[PR #2409] [MERGED] feat(fiddler): inspect native SAZ captures #5207

New issue

Closed

opened 2026-10-31 01:04:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2409
Author: @zahhak
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @N0zoM1z0

Base: main ← Head: docs/fiddler-web-debugging

📝 Commits (6)

21e1e29 feat(fiddler): inspect native SAZ captures
2a0e7e4 chore: synchronize SAZ proposal with current main
e87888b fix(fiddler): preserve body boundaries and page retained capture evidence
2c1f918 chore: reconcile SAZ translations with current main
e000d71 fix(contracts): clarify capture summary request wording
9288458 chore: reconcile capture and Android retained views

📊 Changes

61 files changed (+2237 additions, -285 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+6 -2)
📝 .agents/skills/reverse-engineer-anything/references/runtime-observation.md (+15 -0)
📝 README.md (+1 -1)
📝 docs/.vitepress/config.ts (+4 -0)
📝 docs/browser-observation.md (+4 -0)
📝 docs/client-configuration.md (+6 -0)
📝 docs/packet-captures.md (+1 -1)
📝 docs/web-network-captures.md (+106 -7)
📝 scripts/lib/catalog-builders.mjs (+5 -0)
📝 src/application/WebNetworkCaptureService.ts (+2 -14)
📝 src/application/analysisView/AnalysisViewService.ts (+1 -7)
📝 src/browser/history/CaptureFailures.test.ts (+4 -4)
📝 src/browser/history/CaptureFailures.ts (+13 -11)
📝 src/browser/history/CaptureFormatError.ts (+1 -1)
📝 src/browser/history/CaptureRelease.ts (+13 -6)
➖ src/browser/history/HarCaptureAdapter.ts (+0 -33)
📝 src/browser/history/HistoricalCaptureDecoder.ts (+12 -11)
📝 src/browser/history/HistoricalCaptureFormatAdapter.ts (+1 -0)
➕ src/browser/history/NodeCaptureAdapter.test.ts (+15 -0)
➕ src/browser/history/NodeCaptureAdapter.ts (+58 -0)

...and 41 more files

📄 Description

REA can now inspect recorded SAZ archives directly through the existing historical-capture CLI/MCP workflow, preserving archive coordinates, HTTP fields, stored bytes and Session XML. The admitted profile is the documented raw HTTP/XML layout; producer product/version attribution remains unverified. This is offline analysis of caller-selected files.

The follow-up also adds opt-in detail: "summary" and retained preview/complete record pages. Complete selected Evidence is retained once, and subsequent pages work after the source is removed without launching another decoder. Existing complete replies remain available.

Correctness fixes include the earliest HTTP header/body separator, format-aware XML DTD rejection that permits declaration text inside CDATA/comments, and fail-closed SAZ admission when the runtime cannot enforce a decoder memory bound. UTF-8 validation avoids a redundant full-body copy. ZIP integrity and unsupported-layout checks remain enforced.

Validation on final head 92884580bccecd6cc75c32dfff2859638b5cdbfc:

Typecheck/lint passed. Related compiled CLI/MCP/domain tests passed: 24 tests plus one expected runtime skip; all three Android summary tests passed after reconciling the shared registry with current main.
Three pinned public recorded archives (Mattermost 3.7.0, Mattermost 10.6.1 and Clearinet Encodings) matched an independent Python ZIP/HTTP/XML oracle: 356 sessions, 713 byte fields and 356 XML roots. Built CLI/stdio MCP parity, SDK-converted schemas, retained pages and unchanged input hashes passed again on the final head.
A non-seekable deflater archive with data descriptors, flag 8 and zero local-header sizes passed the public CLI. The ZIP reader uses central-directory sizes.
Full check, generated documentation, test discovery, duplication gate and website checks passed during the follow-up. Final CI remains the merge gate.

Performance: three isolated alternating pairs on the same main compared reading the same first ten record descriptors in two pages. Summary plus retained previews reduced task-call/response text from 217,939 to 7,065 estimated o200k tokens; including the full advertised input catalog, 348,610 to 138,083. Median task wall time was 16.764 s to 12.784 s; sampled process-family peak 942.89 to 906.90 MiB. These are bounded local workflow measurements on the pinned comparison heads, not agent billing or a general speed claim. All heavy local verification used two CPU cores and an 8 GiB process-family guard; no OOM or guard stop occurred.

Scope decision: maintainers accept this bounded historical raw HTTP/XML capability. Live capture/replay, automatic network activity, undocumented layouts and bypassing protection are outside this change. Current Fiddler Everywhere GUI export and actual Bun/macOS/Windows producer workflows remain unverified; no broader support is claimed.

Original implementation by @zahhak; follow-up review, corrections and real-data verification by @N0zoM1z0. Captures and private verification artifacts are not committed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2409 **Author:** [@zahhak](https://github.com/zahhak) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `docs/fiddler-web-debugging` --- ### 📝 Commits (6) - [`21e1e29`](https://github.com/morluto/rea/commit/21e1e29851ffbbe7f2b3c251dd607c20152e448f) feat(fiddler): inspect native SAZ captures - [`2a0e7e4`](https://github.com/morluto/rea/commit/2a0e7e4f4381021a62ae39e1b423a3f6a2341ce7) chore: synchronize SAZ proposal with current main - [`e87888b`](https://github.com/morluto/rea/commit/e87888bb5906cfc415a8b8666082a784fa9652d2) fix(fiddler): preserve body boundaries and page retained capture evidence - [`2c1f918`](https://github.com/morluto/rea/commit/2c1f918115973306161ab8c52788f57c72604d55) chore: reconcile SAZ translations with current main - [`e000d71`](https://github.com/morluto/rea/commit/e000d71e9b2c26c7daec3bf9d16b4bd74d798bb2) fix(contracts): clarify capture summary request wording - [`9288458`](https://github.com/morluto/rea/commit/92884580bccecd6cc75c32dfff2859638b5cdbfc) chore: reconcile capture and Android retained views ### 📊 Changes **61 files changed** (+2237 additions, -285 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+6 -2) 📝 `.agents/skills/reverse-engineer-anything/references/runtime-observation.md` (+15 -0) 📝 `README.md` (+1 -1) 📝 `docs/.vitepress/config.ts` (+4 -0) 📝 `docs/browser-observation.md` (+4 -0) 📝 `docs/client-configuration.md` (+6 -0) 📝 `docs/packet-captures.md` (+1 -1) 📝 `docs/web-network-captures.md` (+106 -7) 📝 `scripts/lib/catalog-builders.mjs` (+5 -0) 📝 `src/application/WebNetworkCaptureService.ts` (+2 -14) 📝 `src/application/analysisView/AnalysisViewService.ts` (+1 -7) 📝 `src/browser/history/CaptureFailures.test.ts` (+4 -4) 📝 `src/browser/history/CaptureFailures.ts` (+13 -11) 📝 `src/browser/history/CaptureFormatError.ts` (+1 -1) 📝 `src/browser/history/CaptureRelease.ts` (+13 -6) ➖ `src/browser/history/HarCaptureAdapter.ts` (+0 -33) 📝 `src/browser/history/HistoricalCaptureDecoder.ts` (+12 -11) 📝 `src/browser/history/HistoricalCaptureFormatAdapter.ts` (+1 -0) ➕ `src/browser/history/NodeCaptureAdapter.test.ts` (+15 -0) ➕ `src/browser/history/NodeCaptureAdapter.ts` (+58 -0) _...and 41 more files_ </details> ### 📄 Description REA can now inspect recorded SAZ archives directly through the existing historical-capture CLI/MCP workflow, preserving archive coordinates, HTTP fields, stored bytes and Session XML. The admitted profile is the documented raw HTTP/XML layout; producer product/version attribution remains unverified. This is offline analysis of caller-selected files. The follow-up also adds opt-in `detail: "summary"` and retained preview/complete record pages. Complete selected Evidence is retained once, and subsequent pages work after the source is removed without launching another decoder. Existing complete replies remain available. Correctness fixes include the earliest HTTP header/body separator, format-aware XML DTD rejection that permits declaration text inside CDATA/comments, and fail-closed SAZ admission when the runtime cannot enforce a decoder memory bound. UTF-8 validation avoids a redundant full-body copy. ZIP integrity and unsupported-layout checks remain enforced. Validation on final head `92884580bccecd6cc75c32dfff2859638b5cdbfc`: - Typecheck/lint passed. Related compiled CLI/MCP/domain tests passed: 24 tests plus one expected runtime skip; all three Android summary tests passed after reconciling the shared registry with current main. - Three pinned public recorded archives (Mattermost 3.7.0, Mattermost 10.6.1 and Clearinet Encodings) matched an independent Python ZIP/HTTP/XML oracle: 356 sessions, 713 byte fields and 356 XML roots. Built CLI/stdio MCP parity, SDK-converted schemas, retained pages and unchanged input hashes passed again on the final head. - A non-seekable deflater archive with data descriptors, flag 8 and zero local-header sizes passed the public CLI. The ZIP reader uses central-directory sizes. - Full check, generated documentation, test discovery, duplication gate and website checks passed during the follow-up. Final CI remains the merge gate. Performance: three isolated alternating pairs on the same main compared reading the same first ten record descriptors in two pages. Summary plus retained previews reduced task-call/response text from 217,939 to 7,065 estimated o200k tokens; including the full advertised input catalog, 348,610 to 138,083. Median task wall time was 16.764 s to 12.784 s; sampled process-family peak 942.89 to 906.90 MiB. These are bounded local workflow measurements on the pinned comparison heads, not agent billing or a general speed claim. All heavy local verification used two CPU cores and an 8 GiB process-family guard; no OOM or guard stop occurred. Scope decision: maintainers accept this bounded historical raw HTTP/XML capability. Live capture/replay, automatic network activity, undocumented layouts and bypassing protection are outside this change. Current Fiddler Everywhere GUI export and actual Bun/macOS/Windows producer workflows remain unverified; no broader support is claimed. Original implementation by @zahhak; follow-up review, corrections and real-data verification by @N0zoM1z0. Captures and private verification artifacts are not committed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:49 +00:00