Fix

Author: sebavan

dist/spector.bundle.js

@@ -808,13 +808,14 @@ export declare class Spector {
     log(value: string): void;
     /**
      * Explicitly opt in to intercepting new Worker() calls to auto-inject Spector.
-     * Experimental/best-effort: can change Worker behavior and fails for some
-     * CORS/CSP policies. Module Workers are not injected. Prefer spyWorker().
+     * Experimental/best-effort: only simple same-origin classic scripts with
+     * string URLs and no options are candidates. Module Workers stay native.
+     * Blob wrapping can still change behavior or fail under CSP. Prefer spyWorker().
      * @param workerBundleUrl URL to spector.worker.bundle.js
      */
     spyWorkers(workerBundleUrl?: string): void;
     /**
-     * Stop intercepting Worker construction.
+     * Stop intercepting Worker construction without replacing later third-party wrappers.
      */
     stopSpyingWorkers(): void;
     /**
@@ -825,8 +826,7 @@ export declare class Spector {
     spyWorker(worker: Worker): WorkerBridge;
     /**
      * Capture a frame from a Worker's WebGL context.
-     * Uses direct postMessage to bypass the main-thread spy chain,
-     * which ensures a full frame is captured.
+     * Uses the Worker's bridge to send the request and publish its result once.
      */
     captureWorker(worker: Worker, commandCount?: number, quickCapture?: boolean, fullCapture?: boolean): void;
     private captureFrames;

dist/spector.d.ts

@@ -35,12 +35,16 @@ And the following list of events:
 - ```onError: IEvent<string>```: triggered when an error occured and return the error message.
 
 ### Worker / OffscreenCanvas APIs
-- ```spyWorkers(workerBundleUrl?: string)``` : Explicitly opt in to experimental, best-effort interception of `new Worker()` calls. Attempts to inject Spector into classic Workers; module Workers are not injected. Recognizable dynamic imports and nested Worker constructions are also bypassed, but source checks cannot establish safety. Blob wrapping, URL/base changes, and constructor interception can alter behavior; CSP/CORS restrictions can prevent injection. Defaults to `"spector.worker.bundle.js"`. Prefer `spyWorker()` when you control the Worker source.
-- ```stopSpyingWorkers()``` : Stop intercepting Worker construction.
+- ```spyWorkers(workerBundleUrl?: string)``` : Explicitly opt in to experimental, best-effort interception of `new Worker()` calls. Only primitive string URLs for same-origin HTTP(S) classic Workers without options are candidates. URL objects, options (including module Workers), subclasses, redirects, blob/data/cross-origin URLs, strict scripts, and recognizable URL-sensitive sources (`import`, `importScripts`, nested Workers, `location`, `Request`, `fetch`, XHR) use native construction. Inputs are passed to the original constructor without extra coercion or options inspection. Source checks cannot establish safety. Defaults to `"spector.worker.bundle.js"`, resolved against the caller's base URL. Prefer `spyWorker()` when you control the Worker source.
+- ```stopSpyingWorkers()``` : Deactivate this interceptor, including retained references to it. Restore the previous constructor only if it is still installed; preserve wrappers installed later by other libraries.
 - ```spyWorker(worker: Worker): WorkerBridge``` : Manually bridge a specific Worker for capture. This is the recommended API and does not replace the Worker constructor. The Worker must load `spector.worker.bundle.js` via `importScripts` (classic Workers) or `import` (module Workers).
 - ```captureWorker(worker: Worker, commandCount?: number, quickCapture?: boolean, fullCapture?: boolean)``` : Capture a frame from a Worker's WebGL context. If the Worker hasn't been bridged yet, `spyWorker` is called automatically.
 
-The browser extension's **Auto-inject Workers (experimental)** checkbox is separate from `spyWorkers()` and defaults **off**, even when offscreen canvas capture was previously enabled. It includes OffscreenCanvas Workers and warns that instrumentation may alter behavior. Changes are persisted in page `sessionStorage` (`SPECTOR_WORKERAUTOINJECT`) for the tab/origin session, like the offscreen capture setting, then reload the tab's loaded frames. The MAIN-world content script reads the exact value `"true"` synchronously at `document_start`; there is no asynchronous storage race. Missing/false values leave `window.Worker` untouched, with no wrapper or preflight fetch. Disabling the checkbox restores that behavior on reload. Main-thread canvas capture and manual Worker APIs remain available.
+The browser extension's **Auto-inject Workers (experimental)** checkbox is separate from `spyWorkers()` and defaults **off**, even when offscreen canvas capture was previously enabled. It uses the same conservative eligibility rules, includes simple classic OffscreenCanvas Workers, and warns that instrumentation may alter behavior. Changes are persisted in page `sessionStorage` (`SPECTOR_WORKERAUTOINJECT`) for the tab/origin session, like the offscreen capture setting, then reload the tab's loaded frames. The MAIN-world content script reads the exact value `"true"` synchronously at `document_start`; it does not wait for asynchronous extension storage. Missing/false values leave `window.Worker` untouched, with no wrapper or preflight fetch. Disabling the checkbox restores that behavior on reload. Main-thread canvas capture and manual Worker APIs remain available.
+
+For OffscreenCanvas capture in the extension, select the instrumented **Worker** entry. A transferred DOM canvas alone does not identify its owning Worker, so selecting its canvas entry reports an error instead of guessing which Worker to capture.
+
+Opt-in is not a compatibility guarantee: source and instrumentation-bundle preflights add synchronous requests, computed API names can evade checks, and blob wrapping still changes the worker global and script error locations. Application responses with CSP or report-only CSP stay native because a blob cannot carry those response policies. Native constructor and preflight failures, including unavailable or non-JavaScript instrumentation bundles, fall back synchronously without creating a blob Worker. A successful XHR preflight does not prove `importScripts` will succeed: it uses different CSP checks and a separate request. Bundle import/execution exceptions are logged in the Worker so the application can still start, but partially executed instrumentation is not rolled back. CSP blocking the blob Worker itself and other asynchronous startup failures cannot transparently replace an already-returned Worker. Module Workers are always native; explicitly import the worker bundle when module capture is needed. No startup message queue or `postMessage` override is installed.
 
 As you notice you could use the capture without displying the UI (this is the orientation we chosed in the browser extension).
 

documentation/apis.md

@@ -89,7 +89,7 @@ browser.action.onClicked.addListener(function (tab) {
 
 listenForMessage(function(request, sender, sendResponse) {
     var frameId;
-    if (sender.frameId) {
+    if (typeof sender.frameId === "number") {
         frameId = sender.frameId;
     } 
     else if (request.uniqueId) {