feat(actions): name the CLI and its harness on every passthrough call (v2.6.0)

[krish221997]

What

Every actions execute call now says who is calling, so the dashboard's Logs page can show it (PICA-1017; backend side is pica-v2 #992).

Header	Value	When
x-one-source	cli	always
x-one-agent	claude-code, cursor, codex, gemini-cli, windsurf, kiro, openclaw, hermes, devin	only when that harness launched the process (the env markers detectLauncher already reads)

A person in a plain terminal sends only the source. No harness version is sent: the CLI does not know it, and a made-up one would be shown next to the harness name as if real. An explicit --headers value still overrides both. Only the passthrough request builder changed; no other request carries them.

Claude Code ──runs──▶ one actions execute ──x-one-source: cli, x-one-agent: claude-code──▶ /v1/passthrough
                                                                                         └─▶ Logs: "Claude Code · via CLI"

Safety

• Cannot break a call. The backend reads these as telemetry: a value it cannot parse is dropped and the call proceeds (DeclaredAgent::for_headers, DeclaredSource::for_headers, both in #992). A source outside the closed list (cli) is ignored.
• No new data leaves the machine beyond the harness name. No arguments, no version, no paths.
• Release order matters. On a backend without #992 (prod is internal-7.33.0 today, #992 is merged but not yet tagged), the passthrough route forwards every caller header it does not explicitly withhold to the upstream platform. These two would therefore reach Stripe, Gmail, etc. as unknown headers. Harmless to the call, but it leaks the harness name to third parties. Tag and publish this CLI version only after a core release containing #992 is on prod. The PR is otherwise ready.

Changes

• src/lib/caller.ts: callerHeaders(env).
• src/lib/api.ts: spread into executePassthroughRequest's headers, before args.headers.
• src/lib/api-caller-headers.test.ts: surface always, harness by launcher, plain terminal, --headers override, non-passthrough untouched. Launcher env markers are cleared per test because the suite itself may run under Claude Code.
• README.md: one paragraph above Telemetry.
• package.json / package-lock.json: 2.5.0 → 2.6.0, version fields only (hand-edited per CLAUDE.md).

Verified

• npm run typecheck clean, npm run build clean.
• npm test: 662 pass, 6 fail. The 6 are resolveConfig tests that fail identically on main without this change (checked by stashing); all 7 new tests pass.
• Not run end to end against a core with #992: the local core and Docker are down on this machine. The header shapes match #992's own route tests (test_passthrough_records_the_client_and_surface_the_cli_names).

🤖 Generated with Claude Code