Add context menus and a Replay shortcut to the plugin's own tabs

Caido builds a command's page context from a fixed list of its own routes, so
a plugin page contributes none and the global bindings cannot see what a
plugin table has selected. The plugin's views therefore carry their own:

- HTTP Records and Findings rows, and their request and response panes, get a
  right-click menu; Cmd-R / Ctrl-R sends whatever is on screen to Replay.
- Findings replay evidence through a new sendRawToReplay, which recovers the
  target from the message's own Host header, with matchedAt supplying only the
  scheme - so an agent finding, whose matchedAt is a source path, still works.
- HttpMessageView rebuilds its editors when Caido tears them down on page
  navigation, so a pane no longer comes back empty or showing the last record.
- Per-request bridge and proxy success logs are dropped: a scan drove a few
  thousand of them and buried every other plugin's output. Failures still log.

Bump to 0.1.1 and repack caido-vigolium.zip.

Author: j3ssie

README.md

@@ -5,7 +5,7 @@ resulting findings, and synchronizing traffic in both directions. It supports ex
 Caido, automatic Proxy forwarding, Sitemap snapshots, and an optional loopback-only live bridge for
 CLI and server integrations.
 
-- **Version:** `0.1.0`
+- **Version:** `0.1.1`
 - **GitHub:** [github.com/vigolium/vigolium](https://github.com/vigolium/vigolium)
 - **Docs:** [docs.vigolium.com](https://docs.vigolium.com/)
 - **Plugin guide:**
@@ -162,6 +162,29 @@ Every binding is also a command: open the palette with `⌘K` / `Ctrl+K` and sea
 The context-menu actions on a request row, request pane or response pane do the same thing without
 a keyboard.
 
+Those five bindings push Caido's own traffic into Vigolium, so they act on whatever Caido has
+selected - a row in HTTP History, Search, Sitemap or Replay - and report `nothing selected to send`
+anywhere else. They cannot read a selection inside the Vigolium page itself: Caido builds a
+command's page context from a fixed list of its own routes, and a plugin page contributes none.
+
+The plugin's own views therefore carry their own bindings and menus, which work only while that view
+is on screen:
+
+| Where                     | Action                                                                                |
+| ------------------------- | ------------------------------------------------------------------------------------- |
+| HTTP Records row or panes | Right-click for Send to Replay, Scan, Copy URL, Delete                                |
+| Findings row or evidence  | Right-click for Send to Replay, Copy as Markdown, Copy request, Copy response, Delete |
+| Either tab                | `⌘R` / `Ctrl+R` sends the open record - or the evidence on screen - to Replay         |
+
+A finding's evidence is stored text with no request behind it, so replaying it re-imports the
+message. The target is recovered from the message's own `Host` header, with the finding's
+`matchedAt` supplying only the scheme - an absolute request target wins over both, and an agent
+finding, whose `matchedAt` is a source path, still replays as long as the message carries a `Host`.
+
+Right-click does nothing on these views in stock Caido. Its `RequestRow`, `Request` and `Response`
+menus are attached by Caido's own tables and request panes; `sdk.ui.httpRequestEditor()` hands a
+plugin a bare editor with no menu wiring, so the plugin has to supply its own.
+
 The Burp extension's `Ctrl+Alt+…` bindings carry over on Windows and Linux. macOS uses `⌘⌃`
 instead, because `Alt` there is the Option dead-key - the OS turns `Alt+V` into `√` before Caido
 sees it. `⌘⇧` would have been the obvious choice but is already taken: Caido binds `⌘⇧A` to Automate

caido-vigolium.zip

@@ -1,7 +1,7 @@
 {
   "id": "vigolium",
   "name": "Vigolium",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Send Caido traffic to the Vigolium scanning engine, review findings, and bridge traffic in both directions with the Vigolium CLI and server.",
   "author": {
     "name": "Vigolium",

manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "caido-vigolium",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "type": "module",
   "description": "Vigolium plugin for Caido",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": true,
   "type": "module",
   "types": "./src/index.ts",

packages/backend/package.json

@@ -242,7 +242,14 @@ export async function openInReplay(
   collectionId?: string,
 ): Promise<string> {
   const requestId = await injectRequest(sdk, input);
-  const session = await sdk.replay.createSession(requestId, collectionId);
+  // Caido converts every argument it is handed, so an explicit `undefined`
+  // collection is not read as "no collection" - it fails the ID conversion with
+  // "Not an ID. Error converting from js 'undefined' into type 'string'". The
+  // argument has to be left off entirely, which is why this is two calls.
+  const session =
+    collectionId === undefined
+      ? await sdk.replay.createSession(requestId)
+      : await sdk.replay.createSession(requestId, collectionId);
   await renameSession(sdk, session.getId(), name);
   return session.getId();
 }

packages/backend/src/bridge/caido.ts

@@ -43,6 +43,20 @@ export const MAX_REPEATER_BODY_BYTES = 2 * 1024 * 1024;
 const DEFAULT_SEND_TIMEOUT_MS = 30_000;
 const MAX_SEND_TIMEOUT_MS = 120_000;
 
+/*
+ * A note on logging, which these routes deliberately do almost none of.
+ *
+ * A scan drives /send, /sitemap, /repeater and /organizer once per request it
+ * makes, so a line each - however terse - buries every other plugin's logs
+ * under a few thousand entries nobody reads. What the line would have said is
+ * already somewhere better: the caller gets it in the reply, and the traffic
+ * itself lands in Caido's own Sitemap and Replay.
+ *
+ * Failures are the exception, being rare and worth interrupting for. Most
+ * arrive here as a throw and are logged centrally by the service; a send that
+ * comes back unsent is not one of those, so it logs where it happens.
+ */
+
 const SCOPE_BLOCKED_MESSAGE =
   "target is out of Caido scope; disable in-scope-only or add it to the project scope";
 
@@ -210,7 +224,6 @@ export async function sitemap(ctx: RouteContext, args: Json): Promise<Json> {
     source,
   });
   await addToSitemap(ctx.sdk, requestId);
-  ctx.log.info(`[Bridge] Added 1 item to the Sitemap from ${source}`);
 
   return {
     added: 1,
@@ -267,7 +280,6 @@ export async function repeater(ctx: RouteContext, args: Json): Promise<Json> {
     },
     tabName,
   );
-  ctx.log.info(`[Bridge] Opened Replay session "${tabName}"`);
 
   const output: Json = {
     sent: 1,
@@ -324,11 +336,11 @@ export async function send(ctx: RouteContext, args: Json): Promise<Json> {
     output.added_to_sitemap = false;
   }
 
-  ctx.log.info(
-    outcome.sent
-      ? `[Bridge] Sent 1 request via Caido to ${resolved.url} (HTTP ${outcome.statusCode})`
-      : `[Bridge] Send via Caido to ${resolved.url} failed: ${outcome.error ?? "unknown"}`,
-  );
+  if (!outcome.sent) {
+    ctx.log.warn(
+      `[Bridge] Send via Caido to ${resolved.url} failed: ${outcome.error ?? "unknown"}`,
+    );
+  }
   return output;
 }
 
@@ -394,7 +406,6 @@ export async function organizer(ctx: RouteContext, args: Json): Promise<Json> {
     notes || source,
     collectionId,
   );
-  ctx.log.info(`[Bridge] Added 1 item to Replay collection "${collectionName}" from ${source}`);
 
   const output: Json = {
     added: 1,

packages/backend/src/bridge/routes.ts

@@ -25,7 +25,8 @@ import { openInReplay } from "./bridge/caido";
 import { BridgeService } from "./bridge/service";
 import { RequestCounters } from "./counters";
 import { publish } from "./events";
-import { fromBase64 } from "./util/bytes";
+import { fromBase64, fromUtf8 } from "./util/bytes";
+import { deriveRequestUrl } from "./util/rawhttp";
 import { LogService } from "./logging";
 import { ProxyForwarder } from "./proxy/forwarder";
 import { SettingsStore, blankToNull, splitModules } from "./settings";
@@ -244,6 +245,44 @@ async function sendRecordToReplay(sdk: SDK, uuid: string): Promise<string> {
   return sessionId;
 }
 
+/**
+ * Opens a raw message in Caido Replay - a finding's evidence, which has no
+ * stored record behind it to look up.
+ *
+ * `urlHint` is the caller's best guess at the target, typically a finding's
+ * `matchedAt`. It is only a hint because that field is not always a URL at all:
+ * an agent finding matches a source file. The message itself is the better
+ * authority, so the two are reconciled rather than one being trusted outright.
+ */
+async function sendRawToReplay(
+  sdk: SDK,
+  urlHint: string,
+  request: string,
+  response: string,
+  name: string,
+): Promise<string> {
+  const { log } = required();
+  const requestBytes = fromUtf8(request);
+  if (requestBytes.length === 0) {
+    throw new VigoliumApiError(0, "There is no request to replay");
+  }
+
+  const url = deriveRequestUrl(requestBytes, urlHint);
+  const responseBytes = response ? fromUtf8(response) : null;
+  const sessionId = await openInReplay(
+    sdk,
+    {
+      url,
+      requestBytes,
+      responseBytes: responseBytes && responseBytes.length > 0 ? responseBytes : null,
+      source: "vigolium-evidence",
+    },
+    name || "vigolium",
+  );
+  log.info(`[Findings] Opened Replay session for ${url}`);
+  return sessionId;
+}
+
 /**
  * The RPC surface, declared once.
  *
@@ -284,6 +323,7 @@ const HANDLERS = {
   agentSessions,
   agentSessionLogs,
   sendRecordToReplay,
+  sendRawToReplay,
 };
 
 export type API = DefineAPI<typeof HANDLERS>;

packages/backend/src/index.ts

@@ -63,8 +63,12 @@ export class ProxyForwarder {
           http_request_base64: requestBase64,
           http_response_base64: responseBase64,
         });
+        // Deliberately silent on success: this runs once per proxied response,
+        // so a line each would bury every other plugin's logs. The counters
+        // already carry the sent/failed tally to the Settings tab, which is
+        // where a per-request rate belongs. Failures still log - they are rare,
+        // and each one is a request Vigolium never saw.
         this.#counters.markSent();
-        this.#log.info("[Proxy] Sent 1 request");
       } catch (e) {
         this.#counters.markFailed();
         this.#log.error(`[Proxy] Request failed: ${errorMessage(e)}`);

packages/backend/src/proxy/forwarder.ts

@@ -48,3 +48,14 @@ export function toLatin1(bytes: Uint8Array, maxBytes?: number): string {
 export function fromLatin1(value: string): Uint8Array {
   return new Uint8Array(Buffer.from(value, "latin1"));
 }
+
+/**
+ * UTF-8, for text that reached us as text.
+ *
+ * A finding's evidence arrives decoded inside a JSON document rather than as
+ * bytes, so latin-1 - correct for a message carried through the editor - would
+ * flatten every multi-byte character it picked up on the way.
+ */
+export function fromUtf8(value: string): Uint8Array {
+  return new Uint8Array(Buffer.from(value, "utf8"));
+}