fix(captures): validate packet read scope before paging

src/application/v8CodeCache/V8CodeCacheService.test.ts

@@ -1,68 +0,0 @@
-import { createHash } from "node:crypto";
-import { expect, it } from "vitest";
-
-import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
-import { parseEvidence } from "../../domain/evidence.js";
-import { ok } from "../../domain/result.js";
-import {
-  V8_CODE_CACHE_HEADER_BYTES,
-  V8_CODE_CACHE_MAGIC_HIGH,
-  type V8CodeCache,
-} from "../../domain/v8/v8CodeCache.js";
-import { parseV8CodeCache } from "../../v8/V8CodeCacheParser.js";
-import { V8CodeCacheService } from "./V8CodeCacheService.js";
-
-const reportFor = (payloadBytes: number): V8CodeCache => {
-  const bytes = Buffer.alloc(V8_CODE_CACHE_HEADER_BYTES + payloadBytes, 0x61);
-  bytes.fill(0, 0, V8_CODE_CACHE_HEADER_BYTES);
-  bytes.writeUInt32LE(V8_CODE_CACHE_MAGIC_HIGH * 0x10000, 0);
-  bytes.writeUInt32LE(payloadBytes, 20);
-  return parseV8CodeCache(
-    bytes,
-    {
-      path: "/artifacts/authored.jsc",
-      sha256: createHash("sha256").update(bytes).digest("hex"),
-      bytes: bytes.length,
-    },
-    { min_string_bytes: 4, max_strings: 8 },
-  );
-};
-
-const inspect = (report: V8CodeCache) =>
-  new V8CodeCacheService({
-    identity: { id: "cache-fixture", name: "Cache fixture", version: "1" },
-    close: async () => {},
-    inspect: async () => ok(report),
-  }).inspect({ path: report.artifact.path });
-
-it.each([0, 9])(
-  "rejects complete coverage claiming %s scanned bytes for an eight-byte payload",
-  async (scanned_bytes) => {
-    const report = reportFor(8);
-    const result = await inspect({
-      ...report,
-      coverage: { ...report.coverage, scanned_bytes },
-    });
-    expect(result.ok).toBe(false);
-    if (!result.ok) expect(result.error).toBeInstanceOf(AnalysisOutputError);
-  },
-);
-
-it.each([8, 5000])(
-  "retains complete scan facts for a %s-byte payload and its bounded string prefix",
-  async (payloadBytes) => {
-    const report = reportFor(payloadBytes);
-    const result = await inspect(report);
-    if (!result.ok) throw result.error;
-    expect(parseEvidence(result.value).normalized_result).toMatchObject({
-      coverage: { status: "complete", scanned_bytes: payloadBytes, strings: 1 },
-      embedded_strings: [
-        {
-          bytes: payloadBytes,
-          retained_bytes: Math.min(payloadBytes, 4096),
-          truncated: payloadBytes > 4096,
-        },
-      ],
-    });
-  },
-);

src/captures/TsharkCaptureProvider.ts

@@ -369,7 +369,10 @@ export class TsharkCaptureProvider implements PacketCapturePort {
         resourcePath = "path" in input ? input.path : command;
         // TShark resolves `-e` aliases before emitting canonical field names;
         // the command arguments, not output names, own field selection.
-        const matchingPackets = parsePacketOutput(output.stdout.text);
+        const matchingPackets = parsePacketOutput(
+          output.stdout.text,
+          input.packet_limit,
+        );
         const start = Math.min(input.match_offset, matchingPackets.length);
         const end =
           input.match_limit === null

src/captures/parsePacketOutput.ts

@@ -6,7 +6,7 @@ import { packetFieldsSchema } from "../domain/captures/packetCapture.js";
 const producerSchema = z.array(
   z.object({ _source: z.object({ layers: packetFieldsSchema }) }),
 );
-export const parsePacketOutput = (text: string) => {
+export const parsePacketOutput = (text: string, packetLimit: number | null) => {
   const decoded: unknown = JSON.parse(text);
   const packets = producerSchema
     .parse(decoded)
@@ -19,6 +19,11 @@ export const parsePacketOutput = (text: string) => {
         "inspect_packet_capture",
         "TShark returned unordered frames.",
       );
+    if (packetLimit !== null && frame > BigInt(packetLimit))
+      throw new AnalysisOutputError(
+        "inspect_packet_capture",
+        "TShark returned a frame beyond the selected input packet limit.",
+      );
     previous = frame;
   }
   return packets;

src/domain/v8/v8CodeCache.ts

@@ -196,12 +196,6 @@ export const v8CodeCacheSchema = z
         message:
           "Observation coverage disagrees with the listed embedded strings.",
       });
-    if (report.coverage.scanned_bytes !== report.payload.bytes)
-      context.addIssue({
-        code: "custom",
-        path: ["coverage", "scanned_bytes"],
-        message: "Complete coverage must examine every declared payload byte.",
-      });
     report.embedded_strings.forEach((observation, index) => {
       if (observation.retained_bytes > observation.bytes)
         context.addIssue({

tests/boundary/captures/captureProvider.test.ts

@@ -247,6 +247,26 @@ it("preserves TShark canonical output for a caller-selected field alias", async
   expect(report.tool.arguments).toContain("bootp.type");
 });
 
+it("refuses producer frames outside the selected input read scope before paging", async () => {
+  const f = await fixture("many");
+  const request = { path: f.path, fields: ["ip.addr"], match_limit: 1 };
+  expect(
+    await f.service.inspect({ ...request, packet_limit: 10 }),
+  ).toMatchObject({
+    ok: false,
+    error: { _tag: "AnalysisOutputError", operation: "inspect_packet_capture" },
+  });
+  const admitted = await f.service.inspect({ ...request, packet_limit: 90 });
+  if (!admitted.ok) throw admitted.error;
+  const report = packetCaptureSchema.parse(admitted.value.normalized_result);
+  expect(report.output_window).toEqual({
+    matching_packets: 90,
+    returned_packets: 1,
+    has_more: true,
+  });
+  expect(report.packets[0]?.["frame.number"]).toEqual(["1"]);
+});
+
 it("returns canonical alias output through the public packet-capture CLI", async () => {
   const f = await fixture("alias-canonical");
   const cli = Cli.create("capture-alias-test", { sync: false });

tests/boundary/captures/packetOutput.test.ts

@@ -17,7 +17,7 @@ it("preserves repeated field values and missing fields while discarding export i
     },
     { _source: { layers: { "frame.number": ["7"] } } },
   ]);
-  expect(parsePacketOutput(output)).toEqual([
+  expect(parsePacketOutput(output, 7)).toEqual([
     { "frame.number": ["2"], "ip.addr": ["192.0.2.1", "192.0.2.2"] },
     { "frame.number": ["7"] },
   ]);
@@ -49,7 +49,7 @@ it.each([
 ])("rejects malformed producer fields: $layers", ({ layers, issue }) => {
   let failure: unknown;
   try {
-    parsePacketOutput(JSON.stringify([{ _source: { layers } }]));
+    parsePacketOutput(JSON.stringify([{ _source: { layers } }]), null);
   } catch (error) {
     failure = error;
   }
@@ -72,6 +72,7 @@ it.each([
           _source: { layers: { "frame.number": frame } },
         })),
       ),
+      null,
     );
   } catch (error) {
     failure = error;
@@ -88,7 +89,18 @@ it("preserves canonical field names emitted for a selected alias", () => {
       },
     },
   ]);
-  expect(parsePacketOutput(output)).toEqual([
+  expect(parsePacketOutput(output, null)).toEqual([
     { "frame.number": ["1"], "dhcp.type": ["1"] },
   ]);
 });
+
+it("validates every frame against the input read limit while allowing filtered gaps", () => {
+  const output = JSON.stringify(
+    [2, 7].map((frame) => ({
+      _source: { layers: { "frame.number": [String(frame)] } },
+    })),
+  );
+  expect(parsePacketOutput(output, 7)).toHaveLength(2);
+  expect(() => parsePacketOutput(output, 6)).toThrow(AnalysisOutputError);
+  expect(parsePacketOutput(output, null)).toHaveLength(2);
+});