[PR #3159] [MERGED] fix(captures): admit schema-valid HAR numbers that evidence cannot publish exactly #5647

Closed
opened 2026-10-31 01:08:15 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3159
Author: @pablodiazjorge
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @baron

Base: main ← Head: fix/har-numeric-admission


📝 Commits (2)

  • 7fa4c40 fix(captures): admit schema-valid HAR numbers that evidence cannot publish exactly
  • c68d96c fix(captures): judge overflowing HAR integers by their lexeme

📊 Changes

2 files changed (+107 additions, -17 deletions)

View changed files

📝 src/browser/history/HarCapture.test.ts (+70 -7)
📝 src/browser/history/HarCapture.ts (+37 -10)

📄 Description

Summary

Fixes #3145. inspect-web-network-capture rejected a schema-valid HAR 1.2 capture when a numeric field could not be projected exactly as a JavaScript number, such as "time": 0.123456789012345678901 or "bodySize": 9007199254740993. The pinned HAR schema admits both. The validation copy reused the evidence projection, which publishes such numbers as null, so AJV saw null where the schema expects a number.

Problem and expected behavior

Smallest trigger: replace "time":1.25 with "time":0.123456789012345678901 in the historicalHar() fixture and run rea inspect-web-network-capture <file> har --json. Before this change: exit 1, invalid_format at /log/entries/0/time, HAR schema validation failed: type (must be number). Expected, as the issue states: admit the capture under the unchanged pinned schema, keep the exact producer lexeme in numeric_literals, and keep the unrepresentable published value explicitly unknown.

Change and scope

  • src/browser/history/HarCapture.ts: the validation copy (projectHar(..., false)) now carries each JSON number as its nearest double, and the evidence projection is unchanged: the lexeme stays in numeric_literals and the published value stays null when it is not exactly representable. When rounding or overflow erases a fractional part (for example 9007199254740993.5, 1e-400, or a fraction too large for a double, which becomes Infinity), the copy carries a non-integer instead, so the schema's integer type is judged by the lexeme and not by the double. The number branch moved into a small projectNumber helper inside projectHar, which keeps the visitor under the complexity limit.
  • src/browser/history/HarCapture.test.ts: the second half of keeps unsafe extension numeric lexemes and rejects unsafe mandatory schema numbers (from #992) asserted the rejection this issue reports; it now asserts that a mandatory bodySize of 9007199254740993 is admitted with its lexeme retained and null published. New cases cover a high-precision time and 1e400, and five non-integer lexemes in an integer field that rounding or overflow would turn into integers, which are still rejected.

Not included: the other capture formats. qlog validates its own frames and does not go through this projection. The numeric redaction proposed in #2872 is already on main (CaptureRedaction.number, through f6905719c); this change leaves it as it is and only changes what the validation copy carries.

Contribution scope: not applicable (input admission within an existing decoder).

Contract and boundary impact

  • Semantic owner and earliest changed stage: the HAR decoder's schema validation copy.
  • Contribution scope fit and linked maintainer decision: not applicable.
  • CLI and MCP/tool-catalog contract: no schema change; valid HAR captures that were refused with invalid_format are now admitted.
  • Provider, bridge, target-format, or platform compatibility: HAR only; no platform-specific code.
  • Evidence, artifact, provenance, or reconstruction contract: unchanged; unrepresentable numbers keep their exact lexeme in numeric_literals and null in reported.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): none.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: src/browser/history/HarCapture.test.ts (one updated, eight new cases).
  • Base reproduction or other evidence: on 767fe0f0c without the change, the compiled CLI refuses the time case with type (must be number) at /log/entries/0/time and the bodySize case with type (must be integer) at /log/entries/0/response/bodySize, both with exit 1, as in the issue. The updated and new admission tests fail there for the same reason.
  • User-visible CLI/MCP output (if applicable): with the change, both cases exit 0; the record keeps {"pointer":"/time","producer_type":"json-number","literal":"0.123456789012345678901"} and reports "time": null; bodySize of 9007199254740993.5 still fails with invalid_format, HAR schema validation failed: type (must be integer).
  • Remaining proof gaps: macOS and Linux not run locally; the change has no platform-specific code.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Windows 11 x64 (10.0.26300), Node 24.18.0, npm 11.16.0, branch based on 767fe0f0c, Windows native addon built from that commit.

  • npx vitest run src/browser/history/HarCapture.test.ts — 53 passed.
  • npx vitest run on the 20 test files that reference HAR capture decoding (unit, boundary, CLI, MCP, acceptance and conformance) — 307 passed, 9 skipped.
  • npm run build:cached, then node scripts/rea.mjs inspect-web-network-capture <file> har --json on the unchanged fixture, the high-precision time, the unsafe bodySize, the non-integer bodySize and an overflowing fractional bodySize — exit 0, 0, 0, 1 and 1 (the last two with type (must be integer)); the same files on 767fe0f0c without the change — exit 1 for time and the unsafe bodySize.
  • A standalone check of the validation number against the pinned AJV 8.20.0 for 19 lexemes (including 1.0, 100e-2, -0, 1e400, 1.5e400, 1e-400, 9007199254740993.5 and a 310-digit fraction) — every number/integer result matches JSON Schema draft-06.
  • npm run check:fast — passed.
  • npx tsc --noEmit — passed.
  • npx oxfmt --check and npx oxlint on the two files — passed; no new lint warnings.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; captures that were refused are now admitted, and every evidence field keeps its meaning.
  • Real Hopper/Ghidra, browser, or OS coverage: native Windows with the compiled CLI; no provider involved.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: the validation copy is internal and never published; redaction runs only in the evidence projection, as before.

Author readiness

Human owner: @pablodiazjorge

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3159 **Author:** [@pablodiazjorge](https://github.com/pablodiazjorge) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@baron](https://github.com/baron) **Base:** `main` ← **Head:** `fix/har-numeric-admission` --- ### 📝 Commits (2) - [`7fa4c40`](https://github.com/morluto/rea/commit/7fa4c40d487280ec69f18b3c3afd18a951df5737) fix(captures): admit schema-valid HAR numbers that evidence cannot publish exactly - [`c68d96c`](https://github.com/morluto/rea/commit/c68d96c94fd24a0dd6d0cff6cdacb3be626309fa) fix(captures): judge overflowing HAR integers by their lexeme ### 📊 Changes **2 files changed** (+107 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/history/HarCapture.test.ts` (+70 -7) 📝 `src/browser/history/HarCapture.ts` (+37 -10) </details> ### 📄 Description ## Summary Fixes #3145. `inspect-web-network-capture` rejected a schema-valid HAR 1.2 capture when a numeric field could not be projected exactly as a JavaScript number, such as `"time": 0.123456789012345678901` or `"bodySize": 9007199254740993`. The pinned HAR schema admits both. The validation copy reused the evidence projection, which publishes such numbers as `null`, so AJV saw `null` where the schema expects a number. ## Problem and expected behavior Smallest trigger: replace `"time":1.25` with `"time":0.123456789012345678901` in the `historicalHar()` fixture and run `rea inspect-web-network-capture <file> har --json`. Before this change: exit 1, `invalid_format` at `/log/entries/0/time`, `HAR schema validation failed: type (must be number).` Expected, as the issue states: admit the capture under the unchanged pinned schema, keep the exact producer lexeme in `numeric_literals`, and keep the unrepresentable published value explicitly unknown. ## Change and scope - `src/browser/history/HarCapture.ts`: the validation copy (`projectHar(..., false)`) now carries each JSON number as its nearest double, and the evidence projection is unchanged: the lexeme stays in `numeric_literals` and the published value stays `null` when it is not exactly representable. When rounding or overflow erases a fractional part (for example `9007199254740993.5`, `1e-400`, or a fraction too large for a double, which becomes `Infinity`), the copy carries a non-integer instead, so the schema's `integer` type is judged by the lexeme and not by the double. The number branch moved into a small `projectNumber` helper inside `projectHar`, which keeps the visitor under the complexity limit. - `src/browser/history/HarCapture.test.ts`: the second half of `keeps unsafe extension numeric lexemes and rejects unsafe mandatory schema numbers` (from #992) asserted the rejection this issue reports; it now asserts that a mandatory `bodySize` of `9007199254740993` is admitted with its lexeme retained and `null` published. New cases cover a high-precision `time` and `1e400`, and five non-integer lexemes in an integer field that rounding or overflow would turn into integers, which are still rejected. Not included: the other capture formats. qlog validates its own frames and does not go through this projection. The numeric redaction proposed in #2872 is already on `main` (`CaptureRedaction.number`, through `f6905719c`); this change leaves it as it is and only changes what the validation copy carries. Contribution scope: not applicable (input admission within an existing decoder). ## Contract and boundary impact - Semantic owner and earliest changed stage: the HAR decoder's schema validation copy. - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: no schema change; valid HAR captures that were refused with `invalid_format` are now admitted. - Provider, bridge, target-format, or platform compatibility: HAR only; no platform-specific code. - Evidence, artifact, provenance, or reconstruction contract: unchanged; unrepresentable numbers keep their exact lexeme in `numeric_literals` and `null` in `reported`. - Target selection, authority, upstream behavior, and cleanup details (if applicable): none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/browser/history/HarCapture.test.ts` (one updated, eight new cases). - Base reproduction or other evidence: on `767fe0f0c` without the change, the compiled CLI refuses the `time` case with `type (must be number)` at `/log/entries/0/time` and the `bodySize` case with `type (must be integer)` at `/log/entries/0/response/bodySize`, both with exit 1, as in the issue. The updated and new admission tests fail there for the same reason. - User-visible CLI/MCP output (if applicable): with the change, both cases exit 0; the record keeps `{"pointer":"/time","producer_type":"json-number","literal":"0.123456789012345678901"}` and reports `"time": null`; `bodySize` of `9007199254740993.5` still fails with `invalid_format`, `HAR schema validation failed: type (must be integer).` - Remaining proof gaps: macOS and Linux not run locally; the change has no platform-specific code. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Windows 11 x64 (10.0.26300), Node 24.18.0, npm 11.16.0, branch based on `767fe0f0c`, Windows native addon built from that commit. - `npx vitest run src/browser/history/HarCapture.test.ts` — 53 passed. - `npx vitest run` on the 20 test files that reference HAR capture decoding (unit, boundary, CLI, MCP, acceptance and conformance) — 307 passed, 9 skipped. - `npm run build:cached`, then `node scripts/rea.mjs inspect-web-network-capture <file> har --json` on the unchanged fixture, the high-precision `time`, the unsafe `bodySize`, the non-integer `bodySize` and an overflowing fractional `bodySize` — exit 0, 0, 0, 1 and 1 (the last two with `type (must be integer)`); the same files on `767fe0f0c` without the change — exit 1 for `time` and the unsafe `bodySize`. - A standalone check of the validation number against the pinned AJV 8.20.0 for 19 lexemes (including `1.0`, `100e-2`, `-0`, `1e400`, `1.5e400`, `1e-400`, `9007199254740993.5` and a 310-digit fraction) — every `number`/`integer` result matches JSON Schema draft-06. - `npm run check:fast` — passed. - `npx tsc --noEmit` — passed. - `npx oxfmt --check` and `npx oxlint` on the two files — passed; no new lint warnings. ## Compatibility, safety, and release - Breaking changes or migration steps: none; captures that were refused are now admitted, and every evidence field keeps its meaning. - Real Hopper/Ghidra, browser, or OS coverage: native Windows with the compiled CLI; no provider involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: the validation copy is internal and never published; redaction runs only in the evidence projection, as before. ## Author readiness Human owner: @pablodiazjorge - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:08:15 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5647
No description provided.