[ericlitman]

Summary

Preserve native Claude requests when T3 identifies its Claude process as t3-code (pingdotgg/t3code#28410). The unknown entrypoint currently triggers CLI cloaking, replacing attribution and changing prompt/cache handling.

 native Claude entrypoints
   cli, sdk-cli, sdk-ts, claude-vscode
+  t3-code (same version/header/metadata checks)

Evidence

• Before: executor regressions show ordinary and scheduled t3-code requests rewritten to claude-cli/2.1.280 (external, cli).
  After: message, streaming and upstream token-count regressions preserve the T3 User-Agent, caller instructions, tools and cache controls. Message/stream requests retain cc_entrypoint=t3-code; count-tokens retains its existing billing-header exclusion.
• Detector coverage includes bare CLI and SDK forms, scheduled markers, Haiku title/search helpers, and rejection when native signals are missing or the version is implausible. Existing unknown-entrypoint coverage remains.
• go test ./... and go build -o test-output ./cmd/server pass. Changed Go files are gofmt clean.

Merge Danger

Door: two-way

Revert the two detector entries; client rollout must be rolled back with it to avoid returning T3 traffic to cloaking.

Blast Radius: Claude

Only t3-code requests satisfying the existing native checks gain pass-through. No payload rules, quota routing, timeouts or token pricing change. Weekly subscription savings have not been measured; this PR establishes attribution compatibility, not a metering fix.

Linear: HOUSE-104

Review scope

Review only this PR's one-commit delta from 148e2d8db9ae7b78df8ce96d8c273c438f688a46 to 5c7a04b0cce66741b1b41f9698064bb97c021658: two production map entries and their regression tests. No upstream synchronization is included. Existing upstream behavior is context for assessing these changes, not a request for a repository-wide audit or unrelated repairs.

[ericlitman]

@unfret review

[unfret]

✅ No blocking findings

Walkthrough

This PR makes the proxy treat Claude requests from T3 Code (entrypoint `t3-code`) as native Claude Code traffic. Before, the proxy did not recognize this entrypoint and rewrote these requests to look like a generic CLI client. That rewrite replaced the User-Agent and billing attribution and changed prompt and cache handling. The production change is two map entries: `t3-code` is added as its own subclient and to the native-entrypoint allowlist, so it still has to pass the existing version, header and metadata checks. The PR adds tests for message, streaming and token-count pass-through, detector identity (including scheduled requests and the Haiku title/search helpers), and rejection when native signals are missing or the version is implausible. The author reports that `go test ./...` and the build pass, and notes that subscription metering savings have not been measured.

Area	What changes
Claude client detection	Adds `t3-code` to the subclient map and to the native-entrypoint allowlist. Requests using it now bypass CLI cloaking when they meet the existing native checks.
Tests	Adds executor tests confirming that `t3-code` execute, stream and count-tokens requests keep their User-Agent, system blocks, tools and messages. Extends the detector tests to cover `t3-code` identity, the helper profiles, and cases where native signals are missing.

Details

Lane / stage	Model	Effort	Outcome	Duration
broad-gpt-5.6-sol-xhigh / review	openai/gpt-5.6-sol → gpt-5.6-sol · primary	xhigh	succeeded	25 s
broad-opus-5.5-max / review	anthropic/claude-opus-5-5 → claude-opus-5-5 · primary	max	succeeded	2 min 24 s
focal-gpt-5.6-sol-xhigh copy / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	9 min 25 s
focal-gpt-5.6-sol-xhigh copy 2 / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	8 min 23 s

First review of this pull request.
4 reviewers finished.
Commit 5c7a04b.
Check run.
Run: GET /unfret/run/panel:5c7a04b0cce66741b1b41f9698064bb97c021658:ThJcSbOxmnz:90ceH0C1WNM.

_{@unfret review · @unfret status · @unfret help}

[unfret]

✅ No blocking findings
Check

[mergify]

✅ Merged into main as a9b5081 at 01:07 UTC

Less than a minute in the queue, with no time running CI.

So far

• ✅ Entered the queue Sun 1 Nov, 01:06 · rule default · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged 01:07 · a9b5081

10 merge conditions met

• github-review-approved · required by GitHub repository ruleset rule Mergify merge protections
• -draft · required by Merge Protections rule Required checks
• -label = hold · required by Merge Protections rule Required checks
• check-success = Analyze (actions) · required by Merge Protections rule Required checks
• check-success = Analyze (go) · required by Merge Protections rule Required checks
• check-success = Analyze (javascript-typescript) · required by Merge Protections rule Required checks
• check-success = e2e-hermetic · required by Merge Protections rule Required checks
• check-success = go · required by Merge Protections rule Required checks
• check-success = @unfret/Unfret · required by Merge Protections rule Unfret on risky paths
• any of · required by GitHub repository ruleset rule Mergify merge protections:
  • check-success = @mergify/Mergify Merge Protections
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections

_{Times in UTC · dashboard · how the merge queue works}