Anything Analyzer Cdp

// Config shape (stored in SQLite settings table)interface LLMConfig {  provider: 'openai' | 'anthropic' | 'custom';  apiKey: string;      // from env or user input  model: string;       // e.g. 'gpt-4o', 'claude-sonnet-4-20250514'  baseUrl?: string;    // for custom OpenAI-compatible endpoints}

// Create a sessionconst session = await window.electron.ipcRenderer.invoke('session:create', {  name: 'My Analysis Session',  url: 'https://example.com'})
// List sessionsconst sessions = await window.electron.ipcRenderer.invoke('session:list')
// Delete sessionawait window.electron.ipcRenderer.invoke('session:delete', sessionId)

// Start capturing for current tabawait window.electron.ipcRenderer.invoke('capture:start', { sessionId, tabId })
// Stop capturingawait window.electron.ipcRenderer.invoke('capture:stop', { sessionId, tabId })
// Get captured requestsconst requests = await window.electron.ipcRenderer.invoke('capture:getRequests', sessionId)

// Trigger AI analysis (streams back via IPC events)await window.electron.ipcRenderer.invoke('analyze:start', { sessionId })
// Listen for streaming chunkswindow.electron.ipcRenderer.on('analyze:chunk', (_, chunk: string) => {  setReport(prev => prev + chunk)})
// Listen for completionwindow.electron.ipcRenderer.on('analyze:done', () => {  setAnalyzing(false)})

// src/main/ai/scene-detector.tsimport { CapturedRequest } from '../../shared/types'
export type Scene =  | 'registration'  | 'oauth'  | 'api-auth'  | 'websocket'  | 'general'
export function detectScene(requests: CapturedRequest[]): Scene {  const urls = requests.map(r => r.url.toLowerCase())  const bodies = requests.map(r => r.requestBody?.toLowerCase() ?? '')
  // OAuth detection  if (urls.some(u => u.includes('oauth') || u.includes('authorize') || u.includes('callback'))) {    return 'oauth'  }
  // Registration detection  if (    bodies.some(b => b.includes('password') && (b.includes('email') || b.includes('username'))) &&    urls.some(u => u.includes('register') || u.includes('signup') || u.includes('sign-up'))  ) {    return 'registration'  }
  // WebSocket upgrade detection  if (requests.some(r => r.isWebSocket)) {    return 'websocket'  }
  // Auth token patterns  if (urls.some(u => u.includes('/auth') || u.includes('/token') || u.includes('/login'))) {    return 'api-auth'  }
  return 'general'}

// src/main/ai/prompt-builder.tsimport { Scene } from './scene-detector'import { AssembledData } from './data-assembler'
export function buildPrompt(scene: Scene, data: AssembledData): string {  const sceneInstructions: Record<Scene, string> = {    registration: `Analyze this registration flow. Extract:1. Required fields and validation rules2. Password requirements  3. Captcha/bot protection mechanisms4. Email verification flow5. Reproducible curl commands for each step`,
    oauth: `Analyze this OAuth flow. Extract:1. OAuth provider and grant type2. Authorization URL with all parameters3. Token exchange endpoint and parameters4. Token refresh mechanism5. Scopes requested`,
    'api-auth': `Analyze this authentication protocol. Extract:1. Auth endpoint and method2. Request payload schema3. Response token format (JWT/session/etc)4. Token usage in subsequent requests (header name, format)5. Expiry and refresh strategy`,
    websocket: `Analyze this WebSocket protocol. Extract:1. Upgrade request headers2. Initial handshake messages3. Message format (JSON/binary/custom)4. Heartbeat/ping-pong mechanism5. Event types and schemas`,
    general: `Analyze this web protocol. Extract:1. Core API endpoints and their purposes2. Authentication mechanism3. Request/response schemas4. Error handling patterns5. Rate limiting signals`,  }
  return `You are a protocol reverse engineer. ${sceneInstructions[scene]}
## Captured Data
### Network Requests (${data.requests.length} total)${data.requests.map(r => `**${r.method} ${r.url}**Status: ${r.statusCode}Request Headers: ${JSON.stringify(r.requestHeaders, null, 2)}Request Body: ${r.requestBody ?? '(empty)'}Response Headers: ${JSON.stringify(r.responseHeaders, null, 2)}Response Body: ${r.responseBody ?? '(empty)'}`).join('\n---\n')}
### JS Hook Events${JSON.stringify(data.hookEvents, null, 2)}
### Storage Snapshots${JSON.stringify(data.storageSnapshots, null, 2)}
Generate a comprehensive protocol analysis report in Markdown.`}

// src/main/capture/js-injector.tsexport function buildHookScript(): string {  return `(function() {  // Hook fetch  const _fetch = window.fetch.bind(window)  window.fetch = async function(...args) {    const [input, init] = args    const url = input instanceof Request ? input.url : String(input)        // Pre-request hook    window.__cdpHook?.({ type: 'fetch:request', url, init: JSON.stringify(init) })        const response = await _fetch(...args)    const clone = response.clone()        // Post-response hook (non-blocking)    clone.text().then(body => {      window.__cdpHook?.({ type: 'fetch:response', url, status: response.status, body })    }).catch(() => {})        return response  }
  // Hook XHR  const _open = XMLHttpRequest.prototype.open  const _send = XMLHttpRequest.prototype.send    XMLHttpRequest.prototype.open = function(method, url, ...rest) {    this.__hookData = { method, url }    return _open.apply(this, [method, url, ...rest])  }    XMLHttpRequest.prototype.send = function(body) {    this.addEventListener('load', function() {      window.__cdpHook?.({        type: 'xhr:complete',        method: this.__hookData?.method,        url: this.__hookData?.url,        requestBody: body,        status: this.status,        responseBody: this.responseText      })    })    return _send.apply(this, [body])  }
  // Hook crypto.subtle for key detection  if (window.crypto?.subtle) {    const _sign = crypto.subtle.sign.bind(crypto.subtle)    crypto.subtle.sign = async function(algorithm, key, data) {      window.__cdpHook?.({ type: 'crypto:sign', algorithm: JSON.stringify(algorithm) })      return _sign(algorithm, key, data)    }  }
  // Hook document.cookie  const cookieDesc = Object.getOwnPropertyDescriptor(Document.prototype, 'cookie')  Object.defineProperty(document, 'cookie', {    get: function() { return cookieDesc.get.call(this) },    set: function(val) {      window.__cdpHook?.({ type: 'cookie:set', value: val })      return cookieDesc.set.call(this, val)    }  })})()`}

// src/main/db/ — SQLite via better-sqlite3import Database from 'better-sqlite3'import path from 'path'import { app } from 'electron'
const DB_PATH = path.join(app.getPath('userData'), 'analyzer.db')
export function getDb(): Database.Database {  const db = new Database(DB_PATH)  db.pragma('journal_mode = WAL')  return db}
// Typical schemaexport function initSchema(db: Database.Database) {  db.exec(`    CREATE TABLE IF NOT EXISTS sessions (      id TEXT PRIMARY KEY,      name TEXT NOT NULL,      url TEXT NOT NULL,      created_at INTEGER NOT NULL    );
    CREATE TABLE IF NOT EXISTS requests (      id TEXT PRIMARY KEY,      session_id TEXT NOT NULL,      url TEXT NOT NULL,      method TEXT NOT NULL,      status_code INTEGER,      request_headers TEXT,      request_body TEXT,      response_headers TEXT,      response_body TEXT,      is_sse INTEGER DEFAULT 0,      is_websocket INTEGER DEFAULT 0,      timestamp INTEGER NOT NULL,      FOREIGN KEY (session_id) REFERENCES sessions(id)    );
    CREATE TABLE IF NOT EXISTS hook_events (      id TEXT PRIMARY KEY,      session_id TEXT NOT NULL,      type TEXT NOT NULL,      data TEXT NOT NULL,      timestamp INTEGER NOT NULL    );
    CREATE TABLE IF NOT EXISTS storage_snapshots (      id TEXT PRIMARY KEY,      session_id TEXT NOT NULL,      cookies TEXT,      local_storage TEXT,      session_storage TEXT,      timestamp INTEGER NOT NULL    );
    CREATE TABLE IF NOT EXISTS settings (      key TEXT PRIMARY KEY,      value TEXT NOT NULL    );  `)}

// src/shared/types.tsexport interface Session {  id: string  name: string  url: string  createdAt: number}
export interface CapturedRequest {  id: string  sessionId: string  url: string  method: string  statusCode?: number  requestHeaders?: Record<string, string>  requestBody?: string  responseHeaders?: Record<string, string>  responseBody?: string  isSSE: boolean  isWebSocket: boolean  timestamp: number}
export interface HookEvent {  id: string  sessionId: string  type: 'fetch:request' | 'fetch:response' | 'xhr:complete' | 'crypto:sign' | 'cookie:set'  data: Record<string, unknown>  timestamp: number}
export interface StorageSnapshot {  id: string  sessionId: string  cookies: string  localStorage: Record<string, string>  sessionStorage: Record<string, string>  timestamp: number}
export interface LLMConfig {  provider: 'openai' | 'anthropic' | 'custom'  apiKey: string  model: string  baseUrl?: string}

// src/main/ai/ai-analyzer.tsimport Anthropic from '@anthropic-ai/sdk'import OpenAI from 'openai'
export async function* callLLM(  config: LLMConfig,  prompt: string): AsyncGenerator<string> {  if (config.provider === 'anthropic') {    const client = new Anthropic({ apiKey: config.apiKey })    const stream = await client.messages.stream({      model: config.model,      max_tokens: 8192,      messages: [{ role: 'user', content: prompt }]    })    for await (const chunk of stream) {      if (chunk.type === 'content_block_delta' && chunk.delta.type === 'text_delta') {        yield chunk.delta.text      }    }  } else {    // OpenAI or custom compatible    const client = new OpenAI({      apiKey: config.apiKey,      baseURL: config.baseUrl  // undefined = default OpenAI    })    const stream = await client.chat.completions.create({      model: config.model,      messages: [{ role: 'user', content: prompt }],      stream: true    })    for await (const chunk of stream) {      yield chunk.choices[0]?.delta?.content ?? ''    }  }}

// Useful for large sessions — filter to only auth-related requestsfunction filterRelevantRequests(requests: CapturedRequest[]): CapturedRequest[] {  const AUTH_PATTERNS = [    /\/auth/, /\/login/, /\/register/, /\/signup/, /\/token/,    /\/oauth/, /\/session/, /\/verify/, /\/captcha/  ]    return requests.filter(r => {    // Always include if has auth header    if (r.requestHeaders?.['authorization'] || r.requestHeaders?.['x-auth-token']) {      return true    }    // Include if URL matches auth patterns    if (AUTH_PATTERNS.some(p => p.test(r.url))) return true    // Include if response sets cookies    if (r.responseHeaders?.['set-cookie']) return true    // Exclude static assets    if (/\.(js|css|png|jpg|gif|svg|woff|ico)(\?|$)/.test(r.url)) return false    return false  })}