@sailfish-ai/recorder 1.7.20 → 1.7.22

package/dist/index.js

@@ -1,7 +1,7 @@
 const DEBUG = import.meta.env.VITE_DEBUG ? import.meta.env.VITE_DEBUG : false;
 // import { NetworkRecordOptions } from "@sailfish-rrweb/rrweb-plugin-network-record";
 import { v4 as uuidv4 } from "uuid";
-import { NetworkRequestEventId, xSf3RidHeader } from "./constants";
+import { NetworkRequestEventId, STATIC_EXTENSIONS, xSf3RidHeader, } from "./constants";
 import { gatherAndCacheDeviceInfo } from "./deviceInfo";
 import { fetchCaptureSettings, sendDomainsToNotPropagateHeaderTo, startRecordingSession, } from "./graphql";
 import { sendMapUuidIfAvailable } from "./mapUuid";
@@ -16,19 +16,115 @@ const DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT = [
     "*.googleapis.com",
     "*.amazonaws.com", // Exclude AWS S3
     "*.smooch.io", // Exclude smooch-related requests
-    "*.zendesk.com", // Exclude zendesk-related requests
+    // Exclude zendesk-related requests
+    "*.zendesk.com",
+    "*.zdassets.com",
 ];
 const BAD_HTTP_STATUS = [
     400, // BAD REQUEST
     403, // FORBIDDEN
 ];
 const CORS_KEYWORD = "CORS";
-const DYNAMIC_PASSED_HOSTS_KEY = "dynamicPassedHosts";
-const DYNAMIC_EXCLUDED_HOSTS_KEY = "dynamicExcludedHosts";
+export const STORAGE_VERSION = 1;
+export const DYNAMIC_PASSED_HOSTS_KEY = "dynamicPassedHosts";
+export const DYNAMIC_EXCLUDED_HOSTS_KEY = "dynamicExcludedHosts";
 const SF_API_KEY_FOR_UPDATE = "sailfishApiKey";
 const SF_BACKEND_API = "sailfishBackendApi";
 const INCLUDE = "include";
 const SAME_ORIGIN = "same-origin";
+const ALLOWED_HEADERS_HEADER = "access-control-allow-headers";
+const OPTIONS = "OPTIONS";
+export const dynamicExcludedHosts = new Set();
+export const dynamicPassedHosts = new Set();
+// 1️⃣ dynamicExcludedHosts.add override
+const originalExcludedAdd = dynamicExcludedHosts.add;
+dynamicExcludedHosts.add = (host) => {
+    const cleaned = host?.trim();
+    if (!cleaned || dynamicExcludedHosts.has(cleaned)) {
+        return dynamicExcludedHosts;
+    }
+    // 1. Add to the excluded Set
+    originalExcludedAdd.call(dynamicExcludedHosts, cleaned);
+    // 2. If it was previously in passed, remove it
+    if (dynamicPassedHosts.has(cleaned)) {
+        dynamicPassedHosts.delete(cleaned);
+    }
+    // 3. Consolidate dynamic exclusions into smart wildcards
+    const consolidated = consolidateDynamicExclusions(dynamicExcludedHosts);
+    dynamicExcludedHosts.clear();
+    for (const p of consolidated) {
+        originalExcludedAdd.call(dynamicExcludedHosts, p);
+    }
+    // 4. Persist wrapper to localStorage
+    try {
+        // TODO decouple into two logical pieces
+        const wrapper = {
+            version: STORAGE_VERSION,
+            entries: {},
+        };
+        const now = Date.now();
+        for (const p of dynamicExcludedHosts) {
+            wrapper.entries[p] = now;
+        }
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(wrapper));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicExcludedHosts failed:", e);
+    }
+    // 5. Notify backend of the updated Set
+    updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
+    return dynamicExcludedHosts;
+};
+// 2️⃣ dynamicPassedHosts.add override (timestamps refreshed on every call)
+const originalPassedAdd = dynamicPassedHosts.add;
+dynamicPassedHosts.add = (host) => {
+    const cleaned = host?.trim();
+    if (!cleaned) {
+        return dynamicPassedHosts;
+    }
+    // 1. Persist wrapper to localStorage (update timestamp unconditionally)
+    try {
+        // TODO decouple into two logical pieces
+        const raw = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
+        let wrapper;
+        if (!raw) {
+            wrapper = { version: STORAGE_VERSION, entries: {} };
+        }
+        else {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed)) {
+                // migrate old array → wrapper
+                wrapper = {
+                    version: STORAGE_VERSION,
+                    entries: Object.fromEntries(parsed.map((h) => [h, Date.now()])),
+                };
+            }
+            else if (parsed &&
+                typeof parsed === "object" &&
+                "entries" in parsed &&
+                typeof parsed.entries === "object") {
+                wrapper = parsed;
+            }
+            else {
+                wrapper = { version: STORAGE_VERSION, entries: {} };
+            }
+        }
+        // always set/update the timestamp
+        wrapper.entries[cleaned] = Date.now();
+        wrapper.version = STORAGE_VERSION;
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(wrapper));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicPassedHosts failed:", e);
+    }
+    // 2. Add to the passed Set if not already present
+    if (!dynamicPassedHosts.has(cleaned)) {
+        originalPassedAdd.call(dynamicPassedHosts, cleaned);
+    }
+    return dynamicPassedHosts;
+};
 /**
  * Notify the backend of the updated dynamicExcludedHosts
  */
@@ -40,58 +136,114 @@ function updateExcludedHostsStorageAndBackend(dynamicExcludedHosts) {
     }
     sendDomainsToNotPropagateHeaderTo(apiKeyForUpdate, [...dynamicExcludedHosts, ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT], apiForUpdate).catch((error) => console.error("Failed to send domains to not propagate header to:", error));
 }
-const dynamicExcludedHosts = new Set();
-const dynamicPassedHosts = new Set();
-// Load initial dynamicExcludedHosts from localStorage
+/**
+ * Given a set of excluded hostPaths (like "foo.com/bar", "foo.com/baz", etc.),
+ * find any path prefixes under each host that appear ≥ threshold times,
+ * and replace their individual entries with a single wildcard pattern
+ * (e.g. "foo.com/bar*").
+ */
+export function consolidateDynamicExclusions(hostPathSet, threshold = 3) {
+    // 1️⃣ Group by host
+    const byHost = {};
+    for (const hostPath of hostPathSet) {
+        const [host, ...rest] = hostPath.split("/");
+        const path = rest.length ? `/${rest.join("/")}` : "/";
+        (byHost[host] ??= []).push(path);
+    }
+    const newSet = new Set();
+    for (const host in byHost) {
+        const paths = byHost[host];
+        if (paths.length < threshold) {
+            // not enough entries to bother; keep them as-is
+            for (const p of paths)
+                newSet.add(`${host}${p}`);
+            continue;
+        }
+        const root = { count: 0, children: new Map() };
+        for (const p of paths) {
+            root.count++;
+            const segments = p.split("/").filter(Boolean);
+            let node = root;
+            for (const seg of segments) {
+                if (!node.children.has(seg)) {
+                    node.children.set(seg, { count: 0, children: new Map() });
+                }
+                node = node.children.get(seg);
+                node.count++;
+            }
+        }
+        // 3️⃣ Walk the trie and pick prefixes where node.count ≥ threshold
+        function gather(node, prefixSegments) {
+            // if this node covers ≥ threshold of this host’s paths, collapse here
+            if (node.count >= threshold && prefixSegments.length > 0) {
+                const wildcardPath = "/" + prefixSegments.join("/") + "/*";
+                newSet.add(`${host}${wildcardPath}`);
+                return;
+            }
+            // otherwise, recurse into children
+            for (const [seg, child] of node.children) {
+                gather(child, prefixSegments.concat(seg));
+            }
+        }
+        gather(root, []);
+    }
+    return newSet;
+}
+// 2️⃣ Load & evict old entries (>7 days) + version check for Excluded
 (() => {
     const stored = localStorage.getItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
-    if (stored) {
-        try {
-            JSON.parse(stored).forEach((host) => dynamicExcludedHosts.add(host));
-        }
-        catch (e) {
-            if (DEBUG)
-                console.log("Failed to parse dynamicExcludedHosts from storage", e);
+    if (!stored)
+        return;
+    try {
+        const wrapper = JSON.parse(stored);
+        // if it's from an old version, drop it
+        if (wrapper.version !== STORAGE_VERSION) {
             localStorage.removeItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
+            return;
         }
+        const now = Date.now();
+        const valid = {};
+        for (const [host, ts] of Object.entries(wrapper.entries)) {
+            if (now - ts < 7 * 24 * 60 * 60 * 1000) {
+                dynamicExcludedHosts.add(host);
+                valid[host] = ts;
+            }
+        }
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify({ version: STORAGE_VERSION, entries: valid }));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Failed to parse dynamicExcludedHosts:", e);
+        localStorage.removeItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
     }
 })();
-// Load initial dynamicPassedHosts from localStorage
+// 3️⃣ Load & evict old entries (>7 days) + version check for Passed
 (() => {
     const stored = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
-    if (stored) {
-        try {
-            JSON.parse(stored).forEach((host) => dynamicPassedHosts.add(host));
-        }
-        catch (e) {
-            if (DEBUG)
-                console.log("Failed to parse dynamicPassedHosts from storage", e);
+    if (!stored)
+        return;
+    try {
+        const wrapper = JSON.parse(stored);
+        if (wrapper.version !== STORAGE_VERSION) {
             localStorage.removeItem(DYNAMIC_PASSED_HOSTS_KEY);
+            return;
         }
+        const now = Date.now();
+        const valid = {};
+        for (const [host, ts] of Object.entries(wrapper.entries)) {
+            if (now - ts < 7 * 24 * 60 * 60 * 1000) {
+                dynamicPassedHosts.add(host);
+                valid[host] = ts;
+            }
+        }
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify({ version: STORAGE_VERSION, entries: valid }));
     }
-})();
-// Override add() to persist updates to localStorage
-const originalExcludedAdd = dynamicExcludedHosts.add;
-dynamicExcludedHosts.add = (host) => {
-    const cleanedHost = host?.trim();
-    if (!cleanedHost) {
-        return dynamicExcludedHosts;
+    catch (e) {
+        if (DEBUG)
+            console.warn("Failed to parse dynamicPassedHosts:", e);
+        localStorage.removeItem(DYNAMIC_PASSED_HOSTS_KEY);
     }
-    originalExcludedAdd.call(dynamicExcludedHosts, cleanedHost);
-    localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
-    updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
-    return dynamicExcludedHosts;
-};
-const originalPassedAdd = dynamicPassedHosts.add;
-dynamicPassedHosts.add = (host) => {
-    const cleanedHost = host?.trim();
-    if (!cleanedHost) {
-        return dynamicPassedHosts;
-    }
-    originalPassedAdd.call(dynamicPassedHosts, cleanedHost);
-    localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
-    return dynamicPassedHosts;
-};
+})();
 const ActionType = {
     PROPAGATE: "propagate",
     IGNORE: "ignore",
@@ -197,7 +349,10 @@ function getOrSetUserDeviceUuid() {
     let userDeviceUuid = localStorage.getItem("sailfishUserDeviceUuid");
     if (!userDeviceUuid) {
         userDeviceUuid = uuidv4();
-        localStorage.setItem("sailfishUserDeviceUuid", userDeviceUuid);
+        try {
+            localStorage.setItem("sailfishUserDeviceUuid", userDeviceUuid);
+        }
+        catch { }
     }
     return userDeviceUuid;
 }
@@ -295,65 +450,29 @@ export function matchUrlWithWildcard(url, patterns) {
         return true;
     });
 }
-function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo = []) {
-    const combinedIgnoreDomains = [
+function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeaderTo = []) {
+    const urlObj = new URL(url, window.location.href);
+    // 1️⃣ STATIC ASSET EXCLUSIONS (by comprehensive file extension list)
+    for (const ext of STATIC_EXTENSIONS) {
+        if (urlObj.pathname.toLowerCase().endsWith(ext)) {
+            return true;
+        }
+    }
+    // 2️⃣ WILDCARD-BASED EXCLUSION (domain + path)
+    // Pass patterns like ["*.cdn.com/*", "api.example.com/v1/*"]
+    const combinedPatterns = [
         ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT,
-        ...domainsToNotPropagateHeadersTo,
+        ...domainsToNotPropagateHeaderTo,
     ];
-    const defaultExcluded = matchUrlWithWildcard(url, combinedIgnoreDomains);
-    if (defaultExcluded) {
+    if (matchUrlWithWildcard(url, combinedPatterns)) {
         return true;
     }
-    const domain = new URL(url).hostname;
-    // Check dynamically excluded hosts (those that reject the tracing header runtime)
-    return dynamicExcludedHosts.has(domain);
-}
-/**
- * Performs an OPTIONS preflight check using XHR.
- * Returns ActionType.PROPAGATE if server responds 2xx, ActionType.IGNORE on error or non-2xx.
- */
-function performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain) {
-    return new Promise((resolve) => {
-        const xhr = new XMLHttpRequest();
-        xhr.open("OPTIONS", url, true);
-        // Mirror credentials
-        xhr.withCredentials = init.credentials === INCLUDE;
-        // CORS preflight headers
-        const method = (init.method || "GET").toUpperCase();
-        xhr.setRequestHeader("Access-Control-Request-Method", method);
-        const rawHeaders = init.headers instanceof Headers
-            ? Object.entries(init.headers)
-            : init.headers || {};
-        const customHeaders = Object.keys(rawHeaders)
-            .map((h) => h.toLowerCase())
-            .filter((h) => ![
-            "accept",
-            "content-type",
-            "accept-language",
-            "content-language",
-        ].includes(h));
-        if (customHeaders.length) {
-            xhr.setRequestHeader("Access-Control-Request-Headers", customHeaders.join(","));
-        }
-        // Add tracing header
-        this.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
-        xhr.onload = () => {
-            if (xhr.status >= 200 && xhr.status < 300) {
-                resolve(ActionType.PROPAGATE);
-            }
-            else {
-                DEBUG &&
-                    console.log(`[XHR Interceptor] OPTIONS returned status ${xhr.status} for ${domain}`);
-                resolve(null);
-            }
-        };
-        xhr.onerror = () => {
-            DEBUG &&
-                console.log(`[XHR Interceptor] Preflight OPTIONS CORS or network error for ${domain}`);
-            resolve(ActionType.IGNORE);
-        };
-        xhr.send();
-    });
+    // 3️⃣ DYNAMIC-FAILURE EXCLUSION (exact host)
+    const hostname = urlObj.hostname;
+    if (dynamicExcludedHosts.has(hostname)) {
+        return true;
+    }
+    return false;
 }
 // Updated XMLHttpRequest interceptor with domain exclusion
 function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
@@ -379,120 +498,101 @@ function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
         this._capturedRequestHeaders = {};
         return originalOpen.apply(this, [method, url, ...args]);
     };
-    // Intercept send()
+    // 1️⃣ XHR interceptor send()
     XMLHttpRequest.prototype.send = function (...args) {
         const url = this._requestUrl;
-        if (!url)
+        if (!url) {
             return originalSend.apply(this, args);
-        const domain = new URL(url).hostname;
-        // Skip domain check for excluded domains
+        }
+        // parse host+path for exclusion
+        const urlObj = new URL(url, window.location.href);
+        const domain = urlObj.hostname;
+        const hostPath = urlObj.pathname === "/" ? domain : `${domain}${urlObj.pathname}`;
+        // 1️⃣ Skip injection for excluded domains/paths
         if (shouldSkipHeadersPropagation(url, domainsToNotPropagateHeaderTo)) {
             return originalSend.apply(this, args);
         }
+        // 2️⃣ Prepare header and IDs
         const pageVisitUUID = sessionStorage.getItem("pageVisitUUID");
         const networkUUID = uuidv4();
-        const xSf3RidHeaderValue = `${sessionId}/${pageVisitUUID}/${networkUUID}`;
-        const proceedSend = () => {
-            if (sessionId) {
-                try {
-                    this.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
-                }
-                catch (e) {
-                    console.warn(`Could not set X-Sf3-Rid header for ${url}`, e);
-                }
+        const headerValue = `${sessionId}/${pageVisitUUID}/${networkUUID}`;
+        try {
+            this.setRequestHeader(xSf3RidHeader, headerValue);
+        }
+        catch (e) {
+            console.warn(`Could not set X-Sf3-Rid for ${url}`, e);
+        }
+        // 3️⃣ Track timing
+        const startTime = Date.now();
+        let finished = false;
+        // 4️⃣ Helper to emit networkRequestFinished
+        const emitFinished = (success, status, errorMsg) => {
+            if (finished)
+                return;
+            finished = true;
+            const endTime = Date.now();
+            sendEvent({
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: status,
+                    success,
+                    error: errorMsg,
+                    method: this._requestMethod,
+                    url,
+                },
+                ...getUrlAndStoredUuids(),
+            });
+            // 5️⃣ Update dynamic sets
+            if (success) {
+                // once any route passes, skip preflight on entire domain
+                dynamicPassedHosts.add(domain);
+            }
+            else {
+                // only exclude the specific failing path
+                dynamicExcludedHosts.add(hostPath);
             }
-            // On CORS or network error during send, add domain to passed-hosts list
-            this.addEventListener("error", () => {
-                dynamicExcludedHosts.add(domain);
-            }, { once: true });
-            // On successful send (HTTP 2xx), add domain to passed-hosts list
-            this.addEventListener("load", () => {
-                if (this.status === 0) {
-                    // status 0 on load is often a CORS‐blocked response
-                    dynamicExcludedHosts.add(domain);
-                }
-                if (this.status >= 200 && this.status < 300) {
-                    dynamicPassedHosts.add(domain);
-                }
-            }, { once: true });
-            return originalSend.apply(this, args);
         };
-        if (!dynamicPassedHosts.has(domain)) {
-            // perform XHR-based preflight
-            const init = {
-                method: this._requestMethod,
-                headers: this._capturedRequestHeaders,
-                credentials: this.withCredentials ? INCLUDE : SAME_ORIGIN,
-            };
-            performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain)
-                .then((preflight) => {
-                if (preflight === ActionType.IGNORE) {
-                    dynamicExcludedHosts.add(domain);
-                    originalSend.call(this, args);
-                }
-                else {
-                    proceedSend();
-                }
-            })
-                .catch(() => {
-                // On error, treat as ignore
-                dynamicExcludedHosts.add(domain);
-                originalSend.call(this, args);
-            });
-            // just return void
-            return;
-        }
-        return proceedSend();
+        // 6️⃣ On successful load
+        this.addEventListener("load", () => {
+            const status = this.status || 0;
+            if (status >= 200 && status < 300) {
+                emitFinished(true, status, "");
+            }
+            else {
+                const msg = this.statusText || `HTTP ${status}`;
+                emitFinished(false, status, msg);
+            }
+        }, { once: true });
+        // 7️⃣ On network/CORS error
+        this.addEventListener("error", () => {
+            // XHR error events often mean CORS or connectivity; status is usually 0
+            const status = this.status || 0;
+            const msg = status === 0
+                ? "Network or CORS failure"
+                : this.statusText || `Error ${status}`;
+            emitFinished(false, status, msg);
+        }, { once: true });
+        // 8️⃣ Finally, send the request
+        return originalSend.apply(this, args);
     };
 }
-/**
- * Performs an OPTIONS preflight check to decide header propagation.
- * Returns 'propagate' if OPTIONS succeeds, 'ignore' otherwise.
- */
-async function performOptionsPreflight(target, thisArg, url, init, sessionId, domain) {
-    try {
-        const headers = new Headers(init.headers || {});
-        headers.set(xSf3RidHeader, sessionId);
-        const response = await target.call(thisArg, url, {
-            method: "OPTIONS",
-            headers,
-        });
-        if (response.ok) {
-            return ActionType.PROPAGATE;
-        }
-        else {
-            DEBUG &&
-                console.log(`[Fetch Interceptor] OPTIONS returned status ${response.status} for ${domain}`);
-            return null;
-        }
-    }
-    catch (error) {
-        // Treat fetch errors (likely CORS failures) as ignore
-        if (error instanceof TypeError || error?.message?.includes(CORS_KEYWORD)) {
-            DEBUG &&
-                console.log(`[Fetch Interceptor] Preflight OPTIONS CORS error for ${domain}:`, error);
-            return ActionType.IGNORE;
-        }
-        // Other failures also ignored as some APIs or reverse proxies (e.g. NGINX) don’t route
-        // or handle OPTIONS requests, leading to:
-        // * 404 Not Found
-        // * 405 Method Not Allowed
-        // * 500 Internal Server Error
-        DEBUG &&
-            console.log(`[Fetch Interceptor] Preflight OPTIONS failed for ${domain}:`, error);
-        return null;
-    }
-}
 // Updated fetch interceptor with exclusion handling
 function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
     const originalFetch = window.fetch;
     const sessionId = getOrSetSessionId();
-    const cache = new Map();
+    const cachedDomains = new Map();
     window.fetch = new Proxy(originalFetch, {
         apply: async (target, thisArg, args) => {
             let input = args[0];
             let init = args[1] || {};
             let url;
+            // 1️⃣ Normalize URL string
             if (typeof input === "string") {
                 url = input;
             }
@@ -503,130 +603,103 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
                 url = input.href;
             }
             else {
-                return target.apply(thisArg, args); // Skip unsupported inputs
+                return target.apply(thisArg, args);
             }
-            // Determine the target domain
             const domain = new URL(url, window.location.href).hostname;
-            // Use cached decision if available
-            if (cache.has(domain)) {
-                const decision = cache.get(domain);
-                if (decision === ActionType.IGNORE) {
-                    return target.apply(thisArg, args);
-                }
-                if (decision === ActionType.PROPAGATE) {
-                    return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
-                }
-            }
-            // Check exclusion domains and cache 'ignore'
+            // 2️⃣ Skip header injection if excluded
             if (shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo)) {
-                cache.set(domain, ActionType.IGNORE);
-                return target.apply(thisArg, args);
-            }
-            let decision = ActionType.PROPAGATE;
-            // Check if domain verified before
-            if (!dynamicPassedHosts.has(domain)) {
-                // Perform OPTIONS preflight to decide header propagation
-                const res = await performOptionsPreflight(target, thisArg, url, init, sessionId, domain);
-                // Skip the header propagation as OPTIONS return Ignore
-                if (res === ActionType.IGNORE) {
-                    decision = res;
-                    dynamicExcludedHosts.add(domain);
-                }
-            }
-            cache.set(domain, decision);
-            if (decision === ActionType.PROPAGATE) {
-                return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
-            }
-            else {
                 return target.apply(thisArg, args);
             }
+            // 3️⃣ Delegate to our existing wrapper that injects header,
+            //    handles retries on BAD_HTTP_STATUS, and updates dynamic sets.
+            return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
         },
     });
-    // Wrapper function to emit 'networkRequest' event
+    // 2️⃣ Fetch interceptor’s injectHeaderWrapper(); emits 'networkRequest' event
     async function injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url) {
-        if (sessionId) {
-            const networkUUID = uuidv4();
-            const urlAndStoredUuids = getUrlAndStoredUuids();
-            const method = init.method || "GET";
-            const startTime = Date.now();
-            const domain = new URL(url).hostname;
-            try {
-                let response = await injectHeader(target, thisArg, input, init, sessionId, urlAndStoredUuids.page_visit_uuid, networkUUID);
-                let isRetry = false;
-                // Retry logic for 400/403 before logging finished event
-                // If the server rejects our header, retry without it
-                if (BAD_HTTP_STATUS.includes(response.status)) {
-                    DEBUG && console.log("Perform retry as status was fail:", response);
-                    response = retryWithoutPropagateHeaders(target, thisArg, args, url);
-                    isRetry = true;
-                }
-                const endTime = Date.now();
-                const status = response.status;
-                const success = response.ok;
-                const error = success ? "" : `Request Error: ${response.statusText}`;
-                if (success) {
-                    (isRetry ? dynamicExcludedHosts : dynamicPassedHosts).add(domain);
-                }
-                // Emit 'networkRequestFinished' event
-                const eventData = {
-                    type: NetworkRequestEventId,
-                    timestamp: endTime,
-                    sessionId,
-                    data: {
-                        request_id: networkUUID,
-                        session_id: sessionId,
-                        timestamp_start: startTime,
-                        timestamp_end: endTime,
-                        response_code: status,
-                        success,
-                        error,
-                        method,
-                        url,
-                    },
-                    ...urlAndStoredUuids,
-                };
-                sendEvent(eventData);
-                return response;
+        if (!sessionId) {
+            return target.apply(thisArg, args);
+        }
+        const urlObj = new URL(url, window.location.href);
+        const domain = urlObj.hostname;
+        const hostPath = urlObj.pathname === "/" ? domain : `${domain}${urlObj.pathname}`;
+        const networkUUID = uuidv4();
+        const urlAndStoredUuids = getUrlAndStoredUuids();
+        const method = init.method || "GET";
+        const startTime = Date.now();
+        try {
+            let response = await injectHeader(target, thisArg, input, init, sessionId, urlAndStoredUuids.page_visit_uuid, networkUUID);
+            let isRetry = false;
+            // Retry logic for 400/403 before logging finished event
+            if (BAD_HTTP_STATUS.includes(response.status)) {
+                DEBUG && console.log("Perform retry as status was fail:", response);
+                response = await retryWithoutPropagateHeaders(target, thisArg, args, url);
+                isRetry = true;
             }
-            catch (error) {
-                const endTime = Date.now();
-                const success = false;
-                const responseCode = error.response?.status || 500;
-                const errorMessage = error.message || "Fetch request failed";
-                // Treat fetch errors (likely CORS failures) as ignore
-                // Since some APIs or reverse proxies (such as NGINX) do not route or handle OPTIONS requests, CORS may occur while the request is being made.
-                if (error instanceof TypeError ||
-                    error?.message?.includes(CORS_KEYWORD)) {
-                    DEBUG &&
-                        console.log(`[Fetch Interceptor] CORS error for ${domain}:`, error);
-                    dynamicExcludedHosts.add(domain);
-                    return target.apply(thisArg, args);
-                }
+            const endTime = Date.now();
+            const status = response.status;
+            const success = response.ok;
+            const error = success ? "" : `Request Error: ${response.statusText}`;
+            // 5️⃣ Update dynamic sets
+            if (success) {
                 dynamicPassedHosts.add(domain);
-                // Emit 'networkRequestFinished' event with error
-                const eventData = {
-                    type: NetworkRequestEventId,
-                    timestamp: endTime,
-                    sessionId,
-                    data: {
-                        request_id: networkUUID,
-                        session_id: sessionId,
-                        timestamp_start: startTime,
-                        timestamp_end: endTime,
-                        response_code: responseCode,
-                        success,
-                        error: errorMessage,
-                        method,
-                        url,
-                    },
-                    ...urlAndStoredUuids,
-                };
-                sendEvent(eventData);
-                throw error;
             }
+            else {
+                dynamicExcludedHosts.add(hostPath);
+            }
+            // Emit 'networkRequestFinished' event
+            const eventData = {
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: status,
+                    success,
+                    error,
+                    method,
+                    url,
+                },
+                ...urlAndStoredUuids,
+            };
+            sendEvent(eventData);
+            return response;
         }
-        else {
-            return target.apply(thisArg, args);
+        catch (error) {
+            const endTime = Date.now();
+            const success = false;
+            const responseCode = error.response?.status || 500;
+            const errorMessage = error.message || "Fetch request failed";
+            if (error instanceof TypeError &&
+                error?.message?.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
+                // CORS/network failure: exclude just this path
+                dynamicExcludedHosts.add(hostPath);
+                return target.apply(thisArg, args);
+            }
+            // On other errors, treat as “passed” so we don’t re-preflight
+            dynamicPassedHosts.add(domain);
+            const eventData = {
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: responseCode,
+                    success,
+                    error: errorMessage,
+                    method,
+                    url,
+                },
+                ...urlAndStoredUuids,
+            };
+            sendEvent(eventData);
+            throw error;
         }
     }
     // Helper function to inject the X-Sf3-Rid header
@@ -654,23 +727,44 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
     async function retryWithoutPropagateHeaders(target, thisArg, args, url) {
         const domain = new URL(url).hostname;
         try {
-            // Retry the fetch without the header
-            // const retryResponse = await originalFetch(retryRequest);
-            const response = target.apply(thisArg, args);
-            // Check if retry succeeded (no network error thrown, and not a 400/403 response)
-            if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
-                // Mark this domain to exclude the header going forward without header
-                dynamicExcludedHosts.add(domain);
-                cache.set(domain, ActionType.IGNORE); // mark domain as 'ignore' in the cache
-                // Log the original failure and the successful retry
-                console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. ` +
-                    `Added "${domain}" to header exclusion lists.`);
+            // **Fix:** Properly await and clone the request without the tracing header
+            let input = args[0];
+            let init = args[1] || {};
+            if (typeof input === "string" || input instanceof URL) {
+                const retryInit = { ...init };
+                const retryHeaders = new Headers(init.headers || {});
+                retryHeaders.delete(xSf3RidHeader);
+                retryInit.headers = retryHeaders;
+                const response = await target.call(thisArg, input, retryInit);
+                if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
+                    dynamicExcludedHosts.add(domain);
+                    cachedDomains.set(domain, ActionType.IGNORE);
+                    DEBUG &&
+                        console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. Added "${domain}" to exclusion list.`);
+                }
+                return response;
+            }
+            else if (input instanceof Request) {
+                const original = input;
+                const cloned = original.clone();
+                const retryHeaders = new Headers(cloned.headers);
+                retryHeaders.delete(xSf3RidHeader);
+                const retryReq = new Request(cloned, { headers: retryHeaders });
+                const response = await target.call(thisArg, retryReq, init);
+                if (response.ok || !BAD_HTTP_STATUS.includes(response.status)) {
+                    dynamicExcludedHosts.add(domain);
+                    cachedDomains.set(domain, ActionType.IGNORE);
+                    DEBUG &&
+                        console.info(`Retried request to ${url} without ${xSf3RidHeader} succeeded. Added "${domain}" to exclusion list.`);
+                }
+                return response;
+            }
+            else {
+                // Fallback
+                return target.apply(thisArg, args);
             }
-            // Return the response from the retry attempt (successful or not)
-            return response;
         }
         catch (retryError) {
-            // Propagate the failure (no domain added to exclude lists since retry failed)
             DEBUG &&
                 console.log(`Retry without ${xSf3RidHeader} for ${url} also failed:`, retryError);
             throw retryError;
@@ -684,27 +778,29 @@ export async function startRecording({ apiKey, backendApi = "https://api-service
     initializeConsolePlugin(DEFAULT_CONSOLE_RECORDING_SETTINGS, sessionId);
     storeCredentialsAndConnection({ apiKey, backendApi });
     trackDomainChanges();
-    // Add provided domainsToNotPropagateHeaderTo to dynamicExcludedHosts without triggering updateExcludedHostsStorageAndBackend
-    domainsToNotPropagateHeaderTo?.forEach((host) => {
-        host?.trim() && originalExcludedAdd.call(dynamicExcludedHosts, host);
+    // ─── Merge stored excludes + passed-in excludes ───
+    const initialExcludes = new Set(dynamicExcludedHosts);
+    domainsToNotPropagateHeaderTo.forEach((host) => {
+        if (host?.trim()) {
+            dynamicExcludedHosts.add(host.trim());
+        }
     });
-    // Persist updated excluded hosts to localStorage
-    localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
-    // Add provided domainsToPropagateHeaderTo to dynamicPassedHosts
+    const newlyExcluded = Array.from(dynamicExcludedHosts).filter((h) => !initialExcludes.has(h));
+    if (newlyExcluded.length) {
+        // single notify of the full updated list
+        updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
+    }
+    // ─── Merge passed hosts ───
     domainsToPropagateHeaderTo.forEach((host) => {
-        originalPassedAdd.call(dynamicPassedHosts, host);
+        if (host?.trim()) {
+            dynamicPassedHosts.add(host.trim());
+        }
     });
-    // Persist updated included hosts to localStorage
-    localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
-    // Non-blocking GraphQL request to send the domains if provided
-    if (dynamicExcludedHosts.size > 0) {
-        sendDomainsToNotPropagateHeaderTo(apiKey, [...dynamicExcludedHosts, ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT], backendApi).catch((error) => console.error("Failed to send domains to not propagate header to:", error));
-    }
     sessionStorage.setItem(SF_API_KEY_FOR_UPDATE, apiKey);
     sessionStorage.setItem(SF_BACKEND_API, backendApi);
     // Setup interceptors with custom ignore and propagate domains
-    setupXMLHttpRequestInterceptor(domainsToPropagateHeaderTo);
-    setupFetchInterceptor(domainsToPropagateHeaderTo);
+    setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo);
+    setupFetchInterceptor(domainsToNotPropagateHeaderTo);
     gatherAndCacheDeviceInfo();
     try {
         const captureSettingsResponse = await fetchCaptureSettings(apiKey, backendApi);