s and hidden __SANDBOX__ iframes into . DIV is // in the allowlist (React needs its own), so specifically treat // class-less, attribute-less, empty body-level divs as foreign. function isInjectedShell(el) { if (el.id && el.id.indexOf('__SANDBOX__') === 0) return true; return el.tagName === 'DIV' && !el.className && !el.id && el.childNodes.length === 0 && el.attributes.length === 0; } function sweepBodyForeign() { if (!document.body) return; var kids = document.body.children; for (var i = kids.length - 1; i >= 0; i--) { if (!BODY_ALLOWED[kids[i].tagName] || isInjectedShell(kids[i])) { try { document.body.removeChild(kids[i]); } catch (e) {} } } } function sweep(root) { sweepBodyForeign(); // Remove already-injected color-picker divs anywhere in the tree. try { if (root.querySelectorAll) { var styled = root.querySelectorAll('div[style]'); for (var s = 0; s < styled.length; s++) { if (isForeign(styled[s]) && styled[s].parentNode) styled[s].parentNode.removeChild(styled[s]); } } } catch (e) {} scrub(root); if (!root.querySelectorAll) return; var sel = '[' + ATTRS.join('],[') + ']'; var els = root.querySelectorAll(sel); for (var i = 0; i < els.length; i++) scrub(els[i]); for (var j = 0; j < ELEMENT_SELECTORS.length; j++) { try { var bad = root.querySelectorAll(ELEMENT_SELECTORS[j]); for (var k = 0; k < bad.length; k++) { if (bad[k].parentNode) bad[k].parentNode.removeChild(bad[k]); } } catch (e) {} } } // Capture the FULL hydration error (the useful diff is at the // end of the message, which log collectors truncate). Log it in // small numbered chunks so nothing is lost. // Verbose hydration diagnostics are a dev tool — in production they // only add main-thread work, so they are compiled out of the hot path. try { if (DEV) window.addEventListener('error', function (ev) { var msg = (ev && ev.error && ev.error.message) || (ev && ev.message) || ''; if (msg.indexOf('Hydration failed') === -1 && msg.indexOf('hydration') === -1) return; var full = msg + '\n---STACK---\n' + ((ev.error && ev.error.stack) || ''); for (var c = 0; c < full.length; c += 350) { console.warn('[hydration-full ' + (c / 350) + ']', full.slice(c, c + 350)); } // Also snapshot body-level children at error time. var kids = document.body ? document.body.children : []; var names = []; for (var b = 0; b < kids.length; b++) names.push(kids[b].tagName + (kids[b].className ? '.' + String(kids[b].className).slice(0, 40) : '')); console.warn('[hydration-body-children]', names.join(' | ')); }, true); // React 19 prints the actual server/client diff via // console.error, not the thrown error. Mirror long // console.error payloads in chunks too. var origErr = console.error; if (DEV) console.error = function () { try { var joined = Array.prototype.map.call(arguments, function (a) { if (typeof a === 'string') return a; try { return JSON.stringify(a); } catch (e) { return String(a); } }).join(' '); if (joined.length > 300 && (joined.indexOf('hydrat') !== -1 || joined.indexOf('match') !== -1 || joined.indexOf('<') !== -1)) { for (var c = 0; c < joined.length && c < 14000; c += 350) { console.warn('[console-error-full ' + (c / 350) + ']', joined.slice(c, c + 350)); } } } catch (e) {} return origErr.apply(console, arguments); }; } catch (e) {} try { var mo = new MutationObserver(function (muts) { for (var i = 0; i < muts.length; i++) { var m = muts[i]; if (m.type === 'attributes') scrub(m.target); if (m.type === 'childList') { for (var n = 0; n < m.addedNodes.length; n++) { var node = m.addedNodes[n]; if (isForeign(node) && node.parentNode) node.parentNode.removeChild(node); // Instantly remove disallowed elements injected directly // under (previously only swept every 500ms — a // node injected in between could still break hydration). if (node && node.nodeType === 1 && node.parentNode === document.body && (!BODY_ALLOWED[node.tagName] || isInjectedShell(node))) { try { console.warn('[hydration-guard] removed injected <' + node.tagName + '> from body', node.outerHTML ? node.outerHTML.slice(0, 200) : ''); document.body.removeChild(node); } catch (e) {} } } } } }); mo.observe(document.documentElement, { attributes: true, childList: true, subtree: true, attributeFilter: ATTRS }); sweep(document.documentElement); document.addEventListener('DOMContentLoaded', function () { sweep(document.documentElement); }); // Extensions keep re-injecting for a while after load; sweep // periodically during the window where hydration happens. var passes = 0; var iv = setInterval(function () { sweep(document.documentElement); if (++passes >= (DEV ? 20 : 4)) clearInterval(iv); }, 500); } catch (e) { /* never break the page over cleanup */ } })();

The Hidden Value Audit