@sailfish-ai/recorder 1.7.21 → 1.7.22

package/dist/index.js

@@ -1,7 +1,7 @@
 const DEBUG = import.meta.env.VITE_DEBUG ? import.meta.env.VITE_DEBUG : false;
 // import { NetworkRecordOptions } from "@sailfish-rrweb/rrweb-plugin-network-record";
 import { v4 as uuidv4 } from "uuid";
-import { NetworkRequestEventId, xSf3RidHeader } from "./constants";
+import { NetworkRequestEventId, STATIC_EXTENSIONS, xSf3RidHeader, } from "./constants";
 import { gatherAndCacheDeviceInfo } from "./deviceInfo";
 import { fetchCaptureSettings, sendDomainsToNotPropagateHeaderTo, startRecordingSession, } from "./graphql";
 import { sendMapUuidIfAvailable } from "./mapUuid";
@@ -25,15 +25,106 @@ const BAD_HTTP_STATUS = [
     403, // FORBIDDEN
 ];
 const CORS_KEYWORD = "CORS";
-const STORAGE_VERSION = 1;
-const DYNAMIC_PASSED_HOSTS_KEY = "dynamicPassedHosts";
-const DYNAMIC_EXCLUDED_HOSTS_KEY = "dynamicExcludedHosts";
+export const STORAGE_VERSION = 1;
+export const DYNAMIC_PASSED_HOSTS_KEY = "dynamicPassedHosts";
+export const DYNAMIC_EXCLUDED_HOSTS_KEY = "dynamicExcludedHosts";
 const SF_API_KEY_FOR_UPDATE = "sailfishApiKey";
 const SF_BACKEND_API = "sailfishBackendApi";
 const INCLUDE = "include";
 const SAME_ORIGIN = "same-origin";
 const ALLOWED_HEADERS_HEADER = "access-control-allow-headers";
 const OPTIONS = "OPTIONS";
+export const dynamicExcludedHosts = new Set();
+export const dynamicPassedHosts = new Set();
+// 1️⃣ dynamicExcludedHosts.add override
+const originalExcludedAdd = dynamicExcludedHosts.add;
+dynamicExcludedHosts.add = (host) => {
+    const cleaned = host?.trim();
+    if (!cleaned || dynamicExcludedHosts.has(cleaned)) {
+        return dynamicExcludedHosts;
+    }
+    // 1. Add to the excluded Set
+    originalExcludedAdd.call(dynamicExcludedHosts, cleaned);
+    // 2. If it was previously in passed, remove it
+    if (dynamicPassedHosts.has(cleaned)) {
+        dynamicPassedHosts.delete(cleaned);
+    }
+    // 3. Consolidate dynamic exclusions into smart wildcards
+    const consolidated = consolidateDynamicExclusions(dynamicExcludedHosts);
+    dynamicExcludedHosts.clear();
+    for (const p of consolidated) {
+        originalExcludedAdd.call(dynamicExcludedHosts, p);
+    }
+    // 4. Persist wrapper to localStorage
+    try {
+        // TODO decouple into two logical pieces
+        const wrapper = {
+            version: STORAGE_VERSION,
+            entries: {},
+        };
+        const now = Date.now();
+        for (const p of dynamicExcludedHosts) {
+            wrapper.entries[p] = now;
+        }
+        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(wrapper));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicExcludedHosts failed:", e);
+    }
+    // 5. Notify backend of the updated Set
+    updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
+    return dynamicExcludedHosts;
+};
+// 2️⃣ dynamicPassedHosts.add override (timestamps refreshed on every call)
+const originalPassedAdd = dynamicPassedHosts.add;
+dynamicPassedHosts.add = (host) => {
+    const cleaned = host?.trim();
+    if (!cleaned) {
+        return dynamicPassedHosts;
+    }
+    // 1. Persist wrapper to localStorage (update timestamp unconditionally)
+    try {
+        // TODO decouple into two logical pieces
+        const raw = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
+        let wrapper;
+        if (!raw) {
+            wrapper = { version: STORAGE_VERSION, entries: {} };
+        }
+        else {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed)) {
+                // migrate old array → wrapper
+                wrapper = {
+                    version: STORAGE_VERSION,
+                    entries: Object.fromEntries(parsed.map((h) => [h, Date.now()])),
+                };
+            }
+            else if (parsed &&
+                typeof parsed === "object" &&
+                "entries" in parsed &&
+                typeof parsed.entries === "object") {
+                wrapper = parsed;
+            }
+            else {
+                wrapper = { version: STORAGE_VERSION, entries: {} };
+            }
+        }
+        // always set/update the timestamp
+        wrapper.entries[cleaned] = Date.now();
+        wrapper.version = STORAGE_VERSION;
+        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(wrapper));
+    }
+    catch (e) {
+        if (DEBUG)
+            console.warn("Persist dynamicPassedHosts failed:", e);
+    }
+    // 2. Add to the passed Set if not already present
+    if (!dynamicPassedHosts.has(cleaned)) {
+        originalPassedAdd.call(dynamicPassedHosts, cleaned);
+    }
+    return dynamicPassedHosts;
+};
 /**
  * Notify the backend of the updated dynamicExcludedHosts
  */
@@ -45,8 +136,59 @@ function updateExcludedHostsStorageAndBackend(dynamicExcludedHosts) {
     }
     sendDomainsToNotPropagateHeaderTo(apiKeyForUpdate, [...dynamicExcludedHosts, ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT], apiForUpdate).catch((error) => console.error("Failed to send domains to not propagate header to:", error));
 }
-const dynamicExcludedHosts = new Set();
-const dynamicPassedHosts = new Set();
+/**
+ * Given a set of excluded hostPaths (like "foo.com/bar", "foo.com/baz", etc.),
+ * find any path prefixes under each host that appear ≥ threshold times,
+ * and replace their individual entries with a single wildcard pattern
+ * (e.g. "foo.com/bar*").
+ */
+export function consolidateDynamicExclusions(hostPathSet, threshold = 3) {
+    // 1️⃣ Group by host
+    const byHost = {};
+    for (const hostPath of hostPathSet) {
+        const [host, ...rest] = hostPath.split("/");
+        const path = rest.length ? `/${rest.join("/")}` : "/";
+        (byHost[host] ??= []).push(path);
+    }
+    const newSet = new Set();
+    for (const host in byHost) {
+        const paths = byHost[host];
+        if (paths.length < threshold) {
+            // not enough entries to bother; keep them as-is
+            for (const p of paths)
+                newSet.add(`${host}${p}`);
+            continue;
+        }
+        const root = { count: 0, children: new Map() };
+        for (const p of paths) {
+            root.count++;
+            const segments = p.split("/").filter(Boolean);
+            let node = root;
+            for (const seg of segments) {
+                if (!node.children.has(seg)) {
+                    node.children.set(seg, { count: 0, children: new Map() });
+                }
+                node = node.children.get(seg);
+                node.count++;
+            }
+        }
+        // 3️⃣ Walk the trie and pick prefixes where node.count ≥ threshold
+        function gather(node, prefixSegments) {
+            // if this node covers ≥ threshold of this host’s paths, collapse here
+            if (node.count >= threshold && prefixSegments.length > 0) {
+                const wildcardPath = "/" + prefixSegments.join("/") + "/*";
+                newSet.add(`${host}${wildcardPath}`);
+                return;
+            }
+            // otherwise, recurse into children
+            for (const [seg, child] of node.children) {
+                gather(child, prefixSegments.concat(seg));
+            }
+        }
+        gather(root, []);
+    }
+    return newSet;
+}
 // 2️⃣ Load & evict old entries (>7 days) + version check for Excluded
 (() => {
     const stored = localStorage.getItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
@@ -102,53 +244,6 @@ const dynamicPassedHosts = new Set();
         localStorage.removeItem(DYNAMIC_PASSED_HOSTS_KEY);
     }
 })();
-// Override add() to persist updates to localStorage
-const originalExcludedAdd = dynamicExcludedHosts.add;
-dynamicExcludedHosts.add = (host) => {
-    const cleanedHost = host?.trim();
-    if (!cleanedHost || dynamicExcludedHosts.has(cleanedHost)) {
-        return dynamicExcludedHosts;
-    }
-    originalExcludedAdd.call(dynamicExcludedHosts, cleanedHost);
-    try {
-        // read existing map or start fresh
-        const stored = localStorage.getItem(DYNAMIC_EXCLUDED_HOSTS_KEY);
-        const obj = stored ? JSON.parse(stored) : {};
-        obj[cleanedHost] = Date.now();
-        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(obj));
-    }
-    catch (e) {
-        if (DEBUG)
-            console.warn("Persist dynamicExcludedHosts failed:", e);
-    }
-    updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
-    return dynamicExcludedHosts;
-};
-const originalPassedAdd = dynamicPassedHosts.add;
-// === UPDATED: override to store timestamp on add (passed hosts) ===
-dynamicPassedHosts.add = (host) => {
-    const cleanedHost = host?.trim();
-    if (!cleanedHost) {
-        return dynamicPassedHosts;
-    }
-    // If we already have it, just return
-    if (dynamicPassedHosts.has(cleanedHost)) {
-        return dynamicPassedHosts;
-    }
-    originalPassedAdd.call(dynamicPassedHosts, cleanedHost);
-    // Persist a host->timestamp map
-    try {
-        const stored = localStorage.getItem(DYNAMIC_PASSED_HOSTS_KEY);
-        const obj = stored ? JSON.parse(stored) : {};
-        obj[cleanedHost] = Date.now();
-        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(obj));
-    }
-    catch (e) {
-        if (DEBUG)
-            console.warn("Persist dynamicPassedHosts failed:", e);
-    }
-    return dynamicPassedHosts;
-};
 const ActionType = {
     PROPAGATE: "propagate",
     IGNORE: "ignore",
@@ -355,75 +450,29 @@ export function matchUrlWithWildcard(url, patterns) {
         return true;
     });
 }
-function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo = []) {
-    const combinedIgnoreDomains = [
+function shouldSkipHeadersPropagation(url, domainsToNotPropagateHeaderTo = []) {
+    const urlObj = new URL(url, window.location.href);
+    // 1️⃣ STATIC ASSET EXCLUSIONS (by comprehensive file extension list)
+    for (const ext of STATIC_EXTENSIONS) {
+        if (urlObj.pathname.toLowerCase().endsWith(ext)) {
+            return true;
+        }
+    }
+    // 2️⃣ WILDCARD-BASED EXCLUSION (domain + path)
+    // Pass patterns like ["*.cdn.com/*", "api.example.com/v1/*"]
+    const combinedPatterns = [
         ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT,
-        ...domainsToNotPropagateHeadersTo,
+        ...domainsToNotPropagateHeaderTo,
     ];
-    const defaultExcluded = matchUrlWithWildcard(url, combinedIgnoreDomains);
-    if (defaultExcluded) {
+    if (matchUrlWithWildcard(url, combinedPatterns)) {
         return true;
     }
-    const domain = new URL(url).hostname;
-    // Check dynamically excluded hosts (those that reject the tracing header runtime)
-    return dynamicExcludedHosts.has(domain);
-}
-/**
- * Performs an OPTIONS preflight check using XHR.
- * Returns ActionType.PROPAGATE if server responds 2xx, ActionType.IGNORE on error or non-2xx.
- */
-function performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain) {
-    return new Promise((resolve) => {
-        const xhr = new XMLHttpRequest();
-        xhr.open(OPTIONS, url, true);
-        xhr.withCredentials = init.credentials === INCLUDE;
-        // Normalize headers into a standard Headers instance
-        const headerEntries = new Headers(init.headers || {});
-        const rawKeys = Array.from(headerEntries.keys());
-        const customHeaders = rawKeys
-            .map((h) => h.toLowerCase())
-            .filter((h) => ![
-            "accept",
-            "content-type",
-            "accept-language",
-            "content-language",
-        ].includes(h));
-        if (customHeaders.length) {
-            xhr.setRequestHeader("Access-Control-Request-Headers", customHeaders.join(","));
-        }
-        // Set the CORS preflight method header
-        xhr.setRequestHeader("Access-Control-Request-Method", (init.method || "GET").toUpperCase());
-        // Correctly add the tracing header to the XHR instance
-        xhr.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
-        xhr.onload = () => {
-            if (xhr.status >= 200 && xhr.status < 300) {
-                const allowed = xhr.getResponseHeader(ALLOWED_HEADERS_HEADER);
-                if (allowed &&
-                    allowed
-                        .split(",")
-                        .map((h) => h.trim().toLowerCase())
-                        .includes(xSf3RidHeader.toLowerCase())) {
-                    resolve(ActionType.PROPAGATE);
-                }
-                else {
-                    DEBUG &&
-                        console.log(`[XHR Interceptor] Header ${xSf3RidHeader} not allowed by preflight for ${domain}`);
-                    resolve(ActionType.IGNORE);
-                }
-            }
-            else {
-                DEBUG &&
-                    console.log(`[XHR Interceptor] OPTIONS returned status ${xhr.status} for ${domain}`);
-                resolve(null);
-            }
-        };
-        xhr.onerror = () => {
-            DEBUG &&
-                console.log(`[XHR Interceptor] Preflight OPTIONS CORS or network error for ${domain}`);
-            resolve(ActionType.IGNORE);
-        };
-        xhr.send();
-    });
+    // 3️⃣ DYNAMIC-FAILURE EXCLUSION (exact host)
+    const hostname = urlObj.hostname;
+    if (dynamicExcludedHosts.has(hostname)) {
+        return true;
+    }
+    return false;
 }
 // Updated XMLHttpRequest interceptor with domain exclusion
 function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
@@ -449,124 +498,90 @@ function setupXMLHttpRequestInterceptor(domainsToNotPropagateHeaderTo = []) {
         this._capturedRequestHeaders = {};
         return originalOpen.apply(this, [method, url, ...args]);
     };
-    // Intercept send()
+    // 1️⃣ XHR interceptor send()
     XMLHttpRequest.prototype.send = function (...args) {
         const url = this._requestUrl;
-        if (!url)
+        if (!url) {
             return originalSend.apply(this, args);
-        const domain = new URL(url).hostname;
-        // Skip domain check for excluded domains
+        }
+        // parse host+path for exclusion
+        const urlObj = new URL(url, window.location.href);
+        const domain = urlObj.hostname;
+        const hostPath = urlObj.pathname === "/" ? domain : `${domain}${urlObj.pathname}`;
+        // 1️⃣ Skip injection for excluded domains/paths
         if (shouldSkipHeadersPropagation(url, domainsToNotPropagateHeaderTo)) {
             return originalSend.apply(this, args);
         }
+        // 2️⃣ Prepare header and IDs
         const pageVisitUUID = sessionStorage.getItem("pageVisitUUID");
         const networkUUID = uuidv4();
-        const xSf3RidHeaderValue = `${sessionId}/${pageVisitUUID}/${networkUUID}`;
-        const proceedSend = () => {
-            if (sessionId) {
-                try {
-                    this.setRequestHeader(xSf3RidHeader, xSf3RidHeaderValue);
-                }
-                catch (e) {
-                    console.warn(`Could not set X-Sf3-Rid header for ${url}`, e);
-                }
+        const headerValue = `${sessionId}/${pageVisitUUID}/${networkUUID}`;
+        try {
+            this.setRequestHeader(xSf3RidHeader, headerValue);
+        }
+        catch (e) {
+            console.warn(`Could not set X-Sf3-Rid for ${url}`, e);
+        }
+        // 3️⃣ Track timing
+        const startTime = Date.now();
+        let finished = false;
+        // 4️⃣ Helper to emit networkRequestFinished
+        const emitFinished = (success, status, errorMsg) => {
+            if (finished)
+                return;
+            finished = true;
+            const endTime = Date.now();
+            sendEvent({
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: status,
+                    success,
+                    error: errorMsg,
+                    method: this._requestMethod,
+                    url,
+                },
+                ...getUrlAndStoredUuids(),
+            });
+            // 5️⃣ Update dynamic sets
+            if (success) {
+                // once any route passes, skip preflight on entire domain
+                dynamicPassedHosts.add(domain);
+            }
+            else {
+                // only exclude the specific failing path
+                dynamicExcludedHosts.add(hostPath);
             }
-            // On CORS or network error during send, log it and add to excluded-hosts
-            this.addEventListener("error", (evt) => {
-                console.error(`[XHR Interceptor] Network error for ${domain} (${url}):`, evt, `status=${this.status}`, `statusText=${this.statusText}`);
-                dynamicExcludedHosts.add(domain);
-            }, { once: true });
-            // On load, log non-2xx statuses (including CORS-blocked status=0) and track passes
-            this.addEventListener("load", () => {
-                if (this.status === 0) {
-                    DEBUG &&
-                        console.error(`[XHR Interceptor] CORS blocked (status=0) for ${domain} (${url})`, `statusText=${this.statusText}`);
-                    dynamicExcludedHosts.add(domain);
-                }
-                else if (this.status >= 200 && this.status < 300) {
-                    dynamicPassedHosts.add(domain);
-                }
-                else {
-                    DEBUG &&
-                        console.error(`[XHR Interceptor] HTTP error ${this.status} ${this.statusText} for ${domain} (${url})`);
-                    dynamicExcludedHosts.add(domain);
-                }
-            }, { once: true });
-            return originalSend.apply(this, args);
         };
-        if (!dynamicPassedHosts.has(domain)) {
-            // perform XHR-based preflight
-            const init = {
-                method: this._requestMethod,
-                headers: this._capturedRequestHeaders,
-                credentials: this.withCredentials ? INCLUDE : SAME_ORIGIN,
-            };
-            performOptionsPreflightForXHR(url, init, xSf3RidHeaderValue, domain)
-                .then((preflight) => {
-                if (preflight === ActionType.IGNORE) {
-                    dynamicExcludedHosts.add(domain);
-                    originalSend.call(this, args);
-                }
-                else {
-                    proceedSend();
-                }
-            })
-                .catch(() => {
-                // On error, treat as ignore
-                dynamicExcludedHosts.add(domain);
-                originalSend.call(this, args);
-            });
-            // just return void
-            return;
-        }
-        return proceedSend();
+        // 6️⃣ On successful load
+        this.addEventListener("load", () => {
+            const status = this.status || 0;
+            if (status >= 200 && status < 300) {
+                emitFinished(true, status, "");
+            }
+            else {
+                const msg = this.statusText || `HTTP ${status}`;
+                emitFinished(false, status, msg);
+            }
+        }, { once: true });
+        // 7️⃣ On network/CORS error
+        this.addEventListener("error", () => {
+            // XHR error events often mean CORS or connectivity; status is usually 0
+            const status = this.status || 0;
+            const msg = status === 0
+                ? "Network or CORS failure"
+                : this.statusText || `Error ${status}`;
+            emitFinished(false, status, msg);
+        }, { once: true });
+        // 8️⃣ Finally, send the request
+        return originalSend.apply(this, args);
     };
 }
-/**
- * Performs an OPTIONS preflight check to decide header propagation.
- * Returns PROPAGATE if both header & method are allowed, IGNORE if disallowed
- * or on a CORS error, null if OPTIONS returned non-2xx.
- */
-async function performOptionsPreflight(target, thisArg, url, init, sessionId, domain) {
-    try {
-        const headers = new Headers(init.headers || {});
-        headers.set(xSf3RidHeader, sessionId);
-        const opts = {
-            method: OPTIONS,
-            headers,
-            mode: "cors",
-            credentials: init.credentials || SAME_ORIGIN,
-        };
-        const response = await target.call(thisArg, url, opts);
-        if (!response.ok) {
-            DEBUG &&
-                console.log(`[Fetch Interceptor] OPTIONS returned status ${response.status} for ${domain}`);
-            return null;
-        }
-        // 1️⃣ Check that our header is allowed
-        const allowedHeaders = response.headers
-            .get(ALLOWED_HEADERS_HEADER)
-            ?.split(",")
-            .map((h) => h.trim().toLowerCase()) || [];
-        if (!allowedHeaders.includes(xSf3RidHeader.toLowerCase())) {
-            DEBUG &&
-                console.log(`[Fetch Interceptor] Header ${xSf3RidHeader} not allowed by preflight for ${domain}`);
-            return ActionType.IGNORE;
-        }
-        return ActionType.PROPAGATE;
-    }
-    catch (error) {
-        if (error instanceof TypeError &&
-            error.message.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
-            DEBUG &&
-                console.log(`[Fetch Interceptor] Preflight OPTIONS CORS error for ${domain}:`, error);
-            return ActionType.IGNORE;
-        }
-        DEBUG &&
-            console.log(`[Fetch Interceptor] Preflight OPTIONS failed for ${domain}:`, error);
-        return null;
-    }
-}
 // Updated fetch interceptor with exclusion handling
 function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
     const originalFetch = window.fetch;
@@ -577,6 +592,7 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
             let input = args[0];
             let init = args[1] || {};
             let url;
+            // 1️⃣ Normalize URL string
             if (typeof input === "string") {
                 url = input;
             }
@@ -587,130 +603,103 @@ function setupFetchInterceptor(domainsToNotPropagateHeadersTo = []) {
                 url = input.href;
             }
             else {
-                return target.apply(thisArg, args); // Skip unsupported inputs
+                return target.apply(thisArg, args);
             }
-            // Determine the target domain
             const domain = new URL(url, window.location.href).hostname;
-            // Use cached decision if available
-            if (cachedDomains.has(domain)) {
-                const decision = cachedDomains.get(domain);
-                if (decision === ActionType.IGNORE) {
-                    return target.apply(thisArg, args);
-                }
-                if (decision === ActionType.PROPAGATE) {
-                    return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
-                }
-            }
-            // Check exclusion domains and cache 'ignore'
+            // 2️⃣ Skip header injection if excluded
             if (shouldSkipHeadersPropagation(url, domainsToNotPropagateHeadersTo)) {
-                cachedDomains.set(domain, ActionType.IGNORE);
-                return target.apply(thisArg, args);
-            }
-            let decision = ActionType.PROPAGATE;
-            // Check if domain verified before
-            if (!dynamicPassedHosts.has(domain)) {
-                // Perform OPTIONS preflight to decide header propagation
-                const res = await performOptionsPreflight(target, thisArg, url, init, sessionId, domain);
-                // Skip the header propagation as OPTIONS return Ignore
-                if (res === ActionType.IGNORE) {
-                    decision = res;
-                    dynamicExcludedHosts.add(domain);
-                }
-            }
-            cachedDomains.set(domain, decision);
-            if (decision === ActionType.PROPAGATE) {
-                return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
-            }
-            else {
                 return target.apply(thisArg, args);
             }
+            // 3️⃣ Delegate to our existing wrapper that injects header,
+            //    handles retries on BAD_HTTP_STATUS, and updates dynamic sets.
+            return injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url);
         },
     });
-    // Wrapper function to emit 'networkRequest' event
+    // 2️⃣ Fetch interceptor’s injectHeaderWrapper(); emits 'networkRequest' event
     async function injectHeaderWrapper(target, thisArg, args, input, init, sessionId, url) {
-        if (sessionId) {
-            const networkUUID = uuidv4();
-            const urlAndStoredUuids = getUrlAndStoredUuids();
-            const method = init.method || "GET";
-            const startTime = Date.now();
-            const domain = new URL(url).hostname;
-            try {
-                let response = await injectHeader(target, thisArg, input, init, sessionId, urlAndStoredUuids.page_visit_uuid, networkUUID);
-                let isRetry = false;
-                // Retry logic for 400/403 before logging finished event
-                // If the server rejects our header, retry without it
-                if (BAD_HTTP_STATUS.includes(response.status)) {
-                    DEBUG && console.log("Perform retry as status was fail:", response);
-                    response = retryWithoutPropagateHeaders(target, thisArg, args, url);
-                    isRetry = true;
-                }
-                const endTime = Date.now();
-                const status = response.status;
-                const success = response.ok;
-                const error = success ? "" : `Request Error: ${response.statusText}`;
-                if (success) {
-                    (isRetry ? dynamicExcludedHosts : dynamicPassedHosts).add(domain);
-                }
-                // Emit 'networkRequestFinished' event
-                const eventData = {
-                    type: NetworkRequestEventId,
-                    timestamp: endTime,
-                    sessionId,
-                    data: {
-                        request_id: networkUUID,
-                        session_id: sessionId,
-                        timestamp_start: startTime,
-                        timestamp_end: endTime,
-                        response_code: status,
-                        success,
-                        error,
-                        method,
-                        url,
-                    },
-                    ...urlAndStoredUuids,
-                };
-                sendEvent(eventData);
-                return response;
+        if (!sessionId) {
+            return target.apply(thisArg, args);
+        }
+        const urlObj = new URL(url, window.location.href);
+        const domain = urlObj.hostname;
+        const hostPath = urlObj.pathname === "/" ? domain : `${domain}${urlObj.pathname}`;
+        const networkUUID = uuidv4();
+        const urlAndStoredUuids = getUrlAndStoredUuids();
+        const method = init.method || "GET";
+        const startTime = Date.now();
+        try {
+            let response = await injectHeader(target, thisArg, input, init, sessionId, urlAndStoredUuids.page_visit_uuid, networkUUID);
+            let isRetry = false;
+            // Retry logic for 400/403 before logging finished event
+            if (BAD_HTTP_STATUS.includes(response.status)) {
+                DEBUG && console.log("Perform retry as status was fail:", response);
+                response = await retryWithoutPropagateHeaders(target, thisArg, args, url);
+                isRetry = true;
             }
-            catch (error) {
-                const endTime = Date.now();
-                const success = false;
-                const responseCode = error.response?.status || 500;
-                const errorMessage = error.message || "Fetch request failed";
-                // Treat fetch errors (likely CORS failures) as ignore
-                // Since some APIs or reverse proxies (such as NGINX) do not route or handle OPTIONS requests, CORS may occur while the request is being made.
-                if (error instanceof TypeError &&
-                    error?.message?.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
-                    DEBUG &&
-                        console.log(`[Fetch Interceptor] CORS error for ${domain}:`, error);
-                    dynamicExcludedHosts.add(domain);
-                    return target.apply(thisArg, args);
-                }
+            const endTime = Date.now();
+            const status = response.status;
+            const success = response.ok;
+            const error = success ? "" : `Request Error: ${response.statusText}`;
+            // 5️⃣ Update dynamic sets
+            if (success) {
                 dynamicPassedHosts.add(domain);
-                // Emit 'networkRequestFinished' event with error
-                const eventData = {
-                    type: NetworkRequestEventId,
-                    timestamp: endTime,
-                    sessionId,
-                    data: {
-                        request_id: networkUUID,
-                        session_id: sessionId,
-                        timestamp_start: startTime,
-                        timestamp_end: endTime,
-                        response_code: responseCode,
-                        success,
-                        error: errorMessage,
-                        method,
-                        url,
-                    },
-                    ...urlAndStoredUuids,
-                };
-                sendEvent(eventData);
-                throw error;
             }
+            else {
+                dynamicExcludedHosts.add(hostPath);
+            }
+            // Emit 'networkRequestFinished' event
+            const eventData = {
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: status,
+                    success,
+                    error,
+                    method,
+                    url,
+                },
+                ...urlAndStoredUuids,
+            };
+            sendEvent(eventData);
+            return response;
         }
-        else {
-            return target.apply(thisArg, args);
+        catch (error) {
+            const endTime = Date.now();
+            const success = false;
+            const responseCode = error.response?.status || 500;
+            const errorMessage = error.message || "Fetch request failed";
+            if (error instanceof TypeError &&
+                error?.message?.toLowerCase().includes(CORS_KEYWORD.toLowerCase())) {
+                // CORS/network failure: exclude just this path
+                dynamicExcludedHosts.add(hostPath);
+                return target.apply(thisArg, args);
+            }
+            // On other errors, treat as “passed” so we don’t re-preflight
+            dynamicPassedHosts.add(domain);
+            const eventData = {
+                type: NetworkRequestEventId,
+                timestamp: endTime,
+                sessionId,
+                data: {
+                    request_id: networkUUID,
+                    session_id: sessionId,
+                    timestamp_start: startTime,
+                    timestamp_end: endTime,
+                    response_code: responseCode,
+                    success,
+                    error: errorMessage,
+                    method,
+                    url,
+                },
+                ...urlAndStoredUuids,
+            };
+            sendEvent(eventData);
+            throw error;
         }
     }
     // Helper function to inject the X-Sf3-Rid header
@@ -789,28 +778,24 @@ export async function startRecording({ apiKey, backendApi = "https://api-service
     initializeConsolePlugin(DEFAULT_CONSOLE_RECORDING_SETTINGS, sessionId);
     storeCredentialsAndConnection({ apiKey, backendApi });
     trackDomainChanges();
-    // Add provided domainsToNotPropagateHeaderTo to dynamicExcludedHosts without triggering updateExcludedHostsStorageAndBackend
-    domainsToNotPropagateHeaderTo?.forEach((host) => {
-        host?.trim() && originalExcludedAdd.call(dynamicExcludedHosts, host);
+    // ─── Merge stored excludes + passed-in excludes ───
+    const initialExcludes = new Set(dynamicExcludedHosts);
+    domainsToNotPropagateHeaderTo.forEach((host) => {
+        if (host?.trim()) {
+            dynamicExcludedHosts.add(host.trim());
+        }
     });
-    // Persist updated excluded hosts to localStorage
-    try {
-        localStorage.setItem(DYNAMIC_EXCLUDED_HOSTS_KEY, JSON.stringify(Array.from(dynamicExcludedHosts)));
+    const newlyExcluded = Array.from(dynamicExcludedHosts).filter((h) => !initialExcludes.has(h));
+    if (newlyExcluded.length) {
+        // single notify of the full updated list
+        updateExcludedHostsStorageAndBackend(dynamicExcludedHosts);
     }
-    catch { }
-    // Add provided domainsToPropagateHeaderTo to dynamicPassedHosts
+    // ─── Merge passed hosts ───
     domainsToPropagateHeaderTo.forEach((host) => {
-        originalPassedAdd.call(dynamicPassedHosts, host);
+        if (host?.trim()) {
+            dynamicPassedHosts.add(host.trim());
+        }
     });
-    // Persist updated included hosts to localStorage
-    try {
-        localStorage.setItem(DYNAMIC_PASSED_HOSTS_KEY, JSON.stringify(Array.from(dynamicPassedHosts)));
-    }
-    catch { }
-    // Non-blocking GraphQL request to send the domains if provided
-    if (dynamicExcludedHosts.size > 0) {
-        sendDomainsToNotPropagateHeaderTo(apiKey, [...dynamicExcludedHosts, ...DOMAINS_TO_NOT_PROPAGATE_HEADER_TO_DEFAULT], backendApi).catch((error) => console.error("Failed to send domains to not propagate header to:", error));
-    }
     sessionStorage.setItem(SF_API_KEY_FOR_UPDATE, apiKey);
     sessionStorage.setItem(SF_BACKEND_API, backendApi);
     // Setup interceptors with custom ignore and propagate domains