(function(){ try { if (typeof window === 'undefined' || typeof document === 'undefined') return; // Vercel feedback / insights / live-feedback infrastructure // (these triggered the original error storm). var rx = /\/_vercel\/feedback|\/_vercel\/insights|feedback\.html|feedback\.js|vercel-live-feedback/i; // W52 follow-up #4 (2026-05-02): Chrome 130+ Local Network // Access policy was firing "76 requests" warnings on // aetheriaos.com because the Vercel feedback widget probes // localhost:3000, 127.0.0.1, *.local, and private IPv4 ranges // to detect a developer's local Vercel CLI for live-preview // links. On production we never want those probes — kill them // at the JS API level so Chrome's network stack never sees // the request and no LNA warning is surfaced. // Chrome 130+ Local Network Access — match every host class // Chrome considers private: // IPv4: loopback (127/8 + 0.0.0.0), link-local (169.254/16), // RFC1918 private (10/8, 172.16/12, 192.168/16) // IPv6: loopback (::1), link-local (fe80::/10), // unique-local (fc00::/7) // Hostname: localhost, *.local mDNS var lna = /^(?:https?:)?\/\/(?:localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|169\.254\.\d+\.\d+|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(?:1[6-9]|2\d|3[01])\.\d+\.\d+|\[::1?\]|\[fe[89ab][0-9a-f]?:[^\]]*\]|\[f[cd][0-9a-f]{2}:[^\]]*\]|[a-z0-9-]+\.local)(?::\d+)?(?:[\/:?#]|$)/i; function shouldSuppress(url) { if (typeof url !== 'string' || !url) return false; if (rx.test(url)) return true; if (lna.test(url)) return true; return false; } // 1. Patch fetch — runs synchronously, doesn't touch DOM, so // safe before React hydration. This is the layer that // actually stops the request storm: the widget tries to // fetch, every call gets a synthetic 204, no network // round-trip, no error onerror cascade. try { var nativeFetch = window.fetch; if (typeof nativeFetch === 'function') { window.fetch = function(input, init){ try { var url = typeof input === 'string' ? input : (input && input.url) ? input.url : ''; if (shouldSuppress(url)) { return Promise.resolve(new Response(null, { status: 204, statusText: 'Suppressed' })); } } catch(_){} return nativeFetch.apply(this, arguments); }; } } catch(_){} // 2. Patch XMLHttpRequest.open — same allow-list, redirected // to a data: URL that resolves immediately. Catches the // widget's XHR fallback. Also DOM-free, safe pre-hydration. try { var nativeOpen = XMLHttpRequest.prototype.open; XMLHttpRequest.prototype.open = function(method, url){ try { if (shouldSuppress(url)) { arguments[1] = 'data:text/plain,'; } } catch(_){} return nativeOpen.apply(this, arguments); }; } catch(_){} // 2b. Patch Element.attachShadow for vercel-live-feedback hosts. // W93-FEEDBACK-SHADOW (2026-05-12). Even with CSP blocking the // remote script, a cached service-worker payload could still // execute feedback.js on a hot page-load. The script crashes on // attachShadow-of-null (its host querySelector found nothing // because we hid the element). BEFORE crashing it may have // called attachShadow on a different node and left a stray // shadow host floating over the page. Patching attachShadow on // element nodes whose tagName matches our blocklist hardens this: // the call returns a detached/empty shadow root that can never // be appended to the live DOM, so it cannot intercept clicks or // cast a transparent overlay. // // NOTE: backticks are STRIPPED from this comment because this // whole IIFE is wrapped in a template literal in the parent file; // a stray backtick would terminate the template string at build // time. Use single quotes only inside this block. try { var nativeAttachShadow = Element.prototype.attachShadow; var SUPPRESS_SHADOW = /^(?:vercel-live-feedback|vercel-toolbar|vercel-live)$/i; Element.prototype.attachShadow = function(init) { try { if (this && this.tagName && SUPPRESS_SHADOW.test(this.tagName)) { // Return a detached host so any appendChild on the returned // shadow root writes into the void. var dummy = document.createElement('div'); return nativeAttachShadow.call(dummy, init || { mode: 'closed' }); } } catch(_){} return nativeAttachShadow.apply(this, arguments); }; } catch(_){} // 2c. Block

One login, every workspace.

One login, every workspace.