Fix/ds proxy via proxy - #4661

Describe the changes that are made

Two replay fixes found while making DaemonSet proxy-via-proxy record/replay green (a k8s-proxy with the DaemonSet agent recording another k8s-proxy, plus a plain Go control app).

1. fix(http): prefer the mock recorded in the current test window (C1)

pkg/agent/proxy/integrations/http/match.go

• Problem: two tests make the same call, e.g. POST /v1/authorize for a valid PAT, then for a bad one. The two recorded mocks have the same URL and body and differ only in the Authorization value, which is marked as noise. DeriveLifetime lax-promotes tagged HTTP mocks into the session pool (pkg/models/lifetime.go), so neither mock is consumed or window-filtered, and ExactBodyMatch returns the first byte-identical body. The bad-token test gets the valid token's 200 instead of its recorded 401.
• Fix: before the body match, preferCurrentTestWindow stable-reorders the schema-matched candidates so that those whose ReqTimestampMock lies inside CurrentTestWindow() come first — the rule mysql/replayer already applies. Only a recorded timestamp inside the window moves a mock. With no active window, a single candidate, or no candidate inside the window, the order and the chosen mock are exactly as before.

2. feat(proxy): add an OnTestWindow hook for parsers (C2)

pkg/agent/proxy/mockmanager.go, pkg/agent/proxy/scoped_mockdb.go, pkg/agent/proxy/integrations/integrations.go

• New optional interface integrations.TestWindowListener. OnTestWindow(fn) registers a callback that runs each time a real test window is published: SetMocksWithWindow past its BaseTime staging call, or a non-zero SetCurrentTestWindow. It runs synchronously on the setter's goroutine, after every MockManager lock is released and before the setter returns, so whatever the callback writes reaches the app before the replayer sends that test's request.
• SetMocksWithWindow is now a thin wrapper around the unchanged body (renamed setMocksWithWindow, which reports whether it published a window). scopedMockDb forwards OnTestWindow, the same way it forwards Revision.
• Consumer: keploy/integrations#305 uses it to push the Kubernetes watch events recorded after a watch-list snapshot down the held-open stream, just before the first test recorded after each event. An informer's state at a test is the snapshot plus every event before that test; without this, replay answers every test from the startup state. Integrations declares the interface by its shape, so it still builds against releases without this hook and then simply behaves as before.

Links & References

Closes: NA — part of the DaemonSet proxy-via-proxy record/replay work.

🔗 Related PRs

• keploy/integrations#305 — HTTP/2 watch-list snapshots and the post-snapshot events that use the hook above
• keploy/k8s-proxy#1002
• keploy/enterprise#2676 — needs a go.keploy.io/server/v3 bump to the release carrying this PR

🐞 Related Issues

• NA

📄 Related Documents

• NA

What type of PR is this? (check all applicable)

• 📦 Chore
• 🍕 Feature
• 🐞 Bug Fix
• 📝 Documentation Update
• 🎨 Style
• 🧑‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🔁 CI
• ⏩ Revert

Added e2e test pipeline?

• 👍 yes
• 🙅 no — unit tests here; the end-to-end scenario needs k8s-proxy + enterprise + integrations together and was verified on a DaemonSet rig (results below)
• 🙋 no, because I need help

Added comments for hard-to-understand areas?

• 👍 yes
• 🙅 no, because the code is self-explanatory

Added to documentation?

• 📜 README.md
• 📓 Wiki
• 🙅 no documentation needed

Are there any sample code or steps to test the changes?

• 👍 yes, mentioned below
• 🙅 no, because it is not needed

go test ./pkg/agent/proxy/integrations/http/ -run 'TestMatch_IdenticalSessionMocksPreferCurrentTestWindow|TestPreferCurrentTestWindow'
go test ./pkg/agent/proxy/ -run 'TestOnTestWindow|TestScopedMockDbForwardsOnTestWindow'
go test -race ./pkg/agent/proxy/ -run 'MockManager|Window|Scoped|Wave|Race'

• TestMatch_IdenticalSessionMocksPreferCurrentTestWindow drives match() with the two authorize mocks: each test window gets its own reply; with no window, or a window matching neither, the first recorded mock still wins (unchanged behaviour).
• TestOnTestWindow_RunsWithNoLockHeld reads the pool back from inside the listener (GetPerTestMocksInWindow takes swapMu), so a listener run under a MockManager lock fails the test instead of deadlocking silently.
• Full ./pkg/agent/proxy/ and ./pkg/agent/proxy/integrations/http/ suites pass; go vet clean; golangci-lint v2.13.1 --new-from-rev: 0 issues.

Self Review done?

• ✅ yes
• ❌ no, because I need help

Any relevant screenshots, recordings or logs?

DaemonSet rig (kind): the recorder k8s-proxy records target k8s-proxy A and a Go control app, then auto-replays. Images were built from k8s-proxy#1002, enterprise#2676 and integrations#305 with this PR's two commits on v3.6.79 (932fa2d1f, 63b147253 — before the main merge df5461f20, which changes none of this PR's files). Two runs of each:

• A's step 3 (bad token must get 401) passes because of C1.
• A's steps 1 and 24 (informer readyReplicas) and the control app's step 11 (informer pod count) pass because of C2 + integrations#305.

Follow-ups (after this PR)

1. Step 15 over HTTPS: in the replay copy, a Go app's first TLS call to a mocked dependency right at startup (k8s-proxy's self-discovery, ~20 ms after start) can fail, so an endpoint that depends on it (/proxy/update/status) answers differently from the recording. Not addressed here; next.
2. Recorder GoTLS attach race: seen in earlier rig rounds; it did not reproduce in the final runs above, but it is not fixed yet. Next.

🧠 Semantics for PR Title & Branch Name

Please ensure your PR title and branch name follow the Keploy semantics:

📌 PR Semantics Guide
📌 Branch Semantics Guide

Additional checklist:

• Have you read the Contributing Guidelines on issues?
• Have you followed the PR Semantics guide for naming this PR?
• Have you followed the Branch Semantics guide for naming your branch?

🤖 Generated with Claude Code