@specific.dev/spectest 0.73.0 → 0.73.1

package/dist/browser.js

@@ -236,11 +236,17 @@ async function applySafeAreaInsets(cdp, d) {
 // ────────────────────────────────────────────────────────────────────────
 // rrweb bootstrap
 // ────────────────────────────────────────────────────────────────────────
-// Vendored `@rrweb/record` UMD bundle (rrweb 2.x). Its global `rrwebRecord`
-// is a module object — the record function is `rrwebRecord.record` (the
-// bootstrap resolves both this and the legacy function-shaped global). Read
-// once at module init — the SDK ships this file in the base snapshot so
-// no network fetch happens inside the VM.
+// Vendored `@rrweb/record` UMD bundle (rrweb 2.x), BUILT FROM OUR FORK by
+// `scripts/rrweb-record/build.sh` (specific-dev/rrweb, branch `spectest` =
+// the `rrweb@2.1.0` tag + upstream PR 1802). Never copy the npm dist over
+// it: upstream's `@rrweb/utils` lists `querySelector` as an accessor, so its
+// pristine-prototype test always fails and `record()` appends an <iframe>
+// to every document — measured at ~1 s per navigation (see the top-frame
+// gate on PAGE_INIT_SCRIPT below). Its global `rrwebRecord` is a module
+// object — the record function is `rrwebRecord.record` (the bootstrap
+// resolves both this and the legacy function-shaped global). Read once at
+// module init — the SDK ships this file in the base snapshot so no network
+// fetch happens inside the VM.
 const RRWEB_BUNDLE = (() => {
     try {
         const here = path.dirname(fileURLToPath(import.meta.url));
@@ -711,8 +717,22 @@ const RRWEB_BOOTSTRAP = `
 // call expression — the TypeError kills everything after the bundle, so
 // the globals define but the bootstrap never runs (zero rrweb events,
 // empty replays).
+//
+// The whole script runs in the TOP frame only. `Page.addScriptToEvaluateOnNewDocument`
+// fires for every frame, and until 2026-09-06 that was a storm: rrweb's
+// `getUntaintedPrototype` appends a hidden <iframe> to read pristine DOM
+// prototypes, this script then ran inside it, the child's `record()` (which
+// treats every frame as an emitting frame unless `recordCrossOriginIframes`
+// is set) appended an iframe of its own, and so on to Chromium's frame-depth
+// cap — 44 nested frames and 45 executions of ~180 KB of JS per navigation,
+// ~0.8–1.3 s inside the page's `load` handler even for a one-line document
+// (`goto` p50 was ~1.5 s in every project). The vendored bundle's fork patch
+// removes the iframe on an unpatched page; this gate bounds it on a page
+// whose prototypes really are patched (zone.js). Nothing is lost: rrweb
+// records same-origin iframes from the parent, and a cross-origin child's
+// events were never drained (they land in the child's own buffer).
 const PAGE_INIT_SCRIPT = RRWEB_BUNDLE
-    ? `${RRWEB_BUNDLE}\n;\n${RRWEB_CONSOLE_PLUGIN_BUNDLE}\n;\n${RRWEB_BOOTSTRAP}`
+    ? `if (window === window.top) {\n${RRWEB_BUNDLE}\n;\n${RRWEB_CONSOLE_PLUGIN_BUNDLE}\n;\n${RRWEB_BOOTSTRAP}\n}`
     : "";
 // Page-side expression that atomically swaps in a fresh buffer and
 // returns the old one. Wrapped as a single expression so view.evaluate's

package/dist/vendor/rrweb-record.min.js

@@ -131,13 +131,13 @@ const testableAccessors = {
     "ownerDocument"
   ],
   ShadowRoot: ["host", "styleSheets"],
-  Element: ["shadowRoot", "querySelector", "querySelectorAll"],
+  Element: ["shadowRoot"],
   MutationObserver: []
 };
 const testableMethods = {
   Node: ["contains", "getRootNode"],
   ShadowRoot: ["getSelection"],
-  Element: [],
+  Element: ["querySelector", "querySelectorAll"],
   MutationObserver: ["constructor"]
 };
 const untaintedBasePrototype = {};
@@ -263,10 +263,10 @@ function shadowRoot(n) {
   return getUntaintedAccessor("Element", n, "shadowRoot");
 }
 function querySelector(n, selectors) {
-  return getUntaintedAccessor("Element", n, "querySelector")(selectors);
+  return getUntaintedMethod("Element", n, "querySelector")(selectors);
 }
 function querySelectorAll(n, selectors) {
-  return getUntaintedAccessor("Element", n, "querySelectorAll")(selectors);
+  return getUntaintedMethod("Element", n, "querySelectorAll")(selectors);
 }
 function mutationObserverCtor() {
   var _a2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.73.0",
+  "version": "0.73.1",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/browser.ts

@@ -615,11 +615,17 @@ async function applySafeAreaInsets(
 // rrweb bootstrap
 // ────────────────────────────────────────────────────────────────────────
 
-// Vendored `@rrweb/record` UMD bundle (rrweb 2.x). Its global `rrwebRecord`
-// is a module object — the record function is `rrwebRecord.record` (the
-// bootstrap resolves both this and the legacy function-shaped global). Read
-// once at module init — the SDK ships this file in the base snapshot so
-// no network fetch happens inside the VM.
+// Vendored `@rrweb/record` UMD bundle (rrweb 2.x), BUILT FROM OUR FORK by
+// `scripts/rrweb-record/build.sh` (specific-dev/rrweb, branch `spectest` =
+// the `rrweb@2.1.0` tag + upstream PR 1802). Never copy the npm dist over
+// it: upstream's `@rrweb/utils` lists `querySelector` as an accessor, so its
+// pristine-prototype test always fails and `record()` appends an <iframe>
+// to every document — measured at ~1 s per navigation (see the top-frame
+// gate on PAGE_INIT_SCRIPT below). Its global `rrwebRecord` is a module
+// object — the record function is `rrwebRecord.record` (the bootstrap
+// resolves both this and the legacy function-shaped global). Read once at
+// module init — the SDK ships this file in the base snapshot so no network
+// fetch happens inside the VM.
 const RRWEB_BUNDLE: string = (() => {
   try {
     const here = path.dirname(fileURLToPath(import.meta.url));
@@ -1094,8 +1100,22 @@ const RRWEB_BOOTSTRAP = `
 // call expression — the TypeError kills everything after the bundle, so
 // the globals define but the bootstrap never runs (zero rrweb events,
 // empty replays).
+//
+// The whole script runs in the TOP frame only. `Page.addScriptToEvaluateOnNewDocument`
+// fires for every frame, and until 2026-09-06 that was a storm: rrweb's
+// `getUntaintedPrototype` appends a hidden <iframe> to read pristine DOM
+// prototypes, this script then ran inside it, the child's `record()` (which
+// treats every frame as an emitting frame unless `recordCrossOriginIframes`
+// is set) appended an iframe of its own, and so on to Chromium's frame-depth
+// cap — 44 nested frames and 45 executions of ~180 KB of JS per navigation,
+// ~0.8–1.3 s inside the page's `load` handler even for a one-line document
+// (`goto` p50 was ~1.5 s in every project). The vendored bundle's fork patch
+// removes the iframe on an unpatched page; this gate bounds it on a page
+// whose prototypes really are patched (zone.js). Nothing is lost: rrweb
+// records same-origin iframes from the parent, and a cross-origin child's
+// events were never drained (they land in the child's own buffer).
 const PAGE_INIT_SCRIPT = RRWEB_BUNDLE
-  ? `${RRWEB_BUNDLE}\n;\n${RRWEB_CONSOLE_PLUGIN_BUNDLE}\n;\n${RRWEB_BOOTSTRAP}`
+  ? `if (window === window.top) {\n${RRWEB_BUNDLE}\n;\n${RRWEB_CONSOLE_PLUGIN_BUNDLE}\n;\n${RRWEB_BOOTSTRAP}\n}`
   : "";
 
 // Page-side expression that atomically swaps in a fresh buffer and

package/src/vendor/rrweb-record.min.js

@@ -131,13 +131,13 @@ const testableAccessors = {
     "ownerDocument"
   ],
   ShadowRoot: ["host", "styleSheets"],
-  Element: ["shadowRoot", "querySelector", "querySelectorAll"],
+  Element: ["shadowRoot"],
   MutationObserver: []
 };
 const testableMethods = {
   Node: ["contains", "getRootNode"],
   ShadowRoot: ["getSelection"],
-  Element: [],
+  Element: ["querySelector", "querySelectorAll"],
   MutationObserver: ["constructor"]
 };
 const untaintedBasePrototype = {};
@@ -263,10 +263,10 @@ function shadowRoot(n) {
   return getUntaintedAccessor("Element", n, "shadowRoot");
 }
 function querySelector(n, selectors) {
-  return getUntaintedAccessor("Element", n, "querySelector")(selectors);
+  return getUntaintedMethod("Element", n, "querySelector")(selectors);
 }
 function querySelectorAll(n, selectors) {
-  return getUntaintedAccessor("Element", n, "querySelectorAll")(selectors);
+  return getUntaintedMethod("Element", n, "querySelectorAll")(selectors);
 }
 function mutationObserverCtor() {
   var _a2;