mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
11ab5f83a1
## Summary - add a containerized differential network capture harness for Claude Code direct vs Claude Code routed through Headroom - capture both Headroom client-side traffic and Headroom upstream traffic with sanitized mitmproxy JSONL output - add `headroom capture network-diff` to compare captures and produce Markdown/JSON reports, including Anthropic tool-count/tool-byte deltas for deferred-tool investigations - add an on-demand GitHub Actions workflow for the harness; it only runs via `workflow_dispatch`, with live Claude Code/Anthropic capture gated on `ANTHROPIC_API_KEY` - document the workflow and ignore generated capture artifacts ## Validation - `C:\git\headroom\.venv\Scripts\python.exe -m pytest tests/test_network_diff_capture.py` - `ruff check headroom/capture headroom/cli/capture.py tests/test_network_diff_capture.py` - `ruff format --check headroom/capture headroom/cli/capture.py tests/test_network_diff_capture.py` - `C:\git\headroom\.venv\Scripts\python.exe -m mypy headroom/capture/network_diff.py headroom/cli/capture.py` - `docker compose -f docker/differential-network-capture/docker-compose.yml --profile run config` - `docker compose -f docker/differential-network-capture/docker-compose.yml --profile run build claude-direct` - `docker run --rm -e CLAUDE_COMMAND="claude --version" headroom-network-diff-claude-direct:latest` - parsed `.github/workflows/network-diff-capture.yml` with PyYAML and confirmed manual-only trigger Live Claude API capture was not run locally because `ANTHROPIC_API_KEY` is not set in this environment. The workflow can run it manually in GitHub Actions when that secret is present; otherwise it emits a visible skip warning and uploads a skipped artifact. ## Notes - Full pre-commit mypy still fails on unrelated Windows `fcntl` attributes in `headroom/subscription/tracker.py`; the feature commit skipped only that hook after narrow mypy passed for the new modules. - `tests/test_release_workflows.py` has two Windows-local failures because it shells out to a missing Unix/Rust command; unrelated workflow checks in that file passed before those failures. - Motivated by https://github.com/chopratejas/headroom/issues/746#issuecomment-4651276818 / Issue #746.
142 lines
4.2 KiB
YAML
142 lines
4.2 KiB
YAML
name: headroom-network-diff
|
|
|
|
services:
|
|
mitm-direct:
|
|
image: mitmproxy/mitmproxy:12
|
|
command:
|
|
- mitmdump
|
|
- --mode
|
|
- regular
|
|
- --listen-host
|
|
- 0.0.0.0
|
|
- --listen-port
|
|
- "8080"
|
|
- --set
|
|
- confdir=/mitmproxy
|
|
- -s
|
|
- /capture/mitm_capture.py
|
|
environment:
|
|
CAPTURE_LANE: direct
|
|
CAPTURE_OUTPUT: /captures/direct.jsonl
|
|
CAPTURE_INCLUDE_HOSTS: ${CAPTURE_INCLUDE_HOSTS:-api.anthropic.com}
|
|
CAPTURE_BODY_BYTES: ${CAPTURE_BODY_BYTES:-262144}
|
|
volumes:
|
|
- ./mitm_capture.py:/capture/mitm_capture.py:ro
|
|
- ./captures:/captures
|
|
- mitm_direct_ca:/mitmproxy
|
|
ports:
|
|
- "${DIRECT_MITM_PORT:-18080}:8080"
|
|
|
|
mitm-headroom-client:
|
|
image: mitmproxy/mitmproxy:12
|
|
command:
|
|
- mitmdump
|
|
- --mode
|
|
- reverse:http://headroom-proxy:8787
|
|
- --listen-host
|
|
- 0.0.0.0
|
|
- --listen-port
|
|
- "8080"
|
|
- -s
|
|
- /capture/mitm_capture.py
|
|
environment:
|
|
CAPTURE_LANE: headroom-client
|
|
CAPTURE_OUTPUT: /captures/headroom-client.jsonl
|
|
CAPTURE_INCLUDE_HOSTS: ${CAPTURE_CLIENT_INCLUDE_HOSTS:-mitm-headroom-client,headroom-proxy,api.anthropic.com}
|
|
CAPTURE_BODY_BYTES: ${CAPTURE_BODY_BYTES:-262144}
|
|
volumes:
|
|
- ./mitm_capture.py:/capture/mitm_capture.py:ro
|
|
- ./captures:/captures
|
|
ports:
|
|
- "${HEADROOM_CLIENT_MITM_PORT:-18082}:8080"
|
|
depends_on:
|
|
- headroom-proxy
|
|
|
|
mitm-headroom-upstream:
|
|
image: mitmproxy/mitmproxy:12
|
|
command:
|
|
- mitmdump
|
|
- --mode
|
|
- regular
|
|
- --listen-host
|
|
- 0.0.0.0
|
|
- --listen-port
|
|
- "8080"
|
|
- --set
|
|
- confdir=/mitmproxy
|
|
- -s
|
|
- /capture/mitm_capture.py
|
|
environment:
|
|
CAPTURE_LANE: headroom-upstream
|
|
CAPTURE_OUTPUT: /captures/headroom-upstream.jsonl
|
|
CAPTURE_INCLUDE_HOSTS: ${CAPTURE_INCLUDE_HOSTS:-api.anthropic.com}
|
|
CAPTURE_BODY_BYTES: ${CAPTURE_BODY_BYTES:-262144}
|
|
volumes:
|
|
- ./mitm_capture.py:/capture/mitm_capture.py:ro
|
|
- ./captures:/captures
|
|
- mitm_headroom_ca:/mitmproxy
|
|
ports:
|
|
- "${HEADROOM_MITM_PORT:-18081}:8080"
|
|
|
|
headroom-proxy:
|
|
build:
|
|
context: ../..
|
|
dockerfile: Dockerfile
|
|
command: ["--host", "0.0.0.0", "--port", "8787", "--backend", "anthropic"]
|
|
environment:
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:?Set ANTHROPIC_API_KEY}
|
|
ANTHROPIC_TARGET_API_URL: ${ANTHROPIC_TARGET_API_URL:-https://api.anthropic.com}
|
|
HTTPS_PROXY: http://mitm-headroom-upstream:8080
|
|
HTTP_PROXY: http://mitm-headroom-upstream:8080
|
|
NO_PROXY: 127.0.0.1,localhost,headroom-proxy
|
|
REQUESTS_CA_BUNDLE: /mitmproxy/mitmproxy-ca-cert.pem
|
|
SSL_CERT_FILE: /mitmproxy/mitmproxy-ca-cert.pem
|
|
volumes:
|
|
- mitm_headroom_ca:/mitmproxy:ro
|
|
depends_on:
|
|
- mitm-headroom-upstream
|
|
|
|
claude-direct:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.runner
|
|
args:
|
|
CLAUDE_CODE_PACKAGE: ${CLAUDE_CODE_PACKAGE:-@anthropic-ai/claude-code}
|
|
profiles: ["run"]
|
|
environment:
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:?Set ANTHROPIC_API_KEY}
|
|
HTTPS_PROXY: http://mitm-direct:8080
|
|
HTTP_PROXY: http://mitm-direct:8080
|
|
NO_PROXY: 127.0.0.1,localhost
|
|
NODE_EXTRA_CA_CERTS: /mitmproxy/mitmproxy-ca-cert.pem
|
|
SSL_CERT_FILE: /mitmproxy/mitmproxy-ca-cert.pem
|
|
CLAUDE_LANE: direct
|
|
CLAUDE_PROMPT: ${CLAUDE_PROMPT:-Summarize this repository in one sentence.}
|
|
CLAUDE_ARGS: ${CLAUDE_DIRECT_ARGS:-}
|
|
volumes:
|
|
- ../..:/workspace:ro
|
|
- mitm_direct_ca:/mitmproxy:ro
|
|
depends_on:
|
|
- mitm-direct
|
|
|
|
claude-headroom:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile.runner
|
|
args:
|
|
CLAUDE_CODE_PACKAGE: ${CLAUDE_CODE_PACKAGE:-@anthropic-ai/claude-code}
|
|
profiles: ["run"]
|
|
environment:
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:?Set ANTHROPIC_API_KEY}
|
|
ANTHROPIC_BASE_URL: http://mitm-headroom-client:8080
|
|
CLAUDE_LANE: headroom
|
|
CLAUDE_PROMPT: ${CLAUDE_PROMPT:-Summarize this repository in one sentence.}
|
|
CLAUDE_ARGS: ${CLAUDE_HEADROOM_ARGS:-}
|
|
volumes:
|
|
- ../..:/workspace:ro
|
|
depends_on:
|
|
- mitm-headroom-client
|
|
|
|
volumes:
|
|
mitm_direct_ca:
|
|
mitm_headroom_ca:
|