fix: enable strictProxyHas for namespace conflict detection in window proxy (#692)

chadgauth · web-flow · commit 1a012b75ea35 · 2026-03-02T10:34:09.000-06:00
* fix: enable strictProxyHas for namespace conflict detection in window proxy

- Add strictProxyHas config option to PartytownConfig for accurate 'in' operator behavior
- Update window proxy has trap to check config flag and use Reflect.has when enabled
- Add FullStory GTM integration test with exact production snippet
- Document strictProxyHas in configuration docs
- Add FullStory to common services with GTM configuration guide
- Add test-results to .gitignore to prevent committing test artifacts

This fixes the issue where FullStory loaded via GTM would detect a false
'namespace conflict' because the window proxy's 'in' operator always returned
true. With strictProxyHas enabled, scripts can accurately check for property
existence using the 'in' operator while maintaining backwards compatibility
for existing implementations.

* chore: fix formatting in documentation files
diff --git a/.changeset/strict-proxy-has.md b/.changeset/strict-proxy-has.md
@@ -0,0 +1,32 @@
+---
+'@qwik.dev/partytown': minor
+---
+
+Add `strictProxyHas` configuration option for accurate namespace conflict detection
+
+**Summary:**
+
+This release adds a new configuration option `strictProxyHas` that enables accurate property existence checks using the `in` operator. This is required for scripts like FullStory that check for namespace conflicts when loaded via Google Tag Manager (GTM).
+
+**Key Changes:**
+
+- Add `strictProxyHas?: boolean` config option to enable accurate `in` operator behavior
+- Update window proxy's `has` trap to use `Reflect.has()` when `strictProxyHas: true`
+- Default is `false` for backwards compatibility
+- Add FullStory GTM integration test with production-ready snippet
+- Document the configuration and provide usage guide
+
+**Usage:**
+
+```html
+<script>
+  partytown = {
+    forward: ['FS.identify', 'FS.event'],
+    strictProxyHas: true  // Enable for FullStory via GTM
+  };
+</script>
+```
+
+**Backwards Compatibility:**
+
+This is a non-breaking change. The default behavior remains unchanged (`strictProxyHas: false`), so existing implementations will continue to work without modifications.
diff --git a/.gitignore b/.gitignore
@@ -23,4 +23,5 @@ node_modules/
 /index.d.ts
 .idea
 .history
+test-results/
 tests/integrations/load-scripts-on-main-thread/snippet.js
diff --git a/docs/src/routes/common-services/index.mdx b/docs/src/routes/common-services/index.mdx
@@ -8,18 +8,34 @@ Partytown is built with the goal that any third-party script can be ran from wit
 
 Below is a list of plugins / libraries that are tested & known to be working with Partytown with their commonly used [forward configs](/forwarding-events) and [proxied domains](/proxying-requests).
 
-| Service                                                                                       | Forward Config                      | Proxy Domain                                        |
-| --------------------------------------------------------------------------------------------- | ----------------------------------- | --------------------------------------------------- |
-| [Facebook Pixel](/facebook-pixel)                                                             | "fbq"                               | "connect.facebook.net"                              |
-| [Google Tag Manager](/google-tag-manager)                                                     | "dataLayer.push"                    |                                                     |
-| [Hubspot Tracking](https://developers.hubspot.com/docs/api/events/tracking-code)              | "\_hsq.push"                        |                                                     |
-| [Intercom](https://developers.intercom.com/installing-intercom/docs/intercom-javascript)      | "Intercom"                          |                                                     |
-| [Klaviyo](https://developers.klaviyo.com/en/docs/javascript-api)                              | "\_learnq.push"                     | "static.klaviyo.com", "static-tracking.klaviyo.com" |
-| [TikTok Pixel](https://ads.tiktok.com/marketing_api/docs?rid=959icq5stjr&id=1701890973258754) | "ttq.track", "ttq.page", "ttq.load" |
-| [Mixpanel](https://developer.mixpanel.com/docs/javascript-quickstart)                         | "mixpanel.track"                    |                                                     |
+| Service                                                                                       | Forward Config                      | Proxy Domain                                        | Additional Config                          |
+| --------------------------------------------------------------------------------------------- | ----------------------------------- | --------------------------------------------------- | ------------------------------------------ |
+| [Facebook Pixel](/facebook-pixel)                                                             | "fbq"                               | "connect.facebook.net"                              |                                            |
+| [FullStory](https://help.fullstory.com/hc/en-us/articles/360020623574)                        | "FS.identify", "FS.event"           |                                                     | `strictProxyHas: true` (if loaded via GTM) |
+| [Google Tag Manager](/google-tag-manager)                                                     | "dataLayer.push"                    |                                                     |                                            |
+| [Hubspot Tracking](https://developers.hubspot.com/docs/api/events/tracking-code)              | "\_hsq.push"                        |                                                     |                                            |
+| [Intercom](https://developers.intercom.com/installing-intercom/docs/intercom-javascript)      | "Intercom"                          |                                                     |                                            |
+| [Klaviyo](https://developers.klaviyo.com/en/docs/javascript-api)                              | "\_learnq.push"                     | "static.klaviyo.com", "static-tracking.klaviyo.com" |                                            |
+| [TikTok Pixel](https://ads.tiktok.com/marketing_api/docs?rid=959icq5stjr&id=1701890973258754) | "ttq.track", "ttq.page", "ttq.load" |                                                     |                                            |
+| [Mixpanel](https://developer.mixpanel.com/docs/javascript-quickstart)                         | "mixpanel.track"                    |                                                     |                                            |
 
 If you would like to add to this list,
 
 - Refer to the ["for Plugin Authors / Developers"](https://github.com/BuilderIO/partytown/blob/main/CONTRIBUTING.md#plugin-authors--developers) section to see how you can validate whether a library / plugin works with Partytown.
 - Send us a PR so that we can have a scenario checked in that validates it.
 - Please [edit this doc](https://github.com/BuilderIO/partytown/edit/main/docs/common-services.md) to add your plugin / library and its configuration so that others can start using it!
+
+## FullStory with Google Tag Manager
+
+When loading FullStory via Google Tag Manager (GTM), you need to enable the `strictProxyHas` configuration option. This is because FullStory checks for namespace conflicts using the `in` operator (e.g., `if (!("FS" in window))`), and by default, Partytown's window proxy always returns `true` for the `in` operator for backwards compatibility.
+
+```html
+<script>
+  partytown = {
+    forward: ['FS.identify', 'FS.event'],
+    strictProxyHas: true,
+  };
+</script>
+```
+
+Without `strictProxyHas: true`, FullStory will detect a false "namespace conflict" and fail to initialize when loaded via GTM's Custom HTML tag. This configuration ensures the `in` operator accurately checks property existence on the window object.
diff --git a/docs/src/routes/configuration/index.mdx b/docs/src/routes/configuration/index.mdx
@@ -14,6 +14,7 @@ Partytown does not require a config for it to work, however a config can be set
 | `loadScriptsOnMainThread` | An array of strings or regular expressions (RegExp) used to filter out which script are executed via Partytown and the main thread. An example is as follows: `loadScriptsOnMainThread: ["https://test.com/analytics.js", "inline-script-id", /regex-matched-script\.js/]`. |
 | `resolveUrl`              | Hook that is called to resolve URLs which can be used to modify URLs. The hook uses the API: `resolveUrl(url: URL, location: URL, method: string)`. See the [Proxying Requests](/proxying-requests) for more information.                                                   |
 | `nonce`                   | The nonce property may be set on script elements created by Partytown. This should be set only when dealing with content security policies and when the use of `unsafe-inline` is disabled (using `nonce-*` instead).                                                       |
+| `strictProxyHas`          | When `true`, the `in` operator will accurately check if properties exist on the window object. Required for scripts that check for namespace conflicts, such as FullStory loaded via GTM. Default is `false` for backwards compatibility.                                   |
 | `fallbackTimeout`         | A timeout in ms until Partytown initialization is considered as failed & fallbacks to the regular execution in main thread. Default is 9999                                                                                                                                 |
 
 ## Vanilla Config
diff --git a/src/lib/types.ts b/src/lib/types.ts
@@ -550,6 +550,23 @@ export interface PartytownConfig {
    * ```
    */
   nonce?: string;
+  /**
+   * When set to `true`, the window proxy's `has` trap will use `Reflect.has()` to accurately
+   * check if properties exist on the window object, instead of always returning `true`.
+   *
+   * This is required for scripts that check for namespace conflicts using the `in` operator,
+   * such as FullStory: `if (!("FS" in window)) { ... }`
+   *
+   * Default: false (for backwards compatibility)
+   *
+   * @example
+   * ```js
+   * partytown = {
+   *   strictProxyHas: true
+   * };
+   * ```
+   */
+  strictProxyHas?: boolean;
 }
 
 export type PartytownInternalConfig = Omit<PartytownConfig, 'loadScriptsOnMainThread'> & {
diff --git a/src/lib/web-worker/worker-image.ts b/src/lib/web-worker/worker-image.ts
@@ -71,7 +71,7 @@ export const createImageConstructor = (env: WebWorkerEnvironment) =>
     toggleAttribute(name: string, force?: boolean): boolean {
       const normalizedName = name.toLowerCase();
       const hasAttr = this.attributes.has(normalizedName);
-      
+
       if (force !== undefined) {
         if (force) {
           if (!hasAttr) {
@@ -83,7 +83,7 @@ export const createImageConstructor = (env: WebWorkerEnvironment) =>
           return false;
         }
       }
-      
+
       if (hasAttr) {
         this.attributes.delete(normalizedName);
         return false;
diff --git a/src/lib/web-worker/worker-window.ts b/src/lib/web-worker/worker-window.ts
@@ -374,11 +374,12 @@ export const createWindow = (
                 return win[propName];
               }
             },
-            has: () =>
-              // window "has" any and all props, this is especially true for global variables
-              // that are meant to be assigned to window, but without "window." prefix,
-              // like: <script>globalProp = true</script>
-              true,
+            has: (target, prop) =>
+              // Check if property exists on the window object
+              // This is used by the 'in' operator (e.g., "propertyName" in window)
+              // When strictProxyHas is enabled, use accurate Reflect.has() behavior
+              // Otherwise, always return true for backwards compatibility
+              webWorkerCtx.$config$.strictProxyHas ? Reflect.has(target, prop) : true,
           }) as any,
           $document$: $createNode$(NodeName.Document, $winId$ + '.' + WinDocId.document) as any,
           $documentElement$: $createNode$(
diff --git a/tests/integrations/full-story/full-story.spec.ts b/tests/integrations/full-story/full-story.spec.ts
@@ -11,3 +11,54 @@ test('full-story', async ({ page }) => {
   const testFullStory = page.locator('#testIdentify');
   await expect(testFullStory).toHaveText('called');
 });
+
+test('full-story via GTM', async ({ page }) => {
+  // Capture console messages - only actual console.log output, not Partytown debug logs
+  const consoleMessages: string[] = [];
+  page.on('console', (msg) => {
+    const text = msg.text();
+    // Filter out Partytown's own debug logging (which would contain the script source)
+    if (!text.includes('%c')) {
+      consoleMessages.push(text);
+    }
+  });
+
+  await page.goto('/tests/integrations/full-story/gtm-fullstory.html');
+
+  await page.waitForSelector('.completed');
+
+  // Check that FS namespace exists and is properly initialized
+  const testFSExists = page.locator('#testFSExists');
+  await expect(testFSExists).toHaveText('yes');
+
+  const fsExists = await page.evaluate(() => {
+    return typeof window['FS'] !== 'undefined' && typeof window['FS'].identify === 'function';
+  });
+  expect(fsExists).toBe(true);
+
+  // Check for namespace conflict error in actual console output
+  const hasNamespaceConflict = consoleMessages.some((msg) =>
+    msg.includes('FullStory namespace conflict')
+  );
+
+  if (hasNamespaceConflict) {
+    console.error('❌ FullStory namespace conflict detected!');
+    console.error('Console messages:', consoleMessages);
+  }
+
+  expect(hasNamespaceConflict).toBe(false);
+
+  // Test FS.identify
+  const buttonSendIdentify = page.locator('#buttonSendIdentify');
+  await buttonSendIdentify.click();
+
+  const testIdentify = page.locator('#testIdentify');
+  await expect(testIdentify).toHaveText('called');
+
+  // Test FS.event
+  const buttonSendEvent = page.locator('#buttonSendEvent');
+  await buttonSendEvent.click();
+
+  const testEvent = page.locator('#testEvent');
+  await expect(testEvent).toHaveText('called');
+});
diff --git a/tests/integrations/full-story/gtm-fullstory.html b/tests/integrations/full-story/gtm-fullstory.html
@@ -0,0 +1,135 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="description" content="Partytown Test Page - FullStory via GTM" />
+
+    <title>Partytown FullStory via GTM</title>
+
+    <script>
+      partytown = {
+        forward: ['FS.identify', 'FS.event'],
+        strictProxyHas: true,
+      };
+    </script>
+    <script src="/~partytown/debug/partytown.js"></script>
+
+    <!-- Exact FullStory snippet from GTM Custom HTML tag -->
+    <script type="text/partytown">
+      window['_fs_host'] = 'fullstory.example.com';
+      window['_fs_script'] = 'fullstory.example.com/s/fs.js';
+      window['_fs_app_host'] = 'app.fullstory.com';
+      window['_fs_org'] = 'o-ABC123-na1';
+      window['_fs_namespace'] = 'FS';
+      !function(m,n,e,t,l,o,g,y){var s,f,a=function(h){
+      return!(h in m)||(m.console&&m.console.log&&m.console.log('FullStory namespace conflict. Please set window["_fs_namespace"].'),!1)}(e)
+      ;function p(b){var h,d=[];function j(){h&&(d.forEach((function(b){var d;try{d=b[h[0]]&&b[h[0]](h[1])}catch(h){return void(b[3]&&b[3](h))}
+      d&&d.then?d.then(b[2],b[3]):b[2]&&b[2](d)})),d.length=0)}function r(b){return function(d){h||(h=[b,d],j())}}return b(r(0),r(1)),{
+      then:function(b,h){return p((function(r,i){d.push([b,h,r,i]),j()}))}}}a&&(g=m[e]=function(){var b=function(b,d,j,r){function i(i,c){
+      h(b,d,j,i,c,r)}r=r||2;var c,u=/Async$/;return u.test(b)?(b=b.replace(u,""),"function"==typeof Promise?new Promise(i):p(i)):h(b,d,j,c,c,r)}
+      ;function h(h,d,j,r,i,c){return b._api?b._api(h,d,j,r,i,c):(b.q&&b.q.push([h,d,j,r,i,c]),null)}return b.q=[],b}(),y=function(b){function h(h){
+      "function"==typeof h[4]&&h[4](new Error(b))}var d=g.q;if(d){for(var j=0;j<d.length;j++)h(d[j]);d.length=0,d.push=h}},function(){
+      (o=n.createElement(t)).async=!0,o.crossOrigin="anonymous",o.src="https://"+l,o.onerror=function(){y("Error loading "+l)}
+      ;var b=n.getElementsByTagName(t)[0];b&&b.parentNode?b.parentNode.insertBefore(o,b):n.head.appendChild(o)}(),function(){function b(){}
+      function h(b,h,d){g(b,h,d,1)}function d(b,d,j){h("setProperties",{type:b,properties:d},j)}function j(b,h){d("user",b,h)}function r(b,h,d){j({
+      uid:b},d),h&&j(h,d)}g.identify=r,g.setUserVars=j,g.identifyAccount=b,g.clearUserCookie=b,g.setVars=d,g.event=function(b,d,j){h("trackEvent",{
+      name:b,properties:d},j)},g.anonymize=function(){r(!1)},g.shutdown=function(){h("shutdown")},g.restart=function(){h("restart")},
+      g.log=function(b,d){h("log",{level:b,msg:d})},g.consent=function(b){h("setIdentity",{consent:!arguments.length||b})}}(),s="fetch",
+      f="XMLHttpRequest",g._w={},g._w[f]=m[f],g._w[s]=m[s],m[s]&&(m[s]=function(){return g._w[s].apply(this,arguments)}),g._v="2.0.0")
+      }(window,document,window._fs_namespace,"script",window._fs_script);
+    </script>
+
+    <link
+      rel="icon"
+      id="favicon"
+      href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🌎</text></svg>"
+    />
+    <style>
+      body {
+        font-family:
+          -apple-system,
+          BlinkMacSystemFont,
+          Segoe UI,
+          Helvetica,
+          Arial,
+          sans-serif,
+          Apple Color Emoji,
+          Segoe UI Emoji;
+        font-size: 12px;
+      }
+      h1 {
+        margin: 0 0 15px 0;
+      }
+      button {
+        padding: 10px 20px;
+        margin: 10px 0;
+        font-size: 14px;
+      }
+      p {
+        margin: 10px 0;
+      }
+      strong {
+        font-weight: 600;
+      }
+    </style>
+  </head>
+  <body>
+    <h1>Partytown FullStory via GTM</h1>
+
+    <p>
+      <strong>FS exists:</strong>
+      <span id="testFSExists"></span>
+    </p>
+
+    <p>
+      <strong>FS.identify Test:</strong>
+      <span id="testIdentify"></span>
+    </p>
+
+    <p>
+      <strong>FS.event Test:</strong>
+      <span id="testEvent"></span>
+    </p>
+
+    <script>
+      function sendIdentify() {
+        console.log('Calling FS.identify...');
+        window['FS'].identify('test-user-123', {
+          displayName: 'Test User',
+          email: 'test.user@example.com',
+        });
+        document.getElementById('testIdentify').textContent = 'called';
+      }
+
+      function sendEvent() {
+        console.log('Calling FS.event...');
+        window['FS'].event('test_event', {
+          property1: 'value1',
+          property2: 'value2',
+        });
+        document.getElementById('testEvent').textContent = 'called';
+      }
+    </script>
+
+    <button onclick="sendIdentify()" id="buttonSendIdentify">Test FS.identify</button>
+    <button onclick="sendEvent()" id="buttonSendEvent">Test FS.event</button>
+
+    <script type="text/partytown">
+      (function () {
+        // Wait a bit for FullStory to initialize
+        setTimeout(function() {
+          if (typeof window['FS'] !== 'undefined' && typeof window['FS'].identify === 'function') {
+            document.getElementById('testFSExists').textContent = 'yes';
+          } else {
+            document.getElementById('testFSExists').textContent = 'no';
+          }
+          document.body.classList.add('completed');
+        }, 100);
+      })();
+    </script>
+
+    <p><a href="/tests/integrations/full-story/">Back to FullStory Tests</a></p>
+    <p><a href="/tests/">All Tests</a></p>
+  </body>
+</html>
