Update to Proxyman

{
  "description": "Configure and troubleshoot Proxyman HTTPS capture across desktop systems, Apple and Android devices or simulators, browsers, runtimes, containers, frameworks, and HTTP clients, including Atlantis instrumentation for controlled apps.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 272
    },
    {
      "relative_path": "references/android-emulator.md",
      "size_in_bytes": 3680
    },
    {
      "relative_path": "references/atlantis.md",
      "size_in_bytes": 5048
    },
    {
      "relative_path": "references/capture-paths.md",
      "size_in_bytes": 6762
    },
    {
      "relative_path": "references/runtime-capture.md",
      "size_in_bytes": 5619
    }
  ],
  "name": "proxyman-https-capture",
  "skill_md_contents": "---\nname: \"proxyman-https-capture\"\ndescription: \"Configure and troubleshoot Proxyman HTTPS capture across desktop systems, Apple and Android devices or simulators, browsers, runtimes, containers, frameworks, and HTTP clients, including Atlantis instrumentation for controlled apps.\"\n---\n\n# Proxyman HTTPS Capture\n\nChoose the least invasive working capture path for the user's exact device, runtime, network, and Proxyman platform. Normal proxy capture has three independent requirements: route traffic through Proxyman, trust the Proxyman CA, and enable SSL Proxying for the target host. Atlantis is an instrumentation alternative that forwards inspected traffic to Proxyman without that proxy/CA/SSL-Proxying path; apply its separate limits and verification.\n\nUse `proxyman-mcp-setup` if tools are absent, `proxyman-traffic-debugging` to inspect captured flows, `proxyman-certificates-recovery` for the host Mac's generated/custom root lifecycle or custom server/client identities, and `proxyman-debugging-tools` when current official documentation is needed beyond the setup flow.\n\n## Gather The Minimum Context\n\nEstablish:\n\n- host OS running Proxyman and app version;\n- target type, OS/runtime version, physical vs simulator/emulator, and debug vs production build;\n- how the target connects to the host and whether a VPN, MDM, firewall, proxy, or certificate pinning is present;\n- target hostname and whether HTTP is visible but HTTPS is opaque, or no traffic appears at all;\n- whether the user wants GUI steps, MCP-guided automation, or manual commands.\n\nDo not install certificates, root an emulator, alter system proxy, inject a shell/app, or restart a target until the user approves that action.\n\n## Universal Capture Model\n\nDiagnose in this order:\n\n1. **Reachability:** target can reach the host running Proxyman.\n2. **Routing:** target sends HTTP/HTTPS to Proxyman's current proxy host and port.\n3. **Recording:** Proxyman is recording and the source/client is visible.\n4. **Trust:** target trusts the correct Proxyman root CA in the relevant store.\n5. **SSL Proxying:** target host is included and not excluded.\n6. **Application behavior:** library proxy bypass, localhost special case, VPN, pinning, QUIC/HTTP3, or a custom trust store.\n\nDo not treat certificate installation as proof that routing works, or SSL Proxying as proof that the target trusts the CA.\n\n## Choose A Path\n\nRead [capture paths](references/capture-paths.md) for the decision matrix and official page links. Read [Atlantis capture](references/atlantis.md) when the user asks what Atlantis is, needs capture while a VPN blocks the normal proxy, or wants to integrate Atlantis into an app.\n\n- Desktop browser/app honoring system proxy: use system proxy plus host certificate trust.\n- iOS/iPadOS/Vision Pro device: use Wi-Fi manual proxy and device certificate trust; for a supported app that can include an instrumentation library, consider Atlantis when proxy/certificate setup is undesirable or a VPN blocks the normal route.\n- Apple simulator: install the CA into the booted simulator and use the simulator proxy path.\n- tvOS/watchOS: follow the physical/simulator-specific official path.\n- Android physical device: manual Wi-Fi proxy plus user/system CA strategy appropriate to OS and app policy.\n- Android emulator: prefer Proxyman's guided automation for an active compatible AVD; read [Android emulator safety](references/android-emulator.md).\n- Terminal runtime or browser: prefer Automatic Setup/injection when supported; otherwise use explicit proxy variables/options and the runtime CA bundle/store from [runtime capture](references/runtime-capture.md).\n- Localhost: use explicit proxy configuration or Reverse Proxy; many clients intentionally bypass the system proxy.\n- Docker/VM/subsystem: use the host address reachable from that network namespace, not blindly `127.0.0.1`.\n\n## MCP-Guided Workflow\n\n1. `get_version` and `get_proxy_status`.\n2. `answer_setup_question` with the exact target, platform, runtime, VPN, and symptom.\n3. Read the returned citations and use `list_setup_workflows` when the target is ambiguous.\n4. For a normal proxy path, check `get_certificate_status` and `get_ssl_proxying_list`. For Atlantis, read `docs://setup/atlantis` and do not force certificate or SSL Proxying setup.\n5. Use a relevant built-in resource or prompt. Setup resources are listed in the capture-path reference.\n6. Explain the automation's state changes and request consent.\n7. Use `run_guided_setup`, `inject_terminal`, `inject_electron`, `set_system_proxy`, `install_certificate`, or SSL tools only when the live server exposes the needed action and the user approved it.\n8. Generate one known HTTPS request from the target.\n9. Find it with `filter_flows` using host and, when relevant, `client`; inspect it with `get_flow_detail`.\n10. Verify HTTPS body visibility, TLS/certificate summary, and target identity.\n\nIf the MCP setup index has no exact match, fetch the current official page through `proxyman-debugging-tools` rather than forcing a generic fallback result.\n\n## GUI Workflow\n\n1. Open Proxyman's Setup or Certificate guide for a normal proxy target. For Atlantis, follow the dedicated integration reference instead.\n2. Use the proxy host/port shown by the running app; do not hardcode a common port.\n3. Follow the target-specific routing and certificate steps from the current official page.\n4. Enable SSL Proxying only for the required host or wildcard.\n5. Generate a deterministic request and verify it in Proxyman.\n6. Document how to restore proxy, trust, emulator boot image, or injected environment.\n\n## Failure Triage\n\n- **Nothing appears:** recording/routing/reachability/client-source problem.\n- **HTTP appears, HTTPS does not:** routing works; inspect target trust, SSL Proxying, pinning, HTTP3/QUIC, or custom CA stores.\n- **TLS error:** verify the correct CA, full trust, host include/exclude, app pinning, and date/time. Do not disable TLS verification as the default fix.\n- **Only some libraries missing:** the library likely bypasses environment/system proxy or uses a separate trust store.\n- **Device cannot connect:** verify same network or routable host address, firewall/access control, current port, and VPN/Private Relay behavior.\n- **Localhost missing:** use Reverse Proxy or explicit proxy settings with a non-loopback target address.\n- **VPN conflict on iOS:** read the Atlantis decision path for a build the user controls instead of repeatedly changing the device proxy.\n- **Android app rejects user CA:** use a debug network security configuration or a controlled compatible emulator system-CA path. Do not advise bypassing pinning in a production app.\n\n## Verification Checklist\n\nA setup is complete only when:\n\n- the expected target/client is identifiable;\n- the test request and response appear;\n- HTTPS headers/body are readable through the intended path: decrypted for normal proxy capture or forwarded by the expected Atlantis source;\n- no unrelated hosts were unnecessarily enabled for SSL Proxying when the normal proxy path was used;\n- the user knows the rollback path;\n- limitations such as pinning, production builds, VPN, root/Magisk, or unsupported automation are stated.\n"
}