fix(har): accept Chrome DevTools bracketed IPv6 server addresses - #7225

Summary

inspect_web_network_capture refuses a whole HAR exported from Chrome DevTools as soon as one entry was served over IPv6. f14c2d4 (#3161) fixed the same thing for Playwright 1.58.2. Chrome's own "Export HAR" writes the same bracketed form, so this extends that adaptation to it.

No linked issue: the failure reproduces on a public Chrome export, shown below.

Problem and expected behavior

Chrome DevTools declares its HAR creator as WebInspector with the AppleWebKit version from Chromium's user agent, frozen at 537.36 for years. Its HAR writer (Log.ts) cuts the port off remoteAddress() with lastIndexOf(':'), then tries to drop the brackets with ipAddress.replace(/\[\]/g, ''). That regex only matches the literal string [], so [2620:0:860:ed1a::1]:443 is written as [2620:0:860:ed1a::1].

A real Chrome export of a Wikipedia page load (88 entries, CredData test corpus, test/data/validHARFiles/ipv6File.har):

$ rea inspect-web-network-capture ipv6File.har har --format json
"code": "invalid_request"
"issues": [{"path": ["capture_path", "/log/entries/0/serverIPAddress"],
  "message": "HAR schema validation failed: format (must match format \"ipv4\")."}]

Expected: the capture decodes, as a Playwright 1.58.2 capture with the same addresses already does.

Change and scope

• HarSchema.ts: the bracket adaptation is keyed by a small table of observed producers (name, version, label), now Playwright 1.58.2 and WebInspector 537.36. Every Chromium-based DevTools declares that creator, so the label is "Chromium DevTools". The rules are unchanged: brackets come off only in the disposable validation copy, and only around a valid IPv6 literal.
• HarCapture.ts: the per-entry limitation names the declared producer instead of always saying Playwright 1.58.2. Playwright captures keep the exact text they had, so their Evidence identities do not change.
• docs/web-network-captures.md says why Chromium's export is bracketed, citing Log.ts at a pinned commit.

Contribution scope: an ordinary fix inside the existing HAR import boundary; a maintainer scope decision is not applicable.

Left out, yours to decide: the same Chrome export of another site (chargebee.com.har, 268 entries) also fails, on /log/entries/62/timings/blocked = -0.771. Chrome writes small negative blocked values (18 of its 268 entries) and clamps them in its own time sum with Math.max(t, 0). Accepting them means loosening a timing rule, which is a separate decision, so it is not in this PR.

Contract and boundary impact

• Semantic owner and earliest changed stage: HAR schema validation (src/browser/history/HarSchema.ts), read by HarCapture.ts for the per-entry limitation.

• Contribution scope fit and linked maintainer decision: not applicable (fix within the existing boundary).

• CLI and MCP/tool-catalog contract: unchanged; the Chrome capture now decodes instead of returning invalid_request.

• Provider, bridge, target-format, or platform compatibility: adds Chromium DevTools HAR (WebInspector 537.36) next to Playwright 1.58.2.

• Evidence, artifact, provenance, or reconstruction contract: original address spelling is kept in Evidence; Playwright limitation text is byte-identical to before.

• Target selection, authority, upstream behavior, and cleanup details: not applicable.

• Generated metadata, package, or installation impact: none.

• Read existing files or captured data.

Evidence and regression coverage

• Tests added or updated: HarCapture.test.ts: two Chromium DevTools addresses keep their original spelling and get the producer-named limitation; a different WebInspector version, bracketed IPv4, and an address with a port stay rejected.

• Base reproduction or other evidence: both "retains" cases fail on main baec375 with HAR schema validation failed: format (must match format "ipv4") and pass with the fix. Changing the WebInspector row's version, changing its label, or accepting any IP family inside the brackets each turns two tests red.

• User-visible CLI/MCP output: the 88-entry Chrome export decodes through the built CLI: 88 records, spellings like [2620:0:860:ed1a::1] kept, limitation on the 87 bracketed entries.

• Remaining proof gaps: Chrome's negative timings.blocked (above) is not handled. Only Chromium 537.36 exports were tested; other WebInspector versions stay rejected on purpose.

• Observed, derived, and inferred claims remain distinguishable.

• Artifact identity, source provenance, and failed attempts remain preserved.

• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On 7681ef6 (rebased onto main baec375):

• vitest run src/browser/history/ — 252 passed
• vitest run tests/boundary/browser/ — 1239 passed, 1 skipped
• npm run check:fast — passes
• npm run docs:check — passes

Before the rebase: lint:typed (no new findings in the changed files), oxfmt --check, tests/acceptance/browser/historicalRedirectLocationCliMcp.test.ts.

Compatibility, safety, and release

• Breaking changes or migration steps: none.
• Real Hopper/Ghidra, browser, or OS coverage: real Chrome DevTools export, Linux.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: reads a capture file only; no target interaction.

AI use: the fix and tests were written by an AI agent; the tests were rerun independently before opening.

Author readiness

Human owner: @JayOfTheKeyboard

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.