Implement comprehensive Claude Code client emulation to ensure all Go-originated
requests are indistinguishable from Node.js clients at the TLS and HTTP levels.
## Core Changes
### 1. TLS Fingerprint Enhancements
- **Enable HTTP/2**: Set ForceAttemptHTTP2=true in TLS transport to match Node.js 24.x
behavior (HTTP/2 is preferred by modern Node.js)
- **ALPN Protocol Priority**: Changed from ["http/1.1"] to ["h2", "http/1.1"] to
advertise HTTP/2 preference, matching actual Node.js client capability
### 2. Request Header Validation & Cleaning (Monkey Patch)
- Created new claudemask package for Node.js emulation validation
- ValidateNodeEmulation(): Verify all required Node.js headers present
- CleanRequest(): Fix any Go client indicators that slip through (Go User-Agent, etc)
- Applied in buildUpstreamRequest() as final validation before sending to Claude API
- Validates 8 required headers: User-Agent, X-Stainless-*, anthropic-version
### 3. Comprehensive Testing
- 8 unit tests covering validation and cleaning scenarios
- Tests verify: valid requests pass, missing headers detected, Go client headers fixed
- All tests passing ✓
## Why This Works
1. **TLS Level**: HTTP/2 negotiation via ALPN matches real Claude Code behavior
2. **HTTP Level**: All X-Stainless headers properly injected (language, runtime, OS)
3. **Fallback**: CleanRequest() catches any missed emulation as safety net
4. **Detection**: ValidateNodeEmulation() logs any inconsistencies for debugging
## Files Modified
- internal/pkg/tlsfingerprint/dialer.go: ALPN protocol priority
- internal/repository/http_upstream.go: Enable HTTP/2
- internal/service/gateway_service.go: Integrate validation/cleaning
- internal/pkg/claudemask/mask.go: New validation module (8 functions)
- internal/pkg/claudemask/mask_test.go: New test suite (8 tests)
## Result
Go requests now sent to Claude API are 100% consistent with Node.js clients:
- JA3/JA4 TLS fingerprints match
- HTTP/2 ALPN negotiation correct
- All identification headers present and consistent
- Fallback cleaning ensures no Go client leakage
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Merge strategy: keep local Claude customizations (ours), accept all other upstream changes.
Claude constants.go retains:
- DefaultCLIVersion = 2.1.88
- Enhanced beta headers (9 new betas)
- ModelSupports1M() function
- GetOAuthBetaHeader() function
- GetAPIKeyBetaHeader() function
- ApplyFingerprintOverrides() function
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Restore account_usage_service.go, antigravity_gateway_service.go,
antigravity_credits_overages.go and its test to upstream/main state.
These credits balance precheck changes were accidentally included
during cherry-pick of channel management commits.
- Parse candidatesTokensDetails from Gemini API to separate image/text output tokens
- Add image_output_tokens and image_output_cost to usage_log (migration 089)
- Support per-image-token pricing via output_cost_per_image_token from model pricing data
- Channel pricing ImageOutputPrice override works in token billing mode
- Auto-fill image_output_price in channel pricing form from model defaults
- Add "channel_mapped" billing model source as new default (migration 088)
- Bills by model name after channel mapping, before account mapping
- Fix channel cache error TTL sign error (115s → 5s)
- Fix Update channel only invalidating new groups, not removed groups
- Fix frontend model_mapping clearing sending undefined instead of {}
- Credits balance precheck via shared AccountUsageService cache before injection
- Skip credits injection for accounts with insufficient balance
- Don't mark credits exhausted for "exhausted your capacity on this model" 429s
## Problem
When a proxy is unreachable, token refresh retries up to 4 times with
30s timeout each, causing requests to hang for ~2 minutes before
failing with a generic 502 error. The failed account is not marked,
so subsequent requests keep hitting it.
## Changes
### Proxy connection fast-fail
- Set TCP dial timeout to 5s and TLS handshake timeout to 5s on
antigravity client, so proxy connectivity issues fail within 5s
instead of 30s
- Reduce overall HTTP client timeout from 30s to 10s
- Export `IsConnectionError` for service-layer use
- Detect proxy connection errors in `RefreshToken` and return
immediately with "proxy unavailable" error (no retries)
### Token refresh temp-unschedulable
- Add 8s context timeout for token refresh on request path
- Mark account as temp-unschedulable for 10min when refresh fails
(both background `TokenRefreshService` and request-path
`GetAccessToken`)
- Sync temp-unschedulable state to Redis cache for immediate
scheduler effect
- Inject `TempUnschedCache` into `AntigravityTokenProvider`
### Account failover
- Return `UpstreamFailoverError` on `GetAccessToken` failure in
`Forward`/`ForwardGemini` to trigger handler-level account switch
instead of returning 502 directly
### Proxy probe alignment
- Apply same 5s dial/TLS timeout to shared `httpclient` pool
- Reduce proxy probe timeout from 30s to 10s
Introduce OAuthRefreshAPI as the single entry point for all OAuth token
refresh operations, eliminating the race condition where background
refresh and inline refresh could simultaneously use the same
refresh_token (fixes#1035).
Key changes:
- Add OAuthRefreshExecutor interface extending TokenRefresher with CacheKey
- Add OAuthRefreshAPI.RefreshIfNeeded with lock → DB re-read → double-check flow
- Add ProviderRefreshPolicy / BackgroundRefreshPolicy strategy types
- Simplify all 4 TokenProviders to delegate to OAuthRefreshAPI
- Rewrite TokenRefreshService.refreshWithRetry to use unified API path
- Add MergeCredentials and BuildClaudeAccountCredentials helpers
- Add 40 unit tests covering all new and modified code paths
