[Tuanpluss02]

Description

Comprehensive hardening across core engine lifecycle, hybrid RAM/disk storage, replay SSRF/resource security, MCP server, and UI surfaces:

1. Core Engine & Lifecycle (C1, C3, C4):

   • Separate manual pause intent (_enabled) from release permission check (isEnabled = _enabled && shouldEnableCapture(...)), gating background workers and storage init in release mode.
   • Accept authentic terminal responses over synthetic timeouts without permanent rejection.
   • Preserve manual pause state across engine reconfigurations.

2. Adapters & Transport (A2, A3, Socket.IO, HTTP, Chopper):

   • Preserve authentic original request tuple (method, URL, headers, body) on Dio redirects without partial URL mutation.
   • Mutate ResponseBody.stream in place on existing object to preserve extra metadata and onClose cleanup callbacks.
   • Deduplicate repeated InterceptlySocketIo.attach calls per Socket via Expando and record connect_error frames rather than closing sessions on transient reconnects.
   • Defensive copy request/response headers via Map.of() in HTTP client and Chopper interceptor.

3. Replay & Security (S2, S3, S4, F1):

   • Disable automatic redirect following (request.followRedirects = false;) to capture 3xx responses directly and prevent redirect SSRF bypasses.
   • Cap replay response body streams at 10 MB with a 15-second timeout and force-close client on error/timeout.
   • Normalize IPv4-mapped IPv6 (::ffff:w.x.y.z), byte-mask ULA (fc00::/7), and byte-mask Link-Local (fe80::/10) private addresses.
   • Add explicit UI confirmation when replaying requests with truncated bodies.

4. Storage & Search (C2, C5, C6, F6, F7, F10):

   • Wire live rotation closure provider (fileRotationCountProvider) through engine, scope, and UI master search to prune expired entries.
   • Retain valid backing file path across runtime persistToDisk toggles.
   • Roll back to intact file handles on non-destructive reset failure, or enter degraded memory mode on destructive reset without crashing append().
   • Return empty page when search since_id cursor is missing from candidates.
   • Detect truncated file reads (bytes.length < length) as unavailable payloads in RealtimeStore.

5. Surfaces, Realtime & Sharing (S1, S5, S6, S7, F2, F4, F5, F8, F9):

   • Retain staged export files across mobile share chooser intents and add purgeStaleExports for temporary files older than 1 hour.
   • Throw MultipleAppsException in MCP AppDiscovery when multiple apps run without an explicit --uri.
   • Export valid UTF-8 multipart in Postman as mode: raw with text language option; emit diagnostic warning for binary/missing bodies.
   • Deduplicate in-flight JsonViewer async flatten isolate jobs and reset loading spinner on errors.
   • Prevent search input from being wiped during active typing debounce on scope rebuilds.
   • Manage 1 Hz duration ticker lifecycle in _RealtimeRowState on pending-to-closed transitions.
   • Transmit raw Uint8List bytes when resending binary frames.
   • Complete superseded/cancelled master search completers cleanly.
   • Safely coerce and validate non-string uri arguments in MCP connect_app.

Type of Change

• fix: A bug fix
• test: Adding or correcting tests

Affected Packages

• interceptly (Core package & UI overlay)
• interceptly_dio
• interceptly_http
• interceptly_chopper
• interceptly_socket_io
• interceptly_mcp

Quality Checklist

• My PR title follows Conventional Commits: type(scope): subject.
• I ran melos run check locally and it passed with zero errors/warnings.
• I added/updated unit or widget tests for my changes (895 / 895 tests passing).
• All new and existing tests pass (melos run test:core).
• Package health evaluated at 160/160 pub points (melos run pana).