From 5cc7cf111fa2f18ee6a1dc9f0708b916d5fcc5a7 Mon Sep 17 00:00:00 2001 From: LP Date: Wed, 19 Aug 2026 23:17:58 +0000 Subject: [PATCH] bank/anthropic: describe the client the OPTIONAL block is for MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Comments only — no uncommented line changes, `hosts` is untouched, and the boundary is exactly what it was. What changes is whether the block describes a client anyone is running. Measured on one lab: Claude Code 2.1.234, every host that appeared in its trail over one run. Two the block did not offer, and one it offers that never came up. downloads.claude.ai is the auto-updater, retrying and failing 32 times in that run. It is listed with the reason NOT to enable it: a lab that pins CLAUDE_VERSION updates by rebuild, so blocked is the right default and the only cost is a noisy trail — which DISABLE_AUTOUPDATER fixes without opening egress. http-intake.logs.us5.datadoghq.com is client telemetry, and naming it matters because sentry.io was already here under "error reporting": someone enabling that line to quiet telemetry blocks would find it changed nothing. The `us5` shard is per-account, so the line says to copy what your own trail shows rather than this one. statsig.anthropic.com keeps its line and gains the finding — never contacted in that run, with 2.1.x fetching gates over api.anthropic.com instead. Annotated rather than deleted: one lab is thin evidence for removing an option, and a commented line costs nothing. The evidence is scoped in the file itself, since a list of hosts one client generation contacted is not a claim about the product. Deliberately not here: raw.githubusercontent.com, which the trail cannot attribute between the client and the agent's own work, because the proxy logs host and method and no path. And the Remote Control note #119 suggested — #120 measured that conclusion wrong, so it should not ship in the shape #119 wrote it. Refs #119 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01BLuSkuyQUfogZpMJ5fVMF9 --- bank/anthropic/allowlist | 43 ++++++++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 6 deletions(-) diff --git a/bank/anthropic/allowlist b/bank/anthropic/allowlist index 401f3a7..a9cc203 100644 --- a/bank/anthropic/allowlist +++ b/bank/anthropic/allowlist @@ -41,11 +41,42 @@ platform.claude.com GET # --------------------------------------------------------------------------- # OPTIONAL — nothing below is needed for the provider to work. # --------------------------------------------------------------------------- -# statsig.anthropic.com POST # feature flags; the client works without it +# downloads.claude.ai GET # in-place auto-update +# statsig.anthropic.com POST # feature flags # sentry.io POST # error reporting +# http-intake.logs.us5.datadoghq.com POST # client telemetry # -# Note what these are NOT: they belong in an allowlist and must never appear in -# the entry's `hosts`. `hosts` is where the addon attaches the Anthropic -# credential, and attaching it to a Sentry request is exactly the accident the -# addon's host matching exists to prevent. Reachable and credentialed are two -# different lists that happen to overlap. +# What these four are is one lab's evidence, not a claim about the product: +# Claude Code 2.1.234, every host that appeared in its trail over one run. A +# different client generation may well contact a different set, so treat the +# list as a starting point and read your own trail. +# +# downloads.claude.ai is the auto-updater, and leaving it blocked is the RIGHT +# default rather than an oversight — a lab whose Dockerfile pins +# CLAUDE_VERSION gets its updates from a rebuild, which is the point of pinning +# it. The only cost is noise: the updater retries, so the trail fills with +# blocked GETs (32 in that run). Someone who wants a quiet trail wants +# DISABLE_AUTOUPDATER in the lab, not this line — opening egress to silence a +# log is paying in the wrong currency. +# +# http-intake.logs.us5.datadoghq.com is client telemetry, and it is NOT the +# sentry.io line above. Anyone who reaches for that one to quiet telemetry +# blocks will find it changed nothing, which is the reason both are named here +# rather than one standing in for the other. `us5` is the shard THAT account +# was assigned; the region is not fixed, so another deployment may see us3 or +# us1 and should copy what its own trail shows rather than this line. +# +# statsig.anthropic.com was never contacted in that run — not once, over the +# whole trail. 2.1.x appears to fetch its gates over api.anthropic.com instead +# (GET /api/claude_code and POST /api/event_logging both show up there, +# credentialed). It stays listed because a line that costs nothing while +# commented is the cheap side of the bet, and one lab is thin evidence for +# deleting an option: an older or newer client may still want it. +# +# Note what all four are NOT: they belong in an allowlist and must never appear +# in the entry's `hosts`. `hosts` is where the addon attaches the Anthropic +# credential, and attaching it to a Sentry or Datadog request is exactly the +# accident the addon's host matching exists to prevent — a telemetry sink is +# the clearest case, since the whole point of the host is that it receives and +# stores what it is sent. Reachable and credentialed are two different lists +# that happen to overlap.