mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
11ab5f83a1
## Summary - add a containerized differential network capture harness for Claude Code direct vs Claude Code routed through Headroom - capture both Headroom client-side traffic and Headroom upstream traffic with sanitized mitmproxy JSONL output - add `headroom capture network-diff` to compare captures and produce Markdown/JSON reports, including Anthropic tool-count/tool-byte deltas for deferred-tool investigations - add an on-demand GitHub Actions workflow for the harness; it only runs via `workflow_dispatch`, with live Claude Code/Anthropic capture gated on `ANTHROPIC_API_KEY` - document the workflow and ignore generated capture artifacts ## Validation - `C:\git\headroom\.venv\Scripts\python.exe -m pytest tests/test_network_diff_capture.py` - `ruff check headroom/capture headroom/cli/capture.py tests/test_network_diff_capture.py` - `ruff format --check headroom/capture headroom/cli/capture.py tests/test_network_diff_capture.py` - `C:\git\headroom\.venv\Scripts\python.exe -m mypy headroom/capture/network_diff.py headroom/cli/capture.py` - `docker compose -f docker/differential-network-capture/docker-compose.yml --profile run config` - `docker compose -f docker/differential-network-capture/docker-compose.yml --profile run build claude-direct` - `docker run --rm -e CLAUDE_COMMAND="claude --version" headroom-network-diff-claude-direct:latest` - parsed `.github/workflows/network-diff-capture.yml` with PyYAML and confirmed manual-only trigger Live Claude API capture was not run locally because `ANTHROPIC_API_KEY` is not set in this environment. The workflow can run it manually in GitHub Actions when that secret is present; otherwise it emits a visible skip warning and uploads a skipped artifact. ## Notes - Full pre-commit mypy still fails on unrelated Windows `fcntl` attributes in `headroom/subscription/tracker.py`; the feature commit skipped only that hook after narrow mypy passed for the new modules. - `tests/test_release_workflows.py` has two Windows-local failures because it shells out to a missing Unix/Rust command; unrelated workflow checks in that file passed before those failures. - Motivated by https://github.com/chopratejas/headroom/issues/746#issuecomment-4651276818 / Issue #746.
89 lines
3.2 KiB
Python
89 lines
3.2 KiB
Python
"""mitmproxy addon that writes sanitized HTTP exchanges as JSONL."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import time
|
|
from pathlib import Path
|
|
from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
|
|
|
|
from mitmproxy import http
|
|
|
|
LANE = os.environ.get("CAPTURE_LANE", "unknown")
|
|
OUTPUT = Path(os.environ.get("CAPTURE_OUTPUT", f"/captures/{LANE}.jsonl"))
|
|
INCLUDE_HOSTS = {
|
|
host.strip().lower()
|
|
for host in os.environ.get("CAPTURE_INCLUDE_HOSTS", "api.anthropic.com").split(",")
|
|
if host.strip()
|
|
}
|
|
BODY_BYTES = int(os.environ.get("CAPTURE_BODY_BYTES", "262144"))
|
|
SENSITIVE_HEADER_PARTS = ("authorization", "api-key", "apikey", "token", "secret", "cookie")
|
|
SENSITIVE_QUERY_PARTS = ("key", "token", "secret", "signature", "code")
|
|
_sequence = 0
|
|
|
|
|
|
def _redact_headers(headers: http.Headers) -> dict[str, str]:
|
|
result: dict[str, str] = {}
|
|
for key, value in headers.items(multi=True):
|
|
if any(part in key.lower() for part in SENSITIVE_HEADER_PARTS):
|
|
result[key] = "<redacted>"
|
|
else:
|
|
result[key] = value
|
|
return result
|
|
|
|
|
|
def _sanitize_url(url: str) -> str:
|
|
parsed = urlsplit(url)
|
|
pairs = []
|
|
for key, value in parse_qsl(parsed.query, keep_blank_values=True):
|
|
if any(part in key.lower() for part in SENSITIVE_QUERY_PARTS):
|
|
pairs.append((key, "<redacted>"))
|
|
else:
|
|
pairs.append((key, value))
|
|
return urlunsplit((parsed.scheme, parsed.netloc, parsed.path, urlencode(pairs), ""))
|
|
|
|
|
|
def _request_json(content: bytes) -> object | None:
|
|
try:
|
|
return json.loads(content.decode("utf-8"))
|
|
except Exception:
|
|
return None
|
|
|
|
|
|
def response(flow: http.HTTPFlow) -> None:
|
|
global _sequence
|
|
host = flow.request.pretty_host.lower()
|
|
if INCLUDE_HOSTS and host not in INCLUDE_HOSTS:
|
|
return
|
|
|
|
_sequence += 1
|
|
request_body = flow.request.raw_content or b""
|
|
response_body = flow.response.raw_content if flow.response else b""
|
|
record = {
|
|
"lane": LANE,
|
|
"sequence": _sequence,
|
|
"timestamp": time.time(),
|
|
"method": flow.request.method,
|
|
"url": _sanitize_url(flow.request.pretty_url),
|
|
"host": flow.request.pretty_host,
|
|
"request_headers": _redact_headers(flow.request.headers),
|
|
"request_body_size": len(request_body),
|
|
"request_body_sha256": hashlib.sha256(request_body).hexdigest() if request_body else None,
|
|
"request_body_b64": base64.b64encode(request_body[:BODY_BYTES]).decode("ascii"),
|
|
"request_body_truncated": len(request_body) > BODY_BYTES,
|
|
"request_json": _request_json(request_body),
|
|
"response_status": flow.response.status_code if flow.response else None,
|
|
"response_headers": _redact_headers(flow.response.headers) if flow.response else {},
|
|
"response_body_size": len(response_body),
|
|
"response_body_sha256": hashlib.sha256(response_body).hexdigest()
|
|
if response_body
|
|
else None,
|
|
}
|
|
|
|
OUTPUT.parent.mkdir(parents=True, exist_ok=True)
|
|
with OUTPUT.open("a", encoding="utf-8") as fh:
|
|
fh.write(json.dumps(record, separators=(",", ":"), sort_keys=True))
|
|
fh.write("\n")
|