fix(record): saftey policy and rebase bug fix

apps/extension/src/tools/vom/__tests__/record-safe-observation.test.ts

@@ -1,9 +1,13 @@
 import { describe, expect, it } from "vitest";
-import { RECORD_DOCUMENT_ATTRIBUTE } from "@/shared/recording-document-identity";
+import {
+  RECORD_DOCUMENT_ATTRIBUTE,
+  recordingDocumentMarkerValue,
+} from "@/shared/recording-document-identity";
 import { projectRecordSafeObservation } from "../record-safe-observation";
 
 describe("projectRecordSafeObservation", () => {
   it("projects the opaque recording identity without exposing captured attributes", () => {
+    const recordingDocumentId = "123e4567-e89b-42d3-a456-426614174000";
     const result = projectRecordSafeObservation({
       rootFrameId: "child",
       frameDocuments: [
@@ -18,7 +22,7 @@ describe("projectRecordSafeObservation", () => {
               parentBackendNodeId: null,
               tag: "html",
               attrs: {
-                [RECORD_DOCUMENT_ATTRIBUTE]: "producer-1",
+                [RECORD_DOCUMENT_ATTRIBUTE]: recordingDocumentMarkerValue(recordingDocumentId),
                 value: "user@example.com",
               },
               rect: null,
@@ -36,7 +40,7 @@ describe("projectRecordSafeObservation", () => {
       {
         frameId: "child",
         target: { tabId: 4, sessionId: "oopif-session" },
-        recordingDocumentId: "producer-1",
+        recordingDocumentId,
       },
     ]);
     const dumped = JSON.stringify(result);
@@ -45,4 +49,34 @@ describe("projectRecordSafeObservation", () => {
     expect(dumped).not.toContain("domNodes");
     expect(dumped).not.toContain("axNodes");
   });
+
+  it("does not project a page-controlled marker value as recording identity", () => {
+    const result = projectRecordSafeObservation({
+      rootFrameId: "root",
+      frameDocuments: [
+        {
+          frameId: "root",
+          target: { tabId: 4 },
+          contextScopeId: "scope-1",
+          axNodes: [],
+          domNodes: [
+            {
+              backendNodeId: 1,
+              parentBackendNodeId: null,
+              tag: "html",
+              attrs: { [RECORD_DOCUMENT_ATTRIBUTE]: "bsk:user@example.com" },
+              rect: null,
+              paintOrder: 0,
+              position: "static",
+              pointerEvents: "auto",
+            },
+          ],
+        },
+      ],
+      rendered: { text: '@vom 1\nRootWebArea "Example"', refs: [], truncated: false },
+    });
+
+    expect(result.frames).toEqual([{ frameId: "root", target: { tabId: 4 } }]);
+    expect(JSON.stringify(result)).not.toContain("user@example.com");
+  });
 });

apps/extension/src/tools/vom/record-safe-observation.ts

@@ -41,9 +41,11 @@ export interface CaptureVomObservationResult {
 
 function projectFrames(documents: CapturedFrameDocument<FrameAxNode>[]): CaptureVomFrame[] {
   return documents.map((document) => {
-    const recordingDocumentId = document.domNodes
-      .map((node) => readRecordingDocumentIdentity(node.attrs))
-      .find((identity) => identity !== undefined);
+    let recordingDocumentId: string | undefined;
+    for (const node of document.domNodes) {
+      recordingDocumentId = readRecordingDocumentIdentity(node.attrs);
+      if (recordingDocumentId) break;
+    }
     return {
       frameId: document.frameId,
       target: document.target,