feat: transparent image fallback to Anthropic for non-Anthropic backends

[BenSheridanEdwards]

DeepSeek's anthropic-compat endpoint returns 400 on image content blocks; OpenRouter and Fireworks reject or silently drop the pixels. Translating images to text up front loses the detail vision is for.

This PR detects an image in the latest message of the outbound request body and reroutes that single request to api.anthropic.com. The model name is swapped on the wire — backend name (deepseek-v4-pro) → canonical Claude name (claude-opus-4-7) outbound, reversed on the response — so Anthropic recognises the model and Claude Code keeps showing the configured backend in its TUI throughout. Once the image is no longer in the latest message, subsequent text turns route back to the configured backend and stale images in conversation history are stripped, so the cost savings hold for follow-ups.

launch_claude now starts the proxy in path so the default deepclaude flow benefits — previously only --remote did. Image-rerouted turns bucket under a new anthropic_max cost key with cost: 0 (Max consumes subscription quota, not per-token).

Disable with DEEPCLAUDE_IMAGE_FALLBACK=off.

Demo

The session shows: TUI banner reads deepseek-v4-pro[1m] · Claude Max; "what model is this?" answers deepseek-v4-pro (text turn → DeepSeek); a screenshot describes accurately (image turn → Anthropic, swapped on the wire); a follow-up referencing the image still self-identifies as deepseek-v4-pro (response-side swap-back, and follow-up has routed back to DeepSeek with stripped history).

Design notes

The proxy doesn't touch the client auth header on image-reroute. Whatever Claude Code is already carrying — OAuth bearer from claude login, an explicit ANTHROPIC_AUTH_TOKEN, etc. — is what authenticates at Anthropic. Other turns continue to the configured backend with the backend's own key, which the proxy holds privately (passed via argv to start-proxy.js). The two credentials never cross.

Why the on-the-wire swap, not env-var canonical names. A simpler approach would be to set ANTHROPIC_DEFAULT_*_MODEL to canonical Claude names and let the proxy do the forward remap to backend names. That works, but it makes the TUI lie permanently — Claude Code reads those env vars and renders "Opus 4.7" in the welcome banner regardless of where requests actually go. The on-the-wire swap keeps the env vars as backend names so the TUI stays truthful for the dominant case (text turns to DeepSeek), and only the image-reroute moment uses Claude names — invisibly.

Why two swaps, not one. Outbound only would leave Claude Code seeing claude-opus-4-7 in the response payload, mismatched against the deepseek-v4-pro it sent. The inbound swap on message.model (in SSE message_start events and non-streaming JSON bodies) closes the loop so Claude Code's view is consistent end-to-end.

Stripping stale images is product-critical, not an optimization. Without it, attaching one image would silently pin every subsequent turn in the conversation to Anthropic Max — the TUI keeps advertising the cheap backend while the user's Max quota bleeds out. That defeats the cost-savings premise of the product. So:

• forceAnthropicForImage only fires when an image is in the latest message (a fresh attachment, or a Read tool_result that just returned).
• On any non-Anthropic route, the proxy walks parsed.messages and replaces every image content block (including those nested inside tool_result.content[]) with the text placeholder [image omitted]. Each strip is logged.
• Text follow-ups go back to the backend and work from the assistant's prior textual description of the image.

The trade-off: a question that genuinely needs to look at the pixels again ("what color is the third building from the left?") won't have visual access to the image after the strip. The conversation can Read the file again, which produces a fresh image in the latest message and routes that single turn to Anthropic.

Detection walks tool_result.content[] recursively. Claude Code's Read tool wraps a returned PNG inside a tool_result rather than at the top of the message. A naive top-level check would miss the most common case.

MODEL_REMAP reverses last-write-wins. claude-opus-4-6 and claude-opus-4-7 both forward-map to deepseek-v4-pro, so the reverse picks claude-opus-4-7 (the most recent key). When Anthropic ships an Opus bump, updating MODEL_REMAP automatically updates the reverse — no separate maintenance.

Drops thinking and context_management on image-reroute. Anthropic 400s with clear_thinking_* strategies if thinking isn't enabled; foreign backends emit signed-but-invalid thinking blocks that don't survive crossing into Anthropic's signing domain.

Test plan

• Plain text turn: routes to DeepSeek, TUI shows deepseek-v4-pro, response correct.
• Image turn (Claude Code Read tool on a PNG): proxy log shows [image→anthropic, deepseek-v4-pro→claude-opus-4-7], response describes the image accurately, TUI still shows deepseek-v4-pro.
• Follow-up text turn after an image: stale images stripped (logged in proxy), routes back to DeepSeek, response continues coherently from the assistant's prior description.
• /_proxy/cost: deepseek bucket grows on text turns; anthropic_max bucket grows only on image turns themselves, not on subsequent text follow-ups.

Closes #12. Supersedes #19.