Skip to content

feat: LLM conversation reassembly and viewer UI#10

Draft
tito wants to merge 13 commits intomainfrom
mathieu/mitm-llm-request-reassembly
Draft

feat: LLM conversation reassembly and viewer UI#10
tito wants to merge 13 commits intomainfrom
mathieu/mitm-llm-request-reassembly

Conversation

@tito
Copy link
Contributor

@tito tito commented Mar 14, 2026

Summary

image
  • Intercept and reassemble LLM API conversations (Anthropic Messages API) from MITM HTTP traffic into structured conversations with turns, tool calls, and thinking blocks
  • Native conversation dissector framework with SSE response parsing and request body extraction
  • Incremental conversation assembler that processes new HTTP transactions and groups them by session
  • Subagent detection and linking (parent/child conversation relationships)
  • Dashboard UI at /conversations with split-pane layout, WebSocket live updates, markdown rendering, tool I/O display with expand/collapse, and URL state management for shareable links

Test plan

  • Verify conversations page loads and lists detected conversations
  • Select a conversation and confirm turns render with USER/AGENT labels
  • Confirm markdown formatting renders correctly in messages
  • Expand tool input/result with "Show more" and verify content displays without line number prefixes
  • Click "View subagent" link on Agent tool calls and verify navigation
  • Refresh the page with a conversation ID in the URL and confirm it restores selection
  • Use browser back/forward and verify navigation works

tito added 13 commits March 13, 2026 09:24
Add TLS man-in-the-middle capability so greyproxy can decrypt and log
HTTPS request/response content flowing through the proxy.

- Add `greyproxy cert generate/install` CLI for CA certificate management
- Auto-inject MITM cert paths into HTTP/SOCKS5 handler metadata on startup
- Enable sniffing by default in greyproxy.yml for both proxy services
- Add OnHTTPRoundTrip callback to Sniffer for decrypted traffic hooks
- Wire [MITM] log output in both HTTP and SOCKS5 handlers
- Fix GenerateCertificate to auto-detect key type (ECDSA/Ed25519/RSA)
  instead of hardcoding SHA256WithRSA
Add end-to-end HTTP transaction recording for MITM-intercepted requests:

- DB: migration for http_transactions table with indexes
- Models: HttpTransaction, HttpTransactionJSON, HttpTransactionCreateInput
- CRUD: create, get, query with filtering (container, destination, method, date range)
- API: GET /api/transactions (list) and GET /api/transactions/:id (detail with body)
- UI: Traffic page with HTMX table, filters, pagination, expandable row details
- Hook: GlobalHTTPRoundTripHook in sniffer + bridge via gostx.SetGlobalMitmHook
- Wire: program.go connects MITM hook to DB storage and EventBus
- Fix: auther srcAddrKey type mismatch — use xctx.SrcAddrFromContext for correct
  client IP resolution (was causing unknown-unknown container names)
- Fix: remove custom lt/gt template funcs that shadowed Go builtins and broke
  int64 comparisons in traffic table (only first row rendered)
- Tests: API handler tests (9), HTMX route tests (10), CRUD tests (5), plugin tests
Detect whether the system uses update-ca-trust (Arch, Fedora, RHEL) or
update-ca-certificates (Debian, Ubuntu) and run the install automatically
with sudo, falling back to manual instructions on failure.
Most content was truncated. But i need to see what's the required size
to support the 1M context from opus
…ing, and system prompt capture

Restructure conversation turns from flat concatenated fields into ordered
steps that preserve the actual back-and-forth flow (assistant -> tool calls
-> tool results -> assistant). Tool results are now attached directly to
their corresponding tool calls. Subagent conversations are linked from
parent Agent tool calls. Full system prompt is captured in output JSON.
Move viewer.html to cmd/assembleconv/ so it's version-controlled.
The assembler now copies it into the output dir as index.html on each run.
assemble2.py reads directly from greyproxy.db (bypassing the export step),
tracks a watermark for incremental processing, stores results in
conversation.db, and serves a REST API with a live web viewer.
…ard UI

Port the Python conversation assembler (assemble2.py) into Go as a native
greyproxy feature. Introduces a Wireshark-inspired dissector framework for
provider-specific HTTP body parsing, with Anthropic as the first dissector.

- Dissector framework: interface + registry in internal/greyproxy/dissector/
- Anthropic dissector: parses Messages API requests, SSE responses, extracts
  session IDs, models, messages, system prompts, and tool calls
- SSE parser shared across providers
- Database: conversations, turns, processing_state tables (migration 7),
  conversation_id FK on http_transactions (migration 8)
- Assembly engine: subscribes to EventTransactionNew, debounces, groups by
  session, classifies threads, builds turns with tool result merging,
  recovers SSE responses, links subagents. Backfills on startup.
- REST API: /api/conversations, /api/conversations/:id, /api/conversations/:id/subagents
- Conversations page: split-pane layout with sidebar list and detail panel,
  collapsible system prompts, thinking blocks, tool calls, subagent navigation,
  live updates via WebSocket
- Test fixtures from real Anthropic API transactions
@cowpig
Copy link

cowpig commented Mar 14, 2026

It would be cool to have a table of contents style tree structure on the side for navigating the conversation history (collapseable?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants