Claude Code processes make HTTPS calls during macOS DarkWake, consuming rate limit budget while laptop sleeps

Summary

Claude Code's Bun processes maintain persistent HTTPS connections and actively reconnect to Anthropic's API servers during macOS DarkWake cycles (brief 2-45 second kernel-level wakes during clamshell sleep). These reconnections appear to anchor the 5-hour rolling usage window and consume rate limit budget -- even though the user is asleep and no prompts were sent.

Environment

• macOS Darwin 25.3.0 (Apple Silicon)
• Claude Code v2.1.81
• Max 5x plan ($100/mo)
• 9 Claude Code sessions open across different projects

What happened

1. Last user activity: 00:32 AM IST (March 23, 2026)
2. Clamshell sleep entered: 00:38 AM (80% battery, on battery)
3. Laptop asleep for ~6 hours, 24 DarkWake cycles
4. First FullWake (lid open): 06:37 AM
5. First command: \/usage\ at 06:54 AM
6. \/usage\ showed ~10% session usage already consumed, reset time 10:29 AM IST

Zero user activity between 00:32 and 06:54. Confirmed via \~/.claude/history.jsonl\.

Evidence from macOS unified log

During DarkWake cycles, Claude Code processes (process names \2.1.76\ and \2.1.81\) made HTTPS calls to port 443:

| DarkWake Time (IST) | Claude Code PIDs Active | Notes |
|---|---|---|
| 05:16:02 | All 9 PIDs | Simultaneous HTTPS calls |
| 05:34:00 | All 9 PIDs | Different hostnames -- connections re-established to new CDN nodes |
| 05:42:29 | All 9 PIDs | Simultaneous HTTPS calls |
| 06:00:12 | 1 PID | Single process |
| 06:16:07 | All 9 + extras | 11 calls total |
| 06:31:24 | 8 PIDs | Nearly full burst |

The hostname hashes change between 05:16 and 05:34, indicating active TLS reconnections (not passive path checks). All connections are port 443, TCP, \attribution: developer\.

The rolling window math

• \/usage\ reset time: 10:29 AM IST
• 10:29 - 5 hours = 5:29 AM (window anchor)
• DarkWake at 05:34 AM is within 5 minutes of this anchor
• DarkWake at 05:16 AM would anchor at 10:16 AM -- also in range

The rolling window appears to be anchored to a DarkWake reconnection, not to any user-initiated activity.

Expected behavior

• Background keepalive/reconnection during DarkWake should NOT anchor the rolling usage window
• Background reconnections should NOT consume tokens or rate limit budget
• Idle sessions should not phone home during sleep in a way that affects metering

Actual behavior

• 9 Claude Code processes reconnect to Anthropic servers during every DarkWake cycle (~every 15 min)
• These reconnections appear to be counted as session activity
• The 5-hour rolling window anchors to these phantom touches
• User wakes up to find ~10% of burst budget consumed before sending a single prompt

Additional context

• macOS DarkWake is a brief kernel-level wake for TCPKeepAlive/SleepService maintenance. Display stays off. Not triggered by the user.
• \pmset -g log\ confirms all DarkWake timestamps and durations (2-45 seconds each)
• macOS unified log confirms Claude Code process network activity (via \nw_path_libinfo_path_check\) during each DarkWake window
• No entries in \history.jsonl\ during the sleep window
• Battery drained from 80% to 65% overnight (consistent with DarkWake TCPKeepAlive activity)

Suggested fix

1. Don't count background keepalive/reconnection traffic against the rate limit or rolling window
2. Consider using \NSProcessInfo.beginActivity(options: .suddenTerminationDisabled)\ or similar to opt out of DarkWake network scheduling for idle sessions
3. Expose per-request token costs in \/usage\ or \/status\ so users can audit what consumed their budget