feat: add litellm client adapter, JSONL flow detail, and sample output

2026-06-01 14:44:04 +08:00
parent 370853ccbf
commit 1547ed7785
18 changed files with 1523 additions and 34 deletions
@@ -0,0 +1,35 @@
+# LEARNINGS.md — auto-reverse
+
+## Session: 2026-05-31 — URA GLS API Reverse Engineering
+
+### Environment & Config
+- Server IP `185.5.132.28` is NOT in Singapore — gets 403 from SG gov sites
+- `OPENROUTER_API_KEY` is in `.env`, loaded by flake.nix shellHook
+- Default model changed to `openrouter/xiaomi/mimo-v2.5-pro`
+- `anthropic` SDK replaced with `litellm` for multi-provider support
+
+### Codebase Conventions
+- `archive.log` is summary only; `archive.jsonl` has full request/response detail
+- `CapturedFlow` model stores everything: `req_headers`, `resp_headers`, `req_body`, `resp_body`, `query`
+- Tool schemas use Anthropic format (`name`, `description`, `input_schema`) — adapter converts to OpenAI format for litellm
+- Tests assert default model string — update when changing model
+
+### Business Context
+- URA GLS (Government Land Sales) site at `eservice.ura.gov.sg/maps/?service=GLSRELEASE&site=1`
+- Uses ArcGIS REST services on `maps.ura.gov.sg`
+- Auth via OneMap JSONP tokens (`getOnemapToken`, `getOnemapLandLotToken`)
+- 60+ fields per GLS parcel including location, dates, prices, development codes
+- Geo-blocked to Singapore IPs via Azure Application Gateway WAF
+
+### Key Findings — API Architecture
+- **ArcGIS endpoints** (`maps.ura.gov.sg/ArcGis/rest/services/lsag/...`): No auth needed, just standard ArcGIS query params
+- **OneMap APIs** (`www.onemap.gov.sg/api/...`): Need `Authorization: <jwt>` header from JSONP token endpoint
+- **eService APIs** (`eservice.ura.gov.sg/ecasService/...`): Session-based, need cookies from browser
+- **LandLot API** (`www.onemap.gov.sg/api/public/landlotAPI/...`): Needs AWS Signature auth (different from Bearer)
+
+### Tool Usage Patterns
+- The MITM proxy is the core value — captures all traffic automatically
+- JS source files contain the real API documentation (auth flows, endpoints, fields)
+- The LLM agent adds cost but wasn't essential for this workflow
+- `archive.jsonl` format is critical for replay — without it, captured data is useless
+- Browser must be on an authorized IP for geo-blocked sites