[PR #809] [MERGED] fix: capture IndexedDB object-store record fingerprints #2256

New issue

Closed

opened 2026-10-16 21:16:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/809
Author: @rudycelekli
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/indexeddb-key-fingerprint-coverage-20261006

📝 Commits (1)

866c980 fix: capture IndexedDB object-store record fingerprints

📊 Changes

4 files changed (+67 additions, -6 deletions)

View changed files

📝 src/browser/CdpCaptureStorageFingerprints.ts (+4 -2)
➕ tests/boundary/browser/cdpBrowserProvider.indexed_db.test.ts (+41 -0)
📝 tests/fixtures/fakeCdpBrowserResults.ts (+21 -4)
📝 tests/fixtures/fakeCdpBrowserTypes.ts (+1 -0)

📄 Description

Summary

Capture records from IndexedDB object stores by omitting the optional CDP indexName. An empty index name requests an index and current Chrome returns Could not get index, losing ordinary store fingerprints.

Check key and primary-key completeness alongside record values. Date key previews omit millisecond precision; two distinct native keys can therefore produce the same retained hash. These partial remote keys now keep record and overall coverage incomplete instead of claiming complete fingerprints.

Verification

Owned Chrome154, real IndexedDB transactions, independent getAllKeys and native CDP requests, and the public CdpBrowserProvider.inspectPage: unchanged main loses records for populated stores; corrected empty and primitive-key controls are complete, Date0/Date1 controls are incomplete.
Focused storage/diff tests:15passed, including two new real protocol-fixture regressions; both new cases fail unchanged source. The HTTP/WebSocket fixture supplements the separate actual Chrome proof.
Exact signed head: npm run check5tasks passed (129 existing warnings, zero errors), npm run check:fast2tasks passed, and npm run verify:browser passed against actual local Chrome.

Related open#763 concerns page-path cookies; its existing correction remains separate. Complex remote key values are not expanded: this preserves the documented partial-coverage contract. The native verifier reports verified: true but unavailable process-lineage evidence (descendant token mismatch); no stronger lineage claim. No other browser/OS or complete database export claim.

AI-assisted implementation and verification; I reviewed the patch and ran the reported checks.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/809 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/indexeddb-key-fingerprint-coverage-20261006` --- ### 📝 Commits (1) - [`866c980`](https://github.com/morluto/rea/commit/866c980caf529c2c3d95d42ac7e5256b32ce55ee) fix: capture IndexedDB object-store record fingerprints ### 📊 Changes **4 files changed** (+67 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/CdpCaptureStorageFingerprints.ts` (+4 -2) ➕ `tests/boundary/browser/cdpBrowserProvider.indexed_db.test.ts` (+41 -0) 📝 `tests/fixtures/fakeCdpBrowserResults.ts` (+21 -4) 📝 `tests/fixtures/fakeCdpBrowserTypes.ts` (+1 -0) </details> ### 📄 Description ## Summary Capture records from IndexedDB object stores by omitting the optional CDP `indexName`. An empty index name requests an index and current Chrome returns `Could not get index`, losing ordinary store fingerprints. Check key and primary-key completeness alongside record values. Date key previews omit millisecond precision; two distinct native keys can therefore produce the same retained hash. These partial remote keys now keep record and overall coverage incomplete instead of claiming complete fingerprints. ## Verification - Owned Chrome154, real IndexedDB transactions, independent `getAllKeys` and native CDP requests, and the public `CdpBrowserProvider.inspectPage`: unchanged main loses records for populated stores; corrected empty and primitive-key controls are complete, Date0/Date1 controls are incomplete. - Focused storage/diff tests:15passed, including two new real protocol-fixture regressions; both new cases fail unchanged source. The HTTP/WebSocket fixture supplements the separate actual Chrome proof. - Exact signed head: `npm run check`5tasks passed (129 existing warnings, zero errors), `npm run check:fast`2tasks passed, and `npm run verify:browser` passed against actual local Chrome. Related open#763 concerns page-path cookies; its existing correction remains separate. Complex remote key values are not expanded: this preserves the documented partial-coverage contract. The native verifier reports `verified: true` but unavailable process-lineage evidence (descendant token mismatch); no stronger lineage claim. No other browser/OS or complete database export claim. AI-assisted implementation and verification; I reviewed the patch and ran the reported checks. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:22 +00:00