Contributing

# Fork the repo on GitHub
# Then clone your fork
git clone https://github.com/YOUR_USERNAME/oisp-sensor.git
cd oisp-sensor

# Add upstream remote
git remote add upstream https://github.com/oximyhq/sensor.git

# Install dependencies
sudo apt-get update
sudo apt-get install -y \
    build-essential \
    libssl-dev \
    pkg-config \
    clang \
    llvm \
    libelf-dev \
    linux-headers-$(uname -r)

# Build
cargo build --release

# Run
sudo ./target/release/oisp-sensor check

git checkout -b feature/your-feature-name
# or
git checkout -b fix/bug-description

git add .
git commit -m "feat: add support for new provider"

<type>: <short description>

[optional body]

[optional footer]

feat: add Anthropic Claude provider detection

Add support for detecting Anthropic Claude API calls
and parsing response events.

Closes #123

fix: handle chunked encoding in SSL capture

Fixes issue where chunked responses were not properly
decoded, causing missing ai.response events.

Fixes #456

git push origin feature/your-feature-name

cargo fmt

cargo clippy -- -D warnings

/// Captures SSL traffic from the specified process.
///
/// # Arguments
///
/// * `pid` - Process ID to monitor
/// * `config` - Capture configuration
///
/// # Errors
///
/// Returns error if eBPF program fails to attach.
pub fn capture_ssl(pid: u32, config: &CaptureConfig) -> Result<()> {
    tracing::info!("Attaching to PID {}", pid);
    // Implementation
    Ok(())
}

cargo test

# Run integration tests
cargo test --test '*'

cd oisp-cookbook

# Test a specific cookbook
./test-all.sh python/01-openai-simple

# Test all cookbooks
./test-all.sh

# Build and run
cargo build --release
sudo ./target/release/oisp-sensor record --output /tmp/test.jsonl

# In another terminal, trigger AI activity
python3 -c "
import openai
client = openai.OpenAI()
response = client.chat.completions.create(
    model='gpt-4o-mini',
    messages=[{'role': 'user', 'content': 'Test'}]
)
print(response.choices[0].message.content)
"

# Stop sensor (Ctrl+C) and check events
cat /tmp/test.jsonl | jq .

oisp-sensor/
├── crates/
│   ├── oisp-capture-ebpf/    # eBPF capture (Linux)
│   ├── oisp-capture-macos/   # macOS capture (preview)
│   ├── oisp-capture-windows/ # Windows capture (preview)
│   ├── oisp-decode/          # HTTP/JSON decoding
│   ├── oisp-export/          # Export formats (JSONL, OTLP, Kafka)
│   ├── oisp-redaction/       # PII/sensitive data redaction
│   ├── oisp-cli/             # CLI interface
│   └── oisp-web/             # Web UI
├── docs-site/                # Astro documentation site
├── oisp-cookbook/            # Example integrations (submodule)
├── Cargo.toml                # Workspace manifest
└── README.md

pub enum Provider {
    OpenAI,
    Anthropic,
    Cohere,  // Add new provider
}

use crate::{Provider, Request, Response};

pub fn detect_request(host: &str, path: &str, body: &str) -> Option<Request> {
    if !host.contains("cohere.ai") {
        return None;
    }

    // Parse Cohere request format
    let data = serde_json::from_str(body).ok()?;

    Some(Request {
        provider: Provider::Cohere,
        model: data["model"].as_str()?.to_string(),
        messages: parse_messages(&data),
        // ...
    })
}

pub fn detect_response(body: &str) -> Option<Response> {
    // Parse Cohere response format
    // ...
}

mod providers;
use providers::{openai, anthropic, cohere};

pub fn decode_request(host: &str, path: &str, body: &str) -> Option<Request> {
    openai::detect_request(host, path, body)
        .or_else(|| anthropic::detect_request(host, path, body))
        .or_else(|| cohere::detect_request(host, path, body))  // Add
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_cohere_request() {
        let body = r#"{"model":"command","message":"Hello"}"#;
        let req = detect_request("api.cohere.ai", "/v1/chat", body);
        assert!(req.is_some());
        assert_eq!(req.unwrap().provider, Provider::Cohere);
    }
}

05-cohere-simple/
├── README.md
├── app.py
├── docker-compose.yml
├── validate.sh
└── expected-events.jsonl

cd docs-site
npm install
npm run dev  # http://localhost:4321

docs-site/
├── src/
│   └── content/
│       └── docs/
│           ├── getting-started/
│           ├── platforms/
│           ├── cookbooks/
│           ├── architecture/
│           ├── configuration/
│           ├── reference/
│           └── guides/
└── astro.config.mjs  # Sidebar navigation

## Description

Brief description of changes.

## Type of Change

- [ ] Bug fix
- [ ] New feature
- [ ] Breaking change
- [ ] Documentation update

## Testing

How was this tested?

## Checklist

- [ ] Code builds
- [ ] Tests pass
- [ ] Documentation updated
- [ ] Changelog updated (if needed)

## Related Issues

Closes #123

RUST_LOG=debug cargo run -- record --output /tmp/test.jsonl

# eBPF capture only
RUST_LOG=oisp_capture_ebpf=debug cargo run

# Decode module only
RUST_LOG=oisp_decode=debug cargo run

# Multiple modules
RUST_LOG=oisp_capture_ebpf=debug,oisp_decode=info cargo run

# List loaded BPF programs
sudo bpftool prog list

# Dump BPF maps
sudo bpftool map dump id <map_id>

# View eBPF logs
sudo cat /sys/kernel/debug/tracing/trace_pipe

# Build with profiling
cargo build --release --features profiling

# Run with perf
sudo perf record -F 99 -g ./target/release/oisp-sensor record
sudo perf report