fix: Cloudflare/CAPTCHA verification failures in browser panel

Merged
JE
8mo ago
+6-2

Fixes #1429

telemetryHookBootstrapScriptSource and addressBarFocusTrackingBootstrapScript are injected with forMainFrameOnly: false, so they run inside cross-origin CAPTCHA iframes (challenges.cloudflare.com, google.com/recaptcha, hcaptcha.com).

CAPTCHA providers fingerprint the JS environment inside their iframe and detect:

  • Overridden console.log/warn/error/info/debug (the telemetry hook replaces all five)
  • Non-standard window.__cmux* globals (__cmuxHooksInstalled, __cmuxConsoleLog, __cmuxErrorLog, __cmuxAddressBarFocusState, etc.)

This causes Cloudflare Turnstile, reCAPTCHA, and hCaptcha to fail or score the session as a bot — which is the behavior described in #1429 (Cloudflare verification stuck on claude.ai and other protected sites).

Fix: forMainFrameOnly: false → forMainFrameOnly: true. Both scripts only need to run in the top-level page context — sub-frame telemetry isn't needed, and address bar focus tracking only applies to the main document.

-Jess

Summary by cubic

Fixes CAPTCHA verification failures in the browser panel by scoping injected scripts to the main frame only. Prevents console overrides and __cmux* globals from running inside cross-origin CAPTCHA iframes.

  • Bug Fixes
    • Set forMainFrameOnly: true for telemetryHookBootstrapScriptSource and addressBarFocusTrackingBootstrapScript to avoid running in CAPTCHA iframes (reCAPTCHA, hCaptcha, Cloudflare Turnstile).
    • Telemetry and focus tracking continue to run in the top-level page where they’re needed.

Summary by CodeRabbit

  • Bug Fixes
    • Restricted telemetry and address bar tracking to the main frame, preventing unnecessary execution in cross-origin iframes.