fix: align iframe depth + unsupported-scheme list with canonical sdk-utils

Bring the inlined iframe helpers into parity with the canonical
@percy/sdk-utils single source of truth (percy/cli #2319):

- DEFAULT_MAX_FRAME_DEPTH 5 -> 3 (MAX_FRAME_DEPTH_CAP already 10).
- isUnsupportedIframeSrc now matches the canonical 15-prefix
  UNSUPPORTED_IFRAME_SRCS (adds chrome/chrome-extension/devtools/edge/opera/
  view-source/blob/file/ws/wss/ftp and the about: prefix) and is
  case-insensitive, instead of the narrow case-sensitive about:blank/
  javascript:/data:/vbscript: check.

Updated the clampFrameDepth + resolveMaxFrameDepth default assertions to 3.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aryanku-dev

.gitignore

@@ -12,3 +12,11 @@ node_modules/
 .vscode
 .settings
 .DS_Store
+
+# bstack-ai-harness:begin (managed — do not edit between markers)
+bstack-ai-harness.yml
+.harness-docs.json
+.harness-manifest.json
+CLAUDE.md
+.claude/
+# bstack-ai-harness:end

src/main/java/io/percy/selenium/Percy.java

@@ -730,16 +730,23 @@ static class PercyContextLostException extends RuntimeException {
 
     // Default maximum nesting depth for cross-origin iframe capture. Mirrors the
     // canonical Percy SDK behaviour — depth 1 is a top-level iframe.
-    private static final int DEFAULT_MAX_FRAME_DEPTH = 5;
+    private static final int DEFAULT_MAX_FRAME_DEPTH = 3;
     private static final int MIN_FRAME_DEPTH = 1;
     private static final int MAX_FRAME_DEPTH_CAP = 10;
 
+    // Mirrors the canonical @percy/sdk-utils UNSUPPORTED_IFRAME_SRCS list
+    // (percy/cli #2319): a null/empty src is unsupported, and the check is a
+    // case-insensitive startsWith over the 15 canonical scheme prefixes.
     private boolean isUnsupportedIframeSrc(String src) {
-        return src == null || src.isEmpty() ||
-               src.equals("about:blank") ||
-               src.startsWith("javascript:") ||
-               src.startsWith("data:") ||
-               src.startsWith("vbscript:");
+        if (src == null || src.isEmpty()) return true;
+        String s = src.toLowerCase();
+        return s.startsWith("about:") || s.startsWith("chrome:") ||
+               s.startsWith("chrome-extension:") || s.startsWith("devtools:") ||
+               s.startsWith("edge:") || s.startsWith("opera:") ||
+               s.startsWith("view-source:") || s.startsWith("data:") ||
+               s.startsWith("javascript:") || s.startsWith("blob:") ||
+               s.startsWith("vbscript:") || s.startsWith("file:") ||
+               s.startsWith("ws:") || s.startsWith("wss:") || s.startsWith("ftp:");
     }
 
     private static String getOrigin(String url) {

src/test/java/io/percy/selenium/IframeFeatureTest.java

@@ -40,10 +40,10 @@ public class IframeFeatureTest {
   @Test
   public void clampFrameDepthBoundsValuesAndDefaults() throws Exception {
     int defDepth = (int) invokeStaticPrivate("clampFrameDepth", new Class[]{int.class}, 0);
-    assertEquals(5, defDepth, "Non-positive depth clamps to default");
+    assertEquals(3, defDepth, "Non-positive depth clamps to default");
 
     int negDepth = (int) invokeStaticPrivate("clampFrameDepth", new Class[]{int.class}, -3);
-    assertEquals(5, negDepth, "Negative depth clamps to default");
+    assertEquals(3, negDepth, "Negative depth clamps to default");
 
     int hugeDepth = (int) invokeStaticPrivate("clampFrameDepth", new Class[]{int.class}, 9999);
     assertEquals(10, hugeDepth, "Huge depth clamps to cap (10)");
@@ -86,7 +86,7 @@ public void resolveMaxFrameDepthPrefersOptionThenCliConfigThenDefault() throws E
 
     setField(percy, "cliConfig", new JSONObject().put("snapshot", new JSONObject()));
     int def = (int) invokePrivate(percy, "resolveMaxFrameDepth", new Class[]{Map.class}, new HashMap<>());
-    assertEquals(5, def);
+    assertEquals(3, def);
   }
 
   @Test
@@ -453,11 +453,11 @@ public void collectClosedShadowPairsWalksTreeAndSkipsContentDocuments() throws E
   @Test
   public void clampFrameDepthZeroReturnsDocumentedDefault() throws Exception {
     // Semantic regression test: maxIframeDepth=0 must fall back to the
-    // documented default (5), matching @percy/sdk-utils behaviour. Anyone
+    // documented default (3), matching @percy/sdk-utils behaviour. Anyone
     // who later changes this to "0 disables CORS capture" would break
     // cross-SDK alignment — this test guards against the silent flip.
     int fromZero = (int) invokeStaticPrivate("clampFrameDepth", new Class[]{int.class}, 0);
-    assertEquals(5, fromZero, "maxIframeDepth=0 must use the canonical default (5), not disable nested capture");
+    assertEquals(3, fromZero, "maxIframeDepth=0 must use the canonical default (3), not disable nested capture");
   }
 
   @Test