Anthropic OAuth subscription: emit x-anthropic-billing-header + cch to bypass the third-party-agent classifier (redux of #2306)

Following up on #2306 (closed 2026-06-27). I think there's a narrow change that addresses part of what it described without touching the part you said was out of scope.

What I'm proposing

Two more signals Anthropic's classifier looks for in the request, both injectable in packages/backend/src/routing/proxy/anthropic-adapter.ts without modifying the system prompt:

1. x-anthropic-billing-header HTTP header — real Claude Code 2.1.185 sends cc_version=2.1.185.XXX; cc_entrypoint=claude-desktop; cch=<5-hex>. The cc_version is itself now a load-bearing signal (Anthropic has been shipping a Claude Code release per week; staying within ~50 patch versions of current matters). cc_entrypoint matters too — see ex-machina-co/opencode-anthropic-auth#175.

2. cch 5-hex body-attestation — Anthropic server-side xxHash64s the body with a per-version seed (0x4D659218E32A3268 since v2.1.138), applies a preimage transform that blanks model and strips max_tokens, and matches the lower 20 bits against this header. Placeholder cch=00000 routes to overage. Algorithms to port from: BYK/loreai cch.ts, marco-jardim reverse-engineering writeup, router-for-me/CLIProxyAPI claude_signing.go. For a TS implementation the existing hash-wasm npm dep provides xxHash64.

What this is not

I'm explicitly not asking for fingerprint scrub tables, tool-name maps, or anything that tracks Anthropic's current classifier rules. Those are a moving target and not a fit for a proxy layer — your earlier comments on #2306 were right. The two signals above are derived from public Claude Code traffic and don't depend on classifier sensitivity.

What I'd like to know

1. Would you welcome a PR against anthropic-adapter.ts with the algorithm ported? I'm happy to draft it and walk through before any commitment.
2. If injecting these is out of scope, would you be open to a small documented passthrough hook (e.g., a MANIFEST_ANTHROPIC_BILLING_HEADER env or config) so users who need this can supply their own header + cch without every user running their own proxy?
3. Either way, would a non-prescriptive pointer in docs/providers/subscription-based-providers.md ("if you see Anthropic return 400 'Third-party apps now draw from your extra usage' with a populated request_id, the open-source community has documented bypasses") be helpful for users hitting this?

Note

Thanks again for the cache_control cap in #2258 and the identity-block injection — those alone fixed most of what I was hitting. This would just close the remaining gap on tool-bearing requests from non-Claude-Code clients. Happy to close if the team doesn't think this gap is worth the proxy's time.