget && !startedWithDangerousScheme && hasDangerousUrlScheme(getRawTargetValue(data, target))) {
+            data[target] = '';
+            return;
+        }
     }
 }
+function getRawTargetValue(data, target) {
+    return data.getAttribute && (target === 'href' || target === 'value')
+        ? (data.getAttribute(target) || '')
+        : data[target];
+}
 function matchPlaceholder(placeholder, regex) {
     if (placeholder.target === 'textContent') {
         return placeholder.data[placeholder.target].match(regex);
     }
     else {
-        const raw = placeholder.data.getAttribute && (placeholder.target === 'href' || placeholder.target === 'value')
-            ? (placeholder.data.getAttribute(placeholder.target) || '')
-            : placeholder.data[placeholder.target];
-        return decodeURI(raw).match(regex);
+        return decodeURI(getRawTargetValue(placeholder.data, placeholder.target)).match(regex);
     }
 }
 function getMetadataValueCaseInsensitive(metadata, type, property) {
@@ -53413,6 +53503,7 @@ function createReplayPlugin() {
 /**
  * limit of number of keys in an object
  * if an object contains more keys than this limit, we would call its toString function directly
+ * arrays longer than this limit are cut down to their first NUM_OF_KEYS_LIMIT elements
  */
 const NUM_OF_KEYS_LIMIT = 50;
 /**
@@ -53484,8 +53575,9 @@ function shouldIgnore(_obj) {
 /**
  * stringify any argument
  * @param arg - the arg to stringify
+ * @param maxLength - stop serializing once this many characters have been visited
  */
-function stringify(arg) {
+function stringify(arg, maxLength = Infinity) {
     if (arg === undefined)
         return 'undefined';
     // Handle primitives
@@ -53496,11 +53588,19 @@ function stringify(arg) {
             return arg.toString();
         return String(arg);
     }
+    let charsVisited = 0;
     return JSON.stringify(arg, function (key, value) {
+        if (charsVisited > maxLength)
+            return '';
+        const valueLength = typeof value === 'string' ? value.length : 0;
+        charsVisited += key.length + valueLength;
         if (value === null)
             return value;
         if (value === undefined)
             return 'undefined';
+        if (Array.isArray(value) && value.length > NUM_OF_KEYS_LIMIT) {
+            return value.slice(0, NUM_OF_KEYS_LIMIT);
+        }
         // Handle objects
         if (shouldIgnore(value)) {
             return value.toString ? value.toString() : '[object Object]';
@@ -54127,8 +54227,11 @@ function ConsoleCapture() {
     let isRecordingActive = false;
     const CAPTURE_CONSOLE_CONFIG = 'captureConsoleLogs';
     const ALWAYS_CAPTURE_ERRORS_CONFIG = 'alwaysCaptureDevLogErrors';
+    const CONSOLE_LOG_LEVELS_CONFIG = 'consoleLogLevels';
     const CONSOLE_METHODS = ['log', 'warn', 'error', 'info'];
     const DEV_LOG_SUB_TYPE = 'console';
+    const DEFAULT_CONSOLE_LOG_LEVELS = ['error', 'warn', 'info'];
+    let consoleLogLevels = DEFAULT_CONSOLE_LOG_LEVELS;
     // deduplicate logs
     let lastLogKey = '';
     return {
@@ -54147,6 +54250,8 @@ function ConsoleCapture() {
         onPtmPaused,
         onPtmUnpaused,
         securityPolicyViolationFn,
+        uncaughtErrorFn,
+        unhandledRejectionFn,
         get isCapturingConsoleLogs() {
             return isCapturingConsoleLogs;
         },
@@ -54166,10 +54271,12 @@ function ConsoleCapture() {
         const { ConfigReader } = pluginAPI;
         ConfigReader.addOption(CAPTURE_CONSOLE_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
         ConfigReader.addOption(ALWAYS_CAPTURE_ERRORS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], false);
+        ConfigReader.addOption(CONSOLE_LOG_LEVELS_CONFIG, [ConfigReader.sources.PENDO_CONFIG_SRC], DEFAULT_CONSOLE_LOG_LEVELS);
         const captureConsoleEnabled = ConfigReader.get(CAPTURE_CONSOLE_CONFIG);
         if (!captureConsoleEnabled)
             return;
         alwaysCaptureErrors = !!ConfigReader.get(ALWAYS_CAPTURE_ERRORS_CONFIG);
+        consoleLogLevels = ConfigReader.get(CONSOLE_LOG_LEVELS_CONFIG);
         globalPendo = pendo;
         buffer = new DevlogBuffer(pendo, pluginAPI);
         transport = new DevlogTransport(pendo, pluginAPI);
@@ -54230,6 +54337,8 @@ function ConsoleCapture() {
         try {
             addIntercepts();
             pluginAPI.attachEventInternal(window, 'securitypolicyviolation', securityPolicyViolationFn);
+            pluginAPI.attachEventInternal(window, 'error', uncaughtErrorFn);
+            pluginAPI.attachEventInternal(window, 'unhandledrejection', unhandledRejectionFn);
         }
         catch (error) {
             pluginAPI.log.error('Error setting up console capture intercepts: ', error);
@@ -54270,16 +54379,36 @@ function ConsoleCapture() {
             createConsoleEvent([message], 'error', { skipStackTrace: true, skipScrubPII: true });
         }
     }
+    function uncaughtErrorFn(evt) {
+        if (!evt || typeof evt !== 'object')
+            return;
+        const rawMessage = evt.message || (evt.error && String(evt.error));
+        if (!rawMessage)
+            return;
+        const message = rawMessage.indexOf('Uncaught') === 0 ? rawMessage : `Uncaught ${rawMessage}`;
+        const stackTrace = evt.error && evt.error.stack;
+        createConsoleEvent([stackTrace ? `${message}\n${stackTrace}` : message], 'error', { skipStackTrace: true });
+    }
+    function unhandledRejectionFn(evt) {
+        if (!evt || typeof evt !== 'object')
+            return;
+        const { reason } = evt;
+        const detail = reason && reason.stack ? reason.stack : reason;
+        createConsoleEvent(['Uncaught (in promise)', detail], 'error', { skipStackTrace: true });
+    }
     function createConsoleEvent(args, methodName, { skipStackTrace = false, skipScrubPII = false } = {}) {
         if (!isCapturingConsoleLogs || !args || args.length === 0 || !_.contains(CONSOLE_METHODS, methodName))
             return;
         if (isErrorOnlyCapture() && methodName !== 'error')
             return;
+        const devLogLevel = methodName === 'log' ? 'info' : methodName;
+        if (!_.contains(consoleLogLevels, devLogLevel))
+            return;
         // stringify args
         let message = _.compact(_.map(args, arg => {
             let stringifiedArg;
             try {
-                stringifiedArg = stringify(arg);
+                stringifiedArg = stringify(arg, MAX_LENGTH);
             }
             catch (error) {
                 pluginAPI.log.error('Error stringifying arg: ', error);
@@ -54303,10 +54432,10 @@ function ConsoleCapture() {
             buffer.lastEvent.devLogCount++;
             return;
         }
-        const devLogEnvelope = createDevLogEnvelope(pluginAPI, globalPendo);
-        const consoleEvent = Object.assign(Object.assign({}, devLogEnvelope), { subType: DEV_LOG_SUB_TYPE, devLogLevel: methodName === 'log' ? 'info' : methodName, devLogMessage: skipScrubPII ? message : scrubPII({ string: message, _ }), devLogTrace: stackTrace, devLogCount: 1 });
         if (!buffer.hasTokenAvailable())
-            return consoleEvent;
+            return;
+        const devLogEnvelope = createDevLogEnvelope(pluginAPI, globalPendo);
+        const consoleEvent = Object.assign(Object.assign({}, devLogEnvelope), { subType: DEV_LOG_SUB_TYPE, devLogLevel, devLogMessage: skipScrubPII ? message : scrubPII({ string: message, _ }), devLogTrace: stackTrace, devLogCount: 1 });
         if (!isPtmPaused) {
             pluginAPI.Events.eventCaptured.trigger(consoleEvent);
         }
@@ -54364,6 +54493,8 @@ function ConsoleCapture() {
         pluginAPI.Events['recording:unpaused'].off(recordingStarted);
         pluginAPI.Events['recording:paused'].off(recordingStopped);
         pluginAPI.detachEventInternal(window, 'securitypolicyviolation', securityPolicyViolationFn);
+        pluginAPI.detachEventInternal(window, 'error', uncaughtErrorFn);
+        pluginAPI.detachEventInternal(window, 'unhandledrejection', unhandledRejectionFn);
         _.each(CONSOLE_METHODS, function (methodName) {
             if (!console[methodName])
                 return _.noop;