[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — run on extraction.py (isort also on the tests); no new findings
• make test passes, and a test case covers the change — tests/foundation and tests/interface module by module, the foundation unittest leg, and tests/project
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1264

Extractor.__init__ swapped format='pcap' for 'json' from the requested engine name; run() only later found the engine unavailable and ran the default PCAP engine. The availability check now lives in _select_engine(), which __init__ calls before the format and trace-format guards, so both follow the engine that runs. Each fallback still warns once.

Probe (examples/captures/test.pcap, format='pcap'/'cap', Python 3.14): pypcap, pcap_ct (not installed), pyshark, pypcapfile (unsupported) wrote out.json before and now write out.pcap, byte-identical to the input. dpkt/scapy, which do run, still get out.json plus the FormatWarning.

tests/foundation/test_extraction.py::_traced now patches _select_engine out alongside run; it pinned the guard firing for engines that can't run on this host. The FormatWarning text now names the lowercased engine (engine=dpkt, not engine=DPKT), as the trace one already did.

New test_extraction_engine_fallback_format_unit.py: 4 passed / 28 subtests with the fix; 29 failed, 3 passed without it.

[JarryShaw]

Verdict: GOOD TO GO at 5d86ceca6 (Sonnet cross-review; the author ran on Opus).

• Re-derived by me using test.pcap with format='pcap' and an engine that is not installed:
  • On main, pypcap and pcap_ct write out.pcap.json and raise FormatWarning + EngineWarning.
  • On this head they write out.pcap, byte-identical to the input, with only EngineWarning.
• Reviewer, unsupported engines: on 3.14, pyshark and pypcapfile behave the same way. dpkt and scapy are installed and still give json with a FormatWarning, unchanged. An unknown engine is unchanged.
• One warning per fallback: calling _select_engine() again adds nothing, and extract() gives exactly one EngineWarning.
• Side effects, none of them breaking:
  • trace_format now follows the engine that runs, and the new test_trace_format_is_kept covers it.
  • The warning text is now engine=dpkt. The only pin, test_extraction_pcap_output_unit.py:103, does not include the engine name.
  • Engine warnings now fire before FileNotFound.
• Edited _traced helper: the change is legitimate. Its six subtests assert only the format guard, and the real path is still covered end to end.
• Tests:
  • With only extraction.py reverted, 29 fail.
  • 66 foundation/interface/project modules plus 13 cli/integration modules pass.
  • The foundation leg runs 526 tests with 0 failures.

[github-actions]

Coverage: 89.45% (unit tier, Python 3.14, 5d86ceca6, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2038	89	634	25	94.76%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2643	98	930	48	94.79%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16615	221	4474	185	98.04%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.