browser-crawl: block third-party hosts instead of allowlisting their errors

What

Block third-party hosts at the network layer during the browser-crawl project, instead of letting their requests fire and then pattern-matching the resulting errors away.

Concretely: a page.route() abort for a configurable host list in tests/console-errors.spec.ts, seeded with the same vendors BUILTIN_NOISE already covers, and extensible per consumer via .docs-test.toml.

Why

BUILTIN_NOISE (tests/console-errors.spec.ts:40-57) already suppresses by host — googletagmanager.com, google-analytics.com, fonts.googleapis.com, fonts.gstatic.com. So host-scoped handling of third-party noise is established. The problem is that it suppresses the error while the request still happens, and the request is the thing causing trouble.

Two consequences:

1. The crawl rate-limits itself, and the failure set moves. Every crawled page boots the consumer's analytics and chat widgets, so a site-wide crawl fires one beacon per page at each vendor within a few seconds. Past some page count that trips the vendor's rate limit, and whichever pages land after the limit fail with a 429 that no allowlist anticipated:

console.error: Failed to load resource: the server responded with a status of 429 ()
(https://app.qualified.com/w/1/1SXpuHx6Cqg3anJd/sentry/proxy)

Observed on agentregistry-oss-website (make framework-test) across four runs of the same suite: 48 failed, then 16, then 17, then 0. The 17 was on unmodified main, so this is not content-specific. The set of failing URLs differs every run and mixes pages that have nothing in common beyond crawl ordering. That reads as a real regression to whoever hits it, and costs a bisect to disprove.

2. CI sends live analytics and chat traffic to vendors on every run. A full crawl is ~170 pages on agentregistry and considerably more on the docs hub. Each one currently loads GTM, GA, and Qualified for real. That is measurable crawl latency, a dependency on external network reachability, and production beacons originating from CI.

Blocking at page.route fixes both, and it fixes the whole class rather than one vendor at a time — right now each new third-party script gets added to a docs site, starts failing the crawl for some consumer, and earns another allowlist entry after someone spends time working out that it is noise.

Suggested shape

• A THIRD_PARTY_HOSTS list in tests/console-errors.spec.ts, seeded from the hosts already in BUILTIN_NOISE, plus the chat/support vendors consumers actually load (app.qualified.com at minimum).
• page.route(/* matching those hosts */, (route) => route.abort()) registered before page.goto.
• A [crawl].blockedHosts key in .docs-test.toml so a consumer can extend the list without a theme release, consistent with how [allowlists].consoleErrors is extended today.
• Keep BUILTIN_NOISE as-is. Blocking a request produces its own net::ERR_FAILED console error, so the existing suppression is still what keeps the abort itself quiet — this is additive, not a replacement.
• Worth confirming the abort does not break openapi.html, which fetches Swagger UI assets from unpkg.com at build time and falls back to a client-side CDN load. unpkg.com should stay reachable, or those pages start failing for a new reason.

Workaround until then

Per-consumer allowlist entry, scoped to the status and the host so a genuine 429 from the site's own origin still fails:

[allowlists]
consoleErrors = [
  "status of 429 .*app\\.qualified\\.com",
]

Reference

• tests/console-errors.spec.ts:40-57 — BUILTIN_NOISE, the existing host-scoped suppression.
• tests/console-errors.spec.ts:96-108 — the console handler that appends msg.location().url, which is what makes host-scoped patterns match these messages at all.
• tests/helpers/target.ts:109-111 — consoleErrorsAllowlist, compiling .docs-test.toml entries to RegExp.
• Surfaced while automating the arctl CLI reference in agentregistry-dev/website; adding 15 pages to the crawl made it fail far more often, but it reproduces on that repo's unmodified main.

Start with tests/console-errors.spec.ts, especially BUILTIN_NOISE and the console handler, then inspect tests/helpers/target.ts for how .docs-test.toml allowlists are compiled. Add configurable blocked hosts and register the request handling before page.goto, while keeping unpkg.com reachable. Done means third-party requests are blocked during browser-crawl, consumer extensions work, and openapi.html still functions.