From ce8298b6dbc8e4c50694e10aa561b175e28b20ec Mon Sep 17 00:00:00 2001 From: paoloanzn Date: Wed, 1 Apr 2026 15:26:35 +0200 Subject: [PATCH] feat: always include cch=00000 placeholder in attribution header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove the NATIVE_CLIENT_ATTESTATION feature gate so the cch placeholder is always present. The hash computation is now handled in JS-land via the fetch wrapper rather than Bun's native HTTP stack. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- src/constants/system.ts | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/src/constants/system.ts b/src/constants/system.ts index 0cd2e76..c83fce6 100644 --- a/src/constants/system.ts +++ b/src/constants/system.ts @@ -1,6 +1,5 @@ // Critical system constants extracted to break circular dependencies -import { feature } from 'bun:bundle' import { getFeatureValue_CACHED_MAY_BE_STALE } from '../services/analytics/growthbook.js' import { logForDebugging } from '../utils/debug.js' import { isEnvDefinedFalsy } from '../utils/envUtils.js' @@ -61,14 +60,10 @@ function isAttributionHeaderEnabled(): boolean { * Returns a header string with cc_version (including fingerprint) and cc_entrypoint. * Enabled by default, can be disabled via env var or GrowthBook killswitch. * - * When NATIVE_CLIENT_ATTESTATION is enabled, includes a `cch=00000` placeholder. - * Before the request is sent, Bun's native HTTP stack finds this placeholder - * in the request body and overwrites the zeros with a computed hash. The - * server verifies this token to confirm the request came from a real Claude - * Code client. See bun-anthropic/src/http/Attestation.zig for implementation. - * - * We use a placeholder (instead of injecting from Zig) because same-length - * replacement avoids Content-Length changes and buffer reallocation. + * Includes a `cch=00000` placeholder that is replaced with a computed + * xxHash64-based integrity hash before the request is sent. The fetch + * wrapper in client.ts handles the replacement. The server verifies + * this token to gate features like fast mode. */ export function getAttributionHeader(fingerprint: string): string { if (!isAttributionHeaderEnabled()) { @@ -78,8 +73,7 @@ export function getAttributionHeader(fingerprint: string): string { const version = `${MACRO.VERSION}.${fingerprint}` const entrypoint = process.env.CLAUDE_CODE_ENTRYPOINT ?? 'unknown' - // cch=00000 placeholder is overwritten by Bun's HTTP stack with attestation token - const cch = feature('NATIVE_CLIENT_ATTESTATION') ? ' cch=00000;' : '' + const cch = ' cch=00000;' // cc_workload: turn-scoped hint so the API can route e.g. cron-initiated // requests to a lower QoS pool. Absent = interactive default. Safe re: // fingerprint (computed from msg chars + version only, line 78 above) and