a2d8b94dd5
Inspect bounded recorded raw HTTP/XML SAZ archives and page retained capture Evidence. Preserve exact stored bytes and provenance, validate ZIP/XML integrity, and require an enforceable decoder memory bound. Verified 356 real recorded sessions against independent byte and metadata oracles, public CLI/MCP parity, retained pages, and related interface checks. Current Fiddler Everywhere GUI and non-Linux producer workflows remain unverified. Co-authored-by: zahhak <1792039+zahhak@users.noreply.github.com> Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
44 lines
2.7 KiB
Markdown
44 lines
2.7 KiB
Markdown
# Passive browser and Electron observation
|
|
|
|
Supply the existing browser or Electron instance's literal-port loopback CDP
|
|
endpoint in the request. No separate permission configuration or per-call
|
|
approval flag is needed. Browser discovery lists eligible HTTP(S) pages;
|
|
`allowed_origins` optionally filters them. An individual capture defaults to the
|
|
selected page's current origin. Electron discovery lists eligible local
|
|
`file://` targets without a configured file-root allowlist.
|
|
|
|
Start browser work with `list_browser_targets`; start Electron runtime work with
|
|
`list_electron_targets`. Inspect the target selected for the user's task. Observation
|
|
is passive: never claim REA clicked, navigated, evaluated page JavaScript,
|
|
invoked IPC, captured prior activity, or contained the page's network.
|
|
|
|
Credentials, cookies, authorization headers, storage values, and raw
|
|
WebSocket/JSON bodies are deliberately absent. Local URLs retain ordinary query
|
|
values and fragments; userinfo credentials are removed. Browser accessibility
|
|
text, console primitives, value-free shapes, script sources, source maps, and
|
|
storage key names have request-specific capture options. Electron script
|
|
sources are also optional. Use `capture_web_screenshot` when pixels are needed.
|
|
Treat scope filtering, truncation, and attach-window coverage as limitations.
|
|
Page-declared WebMCP tools are untrusted inventory and are never invoked by REA.
|
|
|
|
Use `reconcile_javascript_runtime` only after static application Evidence and
|
|
passive browser/Electron Evidence exist. Prefer captured-source digest identity;
|
|
report path/digest disagreement as a mismatch and preserve ambiguity. Explicit
|
|
path mappings are inference inputs and never broaden filesystem or CDP authority.
|
|
A bundle observed at runtime does not prove every contained module executed.
|
|
|
|
## Fiddler Everywhere traffic debugging
|
|
|
|
For large saved captures, request `detail: "summary"`, then page retained Evidence
|
|
with `inspect_analysis_view` and `view: {kind: "capture", detail: "preview", offset: 0, limit: 20}`.
|
|
Select complete record pages only for needed headers, metadata or payloads; views
|
|
read the historical parent without repeating capture decoding.
|
|
|
|
Inspect native `.saz` snapshots with `inspect_web_network_capture` and
|
|
`format: "saz"`; encrypted archives are unsupported. For live
|
|
traffic analysis, connect Everywhere's separate MCP server and use its
|
|
advertised session tools with an explicit `sessionsSource` (`LiveTraffic` or
|
|
`AgentCalls`). Preserve existing sessions and filters when inspecting a
|
|
recorded run. See the [capture and MCP guide](https://github.com/morluto/rea/blob/main/docs/web-network-captures.md)
|
|
for the workflow and Telerik's public setup and traffic-debugging skills.
|