The debugger moved into the conversation.
Wirepane is a new Claude Code plugin that puts an HTTPS debugging proxy inside the coding session. Its repository says the proxy can read browser, simulator, emulator, and phone traffic. Two tools let the model list requests or retrieve one request with its headers and decoded body.[1]
That can cut a familiar loop: open another app, find the failed request, copy it, remove enough private data, then paste what remains into chat. It also joins two trust zones that developers often keep apart. The proxy can see secrets because that is its job. The agent can reason over a request because that is its job. The handoff between them needs its own control.
The right default is the smallest useful capture, not the largest available capture.
TLS inspection creates a local authority.
An HTTPS inspection proxy generates certificates for the sites a client visits. The client accepts them only after it trusts the proxy's local certificate authority. Mitmproxy's documentation explains this mechanism and recommends bypassing hosts that use certificate pinning when their contents do not need inspection.[2]
Wirepane uses the same class of mechanism. Its README says recorded flows can hold passwords, tokens, and personal data. It also says the files remain on disk for two days after the session's last use, unless the user removes them sooner.[1] A local CA and a flow folder are security assets, not temporary visual clutter.
OS permission is too coarse for intent.
Howard Oakley's analysis of macOS Full Disk Access draws a useful line between intent and consent. Selecting one file expresses intent to use that file. Full Disk Access grants a broad standing permission that includes sensitive stores such as Mail and Messages.[3]
Network capture has the same shape. Pointing a whole device at a proxy is broad consent. Naming api.example.com for one login failure expresses the debugging intent. Wirepane's tracked-domain mode can decrypt and record only named domains while passing other connections through untouched.[1]
The model handoff is a second gate.
Local storage does not mean the model has seen nothing. Wirepane says a request enters the conversation when the model calls a request-reading tool. Anthropic's security guide says users remain responsible for reviewing proposed actions. It also recommends project-specific permissions, sandboxing, and virtual machines when external content or services raise risk.[4]
Use separate decisions for capture and disclosure. First decide which client and hosts the proxy may inspect. Then decide which single request the model may read. Redact authorization headers, cookies, request bodies, and response fields before the second decision when the values are not needed to explain the bug.
Artifact check, with a narrow claim.
We cloned Wirepane at commit 73e10496704ee96bb039456cd0dba6c42e4a4f04 and ran its three sidecar test files under Node 22. The run passed 38 tests. Those tests exercised local HTTP and HTTPS capture, tracked domains, rule ordering, loopback refusal for LAN clients, and the guard that tunnels the agent's own traffic.
We did not install the plugin, trust its certificate authority, change a system proxy, connect a phone, or send captured traffic to a model. The passing repository tests support a narrow statement: the tested sidecar behaviors passed on this Linux host. They do not verify the macOS interface, every client, data handling in a real session, or the security of arbitrary rule scripts.
- Use a separate browser profile or test device when possible.
- Track only the hosts needed for the bug.
- Keep captured bodies out of the model unless their content matters.
- Stop the proxy, restore device settings, remove trust, and purge saved flows when the check ends.
The quarantine lane below combines an inspection-scope selector, four review sections, a physical valve readout, and a copyable test card. It drafts the boundary. It does not configure a proxy or prove that data was redacted.