fix(store): record cwd for live Claude Code 2.1.283 proxy traffic

[lis186]

摘要

修正即時 proxy 流量的 Claude cwd 仍然是 null 的問題。

• 現象： fix: subagent import, Claude/Codex proxy cwd, 1h cache pricing, and indexed effort #637 修過 Claude Code 2.1.283 的 cwd 擷取，但即時 proxy 流量在 index.ndjson 和 sessions.json 裡的 cwd 還是全部是 null，所有新版 Claude Code 流量的專案歸屬都受影響。
• 原因： 即時請求其實有頂層的 system，只是 cwd 那一行搬到了 role: system 的訊息裡；extractCwd 在 system 裡找不到就直接回傳 null。
• 為什麼 fix: subagent import, Claude/Codex proxy cwd, 1h cache pricing, and indexed effort #637 沒發現： _req.json 不存 system（只存 hash），所以拿存下來的請求檔驗證時，走的是另一條程式路徑，看起來是好的。
• 修正後： 子代理的判斷不受影響。

Details

• Root cause: live Claude Code 2.1.283 bodies carry a top-level system (starting with x-anthropic-billing-header: cc_version=2.1.283…, about 27 KB) that has no Primary working directory: line. The env block moved to a role: 'system' message. store.extractCwd's system branch returned null without looking further.
• Why fix: subagent import, Claude/Codex proxy cwd, 1h cache pricing, and indexed effort #637 missed it: stored _req.json keeps sysHash instead of system, so the stored-body analysis behind c4f293f took the context_management branch and looked correct. After re-attaching shared/sys_<hash>.json and shared/tools_<hash>.json to the 22 stored requests from the re-verification run, 0/22 yielded a cwd; stored bodies alone gave 20/22.
• Fix (server/store.js): when system has no cwd line, requests carrying context_management continue to the role-system messages, then messages[0], then safeguards[].classifier_context.live_cwd.
  • Role-system messages are checked before messages[0], because 2.1.283's messages[0] embeds CLAUDE.md <system-reminder> text that may quote an unrelated Primary working directory: line. The security scan flagged this ordering (F1).
  • Requests without context_management (title generation, subagent kickoff) still return null as before, so isAnthropicSubagent / isLikelySubagent classification is unchanged.
• Title generation inherits the session's known cwd through the existing sessionMeta path, and stays isSubagent: true.
• Tests: a new test/live-proxy-cwd.e2e.test.js drives a real proxy against a mock upstream with a 2.1.283-shaped main turn and a same-session title request. It checks the index cwd, the title request's isSubagent and cwd inheritance, and sessions.json after shutdown. Unit cases were added to test/store.test.js.
• Docs: docs/wire-protocol-reference.md gains a changelog entry and a corrected Claude cwd detection description.

Verification

• CCXRAY_HOME=$(mktemp -d) CCXRAY_EXPORT_DISABLE=1 npm test: 2645/2646. The one failure, hub-owned config status divergence ("row 2: local agent-port refusal reaches stdout", timed out), is unrelated. It fails identically with the pre-fix server/store.js on this machine and passes in CI on main (fix(cli): print --help and reject unknown options before booting #639). The real ~/.ccxray was untouched during the run.
• Fail-on-old / pass-on-new: test/store.test.js plus test/live-proxy-cwd.e2e.test.js against the pre-fix store.js fail 5 of 72, all actual: null; with the fix, 72/72 pass.
• Live run: Claude Code 2.1.283 claude -p --effort low with a general-purpose subagent, through an isolated proxy. All 5 entries and sessions.json recorded the working directory. Subagent agentKey/isSubagent were unchanged from the pre-fix run.
• Independent review (agentflow security-scan + acceptance, Claude-family reviewers): Outcome, Minimality and Conformance all PASS. Security findings F1 and F6 are folded into this commit.

Not verified:

• Claude Code versions other than 2.1.283.
• Deferred security findings, not in this PR:
  • F2: a pre-existing dashboard onclick DOM XSS on project names (public/miller-columns.js:1858). It is easier to reach now that cwd is recorded, and it is the next fix in the queue.
  • F3: export repoRoot() without sanitizeName().
  • F4/F5: cwd control characters and validation.

🤖 Generated with Claude Code