pxpipe on Windows (Claude Desktop)

This is a Windows-focused fork of teamchong/pxpipe. It adds Windows support to pxpipe mitm — the transparent CONNECT proxy that lets Claude Desktop's Code tab route its Anthropic traffic through pxpipe so Fable 5 requests get image-compressed. Everything else about pxpipe is upstream's; read the main README for what pxpipe does and why.

If you're on macOS or Linux, use upstream — you don't need this fork.

What's different on Windows

Piece	macOS/Linux (upstream)	Windows (this fork)
CA/cert generation	shells out to openssl	pure-JS node-forge (no openssl needed)
Autostart at login	launchd KeepAlive agent	Task Scheduler ONLOGON task (best-effort)
Cert trust	NODE_EXTRA_CA_CERTS only	same — nothing added to the OS trust store

Why node-forge: Windows has no openssl by default, and Git-for-Windows' bundled openssl silently corrupts the -subj "/CN=..." argument, so shelling out is unreliable. node-forge mints an equivalent CA + api.anthropic.com leaf in pure JS.

Requirements

• Windows 10/11
• Node.js (a recent LTS or current) + npx
• Claude Desktop (Code tab), signed into your Claude account
• This repo checked out locally

Quick start

From the repo folder, in PowerShell:

# 1. Generate the CA and patch ~/.claude/settings.json to route through the proxy
npx tsx src/node.ts mitm install

# 2. Start the proxy — LEAVE THIS WINDOW OPEN (it runs in the foreground)
npx tsx src/node.ts mitm

Then fully quit Claude Desktop from the system tray (not just closing the window) and reopen it. Run a task in the Code tab with the model set to Fable 5, and watch the dashboard at http://127.0.0.1:47821/ — you should see events, and compressed Fable requests show "compressed":true in ~/.pxpipe/events.jsonl.

The included start-pxpipe.bat / stop-pxpipe.bat do these steps for you (double-click). stop-pxpipe.bat also runs mitm uninstall to restore your settings — use it if anything goes wrong.

Verifying it works

npx tsx src/node.ts mitm doctor

Expect: cert engine: node-forge, CA material: ok, settings.json: ok. Then in ~/.pxpipe/events.jsonl, a real working request looks like:

"model":"claude-fable-5" ... "compressed":true ... "status":200

Non-Fable models (Sonnet, Opus) will show "reason":"unsupported_model" and pass through uncompressed — that is correct and deliberate. pxpipe only compresses Fable 5, because Sonnet/Opus misread dense imaged text. Leave the Sonnet/Opus chips off in the dashboard.

Known caveats (read these — no bluff)

1. The proxy must be running. If settings.json says to route through 127.0.0.1:47821 but nothing is listening there (proxy window closed, machine rebooted, crash), Claude Desktop will hang and retry until it fails. If Desktop suddenly stops responding, this is the first thing to check. Fastest recovery: run stop-pxpipe.bat (or npx tsx src/node.ts mitm uninstall) to strip the proxy setting, then restart Desktop.

2. Claude Desktop rewrites settings.json on its own. On the newer "Cowork"/agent build, Desktop periodically regenerates ~/.claude/settings.json from its own state, which wipes the injected proxy env. When that happens, interception silently stops (proxy runs, but no new events appear). Re-run mitm install to re-patch. There is no fully durable fix for this from the proxy side — it's Desktop-owned behavior. If you find a Desktop setting that stops the rewrites, that's the real fix.

3. Autostart is best-effort. schtasks registration can fail with "Access is denied" under restricted/managed Windows profiles. That's not fatal — the proxy still works; you just have to start it yourself each session (or add start-pxpipe.bat to your Startup folder). The installer reports honestly whether the task registered.

4. The proxy decrypts api.anthropic.com locally. Same as upstream: your API/OAuth token is visible in plaintext to the proxy (loopback only, never written to events.jsonl). The CA signs only api.anthropic.com; every other host is raw-tunneled untouched.

Uninstall

npx tsx src/node.ts mitm uninstall     # restores settings.json from backup

Then close the proxy window. To remove trust entirely, delete ~/.pxpipe/mitm/.

Credit

All the hard parts — the compression engine, the MITM architecture, the transform pipeline — are teamchong/pxpipe. This fork only ports the platform-specific glue to Windows.