Opaque secret proxy for Starpod.

A local HTTP proxy that intercepts outbound traffic from tool subprocesses, finds starpod:v1: opaque tokens, decrypts them, verifies host binding, and replaces them with real secret values before forwarding.

Features

• mitm — HTTPS MITM with ephemeral certificates (scans HTTPS traffic)
• netns — Linux network namespace isolation (Phase 4)

Usage

# async fn example() -> starpod_core::Result<()> {
let handle = starpod_proxy::start_proxy(starpod_proxy::ProxyConfig {
    master_key: [0u8; 32],
    data_dir: std::path::PathBuf::from(".starpod/db"),
}).await?;

// Inject into tool subprocesses:
// HTTP_PROXY=http://127.0.0.1:{handle.port()}
// HTTPS_PROXY=http://127.0.0.1:{handle.port()}

// Shutdown when done
handle.shutdown().await;
# Ok(())
# }