[BUG] Background permission/safety-check requests aren't reflected in cost/usage, and use the full-price model

What's Wrong?

Beyond the visible assistant turn, Claude Code issues additional POST /v1/messages requests during tool-call execution that never appear as a visible turn in the transcript, in /cost, or in /usage. Captured via a local read-only reverse proxy in front of ANTHROPIC_BASE_URL, across ~7 weeks of real usage (2026-07-13 → 2026-08-31, Claude Code 2.1.220 → 2.1.251):

• These requests use the full-price conversational model (response model field: claude-sonnet-5), not a lighter one.
• Each carries a large (~100K+ character) system prompt and reads tens of thousands of cached tokens, for a tiny response (max_tokens in the tens, single-digit output_tokens).
• They correlate closely with gated tool calls in some sessions: one captured session had 297 of these extra requests against 327 Bash tool calls in the same session (~91%).
• In that session they cost $11.38 out of $30.39 total session spend — 37% of the bill for a mechanism the user never sees broken out anywhere.
• Across all 64 sessions where we observed them, they totaled $73.63 of $836.45 total spend on those sessions (8.8% overall, ranging up to 37% in the worst single session).
• None of this shows up in the CLI's own cost/usage reporting — the only way we found it was inspecting raw HTTP traffic through a local proxy.

What Should Happen?

• Any system-initiated (non-conversational) request Claude Code makes on the user's behalf should be attributed as its own category in /usage//cost — the same transparency already requested for query_source=auxiliary (#82274) and for away-summary billing (#85922).
• Where the underlying task is a bounded, low-complexity decision, it should route to a lightweight model rather than the full conversational model, consistent with how title-generation/session-recap are already supposed to work.

Steps to Reproduce

1. Point ANTHROPIC_BASE_URL at a local reverse proxy that passes requests through unmodified and logs each request/response pair (byte-faithful, no MITM needed).
2. Run a normal coding session that executes several permission-gated tool calls (e.g. Bash).
3. Count POST /v1/messages requests captured by the proxy vs. visible assistant turns in the transcript — there are more requests than turns.
4. Inspect one of the extra requests: max_tokens is small (tens), the response usage.output_tokens is single digits, and usage.cache_read_input_tokens is large (tens of thousands) despite no new visible conversation content having been added.

Claude Code Version

2.1.251 (also observed, unchanged in kind, since at least 2.1.220 and 2.1.237 — sampled across the full ~7-week window)

Is this a regression?

Not sure — it was present and structurally identical across every version we sampled (2.1.220, 2.1.237, 2.1.251) over a month, so it isn't a recent regression within our observation window, but we don't know if it predates it.

Platform

Anthropic API (the same behavior was also present earlier via AWS Bedrock, before an Aug 2026 migration to direct Anthropic access)

Additional Information

This surfaced while building a local profiler that records proxy traffic to measure Claude Code's real-world cache/cost behavior. Happy to share the aggregated (non-content) request-level numbers behind this if useful — no conversation content is required to reproduce or verify the pattern, just request/response metadata (model, token counts, timing).