Network Recording

Use this skill only for an explicitly authorized Target and a network-enabled Docker lab. Recording is an observation capability: it does not expand target authorization, allowed methods, redirect scope, or the selected network profile.

Enable

Set the lab's Traffic recording option to mitmproxy (or set NETWORK_TRAFFIC_RECORDING_MODE=mitmproxy before the lab starts). Enabling or changing recording recreates the lab — an infrastructure mutation — so treat it as the user's/UI's decision or obtain a durable approval covering it; do not enable recording on your own initiative. The lab is recreated so its HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY point to a per-project mitmproxy sidecar on 127.0.0.1:8080.

The recorder shares the lab's Docker network namespace (network_mode: service:lab is the Compose equivalent), so the existing egress firewall also constrains proxy-originated traffic. Its CA is trusted only inside that project lab. Recording cannot be enabled for offline labs.

Flows are retained in the project Docker volume as /captures/traffic.mitm inside the recorder. They can contain credentials, cookies, request bodies, and response bodies; treat them as sensitive evidence and retain them exactly. The recorder captures all proxied lab traffic, including CDN, registry, and telemetry flows — third-party content is not target evidence and must stay out of prompts, telemetry, and evidence.

Search flows

Run these docker exec commands from the host against the recorder container, substituting its project-specific name from the lab boot log. Every docker exec is a shell command and requires a durable command approval matching the exact invocation (see docs/durable-approvals.md). The -nr flag is read-only: never modify the capture in place, and never use mitmproxy client/server replay without a validation plan.

# Compact request/response index.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm --set flow_detail=0

# Filter by host, method, status code (~c), or URL fragment.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~d target.example'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~m POST'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~c 500'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~u /api/'

# Search decoded request/response content deliberately; this may expose secrets.
# ~bq matches request bodies; ~bs matches response bodies; ~b matches both.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~bq token'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~b error'

Prefer narrow filters and confine searches to authorized target domains before quoting content. Record the exact command, target, time window, and result count alongside the flow Evidence. Stop capture when the approved observation is complete; stopping the lab stops its recorder but preserves the flow volume.

Export flows

Captures live in a Docker volume the workspace cannot address, so they only become durable evidence once exported and registered. Export the filtered slice byte-exact, then register it through the Evidence Interface (src/server/evidence/artifact-service.ts) and cite the returned artifact ID:

docker exec <recorder> mitmdump -nr /captures/traffic.mitm \
  -w /captures/exports/traffic-filtered.mitm '~d target.example'

Note the flow volume's size at stop time; traffic.mitm grows without bound. Deletion is governed by the lab disposition flow — do not delete captures on your own initiative. Never replay captured side effects without a validation plan.