fix: 调整为不同API提供商添加特定User-Agent，避免统一使用claude-cli/2.0.33

[Silentely]

Summary / 摘要

Add provider-specific User-Agent headers for API testing to avoid Cloudflare Bot detection and improve test success rates.

为 API 测试添加渠道特定的 User-Agent 头，避免被 Cloudflare Bot 检测系统拦截，提高 API 测试成功率。

Problem / 问题

The previous implementation used a hardcoded generic User-Agent (claude-cli/2.0.33) for all provider API tests. This approach:

• Triggered Cloudflare Bot detection for non-Anthropic providers
• Caused API tests to fail with 520 errors
• Did not accurately represent the actual client behavior

Solution / 解决方案

Added a userAgent parameter to the executeProviderApiTest interface and configured provider-specific User-Agent headers:

Provider	User-Agent
Anthropic Messages API	claude-cli/2.0.50 (external, cli)
OpenAI Chat Completions API	OpenAI/NodeJS/3.2.1
OpenAI Responses API (Codex)	codex_cli_rs/0.63.0
Gemini API	GeminiCLI/v0.17.1

Changes / 变更

• Added userAgent field to the test options interface in executeProviderApiTest
• Updated Anthropic Messages API test with Claude CLI User-Agent
• Updated OpenAI Chat Completions API test with OpenAI SDK User-Agent
• Updated OpenAI Responses API test with Codex CLI User-Agent
• Updated Gemini API test with Gemini CLI User-Agent
• Removed hardcoded generic User-Agent from the request building logic

Files Changed / 文件变更

• src/actions/providers.ts - Core changes to provider API testing

Testing / 测试

• Manual testing performed
• No breaking changes
• Existing API test functionality preserved

[gemini-code-assist]

Summary of Changes

Hello @Silentely, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

此拉取请求旨在通过为不同的API提供商配置特定的User-Agent字符串来提高API测试的可靠性。这一更改解决了因通用User-Agent被Cloudflare等服务识别为机器人而导致API请求失败的问题，确保了API测试能够更准确地反映实际的服务可用性。

Highlights

• 新增User-Agent参数: 在executeProviderApiTest接口中新增了userAgent参数，允许为不同的API提供商配置特定的User-Agent字符串。
• 更新Anthropic Messages API: Anthropic Messages API现在使用claude-cli/2.0.50 (external, cli)作为其User-Agent。
• 更新OpenAI Chat Completions API: OpenAI Chat Completions API现在使用OpenAI/NodeJS/3.2.1作为其User-Agent。
• 更新OpenAI Responses API: OpenAI Responses API现在使用codex_cli_rs/0.63.0作为其User-Agent。
• 更新Gemini API: Gemini API现在使用GeminiCLI/v0.17.1作为其User-Agent。
• 避免Cloudflare检测: 通过为各渠道提供商设置特定的User-Agent，旨在避免被Cloudflare的机器人检测系统拦截，从而提高API测试的成功率。

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

本次 PR 的目标是为不同的 API 提供商添加特定的 User-Agent，以避免被 Cloudflare 等服务拦截。整体实现思路清晰，通过为 executeProviderApiTest 函数添加 userAgent 参数，并将硬编码的通用 User-Agent 替换为各个 API 测试函数中传入的特定值，成功地实现了目标。

代码改动是有效的，但在多个地方引入了相同的语法错误：在对象字面量中，新添加的 userAgent 属性后面缺少了逗号，这将导致代码无法编译。我已在所有出现此问题的地方提出了修复建议。

此外，我还发现 testProviderOpenAIResponses 中使用的 User-Agent 字符串过于具体，包含了特定于 macOS 的平台信息，这可能会降低代码的可移植性。我也一并提出了修改建议。

请修正这些问题以确保代码的正确性和健壮性。

[ding113]

🔒 Security Scan Results

✅ No security vulnerabilities detected

This PR has been scanned against OWASP Top 10, CWE Top 25, and common security anti-patterns. No security issues were identified in the code changes.

Summary of Changes Reviewed

File	Changes
src/actions/providers.ts	Added userAgent parameter to internal options interface; replaced single hardcoded User-Agent with provider-specific hardcoded strings

Security Analysis

Change Type: Refactoring of User-Agent header configuration

Risk Assessment: ✅ None

The changes in this PR:

1. Add a userAgent field to an internal options interface (not exposed to users)
2. Replace one hardcoded string with multiple hardcoded strings based on provider type
3. All User-Agent values are static strings defined at compile time:
   • claude-cli/2.0.50 (external, cli) for Anthropic
   • OpenAI/NodeJS/3.2.1 for OpenAI Chat
   • codex_cli_rs/0.63.0 for OpenAI Responses
   • GeminiCLI/v0.17.1 (platform; arch) for Gemini

Key Security Finding: The userAgent parameter is NOT user-controllable. The ProviderApiTestArgs type (the user-facing interface) does not include userAgent - it only contains providerUrl, apiKey, model, proxyUrl, and proxyFallbackToDirect. The User-Agent is exclusively set through hardcoded values in the internal options object at each call site.

Scanned Categories

• ✅ Injection attacks (SQL, NoSQL, Command, Header, etc.)
• ✅ Authentication and session management
• ✅ Sensitive data exposure
• ✅ Access control and authorization
• ✅ Security misconfiguration
• ✅ Cross-site scripting (XSS)
• ✅ Insecure deserialization
• ✅ SSRF and path traversal
• ✅ Cryptographic weaknesses
• ✅ HTTP Header injection

🛡️ Security Posture

Strong - This is a low-risk refactoring change with no security implications. The change improves code organization without introducing any new attack vectors.

---

🤖 Automated security scan by Claude AI - OWASP Top 10 & CWE coverage

[ding113]

📋 Code Review Summary

This PR introduces provider-specific User-Agent headers for API testing, replacing a hardcoded generic User-Agent. The implementation is clean, well-structured, and correctly adds the userAgent field to the options interface while updating all 4 provider test functions.

🔍 Issues Found

• Critical (🔴): 0 issues
• High (🟠): 0 issues
• Medium (🟡): 0 issues
• Low (🟢): 0 issues

🎯 Priority Actions

No significant issues identified that require changes before merge.

💡 General Observations

• The userAgent field is properly added as a required field in the interface, ensuring type safety
• All 4 callers of executeProviderApiTest correctly provide the new userAgent parameter
• The User-Agent strings appear to be realistic values mimicking actual CLI tools
• Minor note: The Gemini User-Agent "GeminiCLI/v0.17.1 (platform; arch)" contains a literal (platform; arch) string rather than actual platform/architecture values, but this is a cosmetic detail that doesn't affect functionality

---

🤖 Automated review by Claude AI - focused on identifying issues for improvement

[ding113]

📋 Code Review Summary

This PR introduces provider-specific User-Agent headers for API testing, replacing a hardcoded generic User-Agent. The implementation is clean, well-structured, and correctly adds the userAgent field to the options interface while updating all 4 provider test functions.

🔍 Issues Found

• Critical (🔴): 0 issues
• High (🟠): 0 issues
• Medium (🟡): 0 issues
• Low (🟢): 0 issues

🎯 Priority Actions

No significant issues identified that require changes before merge.

💡 General Observations

• The userAgent field is properly added as a required field in the interface, ensuring type safety
• All 4 callers of executeProviderApiTest correctly provide the new userAgent parameter
• The User-Agent strings appear to be realistic values mimicking actual CLI tools
• Minor note: The Gemini User-Agent "GeminiCLI/v0.17.1 (platform; arch)" contains a literal (platform; arch) string rather than actual platform/architecture values, but this is a cosmetic detail that doesn't affect functionality

---

🤖 Automated review by Claude AI - focused on identifying issues for improvement