AG Guard — mitmproxy Campaign Protection

Local proxy that blocks mutations to AppGrowth campaigns not owned by manager 277 (alexander.sakovich).

How it works

• PAC-based routing (ag_guard.pac): only app.appgrowth.com is sent through mitmproxy; everything else goes DIRECT. This keeps the box fast — mitmdump no longer sits in the critical path for Google/Slack/Claude/etc.
• --allow-hosts app\.appgrowth\.com — defensive second layer: even if PAC is bypassed, only appgrowth gets MITM-decrypted.
• ag_guard.py intercepts PUT/POST/PATCH/DELETE to /campaigns2/{id}, looks up owner via GET, blocks if manager != 277.
• Fail-closed: if ownership lookup fails, request is denied.
• Audit events (ALLOWED / BLOCKED) go to ~/.config/mitmproxy/ag_audit.log (rotated, 2 MB × 3). The main ag_guard.log holds only mitmproxy warnings/errors.

Files

File	Purpose
ag_guard.py	mitmproxy addon: ownership check + audit logger
ag_guard.pac	Proxy auto-config — routes only app.appgrowth.com to 127.0.0.1:8080
combined-ca-bundle.pem	certifi + mitmproxy CA (so Python trusts the proxy) — not committed; regenerated locally
rebuild-ca-bundle.sh	Rebuilds combined bundle (run after pip upgrade certifi)
com.ag-guard.plist	LaunchAgent: starts mitmdump at login (KeepAlive: true)
com.ag-guard-ca-bundle.plist	LaunchAgent: rebuilds CA bundle at login

macOS proxy setup (PAC mode)

# Disable any manual HTTP/HTTPS proxy first
networksetup -setwebproxystate Wi-Fi off
networksetup -setsecurewebproxystate Wi-Fi off

# Point the system at the PAC file
networksetup -setautoproxyurl  Wi-Fi file:///Users/$USER/.config/mitmproxy/ag_guard.pac
networksetup -setautoproxystate Wi-Fi on

Verify with scutil --proxy — expect ProxyAutoConfigEnable = 1, HTTPEnable = 0, HTTPSEnable = 0.

mitmdump tuning

LaunchAgent runs mitmdump with:

• --listen-host 127.0.0.1 — bind localhost only
• --set termlog_verbosity=warn — no per-flow INFO chatter
• --set stream_large_bodies=5m — don't buffer big responses
• --set connection_strategy=lazy — defer server connect until first byte
• --set flow_detail=0 — minimal per-flow output

The addon additionally silences mitmproxy.proxy.server / .tls / .http / mitmproxy.connection at the logging level so long-lived CONNECT tunnels don't spam the log.

SSL trust

Python/httpx/requests need SSL_CERT_FILE pointing to combined-ca-bundle.pem:

• Shell: set in ~/.zshrc
• Tests: set in tests/conftest.py (auto-detects bundle)

Manual commands

# Restart proxy
launchctl unload ~/Library/LaunchAgents/com.ag-guard.plist
launchctl load   ~/Library/LaunchAgents/com.ag-guard.plist

# Rebuild CA bundle after certifi update
~/.config/mitmproxy/rebuild-ca-bundle.sh

# Check proxy status
lsof -i :8080 -sTCP:LISTEN

# View logs
tail -f ~/.config/mitmproxy/ag_guard.log   # mitmproxy warnings
tail -f ~/.config/mitmproxy/ag_audit.log   # ALLOWED / BLOCKED events