Author here, I ran a MITM dump on Claude Code sessions to see what actually gets sent over the wire and what makes the safety classifier tick.