2bf3663f65
* feat(browser): inspect retained HAR and mitmproxy capture evidence Add independent offline format adapters, inline CLI/MCP evidence, bounded owned decoder processes, and real producer verification. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): preserve capture boundaries during cancellation and decoding Honor cancellation during owned-command cleanup, retain opaque HAR extension content, and clean verifier resources on every failure path. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): exclude sensitive capture fields across representations Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance. Refs #882 Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing) * fix(browser): exclude sensitive capture identities and bound diagnostics * fix(browser): validate excluded HAR subtrees before projection * fix(browser): distinguish capture input limits from decoder failures * fix(browser): preserve decoder failure categories * fix(browser): validate excluded native credential values * test(browser): report capture verifier assertions directly * fix(browser): classify native representation failures precisely * fix(browser): exclude URL userinfo after header whitespace * fix(browser): preserve capture evidence and failure boundaries * fix(browser): exclude sensitive literals from capture limitations * test(browser): check limitation values without JSON syntax * fix(browser): preserve acquisition integrity and exclude selection diagnostics * fix(browser): preserve capture acquisition and declaration boundaries * fix(mcp): project sensitive capture argument validation * fix: preserve capture bytes and prelaunch cancellation * fix(browser): exclude sensitive HAR record ancestry * fix(browser): preserve transport URL and parameter exclusions * fix(browser): preserve numeric redaction and canonical capture provenance * fix(browser): cover derived capture values and ownership preparation deadlines * fix(browser): exclude explicitly sensitive artifact digests * chore: regenerate generated metadata * fix(browser): reject lossy HAR member normalization * test(browser): assert the advertised unsupported-profile outcome * fix(browser): preserve JSON visitor nesting failure locations * fix(browser): exclude explicitly sensitive native source ranges --------- Co-authored-by: Kaoru0822 <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Historical network upstream profiles
REA uses unmodified upstream packages or a caller-supplied tool. The adapter
code lives under src/browser/history/ and bridge/mitmproxy/; this directory
records provenance rather than vendoring a second parser implementation.
| Upstream | Fixed profile | Use |
|---|---|---|
| har-schema | npm 2.0.0, ISC | HAR 1.2 draft-06 schemas |
| jsonc-parser | npm 3.3.1, MIT | Strict JSON visitor; member sequence, duplicate detection and prototype-safe materialization |
| lossless-json | npm 4.3.1 | Original JSON numeric lexemes and safe-number classification |
| AJV | npm 8.20.0 | Upstream schema validation |
| ajv-formats | npm 3.0.1 | Upstream URI, timestamp and address formats |
| mitmproxy | v12.2.3, commit 6c09d56e4c29a92f5ad01b03199977584b8ea14f, MIT |
Unchanged native mitmproxy.io.tnetstring.load; upstream FlowWriter / SaveHar for ephemeral verification fixtures |
The npm lockfile pins exact package versions and distribution integrity hashes;
their original code and license files remain in the installed packages. Native
mitmproxy is bring-your-own. REA never installs or upgrades it and rejects a
different runtime version. The Linux verification lane downloads the official
standalone release into runner temporary storage with fixed archive SHA-256
2e95286b618fa6fd33e5e62a78c2e5112571d85f42ec2bac29b97ee242bdb5c5.
This is a pinned archive digest, not a publisher signature claim.
No native captures or game/application binaries are checked in. Verification uses source-owned Python fixtures and upstream writers. The original file digest/record representation is preserved independently of the decoded view; upstream conversion defaults are not imported into native states.
The observed SaveHar 12.2.3 optional postData.text: null quirk is admitted
only in a validation copy for that declared producer profile, with the original
null retained. The upstream schemas themselves remain unchanged.
The strict JSON visitor supplies member events before object materialization;
REA rejects all duplicate names and retains original numeric token spelling.
The shared JSON schema currently drops __proto__ members, so both adapters
report that representation as unsupported instead of returning incomplete data.