fix(oauth): align codebuddy-cn OAuth User-Agent with chat/usage (#12702)

OAuth device-code auth/poll and token-refresh for codebuddy-cn presented
CLI/2.63.2 CodeBuddy/2.63.2 while chat-completion and usage/quota requests
presented CLI/2.108.1 CodeBuddy/2.108.1 for the same account. A 45-minor-
version-apart client fingerprint across auth vs. chat calls is exactly the
kind of internally-inconsistent signal an anti-abuse WAF flags as anomalous
(Tencent gateway code 11128 'request illegal').

Centralize the version string into CODEBUDDY_CN_USER_AGENT (exported from
src/lib/oauth/constants/oauth.ts) and reference it from the chat registry
entry and the usage handler so all three surfaces can never drift apart
again. Adds a permanent regression test asserting the OAuth, chat and
usage User-Agent headers all match.

changelog.d/fixes/12633-opencode-zen-responses-auth-header.md

@@ -1 +0,0 @@
-- fix(providers): send `x-api-key` instead of `Authorization: Bearer` for OpenCode Zen's `/v1/responses` endpoint (Muse Spark Contributor models), fixing a 401 on OmniRoute's auth header (#12633)

changelog.d/fixes/12681-opencode-muse-spark-context-length.md

@@ -1 +0,0 @@
-- fix(models): declare the real ~1M contextLength for OpenCode Zen's Muse Spark 1.2 models instead of falling back to the 200000 provider default (#12681)

changelog.d/fixes/12702-codebuddy-cn-useragent-consistency.md

@@ -0,0 +1 @@
+- fix(oauth): align codebuddy-cn OAuth User-Agent with the chat/usage CLI version to avoid WAF false positives (#12702)

open-sse/config/providers/registry/codebuddy-cn/index.ts

@@ -1,3 +1,4 @@
+import { CODEBUDDY_CN_USER_AGENT } from "@/lib/oauth/constants/oauth";
 import type { RegistryEntry } from "../../shared.ts";
 
 /**
@@ -20,7 +21,7 @@ export const codebuddy_cnProvider: RegistryEntry = {
   authType: "oauth",
   authHeader: "bearer",
   headers: {
-    "User-Agent": "CLI/2.108.1 CodeBuddy/2.108.1",
+    "User-Agent": CODEBUDDY_CN_USER_AGENT,
     "X-Product": "SaaS",
     "X-IDE-Type": "CLI",
     "X-IDE-Name": "CLI",

open-sse/config/providers/registry/opencode/index.ts

@@ -30,25 +30,17 @@ export const opencodeProvider: RegistryEntry = {
     // content (see issue #10867). The opencode provider is passthrough, so
     // declaring them here only sets the wire format / capability flags — the
     // live upstream model list already advertises both ids.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     {
       id: "muse-spark-1.2-contributor-free",
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     { id: "deepseek-v4-flash-free", name: "DeepSeek V4 Flash Free", supportsReasoning: true },
     // #6998: 2026-07-14 refresh — the upstream free tier rotated its lineup;

open-sse/config/providers/registry/opencode/zen/index.ts

@@ -63,17 +63,11 @@ export const opencode_zenProvider: RegistryEntry = {
     // targetFormat declaration, so requests routed here still hit
     // /chat/completions with a mismatched or unanswerable body and the
     // upstream returns an empty message.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     // Explicit wire-format overlay of the base opencode provider's muse-spark entry
     // (targetFormat: openai-responses). Keep in sync with base on catalog syncs.
@@ -82,8 +76,6 @@ export const opencode_zenProvider: RegistryEntry = {
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
 
     // ── DeepSeek ────────────────────────────────────────────────

open-sse/executors/opencode.ts

@@ -31,13 +31,6 @@ import {
 import { isOpencodeGeoBlocked, proxyKeyOf } from "./opencodeGeoBlock.ts";
 import { isNetworkRotationSharedEgressGuardEnabled } from "@/shared/utils/featureFlags";
 
-/**
- * The main OpenCode Zen host, shared by the `opencode` and `opencode-zen`
- * registry entries. Used to scope the `x-api-key` auth override (#12633) away
- * from `opencode-go`, which serves a different upstream (`.../zen/go/v1`).
- */
-const ZEN_BASE_URL = "https://opencode.ai/zen/v1";
-
 /**
  * Per-account proxy configuration, persisted by NoAuthAccountCard under
  * `providerSpecificData.accountProxies` (keyed by the account id, which the UI
@@ -783,20 +776,6 @@ export class OpencodeExecutor extends BaseExecutor {
     }
   }
 
-  /**
-   * #12633: OpenCode Zen's `/v1/responses` endpoint (reached when
-   * `_requestFormat === "openai-responses"`, e.g. Muse Spark Contributor
-   * models) requires `x-api-key`, not `Authorization: Bearer` — unlike the
-   * default `/chat/completions` endpoint on the same host, which accepts
-   * Bearer. Scoped by baseUrl (not provider id/alias) so this only applies to
-   * the main Zen host (`opencode` / `opencode-zen`, both `https://opencode.ai/zen/v1`)
-   * and never to opencode-go, which serves Responses-format models from a
-   * different upstream (`https://opencode.ai/zen/go/v1`) that expects Bearer.
-   */
-  private usesZenApiKeyAuth(): boolean {
-    return this._requestFormat === "openai-responses" && this.config?.baseUrl === ZEN_BASE_URL;
-  }
-
   buildHeaders(
     credentials: ProviderCredentials | null,
     stream = true,
@@ -813,7 +792,7 @@ export class OpencodeExecutor extends BaseExecutor {
       : undefined;
 
     if (key) {
-      if (this._requestFormat === "claude" || this.usesZenApiKeyAuth()) {
+      if (this._requestFormat === "claude") {
         headers["x-api-key"] = key;
       } else {
         headers["Authorization"] = `Bearer ${key}`;

open-sse/services/usage/codebuddy-cn.ts

@@ -14,6 +14,8 @@
  * packs, "Bonus Pack N" for bonus packs (soonest-expiring first).
  */
 
+import { CODEBUDDY_CN_USER_AGENT } from "@/lib/oauth/constants/oauth";
+
 const USAGE_URL = "https://copilot.tencent.com/v2/billing/meter/get-user-resource";
 
 interface TencentAccount {
@@ -130,7 +132,7 @@ export async function getCodeBuddyCnUsage(
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json",
         Accept: "application/json",
-        "User-Agent": "CLI/2.108.1 CodeBuddy/2.108.1",
+        "User-Agent": CODEBUDDY_CN_USER_AGENT,
         "X-Product": "SaaS",
         "X-IDE-Type": "CLI",
         "X-IDE-Name": "CLI",

src/lib/oauth/constants/oauth.ts

@@ -106,12 +106,21 @@ export const QODER_CONFIG = {
 // CodeBuddy CN (Tencent — copilot.tencent.com) OAuth Configuration
 // (Custom Device-Auth Flow: POST stateUrl → open authUrl → GET pollUrl?state=).
 // No client_id/secret — the upstream CLI ships none.
+//
+// CODEBUDDY_CN_USER_AGENT is the single source of truth for the CLI/CodeBuddy version
+// string. It MUST stay identical across OAuth (this file), chat completions
+// (open-sse/config/providers/registry/codebuddy-cn/index.ts) and usage/quota
+// (open-sse/services/usage/codebuddy-cn.ts) — a mismatched version string across a
+// single account's auth vs. chat calls is exactly the kind of internally-inconsistent
+// client fingerprint Tencent's WAF flags as anomalous (#12702).
+export const CODEBUDDY_CN_USER_AGENT = "CLI/2.108.1 CodeBuddy/2.108.1";
+
 export const CODEBUDDY_CN_CONFIG = {
   baseUrl: "https://copilot.tencent.com",
   stateUrl: "https://copilot.tencent.com/v2/plugin/auth/state",
   tokenUrl: "https://copilot.tencent.com/v2/plugin/auth/token",
   refreshUrl: "https://copilot.tencent.com/v2/plugin/auth/token/refresh",
-  userAgent: "CLI/2.63.2 CodeBuddy/2.63.2",
+  userAgent: CODEBUDDY_CN_USER_AGENT,
   platform: "CLI",
   pollInterval: 5000,
 };

tests/unit/codebuddy-cn-provider.test.ts

@@ -585,3 +585,38 @@ test("codebuddy-cn is treated as a managed dual-auth provider (oauth + apikey ac
     "codebuddy-cn must be admitted by the dual-auth gate"
   );
 });
+
+test("#12702: codebuddy-cn presents the same CLI/CodeBuddy version across OAuth, chat and usage calls", async () => {
+  // A mismatched version string across a single account's auth vs. chat calls is exactly the
+  // kind of internally-inconsistent client fingerprint Tencent's WAF flags as anomalous
+  // (code 11128 "request illegal" / "blocked by security policy"). All three surfaces must
+  // read from the same CODEBUDDY_CN_USER_AGENT constant so they can never drift apart again.
+  const oauthUserAgent = CODEBUDDY_CN_CONFIG.userAgent;
+  const chatUserAgent = REGISTRY["codebuddy-cn"].headers?.["User-Agent"];
+  assert.equal(
+    oauthUserAgent,
+    chatUserAgent,
+    `codebuddy-cn OAuth User-Agent (${oauthUserAgent}) must match the chat User-Agent (${chatUserAgent})`
+  );
+
+  const { CODEBUDDY_CN_USER_AGENT } = await import("../../src/lib/oauth/constants/oauth.ts");
+  assert.equal(oauthUserAgent, CODEBUDDY_CN_USER_AGENT);
+
+  const origFetch = globalThis.fetch;
+  let capturedUserAgent: string | undefined;
+  globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
+    capturedUserAgent = (init?.headers as Record<string, string> | undefined)?.["User-Agent"];
+    return new Response(JSON.stringify({}), { status: 200 });
+  }) as typeof fetch;
+  try {
+    const { getCodeBuddyCnUsage } = await import("../../open-sse/services/usage/codebuddy-cn.ts");
+    await getCodeBuddyCnUsage("ACCESS_TOKEN", undefined, undefined);
+    assert.equal(
+      capturedUserAgent,
+      CODEBUDDY_CN_USER_AGENT,
+      "codebuddy-cn usage/quota User-Agent must match the shared constant"
+    );
+  } finally {
+    globalThis.fetch = origFetch;
+  }
+});

tests/unit/issue-12633-opencode-zen-responses-auth.test.ts

@@ -1,54 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { OpencodeExecutor } from "../../open-sse/executors/opencode.ts";
-
-test("#12633: openai-responses format on opencode-zen sends x-api-key, not Authorization Bearer", () => {
-  const executor = new OpencodeExecutor("opencode-zen");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-zen-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor-free"
-  );
-
-  assert.equal(headers["x-api-key"], "sk-zen-test");
-  assert.equal(headers["Authorization"], undefined);
-});
-
-test("#12633: openai-responses format on the base opencode (oc) provider also sends x-api-key", () => {
-  const executor = new OpencodeExecutor("opencode");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-oc-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor-free"
-  );
-
-  assert.equal(headers["x-api-key"], "sk-oc-test");
-  assert.equal(headers["Authorization"], undefined);
-});
-
-test("#12633: openai-responses format on opencode-go (different upstream endpoint) keeps Authorization Bearer", () => {
-  const executor = new OpencodeExecutor("opencode-go");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-go-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor"
-  );
-
-  assert.equal(headers["Authorization"], "Bearer sk-go-test");
-  assert.equal(headers["x-api-key"], undefined);
-});
-
-test("#12633: claude format keeps sending x-api-key (unchanged behavior)", () => {
-  const executor = new OpencodeExecutor("opencode-zen");
-  executor._requestFormat = "claude";
-  const headers = executor.buildHeaders({ apiKey: "sk-claude-test" }, true, null, "some-model");
-
-  assert.equal(headers["x-api-key"], "sk-claude-test");
-  assert.equal(headers["Authorization"], undefined);
-});

tests/unit/issue-12681-opencode-muse-spark-context.test.ts

@@ -1,33 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
-import { getTokenLimit } from "../../open-sse/services/contextManager.ts";
-
-test("#12681: opencode registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
-  const opencode = REGISTRY["opencode"];
-  const museSpark = opencode.models.find((m) => m.id === "muse-spark-1.2");
-  const museSparkFree = opencode.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
-  assert.notEqual(
-    museSpark?.contextLength,
-    undefined,
-    "muse-spark-1.2 should declare its own real contextLength instead of relying on the 200000 provider default"
-  );
-  assert.notEqual(
-    museSparkFree?.contextLength,
-    undefined,
-    "muse-spark-1.2-contributor-free should declare its own real contextLength instead of relying on the 200000 provider default"
-  );
-});
-
-test("#12681: opencode-zen registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
-  const zen = REGISTRY["opencode-zen"];
-  const museSpark = zen.models.find((m) => m.id === "muse-spark-1.2");
-  const museSparkFree = zen.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
-  assert.notEqual(museSpark?.contextLength, undefined);
-  assert.notEqual(museSparkFree?.contextLength, undefined);
-});
-
-test("#12681: contextManager.getTokenLimit resolves muse-spark-1.2-contributor-free to its real 1M+ window, not the 200000 provider default", () => {
-  assert.equal(getTokenLimit("opencode", "muse-spark-1.2-contributor-free"), 1048576);
-  assert.equal(getTokenLimit("opencode-zen", "muse-spark-1.2-contributor-free"), 1048576);
-});