[PR #2277] [MERGED] feat(browser): inspect retained aioquic qlog JSON captures #5133

New issue

Closed

opened 2026-10-31 01:04:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2277
Author: @LuisTaffelli
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/qlog-aioquic-json03

📝 Commits (10+)

a75517e feat(browser): inspect retained aioquic qlog JSON captures
ec2d251 fix(adb): count UTF-8 bytes in logcat total_bytes (#2212)
f941968 fix(ci): allow cold Chrome startup in runtime fixtures
47a51b0 fix(process): add an opt-in Swift module cache (#2252)
fd985db fix(apple): join recognized keys from NIBArchive field maps (#2248)
916ac97 fix(cli): retain browser and Inspector input correction details (#2230)
aeee507 feat(sqlite): inspect offline snapshots with selective evidence (#2271)
0043d9b fix(browser): report mismatched event family selection as unknown in capture comparison (#2239)
e20994a fix(ghidra): keep JVM warnings out of LaunchSupport output (#1698)
0365454 docs(agents): require brittleness review before resolving threads

📊 Changes

571 files changed (+68462 additions, -33761 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+40 -4)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+27 -0)
📝 .agents/skills/reverse-engineer-anything/references/runtime-observation.md (+15 -0)
📝 .github/workflows/ci.yml (+6 -0)
➕ .github/workflows/real-packet-capture.yml (+50 -0)
➕ .github/workflows/real-signal-recording.yml (+50 -0)
➕ .github/workflows/sqlite-runtime.yml (+37 -0)
📝 AGENTS.md (+2 -0)
📝 README.md (+5 -2)
📝 README_ar.md (+2 -0)
📝 README_de.md (+2 -0)
📝 README_es.md (+2 -0)
📝 README_fa.md (+20 -18)
📝 README_fr.md (+2 -0)
📝 README_id.md (+2 -0)
📝 README_it.md (+2 -0)
📝 README_ja.md (+2 -0)
📝 README_ko.md (+2 -0)
📝 README_pl.md (+2 -0)
📝 README_pt-BR.md (+2 -0)

...and 80 more files

📄 Description

REA can now inspect retained aioquic 1.5.0 JSON qlog 0.3 event objects through the shared historical-capture CLI/MCP workflow. Original event ordinals, JSON pointers, fields and numeric lexemes are preserved. A typed facet reports trace-scoped STREAM interval unions and endpoint loss declarations; overlap does not establish retransmission and declarations do not prove actual network loss.

The follow-up synchronizes with current main/SAZ, removes the competing JSON worker, and shares one bounded Node decoder across HAR/SAZ/qlog. New qlog admission fails where no Node heap or Windows Job Object memory bound can be enforced. Other qlog layouts remain unsupported.

Opt-in detail: "summary" retains complete selected Evidence once. inspect_analysis_view kind qlog pages trace/stream summaries, loss declarations, incomplete-record ordinals, contributions, covered ranges and final-size lists with explicit selectors and exact advertised schemas. Fact scope remains all recorded events before selection. Capture event preview/complete pages preserve original ordinals and time lexemes. Views work after source deletion without another decoder launch. Application-owned validation returns structured errors, including missing selectors.

Validation on b174c45017069a1e2933837d8340b2f71de6125b:

Initial integration: 80 tests passed with one expected runtime skip. Follow-up public checks cover all seven fact facets, CLI/stdio SDK parity, retained source deletion, identical stream IDs in different traces, malformed/oversized input, and actual HAR/qlog heap exhaustion with continued MCP usability. Final focused domain/contract checks: 28 passed.
Full check and final typecheck/lint/docs checks passed. Duplication is 2.97%; all 1,010 test files are discovered once.
Real producer verification: isolated aioquic 1.5.0 HTTP/3 server/client, TLS certificate verification, exact received payloads, 32 KiB and 512 KiB downloads, ordinary and single deliberately suppressed server UDP datagram lanes. An independent Python sweep-line oracle matched all stream contributions/coverage/totals across four files, 3,848 events and 32 trace-scoped streams. Larger ordinary loopback runs contain actual recorded endpoint loss declarations; no zero-loss assumption was made. Artifact hashes, event times, CLI/MCP Evidence IDs, SDK schemas, authentication exclusions and selection scope passed.

Performance (same final binary, three alternating pairs, fresh MCP sessions, warm filesystem): inspect the first ten events in two pages plus sent stream 0 byte totals. Complete selection replies versus summary/retained pages returned identical task facts. Estimated o200k task input/output text: 29,589 to 6,474 tokens; including the full advertised input catalog, 161,882 to 138,767. Median task wall: 9.098 s to 9.241 s; CPU: 10.798 s to 11.070 s; sampled family peak: 823.54 to 838.82 MiB. Retained page calls were 28–90 ms. This demonstrates lower returned context, not a general speedup or actual agent billing. All heavy local work used two CPU cores and an 8 GiB family guard; maximum observed gate peak was 5,789.8 MiB with no OOM/guard stop.

Scope: offline caller-selected recordings only; no body reconstruction, PCAP/keylog parsing, live requests, target attribution or producer authentication by format selection. Linux/Node and actual aioquic production were verified; macOS/Windows/Bun producer execution, qlog-specific induced cancellation and the separate reply ceiling/deadline remain unverified. Shared lifecycle tests do not establish real-platform behavior. Captures, certificates, keys and private benchmark artifacts are not committed.

Original implementation by @LuisTaffelli; follow-up review, fixes and real-data verification by @N0zoM1z0. CI is the final merge gate. Future profiles/correlation remain separate scope decisions.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2277 **Author:** [@LuisTaffelli](https://github.com/LuisTaffelli) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/qlog-aioquic-json03` --- ### 📝 Commits (10+) - [`a75517e`](https://github.com/morluto/rea/commit/a75517e2fa0282ef2dfa53c57f33bdd332de8a71) feat(browser): inspect retained aioquic qlog JSON captures - [`ec2d251`](https://github.com/morluto/rea/commit/ec2d251c0ad8382e0665546be5ec8f5f1c175962) fix(adb): count UTF-8 bytes in logcat total_bytes (#2212) - [`f941968`](https://github.com/morluto/rea/commit/f941968eb1860dd41efc2a5201b35cecca42301d) fix(ci): allow cold Chrome startup in runtime fixtures - [`47a51b0`](https://github.com/morluto/rea/commit/47a51b08f4d79f808c1b74de79c3852aa853df53) fix(process): add an opt-in Swift module cache (#2252) - [`fd985db`](https://github.com/morluto/rea/commit/fd985dbc5b9435918732c0cc1825060af2a3a47e) fix(apple): join recognized keys from NIBArchive field maps (#2248) - [`916ac97`](https://github.com/morluto/rea/commit/916ac97bf9f7b976982e438ceb856a9692576cb1) fix(cli): retain browser and Inspector input correction details (#2230) - [`aeee507`](https://github.com/morluto/rea/commit/aeee5074d124414239b6dd440dc79c26bcbd58a4) feat(sqlite): inspect offline snapshots with selective evidence (#2271) - [`0043d9b`](https://github.com/morluto/rea/commit/0043d9b134c0a353e8bf85c0bde4492275f1f720) fix(browser): report mismatched event family selection as unknown in capture comparison (#2239) - [`e20994a`](https://github.com/morluto/rea/commit/e20994a8ea10609d420e958bd8a1268b0bcd8899) fix(ghidra): keep JVM warnings out of LaunchSupport output (#1698) - [`0365454`](https://github.com/morluto/rea/commit/0365454a573eb52c7089320fd74bfd4a673b78ae) docs(agents): require brittleness review before resolving threads ### 📊 Changes **571 files changed** (+68462 additions, -33761 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+40 -4) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+27 -0) 📝 `.agents/skills/reverse-engineer-anything/references/runtime-observation.md` (+15 -0) 📝 `.github/workflows/ci.yml` (+6 -0) ➕ `.github/workflows/real-packet-capture.yml` (+50 -0) ➕ `.github/workflows/real-signal-recording.yml` (+50 -0) ➕ `.github/workflows/sqlite-runtime.yml` (+37 -0) 📝 `AGENTS.md` (+2 -0) 📝 `README.md` (+5 -2) 📝 `README_ar.md` (+2 -0) 📝 `README_de.md` (+2 -0) 📝 `README_es.md` (+2 -0) 📝 `README_fa.md` (+20 -18) 📝 `README_fr.md` (+2 -0) 📝 `README_id.md` (+2 -0) 📝 `README_it.md` (+2 -0) 📝 `README_ja.md` (+2 -0) 📝 `README_ko.md` (+2 -0) 📝 `README_pl.md` (+2 -0) 📝 `README_pt-BR.md` (+2 -0) _...and 80 more files_ </details> ### 📄 Description REA can now inspect retained aioquic 1.5.0 JSON qlog 0.3 event objects through the shared historical-capture CLI/MCP workflow. Original event ordinals, JSON pointers, fields and numeric lexemes are preserved. A typed facet reports trace-scoped STREAM interval unions and endpoint loss declarations; overlap does not establish retransmission and declarations do not prove actual network loss. The follow-up synchronizes with current main/SAZ, removes the competing JSON worker, and shares one bounded Node decoder across HAR/SAZ/qlog. New qlog admission fails where no Node heap or Windows Job Object memory bound can be enforced. Other qlog layouts remain unsupported. Opt-in `detail: "summary"` retains complete selected Evidence once. `inspect_analysis_view` kind `qlog` pages trace/stream summaries, loss declarations, incomplete-record ordinals, contributions, covered ranges and final-size lists with explicit selectors and exact advertised schemas. Fact scope remains all recorded events before selection. Capture event preview/complete pages preserve original ordinals and time lexemes. Views work after source deletion without another decoder launch. Application-owned validation returns structured errors, including missing selectors. Validation on `b174c45017069a1e2933837d8340b2f71de6125b`: - Initial integration: 80 tests passed with one expected runtime skip. Follow-up public checks cover all seven fact facets, CLI/stdio SDK parity, retained source deletion, identical stream IDs in different traces, malformed/oversized input, and actual HAR/qlog heap exhaustion with continued MCP usability. Final focused domain/contract checks: 28 passed. - Full check and final typecheck/lint/docs checks passed. Duplication is 2.97%; all 1,010 test files are discovered once. - Real producer verification: isolated aioquic 1.5.0 HTTP/3 server/client, TLS certificate verification, exact received payloads, 32 KiB and 512 KiB downloads, ordinary and single deliberately suppressed server UDP datagram lanes. An independent Python sweep-line oracle matched all stream contributions/coverage/totals across four files, 3,848 events and 32 trace-scoped streams. Larger ordinary loopback runs contain actual recorded endpoint loss declarations; no zero-loss assumption was made. Artifact hashes, event times, CLI/MCP Evidence IDs, SDK schemas, authentication exclusions and selection scope passed. Performance (same final binary, three alternating pairs, fresh MCP sessions, warm filesystem): inspect the first ten events in two pages plus sent stream 0 byte totals. Complete selection replies versus summary/retained pages returned identical task facts. Estimated o200k task input/output text: 29,589 to 6,474 tokens; including the full advertised input catalog, 161,882 to 138,767. Median task wall: 9.098 s to 9.241 s; CPU: 10.798 s to 11.070 s; sampled family peak: 823.54 to 838.82 MiB. Retained page calls were 28–90 ms. This demonstrates lower returned context, not a general speedup or actual agent billing. All heavy local work used two CPU cores and an 8 GiB family guard; maximum observed gate peak was 5,789.8 MiB with no OOM/guard stop. Scope: offline caller-selected recordings only; no body reconstruction, PCAP/keylog parsing, live requests, target attribution or producer authentication by format selection. Linux/Node and actual aioquic production were verified; macOS/Windows/Bun producer execution, qlog-specific induced cancellation and the separate reply ceiling/deadline remain unverified. Shared lifecycle tests do not establish real-platform behavior. Captures, certificates, keys and private benchmark artifacts are not committed. Original implementation by @LuisTaffelli; follow-up review, fixes and real-data verification by @N0zoM1z0. CI is the final merge gate. Future profiles/correlation remain separate scope decisions. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:14 +00:00