From 10c7d1048ff019274017ce466e8227869e12510d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 23 Sep 2026 23:53:04 +0000
Subject: [PATCH 1/7] Report debug script syntax errors as the run's error,
 immediately

A debug script that failed to compile never ran its wrapper, so the run
waited out its whole timeout and the only clue was an app-level
javascript-error event - which WebKit sanitizes in sandboxed frames to
"Script error. (details withheld ...)".

The bridge now checks whether the injected script started. If it did
not, the error event raised during insertion becomes the run's result:
the parser message plus line/column within the debug script on
Chromium and Firefox, or an explanation that details were withheld on
WebKit. The run finishes straight away instead of timing out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 datasette_apps/rendering.py | 62 ++++++++++++++++++++++++++++++++++++-
 tests/test_playwright.py    | 41 ++++++++++++++++++++++++
 2 files changed, 102 insertions(+), 1 deletion(-)

diff --git a/datasette_apps/rendering.py b/datasette_apps/rendering.py
index 03a18da..b00c559 100644
--- a/datasette_apps/rendering.py
+++ b/datasette_apps/rendering.py
@@ -74,6 +74,38 @@ def _csp_meta(csp):
     return true;
   }
 
+  function debugScriptCompileError(details, code) {
+    if (!details) {
+      return {message: "Debug script did not run"};
+    }
+    if (details.sanitized) {
+      return {
+        sanitized: true,
+        message: "Debug script failed to compile, most likely a syntax " +
+          "error - this browser withholds the details in sandboxed " +
+          "frames. Check for unbalanced brackets or quotes, and for " +
+          "import or export statements, which an async function body " +
+          "cannot contain"
+      };
+    }
+    var error = {
+      name: details.name || "SyntaxError",
+      // Chromium prefixes the message with the DOM call that inserted
+      // the script
+      message: "Debug script failed to compile: " +
+        String(details.message || "").replace(
+          /^Failed to execute '[^']*' on '[^']*': /, ""
+        )
+    };
+    // The debug script starts on line 2 of the injected wrapper
+    var line = details.lineno - 1;
+    if (line >= 1 && line <= code.split("\\n").length) {
+      error.line = line;
+      error.column = details.colno;
+    }
+    return error;
+  }
+
   function runDebugScript(id, code) {
     function report(ok, payload) {
       var message = {type: "datasette-app-debug-result", id: id, ok: ok};
@@ -116,16 +148,40 @@ def _csp_meta(csp):
       delete window.__datasetteAppsDebugReportError;
       report(false, normalizeError(error));
     };
+    var started = false;
+    var compileError = null;
+    window.__datasetteAppsDebugStarted = function() {
+      started = true;
+    };
     var script = document.createElement("script");
     script.textContent = "(async function() {" +
+      "window.__datasetteAppsDebugStarted(); " +
       "try { window.__datasetteAppsDebugReport(" +
       "await (async function() {\\n" + code + "\\n})()); }" +
       " catch (error) { window.__datasetteAppsDebugReportError(error); }" +
       "})();";
-    (document.body || document.documentElement).appendChild(script);
+    // Inline scripts run synchronously on insertion and the async
+    // wrapper cannot throw, so an error event raised meanwhile means the
+    // script failed to compile: it becomes the run's result, not an app
+    // error - otherwise the run would wait out its whole timeout.
+    debugErrorHandler = function(details) {
+      compileError = details;
+      return true;
+    };
+    try {
+      (document.body || document.documentElement).appendChild(script);
+    } finally {
+      debugErrorHandler = null;
+    }
     if (script.parentNode) {
       script.parentNode.removeChild(script);
     }
+    delete window.__datasetteAppsDebugStarted;
+    if (!started) {
+      delete window.__datasetteAppsDebugReport;
+      delete window.__datasetteAppsDebugReportError;
+      report(false, debugScriptCompileError(compileError, code));
+    }
   }
 
   debugMessageHandler = function(message) {
@@ -150,6 +206,7 @@ def iframe_bridge_script(channel_token=None, debug=False):
   var lastViewportContent = null;
   var viewportReporterStarted = false;
   var debugMessageHandler = null;
+  var debugErrorHandler = null;
 
   function noopHistoryMethod() {
   }
@@ -380,6 +437,9 @@ def iframe_bridge_script(channel_token=None, debug=False):
     details.filename = event.filename || "";
     details.lineno = event.lineno || 0;
     details.colno = event.colno || 0;
+    if (debugErrorHandler && debugErrorHandler(details)) {
+      return;
+    }
     postAppError("javascript-error", details);
   }, true);
 
diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 0cea3e6..7bac3ff 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1131,3 +1131,44 @@ def test_debug_harness_reports_app_errors_and_unserializable_result(
             or (error.get("sanitized") and "details withheld" in error["message"])
             for error in js_errors
         )
+
+
+def test_debug_harness_reports_debug_script_syntax_error_immediately(
+    tmp_path, monkeypatch
+):
+    monkeypatch.setenv("DATASETTE_SECRET", DEBUG_ACTOR_SECRET)
+    server = DatasetteServer(tmp_path)
+    app = asyncio.run(
+        server.create_app('<h1 id="title">Fine app</h1>', name="Fine app")
+    )
+    job, payload, harness = asyncio.run(
+        _create_debug_job_with_task(
+            server,
+            app["id"],
+            "const title = document.querySelector('#title';\n"
+            "return title.textContent;",
+            timeout_ms=30000,
+        )
+    )
+
+    with server, _browser_page() as page:
+        _run_debug_task(server, page, "01TASK0000000000000000SYNX", payload, harness)
+        envelope = _wait_for_task_result(page)[0]["envelope"]
+
+        # A debug script that fails to compile never runs its wrapper, so
+        # it used to wait out the whole timeout with only an app-level
+        # javascript-error event - just "Script error." on WebKit. It is
+        # now the run's own error, reported straight away.
+        assert envelope["timed_out"] is False
+        assert envelope["duration_ms"] < 10000
+        assert envelope["ok"] is False
+        error = envelope["error"]
+        assert error["message"].startswith("Debug script failed to compile")
+        # Chromium and Firefox report the parser's message and position;
+        # WebKit withholds them in sandboxed frames, so the message
+        # explains that instead
+        if not error.get("sanitized"):
+            assert error["name"] == "SyntaxError"
+            assert "Failed to execute" not in error["message"]
+            assert error["line"] == 1
+        assert envelope["events"]["errors"] == []

From c0cfede610417ec80f030dfd5797fc7142f81bb5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:01:01 +0000
Subject: [PATCH 2/7] Accept "private, no-store" cache-control in debug frame
 test

Newer Datasette releases add "private" to responses for signed-in
actors. Check for the no-store directive instead of the exact header so
the test passes against older and newer Datasette alike.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 tests/test_debug_jobs.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/test_debug_jobs.py b/tests/test_debug_jobs.py
index 23d9651..c9a815d 100644
--- a/tests/test_debug_jobs.py
+++ b/tests/test_debug_jobs.py
@@ -149,7 +149,13 @@ async def test_frame_serves_job_revision_with_debug_bridge():
     assert "datasette-app-debug-eval" in document
     assert "waitFor" in document
     assert job["config"]["channel_token"] in document
-    assert response.headers["cache-control"] == "no-store"
+    # Newer Datasette releases add "private" to responses for signed-in
+    # actors, so check for the directive rather than the exact header
+    cache_control = [
+        directive.strip()
+        for directive in response.headers["cache-control"].lower().split(",")
+    ]
+    assert "no-store" in cache_control
 
     # Only the actor who created the job may fetch the document; the
     # frame token additionally binds the request to the claimed run.

From dffc7e29a45288ddd1863e1f5eb03b9d0c5f7d35 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:01:01 +0000
Subject: [PATCH 3/7] TEMPORARY: probe error sanitization per browser engine

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 tests/test_playwright.py | 86 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 7bac3ff..9aaf826 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1172,3 +1172,89 @@ def test_debug_harness_reports_debug_script_syntax_error_immediately(
             assert "Failed to execute" not in error["message"]
             assert error["line"] == 1
         assert envelope["events"]["errors"] == []
+
+
+# TEMPORARY PROBE - records what each engine reports to a sandboxed
+# srcdoc frame's error listener for several ways of raising an error.
+# Emitted as a warning so CI logs carry the data; removed after.
+_PROBES = {
+    "classic_toplevel": '<script id="s">throw new Error("classic top-level")</script>',
+    "classic_sourceurl_data": '<script id="s">throw new Error("sourceURL data")\n//# sourceURL=data:text/javascript,probe</script>',
+    "classic_sourceurl_relative": '<script id="s">throw new Error("sourceURL relative")\n//# sourceURL=probe-script.js</script>',
+    "module_toplevel": '<script type="module" id="s">throw new Error("module top-level")</script>',
+    "classic_timeout": '<script id="s">setTimeout(function() { throw new Error("classic timeout") }, 0)</script>',
+    "module_timeout": '<script type="module" id="s">setTimeout(function() { throw new Error("module timeout") }, 0)</script>',
+    "classic_rethrown_by_module": (
+        '<script type="module">window.wrapM = function(fn) { return function() {'
+        " try { return fn.apply(this, arguments); } catch (e) { throw e; } }; };</script>"
+        '<script id="s">setTimeout(function() { window.wrapM(function() {'
+        ' throw new Error("rethrown via module"); })(); }, 100)</script>'
+    ),
+    "classic_rethrown_by_classic": (
+        '<script id="s">setTimeout(function() { try { throw new Error("orig") }'
+        ' catch (e) { throw new Error("rethrown classic") } }, 0)</script>'
+    ),
+    "classic_listener_dispatch": (
+        '<script id="s">document.addEventListener("probe", function() {'
+        ' throw new Error("listener"); }); document.dispatchEvent(new Event("probe"));</script>'
+    ),
+    "classic_syntax": '<script id="s">var x = (;</script>',
+}
+
+_PROBE_LISTENER = """<script id="listener">
+window.addEventListener("error", function(e) {
+  var cs = document.currentScript;
+  parent.postMessage({
+    probe: __NAME__,
+    message: String(e.message),
+    filename: e.filename || "",
+    lineno: e.lineno || 0,
+    colno: e.colno || 0,
+    hasError: !!e.error,
+    errorMessage: e.error ? String(e.error.message) : null,
+    stack: e.error && e.error.stack ? String(e.error.stack).slice(0, 160) : null,
+    currentScript: cs ? (cs.id || "(no id)") : null
+  }, "*");
+}, true);
+</script>"""
+
+
+def test_zz_probe_error_sanitization(tmp_path):
+    import warnings
+
+    from datasette_apps.csp import build_csp
+    from datasette_apps.rendering import _csp_meta
+
+    server = DatasetteServer(tmp_path)
+    docs = {
+        name: "<!doctype html>"
+        + _csp_meta(build_csp([]))
+        + _PROBE_LISTENER.replace("__NAME__", json.dumps(name))
+        + html
+        for name, html in _PROBES.items()
+    }
+    with server, _browser_page() as page:
+        page.goto(server.url + "/")
+        results = page.evaluate(
+            """async (docs) => {
+              const results = {};
+              window.addEventListener("message", (e) => {
+                if (e.data && e.data.probe) {
+                  (results[e.data.probe] = results[e.data.probe] || []).push(e.data);
+                }
+              });
+              for (const [name, doc] of Object.entries(docs)) {
+                const iframe = document.createElement("iframe");
+                iframe.setAttribute("sandbox", "allow-scripts allow-forms");
+                iframe.srcdoc = doc;
+                document.body.appendChild(iframe);
+              }
+              await new Promise((r) => setTimeout(r, 2000));
+              return results;
+            }""",
+            docs,
+        )
+    browser = os.environ.get("DATASETTE_APPS_PLAYWRIGHT_BROWSER", "chromium")
+    warnings.warn(
+        "PROBE-RESULTS " + browser + " " + json.dumps(results, sort_keys=True)
+    )

From 3f6e42524721dd836ae89c61b4c57e36bf687927 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:05:52 +0000
Subject: [PATCH 4/7] TEMPORARY: probe round 2 - blob/data script conversion
 and callback wrapping

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 tests/test_playwright.py | 119 ++++++++++++++++++++++++---------------
 1 file changed, 73 insertions(+), 46 deletions(-)

diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 9aaf826..a5a42fb 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1174,65 +1174,94 @@ def test_debug_harness_reports_debug_script_syntax_error_immediately(
         assert envelope["events"]["errors"] == []
 
 
-# TEMPORARY PROBE - records what each engine reports to a sandboxed
-# srcdoc frame's error listener for several ways of raising an error.
-# Emitted as a warning so CI logs carry the data; removed after.
-_PROBES = {
-    "classic_toplevel": '<script id="s">throw new Error("classic top-level")</script>',
-    "classic_sourceurl_data": '<script id="s">throw new Error("sourceURL data")\n//# sourceURL=data:text/javascript,probe</script>',
-    "classic_sourceurl_relative": '<script id="s">throw new Error("sourceURL relative")\n//# sourceURL=probe-script.js</script>',
-    "module_toplevel": '<script type="module" id="s">throw new Error("module top-level")</script>',
-    "classic_timeout": '<script id="s">setTimeout(function() { throw new Error("classic timeout") }, 0)</script>',
-    "module_timeout": '<script type="module" id="s">setTimeout(function() { throw new Error("module timeout") }, 0)</script>',
-    "classic_rethrown_by_module": (
-        '<script type="module">window.wrapM = function(fn) { return function() {'
-        " try { return fn.apply(this, arguments); } catch (e) { throw e; } }; };</script>"
-        '<script id="s">setTimeout(function() { window.wrapM(function() {'
-        ' throw new Error("rethrown via module"); })(); }, 100)</script>'
-    ),
-    "classic_rethrown_by_classic": (
-        '<script id="s">setTimeout(function() { try { throw new Error("orig") }'
-        ' catch (e) { throw new Error("rethrown classic") } }, 0)</script>'
-    ),
-    "classic_listener_dispatch": (
-        '<script id="s">document.addEventListener("probe", function() {'
-        ' throw new Error("listener"); }); document.dispatchEvent(new Event("probe"));</script>'
-    ),
-    "classic_syntax": '<script id="s">var x = (;</script>',
-}
+# TEMPORARY PROBE (round 2) - can a MutationObserver convert inline
+# classic scripts to same-text blob:/data: scripts before they run, and
+# does WebKit then report their errors in full? Also checks a
+# Sentry-style callback wrapper. Emitted as a warning; removed after.
+_PROBE2_CONVERTER = """<script id="converter">
+new MutationObserver(function(records) {
+  records.forEach(function(r) { r.addedNodes.forEach(function(node) {
+    if (node.tagName !== "SCRIPT" || node.src || !node.hasAttribute("data-convert")) return;
+    node.dataset.seen = "1";
+    var text = node.textContent;
+    if (__MODE__ === "none") return;
+    if (__CROSSORIGIN__) node.crossOrigin = "anonymous";
+    node.src = __MODE__ === "blob"
+      ? URL.createObjectURL(new Blob([text], {type: "text/javascript"}))
+      : "data:text/javascript;charset=utf-8," + encodeURIComponent(text);
+  }); });
+}).observe(document, {childList: true, subtree: true});
+</script>"""
+
+_PROBE2_BODY = """<script id="a" data-convert>let shared = 42; var viaVar = 1;
+parent.postMessage({probe: __NAME__, step: "a-ran",
+  seen: (document.currentScript && document.currentScript.dataset.seen) || null,
+  src: document.currentScript ? document.currentScript.src.slice(0, 12) : null}, "*");</script>
+<script id="b">parent.postMessage({probe: __NAME__, step: "b-ran",
+  sharedType: typeof shared, viaVar: typeof viaVar}, "*");</script>
+<script id="c" data-convert>
+throw new Error("converted top-level");</script>
+<script id="d">parent.postMessage({probe: __NAME__, step: "d-ran"}, "*");</script>"""
+
+_PROBE2_WRAPPER = """<script id="wrap">
+window.__recorded = null;
+var nativeSetTimeout = window.setTimeout;
+window.setTimeout = function(fn, ms) {
+  var wrapped = function() {
+    try { return fn.apply(this, arguments); }
+    catch (e) { window.__recorded = String(e && e.message); throw e; }
+  };
+  return nativeSetTimeout(wrapped, ms);
+};
+</script>
+<script id="s">setTimeout(function() { null.boom; }, 0)</script>"""
 
-_PROBE_LISTENER = """<script id="listener">
+_PROBE2_LISTENER = """<script id="listener">
 window.addEventListener("error", function(e) {
   var cs = document.currentScript;
   parent.postMessage({
-    probe: __NAME__,
-    message: String(e.message),
-    filename: e.filename || "",
-    lineno: e.lineno || 0,
-    colno: e.colno || 0,
-    hasError: !!e.error,
-    errorMessage: e.error ? String(e.error.message) : null,
-    stack: e.error && e.error.stack ? String(e.error.stack).slice(0, 160) : null,
+    probe: __NAME__, step: "error",
+    message: String(e.message), filename: String(e.filename || "").slice(0, 40),
+    lineno: e.lineno || 0, colno: e.colno || 0, hasError: !!e.error,
+    recorded: window.__recorded || null,
     currentScript: cs ? (cs.id || "(no id)") : null
   }, "*");
 }, true);
 </script>"""
 
 
+def _probe2_doc(name, script_src_extra, body):
+    csp = (
+        "default-src 'none'; script-src 'unsafe-inline'"
+        + script_src_extra
+        + "; style-src 'unsafe-inline'; img-src data: blob:;"
+    )
+    return (
+        "<!doctype html>"
+        + '<meta http-equiv="Content-Security-Policy" content="' + csp + '">'
+        + _PROBE2_LISTENER.replace("__NAME__", json.dumps(name))
+        + body.replace("__NAME__", json.dumps(name))
+    )
+
+
 def test_zz_probe_error_sanitization(tmp_path):
     import warnings
 
-    from datasette_apps.csp import build_csp
-    from datasette_apps.rendering import _csp_meta
+    def converter(mode, crossorigin=False):
+        return _PROBE2_CONVERTER.replace("__MODE__", json.dumps(mode)).replace(
+            "__CROSSORIGIN__", json.dumps(crossorigin)
+        )
 
-    server = DatasetteServer(tmp_path)
     docs = {
-        name: "<!doctype html>"
-        + _csp_meta(build_csp([]))
-        + _PROBE_LISTENER.replace("__NAME__", json.dumps(name))
-        + html
-        for name, html in _PROBES.items()
+        "observer_only": _probe2_doc("observer_only", "", converter("none") + _PROBE2_BODY),
+        "blob": _probe2_doc("blob", " blob:", converter("blob") + _PROBE2_BODY),
+        "blob_crossorigin": _probe2_doc(
+            "blob_crossorigin", " blob:", converter("blob", True) + _PROBE2_BODY
+        ),
+        "data": _probe2_doc("data", " data:", converter("data") + _PROBE2_BODY),
+        "wrapper": _probe2_doc("wrapper", "", _PROBE2_WRAPPER),
     }
+    server = DatasetteServer(tmp_path)
     with server, _browser_page() as page:
         page.goto(server.url + "/")
         results = page.evaluate(
@@ -1255,6 +1284,4 @@ def test_zz_probe_error_sanitization(tmp_path):
             docs,
         )
     browser = os.environ.get("DATASETTE_APPS_PLAYWRIGHT_BROWSER", "chromium")
-    warnings.warn(
-        "PROBE-RESULTS " + browser + " " + json.dumps(results, sort_keys=True)
-    )
+    warnings.warn("PROBE-RESULTS " + browser + " " + json.dumps(results, sort_keys=True))

From b4b30fbe1e52ca726fa99bfd9764eaaca843a6ef Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:20:33 +0000
Subject: [PATCH 5/7] Remove temporary error sanitization probes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 tests/test_playwright.py | 113 ---------------------------------------
 1 file changed, 113 deletions(-)

diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index a5a42fb..7bac3ff 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1172,116 +1172,3 @@ def test_debug_harness_reports_debug_script_syntax_error_immediately(
             assert "Failed to execute" not in error["message"]
             assert error["line"] == 1
         assert envelope["events"]["errors"] == []
-
-
-# TEMPORARY PROBE (round 2) - can a MutationObserver convert inline
-# classic scripts to same-text blob:/data: scripts before they run, and
-# does WebKit then report their errors in full? Also checks a
-# Sentry-style callback wrapper. Emitted as a warning; removed after.
-_PROBE2_CONVERTER = """<script id="converter">
-new MutationObserver(function(records) {
-  records.forEach(function(r) { r.addedNodes.forEach(function(node) {
-    if (node.tagName !== "SCRIPT" || node.src || !node.hasAttribute("data-convert")) return;
-    node.dataset.seen = "1";
-    var text = node.textContent;
-    if (__MODE__ === "none") return;
-    if (__CROSSORIGIN__) node.crossOrigin = "anonymous";
-    node.src = __MODE__ === "blob"
-      ? URL.createObjectURL(new Blob([text], {type: "text/javascript"}))
-      : "data:text/javascript;charset=utf-8," + encodeURIComponent(text);
-  }); });
-}).observe(document, {childList: true, subtree: true});
-</script>"""
-
-_PROBE2_BODY = """<script id="a" data-convert>let shared = 42; var viaVar = 1;
-parent.postMessage({probe: __NAME__, step: "a-ran",
-  seen: (document.currentScript && document.currentScript.dataset.seen) || null,
-  src: document.currentScript ? document.currentScript.src.slice(0, 12) : null}, "*");</script>
-<script id="b">parent.postMessage({probe: __NAME__, step: "b-ran",
-  sharedType: typeof shared, viaVar: typeof viaVar}, "*");</script>
-<script id="c" data-convert>
-throw new Error("converted top-level");</script>
-<script id="d">parent.postMessage({probe: __NAME__, step: "d-ran"}, "*");</script>"""
-
-_PROBE2_WRAPPER = """<script id="wrap">
-window.__recorded = null;
-var nativeSetTimeout = window.setTimeout;
-window.setTimeout = function(fn, ms) {
-  var wrapped = function() {
-    try { return fn.apply(this, arguments); }
-    catch (e) { window.__recorded = String(e && e.message); throw e; }
-  };
-  return nativeSetTimeout(wrapped, ms);
-};
-</script>
-<script id="s">setTimeout(function() { null.boom; }, 0)</script>"""
-
-_PROBE2_LISTENER = """<script id="listener">
-window.addEventListener("error", function(e) {
-  var cs = document.currentScript;
-  parent.postMessage({
-    probe: __NAME__, step: "error",
-    message: String(e.message), filename: String(e.filename || "").slice(0, 40),
-    lineno: e.lineno || 0, colno: e.colno || 0, hasError: !!e.error,
-    recorded: window.__recorded || null,
-    currentScript: cs ? (cs.id || "(no id)") : null
-  }, "*");
-}, true);
-</script>"""
-
-
-def _probe2_doc(name, script_src_extra, body):
-    csp = (
-        "default-src 'none'; script-src 'unsafe-inline'"
-        + script_src_extra
-        + "; style-src 'unsafe-inline'; img-src data: blob:;"
-    )
-    return (
-        "<!doctype html>"
-        + '<meta http-equiv="Content-Security-Policy" content="' + csp + '">'
-        + _PROBE2_LISTENER.replace("__NAME__", json.dumps(name))
-        + body.replace("__NAME__", json.dumps(name))
-    )
-
-
-def test_zz_probe_error_sanitization(tmp_path):
-    import warnings
-
-    def converter(mode, crossorigin=False):
-        return _PROBE2_CONVERTER.replace("__MODE__", json.dumps(mode)).replace(
-            "__CROSSORIGIN__", json.dumps(crossorigin)
-        )
-
-    docs = {
-        "observer_only": _probe2_doc("observer_only", "", converter("none") + _PROBE2_BODY),
-        "blob": _probe2_doc("blob", " blob:", converter("blob") + _PROBE2_BODY),
-        "blob_crossorigin": _probe2_doc(
-            "blob_crossorigin", " blob:", converter("blob", True) + _PROBE2_BODY
-        ),
-        "data": _probe2_doc("data", " data:", converter("data") + _PROBE2_BODY),
-        "wrapper": _probe2_doc("wrapper", "", _PROBE2_WRAPPER),
-    }
-    server = DatasetteServer(tmp_path)
-    with server, _browser_page() as page:
-        page.goto(server.url + "/")
-        results = page.evaluate(
-            """async (docs) => {
-              const results = {};
-              window.addEventListener("message", (e) => {
-                if (e.data && e.data.probe) {
-                  (results[e.data.probe] = results[e.data.probe] || []).push(e.data);
-                }
-              });
-              for (const [name, doc] of Object.entries(docs)) {
-                const iframe = document.createElement("iframe");
-                iframe.setAttribute("sandbox", "allow-scripts allow-forms");
-                iframe.srcdoc = doc;
-                document.body.appendChild(iframe);
-              }
-              await new Promise((r) => setTimeout(r, 2000));
-              return results;
-            }""",
-            docs,
-        )
-    browser = os.environ.get("DATASETTE_APPS_PLAYWRIGHT_BROWSER", "chromium")
-    warnings.warn("PROBE-RESULTS " + browser + " " + json.dumps(results, sort_keys=True))

From d8b27da42de511c1e32cf4ee016461c9a78e3003 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:20:34 +0000
Subject: [PATCH 6/7] Recover uncaught error details in debug frames on WebKit

WebKit reports every uncaught error from a classic script in a
sandboxed (opaque origin) frame as a bare "Script error.", so app_debug
runs in Safari told the agent nothing about the app's own errors.
Probing WebKit in CI showed module scripts and same-origin external
scripts keep their error details, and that a MutationObserver sees each
parser-inserted script before it runs.

On engines where a probe error comes back sanitized, the debug bridge
now:

- swaps each inline classic <script>, just before it runs, for a
  same-text blob: script - still a classic script run in document order,
  so globals, document.write and document.currentScript are unchanged.
  Its errors are reported against "app-script-N" (the app's Nth
  <script> element) with the failing line as sourceLine
- wraps callbacks the app registers (timers, animation frames,
  microtasks, listeners, on* handler properties, inline on* attributes,
  observers) to capture what they throw before it is sanitized
- names the script whose top-level code threw when neither applies

The debug frame CSP additionally allows blob: scripts (granting nothing
'unsafe-inline' does not) and sets worker-src 'none' to keep workers
blocked. The production app view policy is unchanged. Chromium and
Firefox report full details already, so none of this activates there.

Debug scripts now run after DOMContentLoaded, so they always see the
page after its own parser-inserted scripts have run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 datasette_apps/agent_tools.py |   8 +-
 datasette_apps/csp.py         |  19 +-
 datasette_apps/rendering.py   | 386 +++++++++++++++++++++++++++++++++-
 datasette_apps/views.py       |   2 +-
 tests/test_csp.py             |  17 ++
 tests/test_debug_jobs.py      |   8 +
 tests/test_playwright.py      |  94 ++++++++-
 7 files changed, 518 insertions(+), 16 deletions(-)

diff --git a/datasette_apps/agent_tools.py b/datasette_apps/agent_tools.py
index 338e141..98bb10a 100644
--- a/datasette_apps/agent_tools.py
+++ b/datasette_apps/agent_tools.py
@@ -74,7 +74,8 @@
         "loads invisibly in the user's open browser tab, so this requires an "
         "interactive conversation and edit permission for that app. The "
         "javascript argument is the body of an async function executed in "
-        "the app's global scope; its awaited return value is the result and "
+        "the app's global scope once the page has parsed and its own scripts "
+        "have run; its awaited return value is the result and "
         "must be JSON-serializable - return .textContent or measurements, "
         "not DOM elements. Apps render asynchronously, so wait for readiness "
         "with await debug.waitFor(fn, {timeout, interval}), which polls fn "
@@ -85,7 +86,10 @@
         "await debug.waitFor(() => window.innerWidth). Captured "
         "events include JavaScript errors, unhandled rejections, CSP "
         "violations, failed fetches, console output and datasette.query() "
-        "calls, from page load through script completion. Caveat: synthetic "
+        "calls, from page load through script completion. Some browsers "
+        "report errors against app-script-N - the app's Nth <script> "
+        "element - with line numbers within that script and the failing "
+        "line as sourceLine. Caveat: synthetic "
         "events dispatched by the debug script have isTrusted: false, so a "
         "few native browser behaviors (external-link interception, popup "
         "allowances) will not trigger."
diff --git a/datasette_apps/csp.py b/datasette_apps/csp.py
index 87fa777..46105c6 100644
--- a/datasette_apps/csp.py
+++ b/datasette_apps/csp.py
@@ -101,14 +101,29 @@ async def resolve_csp_origins(datasette, actor, requested_origins, existing_orig
     return normalized
 
 
-def build_csp(connect_origins):
+def build_csp(connect_origins, debug=False):
+    """debug=True builds the debug frame's policy, which also allows
+    blob: scripts: on engines that withhold error details for inline
+    scripts in sandboxed frames (WebKit) the debug bridge re-runs each
+    inline script as a same-text blob: script, whose errors keep their
+    details. That grants nothing 'unsafe-inline' does not - page code can
+    already run any script text it builds - and worker-src 'none' keeps
+    workers blocked, as they are in production."""
     origins = [normalize_connect_origin(origin) for origin in connect_origins]
     directives = [*BASE_DIRECTIVES]
+    if debug:
+        directives = [
+            f"{directive} blob:" if directive.startswith("script-src ") else directive
+            for directive in directives
+        ]
     if origins:
         element_sources = ["'unsafe-inline'", *origins]
-        directives.append(f"script-src-elem {' '.join(element_sources)}")
+        script_element_sources = [*element_sources, *(["blob:"] if debug else [])]
+        directives.append(f"script-src-elem {' '.join(script_element_sources)}")
         directives.append(f"style-src-elem {' '.join(element_sources)}")
     directives.append(f"img-src {' '.join(['data:', 'blob:', *origins])}")
     if origins:
         directives.append(f"connect-src {' '.join(origins)}")
+    if debug:
+        directives.append("worker-src 'none'")
     return "; ".join(directives) + ";"
diff --git a/datasette_apps/rendering.py b/datasette_apps/rendering.py
index b00c559..8e26424 100644
--- a/datasette_apps/rendering.py
+++ b/datasette_apps/rendering.py
@@ -15,7 +15,9 @@ def _csp_meta(csp):
 # Only injected into debug frames: ordinary app views have no eval
 # surface. Execution inserts an inline <script> element, which the
 # production script-src 'unsafe-inline' policy already permits - no
-# 'unsafe-eval', no debug-only CSP variant.
+# 'unsafe-eval'. The debug frame's policy differs from production only
+# by also allowing blob: scripts, used to recover error details on
+# engines that withhold them (see build_csp).
 _DEBUG_BRIDGE_EXTENSIONS = """
   window.debug = {
     waitFor: function(fn, options) {
@@ -164,6 +166,7 @@ def _csp_meta(csp):
     // wrapper cannot throw, so an error event raised meanwhile means the
     // script failed to compile: it becomes the run's result, not an app
     // error - otherwise the run would wait out its whole timeout.
+    var previousErrorHandler = debugErrorHandler;
     debugErrorHandler = function(details) {
       compileError = details;
       return true;
@@ -171,7 +174,7 @@ def _csp_meta(csp):
     try {
       (document.body || document.documentElement).appendChild(script);
     } finally {
-      debugErrorHandler = null;
+      debugErrorHandler = previousErrorHandler;
     }
     if (script.parentNode) {
       script.parentNode.removeChild(script);
@@ -188,9 +191,382 @@ def _csp_meta(csp):
     if (message.type !== "datasette-app-debug-eval") {
       return false;
     }
-    runDebugScript(message.id, String(message.code || ""));
+    var run = function() {
+      runDebugScript(message.id, String(message.code || ""));
+    };
+    if (document.readyState === "loading") {
+      // Run after the page's own parser-inserted scripts: the eval
+      // message can otherwise arrive between them, for instance while
+      // the parser waits on a script converted to blob: (below)
+      nativeAddEventListener.call(document, "DOMContentLoaded", run, {once: true});
+    } else {
+      run();
+    }
     return true;
   };
+
+  // ---- Error details on engines that withhold them ----
+  //
+  // WebKit reports every uncaught error from a classic script in a
+  // sandboxed (opaque origin) frame as a bare "Script error.". On
+  // engines that do, debug frames recover the details:
+  // - each inline <script> is swapped, just before it runs, for a
+  //   same-text blob: script, whose errors keep their details. Still a
+  //   classic script executed in document order, so globals,
+  //   document.write and document.currentScript are unchanged
+  // - callbacks the app registers (timers, listeners, handler
+  //   properties, observers) are wrapped, so whatever they throw is
+  //   captured on its way out, before the browser sanitizes it
+  // Errors from converted scripts are reported against "app-script-N"
+  // (the Nth <script> element in the app) with line numbers within
+  // that script, plus the text of the failing line.
+  var nativeQueueMicrotask = typeof window.queueMicrotask === "function"
+    ? window.queueMicrotask.bind(window)
+    : function(fn) { Promise.resolve().then(fn); };
+  var nativeAddEventListener = EventTarget.prototype.addEventListener;
+  var nativeRemoveEventListener = EventTarget.prototype.removeEventListener;
+  var NativeMutationObserver = window.MutationObserver;
+  var CLASSIC_SCRIPT_TYPES = [
+    "", "text/javascript", "application/javascript", "text/ecmascript",
+    "application/ecmascript", "application/x-javascript", "text/x-javascript"
+  ];
+  // Attributes an external script honors that an inline one ignores
+  var INLINE_ONLY_BLOCKERS = [
+    "src", "async", "defer", "nomodule", "integrity", "onload", "onerror",
+    "language"
+  ];
+  // Event types whose inline on* attribute handlers get wrapped just
+  // before dispatch reaches them
+  var INLINE_HANDLER_EVENTS = [
+    "click", "dblclick", "contextmenu", "auxclick", "mousedown", "mouseup",
+    "mouseover", "mouseout", "pointerdown", "pointerup", "touchstart",
+    "touchend", "keydown", "keyup", "keypress", "input", "change", "submit",
+    "reset", "focus", "blur", "focusin", "focusout", "select", "toggle",
+    "load", "resize", "hashchange"
+  ];
+  var convertedScripts = {};  // blob URL -> {label, text}
+  var pendingConversions = [];
+  var seenScripts = new WeakSet();
+  var callbackWrappers = new WeakMap();  // callback -> wrapper
+  var wrappedCallbacks = new WeakMap();  // wrapper -> callback
+  var thrownByCallback = null;
+
+  function errorsAreSanitized() {
+    var sanitized = false;
+    var probe = document.createElement("script");
+    probe.textContent = "throw new Error('datasette-apps error details probe')";
+    debugErrorHandler = function(details) {
+      sanitized = !!details.sanitized;
+      return true;
+    };
+    try {
+      (document.head || document.documentElement).appendChild(probe);
+    } finally {
+      debugErrorHandler = null;
+    }
+    if (probe.parentNode) {
+      probe.parentNode.removeChild(probe);
+    }
+    return sanitized;
+  }
+
+  function scriptLabel(script) {
+    var scripts = document.getElementsByTagName("script");
+    var index = 0;
+    for (var i = 0; i < scripts.length; i += 1) {
+      if (scripts[i].id === "datasette-apps-bridge") {
+        continue;
+      }
+      index += 1;
+      if (scripts[i] === script) {
+        return "app-script-" + index;
+      }
+    }
+    return "app-script";
+  }
+
+  function canConvert(script) {
+    if (!script.isConnected || document.readyState !== "loading") {
+      return false;
+    }
+    var type = (script.getAttribute("type") || "").trim().toLowerCase();
+    if (CLASSIC_SCRIPT_TYPES.indexOf(type) === -1) {
+      return false;
+    }
+    return !INLINE_ONLY_BLOCKERS.some(function(name) {
+      return script.hasAttribute(name);
+    });
+  }
+
+  function pointScriptAtBlob(entry) {
+    entry.url = URL.createObjectURL(
+      new Blob([entry.text], {type: "text/javascript"})
+    );
+    convertedScripts[entry.url] = entry;
+    entry.script.src = entry.url;
+  }
+
+  function convertScript(script) {
+    var entry = {
+      script: script,
+      text: script.textContent,
+      label: scriptLabel(script),
+      url: null
+    };
+    pointScriptAtBlob(entry);
+    pendingConversions.push(entry);
+    function settle(event) {
+      nativeRemoveEventListener.call(script, "load", settle);
+      nativeRemoveEventListener.call(script, "error", settle);
+      pendingConversions.splice(pendingConversions.indexOf(entry), 1);
+      URL.revokeObjectURL(entry.url);
+      if (event.type === "error" && script.parentNode) {
+        // The blob: script could not load - say the app's own CSP
+        // forbids blob: scripts. Parser-blocking scripts fire this
+        // before parsing resumes, so running the original inline here
+        // keeps it in order.
+        var fallback = document.createElement("script");
+        seenScripts.add(fallback);
+        fallback.textContent = entry.text;
+        script.parentNode.insertBefore(fallback, script.nextSibling);
+      }
+    }
+    nativeAddEventListener.call(script, "load", settle);
+    nativeAddEventListener.call(script, "error", settle);
+  }
+
+  function convertParserScripts(records, observer) {
+    records.forEach(function(record) {
+      Array.prototype.forEach.call(record.addedNodes, function(node) {
+        if (node.nodeType !== 1 || node.tagName !== "SCRIPT" || seenScripts.has(node)) {
+          return;
+        }
+        seenScripts.add(node);
+        if (node.id !== "datasette-apps-bridge" && canConvert(node)) {
+          convertScript(node);
+        }
+      });
+    });
+    // A parser that yielded mid-script may have added more text since
+    // a script was converted; a script's src only takes effect when it
+    // is prepared, so re-pointing it before then is safe
+    pendingConversions.forEach(function(entry) {
+      if (entry.script.textContent !== entry.text) {
+        URL.revokeObjectURL(entry.url);
+        entry.text = entry.script.textContent;
+        pointScriptAtBlob(entry);
+      }
+    });
+    if (document.readyState !== "loading") {
+      observer.disconnect();
+    }
+  }
+
+  function rememberThrown(error) {
+    thrownByCallback = {error: error};
+    // The error event for an uncaught callback exception is dispatched
+    // before any microtask runs; anything still here afterwards was
+    // caught elsewhere
+    nativeQueueMicrotask(function() {
+      thrownByCallback = null;
+    });
+  }
+
+  function wrapCallback(callback) {
+    if (!callback || (typeof callback !== "function" && typeof callback !== "object")) {
+      return callback;
+    }
+    var wrapper = callbackWrappers.get(callback);
+    if (wrapper) {
+      return wrapper;
+    }
+    wrapper = function debugBridgeErrorCapture() {
+      try {
+        if (typeof callback === "function") {
+          return callback.apply(this, arguments);
+        }
+        return callback.handleEvent.apply(callback, arguments);
+      } catch (error) {
+        rememberThrown(error);
+        throw error;
+      }
+    };
+    callbackWrappers.set(callback, wrapper);
+    wrappedCallbacks.set(wrapper, callback);
+    return wrapper;
+  }
+
+  function wrapHandlerProperties(target) {
+    if (!target) {
+      return;
+    }
+    Object.getOwnPropertyNames(target).forEach(function(name) {
+      if (name.slice(0, 2) !== "on") {
+        return;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(target, name);
+      if (!descriptor || !descriptor.get || !descriptor.set || !descriptor.configurable) {
+        return;
+      }
+      Object.defineProperty(target, name, {
+        configurable: true,
+        enumerable: descriptor.enumerable,
+        get: function() {
+          var value = descriptor.get.call(this);
+          return (value && wrappedCallbacks.get(value)) || value;
+        },
+        set: function(value) {
+          descriptor.set.call(
+            this, typeof value === "function" ? wrapCallback(value) : value
+          );
+        }
+      });
+    });
+  }
+
+  function rewrapHandler(target, name) {
+    try {
+      var handler = target[name];
+      if (typeof handler === "function") {
+        target[name] = handler;
+      }
+    } catch (ignore) {
+    }
+  }
+
+  function wrapAppCallbacks() {
+    [
+      "setTimeout", "setInterval", "requestAnimationFrame", "queueMicrotask",
+      "requestIdleCallback"
+    ].forEach(function(name) {
+      var original = window[name];
+      if (typeof original !== "function") {
+        return;
+      }
+      window[name] = function(callback) {
+        var args = Array.prototype.slice.call(arguments);
+        if (typeof callback === "function") {
+          args[0] = wrapCallback(callback);
+        }
+        return original.apply(window, args);
+      };
+    });
+    EventTarget.prototype.addEventListener = function(type, listener, options) {
+      return nativeAddEventListener.call(this, type, wrapCallback(listener), options);
+    };
+    EventTarget.prototype.removeEventListener = function(type, listener, options) {
+      var wrapper = listener ? callbackWrappers.get(listener) : null;
+      return nativeRemoveEventListener.call(this, type, wrapper || listener, options);
+    };
+    [
+      window, window.Window, window.Document, window.Element,
+      window.HTMLElement, window.SVGElement, window.XMLHttpRequestEventTarget,
+      window.XMLHttpRequest, window.FileReader, window.MediaQueryList
+    ].forEach(function(target) {
+      wrapHandlerProperties(target === window ? window : target && target.prototype);
+    });
+    [
+      "MutationObserver", "ResizeObserver", "IntersectionObserver",
+      "PerformanceObserver"
+    ].forEach(function(name) {
+      var Original = window[name];
+      if (typeof Original !== "function" || typeof Proxy !== "function") {
+        return;
+      }
+      window[name] = new Proxy(Original, {
+        construct: function(target, args, newTarget) {
+          args = Array.prototype.slice.call(args);
+          if (typeof args[0] === "function") {
+            args[0] = wrapCallback(args[0]);
+          }
+          return Reflect.construct(target, args, newTarget);
+        }
+      });
+    });
+    // Inline on* attributes compile to handlers the browser installs
+    // itself; wrap those on the event's path just before dispatch
+    // reaches them
+    INLINE_HANDLER_EVENTS.forEach(function(type) {
+      nativeAddEventListener.call(window, type, function(event) {
+        var name = "on" + type;
+        rewrapHandler(window, name);
+        rewrapHandler(document, name);
+        var path = typeof event.composedPath === "function" ? event.composedPath() : [];
+        for (var i = 0; i < path.length; i += 1) {
+          if (path[i] && path[i].nodeType === 1 && path[i].hasAttribute(name)) {
+            rewrapHandler(path[i], name);
+          }
+        }
+      }, true);
+    });
+  }
+
+  function stackLocation(stack) {
+    var match = /((?:blob:|about:|https?:)[^\\s()@]*?):(\\d+):(\\d+)(?=\\)|\\s|$)/.exec(
+      String(stack || "")
+    );
+    return match
+      ? {url: match[1], line: Number(match[2]), column: Number(match[3])}
+      : null;
+  }
+
+  function recoverErrorDetails(details) {
+    var thrown = thrownByCallback;
+    thrownByCallback = null;
+    if (!details.sanitized) {
+      return false;
+    }
+    if (thrown) {
+      var recovered = normalizeError(thrown.error);
+      var location = stackLocation(recovered.stack);
+      Object.keys(details).forEach(function(key) {
+        delete details[key];
+      });
+      Object.keys(recovered).forEach(function(key) {
+        details[key] = recovered[key];
+      });
+      details.filename = location ? location.url : "";
+      details.lineno = location ? location.line : 0;
+      details.colno = location ? location.column : 0;
+      return false;
+    }
+    // Still sanitized: an inline script that could not be converted.
+    // Name the script whose top-level code threw.
+    var script = document.currentScript;
+    if (script && script.id !== "datasette-apps-bridge") {
+      details.script = scriptLabel(script);
+      details.message += " - thrown by the top-level code of " + details.script;
+    }
+    return false;
+  }
+
+  function describeConvertedScripts(details) {
+    var entry = details.filename && convertedScripts[details.filename];
+    if (entry) {
+      details.filename = entry.label;
+      var line = entry.text.split("\\n")[details.lineno - 1];
+      if (line !== undefined) {
+        details.sourceLine = line.trim().slice(0, 300);
+      }
+    }
+    if (details.stack) {
+      Object.keys(convertedScripts).forEach(function(url) {
+        details.stack = details.stack.split(url).join(convertedScripts[url].label);
+      });
+    }
+    return details;
+  }
+
+  if (errorsAreSanitized()) {
+    new NativeMutationObserver(convertParserScripts).observe(document, {
+      childList: true,
+      subtree: true,
+      characterData: true
+    });
+    wrapAppCallbacks();
+    debugErrorHandler = recoverErrorDetails;
+    debugErrorFilter = describeConvertedScripts;
+  }
 """
 
 
@@ -207,6 +583,7 @@ def iframe_bridge_script(channel_token=None, debug=False):
   var viewportReporterStarted = false;
   var debugMessageHandler = null;
   var debugErrorHandler = null;
+  var debugErrorFilter = null;
 
   function noopHistoryMethod() {
   }
@@ -315,6 +692,9 @@ def iframe_bridge_script(channel_token=None, debug=False):
 
   function postAppError(kind, details) {
     details = details || {};
+    if (debugErrorFilter) {
+      details = debugErrorFilter(details);
+    }
     details.kind = kind;
     details.timestamp = new Date().toISOString();
     postToParent({
diff --git a/datasette_apps/views.py b/datasette_apps/views.py
index cf6b6a9..c261051 100644
--- a/datasette_apps/views.py
+++ b/datasette_apps/views.py
@@ -733,7 +733,7 @@ async def debug_frame(datasette, request):
     version = await registry.get_version(job["app_id"], job["version"])
     if version is None:
         raise NotFound("App revision not found")
-    csp = build_csp(await registry.get_csp_origins(job["app_id"]))
+    csp = build_csp(await registry.get_csp_origins(job["app_id"]), debug=True)
     document = build_app_srcdoc(
         version["html"],
         csp,
diff --git a/tests/test_csp.py b/tests/test_csp.py
index 0a66a2d..337699b 100644
--- a/tests/test_csp.py
+++ b/tests/test_csp.py
@@ -39,6 +39,23 @@ def test_build_csp_includes_exact_connect_origins():
     )
 
 
+def test_build_debug_csp_adds_blob_scripts_and_blocks_workers():
+    # The debug bridge re-runs inline scripts as blob: scripts on
+    # engines that withhold their error details; workers stay blocked
+    assert build_csp([], debug=True) == (
+        "default-src 'none'; script-src 'unsafe-inline' blob:; "
+        "style-src 'unsafe-inline'; img-src data: blob:; worker-src 'none';"
+    )
+    assert build_csp(["https://api.github.com"], debug=True) == (
+        "default-src 'none'; script-src 'unsafe-inline' blob:; "
+        "style-src 'unsafe-inline'; "
+        "script-src-elem 'unsafe-inline' https://api.github.com blob:; "
+        "style-src-elem 'unsafe-inline' https://api.github.com; "
+        "img-src data: blob: https://api.github.com; "
+        "connect-src https://api.github.com; worker-src 'none';"
+    )
+
+
 def test_build_csp_can_allow_insecure_origins_in_tests(monkeypatch):
     monkeypatch.setenv("DATASETTE_APPS_ALLOW_INSECURE_TEST_CSP_ORIGINS", "1")
 
diff --git a/tests/test_debug_jobs.py b/tests/test_debug_jobs.py
index c9a815d..c139faa 100644
--- a/tests/test_debug_jobs.py
+++ b/tests/test_debug_jobs.py
@@ -1,11 +1,13 @@
 """Tests for debug job storage and the /-/apps/debug/* endpoints."""
 
+import html
 from datetime import datetime, timedelta, timezone
 
 import pytest
 from datasette.app import Datasette
 
 from datasette_apps import Registry
+from datasette_apps.csp import build_csp
 from datasette_apps.debug import (
     DEFAULT_TIMEOUT_MS,
     DEFAULT_VIEWPORT,
@@ -149,6 +151,9 @@ async def test_frame_serves_job_revision_with_debug_bridge():
     assert "datasette-app-debug-eval" in document
     assert "waitFor" in document
     assert job["config"]["channel_token"] in document
+    # Debug frames allow blob: scripts, for recovering error details on
+    # engines that withhold them for inline scripts
+    assert html.escape(build_csp([], debug=True), quote=True) in document
     # Newer Datasette releases add "private" to responses for signed-in
     # actors, so check for the directive rather than the exact header
     cache_control = [
@@ -363,3 +368,6 @@ async def test_stored_app_view_has_no_debug_eval_channel():
     response = await datasette.client.get(f"/-/apps/{app['id']}", actor={"id": "alice"})
     assert response.status_code == 200
     assert "datasette-app-debug-eval" not in response.text
+    # The debug-only CSP (blob: scripts, worker-src 'none') stays out
+    assert "worker-src" not in response.text
+    assert "Content-Security-Policy" in response.text
diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 7bac3ff..48a0280 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1118,19 +1118,14 @@ def test_debug_harness_reports_app_errors_and_unserializable_result(
         )
         assert "app warned" in messages
         # WebKit withholds uncaught-error details in sandboxed (opaque
-        # origin) frames - srcdoc and URL frames alike - reporting only
-        # "Script error."; the bridge annotates those so readers know why
-        # details are missing. Chromium and Firefox report in full.
+        # origin) frames, reporting only "Script error."; debug frames
+        # recover them, so every engine reports the thrown message.
         js_errors = [
             error
             for error in envelope["events"]["errors"]
             if error["kind"] == "javascript-error"
         ]
-        assert any(
-            "render exploded" in error.get("message", "")
-            or (error.get("sanitized") and "details withheld" in error["message"])
-            for error in js_errors
-        )
+        assert any("render exploded" in error.get("message", "") for error in js_errors)
 
 
 def test_debug_harness_reports_debug_script_syntax_error_immediately(
@@ -1172,3 +1167,86 @@ def test_debug_harness_reports_debug_script_syntax_error_immediately(
             assert "Failed to execute" not in error["message"]
             assert error["line"] == 1
         assert envelope["events"]["errors"] == []
+
+
+def test_debug_harness_recovers_error_details_from_every_error_source(
+    tmp_path, monkeypatch
+):
+    monkeypatch.setenv("DATASETTE_SECRET", DEBUG_ACTOR_SECRET)
+    server = DatasetteServer(tmp_path)
+    app = asyncio.run(
+        server.create_app(
+            """<!doctype html>
+<h1 id="title">Error sampler</h1>
+<button id="listener-button">Listener</button>
+<button id="attribute-button" onclick="attributeHandler()">Attribute</button>
+<script>
+const shared = {count: 0};
+function attributeHandler() {
+  shared.count += 1;
+  throw new Error("inline attribute handler failed");
+}
+document.getElementById("listener-button").addEventListener("click", function() {
+  shared.count += 1;
+  throw new Error("click listener failed");
+});
+setTimeout(function() {
+  throw new Error("timer callback failed");
+}, 0);
+</script>
+<script>
+shared.count += 1;
+document.getElementById("title").dataset.ready = "yes";
+throw new Error("top-level code failed");
+</script>""",
+            name="Error sampler",
+        )
+    )
+    job, payload, harness = asyncio.run(
+        _create_debug_job_with_task(
+            server,
+            app["id"],
+            """
+await debug.waitFor(() => document.getElementById("title").dataset.ready);
+document.getElementById("listener-button").click();
+document.getElementById("attribute-button").click();
+await new Promise((resolve) => setTimeout(resolve, 200));
+return {count: shared.count};
+""",
+        )
+    )
+
+    with server, _browser_page() as page:
+        _run_debug_task(server, page, "01TASK0000000000000000RCVR", payload, harness)
+        envelope = _wait_for_task_result(page)[0]["envelope"]
+
+    # The app ran exactly as it would without the debug bridge: its
+    # scripts share top-level bindings with each other and with the
+    # debug script
+    assert envelope["ok"] is True, envelope
+    assert envelope["result"] == {"count": 3}
+    js_errors = {
+        error["message"]: error
+        for error in envelope["events"]["errors"]
+        if error["kind"] == "javascript-error"
+    }
+    # WebKit sanitizes every one of these to "Script error." in a
+    # sandboxed frame; debug frames recover each message
+    for expected in (
+        "top-level code failed",
+        "click listener failed",
+        "inline attribute handler failed",
+        "timer callback failed",
+    ):
+        assert any(expected in message for message in js_errors), js_errors
+    assert not any("Script error" in message for message in js_errors), js_errors
+    top_level = next(
+        error
+        for message, error in js_errors.items()
+        if "top-level code failed" in message
+    )
+    if top_level["filename"].startswith("app-script-"):
+        # Engines that sanitize run inline scripts as blob: scripts,
+        # reported against the app's Nth <script> element
+        assert top_level["filename"] == "app-script-2"
+        assert top_level["sourceLine"] == 'throw new Error("top-level code failed");'

From 320c841b78178460662e9f2ab0a9bcd9b010b0f1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 24 Sep 2026 00:25:50 +0000
Subject: [PATCH 7/7] Keep caught callback errors until the error event on
 WebKit

WebKit drains microtasks between a callback invoked from the event loop
(a timer, a real user click) throwing and reporting the exception, so a
remembered error cleared by a microtask was gone before its sanitized
"Script error." event arrived. Remember caught errors on a stack cleared
by a later task instead - the report always lands within the same task,
and a callback throwing during that microtask drain is reported first.

The recovery test now reports every captured error in full on failure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VX4speFtsjrJCtLtVaFB85
---
 datasette_apps/rendering.py | 24 +++++++++++-------------
 tests/test_playwright.py    |  6 ++++--
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/datasette_apps/rendering.py b/datasette_apps/rendering.py
index 8e26424..33d0dfc 100644
--- a/datasette_apps/rendering.py
+++ b/datasette_apps/rendering.py
@@ -220,9 +220,7 @@ def _csp_meta(csp):
   // Errors from converted scripts are reported against "app-script-N"
   // (the Nth <script> element in the app) with line numbers within
   // that script, plus the text of the failing line.
-  var nativeQueueMicrotask = typeof window.queueMicrotask === "function"
-    ? window.queueMicrotask.bind(window)
-    : function(fn) { Promise.resolve().then(fn); };
+  var nativeSetTimeout = window.setTimeout.bind(window);
   var nativeAddEventListener = EventTarget.prototype.addEventListener;
   var nativeRemoveEventListener = EventTarget.prototype.removeEventListener;
   var NativeMutationObserver = window.MutationObserver;
@@ -249,7 +247,7 @@ def _csp_meta(csp):
   var seenScripts = new WeakSet();
   var callbackWrappers = new WeakMap();  // callback -> wrapper
   var wrappedCallbacks = new WeakMap();  // wrapper -> callback
-  var thrownByCallback = null;
+  var thrownByCallbacks = [];
 
   function errorsAreSanitized() {
     var sanitized = false;
@@ -363,13 +361,14 @@ def _csp_meta(csp):
   }
 
   function rememberThrown(error) {
-    thrownByCallback = {error: error};
-    // The error event for an uncaught callback exception is dispatched
-    // before any microtask runs; anything still here afterwards was
-    // caught elsewhere
-    nativeQueueMicrotask(function() {
-      thrownByCallback = null;
-    });
+    // The browser reports an uncaught callback exception within the
+    // same task - though WebKit drains microtasks first, and a callback
+    // throwing in one of those is reported before this one, hence a
+    // stack. Anything left by a later task was caught elsewhere.
+    thrownByCallbacks.push({error: error});
+    nativeSetTimeout(function() {
+      thrownByCallbacks = [];
+    }, 0);
   }
 
   function wrapCallback(callback) {
@@ -511,8 +510,7 @@ def _csp_meta(csp):
   }
 
   function recoverErrorDetails(details) {
-    var thrown = thrownByCallback;
-    thrownByCallback = null;
+    var thrown = thrownByCallbacks.pop();
     if (!details.sanitized) {
       return false;
     }
diff --git a/tests/test_playwright.py b/tests/test_playwright.py
index 48a0280..857400d 100644
--- a/tests/test_playwright.py
+++ b/tests/test_playwright.py
@@ -1230,6 +1230,8 @@ def test_debug_harness_recovers_error_details_from_every_error_source(
         for error in envelope["events"]["errors"]
         if error["kind"] == "javascript-error"
     }
+    # A str, so pytest reports it in full rather than truncated
+    all_errors = json.dumps(list(js_errors.values()), indent=1)
     # WebKit sanitizes every one of these to "Script error." in a
     # sandboxed frame; debug frames recover each message
     for expected in (
@@ -1238,8 +1240,8 @@ def test_debug_harness_recovers_error_details_from_every_error_source(
         "inline attribute handler failed",
         "timer callback failed",
     ):
-        assert any(expected in message for message in js_errors), js_errors
-    assert not any("Script error" in message for message in js_errors), js_errors
+        assert any(expected in message for message in js_errors), all_errors
+    assert not any("Script error" in message for message in js_errors), all_errors
     top_level = next(
         error
         for message, error in js_errors.items()