django-http-inspector 0.1.4__tar.gz

django_http_inspector-0.1.4/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 django-http-inspector contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_http_inspector-0.1.4/PKG-INFO

@@ -0,0 +1,129 @@
+Metadata-Version: 2.4
+Name: django-http-inspector
+Version: 0.1.4
+Summary: An embedded HTTP traffic inspector and replay tool for Django development
+Author: django-http-inspector contributors
+License-Expression: MIT
+Keywords: django,http,webhook,inspector,replay,debugging
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.0
+Classifier: Framework :: Django :: 5.1
+Classifier: Framework :: Django :: 5.2
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Software Development :: Debuggers
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django>=4.2
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+Dynamic: license-file
+
+# django-http-inspector
+
+django-http-inspector is an embedded HTTP traffic inspector for Django development. It captures requests and responses outside the project's middleware chain and can replay a captured request to the URL seen at capture time over a real HTTP connection.
+
+It is a development tool, not a reverse proxy, tunnel, production observability platform, or production security boundary.
+
+## Installation
+
+```bash
+python -m pip install django-http-inspector
+```
+
+## Intended integration
+
+```python
+# wsgi.py
+from django.core.wsgi import get_wsgi_application
+from django_http_inspector import InspectorWSGI
+
+application = InspectorWSGI(get_wsgi_application())
+```
+
+```bash
+python manage.py runserver
+```
+
+Open `http://127.0.0.1:8000/__inspect/`.
+
+## Configuration
+
+```python
+DJANGO_HTTP_INSPECTOR = {
+    "ENABLED": DEBUG,
+    # Set True only on a trusted development network. No authentication is added.
+    "ALLOW_REMOTE": False,
+    "PATH": "/__inspect/",
+    "CAPTURE_MAX_BYTES": 1024 * 1024,
+    "MAX_RECORDS": 1000,
+    "EXCLUDE_PATHS": [
+        "/static/",
+        "/favicon.ico",
+        "/.well-known/appspecific/com.chrome.devtools.json",
+    ],
+    "TRUSTED_PROXY_CIDRS": [],
+    "INSPECTOR_ALLOWED_HOSTS": ["localhost", "127.0.0.1", "[::1]"],
+    "REPLAY_TIMEOUT": 10,
+    # Default: BASE_DIR / ".django-http-inspector.sqlite3"
+    "SQLITE_PATH": BASE_DIR / ".django-http-inspector.sqlite3",
+}
+```
+
+django-http-inspector is disabled by default when `DEBUG=False`. The MVP Inspector UI is loopback-only.
+
+To access Inspector from another device during development, use the single explicit switch and make Django listen on the network:
+
+```python
+DJANGO_HTTP_INSPECTOR = {
+    "ALLOW_REMOTE": True,
+}
+```
+
+```bash
+python manage.py runserver 0.0.0.0:8000
+```
+
+Then open `http://<development-machine-ip>:8000/__inspect/`. Remote mode has no authentication: anyone who can connect can read captured credentials and bodies and trigger real Replay requests. Never expose it to the public internet or an untrusted network. The advanced `INSPECTOR_ALLOWED_HOSTS` and `INSPECTOR_ALLOWED_CLIENT_CIDRS` settings remain available for the default local-only mode but are not needed when `ALLOW_REMOTE=True`.
+
+Inspector records live in a package-managed SQLite database, not in Django's business database. You do not need to add the package to `INSTALLED_APPS` or run migrations. The file survives `runserver` reloads; delete it to reset all Inspector history.
+
+Add the runtime files to the project's `.gitignore`:
+
+```gitignore
+.django-http-inspector.sqlite3
+.django-http-inspector.sqlite3-shm
+.django-http-inspector.sqlite3-wal
+```
+
+## Replay semantics
+
+Replay makes a real HTTP request to the complete URL reconstructed when the original request was captured. It does not substitute a loopback URL and does not call the Django handler in-process. Consequently, it can pass through DNS, TLS, a public tunnel, a gateway, the web server, and the complete Django middleware chain again.
+
+WSGI servers normalize request data before applications see it. django-http-inspector therefore provides a semantically equivalent replay of the WSGI-observable request, not a byte-for-byte recreation of the network stream. Hop-by-hop headers are removed, `Host` and `Content-Length` are regenerated, and a correlation header is added.
+
+Replay causes real side effects. Treat payment, email, webhook, and mutation endpoints accordingly.
+
+The request stream refreshes automatically while the Inspector tab is visible. Select **Edit & Replay** to change a replay copy's headers and textual body. The captured method and complete URL remain read-only and are always used as the replay target; binary, multipart, and incomplete bodies cannot be edited. Duplicate headers are supported in the raw `Name: Value` editor.
+
+Complete `multipart/form-data` bodies are presented as ordered form fields. File parts show only their filename, media type, and captured-content size; binary file bytes are never rendered. Malformed, incomplete, or oversized multipart previews safely fall back to the existing raw/binary view. This presentation does not modify the bytes saved or sent by Replay.
+
+Chrome DevTools may request `/.well-known/appspecific/com.chrome.devtools.json` while inspecting localhost. The default exclusions prevent that harmless discovery request from cluttering Inspector, although Django may still log its 404 response.
+
+## Development
+
+```bash
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]"
+.venv/bin/python tests/runtests.py
+.venv/bin/python -m build
+```
+
+See the [approved design](docs/superpowers/specs/2026-09-09-django-http-inspector-mvp-design.md) for replay semantics and security boundaries.

django_http_inspector-0.1.4/README.md

@@ -0,0 +1,101 @@
+# django-http-inspector
+
+django-http-inspector is an embedded HTTP traffic inspector for Django development. It captures requests and responses outside the project's middleware chain and can replay a captured request to the URL seen at capture time over a real HTTP connection.
+
+It is a development tool, not a reverse proxy, tunnel, production observability platform, or production security boundary.
+
+## Installation
+
+```bash
+python -m pip install django-http-inspector
+```
+
+## Intended integration
+
+```python
+# wsgi.py
+from django.core.wsgi import get_wsgi_application
+from django_http_inspector import InspectorWSGI
+
+application = InspectorWSGI(get_wsgi_application())
+```
+
+```bash
+python manage.py runserver
+```
+
+Open `http://127.0.0.1:8000/__inspect/`.
+
+## Configuration
+
+```python
+DJANGO_HTTP_INSPECTOR = {
+    "ENABLED": DEBUG,
+    # Set True only on a trusted development network. No authentication is added.
+    "ALLOW_REMOTE": False,
+    "PATH": "/__inspect/",
+    "CAPTURE_MAX_BYTES": 1024 * 1024,
+    "MAX_RECORDS": 1000,
+    "EXCLUDE_PATHS": [
+        "/static/",
+        "/favicon.ico",
+        "/.well-known/appspecific/com.chrome.devtools.json",
+    ],
+    "TRUSTED_PROXY_CIDRS": [],
+    "INSPECTOR_ALLOWED_HOSTS": ["localhost", "127.0.0.1", "[::1]"],
+    "REPLAY_TIMEOUT": 10,
+    # Default: BASE_DIR / ".django-http-inspector.sqlite3"
+    "SQLITE_PATH": BASE_DIR / ".django-http-inspector.sqlite3",
+}
+```
+
+django-http-inspector is disabled by default when `DEBUG=False`. The MVP Inspector UI is loopback-only.
+
+To access Inspector from another device during development, use the single explicit switch and make Django listen on the network:
+
+```python
+DJANGO_HTTP_INSPECTOR = {
+    "ALLOW_REMOTE": True,
+}
+```
+
+```bash
+python manage.py runserver 0.0.0.0:8000
+```
+
+Then open `http://<development-machine-ip>:8000/__inspect/`. Remote mode has no authentication: anyone who can connect can read captured credentials and bodies and trigger real Replay requests. Never expose it to the public internet or an untrusted network. The advanced `INSPECTOR_ALLOWED_HOSTS` and `INSPECTOR_ALLOWED_CLIENT_CIDRS` settings remain available for the default local-only mode but are not needed when `ALLOW_REMOTE=True`.
+
+Inspector records live in a package-managed SQLite database, not in Django's business database. You do not need to add the package to `INSTALLED_APPS` or run migrations. The file survives `runserver` reloads; delete it to reset all Inspector history.
+
+Add the runtime files to the project's `.gitignore`:
+
+```gitignore
+.django-http-inspector.sqlite3
+.django-http-inspector.sqlite3-shm
+.django-http-inspector.sqlite3-wal
+```
+
+## Replay semantics
+
+Replay makes a real HTTP request to the complete URL reconstructed when the original request was captured. It does not substitute a loopback URL and does not call the Django handler in-process. Consequently, it can pass through DNS, TLS, a public tunnel, a gateway, the web server, and the complete Django middleware chain again.
+
+WSGI servers normalize request data before applications see it. django-http-inspector therefore provides a semantically equivalent replay of the WSGI-observable request, not a byte-for-byte recreation of the network stream. Hop-by-hop headers are removed, `Host` and `Content-Length` are regenerated, and a correlation header is added.
+
+Replay causes real side effects. Treat payment, email, webhook, and mutation endpoints accordingly.
+
+The request stream refreshes automatically while the Inspector tab is visible. Select **Edit & Replay** to change a replay copy's headers and textual body. The captured method and complete URL remain read-only and are always used as the replay target; binary, multipart, and incomplete bodies cannot be edited. Duplicate headers are supported in the raw `Name: Value` editor.
+
+Complete `multipart/form-data` bodies are presented as ordered form fields. File parts show only their filename, media type, and captured-content size; binary file bytes are never rendered. Malformed, incomplete, or oversized multipart previews safely fall back to the existing raw/binary view. This presentation does not modify the bytes saved or sent by Replay.
+
+Chrome DevTools may request `/.well-known/appspecific/com.chrome.devtools.json` while inspecting localhost. The default exclusions prevent that harmless discovery request from cluttering Inspector, although Django may still log its 404 response.
+
+## Development
+
+```bash
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]"
+.venv/bin/python tests/runtests.py
+.venv/bin/python -m build
+```
+
+See the [approved design](docs/superpowers/specs/2026-09-09-django-http-inspector-mvp-design.md) for replay semantics and security boundaries.

django_http_inspector-0.1.4/pyproject.toml

@@ -0,0 +1,42 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "django-http-inspector"
+version = "0.1.4"
+description = "An embedded HTTP traffic inspector and replay tool for Django development"
+readme = "README.md"
+requires-python = ">=3.9"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{name = "django-http-inspector contributors"}]
+keywords = ["django", "http", "webhook", "inspector", "replay", "debugging"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Web Environment",
+  "Framework :: Django",
+  "Framework :: Django :: 4.2",
+  "Framework :: Django :: 5.0",
+  "Framework :: Django :: 5.1",
+  "Framework :: Django :: 5.2",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Intended Audience :: Developers",
+  "Operating System :: OS Independent",
+  "Topic :: Software Development :: Debuggers",
+]
+dependencies = ["Django>=4.2"]
+
+[project.optional-dependencies]
+dev = ["build>=1.2", "twine>=5"]
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+include-package-data = true
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+django_http_inspector = ["templates/**/*.html", "static/**/*"]

django_http_inspector-0.1.4/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

django_http_inspector-0.1.4/src/django_http_inspector/__init__.py

@@ -0,0 +1,6 @@
+"""Public API for django-http-inspector."""
+
+from .wrapper.wsgi import InspectorWSGI
+
+__all__ = ["InspectorWSGI"]
+__version__ = "0.1.4"

django_http_inspector-0.1.4/src/django_http_inspector/capture/exchange.py

@@ -0,0 +1,84 @@
+import logging
+import time
+
+from django.utils import timezone
+
+from django_http_inspector.storage.records import ExchangeRecord
+
+logger = logging.getLogger("django_http_inspector")
+
+
+class ExchangeCapture:
+    def __init__(self, environ, input_stream, config, url_data, headers, repository):
+        self.environ = environ
+        self.input_stream = input_stream
+        self.config = config
+        self.started = time.monotonic()
+        self.response_status = None
+        self.response_headers = []
+        self.response_body = bytearray()
+        self.response_size = 0
+        self.response_incomplete = False
+        self.error_summary = ""
+        self.finalized = False
+        self.exchange = None
+        self.repository = repository
+        url, scheme, host, provenance = url_data
+        if not repository.available:
+            return
+        nonce = next((value for name, value in headers if name.lower() == "x-django-http-inspector-replay"), None)
+        try:
+            self.exchange = repository.create_exchange(
+                correlation_nonce=nonce,
+                method=str(environ.get("REQUEST_METHOD", "GET")),
+                url=url,
+                url_provenance=provenance,
+                scheme=scheme,
+                host=host,
+                path=str(environ.get("PATH_INFO", "/")),
+                query_string=str(environ.get("QUERY_STRING", "")),
+                request_headers=headers,
+                request_content_type=str(environ.get("CONTENT_TYPE", "")),
+                request_declared_size=input_stream.declared_size,
+                client_addr=str(environ.get("REMOTE_ADDR", "")),
+            )
+        except Exception:
+            logger.exception("Unable to create django-http-inspector exchange")
+
+    def start(self, status, headers):
+        self.response_status = int(str(status).split(" ", 1)[0])
+        self.response_headers = [[str(name), str(value)] for name, value in headers]
+
+    def observe_response(self, data):
+        self.response_size += len(data)
+        remaining = self.config.capture_max_bytes - len(self.response_body)
+        if remaining > 0:
+            self.response_body.extend(data[:remaining])
+
+    def finalize(self, error=None, incomplete=False):
+        if not self.exchange or self.finalized:
+            return
+        self.finalized = True
+        now = timezone.now()
+        if error:
+            self.error_summary = f"{type(error).__name__}: {error}"[:2000]
+        try:
+            self.exchange.completed_at = now
+            self.exchange.duration_ms = (time.monotonic() - self.started) * 1000
+            self.exchange.request_body = bytes(self.input_stream.captured)
+            self.exchange.request_observed_size = self.input_stream.observed_size
+            self.exchange.request_captured_size = len(self.input_stream.captured)
+            self.exchange.request_body_truncated = self.input_stream.truncated
+            self.exchange.request_body_incomplete = self.input_stream.incomplete
+            self.exchange.response_status = self.response_status
+            self.exchange.response_headers = self.response_headers
+            self.exchange.response_body = bytes(self.response_body)
+            self.exchange.response_size = self.response_size
+            self.exchange.response_body_truncated = self.response_size > self.config.capture_max_bytes
+            self.exchange.response_body_incomplete = incomplete
+            self.exchange.state = ExchangeRecord.State.APPLICATION_ERROR if error else ExchangeRecord.State.COMPLETE
+            self.exchange.error_summary = self.error_summary
+            self.repository.update_exchange(self.exchange)
+            self.repository.prune(self.config.max_records)
+        except Exception:
+            logger.exception("Unable to finalize django-http-inspector exchange")

django_http_inspector-0.1.4/src/django_http_inspector/capture/headers.py

@@ -0,0 +1,33 @@
+HOP_BY_HOP_HEADERS = {
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+}
+
+
+def request_headers_from_environ(environ):
+    headers = []
+    if environ.get("CONTENT_TYPE"):
+        headers.append(["Content-Type", str(environ["CONTENT_TYPE"])])
+    if environ.get("CONTENT_LENGTH"):
+        headers.append(["Content-Length", str(environ["CONTENT_LENGTH"])])
+    for key, value in environ.items():
+        if key.startswith("HTTP_"):
+            name = "-".join(part.title() for part in key[5:].split("_"))
+            headers.append([name, str(value)])
+    return headers
+
+
+def replay_headers(headers):
+    result = []
+    for name, value in headers:
+        lower = name.lower()
+        if lower in HOP_BY_HOP_HEADERS or lower in {"content-length", "host", "x-django-http-inspector-replay"}:
+            continue
+        result.append((name, value))
+    return result

django_http_inspector-0.1.4/src/django_http_inspector/capture/url.py

@@ -0,0 +1,51 @@
+from ipaddress import ip_address, ip_network
+from urllib.parse import quote
+
+
+def _trusted(remote_addr, cidrs):
+    try:
+        address = ip_address(remote_addr)
+        return any(address in ip_network(cidr, strict=False) for cidr in cidrs)
+    except ValueError:
+        return False
+
+
+def _forwarded(environ):
+    value = environ.get("HTTP_FORWARDED", "")
+    if not value:
+        return None, None
+    nearest = value.split(",")[-1]
+    parts = {}
+    for item in nearest.split(";"):
+        key, separator, raw = item.strip().partition("=")
+        if separator:
+            parts[key.lower()] = raw.strip().strip('"')
+    return parts.get("proto"), parts.get("host")
+
+
+def build_url(environ, trusted_proxy_cidrs=()):
+    scheme = str(environ.get("wsgi.url_scheme", "http")).lower()
+    host = str(environ.get("HTTP_HOST") or "")
+    provenance = "reconstructed"
+    if _trusted(str(environ.get("REMOTE_ADDR", "")), trusted_proxy_cidrs):
+        forwarded_scheme, forwarded_host = _forwarded(environ)
+        scheme = forwarded_scheme or str(environ.get("HTTP_X_FORWARDED_PROTO", "")).split(",")[-1].strip() or scheme
+        host = forwarded_host or str(environ.get("HTTP_X_FORWARDED_HOST", "")).split(",")[-1].strip() or host
+        provenance = "trusted_proxy"
+    if scheme not in {"http", "https"} or not host or any(ch in host for ch in "\r\n/@"):
+        return "", scheme, host, provenance
+
+    raw_uri = environ.get("RAW_URI") or environ.get("REQUEST_URI")
+    if raw_uri:
+        target = str(raw_uri)
+        provenance = "server_specific"
+        if not target.startswith("/"):
+            target = "/" + target
+    else:
+        script = quote(str(environ.get("SCRIPT_NAME", "")), safe="/%:@")
+        path = quote(str(environ.get("PATH_INFO", "/")), safe="/%:@")
+        target = script + path
+        query = str(environ.get("QUERY_STRING", ""))
+        if query:
+            target += "?" + query
+    return f"{scheme}://{host}{target}", scheme, host, provenance

django_http_inspector-0.1.4/src/django_http_inspector/config.py

@@ -0,0 +1,102 @@
+from dataclasses import dataclass
+from ipaddress import ip_network
+from os import PathLike
+from pathlib import Path
+from typing import Tuple
+
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+
+@dataclass(frozen=True)
+class InspectConfig:
+    enabled: bool
+    allow_remote: bool
+    path: str
+    capture_max_bytes: int
+    max_records: int
+    exclude_paths: Tuple[str, ...]
+    trusted_proxy_cidrs: Tuple[str, ...]
+    inspector_allowed_hosts: Tuple[str, ...]
+    inspector_allowed_client_cidrs: Tuple[str, ...]
+    replay_timeout: float
+    sqlite_path: Path
+
+    def is_inspector_path(self, path: str) -> bool:
+        base = self.path.rstrip("/")
+        return path == base or path.startswith(base + "/")
+
+    def is_excluded_path(self, path: str) -> bool:
+        return self.is_inspector_path(path) or any(
+            path == prefix.rstrip("/") or path.startswith(prefix)
+            for prefix in self.exclude_paths
+        )
+
+
+def _path(value: object, name: str) -> str:
+    if not isinstance(value, str) or not value.startswith("/"):
+        raise ImproperlyConfigured(f"DJANGO_HTTP_INSPECTOR[{name!r}] must start with '/'.")
+    return value.rstrip("/") + "/"
+
+
+def _positive_number(value: object, name: str, number_type):
+    if isinstance(value, bool) or not isinstance(value, number_type) or value <= 0:
+        raise ImproperlyConfigured(f"DJANGO_HTTP_INSPECTOR[{name!r}] must be positive.")
+    return value
+
+
+def _boolean(value: object, name: str) -> bool:
+    if type(value) is not bool:
+        raise ImproperlyConfigured(f"DJANGO_HTTP_INSPECTOR[{name!r}] must be a boolean.")
+    return value
+
+
+def load_config() -> InspectConfig:
+    raw = getattr(settings, "DJANGO_HTTP_INSPECTOR", {})
+    if not isinstance(raw, dict):
+        raise ImproperlyConfigured("DJANGO_HTTP_INSPECTOR must be a dictionary.")
+
+    allow_remote = _boolean(raw.get("ALLOW_REMOTE", False), "ALLOW_REMOTE")
+    trusted = tuple(raw.get("TRUSTED_PROXY_CIDRS", ()))
+    clients = tuple(raw.get("INSPECTOR_ALLOWED_CLIENT_CIDRS", ("127.0.0.0/8", "::1/128")))
+    try:
+        for cidr in trusted + clients:
+            ip_network(cidr, strict=False)
+    except (TypeError, ValueError) as exc:
+        raise ImproperlyConfigured(f"Invalid django-http-inspector CIDR: {exc}") from exc
+    if not allow_remote and any(not ip_network(cidr, strict=False).is_loopback for cidr in clients):
+        raise ImproperlyConfigured(
+            "MVP Inspector access is loopback-only; non-loopback authentication is not implemented."
+        )
+
+    hosts = tuple(raw.get("INSPECTOR_ALLOWED_HOSTS", ("localhost", "127.0.0.1", "[::1]")))
+    if not hosts or not all(isinstance(host, str) and host for host in hosts):
+        raise ImproperlyConfigured("INSPECTOR_ALLOWED_HOSTS must contain host names.")
+
+    base_dir = Path(getattr(settings, "BASE_DIR", Path.cwd()))
+    sqlite_value = raw.get("SQLITE_PATH", base_dir / ".django-http-inspector.sqlite3")
+    if not isinstance(sqlite_value, (str, PathLike)) or not str(sqlite_value):
+        raise ImproperlyConfigured("DJANGO_HTTP_INSPECTOR['SQLITE_PATH'] must be a non-empty path.")
+    sqlite_path = Path(sqlite_value)
+    if not sqlite_path.is_absolute():
+        sqlite_path = base_dir / sqlite_path
+    sqlite_path = sqlite_path.resolve()
+    if sqlite_path.exists() and sqlite_path.is_dir():
+        raise ImproperlyConfigured("DJANGO_HTTP_INSPECTOR['SQLITE_PATH'] must be a file, not a directory.")
+
+    return InspectConfig(
+        enabled=bool(raw.get("ENABLED", settings.DEBUG)),
+        allow_remote=allow_remote,
+        path=_path(raw.get("PATH", "/__inspect/"), "PATH"),
+        capture_max_bytes=_positive_number(raw.get("CAPTURE_MAX_BYTES", 1024 * 1024), "CAPTURE_MAX_BYTES", int),
+        max_records=_positive_number(raw.get("MAX_RECORDS", 1000), "MAX_RECORDS", int),
+        exclude_paths=tuple(_path(p, "EXCLUDE_PATHS") for p in raw.get(
+            "EXCLUDE_PATHS",
+            ("/static/", "/favicon.ico", "/.well-known/appspecific/com.chrome.devtools.json"),
+        )),
+        trusted_proxy_cidrs=trusted,
+        inspector_allowed_hosts=hosts,
+        inspector_allowed_client_cidrs=clients,
+        replay_timeout=float(_positive_number(raw.get("REPLAY_TIMEOUT", 10), "REPLAY_TIMEOUT", (int, float))),
+        sqlite_path=sqlite_path,
+    )