diff --git a/datasette_apps/agent_tools.py b/datasette_apps/agent_tools.py
index 338e141..98bb10a 100644
--- a/datasette_apps/agent_tools.py
+++ b/datasette_apps/agent_tools.py
@@ -74,7 +74,8 @@
         "loads invisibly in the user's open browser tab, so this requires an "
         "interactive conversation and edit permission for that app. The "
         "javascript argument is the body of an async function executed in "
-        "the app's global scope; its awaited return value is the result and "
+        "the app's global scope once the page has parsed and its own scripts "
+        "have run; its awaited return value is the result and "
         "must be JSON-serializable - return .textContent or measurements, "
         "not DOM elements. Apps render asynchronously, so wait for readiness "
         "with await debug.waitFor(fn, {timeout, interval}), which polls fn "
@@ -85,7 +86,10 @@
         "await debug.waitFor(() => window.innerWidth). Captured "
         "events include JavaScript errors, unhandled rejections, CSP "
         "violations, failed fetches, console output and datasette.query() "
-        "calls, from page load through script completion. Caveat: synthetic "
+        "calls, from page load through script completion. Some browsers "
+        "report errors against app-script-N - the app's Nth <script> "
+        "element - with line numbers within that script and the failing "
+        "line as sourceLine. Caveat: synthetic "
         "events dispatched by the debug script have isTrusted: false, so a "
         "few native browser behaviors (external-link interception, popup "
         "allowances) will not trigger."
diff --git a/datasette_apps/csp.py b/datasette_apps/csp.py
index 87fa777..46105c6 100644
--- a/datasette_apps/csp.py
+++ b/datasette_apps/csp.py
@@ -101,14 +101,29 @@ async def resolve_csp_origins(datasette, actor, requested_origins, existing_orig
     return normalized
 
 
-def build_csp(connect_origins):
+def build_csp(connect_origins, debug=False):
+    """debug=True builds the debug frame's policy, which also allows
+    blob: scripts: on engines that withhold error details for inline
+    scripts in sandboxed frames (WebKit) the debug bridge re-runs each
+    inline script as a same-text blob: script, whose errors keep their
+    details. That grants nothing 'unsafe-inline' does not - page code can
+    already run any script text it builds - and worker-src 'none' keeps
+    workers blocked, as they are in production."""
     origins = [normalize_connect_origin(origin) for origin in connect_origins]
     directives = [*BASE_DIRECTIVES]
+    if debug:
+        directives = [
+            f"{directive} blob:" if directive.startswith("script-src ") else directive
+            for directive in directives
+        ]
     if origins:
         element_sources = ["'unsafe-inline'", *origins]
-        directives.append(f"script-src-elem {' '.join(element_sources)}")
+        script_element_sources = [*element_sources, *(["blob:"] if debug else [])]
+        directives.append(f"script-src-elem {' '.join(script_element_sources)}")
         directives.append(f"style-src-elem {' '.join(element_sources)}")
     directives.append(f"img-src {' '.join(['data:', 'blob:', *origins])}")
     if origins:
         directives.append(f"connect-src {' '.join(origins)}")
+    if debug:
+        directives.append("worker-src 'none'")
     return "; ".join(directives) + ";"
diff --git a/datasette_apps/rendering.py b/datasette_apps/rendering.py
index 03a18da..33d0dfc 100644
--- a/datasette_apps/rendering.py
+++ b/datasette_apps/rendering.py
@@ -15,7 +15,9 @@ def _csp_meta(csp):
 # Only injected into debug frames: ordinary app views have no eval
 # surface. Execution inserts an inline <script> element, which the
 # production script-src 'unsafe-inline' policy already permits - no
-# 'unsafe-eval', no debug-only CSP variant.
+# 'unsafe-eval'. The debug frame's policy differs from production only
+# by also allowing blob: scripts, used to recover error details on
+# engines that withhold them (see build_csp).
 _DEBUG_BRIDGE_EXTENSIONS = """
   window.debug = {
     waitFor: function(fn, options) {
@@ -74,6 +76,38 @@ def _csp_meta(csp):
     return true;
   }
 
+  function debugScriptCompileError(details, code) {
+    if (!details) {
+      return {message: "Debug script did not run"};
+    }
+    if (details.sanitized) {
+      return {
+        sanitized: true,
+        message: "Debug script failed to compile, most likely a syntax " +
+          "error - this browser withholds the details in sandboxed " +
+          "frames. Check for unbalanced brackets or quotes, and for " +
+          "import or export statements, which an async function body " +
+          "cannot contain"
+      };
+    }
+    var error = {
+      name: details.name || "SyntaxError",
+      // Chromium prefixes the message with the DOM call that inserted
+      // the script
+      message: "Debug script failed to compile: " +
+        String(details.message || "").replace(
+          /^Failed to execute '[^']*' on '[^']*': /, ""
+        )
+    };
+    // The debug script starts on line 2 of the injected wrapper
+    var line = details.lineno - 1;
+    if (line >= 1 && line <= code.split("\\n").length) {
+      error.line = line;
+      error.column = details.colno;
+    }
+    return error;
+  }
+
   function runDebugScript(id, code) {
     function report(ok, payload) {
       var message = {type: "datasette-app-debug-result", id: id, ok: ok};
@@ -116,25 +150,421 @@ def _csp_meta(csp):
       delete window.__datasetteAppsDebugReportError;
       report(false, normalizeError(error));
     };
+    var started = false;
+    var compileError = null;
+    window.__datasetteAppsDebugStarted = function() {
+      started = true;
+    };
     var script = document.createElement("script");
     script.textContent = "(async function() {" +
+      "window.__datasetteAppsDebugStarted(); " +
       "try { window.__datasetteAppsDebugReport(" +
       "await (async function() {\\n" + code + "\\n})()); }" +
       " catch (error) { window.__datasetteAppsDebugReportError(error); }" +
       "})();";
-    (document.body || document.documentElement).appendChild(script);
+    // Inline scripts run synchronously on insertion and the async
+    // wrapper cannot throw, so an error event raised meanwhile means the
+    // script failed to compile: it becomes the run's result, not an app
+    // error - otherwise the run would wait out its whole timeout.
+    var previousErrorHandler = debugErrorHandler;
+    debugErrorHandler = function(details) {
+      compileError = details;
+      return true;
+    };
+    try {
+      (document.body || document.documentElement).appendChild(script);
+    } finally {
+      debugErrorHandler = previousErrorHandler;
+    }
     if (script.parentNode) {
       script.parentNode.removeChild(script);
     }
+    delete window.__datasetteAppsDebugStarted;
+    if (!started) {
+      delete window.__datasetteAppsDebugReport;
+      delete window.__datasetteAppsDebugReportError;
+      report(false, debugScriptCompileError(compileError, code));
+    }
   }
 
   debugMessageHandler = function(message) {
     if (message.type !== "datasette-app-debug-eval") {
       return false;
     }
-    runDebugScript(message.id, String(message.code || ""));
+    var run = function() {
+      runDebugScript(message.id, String(message.code || ""));
+    };
+    if (document.readyState === "loading") {
+      // Run after the page's own parser-inserted scripts: the eval
+      // message can otherwise arrive between them, for instance while
+      // the parser waits on a script converted to blob: (below)
+      nativeAddEventListener.call(document, "DOMContentLoaded", run, {once: true});
+    } else {
+      run();
+    }
     return true;
   };
+
+  // ---- Error details on engines that withhold them ----
+  //
+  // WebKit reports every uncaught error from a classic script in a
+  // sandboxed (opaque origin) frame as a bare "Script error.". On
+  // engines that do, debug frames recover the details:
+  // - each inline <script> is swapped, just before it runs, for a
+  //   same-text blob: script, whose errors keep their details. Still a
+  //   classic script executed in document order, so globals,
+  //   document.write and document.currentScript are unchanged
+  // - callbacks the app registers (timers, listeners, handler
+  //   properties, observers) are wrapped, so whatever they throw is
+  //   captured on its way out, before the browser sanitizes it
+  // Errors from converted scripts are reported against "app-script-N"
+  // (the Nth <script> element in the app) with line numbers within
+  // that script, plus the text of the failing line.
+  var nativeSetTimeout = window.setTimeout.bind(window);
+  var nativeAddEventListener = EventTarget.prototype.addEventListener;
+  var nativeRemoveEventListener = EventTarget.prototype.removeEventListener;
+  var NativeMutationObserver = window.MutationObserver;
+  var CLASSIC_SCRIPT_TYPES = [
+    "", "text/javascript", "application/javascript", "text/ecmascript",
+    "application/ecmascript", "application/x-javascript", "text/x-javascript"
+  ];
+  // Attributes an external script honors that an inline one ignores
+  var INLINE_ONLY_BLOCKERS = [
+    "src", "async", "defer", "nomodule", "integrity", "onload", "onerror",
+    "language"
+  ];
+  // Event types whose inline on* attribute handlers get wrapped just
+  // before dispatch reaches them
+  var INLINE_HANDLER_EVENTS = [
+    "click", "dblclick", "contextmenu", "auxclick", "mousedown", "mouseup",
+    "mouseover", "mouseout", "pointerdown", "pointerup", "touchstart",
+    "touchend", "keydown", "keyup", "keypress", "input", "change", "submit",
+    "reset", "focus", "blur", "focusin", "focusout", "select", "toggle",
+    "load", "resize", "hashchange"
+  ];
+  var convertedScripts = {};  // blob URL -> {label, text}
+  var pendingConversions = [];
+  var seenScripts = new WeakSet();
+  var callbackWrappers = new WeakMap();  // callback -> wrapper
+  var wrappedCallbacks = new WeakMap();  // wrapper -> callback
+  var thrownByCallbacks = [];
+
+  function errorsAreSanitized() {
+    var sanitized = false;
+    var probe = document.createElement("script");
+    probe.textContent = "throw new Error('datasette-apps error details probe')";
+    debugErrorHandler = function(details) {
+      sanitized = !!details.sanitized;
+      return true;
+    };
+    try {
+      (document.head || document.documentElement).appendChild(probe);
+    } finally {
+      debugErrorHandler = null;
+    }
+    if (probe.parentNode) {
+      probe.parentNode.removeChild(probe);
+    }
+    return sanitized;
+  }
+
+  function scriptLabel(script) {
+    var scripts = document.getElementsByTagName("script");
+    var index = 0;
+    for (var i = 0; i < scripts.length; i += 1) {
+      if (scripts[i].id === "datasette-apps-bridge") {
+        continue;
+      }
+      index += 1;
+      if (scripts[i] === script) {
+        return "app-script-" + index;
+      }
+    }
+    return "app-script";
+  }
+
+  function canConvert(script) {
+    if (!script.isConnected || document.readyState !== "loading") {
+      return false;
+    }
+    var type = (script.getAttribute("type") || "").trim().toLowerCase();
+    if (CLASSIC_SCRIPT_TYPES.indexOf(type) === -1) {
+      return false;
+    }
+    return !INLINE_ONLY_BLOCKERS.some(function(name) {
+      return script.hasAttribute(name);
+    });
+  }
+
+  function pointScriptAtBlob(entry) {
+    entry.url = URL.createObjectURL(
+      new Blob([entry.text], {type: "text/javascript"})
+    );
+    convertedScripts[entry.url] = entry;
+    entry.script.src = entry.url;
+  }
+
+  function convertScript(script) {
+    var entry = {
+      script: script,
+      text: script.textContent,
+      label: scriptLabel(script),
+      url: null
+    };
+    pointScriptAtBlob(entry);
+    pendingConversions.push(entry);
+    function settle(event) {
+      nativeRemoveEventListener.call(script, "load", settle);
+      nativeRemoveEventListener.call(script, "error", settle);
+      pendingConversions.splice(pendingConversions.indexOf(entry), 1);
+      URL.revokeObjectURL(entry.url);
+      if (event.type === "error" && script.parentNode) {
+        // The blob: script could not load - say the app's own CSP
+        // forbids blob: scripts. Parser-blocking scripts fire this
+        // before parsing resumes, so running the original inline here
+        // keeps it in order.
+        var fallback = document.createElement("script");
+        seenScripts.add(fallback);
+        fallback.textContent = entry.text;
+        script.parentNode.insertBefore(fallback, script.nextSibling);
+      }
+    }
+    nativeAddEventListener.call(script, "load", settle);
+    nativeAddEventListener.call(script, "error", settle);
+  }
+
+  function convertParserScripts(records, observer) {
+    records.forEach(function(record) {
+      Array.prototype.forEach.call(record.addedNodes, function(node) {
+        if (node.nodeType !== 1 || node.tagName !== "SCRIPT" || seenScripts.has(node)) {
+          return;
+        }
+        seenScripts.add(node);
+        if (node.id !== "datasette-apps-bridge" && canConvert(node)) {
+          convertScript(node);
+        }
+      });
+    });
+    // A parser that yielded mid-script may have added more text since
+    // a script was converted; a script's src only takes effect when it
+    // is prepared, so re-pointing it before then is safe
+    pendingConversions.forEach(function(entry) {
+      if (entry.script.textContent !== entry.text) {
+        URL.revokeObjectURL(entry.url);
+        entry.text = entry.script.textContent;
+        pointScriptAtBlob(entry);
+      }
+    });
+    if (document.readyState !== "loading") {
+      observer.disconnect();
+    }
+  }
+
+  function rememberThrown(error) {
+    // The browser reports an uncaught callback exception within the
+    // same task - though WebKit drains microtasks first, and a callback
+    // throwing in one of those is reported before this one, hence a
+    // stack. Anything left by a later task was caught elsewhere.
+    thrownByCallbacks.push({error: error});
+    nativeSetTimeout(function() {
+      thrownByCallbacks = [];
+    }, 0);
+  }
+
+  function wrapCallback(callback) {
+    if (!callback || (typeof callback !== "function" && typeof callback !== "object")) {
+      return callback;
+    }
+    var wrapper = callbackWrappers.get(callback);
+    if (wrapper) {
+      return wrapper;
+    }
+    wrapper = function debugBridgeErrorCapture() {
+      try {
+        if (typeof callback === "function") {
+          return callback.apply(this, arguments);
+        }
+        return callback.handleEvent.apply(callback, arguments);
+      } catch (error) {
+        rememberThrown(error);
+        throw error;
+      }
+    };
+    callbackWrappers.set(callback, wrapper);
+    wrappedCallbacks.set(wrapper, callback);
+    return wrapper;
+  }
+
+  function wrapHandlerProperties(target) {
+    if (!target) {
+      return;
+    }
+    Object.getOwnPropertyNames(target).forEach(function(name) {
+      if (name.slice(0, 2) !== "on") {
+        return;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(target, name);
+      if (!descriptor || !descriptor.get || !descriptor.set || !descriptor.configurable) {
+        return;
+      }
+      Object.defineProperty(target, name, {
+        configurable: true,
+        enumerable: descriptor.enumerable,
+        get: function() {
+          var value = descriptor.get.call(this);
+          return (value && wrappedCallbacks.get(value)) || value;
+        },
+        set: function(value) {
+          descriptor.set.call(
+            this, typeof value === "function" ? wrapCallback(value) : value
+          );
+        }
+      });
+    });
+  }
+
+  function rewrapHandler(target, name) {
+    try {
+      var handler = target[name];
+      if (typeof handler === "function") {
+        target[name] = handler;
+      }
+    } catch (ignore) {
+    }
+  }
+
+  function wrapAppCallbacks() {
+    [
+      "setTimeout", "setInterval", "requestAnimationFrame", "queueMicrotask",
+      "requestIdleCallback"
+    ].forEach(function(name) {
+      var original = window[name];
+      if (typeof original !== "function") {
+        return;
+      }
+      window[name] = function(callback) {
+        var args = Array.prototype.slice.call(arguments);
+        if (typeof callback === "function") {
+          args[0] = wrapCallback(callback);
+        }
+        return original.apply(window, args);
+      };
+    });
+    EventTarget.prototype.addEventListener = function(type, listener, options) {
+      return nativeAddEventListener.call(this, type, wrapCallback(listener), options);
+    };
+    EventTarget.prototype.removeEventListener = function(type, listener, options) {
+      var wrapper = listener ? callbackWrappers.get(listener) : null;
+      return nativeRemoveEventListener.call(this, type, wrapper || listener, options);
+    };
+    [
+      window, window.Window, window.Document, window.Element,
+      window.HTMLElement, window.SVGElement, window.XMLHttpRequestEventTarget,
+      window.XMLHttpRequest, window.FileReader, window.MediaQueryList
+    ].forEach(function(target) {
+      wrapHandlerProperties(target === window ? window : target && target.prototype);
+    });
+    [
+      "MutationObserver", "ResizeObserver", "IntersectionObserver",
+      "PerformanceObserver"
+    ].forEach(function(name) {
+      var Original = window[name];
+      if (typeof Original !== "function" || typeof Proxy !== "function") {
+        return;
+      }
+      window[name] = new Proxy(Original, {
+        construct: function(target, args, newTarget) {
+          args = Array.prototype.slice.call(args);
+          if (typeof args[0] === "function") {
+            args[0] = wrapCallback(args[0]);
+          }
+          return Reflect.construct(target, args, newTarget);
+        }
+      });
+    });
+    // Inline on* attributes compile to handlers the browser installs
+    // itself; wrap those on the event's path just before dispatch
+    // reaches them
+    INLINE_HANDLER_EVENTS.forEach(function(type) {
+      nativeAddEventListener.call(window, type, function(event) {
+        var name = "on" + type;
+        rewrapHandler(window, name);
+        rewrapHandler(document, name);
+        var path = typeof event.composedPath === "function" ? event.composedPath() : [];
+        for (var i = 0; i < path.length; i += 1) {
+          if (path[i] && path[i].nodeType === 1 && path[i].hasAttribute(name)) {
+            rewrapHandler(path[i], name);
+          }
+        }
+      }, true);
+    });
+  }
+
+  function stackLocation(stack) {
+    var match = /((?:blob:|about:|https?:)[^\\s()@]*?):(\\d+):(\\d+)(?=\\)|\\s|$)/.exec(
+      String(stack || "")
+    );
+    return match
+      ? {url: match[1], line: Number(match[2]), column: Number(match[3])}
+      : null;
+  }
+
+  function recoverErrorDetails(details) {
+    var thrown = thrownByCallbacks.pop();
+    if (!details.sanitized) {
+      return false;
+    }
+    if (thrown) {
+      var recovered = normalizeError(thrown.error);
+      var location = stackLocation(recovered.stack);
+      Object.keys(details).forEach(function(key) {
+        delete details[key];
+      });
+      Object.keys(recovered).forEach(function(key) {
+        details[key] = recovered[key];
+      });
+      details.filename = location ? location.url : "";
+      details.lineno = location ? location.line : 0;
+      details.colno = location ? location.column : 0;
+      return false;
+    }
+    // Still sanitized: an inline script that could not be converted.
+    // Name the script whose top-level code threw.
+    var script = document.currentScript;
+    if (script && script.id !== "datasette-apps-bridge") {
+      details.script = scriptLabel(script);
+      details.message += " - thrown by the top-level code of " + details.script;
+    }
+    return false;
+  }
+
+  function describeConvertedScripts(details) {
+    var entry = details.filename && convertedScripts[details.filename];
+    if (entry) {
+      details.filename = entry.label;
+      var line = entry.text.split("\\n")[details.lineno - 1];
+      if (line !== undefined) {
+        details.sourceLine = line.trim().slice(0, 300);
+      }
+    }
+    if (details.stack) {
+      Object.keys(convertedScripts).forEach(function(url) {
+        details.stack = details.stack.split(url).join(convertedScripts[url].label);
+      });
+    }
+    return details;
+  }
+
+  if (errorsAreSanitized()) {
+    new NativeMutationObserver(convertParserScripts).observe(document, {
+      childList: true,
+      subtree: true,
+      characterData: true
+    });
+    wrapAppCallbacks();
+    debugErrorHandler = recoverErrorDetails;
+    debugErrorFilter = describeConvertedScripts;
+  }
 """
 
 
@@ -150,6 +580,8 @@ def iframe_bridge_script(channel_token=None, debug=False):
   var lastViewportContent = null;
   var viewportReporterStarted = false;
   var debugMessageHandler = null;
+  var debugErrorHandler = null;
+  var debugErrorFilter = null;
 
   function noopHistoryMethod() {
   }
@@ -258,6 +690,9 @@ def iframe_bridge_script(channel_token=None, debug=False):
 
   function postAppError(kind, details) {
     details = details || {};
+    if (debugErrorFilter) {
+      details = debugErrorFilter(details);
+    }
     details.kind = kind;
     details.timestamp = new Date().toISOString();
     postToParent({
@@ -380,6 +815,9 @@ def iframe_bridge_script(channel_token=None, debug=False):
     details.filename = event.filename || "";
     details.lineno = event.lineno || 0;
     details.colno = event.colno || 0;
+    if (debugErrorHandler && debugErrorHandler(details)) {
+      return;
+    }
     postAppError("javascript-error", details);
   }, true);
 
diff --git a/datasette_apps/views.py b/datasette_apps/views.py
index cf6b6a9..c261051 100644
--- a/datasette_apps/views.py
+++ b/datasette_apps/views.py
@@ -733,7 +733,7 @@ async def debug_frame(datasette, request):
     version = await registry.get_version(job["app_id"], job["version"])
     if version is None:
         raise NotFound("App revision not found")
-    csp = build_csp(await registry.get_csp_origins(job["app_id"]))
+    csp = build_csp(await registry.get_csp_origins(job["app_id"]), debug=True)
     document = build_app_srcdoc(
         version["html"],
         csp,
diff --git a/tests/test_csp.py b/tests/test_csp.py
index 0a66a2d..337699b 100644
--- a/tests/test_csp.py
+++ b/tests/test_csp.py
@@ -39,6 +39,23 @@ def test_build_csp_includes_exact_connect_origins():
     )
 
 
+def test_build_debug_csp_adds_blob_scripts_and_blocks_workers():
+    # The debug bridge re-runs inline scripts as blob: scripts on
+    # engines that withhold their error details; workers stay blocked
+    assert build_csp([], debug=True) == (
+        "default-src 'none'; script-src 'unsafe-inline' blob:; "
+        "style-src 'unsafe-inline'; img-src data: blob:; worker-src 'none';"
+    )
+    assert build_csp(["https://api.github.com"], debug=True) == (
+        "default-src 'none'; script-src 'unsafe-inline' blob:; "
+        "style-src 'unsafe-inline'; "
+        "script-src-elem 'unsafe-inline' https://api.github.com blob:; "
+        "style-src-elem 'unsafe-inline' https://api.github.com; "
+        "img-src data: blob: https://api.github.com; "
+        "connect-src https://api.github.com; worker-src 'none';"
+    )
+
+
 def test_build_csp_can_allow_insecure_origins_in_tests(monkeypatch):
     monkeypatch.setenv("DATASETTE_APPS_ALLOW_INSECURE_TEST_CSP_ORIGINS", "1")
 
diff --git a/tests/test_debug_jobs.py b/tests/test_debug_jobs.py
index 23d9651..c139faa 100644
--- a/tests/test_debug_jobs.py
+++ b/tests/test_debug_jobs.py
@@ -1,11 +1,13 @@
 """Tests for debug job storage and the /-/apps/debug/* endpoints."""
 
+import html
 from datetime import datetime, timedelta, timezone
 
 import pytest
 from datasette.app import Datasette
 
 from datasette_apps import Registry
+from datasette_apps.csp import build_csp
 from datasette_apps.debug import (
     DEFAULT_TIMEOUT_MS,
     DEFAULT_VIEWPORT,
@@ -149,7 +151,16 @@ async def test_frame_serves_job_revision_with_debug_bridge():
     assert "datasette-app-debug-eval" in document
     assert "waitFor" in document
     assert job["config"]["channel_token"] in document
-    assert response.headers["cache-control"] == "no-store"
+    # Debug frames allow blob: scripts, for recovering error details on
+    # engines that withhold them for inline scripts
+    assert html.escape(build_csp([], debug=True), quote=True) in document
+    # Newer Datasette releases add "private" to responses for signed-in
+    # actors, so check for the directive rather than the exact header
+    cache_control = [
+        directive.strip()
+        for directive in response.headers["cache-control"].lower().split(",")
+    ]
+    assert "no-store" in cache_control
 
     # Only the actor who created the job may fetch the document; the
     # frame token additionally binds the request to the claimed run.
@@ -357,3 +368,6 @@ async def test_stored_app_view_has_no_debug_eval_channel():
     response = await datasette.client.get(f"/-/apps/{app['id']}", actor={"id": "alice"})
     assert response.status_code == 200
     assert "datasette-app-debug-eval" not in response.text
+    # The debug-only CSP (blob: scripts, worker-src 'none') stays out
+    assert "worker-src" not in response.text
+    assert "Content-Security-Policy" in response.text
diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 0cea3e6..857400d 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1118,16 +1118,137 @@ def test_debug_harness_reports_app_errors_and_unserializable_result(
         )
         assert "app warned" in messages
         # WebKit withholds uncaught-error details in sandboxed (opaque
-        # origin) frames - srcdoc and URL frames alike - reporting only
-        # "Script error."; the bridge annotates those so readers know why
-        # details are missing. Chromium and Firefox report in full.
+        # origin) frames, reporting only "Script error."; debug frames
+        # recover them, so every engine reports the thrown message.
         js_errors = [
             error
             for error in envelope["events"]["errors"]
             if error["kind"] == "javascript-error"
         ]
-        assert any(
-            "render exploded" in error.get("message", "")
-            or (error.get("sanitized") and "details withheld" in error["message"])
-            for error in js_errors
+        assert any("render exploded" in error.get("message", "") for error in js_errors)
+
+
+def test_debug_harness_reports_debug_script_syntax_error_immediately(
+    tmp_path, monkeypatch
+):
+    monkeypatch.setenv("DATASETTE_SECRET", DEBUG_ACTOR_SECRET)
+    server = DatasetteServer(tmp_path)
+    app = asyncio.run(
+        server.create_app('<h1 id="title">Fine app</h1>', name="Fine app")
+    )
+    job, payload, harness = asyncio.run(
+        _create_debug_job_with_task(
+            server,
+            app["id"],
+            "const title = document.querySelector('#title';\n"
+            "return title.textContent;",
+            timeout_ms=30000,
+        )
+    )
+
+    with server, _browser_page() as page:
+        _run_debug_task(server, page, "01TASK0000000000000000SYNX", payload, harness)
+        envelope = _wait_for_task_result(page)[0]["envelope"]
+
+        # A debug script that fails to compile never runs its wrapper, so
+        # it used to wait out the whole timeout with only an app-level
+        # javascript-error event - just "Script error." on WebKit. It is
+        # now the run's own error, reported straight away.
+        assert envelope["timed_out"] is False
+        assert envelope["duration_ms"] < 10000
+        assert envelope["ok"] is False
+        error = envelope["error"]
+        assert error["message"].startswith("Debug script failed to compile")
+        # Chromium and Firefox report the parser's message and position;
+        # WebKit withholds them in sandboxed frames, so the message
+        # explains that instead
+        if not error.get("sanitized"):
+            assert error["name"] == "SyntaxError"
+            assert "Failed to execute" not in error["message"]
+            assert error["line"] == 1
+        assert envelope["events"]["errors"] == []
+
+
+def test_debug_harness_recovers_error_details_from_every_error_source(
+    tmp_path, monkeypatch
+):
+    monkeypatch.setenv("DATASETTE_SECRET", DEBUG_ACTOR_SECRET)
+    server = DatasetteServer(tmp_path)
+    app = asyncio.run(
+        server.create_app(
+            """<!doctype html>
+<h1 id="title">Error sampler</h1>
+<button id="listener-button">Listener</button>
+<button id="attribute-button" onclick="attributeHandler()">Attribute</button>
+<script>
+const shared = {count: 0};
+function attributeHandler() {
+  shared.count += 1;
+  throw new Error("inline attribute handler failed");
+}
+document.getElementById("listener-button").addEventListener("click", function() {
+  shared.count += 1;
+  throw new Error("click listener failed");
+});
+setTimeout(function() {
+  throw new Error("timer callback failed");
+}, 0);
+</script>
+<script>
+shared.count += 1;
+document.getElementById("title").dataset.ready = "yes";
+throw new Error("top-level code failed");
+</script>""",
+            name="Error sampler",
+        )
+    )
+    job, payload, harness = asyncio.run(
+        _create_debug_job_with_task(
+            server,
+            app["id"],
+            """
+await debug.waitFor(() => document.getElementById("title").dataset.ready);
+document.getElementById("listener-button").click();
+document.getElementById("attribute-button").click();
+await new Promise((resolve) => setTimeout(resolve, 200));
+return {count: shared.count};
+""",
         )
+    )
+
+    with server, _browser_page() as page:
+        _run_debug_task(server, page, "01TASK0000000000000000RCVR", payload, harness)
+        envelope = _wait_for_task_result(page)[0]["envelope"]
+
+    # The app ran exactly as it would without the debug bridge: its
+    # scripts share top-level bindings with each other and with the
+    # debug script
+    assert envelope["ok"] is True, envelope
+    assert envelope["result"] == {"count": 3}
+    js_errors = {
+        error["message"]: error
+        for error in envelope["events"]["errors"]
+        if error["kind"] == "javascript-error"
+    }
+    # A str, so pytest reports it in full rather than truncated
+    all_errors = json.dumps(list(js_errors.values()), indent=1)
+    # WebKit sanitizes every one of these to "Script error." in a
+    # sandboxed frame; debug frames recover each message
+    for expected in (
+        "top-level code failed",
+        "click listener failed",
+        "inline attribute handler failed",
+        "timer callback failed",
+    ):
+        assert any(expected in message for message in js_errors), all_errors
+    assert not any("Script error" in message for message in js_errors), all_errors
+    top_level = next(
+        error
+        for message, error in js_errors.items()
+        if "top-level code failed" in message
+    )
+    if top_level["filename"].startswith("app-script-"):
+        # Engines that sanitize run inline scripts as blob: scripts,
+        # reported against the app's Nth <script> element
+        assert top_level["filename"] == "app-script-2"
+        assert top_level["sourceLine"] == 'throw new Error("top-level code failed");'