[PR #4186] [CLOSED] fix(pcap): preserve timestamps from older Wireshark 4.x output #6116

New issue

Closed

opened 2026-10-31 01:12:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:00 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4186
Author: @ketpatil77
Created: 10/15/2026
Status: ❌ Closed

Base: main ← Head: fix/capinfos-legacy-time-labels

📝 Commits (1)

7bcb437 fix(pcap): read Wireshark 4.0 and 4.2 capture timestamps

📊 Changes

2 files changed (+26 additions, -2 deletions)

View changed files

📝 src/pcap/PcapConfiguration.test.ts (+20 -0)
📝 src/pcap/PcapOutput.ts (+6 -2)

📄 Description

Summary

Fixes #4180. Preserve capture start/end times from Wireshark 4.0/4.2 capinfos output.

Problem and expected behavior

The parser recognized only “Earliest/Latest packet time”. Supported older Wireshark 4.x producers emit “First/Last packet time”, so populated timestamps became null.

Change and scope

Accept the older labels as fallbacks at the existing capinfos parsing boundary. No provider, execution-authority, or schema changes; no additional maintainer scope decision is applicable.

Contract and boundary impact

Semantic owner: parseCapinfosOutput, producer-output parsing.
CLI/MCP: existing nullable fields now retain available producer timestamps.
Compatibility: both label pairs supported; absent fields remain null.
Evidence/provenance: preserve producer strings; no date reinterpretation.
Target selection, authority, cleanup: unchanged.
Generated metadata, packaging, installation: none.
Effects: only existing captured-data parsing.

Evidence and regression coverage

Added legacy-label equality and absent-timestamp regressions.
The legacy-label test failed before the fix (both timestamps null).
Vitest: PcapConfiguration.test.ts plus boundary/mcp/pcapMcp.test.ts, 17 passed.
oxfmt applied; git diff --check passed.
Focused oxlint completed with complexity/size warnings in PcapOutput.ts.
No real capinfos executable or live packet capture was exercised here. The MCP boundary test uses the existing fixture producer; it does not prove real-tool integration.

Compatibility and risk

Existing field shapes and timestamp strings are preserved. No release metadata changes, network access, target execution, or containment changes.

Author readiness

Human owner: @ketpatil77

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

Human readiness and hosted checks remain pending. This draft is submitted for the human owner to inspect before requesting initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4186 **Author:** [@ketpatil77](https://github.com/ketpatil77) **Created:** 10/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/capinfos-legacy-time-labels` --- ### 📝 Commits (1) - [`7bcb437`](https://github.com/morluto/rea/commit/7bcb43788a37553d1593df6e0620a77dce6a0a1e) fix(pcap): read Wireshark 4.0 and 4.2 capture timestamps ### 📊 Changes **2 files changed** (+26 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/pcap/PcapConfiguration.test.ts` (+20 -0) 📝 `src/pcap/PcapOutput.ts` (+6 -2) </details> ### 📄 Description ## Summary Fixes #4180. Preserve capture start/end times from Wireshark 4.0/4.2 capinfos output. ## Problem and expected behavior The parser recognized only “Earliest/Latest packet time”. Supported older Wireshark 4.x producers emit “First/Last packet time”, so populated timestamps became null. ## Change and scope Accept the older labels as fallbacks at the existing capinfos parsing boundary. No provider, execution-authority, or schema changes; no additional maintainer scope decision is applicable. ## Contract and boundary impact - Semantic owner: parseCapinfosOutput, producer-output parsing. - CLI/MCP: existing nullable fields now retain available producer timestamps. - Compatibility: both label pairs supported; absent fields remain null. - Evidence/provenance: preserve producer strings; no date reinterpretation. - Target selection, authority, cleanup: unchanged. - Generated metadata, packaging, installation: none. - Effects: only existing captured-data parsing. ## Evidence and regression coverage - Added legacy-label equality and absent-timestamp regressions. - The legacy-label test failed before the fix (both timestamps null). - Vitest: PcapConfiguration.test.ts plus boundary/mcp/pcapMcp.test.ts, 17 passed. - oxfmt applied; git diff --check passed. - Focused oxlint completed with complexity/size warnings in PcapOutput.ts. - No real capinfos executable or live packet capture was exercised here. The MCP boundary test uses the existing fixture producer; it does not prove real-tool integration. ## Compatibility and risk Existing field shapes and timestamp strings are preserved. No release metadata changes, network access, target execution, or containment changes. ## Author readiness Human owner: @ketpatil77 - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge Human readiness and hosted checks remain pending. This draft is submitted for the human owner to inspect before requesting initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:00 +00:00