Fix 403 Forbidden: Add User-Agent header to OpenAI client fetch to prevent WAF/Cloudflare blocks

[ID-VerNe]

Description

When using deepcode-cli with custom/proxy API endpoints (e.g., endpoints routed through Cloudflare or strict enterprise WAFs), requests immediately fail with a 403 Your request was blocked error.

Root Cause

In the initialization of the OpenAI client, the custom fetch implementation using undiciFetch does not provide a default User-Agent.
Many CDNs and WAFs (like Cloudflare) automatically block HTTP requests missing a User-Agent as a basic anti-bot measure.

ypescript // Current implementation fetch: (url, init) => undiciFetch(url, { ...init, dispatcher: keepAliveAgent })

Proposed Solution

Inject a standard or tool-specific User-Agent into the headers before passing them to undiciFetch.

` ypescript
fetch: (url, init) => {
const headers = new Headers(init?.headers);
if (!headers.has("User-Agent")) {
headers.set("User-Agent", "deepcode-cli/0.1.x (Node.js)");
}

// Note: undiciFetch expects a plain object or an array of arrays for headers in some older TS setups,
// so converting Headers back to an object might be necessary depending on the exact undici version used.
const headersObj = Object.fromEntries(headers.entries());

return undiciFetch(url, {
...init,
headers: headersObj,
dispatcher: keepAliveAgent
});
}
`

Steps to Reproduce

1. Set BASE_URL in ~/.deepcode/settings.json to an API endpoint protected by Cloudflare.
2. Run deepcode and send a message.
3. Observe the 403 Your request was blocked error.

[ID-VerNe]

Just to follow up: we locally hot-patched the compiled dist/cli.js and confirmed this exact fix works.

If anyone else is blocked by this before an official patch is released, the workaround was to wrap the undiciFetch call to ensure the User-Agent is injected without destroying existing headers (like the API Key/Token).

The working patch logic we applied to the compiled code looks like this:

javascript fetch: (url, init) => { const ua = "deepcode-cli/0.1.x"; // Or a standard browser UA const h = init.headers; if (h && typeof h.set === "function") { h.set("User-Agent", ua); } else if (h) { h["User-Agent"] = ua; } else { init.headers = { "User-Agent": ua }; } return undiciFetch(url, { ...init, dispatcher: keepAliveAgent }); }

Once this was injected, the 403/401 blocks from Cloudflare disappeared entirely and the CLI worked perfectly with the proxy endpoint.