[Juliusolsson05]

Summary

Bumps packages/claude-code-headless so the mitm addon emits request_shape alongside proxy request events. This repairs the body-shape sidecar predicate that was silently inert in production: modern Claude Code requests include large conversation bodies, so the old adapter usually had no body data to inspect and title-gen / branch-name-gen / hook-agent flows could leak into the cc-shell feed as orphan ghosts.

This bump also includes two proxy-capture behavior changes that should be reviewed with the same care as the request-shape field:

• request headers written to proxy-events.jsonl are filtered through an allowlist, so sensitive headers such as Authorization and unreviewed custom headers are no longer persisted
• the forensic body_b64 capture cap increases from 256 KiB to 2 MiB; request_shape is still the predicate path, while body_b64 remains for debugging captured small/medium requests

Forensic root cause (debug bundle 2026-05-07T08-26-35-212-5d948ab5)

signal	observed
/v1/messages requests with body captured	1 of 23 (the 323-byte warmup quota check)
/v1/messages requests dropped past 256 KiB cap	22 of 23 (Content-Length 681862-1033291)
state.requestShape non-null when isSidecarFlow ran	0
flow_ignored events emitted	0
orphan ghosts visible at the bottom of the user feed	7

The c8c2623 predicate was correct; the addon never fed it data on real Claude Code traffic because every modern request includes the full conversation history.

Submodule change (packages/claude-code-headless)

fix/emit-request-shape now points at commit f978e15 and includes:

• mitmAddon.py parses the buffered request body inside the addon and emits a small request_shape JSON object regardless of body size
• ClaudeProxyAdapter.ts accepts optional request_shape, prefers it over parsing body_b64, and keeps body_b64 as the fallback for older addon binaries
• request header capture now uses an allowlist to avoid persisting Authorization or future sensitive headers by default
• _REQUEST_BODY_CAP is now 2 MiB for forensic body_b64 capture; request-shape extraction remains independent of that cap

Followups

• The renderer-side suppression in fix(feed): suppress orphan ghosts with title-gen / predict-next-prompt shape #54 stays in place as belt-and-suspenders for sidecar variants whose system-prompt fingerprint we do not yet have. Once we capture and add the predict-next-prompt prefix to SIDECAR_SYSTEM_PROMPT_PREFIXES, the renderer filter can be removed.
• A separate PR in the claude-code-headless repo should merge fix/emit-request-shape to its main so the submodule pointer here is reachable from a stable ref.

Verification

• npm run build in packages/claude-code-headless
• npm run build:app in cc-shell
• npx tsx src/testing/verify-sidecar-haiku.ts — 13 passed, 0 failed
• After merge: user restarts the app, generates a Claude turn, and we expect flow_ignored events for any sidecar shape that matches signal 2a (max_tokens <= 1024 AND messageCount <= 3) or signal 2b (system-prefix fingerprint).

[Juliusolsson05]

Scope expansion — additional commit on this branch (and the submodule branch):

Building on the original `request_shape` capture, added:

• Header allowlist (`mitmAddon.py`). `dict(request.headers)` was exfiltrating bearer tokens and ANTHROPIC_CUSTOM_HEADERS-injected secrets to disk. Now restricted to the headers we actually use for forensic correlation (`x-app`, `user-agent`, `x-claude-code-session-id`, `anthropic-beta`, etc.). Authorization is structurally excluded.

• Extended `request_shape` with four diagnostic discriminators identified by reverse-engineering Claude Code's HTTP layer (`vendor/claude-code-src/full/services/api/client.ts`, `utils/sideQuery.ts`):

  • `tools_count` — real CC turns ALWAYS ship the tools array; sidecars routed through `sideQuery`/`queryHaiku` ship `tools: []` or omit. Strongest single signal we don't yet wire into `isSidecarFlow`.
  • `system_blocks_count`, `system_total_chars`, `messages_total_chars` — magnitude signals.
  • `attribution_entrypoint` — `cc_entrypoint` slug parsed out of the attribution header (`cli` / `sdk-cli` / `mcp` / etc.).

• Body cap raised 256 KiB → 2 MiB so forensic tooling (debug bundles) can decode actual prompt text. The previous cap silently dropped the body for every conversation past the warmup quota check.

`verify-sidecar-haiku.ts`: 13/13 still passing — predicate logic untouched; all new fields are additive.

Submodule commits: 505377a (original), f978e15 (this expansion).
cc-shell commits: e034ad0 (pointer bump), ba55ae7 (pointer re-bump for f978e15).