How Claude Code tracks your coding sessions

As a Head of Analytics, I build tracking systems for a living. So at some point the obvious question hit me: how does my own tool track me? I decompiled the Claude Code CLI binary and cross-checked it against source code Anthropic accidentally leaked via npm. Your prompts aren't being exfiltrated. Your code stays local. But there's a regex that flags when you swear, 40 background LLM calls you never see, a remote flag that can change what gets collected without asking, and DO_NOT_TRACK=1 is silently ignored.