feat(billing): add cch attestation for OAuth requests - #8
Merged
Conversation
Compute and inject the billing attribution header (fingerprint + cch body hash) for OAuth-authenticated API requests. This matches Claude Code's native client attestation protocol, enabling subscription-tier rate limits and fast mode access. The fingerprint is SHA-256(salt + 3 chars from first user message + version), truncated to 3 hex chars. The cch is xxHash64(serialized body with placeholder, seed) masked to 5 hex chars, replacing the cch=00000 placeholder via str::replacen. Only the first occurrence is replaced — struct field ordering ensures system serializes before messages to avoid collision with tool results containing the literal placeholder. Unlike Claude Code's Bun runtime (which mutates strings in-place and can poison prompt cache via global cch= substitution in historical tool results), our implementation creates a fresh String per request and never modifies the conversation history.
Replace the earlier "tamper-proof / unreplicable" characterization with the actual algorithm, constants, and known bugs based on the a10k.co reverse engineering writeup.
- Fix workspace Cargo.toml: move xxhash-rust after tracing-subscriber to restore alphabetical dependency order. - DRY: use CCH_PLACEHOLDER constant in build_billing_header instead of hardcoding the literal. - Reorder tests to match convention: happy path → variants → edge cases.
Uh oh!
There was an error while loading. Please reload this page.
6 tasks
hakula139 added a commit
that referenced
this pull request
Jun 26, 2026
## Summary Refresh dependencies across both ecosystems and clear the two open Dependabot DoS advisories (#7, #8). - **Rust:** `cargo update` (77 crates, semver-compatible) plus two direct major bumps — `nix` 0.30 → 0.31 and `toml` 0.8 → 1. Both have narrow usage (`nix` only `killpg`/`Pid`/`Signal` in `bash.rs`; `toml` only `from_str` deserialization), so the migrations are no-ops at the call sites. - **Node:** `pnpm update --latest` (cspell 10.0.1, markdownlint-cli2 0.22.1) plus pnpm `overrides` forcing the patched `js-yaml` and `markdown-it`. ## Design decisions - **DoS fix needs an override, not a direct bump.** Both `js-yaml` and `markdown-it` reach the tree only transitively through `markdownlint-cli2@0.22.1`, which still pins the vulnerable versions, so `overrides` is the only way to force the patched releases. - **`js-yaml` capped at `^4.2.0`, not `>=4.2.0`.** The latest is 5.1.0, but 5.x drops the `default` ESM export `markdownlint-cli2` imports, which breaks `pnpm lint`. The advisory is patched in 4.2.0, so the 4.x line fixes the alert without breakage. - **`ratatui` / `crossterm` / `syntect` left on their current majors.** They are already at their newest major; only `nix` and `toml` had a clean newer major among our direct deps. ## Changes | File | Description | | ---------------- | ------------------------------------------------------------------------------ | | `Cargo.toml` | Bump `nix` 0.30 → 0.31, `toml` 0.8 → 1 | | `Cargo.lock` | Relock; `cargo update` across 77 crates | | `package.json` | cspell `^10.0.1`, markdownlint-cli2 `^0.22.1`, pnpm overrides for the DoS deps | | `pnpm-lock.yaml` | Relock onto patched + latest versions | ## Test plan - [x] `cargo fmt --all --check` — clean - [x] `cargo clippy --all-targets -- -D warnings` — zero warnings - [x] `cargo test` — 2094 pass - [x] `pnpm lint` — 48 files, 0 errors - [x] `pnpm spellcheck` — 184 files, 0 issues - [x] No `js-yaml@4.1.1` / `markdown-it@14.1.1` left in the lock
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add billing attribution header computation with cch request integrity hash for OAuth-authenticated API requests. This matches Claude Code's native client attestation protocol, enabling subscription-tier rate limits and fast mode access.
The cch mechanism was reverse-engineered from Anthropic's custom Bun binary (a10k.co writeup) — it's xxHash64 with a fixed seed, masked to 5 hex chars. The fingerprint suffix is SHA-256 of salt + 3 characters from the first user message + version.
billing.rsmodule:compute_fingerprint(SHA-256 suffix),build_billing_header(header assembly with placeholder),inject_cch(xxHash64 body hash + single-occurrence replacement).anthropic.rs: for OAuth, prepend billing header as the first system block, serialize to string, compute and inject cch before sending.CreateMessageRequestfields sosystemserializes beforemessages, ensuring the placeholder in the billing header is found first bystr::replaceneven when tool results contain the literalcch=00000.stream_ssefromserde_json::Value+.json()toString+.body()to support post-serialization cch injection.Avoiding Claude Code's prompt cache bug
Claude Code's Bun runtime performs a global in-place string mutation of
cch=values across the entire request body, including historical tool results (anthropics/claude-code#40652). This permanently invalidates prompt cache and wastes 30-50K+ tokens per turn. Our implementation is structurally immune:inject_cchtakes&str(immutable) and returns a newString— Rust's ownership model prevents in-place mutation.str::replacen(..., 1)replaces only the first occurrence (the billing header's placeholder).messagesslice is never modified — it's serialized fresh each turn.Changes
Cargo.tomlsha2 = "0.10"andxxhash-rust = { version = "0.8", features = ["xxh64"] }to workspace dependenciescrates/oxide-code/Cargo.tomlsha2andxxhash-rustcrates/oxide-code/src/client.rsmod billingcrates/oxide-code/src/client/billing.rscompute_fingerprint,build_billing_header,inject_cchwith 8 testscrates/oxide-code/src/client/anthropic.rsbilling,ContentBlock,Role; reorderCreateMessageRequestfields (systembeforemessages); compute billing header for OAuth instream_message; switchstream_ssebody fromValuetoString; addfirst_user_texthelper with 4 testsCLAUDE.mdbilling.rsto crate structure diagramdocs/research/anthropic-api.mdTest plan
cargo fmt --all --check— cleancargo buildcompiles cleanlycargo clippy --all-targets -- -D warnings— zero warningscargo test— 208 tests pass (12 new)cargo llvm-cov --ignore-filename-regex 'main\.rs'— 87% line coverage (billing.rsat 100%)