The header-stripping test sent a real internal address and an internal
client name as forwarded headers. It now uses 203.0.113.44 (TEST-NET-3) and a
neutral client name, and checks those values for leaks instead. The host
setup guide pointed at the build directory of an old monorepo layout; it is
service/ in this repository.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
Stripping forwarding headers kept our IP and chain out of reach, but the
User-Agent went through untouched. Clients that fell back to their own name
("crawlkit-roles", "crawlkit-virk", ...) tied all ten exits together as one
actor, and one missing UA meant Go-http-client. The proxy now overwrites the
UA on every request (WEIRCON_USER_AGENT, default current Firefox) and the
egress prober uses the same string.
Also dropped: From, Sec-Ch-Ua* (would contradict a Firefox UA) and any
X-Weircon-* by prefix. New end-to-end test drives the whole handler and
checks what the target actually receives.
Claude-Session: https://claude.ai/code/session_01AUj1LSMmrowcomkn1ciAgj
agw