TLS-intercepting tracer for the Claude Code, Codex, Grok, and Kimi Code CLIs — full first-party capture (messages, OAuth, usage/credits) in a live web UI: reconstructed sessions, replay, cost/cache/first-token-latency chips. External hosts pass through as byte-counted tunnels, never decrypted.