inspector: fix ctype UB, stoi overflow, WebSocket frame bounds

[VirajMishra1]

Fixes four small issues in the inspector:

• inspector_io.cc: the ::isdigit call now takes an unsigned char. Passing a plain char is undefined behavior when the value is negative, which happens with non-ASCII input.
• inspector_io.cc: std::stoi is replaced with std::from_chars. The string is already checked to be all digits, so the only difference is overflow: stoi throws, which doesn't build with -fno-exceptions, and from_chars reports an error code that we now check.
• inspector_io.cc: target_session_id is cast to unsigned int before the << 16, since left-shifting a negative or large signed value is undefined behavior.
• inspector_socket.cc: in decode_frame_hybi17 the length check compared the payload length against the size of the whole buffer. At that point the frame header has already been consumed, so it now compares against the bytes remaining after the iterator. That stops a frame whose declared length is larger than what is actually left from being treated as complete.

I used AI tooling to help find these and draft the first version. I reviewed and understand each change and I am responsible for it.

[nodejs-github-bot]

Review requested:

• @nodejs/http
• @nodejs/inspector
• @nodejs/net

[MikeMcC399]

Caution

AgentScan found account activity patterns that may be consistent with
automation. This is a heuristic, not proof that this pull request was
opened by an agent or violates policy. AI-assisted contributions are
permitted, but automated tooling must not open pull requests without
advance approval, and contributors must personally understand, test,
verify, and take responsibility for every submitted change. See the
AgentScan analysis,
AI use policy,
and
automation policy
for additional context.

[MikeMcC399]

Please make sure you have read and understood the following documents:

• Guides and FAQs for first-time contributors
• contribution and automation policies
• pull request guide
• AI use policy
• Code of Conduct

[VirajMishra1]

I have read and understood all of the linked documents -- the contributing guide, pull request guide, AI use policy, automation policy, and Code of Conduct.

To be transparent: I used AI tooling to help identify these bugs and draft the initial code, but I personally reviewed each change, understand what it does, and take responsibility for it. I did not use automated tooling to open this PR -- I opened it manually after reviewing the diff. Happy to discuss any of the specific changes if that would help.

[VirajMishra1]

Thanks for checking. Two CI failures, both now fixed:

1. Build failures (inspector_io.cc): The try/catch around std::stoi doesn't compile when -fno-exceptions is set. Replaced with std::from_chars (C++17, no exceptions needed, same overflow-safe behavior).

2. Commit message lint: The title used fix: which isn't a valid Node.js subsystem prefix. Amended to inspector,http,os: fix ctype UB, stoi overflow, proto pollution (within 72 chars, valid subsystems, with Signed-off-by trailer).

Force-pushed the updated commit. CI should be clean now.

[panva]

this alone would likely need a full http CI benchmark

[VirajMishra1]

I reverted it for now, happy to revisit in a separate PR with benchmarks.

[codecov]

Codecov Report

❌ Patch coverage is 88.88889% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.05%. Comparing base (6e7818e) to head (87a5ab0).
⚠️ Report is 284 commits behind head on main.

Files with missing lines	Patch %	Lines
src/inspector_io.cc	85.71%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65763      +/-   ##
==========================================
+ Coverage   89.95%   90.05%   +0.09%     
==========================================
  Files         757      769      +12     
  Lines      258053   261322    +3269     
  Branches    48934    49631     +697     
==========================================
+ Hits       232144   235336    +3192     
- Misses      16962    17035      +73     
- Partials     8947     8951       +4     

Files with missing lines	Coverage Δ
src/inspector_socket.cc	82.90% <100.00%> (+0.04%)	⬆️
src/inspector_io.cc	91.16% <85.71%> (-0.64%)	⬇️

... and 74 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[VirajMishra1]

Thanks for flagging this. The mismatch was from before I replaced stoi with from_chars and dropped the http change. The title and the commit message are now the same, and I have updated the description so it lists the four changes actually in the diff and describes the frame bounds check correctly.