morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #7267] [MERGED] feat(browser): reuse saved response values across scenario steps #7799

New issue

Closed

opened 2026-11-05 01:47:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-05 01:47:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7267
Author: @gensokyo-dev
Created: 10/26/2026
Status: ✅ Merged
Merged: 10/27/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/scenario-saved-response-values

📝 Commits (10+)

2ed3285 feat(browser): save response values for later scenario steps
355e2dc fix(browser): protect saved response sources and preserve exact bindings
3c83b4f Merge remote-tracking branch 'origin/main' into feat/scenario-saved-response-values
2758542 test(browser): verify saved values against real PocketBase workflows
dd3085b fix(browser): redact JSON tokens structurally and bound retained credentials
92b1f1c docs(browser): record final saved-value costs and main CI controls
439a389 fix(browser): protect source transactions before Evidence publication
419dd19 Merge remote-tracking branch 'origin/main' into feat/scenario-saved-response-values
e7acc5d perf(browser): reject oversized secret spellings before encoding
9920a9a docs: record final saved response workflow verification

📊 Changes

54 files changed (+7287 additions, -370 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 .agents/skills/reverse-engineer-anything/references/environments.md (+72 -26)
📝 docs/agent-environments.md (+4 -1)
📝 docs/browser-scenario-contract.md (+149 -1)
➕ docs/specs/agent-environments/scenario-saved-values/plan.md (+22 -0)
➕ docs/specs/agent-environments/scenario-saved-values/spec.md (+74 -0)
➕ docs/specs/agent-environments/scenario-saved-values/tasks.md (+15 -0)
➕ docs/specs/agent-environments/scenario-saved-values/verification.md (+138 -0)
➕ docs/verification/browser-saved-values-2026-10-26.md (+271 -0)
📝 docs/web-network-captures.md (+27 -5)
➕ experiments/analysis-efficiency/browser-saved-values.mjs (+713 -0)
➕ experiments/analysis-efficiency/fixtures/browser-saved-values/immediate-followup.html (+30 -0)
➕ experiments/analysis-efficiency/fixtures/browser-saved-values/index.html (+39 -0)
➕ experiments/analysis-efficiency/fixtures/browser-saved-values/whole-json.html (+15 -0)
📝 scripts/lib/browser-scenario-verifier.mjs (+14 -3)
➕ src/application/BrowserScenarioEvidence.test.ts (+63 -0)
📝 src/application/BrowserScenarioEvidence.ts (+19 -4)
📝 src/application/environment/environmentBuild.ts (+5 -1)
📝 src/application/environment/environmentBuildReport.test.ts (+52 -0)
📝 src/application/environment/environmentBuildReport.ts (+52 -0)

...and 34 more files

📄 Description

Summary

Scenarios save response fields and reuse generated IDs, typed JSON and authentication headers in later steps. Integrates Edgar Arakelyan’s #7162, with original credit preserved and upstream changes through 9f5191ab0 compared.

Canonical domain validation owns reference ordering. Shared browser owners handle exact numbers, bounded UTF-8/body reads, retained accounting and source privacy; CLI/MCP use the same implementation. Empty saves preserve existing Evidence identity. No dependency or release-version change in this PR.

Behavior and boundaries

Marked response values protect their source and retained follow-up/event text by exact request identity. Unknown source facts remain withheld with limitations. JSON protection combines decoded-token and whole-body matching; unsafe replacements withhold content.
Page/cookie/local-storage values and constructed Basic credentials keep their existing prospective-only policy. A separate bounded response projection borrows admitted compiled patterns; promotion preserves the first marker and does not rewrite unrelated pre-read facts.
UI response matching is observational and refuses observed ambiguity. Whole path normalization handles backslashes/dot segments while preserving wildcard/literal distinctions. It cannot establish action causality or original-wire body provenance.
Request JSON/URL/envelope expansion and derived credentials are admitted before allocation/dispatch. Scenarios planning sensitive response/page/Basic values withhold screenshots from the first step; other artifacts and explicit missing/equality coverage remain available.

This extends existing explicit request/UI operations without a new provider or execution authority. Compressed/cache-unknown saved UI bodies remain unsupported. Complete retained parent Evidence remains accessible.

Executed validation

Feature branch: 560 tests / 12 source suites, type/lint and build passed.
Current-main integration with Playwright 1.64.1: 561 tests / 12 suites, build and check:fast passed. The documented verification tree combines pinned public main/PR inputs with 2c5f9cc14 and upstream reconciliation 0d89c6540.
Real PocketBase 0.40.6: eight-step CLI and both equivalent MCP workflows passed, with independent backend identity/title/quantity and retained wire-body checks. Current legacy runs actually observed and preserved both pre-read login bodies while protecting post-read facts.
Real escaped/exponent JSON, metadata-only source, whole-JSON storage POST, immediate UI follow-up/console, and sensitive/nonsecret PNG cases passed. Three sensitive screenshots are missing; the nonsecret PNG signature is verified. Shared CI browser fixture also passed its focused public CLI check.
Negative controls reproduce the actionable review failures before their fixes, including ten screenshot cases and the three latest prospective-policy cases. Earlier schema/profile coverage has 41 distinct cases across its runs; final real SDK calls validate the actual named contracts/results.
docs:check, rendered docs:build, and format:check passed on the final head. Evidence, limitations and reproduction.

The primary pair holds runtime/provider/dependencies constant: calls 3→1 per task, input catalog + all arguments/text replies including proof exports 34,885→25,881 estimated o200k tokens. Whole verifier elapsed 13.413→8.092 s, CPU 15.347→9.387 s, sampled process-family peak 2.018→1.689 GB. First/warm timings and all earlier pairs, including slower candidate results, remain recorded. Two CPUs and an 8 GiB family guard bounded checks. No actual model billing, external PocketBase resource use, fully cold OS-cache or general speedup claim.

Review, CI and remaining scope

All fifteen actionable review threads are fixed at their owners, including source/whole-JSON privacy, ambiguous identity, credential/exemplar accounting, path normalization, event publication, expansion, screenshot privacy and preservation of page-value chronology.

Final-head CI run 40423097902 passes static/docs/build, Windows build, Linux native baseline, real-browser and agentenv. Source has 20,232 passed / 1 failed; the completed shard has 1,909 passed / 1 failed. Both failures (bundle-root inventory and empty Java bitness) independently reproduce on the exact CI main parent 8a47cbbcce538f511609b90b5d40bd00920b3216. All cancelled-shard logs were inspected and emit no additional failure; those lanes remain incomplete. Two historical SAZ assertions also reproduce on that parent but are not claimed as executed by this final CI run. The earlier own event-budget failure was fixed rather than bypassed.

The latest upstream query and refused-slug corrections are integrated; their three regressions fail before the fix. All fifteen earlier actionable review threads are resolved. A further Codex review request was refused by the repository usage limit, so no fresh successful automated review is claimed. User-authorized admin bypass covers the independently proven main failures and unchecked human-readiness gate.

Real-provider scope is Linux Chromium, an owned PocketBase frontend and the shared CI fixture. Other platforms, real Basic-auth servers, service-worker integrations and historical multi-app/model evaluations were not verified here.

Author readiness

Human owner: @gensokyo-dev (account used at the user's direction; no human-review attestation made).

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

The user explicitly authorized a non-draft PR and admin bypass of the human-readiness gate without filling these declarations, plus bypass of independently proven unrelated main failures. This does not assert human review occurred. Actionable findings caused by this change will be fixed before merge.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7267 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/26/2026 **Status:** ✅ Merged **Merged:** 10/27/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/scenario-saved-response-values` --- ### 📝 Commits (10+) - [`2ed3285`](https://github.com/morluto/rea/commit/2ed328513be6549795bd32c1acbb8bb0b25c51b1) feat(browser): save response values for later scenario steps - [`355e2dc`](https://github.com/morluto/rea/commit/355e2dcb829b6a25ece8607bce3d331e7a8b4202) fix(browser): protect saved response sources and preserve exact bindings - [`3c83b4f`](https://github.com/morluto/rea/commit/3c83b4f9ce9bd62f267b67aeea2858b3d2ac2ced) Merge remote-tracking branch 'origin/main' into feat/scenario-saved-response-values - [`2758542`](https://github.com/morluto/rea/commit/275854261e0567d0749bccd37653e9104f88978d) test(browser): verify saved values against real PocketBase workflows - [`dd3085b`](https://github.com/morluto/rea/commit/dd3085bf5a2511009116f2672d5aefa8e452537e) fix(browser): redact JSON tokens structurally and bound retained credentials - [`92b1f1c`](https://github.com/morluto/rea/commit/92b1f1cc8735db6a53ffec3c5b5d7d9ca4816fbd) docs(browser): record final saved-value costs and main CI controls - [`439a389`](https://github.com/morluto/rea/commit/439a389fe7c7fda042304db36e10bef377cc6c6e) fix(browser): protect source transactions before Evidence publication - [`419dd19`](https://github.com/morluto/rea/commit/419dd19003ab17ecdaedbfaf2ea9b69a55aba1eb) Merge remote-tracking branch 'origin/main' into feat/scenario-saved-response-values - [`e7acc5d`](https://github.com/morluto/rea/commit/e7acc5d857078e414c9d90d1cee3a018ab672bed) perf(browser): reject oversized secret spellings before encoding - [`9920a9a`](https://github.com/morluto/rea/commit/9920a9a39dc4c9e3eb52cc156bbb5d2d0ac4525a) docs: record final saved response workflow verification ### 📊 Changes **54 files changed** (+7287 additions, -370 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `.agents/skills/reverse-engineer-anything/references/environments.md` (+72 -26) 📝 `docs/agent-environments.md` (+4 -1) 📝 `docs/browser-scenario-contract.md` (+149 -1) ➕ `docs/specs/agent-environments/scenario-saved-values/plan.md` (+22 -0) ➕ `docs/specs/agent-environments/scenario-saved-values/spec.md` (+74 -0) ➕ `docs/specs/agent-environments/scenario-saved-values/tasks.md` (+15 -0) ➕ `docs/specs/agent-environments/scenario-saved-values/verification.md` (+138 -0) ➕ `docs/verification/browser-saved-values-2026-10-26.md` (+271 -0) 📝 `docs/web-network-captures.md` (+27 -5) ➕ `experiments/analysis-efficiency/browser-saved-values.mjs` (+713 -0) ➕ `experiments/analysis-efficiency/fixtures/browser-saved-values/immediate-followup.html` (+30 -0) ➕ `experiments/analysis-efficiency/fixtures/browser-saved-values/index.html` (+39 -0) ➕ `experiments/analysis-efficiency/fixtures/browser-saved-values/whole-json.html` (+15 -0) 📝 `scripts/lib/browser-scenario-verifier.mjs` (+14 -3) ➕ `src/application/BrowserScenarioEvidence.test.ts` (+63 -0) 📝 `src/application/BrowserScenarioEvidence.ts` (+19 -4) 📝 `src/application/environment/environmentBuild.ts` (+5 -1) 📝 `src/application/environment/environmentBuildReport.test.ts` (+52 -0) 📝 `src/application/environment/environmentBuildReport.ts` (+52 -0) _...and 34 more files_ </details> ### 📄 Description ## Summary Scenarios save response fields and reuse generated IDs, typed JSON and authentication headers in later steps. Integrates Edgar Arakelyan’s #7162, with original credit preserved and upstream changes through `9f5191ab0` compared. Canonical domain validation owns reference ordering. Shared browser owners handle exact numbers, bounded UTF-8/body reads, retained accounting and source privacy; CLI/MCP use the same implementation. Empty saves preserve existing Evidence identity. No dependency or release-version change in this PR. ## Behavior and boundaries - Marked response values protect their source and retained follow-up/event text by exact request identity. Unknown source facts remain withheld with limitations. JSON protection combines decoded-token and whole-body matching; unsafe replacements withhold content. - Page/cookie/local-storage values and constructed Basic credentials keep their existing prospective-only policy. A separate bounded response projection borrows admitted compiled patterns; promotion preserves the first marker and does not rewrite unrelated pre-read facts. - UI response matching is observational and refuses observed ambiguity. Whole path normalization handles backslashes/dot segments while preserving wildcard/literal distinctions. It cannot establish action causality or original-wire body provenance. - Request JSON/URL/envelope expansion and derived credentials are admitted before allocation/dispatch. Scenarios planning sensitive response/page/Basic values withhold screenshots from the first step; other artifacts and explicit missing/equality coverage remain available. This extends existing explicit request/UI operations without a new provider or execution authority. Compressed/cache-unknown saved UI bodies remain unsupported. Complete retained parent Evidence remains accessible. ## Executed validation - Feature branch: **560 tests / 12 source suites**, type/lint and build passed. - Current-main integration with **Playwright 1.64.1**: **561 tests / 12 suites**, build and `check:fast` passed. The documented verification tree combines pinned public main/PR inputs with `2c5f9cc14` and upstream reconciliation `0d89c6540`. - Real PocketBase 0.40.6: eight-step CLI and both equivalent MCP workflows passed, with independent backend identity/title/quantity and retained wire-body checks. Current legacy runs actually observed and preserved both pre-read login bodies while protecting post-read facts. - Real escaped/exponent JSON, metadata-only source, whole-JSON storage POST, immediate UI follow-up/console, and sensitive/nonsecret PNG cases passed. Three sensitive screenshots are missing; the nonsecret PNG signature is verified. Shared CI browser fixture also passed its focused public CLI check. - Negative controls reproduce the actionable review failures before their fixes, including ten screenshot cases and the three latest prospective-policy cases. Earlier schema/profile coverage has 41 distinct cases across its runs; final real SDK calls validate the actual named contracts/results. - `docs:check`, rendered `docs:build`, and `format:check` passed on the final head. [Evidence, limitations and reproduction](docs/verification/browser-saved-values-2026-10-26.md). The primary pair holds runtime/provider/dependencies constant: calls **3→1 per task**, input catalog + all arguments/text replies including proof exports **34,885→25,881 estimated o200k tokens**. Whole verifier elapsed **13.413→8.092 s**, CPU **15.347→9.387 s**, sampled process-family peak **2.018→1.689 GB**. First/warm timings and all earlier pairs, including slower candidate results, remain recorded. Two CPUs and an 8 GiB family guard bounded checks. No actual model billing, external PocketBase resource use, fully cold OS-cache or general speedup claim. ## Review, CI and remaining scope All fifteen actionable review threads are fixed at their owners, including source/whole-JSON privacy, ambiguous identity, credential/exemplar accounting, path normalization, event publication, expansion, screenshot privacy and preservation of page-value chronology. Final-head CI run [40423097902](https://github.com/morluto/rea/actions/runs/40423097902) passes static/docs/build, Windows build, Linux native baseline, real-browser and agentenv. Source has **20,232 passed / 1 failed**; the completed shard has **1,909 passed / 1 failed**. Both failures (bundle-root inventory and empty Java bitness) independently reproduce on the exact CI main parent `8a47cbbcce538f511609b90b5d40bd00920b3216`. All cancelled-shard logs were inspected and emit no additional failure; those lanes remain incomplete. Two historical SAZ assertions also reproduce on that parent but are not claimed as executed by this final CI run. The earlier own event-budget failure was fixed rather than bypassed. The latest upstream query and refused-slug corrections are integrated; their three regressions fail before the fix. All fifteen earlier actionable review threads are resolved. A further Codex review request was refused by the repository usage limit, so no fresh successful automated review is claimed. User-authorized admin bypass covers the independently proven main failures and unchecked human-readiness gate. Real-provider scope is Linux Chromium, an owned PocketBase frontend and the shared CI fixture. Other platforms, real Basic-auth servers, service-worker integrations and historical multi-app/model evaluations were not verified here. ## Author readiness Human owner: @gensokyo-dev (account used at the user's direction; no human-review attestation made). - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. The user explicitly authorized a non-draft PR and admin bypass of the human-readiness gate without filling these declarations, plus bypass of independently proven unrelated main failures. This does not assert human review occurred. Actionable findings caused by this change will be fixed before merge. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-05 01:47:44 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7799

No description provided.

Rows
Columns