fix(web): reject a reshaped replay param, and forward a declared JSON body

Copilot's sixth pass generated no new inline comments; both suppressed ones
were right.

- `arguments` surviving the key check is not the same as being sent as
  written. `replayProtocolRequest` applies `arguments ?? {}`, so a `null` shown
  in the editor reaches the wire as `{}`; an array or scalar is not nullish and
  rides the cast into a call whose type says it is a named-argument record.
  `reshapedReplayParam` rejects both before Send. `name` and `uri` are
  deliberately not checked there — the dispatch already refuses those with a
  reason the caller shows as a toast, so they fail visibly rather than
  silently.

- `NetworkEntry` never forwarded the body's content type, so the Network tab
  could not reach the declared-JSON branch at all and a malformed
  `application/json` response read as plain text with no sign it was meant to
  be JSON. Forwarded — but only when the declared type *is* JSON: passing it
  wholesale would also route an HTML body into the sandboxed frame and a CSV
  one into a table, which is a change to what the Network tab is and not one
  this makes.

The `NetworkEntry > Auth Success` play function moved off `textContent` for
body assertions. Ace repaints its rows on an animation frame and virtualizes
them, so reading the DOM straight after Reveal returned the previous rows
under load — it passed in isolation and failed in the full run. It now reads
the editors' documents alongside the DOM text, and waits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/lib/protocolReplay.test.ts

@@ -5,6 +5,7 @@ import {
   messagesToLogEntries,
   replayProtocolRequest,
   replayableParams,
+  reshapedReplayParam,
   type ReplayClient,
 } from "./protocolReplay";
 
@@ -135,6 +136,44 @@ describe("replayableParams", () => {
   });
 });
 
+// `replayableParams` answers which keys survive; this answers whether the
+// surviving ones survive intact.
+describe("reshapedReplayParam", () => {
+  it("accepts an object arguments", () => {
+    expect(
+      reshapedReplayParam("tools/call", { name: "x", arguments: { a: 1 } }),
+    ).toBeNull();
+  });
+
+  it("accepts an absent arguments", () => {
+    expect(reshapedReplayParam("tools/call", { name: "x" })).toBeNull();
+  });
+
+  // The sharp case: `?? {}` replaces a null, so the editor shows `null` and the
+  // wire carries `{}`.
+  it("rejects a null arguments, which is sent as an empty object", () => {
+    expect(
+      reshapedReplayParam("tools/call", { name: "x", arguments: null }),
+    ).toMatch(/sent as `\{\}` when null/);
+  });
+
+  it.each([
+    ["an array", [1, 2]],
+    ["a number", 4],
+    ["a string", "a"],
+  ])("rejects %s arguments", (_label, args) => {
+    expect(
+      reshapedReplayParam("prompts/get", { name: "x", arguments: args }),
+    ).toMatch(/must be a JSON object/);
+  });
+
+  it("has nothing to say about methods that take no arguments", () => {
+    expect(reshapedReplayParam("tools/list", { cursor: "a" })).toBeNull();
+    expect(reshapedReplayParam("resources/read", { uri: "x://y" })).toBeNull();
+    expect(reshapedReplayParam("ping", undefined)).toBeNull();
+  });
+});
+
 describe("replayProtocolRequest", () => {
   const tool: Tool = { name: "echo", inputSchema: { type: "object" } };
 

clients/web/src/lib/protocolReplay.ts

@@ -133,6 +133,41 @@ export function replayableParams(
   };
 }
 
+/**
+ * A param the dispatch below would *reshape* on the way out, or null when every
+ * kept param is sent as written.
+ *
+ * {@link replayableParams} answers which keys survive; this answers whether the
+ * surviving ones survive *intact*. Only `arguments` can fail that today, and it
+ * fails two ways, both of which the Edit-and-replay editor has to catch before
+ * Send:
+ *
+ * - `arguments: null` is nullish, so `?? {}` replaces it — the editor shows
+ *   `null` and the wire carries `{}`.
+ * - `arguments: [1,2]` or `arguments: 4` is not nullish, so the cast carries it
+ *   through unchanged into a call whose type says it is a named-argument
+ *   record. Nothing reshapes it, but nothing can send it either.
+ *
+ * `name` and `uri` are deliberately not checked here: the dispatch already
+ * refuses a missing or non-string one with a reason the caller surfaces as a
+ * toast, so those fail visibly rather than silently.
+ */
+export function reshapedReplayParam(
+  method: string,
+  params: Record<string, unknown> | undefined,
+): string | null {
+  if (!params) return null;
+  if (method !== "tools/call" && method !== "prompts/get") return null;
+  if (!Object.hasOwn(params, "arguments")) return null;
+  const args = params.arguments;
+  const isRecord =
+    args !== null && typeof args === "object" && !Array.isArray(args);
+  if (isRecord) return null;
+  return args === null
+    ? "`arguments` is sent as `{}` when null — remove it, or give it an object"
+    : "`arguments` must be a JSON object (`{ … }`)";
+}
+
 export async function replayProtocolRequest(
   client: ReplayClient,
   method: string,