Skip to content

Known limits

Plain statements of what does not work, so you can plan around them.

Cross-origin iframes

  • The player draws in the top frame. For an element inside a cross-origin iframe, a frame agent (/frame-agent.js) is injected into that frame on demand. It resolves the last part of the locator and returns a rectangle to the top frame. The service worker relays the messages.
  • A synthetic "ghost" anchor is kept in the top frame at the element's position and refreshed every 300 ms (marked data-wp-synthetic). The overlay follows the ghost.
  • Picking works through one cross-origin hop. Deeper nesting of cross-origin frames is not supported.
  • Needs the extension to hold access to the frame's origin as well as the page's. The content script is registered for all frames of granted origins (allFrames, matchOriginAsFallback).
  • The ghost anchor is refreshed every 300 ms, so the overlay can trail the element briefly while the frame scrolls.

Content Security Policy

  • The player lives in the extension's own shadow root and is injected through scripting, so a strict host CSP does not stop it. Media (data images, third-party video iframes) renders under a strict host CSP; checked in Chromium only (decision 68, e2e/specs/csp-media.spec.ts).
  • The host's CSP still applies to the host's own frames: a host that blocks framing of a third-party document blocks it for the host, not for the player's viewer.
  • Edge has not been tested.

Closed shadow DOM

  • Open shadow roots are supported: locators carry a shadowPath of host selectors.
  • A closed shadow root cannot be entered. The locator fails with shadow-root-closed. Anchor on the shadow host itself, or ask the application team for an open root.

Layout

  • Inline banners push normal-flow content. A host header that is position: fixed is not pushed.
  • Targets clipped by a scroll container, or covered by a sticky header or fixed footer, are treated as not renderable.
  • Elements that move on every render can make a tooltip jump. Prefer stable anchors.

Product scope

  • No roles, segments or audience targeting: they are in the schema and are not evaluated. auth.status returns fixed roles.
  • No sign-in, no remote store, no analytics. events.push discards what it receives.
  • Edge: the manifest builds and has been inspected; the Playwright suite has not run on Edge.
  • Surveys and NPS are not built.

Studio limits

  • Only three advance conditions and six button actions are offered in forms; the schema allows more.
  • There is no branching editor.
  • Resource open-in is new tab or same tab.

Gotchas

  • Cross-origin frame content you cannot select (for example a payment iframe) cannot be anchored. Anchor to the frame element in the top document instead.
  • If a tour works on one machine and not another, check that the origin was granted on both and that a bundle import used the same application key.