Route Databricks-hosted models to gateway auth in relayed sessions (hybrid OSS + relayed) - #565
Open
masonc08 wants to merge 5 commits into
Open
Route Databricks-hosted models to gateway auth in relayed sessions (hybrid OSS + relayed)#565masonc08 wants to merge 5 commits into
masonc08 wants to merge 5 commits into
Conversation
…ions Lets a relayed (subscription-relay) Claude Code session also reach Databricks-hosted OSS / system.ai models. The loopback proxy now inspects each request's `model`: a namespace-qualified Databricks id is re-routed to gateway auth (Databricks token in `Authorization`, MPS + swap headers dropped), while a bare Anthropic subscription id keeps today's OAuth-passthrough relay. So one session can switch between the relayed Enterprise subscription and Databricks models via `/model`. Gated by start_proxy(hybrid_oss_routing=...), on only for the relayed launch; a pure-relay session sends only bare Anthropic ids, so behavior is unchanged. Users surface Databricks models through Claude Code's existing modelPicker / --model. Toward AIGTWY-4490. Co-authored-by: Isaac <no-reply@databricks.com>
Co-authored-by: Isaac <no-reply@databricks.com>
masonc08
force-pushed
the
masonc08/hybrid-oss-relayed-routing
branch
from
September 11, 2026 14:15
6be9d4d to
33f2209
Compare
masonc08
marked this pull request as ready for review
September 11, 2026 16:12
Co-authored-by: Isaac <no-reply@databricks.com>
Runs the relayed proxy with relayed_oss_routing on and, after the subscription relay check, POSTs a namespace-qualified Databricks-hosted model (a discovered OSS id when offered, else a system.ai one) through the same proxy — asserting it serves (200). Proves one relayed session reaches both the subscription and Databricks models. Skips gracefully when the workspace advertises no such model. Co-authored-by: Isaac <no-reply@databricks.com>
masonc08
enabled auto-merge (squash)
September 11, 2026 19:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Lets a relayed (subscription-relay) Claude Code session also reach Databricks-hosted (
system.ai/ OSS) models in the same session. The loopback proxy now routes per request by the requested model.A relayed session authenticates with the caller's subscription OAuth in
Authorization; Databricks-hosted models authenticate with a Databricks token inAuthorization. Claude Code sends only oneAuthorizationper session, so today a session is one or the other. This makes a single session serve both.How
All modes already hit the same upstream (
{workspace}/ai-gateway/anthropic/); they differ only in auth + the provider-service header. So the proxy can multiplex per request:system.ai.*,catalog.schema.model,databricks-*) → gateway auth: the Databricks token goes inAuthorization, and the swap +Databricks-Model-Provider-Serviceheaders are dropped so the gateway serves the model directly. Byte-identical to the normal non-relayed path.claude-opus-4-1, …) → today's behavior: OAuth passed through untouched, Databricks token injected as theX-Databricks-AI-Gateway-Tokenswap header.Gated by
start_proxy(hybrid_oss_routing=...), enabled only for the relayed launch. A pure-relay session only sends bare Anthropic ids, so its behavior is unchanged (the classifier relays anything without a dot). Users surface Databricks-hosted models through Claude Code's existingmodelPicker/--model; the proxy makes those selections route correctly.Testing
Automated (hermetic,
test_gateway_proxy.py):TestHybridOssRoutingdrives the handler end to end and asserts the forwarded headers per model: a Databricks-hosted id gets the gateway token inAuthorizationwith the swap + provider-service headers dropped; a bare Anthropic id keeps the OAuth passthrough + swap header; with routing off, even a qualified id relays (pure-relay sessions unchanged).is_databricks_routed_model(qualified vs bare vs missing id),_request_model(body parsing), and theforwarded_request_headersheader shapes. Full hermetic suite green.Live backend validation: confirmed against a staging workspace that the gateway serves both a Databricks-hosted Claude model and an OSS model when a Messages request carries a Databricks bearer in
Authorizationand no provider-service header — the exact request shape the proxy's Databricks route emits. So both halves are covered: the per-model header logic by the unit tests, and the gateway serving those requests by the live check. The proxy'sroutediagnostic (UCODE_RELAYED_PROXY_DIAGNOSTICS=1) distinguishesrelayvsdatabricksper request.