What
The internal billing/attribution header sent with first-party API requests now includes a cc_turn_origin value (a lowercase string matching /^[a-z][a-z_]{0,31}$/), alongside the existing cc_version, cc_entrypoint, cc_workload, cc_is_subagent, cc_prev_req, and cc_prompt_id fields. It's only included when the account is a first-party account and a valid origin string is present.
The regex Claude Code uses to strip sensitive query/cookie fields from logs, which already covered cc_prev_req, cc_prompt_id, and cc_workload, now also scrubs cc_turn_origin.
Why
This lets Claude Code track where a turn originated for billing/attribution purposes while making sure that new field is treated the same as other sensitive request identifiers and kept out of logs.