@spotify-confidence/csr-common 0.18.9 → 0.18.11

package/dist/uploader/index.js

@@ -1,4 +1,4 @@
-import { t as isSessionActivityEvent } from "../session-activity-CJ1wae06.js";
+import { o as stripUrlQueryAndHash, t as isSessionActivityEvent } from "../session-activity-tshS9Hua.js";
 import Bowser from "bowser";
 //#region src/uploader/client-context.ts
 function collectUserAgentContext() {
@@ -22,12 +22,15 @@ function collectUserAgentContext() {
 		screenHeight: window.screen.height,
 		devicePixelRatio: window.devicePixelRatio,
 		uri: `${window.location.origin}${window.location.pathname}`,
-		referrer: document.referrer
+		referrer: stripUrlQueryAndHash(document.referrer)
 	};
 }
 //#endregion
 //#region src/uploader/worker/worker-script.ts
-const workerScript = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n	url;\n	ws = null;\n	onCloseCb = null;\n	onStateChangeCb = null;\n	intentionallyClosed = false;\n	dead = false;\n	/** Frames buffered while a (re)connect is in progress. */\n	pending = [];\n	readyPromise;\n	constructor(url) {\n		this.url = url;\n		this.readyPromise = new Promise((resolve, reject) => {\n			this.connect(false, resolve, reject);\n		});\n		this.readyPromise.catch(() => {});\n	}\n	ready() {\n		return this.readyPromise;\n	}\n	send(frame) {\n		if (this.dead || this.intentionallyClosed) return;\n		if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n		else this.pending.push(frame);\n	}\n	close(reason = \"transport-close\") {\n		this.intentionallyClosed = true;\n		this.ws?.close(1e3, reason);\n	}\n	onClose(cb) {\n		this.onCloseCb = cb;\n	}\n	onStateChange(cb) {\n		this.onStateChangeCb = cb;\n	}\n	connect(isReconnect, onReady, onReadyFail) {\n		const ws = new WebSocket(this.url);\n		this.ws = ws;\n		let opened = false;\n		ws.onopen = () => {\n			opened = true;\n			onReady?.();\n			if (isReconnect) this.onStateChangeCb?.({ connected: true });\n			while (this.pending.length > 0) {\n				const f = this.pending.shift();\n				ws.send(JSON.stringify(f));\n			}\n		};\n		ws.onclose = (event) => {\n			if (this.intentionallyClosed) return;\n			if (!opened) {\n				const reason = `${isReconnect ? \"reconnect\" : \"initial\"}-failed code=${event.code}`;\n				if (onReadyFail) {\n					onReadyFail(new Error(reason));\n					this.dead = true;\n				} else this.die(reason);\n				return;\n			}\n			if (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n				this.onStateChangeCb?.({ connected: false });\n				this.connect(true);\n			} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n		};\n	}\n	die(reason) {\n		this.dead = true;\n		this.onCloseCb?.({ reason });\n	}\n};\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n	apiUrl;\n	clientSecret;\n	context;\n	websocketUrl;\n	log;\n	forceRecord;\n	constructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n		this.apiUrl = apiUrl;\n		this.clientSecret = clientSecret;\n		this.context = context;\n		this.websocketUrl = websocketUrl;\n		this.log = log;\n		this.forceRecord = forceRecord;\n	}\n	async initSession() {\n		const url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n		this.log(`fetch POST ${url}`);\n		const res = await fetch(url, {\n			method: \"POST\",\n			headers: { \"Content-Type\": \"application/json\" },\n			body: JSON.stringify({\n				clientSecret: this.clientSecret,\n				...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n				...this.forceRecord ? { forceRecord: true } : {}\n			})\n		});\n		if (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n		const data = await res.json();\n		if (data.skipRecording) return { skipRecording: true };\n		if (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n		return {\n			sessionId: data.sessionId,\n			sessionToken: data.sessionToken\n		};\n	}\n	async openTransport(sessionToken) {\n		const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n		const url = `${wsBase}${wsBase.includes(\"?\") ? \"&\" : \"?\"}session_token=${encodeURIComponent(sessionToken)}`;\n		this.log(`WebSocket connect ${url.replace(/session_token=[^&]*/, \"session_token=[REDACTED]\")}`);\n		const transport = new WebSocketTransport(url);\n		await transport.ready();\n		return transport;\n	}\n	trimSlash(s) {\n		return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n	}\n	toWsScheme(base) {\n		if (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n		if (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n		return base;\n	}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n	if (idleTimer !== null) {\n		clearTimeout(idleTimer);\n		idleTimer = null;\n	}\n}\nfunction log(msg) {\n	for (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n		type: \"log\",\n		msg\n	});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n	cancelIdleTimer();\n	const handle = {\n		port: adapter,\n		hello: null,\n		debugLogs: false\n	};\n	ports.push(handle);\n	adapter.onmessage((data) => {\n		handleMessage(handle, data);\n	});\n}\nfunction handleMessage(handle, message) {\n	switch (message.type) {\n		case \"hello\":\n			handle.hello = message;\n			handle.debugLogs = message.debugLogs ?? false;\n			if (rejectIfIncompatible(handle)) return;\n			if (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n			onHello(handle);\n			return;\n		case \"frame\":\n			onFrame(message.frame);\n			return;\n		case \"bye\":\n			onBye(handle);\n			return;\n		default: break;\n	}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n	if (lockedConfig === null) return false;\n	const incoming = handle.hello;\n	if (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n	handle.port.postMessage({\n		type: \"dead\",\n		reason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n	});\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	return true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n	const tabId = handle.hello.tabId;\n	if (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n	const fresh = crypto.randomUUID();\n	handle.newTabId = fresh;\n	handle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n	switch (state.phase) {\n		case \"init\":\n			lockedConfig = {\n				apiUrl: handle.hello.apiUrl,\n				websocketUrl: handle.hello.websocketUrl,\n				clientSecret: handle.hello.clientSecret\n			};\n			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ?? \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n			state = { phase: \"initializing\" };\n			initializeSession(handle.hello).then(flushPendingWelcomes);\n			return;\n		case \"initializing\": return;\n		case \"active\":\n			sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n			return;\n		case \"idle\": {\n			const { client, sessionId, sessionToken } = state;\n			state = { phase: \"initializing\" };\n			resumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n			return;\n		}\n		case \"skipping\":\n			if (handle.hello.forceRecord) {\n				log(\"forceRecord set; re-initializing from skipping state\");\n				state = { phase: \"initializing\" };\n				initializeSession(handle.hello).then(flushPendingWelcomes);\n				return;\n			}\n			handle.port.postMessage({\n				type: \"welcome\",\n				result: { skipRecording: true }\n			});\n			return;\n		case \"dead\":\n			handle.port.postMessage({\n				type: \"dead\",\n				reason: state.reason\n			});\n			return;\n		default: break;\n	}\n}\nasync function initializeSession(firstHello) {\n	const client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n	if (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n		log(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n		try {\n			const transport = await client.openTransport(firstHello.sessionTokenHint);\n			wireTransport(transport);\n			state = {\n				phase: \"active\",\n				client,\n				transport,\n				sessionId: firstHello.sessionIdHint,\n				sessionToken: firstHello.sessionTokenHint\n			};\n			log(\"hint adopted; transport open\");\n			if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n			return;\n		} catch (err) {\n			log(`hint rejected (${String(err)}); falling back to fresh init`);\n		}\n	}\n	let result;\n	try {\n		result = await client.initSession();\n	} catch (err) {\n		log(`init-session threw: ${String(err)}`);\n		transitionToDead(`init-session-failed: ${String(err)}`);\n		return;\n	}\n	if (\"skipRecording\" in result) {\n		log(\"init-session: skipRecording\");\n		state = { phase: \"skipping\" };\n		return;\n	}\n	log(`init-session ok sessionId=${result.sessionId}`);\n	let transport;\n	try {\n		transport = await client.openTransport(result.sessionToken);\n	} catch (err) {\n		log(`openTransport threw: ${String(err)}`);\n		transitionToDead(`open-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport open; session active\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId: result.sessionId,\n		sessionToken: result.sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n	log(\"resuming transport from idle\");\n	let transport;\n	try {\n		transport = await client.openTransport(sessionToken);\n	} catch (err) {\n		log(`resume-transport threw: ${String(err)}`);\n		transitionToDead(`resume-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport resumed\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId,\n		sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n	transport.onClose((info) => {\n		if (state.phase !== \"active\") return;\n		transitionToDead(info.reason);\n	});\n	transport.onStateChange((info) => {\n		if (state.phase !== \"active\") return;\n		for (const handle of ports) handle.port.postMessage({\n			type: \"state\",\n			connected: info.connected\n		});\n	});\n}\nfunction transitionToDead(reason) {\n	state = {\n		phase: \"dead\",\n		reason\n	};\n	for (const handle of ports) handle.port.postMessage({\n		type: \"dead\",\n		reason\n	});\n}\nfunction flushPendingWelcomes() {\n	for (const handle of ports) {\n		if (handle.hello === null) continue;\n		if (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n		else if (state.phase === \"skipping\") handle.port.postMessage({\n			type: \"welcome\",\n			result: { skipRecording: true }\n		});\n		else if (state.phase === \"dead\") handle.port.postMessage({\n			type: \"dead\",\n			reason: state.reason\n		});\n	}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n	const hint = handle.hello?.sessionIdHint;\n	const adopted = hint !== void 0 && hint !== currentSessionId;\n	const newTabId = handle.newTabId;\n	handle.port.postMessage({\n		type: \"welcome\",\n		result: {\n			sessionId: currentSessionId,\n			sessionToken: currentSessionToken\n		},\n		adoptedFromSessionId: adopted ? hint : void 0,\n		newTabId,\n		resetCounter: adopted || newTabId !== void 0\n	});\n}\nfunction onFrame(frame) {\n	if (state.phase !== \"active\") return;\n	state.transport.send(frame);\n}\nfunction onBye(handle) {\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	if (ports.length === 0 && state.phase === \"active\") {\n		log(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n		idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n	}\n}\nfunction enterIdle() {\n	idleTimer = null;\n	if (state.phase !== \"active\" || ports.length > 0) return;\n	log(\"idle timeout; closing transport\");\n	state.transport.close(\"idle\");\n	state = {\n		phase: \"idle\",\n		client: state.client,\n		sessionId: state.sessionId,\n		sessionToken: state.sessionToken\n	};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n	const port = event.ports[0];\n	port.start();\n	registerPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n	return {\n		postMessage: (message) => port.postMessage(message),\n		onmessage: (cb) => {\n			port.onmessage = (e) => cb(e.data);\n		}\n	};\n}\nfunction adaptDedicatedSelf() {\n	const ws = self;\n	return {\n		postMessage: (message) => ws.postMessage(message),\n		onmessage: (cb) => {\n			ws.onmessage = (e) => cb(e.data);\n		}\n	};\n}\n//#endregion\n";
+const workerScript = "//#region src/uploader/worker/web-socket-transport.ts\n/**\n* WebSocket-backed Transport. Internal retry policy: clean server-initiated close after the\n* first successful open → reconnect and resume; abrupt close (or any close before the first\n* open) → fire `onClose` and stop. Frames received while a (re)connect is in progress are\n* buffered and flushed on open.\n*\n* `ready()` resolves on the first successful open and rejects on close-before-open. Callers\n* should await it before treating the Transport as live, so a failure to open can be caught\n* (e.g. 4404 unknown session) and recovered from.\n*/\nvar WebSocketTransport = class {\n	url;\n	ws = null;\n	onCloseCb = null;\n	onStateChangeCb = null;\n	intentionallyClosed = false;\n	dead = false;\n	/** Frames buffered while a (re)connect is in progress. */\n	pending = [];\n	readyPromise;\n	protocols;\n	constructor(url, protocols = []) {\n		this.url = url;\n		this.protocols = [...protocols];\n		this.readyPromise = new Promise((resolve, reject) => {\n			this.connect(false, resolve, reject);\n		});\n		this.readyPromise.catch(() => {});\n	}\n	ready() {\n		return this.readyPromise;\n	}\n	send(frame) {\n		if (this.dead || this.intentionallyClosed) return;\n		if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(JSON.stringify(frame));\n		else this.pending.push(frame);\n	}\n	close(reason = \"transport-close\") {\n		this.intentionallyClosed = true;\n		this.ws?.close(1e3, reason);\n	}\n	onClose(cb) {\n		this.onCloseCb = cb;\n	}\n	onStateChange(cb) {\n		this.onStateChangeCb = cb;\n	}\n	connect(isReconnect, onReady, onReadyFail) {\n		let ws;\n		try {\n			ws = new WebSocket(this.url, [...this.protocols]);\n		} catch (_error) {\n			this.failConnection(isReconnect, onReadyFail);\n			return;\n		}\n		this.ws = ws;\n		let opened = false;\n		ws.onopen = () => {\n			const expectedProtocol = this.protocols[0];\n			if (expectedProtocol !== void 0 && ws.protocol !== expectedProtocol) {\n				this.failConnection(isReconnect, onReadyFail);\n				ws.close(1e3, \"protocol-mismatch\");\n				return;\n			}\n			opened = true;\n			onReady?.();\n			if (isReconnect) this.onStateChangeCb?.({ connected: true });\n			while (this.pending.length > 0) {\n				const f = this.pending.shift();\n				ws.send(JSON.stringify(f));\n			}\n		};\n		ws.onclose = (event) => {\n			if (this.intentionallyClosed || this.dead) return;\n			if (!opened) {\n				this.failConnection(isReconnect, onReadyFail);\n				return;\n			}\n			if (event.wasClean && (event.code === 1e3 || event.code === 1001)) {\n				this.onStateChangeCb?.({ connected: false });\n				this.connect(true);\n			} else this.die(`close code=${event.code} wasClean=${event.wasClean}`);\n		};\n	}\n	failConnection(isReconnect, onReadyFail) {\n		const reason = isReconnect ? \"reconnect-failed\" : \"initial-failed\";\n		if (onReadyFail) {\n			this.dead = true;\n			onReadyFail(new Error(reason));\n		} else this.die(reason);\n	}\n	die(reason) {\n		this.dead = true;\n		this.onCloseCb?.({ reason });\n	}\n};\n//#endregion\n//#region src/uploader/worker/websocket-auth.ts\nconst RECORDING_PROTOCOL = \"recording.v1\";\nconst AUTH_PROTOCOL_PREFIX = \"auth.\";\nconst MAX_TOKEN_LENGTH = 4096;\nfunction recordingProtocols(sessionToken) {\n	if (sessionToken.length > MAX_TOKEN_LENGTH) throw new Error(\"Session token is too long for WebSocket authentication\");\n	if (!sessionToken || /[^A-Za-z0-9._-]/.test(sessionToken)) throw new Error(\"Invalid session token for WebSocket authentication\");\n	return [RECORDING_PROTOCOL, `${AUTH_PROTOCOL_PREFIX}${sessionToken}`];\n}\n//#endregion\n//#region src/uploader/worker/csr-client.ts\n/**\n* Single Client implementation that talks to the recording backend's REST + WS protocol.\n* Both dev-server and prod implement the same protocol, so we don't need polymorphism here yet.\n*/\nvar CsrClient = class {\n	apiUrl;\n	clientSecret;\n	context;\n	websocketUrl;\n	log;\n	forceRecord;\n	constructor(apiUrl, clientSecret, context, websocketUrl, log = () => {}, forceRecord) {\n		this.apiUrl = apiUrl;\n		this.clientSecret = clientSecret;\n		this.context = context;\n		this.websocketUrl = websocketUrl;\n		this.log = log;\n		this.forceRecord = forceRecord;\n	}\n	async initSession() {\n		const url = `${this.trimSlash(this.apiUrl)}/v1/sessions:initSession`;\n		this.log(`fetch POST ${url}`);\n		const res = await fetch(url, {\n			method: \"POST\",\n			headers: { \"Content-Type\": \"application/json\" },\n			body: JSON.stringify({\n				clientSecret: this.clientSecret,\n				...this.context && Object.keys(this.context).length > 0 ? { context: this.context } : {},\n				...this.forceRecord ? { forceRecord: true } : {}\n			})\n		});\n		if (!res.ok) throw new Error(`init-session failed: HTTP ${res.status}`);\n		const data = await res.json();\n		if (data.skipRecording) return { skipRecording: true };\n		if (!data.sessionId || !data.sessionToken) throw new Error(\"init-session response missing sessionId or sessionToken\");\n		return {\n			sessionId: data.sessionId,\n			sessionToken: data.sessionToken\n		};\n	}\n	async openTransport(sessionToken) {\n		const wsBase = this.websocketUrl ?? `${this.toWsScheme(this.trimSlash(this.apiUrl))}/sessions/stream`;\n		let parsedUrl;\n		try {\n			parsedUrl = new URL(wsBase);\n		} catch (_error) {\n			throw new Error(\"Invalid WebSocket URL\");\n		}\n		if (parsedUrl.searchParams.has(\"session_token\")) throw new Error(\"WebSocket URL must not include a session token\");\n		const protocols = recordingProtocols(sessionToken);\n		this.log(`WebSocket connect ${wsBase}`);\n		const transport = new WebSocketTransport(wsBase, protocols);\n		await transport.ready();\n		return transport;\n	}\n	trimSlash(s) {\n		return s.endsWith(\"/\") ? s.slice(0, -1) : s;\n	}\n	toWsScheme(base) {\n		if (base.startsWith(\"https://\")) return `wss://${base.slice(8)}`;\n		if (base.startsWith(\"http://\")) return `ws://${base.slice(7)}`;\n		return base;\n	}\n};\n//#endregion\n//#region src/uploader/worker/core.ts\nconst WORKER_HASH = globalThis.__WORKER_HASH__;\nconst IDLE_GRACE_MS = 5e3;\nlet state = { phase: \"init\" };\nconst ports = [];\nlet idleTimer = null;\nfunction cancelIdleTimer() {\n	if (idleTimer !== null) {\n		clearTimeout(idleTimer);\n		idleTimer = null;\n	}\n}\nfunction log(msg) {\n	for (const handle of ports) if (handle.debugLogs) handle.port.postMessage({\n		type: \"log\",\n		msg\n	});\n}\n/**\n* The first hello \"locks in\" the session's apiUrl/clientSecret. Any later tab arriving\n* with different values is misconfigured — we reject it rather than silently using the\n* locked values. In SharedWorker mode the `name = hash(clientSecret)` scoping already\n* prevents secret-mismatch from sharing a worker, but this defends against the dedicated\n* path and against future bugs.\n*/\nlet lockedConfig = null;\nfunction registerPort(adapter) {\n	cancelIdleTimer();\n	const handle = {\n		port: adapter,\n		hello: null,\n		debugLogs: false\n	};\n	ports.push(handle);\n	adapter.onmessage((data) => {\n		handleMessage(handle, data);\n	});\n}\nfunction handleMessage(handle, message) {\n	switch (message.type) {\n		case \"hello\":\n			handle.hello = message;\n			handle.debugLogs = message.debugLogs ?? false;\n			if (rejectIfIncompatible(handle)) return;\n			if (state.phase !== \"dead\" && state.phase !== \"skipping\") detectDuplicateTab(handle);\n			onHello(handle);\n			return;\n		case \"frame\":\n			onFrame(message.frame);\n			return;\n		case \"bye\":\n			onBye(handle);\n			return;\n		default: break;\n	}\n}\n/**\n* Reject hellos whose `apiUrl`/`clientSecret` don't match the values established by the\n* first hello. Returns true if the port was rejected (caller should not continue\n* processing this hello).\n*/\nfunction rejectIfIncompatible(handle) {\n	if (lockedConfig === null) return false;\n	const incoming = handle.hello;\n	if (incoming.apiUrl === lockedConfig.apiUrl && incoming.websocketUrl === lockedConfig.websocketUrl && incoming.clientSecret === lockedConfig.clientSecret) return false;\n	handle.port.postMessage({\n		type: \"dead\",\n		reason: \"incompatible-options: apiUrl/websocketUrl/clientSecret differ from the worker session\"\n	});\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	return true;\n}\n/**\n* If another already-connected port has the same `tabId`, this hello is from a duplicate\n* tab (browser \"Duplicate\" command clones sessionStorage). Mint a fresh `tabId` so the two\n* tabs don't collide on the same `(sessionId, tabId)` Recording. The new tabId is returned\n* to the tab in `welcome` so it can update its own state and sessionStorage.\n*/\nfunction detectDuplicateTab(handle) {\n	const tabId = handle.hello.tabId;\n	if (!ports.some((p) => p !== handle && p.hello?.tabId === tabId)) return;\n	const fresh = crypto.randomUUID();\n	handle.newTabId = fresh;\n	handle.hello.tabId = fresh;\n}\nfunction onHello(handle) {\n	switch (state.phase) {\n		case \"init\":\n			lockedConfig = {\n				apiUrl: handle.hello.apiUrl,\n				websocketUrl: handle.hello.websocketUrl,\n				clientSecret: handle.hello.clientSecret\n			};\n			log(`hello received apiUrl=${handle.hello.apiUrl} websocketUrl=${handle.hello.websocketUrl ? \"(configured)\" : \"(derive)\"} sessionIdHint=${handle.hello.sessionIdHint ?? \"(none)\"}`);\n			state = { phase: \"initializing\" };\n			initializeSession(handle.hello).then(flushPendingWelcomes);\n			return;\n		case \"initializing\": return;\n		case \"active\":\n			sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n			return;\n		case \"idle\": {\n			const { client, sessionId, sessionToken } = state;\n			state = { phase: \"initializing\" };\n			resumeTransport(client, sessionId, sessionToken).then(flushPendingWelcomes);\n			return;\n		}\n		case \"skipping\":\n			if (handle.hello.forceRecord) {\n				log(\"forceRecord set; re-initializing from skipping state\");\n				state = { phase: \"initializing\" };\n				initializeSession(handle.hello).then(flushPendingWelcomes);\n				return;\n			}\n			handle.port.postMessage({\n				type: \"welcome\",\n				result: { skipRecording: true },\n				workerHash: WORKER_HASH\n			});\n			return;\n		case \"dead\":\n			handle.port.postMessage({\n				type: \"dead\",\n				reason: state.reason\n			});\n			return;\n		default: break;\n	}\n}\nasync function initializeSession(firstHello) {\n	const client = new CsrClient(firstHello.apiUrl, firstHello.clientSecret, firstHello.context, firstHello.websocketUrl, log, firstHello.forceRecord);\n	if (firstHello.sessionIdHint && firstHello.sessionTokenHint) {\n		log(`adopting sessionIdHint=${firstHello.sessionIdHint}`);\n		try {\n			const transport = await client.openTransport(firstHello.sessionTokenHint);\n			wireTransport(transport);\n			state = {\n				phase: \"active\",\n				client,\n				transport,\n				sessionId: firstHello.sessionIdHint,\n				sessionToken: firstHello.sessionTokenHint\n			};\n			log(\"hint adopted; transport open\");\n			if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n			return;\n		} catch (err) {\n			log(`hint rejected (${String(err)}); falling back to fresh init`);\n		}\n	}\n	let result;\n	try {\n		result = await client.initSession();\n	} catch (err) {\n		log(`init-session threw: ${String(err)}`);\n		transitionToDead(`init-session-failed: ${String(err)}`);\n		return;\n	}\n	if (\"skipRecording\" in result) {\n		log(\"init-session: skipRecording\");\n		state = { phase: \"skipping\" };\n		return;\n	}\n	log(`init-session ok sessionId=${result.sessionId}`);\n	let transport;\n	try {\n		transport = await client.openTransport(result.sessionToken);\n	} catch (err) {\n		log(`openTransport threw: ${String(err)}`);\n		transitionToDead(`open-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport open; session active\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId: result.sessionId,\n		sessionToken: result.sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nasync function resumeTransport(client, sessionId, sessionToken) {\n	log(\"resuming transport from idle\");\n	let transport;\n	try {\n		transport = await client.openTransport(sessionToken);\n	} catch (err) {\n		log(`resume-transport threw: ${String(err)}`);\n		transitionToDead(`resume-transport-failed: ${String(err)}`);\n		return;\n	}\n	wireTransport(transport);\n	log(\"transport resumed\");\n	state = {\n		phase: \"active\",\n		client,\n		transport,\n		sessionId,\n		sessionToken\n	};\n	if (ports.length === 0) idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n}\nfunction wireTransport(transport) {\n	transport.onClose((info) => {\n		if (state.phase !== \"active\") return;\n		transitionToDead(info.reason);\n	});\n	transport.onStateChange((info) => {\n		if (state.phase !== \"active\") return;\n		for (const handle of ports) handle.port.postMessage({\n			type: \"state\",\n			connected: info.connected\n		});\n	});\n}\nfunction transitionToDead(reason) {\n	state = {\n		phase: \"dead\",\n		reason\n	};\n	for (const handle of ports) handle.port.postMessage({\n		type: \"dead\",\n		reason\n	});\n}\nfunction flushPendingWelcomes() {\n	for (const handle of ports) {\n		if (handle.hello === null) continue;\n		if (state.phase === \"active\") sendActiveWelcome(handle, state.sessionId, state.sessionToken);\n		else if (state.phase === \"skipping\") handle.port.postMessage({\n			type: \"welcome\",\n			result: { skipRecording: true },\n			workerHash: WORKER_HASH\n		});\n		else if (state.phase === \"dead\") handle.port.postMessage({\n			type: \"dead\",\n			reason: state.reason\n		});\n	}\n}\nfunction sendActiveWelcome(handle, currentSessionId, currentSessionToken) {\n	const hint = handle.hello?.sessionIdHint;\n	const adopted = hint !== void 0 && hint !== currentSessionId;\n	const newTabId = handle.newTabId;\n	handle.port.postMessage({\n		type: \"welcome\",\n		result: {\n			sessionId: currentSessionId,\n			sessionToken: currentSessionToken\n		},\n		workerHash: WORKER_HASH,\n		adoptedFromSessionId: adopted ? hint : void 0,\n		newTabId,\n		resetCounter: adopted || newTabId !== void 0\n	});\n}\nfunction onFrame(frame) {\n	if (state.phase !== \"active\") return;\n	state.transport.send(frame);\n}\nfunction onBye(handle) {\n	const idx = ports.indexOf(handle);\n	if (idx >= 0) ports.splice(idx, 1);\n	if (ports.length === 0 && state.phase === \"active\") {\n		log(`last tab disconnected; closing transport in ${IDLE_GRACE_MS}ms`);\n		idleTimer = setTimeout(enterIdle, IDLE_GRACE_MS);\n	}\n}\nfunction enterIdle() {\n	idleTimer = null;\n	if (state.phase !== \"active\" || ports.length > 0) return;\n	log(\"idle timeout; closing transport\");\n	state.transport.close(\"idle\");\n	state = {\n		phase: \"idle\",\n		client: state.client,\n		sessionId: state.sessionId,\n		sessionToken: state.sessionToken\n	};\n}\n//#endregion\n//#region src/uploader/worker/entry.ts\nconst SharedWorkerScopeCtor = globalThis.SharedWorkerGlobalScope;\nif (typeof SharedWorkerScopeCtor === \"function\" && self instanceof SharedWorkerScopeCtor) self.onconnect = (event) => {\n	const port = event.ports[0];\n	port.start();\n	registerPort(adaptMessagePort(port));\n};\nelse registerPort(adaptDedicatedSelf());\nfunction adaptMessagePort(port) {\n	return {\n		postMessage: (message) => port.postMessage(message),\n		onmessage: (cb) => {\n			port.onmessage = (e) => cb(e.data);\n		}\n	};\n}\nfunction adaptDedicatedSelf() {\n	const ws = self;\n	return {\n		postMessage: (message) => ws.postMessage(message),\n		onmessage: (cb) => {\n			ws.onmessage = (e) => cb(e.data);\n		}\n	};\n}\n//#endregion\n";
+//#endregion
+//#region src/uploader/worker-hash.ts
+const WORKER_HASH = "1774b236fa1eb46a";
 //#endregion
 //#region src/uploader/create-uploader.ts
 const STORAGE_TAB_ID = "csr:tabId";
@@ -117,6 +120,7 @@ async function createUploader(opts) {
 		return msg;
 	}), welcomeDeadline]);
 	log?.(welcome.type === "welcome" ? `tab: welcome (${"sessionId" in welcome.result ? `sessionId=${welcome.result.sessionId}` : "skipRecording"})` : `tab: dead reason=${welcome.reason}`);
+	if (welcome.type === "welcome" && urlScheme === "custom" && welcome.workerHash !== "1774b236fa1eb46a") log?.("tab: WORKER MISMATCH — the self-hosted confidence-worker.js does not match the installed SDK. Copy the updated file from node_modules/@spotify-confidence/session-recording/dist/confidence-worker.js");
 	if (welcome.type === "dead") throw new Error(`uploader: ${welcome.reason}`);
 	if ("skipRecording" in welcome.result) {
 		if (opts.forceRecord) log?.("tab: forceRecord was set but backend still skipped — backend may not support forceRecord yet");
@@ -325,4 +329,4 @@ function writeCounter(counter) {
 	sessionStorage.setItem(STORAGE_COUNTER, String(counter));
 }
 //#endregion
-export { collectUserAgentContext, createUploader, workerScript };
+export { WORKER_HASH, collectUserAgentContext, createUploader, workerScript };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotify-confidence/csr-common",
   "license": "Apache-2.0",
-  "version": "0.18.9",
+  "version": "0.18.11",
   "repository": {
     "type": "git",
     "url": "https://github.com/spotify/confidence-sdk-js.git",

package/src/index.ts

@@ -43,7 +43,7 @@ export {
   type FlagEvaluationPluginData,
 } from './events';
 
-export { stripUrl } from './url';
+export { stripUrl, stripUrlQueryAndHash } from './url';
 
 export { RecordingMetricKey } from './metrics';
 

package/src/test-utils/mock-ws-server.ts

@@ -14,15 +14,30 @@ import { onTestFinished, vi } from 'vitest';
  * Must be called from within a test (or a helper called from one) so vitest
  * has a test context to attach the cleanup to.
  */
-export function installMockWsServer(url: string): {
+interface MockWsServerOptions {
+  selectProtocol?: (protocols: string[], connectionIndex: number) => string;
+}
+
+export function installMockWsServer(
+  url: string,
+  options: MockWsServerOptions = {},
+): {
   server: Server;
   connections: Client[];
   messages: string[];
+  protocolOffers: string[][];
   waitForConnection: () => Promise<Client>;
   nextMessage: () => Promise<string>;
   nextMessages: (n: number) => Promise<string[]>;
 } {
-  const server = new Server(url);
+  const protocolOffers: string[][] = [];
+  const server = new Server(url, {
+    selectProtocol: protocols => {
+      const offer = [...protocols];
+      protocolOffers.push(offer);
+      return options.selectProtocol?.(offer, protocolOffers.length - 1) ?? offer[0] ?? '';
+    },
+  });
   const connections: Client[] = [];
   const messages: string[] = [];
   let nextConnIndex = 0;
@@ -71,6 +86,7 @@ export function installMockWsServer(url: string): {
     server,
     connections,
     messages,
+    protocolOffers,
     waitForConnection,
     nextMessage,
     nextMessages,

package/src/uploader/client-context.test.ts

@@ -84,6 +84,33 @@ describe('collectUserAgentContext', () => {
     });
   });
 
+  it.each([
+    ['https://referrer.example/path?email=alice@example.com#token', 'https://referrer.example/path'],
+    ['https://referrer.example/path#token?email=alice@example.com', 'https://referrer.example/path'],
+    ['https://referrer.example/path?email=alice@example.com', 'https://referrer.example/path'],
+    ['https://referrer.example/path#token', 'https://referrer.example/path'],
+    ['', ''],
+    ['invalid-url?email=alice@example.com#token', 'invalid-url'],
+  ])('strips query/hash from referrer %s', (referrer, expected) => {
+    stubBrowser({ document: { referrer } });
+    expect(collectUserAgentContext()?.referrer).toBe(expected);
+  });
+
+  it('excludes query/hash from the initial document URI', () => {
+    stubBrowser({
+      window: {
+        location: {
+          origin: 'https://example.com',
+          pathname: '/path',
+          search: '?email=alice@example.com',
+          hash: '#token',
+          href: 'https://example.com/path?email=alice@example.com#token',
+        },
+      },
+    });
+    expect(collectUserAgentContext()?.uri).toBe('https://example.com/path');
+  });
+
   it('flags `mobile` platform type as mobile=true', () => {
     parse.mockReturnValueOnce({
       os: {},

package/src/uploader/client-context.ts

@@ -1,4 +1,5 @@
 import Bowser from 'bowser';
+import { stripUrlQueryAndHash } from '../url';
 
 /**
  * JSON-shaped values accepted in a Context — matches `google.protobuf.Struct`.
@@ -31,6 +32,7 @@ export type UserAgentContext = {
   devicePixelRatio?: number;
   /** Initial document URI — without query/hash to avoid leaking PII. */
   uri?: string;
+  /** Document referrer — without query/hash to avoid leaking PII. */
   referrer?: string;
 };
 
@@ -65,6 +67,6 @@ export function collectUserAgentContext(): UserAgentContext | undefined {
     screenHeight: window.screen.height,
     devicePixelRatio: window.devicePixelRatio,
     uri: `${window.location.origin}${window.location.pathname}`,
-    referrer: document.referrer,
+    referrer: stripUrlQueryAndHash(document.referrer),
   };
 }

package/src/uploader/create-uploader.test.ts

@@ -97,6 +97,7 @@ describe('createUploader', () => {
 
   async function loadCreateUploader() {
     vi.resetModules();
+    vi.doMock('./worker-hash', () => ({ WORKER_HASH: 'expected-hash' }));
     // .js extension is required by Node16 module resolution for dynamic imports
     // (static `import` lines work without it because the package is CJS — see package.json).
     // eslint-disable-next-line es/no-dynamic-import
@@ -309,6 +310,110 @@ describe('createUploader', () => {
     });
   });
 
+  describe('worker hash mismatch', () => {
+    beforeEach(() => {
+      (globalThis as Record<string, unknown>).window = { addEventListener: vi.fn() };
+      (globalThis as Record<string, unknown>).document = { addEventListener: vi.fn() };
+    });
+
+    afterEach(() => {
+      delete (globalThis as Record<string, unknown>).window;
+      delete (globalThis as Record<string, unknown>).document;
+    });
+
+    function workerThatReplies(welcomeOverrides: Record<string, unknown> = {}) {
+      return class {
+        onerror: ((e: Event) => void) | null = null;
+        onmessage: ((e: MessageEvent) => void) | null = null;
+        postMessage(m: unknown) {
+          const msg = m as { type: string };
+          if (msg.type === 'hello') {
+            setTimeout(
+              () =>
+                this.onmessage?.({
+                  data: {
+                    type: 'welcome',
+                    result: { sessionId: 'sess-1', sessionToken: 'tok-1' },
+                    workerHash: 'stale-hash',
+                    ...welcomeOverrides,
+                  },
+                } as MessageEvent),
+              0,
+            );
+          }
+        }
+      };
+    }
+
+    async function loadCreateUploaderWithMockedContext() {
+      vi.doMock('./client-context', () => ({ collectUserAgentContext: () => null }));
+      return loadCreateUploader();
+    }
+
+    it('logs a warning when workerUrl is set and hashes mismatch', async () => {
+      (globalThis as Record<string, unknown>).Worker = workerThatReplies();
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploaderWithMockedContext();
+      const logs: string[] = [];
+      await createUploader({
+        ...DEFAULTS,
+        workerMode: 'dedicated',
+        workerUrl: '/confidence-worker.js',
+        debugLogger: m => logs.push(m),
+      });
+
+      expect(logs.some(l => l.includes('WORKER MISMATCH'))).toBe(true);
+    });
+
+    it('does not warn when using data: URL (inlined worker)', async () => {
+      (globalThis as Record<string, unknown>).Worker = workerThatReplies();
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploaderWithMockedContext();
+      const logs: string[] = [];
+      await createUploader({
+        ...DEFAULTS,
+        workerMode: 'dedicated',
+        debugLogger: m => logs.push(m),
+      });
+
+      expect(logs.some(l => l.includes('WORKER MISMATCH'))).toBe(false);
+    });
+
+    it('does not warn when hashes match', async () => {
+      (globalThis as Record<string, unknown>).Worker = workerThatReplies({ workerHash: 'expected-hash' });
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploaderWithMockedContext();
+      const logs: string[] = [];
+      await createUploader({
+        ...DEFAULTS,
+        workerMode: 'dedicated',
+        workerUrl: '/confidence-worker.js',
+        debugLogger: m => logs.push(m),
+      });
+
+      expect(logs.some(l => l.includes('WORKER MISMATCH'))).toBe(false);
+    });
+
+    it('warns when workerHash is absent (old worker)', async () => {
+      (globalThis as Record<string, unknown>).Worker = workerThatReplies({ workerHash: undefined });
+      delete (globalThis as Record<string, unknown>).SharedWorker;
+
+      const createUploader = await loadCreateUploaderWithMockedContext();
+      const logs: string[] = [];
+      await createUploader({
+        ...DEFAULTS,
+        workerMode: 'dedicated',
+        workerUrl: '/confidence-worker.js',
+        debugLogger: m => logs.push(m),
+      });
+
+      expect(logs.some(l => l.includes('WORKER MISMATCH'))).toBe(true);
+    });
+  });
+
   describe('welcome timeout', () => {
     it('rejects when the worker never sends a welcome', async () => {
       (globalThis as Record<string, unknown>).Worker = class {

package/src/uploader/create-uploader.ts

@@ -2,6 +2,7 @@ import type { CreateUploaderOptions, Frame, Uploader } from './types';
 import { ClientContext, collectUserAgentContext } from './client-context';
 import { isSessionActivityEvent } from '../session-activity';
 import { workerScript } from './worker/worker-script';
+import { WORKER_HASH } from './worker-hash';
 
 const STORAGE_TAB_ID = 'csr:tabId';
 const STORAGE_SESSION = 'csr:session';
@@ -18,6 +19,7 @@ interface PortLike {
 interface WelcomeMessage {
   type: 'welcome';
   result: { sessionId: string; sessionToken: string } | { skipRecording: true };
+  workerHash?: string;
   adoptedFromSessionId?: string;
   /** Worker-assigned fresh tabId because this tab is a duplicate of another live one. */
   newTabId?: string;
@@ -154,6 +156,12 @@ export async function createUploader(opts: CreateUploaderOptions): Promise<Uploa
       ? `tab: welcome (${'sessionId' in welcome.result ? `sessionId=${welcome.result.sessionId}` : 'skipRecording'})`
       : `tab: dead reason=${welcome.reason}`,
   );
+  if (welcome.type === 'welcome' && urlScheme === 'custom' && welcome.workerHash !== WORKER_HASH) {
+    log?.(
+      'tab: WORKER MISMATCH — the self-hosted confidence-worker.js does not match the installed SDK. ' +
+        'Copy the updated file from node_modules/@spotify-confidence/session-recording/dist/confidence-worker.js',
+    );
+  }
   if (welcome.type === 'dead') {
     throw new Error(`uploader: ${welcome.reason}`);
   }

package/src/uploader/index.ts

@@ -13,3 +13,4 @@ export {
  * SharedWorker sharing (per-document blob URLs defeat sharing).
  */
 export { workerScript } from './worker/worker-script';
+export { WORKER_HASH } from './worker-hash';

package/src/uploader/types.ts

@@ -10,11 +10,12 @@ export interface CreateUploaderOptions {
   apiUrl: string;
   /**
    * URL of the WebSocket ingest endpoint, including the path (e.g.
-   * `wss://recording-ws.confidence.dev/sessions/stream`) but **without** any query —
-   * the worker appends `?session_token=…`. Optional: when omitted the worker derives
-   * one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
-   * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on
-   * different hosts (e.g. prod).
+   * `wss://recording-ws.confidence.dev/sessions/stream`). The worker sends the session
+   * token through the WebSocket subprotocol header. A `session_token` query parameter is
+   * rejected. Other query parameters are retained. Optional: when omitted the worker
+   * derives one from `apiUrl` by swapping `http(s)://` → `ws(s)://` and appending
+   * `/sessions/stream`. Set this when the init endpoint and the WS ingest live on different
+   * hosts (e.g. prod).
    */
   websocketUrl?: string;
   /** Per-tenant secret. Hashed to scope the SharedWorker so different secrets never share a session, and sent in the `initSession` request body. */
@@ -55,7 +56,7 @@ export interface CreateUploaderOptions {
   onTerminate?: (info: { reason: string }) => void;
   /**
    * Optional verbose tracer. Called on key tab- and worker-side events
-   * (hello/welcome, init-session URL, ws connect URL, retries, transitions).
+   * (hello/welcome, init-session URL, credential-free ws connect URL, retries, transitions).
    * Worker messages are forwarded over the port and tagged so you can tell them apart.
    */
   debugLogger?: (msg: string) => void;

package/src/uploader/worker/core.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { createMockPort, installMockFetch, installMockWsServer, jsonResponse } from '../../test-utils';
 
 const API_URL = 'https://api.example';
-const WS_URL = 'wss://api.example/sessions/stream?session_token=tok-1';
+const WS_URL = 'wss://api.example/sessions/stream';
 
 async function loadCore() {
   vi.resetModules();
@@ -27,6 +27,7 @@ const isType = (type: string) => (m: unknown) => (m as { type: string }).type ==
 interface WelcomeMessage {
   type: 'welcome';
   result: { sessionId: string; sessionToken: string } | { skipRecording: true };
+  workerHash?: string;
   newTabId?: string;
   resetCounter?: boolean;
   adoptedFromSessionId?: string;
@@ -37,15 +38,18 @@ interface DeadMessage {
 }
 
 describe('worker/core', () => {
-  function setupBackend(initBody: unknown = { sessionId: 'sess-1', sessionToken: 'tok-1' }) {
+  function setupBackend(
+    initBody: unknown = { sessionId: 'sess-1', sessionToken: 'tok-1' },
+    selectProtocol?: (protocols: string[], connectionIndex: number) => string,
+  ) {
     const fetchHarness = installMockFetch(() => jsonResponse(initBody));
-    const wsHarness = installMockWsServer(WS_URL);
+    const wsHarness = installMockWsServer(WS_URL, { selectProtocol });
     return { fetchHarness, wsHarness };
   }
 
   describe('first hello', () => {
     it('runs initSession + openTransport, then sends welcome', async () => {
-      const { fetchHarness } = setupBackend();
+      const { fetchHarness, wsHarness } = setupBackend();
       const { registerPort } = await loadCore();
       const port = createMockPort();
       registerPort(port.adapter);
@@ -59,6 +63,34 @@ describe('worker/core', () => {
         sessionId: 'sess-1',
         sessionToken: 'tok-1',
       });
+      expect(wsHarness.connections[0].url).toBe(WS_URL);
+      expect(wsHarness.protocolOffers).toEqual([['recording.v1', 'auth.tok-1']]);
+    });
+
+    it('includes workerHash in welcome when set on globalThis', async () => {
+      (globalThis as Record<string, unknown>).__WORKER_HASH__ = 'abc123';
+      setupBackend();
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(helloMessage());
+      const welcome = await port.next<WelcomeMessage>(isType('welcome'));
+
+      expect(welcome.workerHash).toBe('abc123');
+      delete (globalThis as Record<string, unknown>).__WORKER_HASH__;
+    });
+
+    it('workerHash is undefined when not set on globalThis', async () => {
+      setupBackend();
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(helloMessage());
+      const welcome = await port.next<WelcomeMessage>(isType('welcome'));
+
+      expect(welcome.workerHash).toBeUndefined();
     });
 
     it('replies with skipRecording when the backend opts out', async () => {
@@ -222,9 +254,119 @@ describe('worker/core', () => {
       expect(debug.received.some(isType('log'))).toBe(true);
       expect(quiet.received.some(isType('log'))).toBe(false);
     });
+
+    it('does not expose a session token through configured URLs', async () => {
+      const token = 'leaky-sensitive';
+      setupBackend({ sessionId: 'session-1', sessionToken: token });
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(
+        helloMessage({
+          websocketUrl: `${WS_URL}?session_token=${token}`,
+          sessionIdHint: 'session-1',
+          sessionTokenHint: token,
+          debugLogs: true,
+        }),
+      );
+      await port.next<DeadMessage>(isType('dead'));
+
+      const logs = port.received.filter(isType('log')).map(message => (message as { msg: string }).msg);
+      expect(logs.length).toBeGreaterThan(0);
+      for (const log of logs) {
+        expect(log).not.toContain(token);
+      }
+    });
   });
 
   describe('lifecycle after active', () => {
+    it('uses a fresh header credential when a session hint fails protocol negotiation', async () => {
+      const { fetchHarness, wsHarness } = setupBackend(
+        { sessionId: 'fresh-session', sessionToken: 'fresh-sensitive' },
+        (protocols, connectionIndex) => (connectionIndex === 0 ? '' : protocols[0]),
+      );
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(
+        helloMessage({
+          sessionIdHint: 'stale-session',
+          sessionTokenHint: 'stale-sensitive',
+          debugLogs: true,
+        }),
+      );
+      const welcome = await port.next<WelcomeMessage>(isType('welcome'));
+
+      expect(welcome.result).toEqual({
+        sessionId: 'fresh-session',
+        sessionToken: 'fresh-sensitive',
+      });
+      expect(fetchHarness.calls).toHaveLength(1);
+      expect(wsHarness.protocolOffers).toEqual([
+        ['recording.v1', 'auth.stale-sensitive'],
+        ['recording.v1', 'auth.fresh-sensitive'],
+      ]);
+      expect(wsHarness.connections.every(connection => connection.url === WS_URL)).toBe(true);
+      const logs = port.received.filter(isType('log')).map(message => (message as { msg: string }).msg);
+      expect(logs.some(log => log.includes('sessionIdHint=stale-session'))).toBe(true);
+      expect(logs).toContain('adopting sessionIdHint=stale-session');
+      expect(logs).toContain('init-session ok sessionId=fresh-session');
+      for (const log of logs) {
+        expect(log).not.toContain('stale-sensitive');
+        expect(log).not.toContain('c3RhbGUtc2Vuc2l0aXZl');
+        expect(log).not.toContain('fresh-sensitive');
+        expect(log).not.toContain('ZnJlc2gtc2Vuc2l0aXZl');
+      }
+    });
+
+    it('stops when a hinted session upgrades with recording.v1 then immediately closes with 4401', async () => {
+      const { fetchHarness, wsHarness } = setupBackend();
+      // The API checks session state after the upgrade. A valid token for a missing or
+      // closed session therefore opens successfully before the server rejects it.
+      wsHarness.server.on('connection', () => {
+        setTimeout(() => wsHarness.server.close({ code: 4401, reason: 'Unauthorized', wasClean: true }), 0);
+      });
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(helloMessage({ sessionIdHint: 'stale-session', sessionTokenHint: 'stale-sensitive' }));
+      const welcome = await port.next<WelcomeMessage>(isType('welcome'));
+      const dead = await port.next<DeadMessage>(isType('dead'));
+
+      expect(welcome.result).toEqual({ sessionId: 'stale-session', sessionToken: 'stale-sensitive' });
+      expect(dead.reason).toBe('close code=4401 wasClean=true');
+      expect(fetchHarness.calls).toHaveLength(0);
+      expect(wsHarness.protocolOffers).toEqual([['recording.v1', 'auth.stale-sensitive']]);
+      expect(wsHarness.connections).toHaveLength(1);
+      expect(wsHarness.connections[0].url).toBe(WS_URL);
+    });
+
+    it('stops after one failed header-authenticated reconnect', async () => {
+      const { fetchHarness, wsHarness } = setupBackend(undefined, (protocols, connectionIndex) =>
+        connectionIndex === 0 ? protocols[0] : '',
+      );
+      const { registerPort } = await loadCore();
+      const port = createMockPort();
+      registerPort(port.adapter);
+
+      port.tabSends(helloMessage({ debugLogs: true }));
+      await port.next<WelcomeMessage>(isType('welcome'));
+      const first = await wsHarness.waitForConnection();
+      first.close({ code: 1000, reason: 'drain', wasClean: true });
+
+      const dead = await port.next<DeadMessage>(isType('dead'));
+      expect(dead.reason).toBe('reconnect-failed');
+      expect(fetchHarness.calls).toHaveLength(1);
+      expect(wsHarness.protocolOffers).toEqual([
+        ['recording.v1', 'auth.tok-1'],
+        ['recording.v1', 'auth.tok-1'],
+      ]);
+      expect(wsHarness.connections.every(connection => connection.url === WS_URL)).toBe(true);
+    });
+
     it('broadcasts dead to all ports when the transport closes abruptly', async () => {
       const { wsHarness } = setupBackend();
       const { registerPort } = await loadCore();

package/src/uploader/worker/core.ts

@@ -2,6 +2,8 @@ import type { ClientContext } from '../client-context';
 import type { Client, Frame, Transport } from '../types';
 import { CsrClient } from './csr-client';
 
+const WORKER_HASH: string | undefined = (globalThis as Record<string, unknown>).__WORKER_HASH__ as string | undefined;
+
 /** Adapter so this module is unaware of whether it's running in a SharedWorker or a dedicated Worker. */
 export interface PortAdapter {
   postMessage(message: unknown): void;
@@ -173,7 +175,7 @@ function onHello(handle: PortHandle): void {
       };
       log(
         `hello received apiUrl=${handle.hello!.apiUrl} websocketUrl=${
-          handle.hello!.websocketUrl ?? '(derive)'
+          handle.hello!.websocketUrl ? '(configured)' : '(derive)'
         } sessionIdHint=${handle.hello!.sessionIdHint ?? '(none)'}`,
       );
       state = { phase: 'initializing' };
@@ -202,6 +204,7 @@ function onHello(handle: PortHandle): void {
       handle.port.postMessage({
         type: 'welcome',
         result: { skipRecording: true },
+        workerHash: WORKER_HASH,
       });
       return;
     case 'dead':
@@ -332,6 +335,7 @@ function flushPendingWelcomes(): void {
       handle.port.postMessage({
         type: 'welcome',
         result: { skipRecording: true },
+        workerHash: WORKER_HASH,
       });
     } else if (state.phase === 'dead') {
       handle.port.postMessage({ type: 'dead', reason: state.reason });
@@ -346,6 +350,7 @@ function sendActiveWelcome(handle: PortHandle, currentSessionId: string, current
   handle.port.postMessage({
     type: 'welcome',
     result: { sessionId: currentSessionId, sessionToken: currentSessionToken },
+    workerHash: WORKER_HASH,
     adoptedFromSessionId: adopted ? hint : undefined,
     newTabId,
     resetCounter: adopted || newTabId !== undefined,