references/runtime-observation.md
4.7 KB查看排版效果| 1 | # Browser and Electron runtime observation |
| 2 | |
| 3 | Supply the existing browser or Electron instance's literal-port loopback CDP |
| 4 | endpoint in the request. No separate permission configuration or per-call |
| 5 | approval flag is needed. Browser discovery lists eligible HTTP(S) pages; |
| 6 | `allowed_origins` optionally filters them. An individual capture defaults to the |
| 7 | selected page's current origin. Electron discovery lists eligible local |
| 8 | `file://` targets without a configured file-root allowlist. |
| 9 | |
| 10 | Start passive browser work with `list_browser_targets`; start Electron runtime work with |
| 11 | `list_electron_targets`. Before an electron-main Inspector attempt, check |
| 12 | packaged fuses with `inspect_electron_fuses`. Inspect the target selected for |
| 13 | the user's task. Observation with these tools is passive: never claim REA |
| 14 | clicked, navigated, evaluated page JavaScript, invoked IPC, or captured prior |
| 15 | activity. REA does not contain the page's network. |
| 16 | |
| 17 | Passive captures omit raw header collections, credential header values, storage |
| 18 | values, and raw WebSocket/JSON bodies. Selected response metadata, including |
| 19 | content encoding, policy values, and Link URLs, is retained. Local URLs retain ordinary query |
| 20 | values and fragments; userinfo credentials are removed. Browser accessibility |
| 21 | text, console primitives, value-free shapes, script sources, source maps, and |
| 22 | storage key names have request-specific capture options. Electron script |
| 23 | sources are also optional. Use `capture_web_screenshot` when pixels are needed. |
| 24 | Treat scope filtering, truncation, and attach-window coverage as limitations. |
| 25 | Page-declared WebMCP tools are untrusted inventory and are never invoked by REA. |
| 26 | |
| 27 | ## Who performs the action |
| 28 | |
| 29 | - The user performs it: `list_browser_targets`, then `inspect_web_page` or |
| 30 | `observe_web_session` on the selected target. |
| 31 | - The agent must perform it: one `capture_browser_scenario` with declared |
| 32 | actions. Use connect mode with the loopback CDP endpoint and `target_id` for |
| 33 | an existing browser, or launch mode with a caller-selected executable for a |
| 34 | temporary profile. Connect mode first navigates the selected page to |
| 35 | `start_url`, which can clear unsaved form values and other temporary state. |
| 36 | Recreate the state needed for the investigation in the declared actions. |
| 37 | Connect mode leaves the external browser open; launch mode owns a temporary |
| 38 | browser and profile. Check `browser.cleanup` for the outcome. |
| 39 | Request only the DOM, accessibility, or network details needed for the question. |
| 40 | The default final capture contains the URL; step outcomes are reported separately. |
| 41 | Add a wait action for the expected page state before capturing it. Report that |
| 42 | REA performed the declared actions. |
| 43 | |
| 44 | Scenario network records have no request initiator stacks. For that evidence, |
| 45 | use passive capture while the user performs the action. Listener source locations |
| 46 | identify candidate handlers; they do not establish which script sent a particular |
| 47 | request. Avoid overlapping passive capture and scenario actions on the same target. |
| 48 | |
| 49 | Focused follow-up tools: |
| 50 | |
| 51 | - `observe_web_execution`: execution coverage during a window; it resets |
| 52 | counters and temporarily disables optimization. |
| 53 | - `inspect_web_event_listeners`: source locations for listeners registered |
| 54 | directly on the first CSS match, without dispatching an event. |
| 55 | - `compare_web_captures`: two normalized passive captures or recorded scenarios. |
| 56 | - `discover_webmcp_tools`: inspect page-declared WebMCP inventory; never invoke |
| 57 | the discovered tools. |
| 58 | |
| 59 | Use `reconcile_javascript_runtime` only after static application Evidence and |
| 60 | passive browser/Electron Evidence exist. Prefer captured-source digest identity; |
| 61 | report path/digest disagreement as a mismatch and preserve ambiguity. Explicit |
| 62 | path mappings are inference inputs and never broaden filesystem or CDP authority. |
| 63 | A bundle observed at runtime does not prove every contained module executed. |
| 64 | |
| 65 | ## Fiddler Everywhere traffic debugging |
| 66 | |
| 67 | For large saved captures, request `detail: "summary"`, then page retained Evidence |
| 68 | with `inspect_analysis_view` and `view: {kind: "capture", detail: "preview", offset: 0, limit: 20}`. |
| 69 | Select complete record pages only for needed headers, metadata or payloads; views |
| 70 | read the historical parent without repeating capture decoding. |
| 71 | |
| 72 | Inspect native `.saz` snapshots with `inspect_web_network_capture` and |
| 73 | `format: "saz"`; encrypted archives are unsupported. For live |
| 74 | traffic analysis, connect Everywhere's separate MCP server and use its |
| 75 | advertised session tools with an explicit `sessionsSource` (`LiveTraffic` or |
| 76 | `AgentCalls`). Preserve existing sessions and filters when inspecting a |
| 77 | recorded run. See the [capture and MCP guide](https://github.com/morluto/rea/blob/main/docs/web-network-captures.md) |
| 78 | for the workflow and Telerik's public setup and traffic-debugging skills. |
文件内容是平台检查时读出的文本，只供查看。平台不会运行包里的任何脚本或程序。
