Skip to content

Unified MITM proxy for credential injection#3

Open
evgeny-boger wants to merge 3 commits intomainfrom
test-proxy-push-1772499886
Open

Unified MITM proxy for credential injection#3
evgeny-boger wants to merge 3 commits intomainfrom
test-proxy-push-1772499886

Conversation

@evgeny-boger
Copy link
Member

Summary

  • Replace 3 separate proxies (claude-vm-proxy, github-git-proxy, github-mcp-proxy) with a two-tier MITM architecture: mitmproxy (VM-side) + credential-proxy (host-side)
  • Per-repo token routing via path_prefix matching for GitHub App installation tokens
  • Cross-VM isolation via per-instance shared secret (X-Proxy-Token)
  • Fix mitmproxy startup: use systemd-run --user instead of nohup (survives SSH session exit)
  • Git SSH→HTTPS rewrite via url.insteadOf (SSH can't go through HTTP proxy)
  • Fix gh >=2.40 migration error with config.yml version: "1"
  • Conditional setup: skip proxy chain when no credentials configured
  • Check push access via git push --dry-run before starting GitHub device auth flow
  • Proxy env vars via /etc/profile.d/ instead of .bashrc
  • ARC42 architecture doc in Russian

Test plan

  • 42 unit tests pass (python3 -m unittest test_credential_proxy -v)
  • 6 E2E VM tests pass (test_e2e_vm.py)
  • Manual: agent-vm shellgh auth statusgit push roundtrip
  • Manual: agent-vm claude with CLAUDE_VM_PROXY_ACCESS_TOKEN set
  • Manual: VM startup without any credentials configured

🤖 Generated with Claude Code

evgeny-boger and others added 3 commits March 3, 2026 01:21
- Fix avail==0 treated as "no stats": allow avail=0 as legitimate (guest OOM)
- Fix max_mem auto-detection: use query-memory-size-summary (QEMU -m value)
  instead of current balloon size, which may have been shrunk by a prior daemon
- Fix CRITICAL path slower than GROW: jump to max(desired, cur+2*step)
- Change defaults: headroom 20%→40%, min-free 384M→1G
- Make GROW jump directly to desired (matching SHRINK), both directions fast
- Ensure desired >= used + min_free (at least 1G headroom always)
- Add comprehensive docstring and update help text

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix mitmproxy startup: use systemd-run --user instead of nohup
  (process was killed when limactl shell SSH session exited)
- Move proxy env vars from .bashrc to /etc/profile.d/credential-proxy.sh
  (avoids polluting shell after proxy stops)
- Add git SSH→HTTPS rewrite via url.insteadOf (SSH can't go through
  HTTP proxy, HTTPS goes through mitmproxy for credential injection)
- Fix gh >=2.40 migration error: write config.yml with version: "1"
  to prevent API call during multi-account migration
- Make credential setup conditional: skip .credentials.json when
  CLAUDE_VM_PROXY_ACCESS_TOKEN unset, skip proxy chain when no
  credential rules exist
- Request scoped tokens for all submodules (don't skip public repos,
  user may have write access)
- Update ARC42 architecture doc with all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Before starting the interactive GitHub device auth flow, verify the
user has write access using git push --dry-run. Works with both SSH
keys and HTTPS credentials — no API token needed. Repos without
write access are skipped silently.

Update ARC42 architecture doc.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@evgeny-boger evgeny-boger force-pushed the test-proxy-push-1772499886 branch from 4fad804 to 31ad65f Compare March 3, 2026 14:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant