Route Databricks-hosted models to gateway auth in relayed sessions (hybrid OSS + relayed)

[masonc08]

What

Lets a relayed (subscription-relay) Claude Code session also reach Databricks-hosted (system.ai / OSS) models in the same session. The loopback proxy now routes per request by the requested model.

A relayed session authenticates with the caller's subscription OAuth in Authorization; Databricks-hosted models authenticate with a Databricks token in Authorization. Claude Code sends only one Authorization per session, so today a session is one or the other. This makes a single session serve both.

How

All modes already hit the same upstream ({workspace}/ai-gateway/anthropic/); they differ only in auth + the provider-service header. So the proxy can multiplex per request:

• Databricks-hosted model (namespace-qualified id — system.ai.*, catalog.schema.model, databricks-*) → gateway auth: the Databricks token goes in Authorization, and the swap + Databricks-Model-Provider-Service headers are dropped so the gateway serves the model directly. Byte-identical to the normal non-relayed path.
• Relayed subscription model (bare Anthropic id — claude-opus-4-1, …) → today's behavior: OAuth passed through untouched, Databricks token injected as the X-Databricks-AI-Gateway-Token swap header.

Gated by start_proxy(hybrid_oss_routing=...), enabled only for the relayed launch. A pure-relay session only sends bare Anthropic ids, so its behavior is unchanged (the classifier relays anything without a dot). Users surface Databricks-hosted models through Claude Code's existing modelPicker / --model; the proxy makes those selections route correctly.

Testing

Automated (hermetic, test_gateway_proxy.py):

• TestHybridOssRouting drives the handler end to end and asserts the forwarded headers per model: a Databricks-hosted id gets the gateway token in Authorization with the swap + provider-service headers dropped; a bare Anthropic id keeps the OAuth passthrough + swap header; with routing off, even a qualified id relays (pure-relay sessions unchanged).
• is_databricks_routed_model (qualified vs bare vs missing id), _request_model (body parsing), and the forwarded_request_headers header shapes. Full hermetic suite green.

Live backend validation: confirmed against a staging workspace that the gateway serves both a Databricks-hosted Claude model and an OSS model when a Messages request carries a Databricks bearer in Authorization and no provider-service header — the exact request shape the proxy's Databricks route emits. So both halves are covered: the per-model header logic by the unit tests, and the gateway serving those requests by the live check. The proxy's route diagnostic (UCODE_RELAYED_PROXY_DIAGNOSTICS=1) distinguishes relay vs databricks per request.