morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7225] [MERGED] fix(har): accept Chrome DevTools bracketed IPv6 server addresses #7728

New issue

Closed

opened 2026-11-03 13:39:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-03 13:39:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7225
Author: @JayOfTheKeyboard
Created: 10/26/2026
Status: ✅ Merged
Merged: 11/3/2026
Merged by: @morluto

Base: main ← Head: fix/har-chrome-devtools-ipv6

📝 Commits (1)

7681ef6 fix(har): accept Chrome DevTools bracketed IPv6 server addresses

📊 Changes

4 files changed (+89 additions, -24 deletions)

View changed files

📝 docs/web-network-captures.md (+6 -2)
📝 src/browser/history/HarCapture.test.ts (+34 -0)
📝 src/browser/history/HarCapture.ts (+9 -8)
📝 src/browser/history/HarSchema.ts (+40 -14)

📄 Description

Summary

inspect_web_network_capture refuses a whole HAR exported from Chrome DevTools as soon as one entry was served over IPv6. f14c2d4df (#3161) fixed the same thing for Playwright 1.58.2. Chrome's own "Export HAR" writes the same bracketed form, so this extends that adaptation to it.

No linked issue: the failure reproduces on a public Chrome export, shown below.

Problem and expected behavior

Chrome DevTools declares its HAR creator as WebInspector with the AppleWebKit version from Chromium's user agent, frozen at 537.36 for years. Its HAR writer (Log.ts) cuts the port off remoteAddress() with lastIndexOf(':'), then tries to drop the brackets with ipAddress.replace(/\[\]/g, ''). That regex only matches the literal string [], so [2620:0:860:ed1a::1]:443 is written as [2620:0:860:ed1a::1].

A real Chrome export of a Wikipedia page load (88 entries, CredData test corpus, test/data/validHARFiles/ipv6File.har):

$ rea inspect-web-network-capture ipv6File.har har --format json
"code": "invalid_request"
"issues": [{"path": ["capture_path", "/log/entries/0/serverIPAddress"],
  "message": "HAR schema validation failed: format (must match format \"ipv4\")."}]

Expected: the capture decodes, as a Playwright 1.58.2 capture with the same addresses already does.

Change and scope

HarSchema.ts: the bracket adaptation is keyed by a small table of observed producers (name, version, label), now Playwright 1.58.2 and WebInspector 537.36. Every Chromium-based DevTools declares that creator, so the label is "Chromium DevTools". The rules are unchanged: brackets come off only in the disposable validation copy, and only around a valid IPv6 literal.
HarCapture.ts: the per-entry limitation names the declared producer instead of always saying Playwright 1.58.2. Playwright captures keep the exact text they had, so their Evidence identities do not change.
docs/web-network-captures.md says why Chromium's export is bracketed, citing Log.ts at a pinned commit.

Contribution scope: an ordinary fix inside the existing HAR import boundary; a maintainer scope decision is not applicable.

Left out, yours to decide: the same Chrome export of another site (chargebee.com.har, 268 entries) also fails, on /log/entries/62/timings/blocked = -0.771. Chrome writes small negative blocked values (18 of its 268 entries) and clamps them in its own time sum with Math.max(t, 0). Accepting them means loosening a timing rule, which is a separate decision, so it is not in this PR.

Contract and boundary impact

Semantic owner and earliest changed stage: HAR schema validation (src/browser/history/HarSchema.ts), read by HarCapture.ts for the per-entry limitation.
Contribution scope fit and linked maintainer decision: not applicable (fix within the existing boundary).
CLI and MCP/tool-catalog contract: unchanged; the Chrome capture now decodes instead of returning invalid_request.
Provider, bridge, target-format, or platform compatibility: adds Chromium DevTools HAR (WebInspector 537.36) next to Playwright 1.58.2.
Evidence, artifact, provenance, or reconstruction contract: original address spelling is kept in Evidence; Playwright limitation text is byte-identical to before.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: none.
Read existing files or captured data.

Evidence and regression coverage

Tests added or updated: HarCapture.test.ts: two Chromium DevTools addresses keep their original spelling and get the producer-named limitation; a different WebInspector version, bracketed IPv4, and an address with a port stay rejected.
Base reproduction or other evidence: both "retains" cases fail on main baec375c3 with HAR schema validation failed: format (must match format "ipv4") and pass with the fix. Changing the WebInspector row's version, changing its label, or accepting any IP family inside the brackets each turns two tests red.
User-visible CLI/MCP output: the 88-entry Chrome export decodes through the built CLI: 88 records, spellings like [2620:0:860:ed1a::1] kept, limitation on the 87 bracketed entries.
Remaining proof gaps: Chrome's negative timings.blocked (above) is not handled. Only Chromium 537.36 exports were tested; other WebInspector versions stay rejected on purpose.
Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On 7681ef63d (rebased onto main baec375c3):

vitest run src/browser/history/ — 252 passed
vitest run tests/boundary/browser/ — 1239 passed, 1 skipped
npm run check:fast — passes
npm run docs:check — passes

Before the rebase: lint:typed (no new findings in the changed files), oxfmt --check, tests/acceptance/browser/historicalRedirectLocationCliMcp.test.ts.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: real Chrome DevTools export, Linux.
Package or release metadata impact: none.
Security, privacy, process, or containment review: reads a capture file only; no target interaction.

AI use: the fix and tests were written by an AI agent; the tests were rerun independently before opening.

Author readiness

Human owner: @JayOfTheKeyboard

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7225 **Author:** [@JayOfTheKeyboard](https://github.com/JayOfTheKeyboard) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 11/3/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/har-chrome-devtools-ipv6` --- ### 📝 Commits (1) - [`7681ef6`](https://github.com/morluto/rea/commit/7681ef63d78aada23cda549af1821663aff8d4d9) fix(har): accept Chrome DevTools bracketed IPv6 server addresses ### 📊 Changes **4 files changed** (+89 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `docs/web-network-captures.md` (+6 -2) 📝 `src/browser/history/HarCapture.test.ts` (+34 -0) 📝 `src/browser/history/HarCapture.ts` (+9 -8) 📝 `src/browser/history/HarSchema.ts` (+40 -14) </details> ### 📄 Description ## Summary `inspect_web_network_capture` refuses a whole HAR exported from Chrome DevTools as soon as one entry was served over IPv6. f14c2d4df (#3161) fixed the same thing for Playwright 1.58.2. Chrome's own "Export HAR" writes the same bracketed form, so this extends that adaptation to it. No linked issue: the failure reproduces on a public Chrome export, shown below. ## Problem and expected behavior Chrome DevTools declares its HAR creator as `WebInspector` with the AppleWebKit version from Chromium's user agent, frozen at `537.36` for years. Its HAR writer ([Log.ts](https://github.com/ChromeDevTools/devtools-frontend/blob/main/front_end/models/har/Log.ts)) cuts the port off `remoteAddress()` with `lastIndexOf(':')`, then tries to drop the brackets with `ipAddress.replace(/\[\]/g, '')`. That regex only matches the literal string `[]`, so `[2620:0:860:ed1a::1]:443` is written as `[2620:0:860:ed1a::1]`. A real Chrome export of a Wikipedia page load (88 entries, CredData test corpus, `test/data/validHARFiles/ipv6File.har`): ```text $ rea inspect-web-network-capture ipv6File.har har --format json "code": "invalid_request" "issues": [{"path": ["capture_path", "/log/entries/0/serverIPAddress"], "message": "HAR schema validation failed: format (must match format \"ipv4\")."}] ``` Expected: the capture decodes, as a Playwright 1.58.2 capture with the same addresses already does. ## Change and scope - `HarSchema.ts`: the bracket adaptation is keyed by a small table of observed producers (name, version, label), now Playwright 1.58.2 and `WebInspector` 537.36. Every Chromium-based DevTools declares that creator, so the label is "Chromium DevTools". The rules are unchanged: brackets come off only in the disposable validation copy, and only around a valid IPv6 literal. - `HarCapture.ts`: the per-entry limitation names the declared producer instead of always saying Playwright 1.58.2. Playwright captures keep the exact text they had, so their Evidence identities do not change. - `docs/web-network-captures.md` says why Chromium's export is bracketed, citing Log.ts at a pinned commit. Contribution scope: an ordinary fix inside the existing HAR import boundary; a maintainer scope decision is not applicable. Left out, yours to decide: the same Chrome export of another site (`chargebee.com.har`, 268 entries) also fails, on `/log/entries/62/timings/blocked = -0.771`. Chrome writes small negative `blocked` values (18 of its 268 entries) and clamps them in its own `time` sum with `Math.max(t, 0)`. Accepting them means loosening a timing rule, which is a separate decision, so it is not in this PR. ## Contract and boundary impact - Semantic owner and earliest changed stage: HAR schema validation (`src/browser/history/HarSchema.ts`), read by `HarCapture.ts` for the per-entry limitation. - Contribution scope fit and linked maintainer decision: not applicable (fix within the existing boundary). - CLI and MCP/tool-catalog contract: unchanged; the Chrome capture now decodes instead of returning `invalid_request`. - Provider, bridge, target-format, or platform compatibility: adds Chromium DevTools HAR (`WebInspector` 537.36) next to Playwright 1.58.2. - Evidence, artifact, provenance, or reconstruction contract: original address spelling is kept in Evidence; Playwright limitation text is byte-identical to before. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none. - [x] Read existing files or captured data. ## Evidence and regression coverage - Tests added or updated: `HarCapture.test.ts`: two Chromium DevTools addresses keep their original spelling and get the producer-named limitation; a different `WebInspector` version, bracketed IPv4, and an address with a port stay rejected. - Base reproduction or other evidence: both "retains" cases fail on main baec375c3 with `HAR schema validation failed: format (must match format "ipv4")` and pass with the fix. Changing the `WebInspector` row's version, changing its label, or accepting any IP family inside the brackets each turns two tests red. - User-visible CLI/MCP output: the 88-entry Chrome export decodes through the built CLI: 88 records, spellings like `[2620:0:860:ed1a::1]` kept, limitation on the 87 bracketed entries. - Remaining proof gaps: Chrome's negative `timings.blocked` (above) is not handled. Only Chromium 537.36 exports were tested; other `WebInspector` versions stay rejected on purpose. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed On 7681ef63d (rebased onto main baec375c3): - `vitest run src/browser/history/` — 252 passed - `vitest run tests/boundary/browser/` — 1239 passed, 1 skipped - `npm run check:fast` — passes - `npm run docs:check` — passes Before the rebase: `lint:typed` (no new findings in the changed files), `oxfmt --check`, `tests/acceptance/browser/historicalRedirectLocationCliMcp.test.ts`. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: real Chrome DevTools export, Linux. - Package or release metadata impact: none. - Security, privacy, process, or containment review: reads a capture file only; no target interaction. AI use: the fix and tests were written by an AI agent; the tests were rerun independently before opening. ## Author readiness Human owner: @JayOfTheKeyboard - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-03 13:39:57 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7728

No description provided.

Rows
Columns