Body match-and-replace rules

Extends match-and-replace rules to request/response bodies, not just
headers. A body rule materializes the body into memory (bounded by
the same maxCaptureBytes cap as history capture) instead of streaming
it straight through - the opposite of the normal path, so it's only
paid when a body rule is actually configured. A body over the cap
passes through byte-exact and unmodified rather than being partially
rewritten.

Response Content-Length is recomputed explicitly when a rule changes
body length: unlike http.Request.Write, http.ResponseWriter doesn't
derive it from resp.ContentLength on its own, so a stale header would
otherwise corrupt response framing for the client.

The history audit trail still shows the original, pre-rule bytes on
both legs; only the wire traffic reflects the rewrite. Verified live
against a real daemon: origin receives the rewritten request body,
client receives the rewritten response body with correct
Content-Length, and history keeps the unmodified bytes.

Adds a Part selector (header/body) to the Rules add/edit form and
table in the TUI.

1 files changed, 45 insertions, 0 deletions

diff --git a/internal/proxy/bodyrules.go b/internal/proxy/bodyrules.go
new file mode 100644
index 0000000..128464c
--- /dev/null
+++ b/internal/proxy/bodyrules.go
@@ -0,0 +1,45 @@
+package proxy
+
+import (
+	"bytes"
+	"io"
+
+	"mitmux/internal/rules"
+)
+
+// applyBodyRules reads body fully (bounded by maxCaptureBytes - a body
+// rule is opted into deliberately by whoever wrote it, but an unbounded
+// read of a maliciously or just accidentally huge body would still be a
+// memory-exhaustion vector) and, if it fits, runs bodyRules over it via
+// rules.ApplyBody and returns a fresh reader over the result.
+//
+// If the body is larger than the cap, it's passed straight through
+// completely unmodified - reconstructed from the bytes already read
+// plus whatever's left on the original reader - rather than rewriting
+// only part of it or dropping data. A body a rule can't safely see in
+// full is better left alone than partially corrupted; applied=false
+// tells the caller not to touch Content-Length, since the original
+// length (whatever it was) is still exactly right.
+func applyBodyRules(body io.ReadCloser, bodyRules []rules.Rule) (newBody io.ReadCloser, newLength int64, applied bool, err error) {
+	if body == nil {
+		return body, 0, false, nil
+	}
+
+	limited := io.LimitReader(body, maxCaptureBytes+1)
+	data, err := io.ReadAll(limited)
+	if err != nil {
+		body.Close()
+		return nil, 0, false, err
+	}
+
+	if int64(len(data)) > maxCaptureBytes {
+		return struct {
+			io.Reader
+			io.Closer
+		}{io.MultiReader(bytes.NewReader(data), body), body}, 0, false, nil
+	}
+
+	body.Close()
+	rewritten := rules.ApplyBody(data, bodyRules)
+	return io.NopCloser(bytes.NewReader(rewritten)), int64(len(rewritten)), true, nil
+}