[PR #3082] [MERGED] fix(browser): preserve passive network inventory uncertainty #5602

New issue

Closed

opened 2026-10-31 01:07:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:07:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3082
Author: @To3akaRin
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @N0zoM1z0

Base: main ← Head: codex/browser-request-inventory-coverage

📝 Commits (10+)

0ace143 fix(browser): retain inventory changes with unavailable shapes
4450463 fix(javascript): restore read-site ambient aliases and string config reads
d625dfc fix(browser): preserve unknown request identity in inventory diffs
c023db3 Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests
828ccc3 test: cover config value escapes and source-map edge pairing
c0e4aa9 Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests
b911d21 fix(browser): include dropped events in network inventory coverage
aff46f5 test(docs): retarget translated readme link drift at current links
53bcc17 chore: merge current main into passive inventory fix
0fdac09 fix(javascript): admit candidate endpoint interpretation in worker output

📊 Changes

20 files changed (+1500 additions, -121 deletions)

View changed files

📝 docs/browser-observation.md (+26 -0)
📝 docs/javascript-application-workflows.md (+5 -0)
📝 docs/mcp-contracts.md (+12 -7)
📝 docs/web-network-captures.md (+5 -1)
📝 src/browser/CdpCaptureDocuments.test.ts (+2 -0)
📝 src/contracts/inputSchemaPresentation.ts (+2 -2)
📝 src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts (+23 -0)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+18 -9)
📝 src/domain/jsonValue.test.ts (+12 -0)
➕ src/domain/webCaptureDiff.network.test.ts (+679 -0)
📝 src/domain/webCaptureDiff.ts (+189 -81)
📝 src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts (+26 -0)
📝 tests/acceptance/applications/javascriptCancellationCli.test.ts (+29 -3)
📝 tests/acceptance/applications/javascriptConfigurationReadsCli.test.ts (+21 -0)
📝 tests/acceptance/applications/runtime.test.ts (+60 -11)
➕ tests/acceptance/tools/passiveNetworkInventory.test.ts (+215 -0)
📝 tests/boundary/browser/sazWebCapture.test.ts (+26 -2)
📝 tests/boundary/mcp/browserComparisonInput.test.ts (+2 -2)
📝 tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts (+19 -3)
➕ tests/fixtures/passiveNetworkCapture.ts (+129 -0)

📄 Description

Summary

Offline passive network comparisons now preserve uncertainty when request types, selected metadata, or per-kind inventory coverage are incomplete. Missing body/response content no longer erases a proven HTTP addition; incomplete HTTP coverage cannot establish WebSocket absence.

Follow-up to #2609. The original commits/authors are preserved, integrated with main through b8510ee00. Additional review reproduced and repaired nullable redirect-type and duplicate-count false modifications.

Change and ownership

Keep identity/type ambiguity, selected-content projection and HTTP/WebSocket inventory coverage with webCaptureDiff.ts.
Exclude potentially matching unknown-type groups before their counts/content fingerprints can invent a match. Skip that endpoint index when all types are known.
Select only mutually known redirect metadata, including resource type, and have that owner report completeness directly.
With incomplete HTTP inventory, compare distinct known content samples without claiming duplicate request multiplicity. WebSocket stream inventories/counts require complete WebSocket coverage. Independently known metadata and complete-inventory count changes remain reportable.
Hash HTTP rows during projection and retain digests rather than an intermediate collection of raw projection objects.
Give each public CLI case its own deadline and reuse one owned SDK connection for the MCP matrix. No timeout, retry, assertion or CI selection was loosened.

Shared fixes already included in the original branch remain: conservative JavaScript process-configuration escapes, malformed JSON rejection coverage, schema-projection documentation, cancellation at controlled child progress boundaries, and SAZ byte/provenance checks. Current main's redirect response owner, tuple/schema-profile fixes and MCP fault barriers are retained.

CLI/MCP schemas, Evidence and session envelopes remain unchanged by the network fix. It compares supplied observations; no new capture, replay, execution, injection or installation authority is added. This is an ordinary correctness fix within existing scope; an additional capability decision is not applicable.

Executed correctness evidence

Linux, Node 24.18.0 / npm 11.16.0; serial two-CPU / 8 GiB guards:

Original domain cases: 35 passed after integration. New known↔missing redirect-type cases failed in both directions before repair. Three dropped/truncated/unavailable duplicate-request cases also failed before repair.
Current domain suite: 45 passed, including negative and positive redirect, HTTP and WebSocket controls. Incomplete capture keeps known metadata changes while retaining uncertainty about counts/absence.
Full related selection: 196 passed / 3 conditionally skipped across 13 files, including JavaScript configuration/cancellation, JSON, SAZ, CLI and real stdio MCP. The initial aggregate CLI case exceeded its 30-second deadline; splitting its cases fixed this structural failure without increasing timeouts.
Public matrix: 20 individually tested CLI comparisons plus 20 comparisons on one production SDK connection; 21 tests passed. After current main's contract updates, 51 tests across the public comparison selections passed.
npm run check, npm run docs:check and npm run verify:test-discovery passed; 1,287 test files discovered exactly once. On final head 4121cfa83, current-main static checks, docs checks and the six actual-file CLI/SDK comparisons all passed again.

Real program/provider evidence: a local HTTP redirect/fetch application in Chromium 153.0.8010.12, observed through the production CDP provider. Two recordings each retained two HTTP requests and one redirect; 200 → 201 was correctly reported as one metadata modification. A separately labelled derivative with one optional redirect type omitted returned unknown in both directions. An initial navigation attempt correctly returned target_changed; changing the probe to fixed-page fetches respected the inspection boundary. Browser/profile cleanup completed.

Those actual recordings and the labelled derivative passed six public CLI/real stdio SDK calls, including output-schema validation and unchanged source-file SHA-256 checks. No complete live-CDP inventory, native Windows/macOS execution or deep native provider coverage is claimed. The normalized fixture matrix and amplified benchmark are labelled synthetic.

Performance and context

Equivalent completed domain task with 10,000 synthetic repetitions of a genuine recorded API request: integration baseline first/warm comparisons 334 / 268–273 ms, updated 318 / 259–260 ms. Sampled peak process RSS 181 → 160 MiB; result JSON remained 2,136 bytes. Three samples are observations, not a statistical speedup claim. No persistent cache or new result fields were added.

Real public calls returned 3.7–3.8 KB CLI JSON; final warmed SDK calls took 9 ms after the first 113 ms call (the initial run was 11–13 / 160 ms). SDK full transport responses were 7.7–8.0 KB because they include text and structured content. Agent tokens were not measured. The existing one-time SDK catalog was measured separately at 3.09 MB initially and 3.17 MB after current main's schema changes and is outside this network-change scope.

Full related testing peaked at 2.05 GiB; static checks at 4.46 GiB; real Chromium at 1.10 GiB. No local guard stop or OOM.

Author readiness

Human owner: @N0zoM1z0

Recorded from the owner's explicit standing declarations for the remaining approved bug-fix batch. Technical review and executed evidence above were performed by the agent; ownership remains with the named human.

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3082 **Author:** [@To3akaRin](https://github.com/To3akaRin) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `codex/browser-request-inventory-coverage` --- ### 📝 Commits (10+) - [`0ace143`](https://github.com/morluto/rea/commit/0ace143771196eec8d7fcf0df506203999172a08) fix(browser): retain inventory changes with unavailable shapes - [`4450463`](https://github.com/morluto/rea/commit/44504630193253978d1de919bcbb0645652c7b32) fix(javascript): restore read-site ambient aliases and string config reads - [`d625dfc`](https://github.com/morluto/rea/commit/d625dfcccfd2df46a0940c91e46338d83463e1d0) fix(browser): preserve unknown request identity in inventory diffs - [`c023db3`](https://github.com/morluto/rea/commit/c023db356f14fe8cc5ebee7aa2cc2d497677d8c8) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests - [`828ccc3`](https://github.com/morluto/rea/commit/828ccc36b65c0ea373cddc227998b5b9bcef7b28) test: cover config value escapes and source-map edge pairing - [`c0e4aa9`](https://github.com/morluto/rea/commit/c0e4aa91bb72411adfc4d5c5cf8d4d7ad892998f) Merge remote-tracking branch 'origin/main' into fix/main-red-ida-javascript-tests - [`b911d21`](https://github.com/morluto/rea/commit/b911d21f7e9c39dd3930789e8eae3594efeb0c82) fix(browser): include dropped events in network inventory coverage - [`aff46f5`](https://github.com/morluto/rea/commit/aff46f51fdb38f3c1c481af59099c1c4de837161) test(docs): retarget translated readme link drift at current links - [`53bcc17`](https://github.com/morluto/rea/commit/53bcc1797e2d153392b0518f1e8986c1409d9a72) chore: merge current main into passive inventory fix - [`0fdac09`](https://github.com/morluto/rea/commit/0fdac09259eabafc7f852723c20d034e324590c2) fix(javascript): admit candidate endpoint interpretation in worker output ### 📊 Changes **20 files changed** (+1500 additions, -121 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+26 -0) 📝 `docs/javascript-application-workflows.md` (+5 -0) 📝 `docs/mcp-contracts.md` (+12 -7) 📝 `docs/web-network-captures.md` (+5 -1) 📝 `src/browser/CdpCaptureDocuments.test.ts` (+2 -0) 📝 `src/contracts/inputSchemaPresentation.ts` (+2 -2) 📝 `src/domain/javascript/javascriptSemanticAnalysis.native_bindings.test.ts` (+23 -0) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+18 -9) 📝 `src/domain/jsonValue.test.ts` (+12 -0) ➕ `src/domain/webCaptureDiff.network.test.ts` (+679 -0) 📝 `src/domain/webCaptureDiff.ts` (+189 -81) 📝 `src/javascript/analysis/JavaScriptAnalysisWorkerSchemas.test.ts` (+26 -0) 📝 `tests/acceptance/applications/javascriptCancellationCli.test.ts` (+29 -3) 📝 `tests/acceptance/applications/javascriptConfigurationReadsCli.test.ts` (+21 -0) 📝 `tests/acceptance/applications/runtime.test.ts` (+60 -11) ➕ `tests/acceptance/tools/passiveNetworkInventory.test.ts` (+215 -0) 📝 `tests/boundary/browser/sazWebCapture.test.ts` (+26 -2) 📝 `tests/boundary/mcp/browserComparisonInput.test.ts` (+2 -2) 📝 `tests/boundary/mcp/enhancedTools.callPathsAndBatches.test.ts` (+19 -3) ➕ `tests/fixtures/passiveNetworkCapture.ts` (+129 -0) </details> ### 📄 Description ## Summary Offline passive network comparisons now preserve uncertainty when request types, selected metadata, or per-kind inventory coverage are incomplete. Missing body/response content no longer erases a proven HTTP addition; incomplete HTTP coverage cannot establish WebSocket absence. Follow-up to #2609. The original commits/authors are preserved, integrated with main through b8510ee00. Additional review reproduced and repaired nullable redirect-type and duplicate-count false modifications. ## Change and ownership - Keep identity/type ambiguity, selected-content projection and HTTP/WebSocket inventory coverage with `webCaptureDiff.ts`. - Exclude potentially matching unknown-type groups before their counts/content fingerprints can invent a match. Skip that endpoint index when all types are known. - Select only mutually known redirect metadata, including resource type, and have that owner report completeness directly. - With incomplete HTTP inventory, compare distinct known content samples without claiming duplicate request multiplicity. WebSocket stream inventories/counts require complete WebSocket coverage. Independently known metadata and complete-inventory count changes remain reportable. - Hash HTTP rows during projection and retain digests rather than an intermediate collection of raw projection objects. - Give each public CLI case its own deadline and reuse one owned SDK connection for the MCP matrix. No timeout, retry, assertion or CI selection was loosened. Shared fixes already included in the original branch remain: conservative JavaScript process-configuration escapes, malformed JSON rejection coverage, schema-projection documentation, cancellation at controlled child progress boundaries, and SAZ byte/provenance checks. Current main's redirect response owner, tuple/schema-profile fixes and MCP fault barriers are retained. CLI/MCP schemas, Evidence and session envelopes remain unchanged by the network fix. It compares supplied observations; no new capture, replay, execution, injection or installation authority is added. This is an ordinary correctness fix within existing scope; an additional capability decision is not applicable. ## Executed correctness evidence Linux, Node 24.18.0 / npm 11.16.0; serial two-CPU / 8 GiB guards: - Original domain cases: **35 passed** after integration. New known↔missing redirect-type cases failed in both directions before repair. Three dropped/truncated/unavailable duplicate-request cases also failed before repair. - Current domain suite: **45 passed**, including negative and positive redirect, HTTP and WebSocket controls. Incomplete capture keeps known metadata changes while retaining uncertainty about counts/absence. - Full related selection: **196 passed / 3 conditionally skipped across 13 files**, including JavaScript configuration/cancellation, JSON, SAZ, CLI and real stdio MCP. The initial aggregate CLI case exceeded its 30-second deadline; splitting its cases fixed this structural failure without increasing timeouts. - Public matrix: 20 individually tested CLI comparisons plus 20 comparisons on one production SDK connection; **21 tests passed**. After current main's contract updates, **51 tests across the public comparison selections passed**. - `npm run check`, `npm run docs:check` and `npm run verify:test-discovery` passed; 1,287 test files discovered exactly once. On final head 4121cfa83, current-main static checks, docs checks and the six actual-file CLI/SDK comparisons all passed again. Real program/provider evidence: a local HTTP redirect/fetch application in **Chromium 153.0.8010.12**, observed through the production CDP provider. Two recordings each retained two HTTP requests and one redirect; `200 → 201` was correctly reported as one metadata modification. A separately labelled derivative with one optional redirect type omitted returned `unknown` in both directions. An initial navigation attempt correctly returned `target_changed`; changing the probe to fixed-page fetches respected the inspection boundary. Browser/profile cleanup completed. Those actual recordings and the labelled derivative passed **six public CLI/real stdio SDK calls**, including output-schema validation and unchanged source-file SHA-256 checks. No complete live-CDP inventory, native Windows/macOS execution or deep native provider coverage is claimed. The normalized fixture matrix and amplified benchmark are labelled synthetic. ## Performance and context Equivalent completed domain task with 10,000 synthetic repetitions of a genuine recorded API request: integration baseline first/warm comparisons **334 / 268–273 ms**, updated **318 / 259–260 ms**. Sampled peak process RSS **181 → 160 MiB**; result JSON remained **2,136 bytes**. Three samples are observations, not a statistical speedup claim. No persistent cache or new result fields were added. Real public calls returned **3.7–3.8 KB CLI JSON**; final warmed SDK calls took **9 ms** after the first 113 ms call (the initial run was 11–13 / 160 ms). SDK full transport responses were 7.7–8.0 KB because they include text and structured content. Agent tokens were not measured. The existing one-time SDK catalog was measured separately at 3.09 MB initially and 3.17 MB after current main's schema changes and is outside this network-change scope. Full related testing peaked at **2.05 GiB**; static checks at **4.46 GiB**; real Chromium at **1.10 GiB**. No local guard stop or OOM. ## Author readiness Human owner: @N0zoM1z0 Recorded from the owner's explicit standing declarations for the remaining approved bug-fix batch. Technical review and executed evidence above were performed by the agent; ownership remains with the named human. - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:07:54 +00:00