fix(proxy): preserve User-Agent for gemini providers (fix #515)#520
fix(proxy): preserve User-Agent for gemini providers (fix #515)#520
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 Walkthrough概览在 ProxyForwarder 中引入新的私有静态辅助方法 buildGeminiHeaders，用于集中处理 Gemini 和 Gemini-cli 相关的请求头构建，包括认证、主机、内容类型等头部信息，替代之前分散的头部处理逻辑。 变更清单
预估代码审查工作量🎯 3 (中等) | ⏱️ ~20 分钟 Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
Summary of ChangesHello @ding113, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 此拉取请求旨在解决Gemini代理服务中请求头处理不当的问题，特别是 Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
github-actions
bot
added
bug
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
本次 PR 修复了 Gemini 供应商请求头（特别是 User-Agent）未能正确透传的 Bug，做得很好。通过重构 Gemini 的请求头构建逻辑，统一使用 HeaderProcessor，显著提升了代码的一致性和可维护性。新的实现正确地处理了会话中的请求头透传、过滤器修改以及上游鉴权的覆盖，并通过黑名单机制安全地移除了代理侧的用户凭证，防止了密钥泄露风险。此外，新增的单元测试覆盖了各种场景，包括 API Key 和 OAuth 模式、User-Agent 的回退逻辑等，确保了修复的可靠性。我有一个关于代码明确性的小建议，除此之外，这是一个高质量的修复。
| } | ||
|
|
||
| const headerProcessor = HeaderProcessor.createForProxy({ | ||
| blacklist: ["content-length", "connection", "x-api-key", GEMINI_PROTOCOL.HEADERS.API_KEY], |
There was a problem hiding this comment.
为了提高代码的明确性和可维护性，建议在黑名单中显式添加 authorization。虽然 HeaderProcessor.createForProxy 默认会因 preserveAuthorization: false 而隐式地将其加入黑名单，但显式声明可以使意图更加清晰，并减少对 HeaderProcessor 内部实现的依赖。这也与 PR 描述中提到的“显式黑名单移除 proxy 侧认证头（authorization/x-api-key/x-goog-api-key）”保持一致。
| blacklist: ["content-length", "connection", "x-api-key", GEMINI_PROTOCOL.HEADERS.API_KEY], | |
| blacklist: ["content-length", "connection", "authorization", "x-api-key", GEMINI_PROTOCOL.HEADERS.API_KEY], |
🧪 测试结果
总体结果: ✅ 所有测试通过 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
src/app/v1/_lib/proxy/forwarder.ts (1)
1815-1815: 可选优化：User-Agent 解析逻辑与 Codex 分支略有不同。当前 Gemini 实现使用简单的 nullish coalescing：
session.headers.get("user-agent") ?? session.userAgent ?? "claude-code-hub"而 Codex 分支（第 1721-1738 行）使用
isHeaderModified检测来决定是否使用过滤后的值。两种实现在实际场景中结果相同，但如果未来需要统一行为，可以考虑提取为共享辅助函数。
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to Reviews > Disable Cache setting
📒 Files selected for processing (2)
src/app/v1/_lib/proxy/forwarder.tstests/unit/proxy/proxy-forwarder.test.ts
🧰 Additional context used
📓 Path-based instructions (10)
**/*.{ts,tsx,js,jsx,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Use 2-space indentation in all code files
Files:
tests/unit/proxy/proxy-forwarder.test.tssrc/app/v1/_lib/proxy/forwarder.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx,js,jsx}: Use double quotes for strings instead of single quotes
Use trailing commas in multi-line structures
Enforce maximum line length of 100 characters
Use path alias@/*to reference files from./src/*directory
**/*.{ts,tsx,js,jsx}: Use Biome for linting and formatting with 2-space indent, double quotes, trailing commas, and 100 character max line length
Use path alias@/*to reference files in./src/*directory
Files:
tests/unit/proxy/proxy-forwarder.test.tssrc/app/v1/_lib/proxy/forwarder.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use TypeScript strict mode for type safety
Use readonly or const assertions for immutable data structures
Files:
tests/unit/proxy/proxy-forwarder.test.tssrc/app/v1/_lib/proxy/forwarder.ts
**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest for unit testing with Node environment, coverage thresholds: 50% lines/functions, 40% branches
Files:
tests/unit/proxy/proxy-forwarder.test.ts
**/*.test.ts
📄 CodeRabbit inference engine (AGENTS.md)
Ensure test database names contain 'test' keyword for safety validation
Files:
tests/unit/proxy/proxy-forwarder.test.ts
src/app/v1/_lib/**/*.ts
📄 CodeRabbit inference engine (CLAUDE.md)
Guard pipeline must execute in order: ProxyAuthenticator, SensitiveWordGuard, VersionGuard, ProxySessionGuard, ProxyRateLimitGuard, ProxyProviderResolver
Files:
src/app/v1/_lib/proxy/forwarder.ts
src/app/v1/_lib/proxy/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
src/app/v1/_lib/proxy/**/*.ts: Implement guard pipeline pattern for cross-cutting concerns in request processing (auth, rate limiting, session)
Use undici library for HTTP requests instead of node-fetch for better performance
Files:
src/app/v1/_lib/proxy/forwarder.ts
src/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
src/**/*.ts: Hash API keys using SHA-256 before storing in database, never store plaintext keys
Mask API keys and sensitive data in application logs
Validate required environment variables at startup with clear error messages
Files:
src/app/v1/_lib/proxy/forwarder.ts
src/app/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
Implement Content-Security-Policy headers for XSS prevention
Files:
src/app/v1/_lib/proxy/forwarder.ts
src/app/v1/**/*.ts
📄 CodeRabbit inference engine (AGENTS.md)
Use Hono router for ultrafast, lightweight routing in proxy endpoints
Files:
src/app/v1/_lib/proxy/forwarder.ts
🧠 Learnings (6)
📚 Learning: 2026-01-03T09:08:20.573Z
Learnt from: CR
Repo: ding113/claude-code-hub PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-03T09:08:20.573Z
Learning: Applies to src/app/v1/_lib/proxy-handler.ts : Structure request flow in proxy handler through: ProxySession.fromContext() -> detectFormat() -> GuardPipelineBuilder.run() -> ProxyForwarder.send() -> ProxyResponseHandler.dispatch()
Applied to files:
tests/unit/proxy/proxy-forwarder.test.tssrc/app/v1/_lib/proxy/forwarder.ts
📚 Learning: 2026-01-03T09:10:02.182Z
Learnt from: NieiR
Repo: ding113/claude-code-hub PR: 517
File: src/app/v1/_lib/proxy/auth-guard.ts:205-232
Timestamp: 2026-01-03T09:10:02.182Z
Learning: In `src/app/v1/_lib/proxy/auth-guard.ts`, the `extractApiKeyFromHeaders` function is intentionally a standalone simplified version for non-Guard flows. It deliberately does not check for multi-source conflicts (unlike `ProxyAuthenticator.validate`), and the code duplication is intentional to avoid coupling between Guard and non-Guard authentication flows.
Applied to files:
tests/unit/proxy/proxy-forwarder.test.tssrc/app/v1/_lib/proxy/forwarder.ts
📚 Learning: 2026-01-03T09:08:49.019Z
Learnt from: CR
Repo: ding113/claude-code-hub PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-03T09:08:49.019Z
Learning: Applies to src/app/v1/_lib/proxy/**/*.ts : Implement guard pipeline pattern for cross-cutting concerns in request processing (auth, rate limiting, session)
Applied to files:
src/app/v1/_lib/proxy/forwarder.ts
📚 Learning: 2026-01-03T09:08:49.019Z
Learnt from: CR
Repo: ding113/claude-code-hub PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-03T09:08:49.019Z
Learning: Applies to src/app/v1/_lib/proxy/**/*.ts : Use undici library for HTTP requests instead of node-fetch for better performance
Applied to files:
src/app/v1/_lib/proxy/forwarder.ts
📚 Learning: 2026-01-03T09:08:20.573Z
Learnt from: CR
Repo: ding113/claude-code-hub PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-03T09:08:20.573Z
Learning: Applies to src/app/v1/_lib/**/*.ts : Guard pipeline must execute in order: ProxyAuthenticator, SensitiveWordGuard, VersionGuard, ProxySessionGuard, ProxyRateLimitGuard, ProxyProviderResolver
Applied to files:
src/app/v1/_lib/proxy/forwarder.ts
📚 Learning: 2026-01-03T09:08:49.019Z
Learnt from: CR
Repo: ding113/claude-code-hub PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-03T09:08:49.019Z
Learning: Applies to src/app/v1/_lib/proxy/*handler*.ts : Stream responses with proper backpressure handling and chunked transfer encoding
Applied to files:
src/app/v1/_lib/proxy/forwarder.ts
🧬 Code graph analysis (1)
src/app/v1/_lib/proxy/forwarder.ts (4)
src/app/v1/_lib/gemini/auth.ts (1)
isApiKey(79-82)src/app/v1/_lib/proxy/session.ts (1)
ProxySession(48-671)src/app/v1/_lib/headers.ts (1)
HeaderProcessor(20-143)src/app/v1/_lib/gemini/protocol.ts (1)
GEMINI_PROTOCOL(1-20)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Greptile Review
- GitHub Check: 🌐 API Tests
- GitHub Check: Docker Build Test
- GitHub Check: pr-description
- GitHub Check: pr-label
- GitHub Check: pr-review
- GitHub Check: check-codex-status
- GitHub Check: dev-build-deploy
🔇 Additional comments (6)
tests/unit/proxy/proxy-forwarder.test.ts (4)
62-69: LGTM！测试辅助函数结构清晰。
createGeminiProvider辅助函数与现有的createCodexProvider模式一致，正确地支持"gemini"和"gemini-cli"两种类型。
160-197: LGTM！API key 模式测试覆盖全面。测试正确验证了关键的安全行为：
- 代理侧认证头（
x-api-key、authorization、x-goog-api-key）被移除，防止泄露- 上游
x-goog-api-key使用正确的上游密钥user-agent被正确透传
199-253: LGTM！User-Agent 过滤和回退逻辑测试完整。两个测试用例正确覆盖了：
- 过滤器修改 user-agent 的场景（应使用过滤后的值）
- 过滤器删除 user-agent 的场景（应回退到原始
userAgent）
255-311: LGTM！OAuth 模式和 gemini-cli 测试覆盖到位。
- OAuth 模式测试验证了
Authorization: Bearer正确设置且x-goog-api-key被移除- gemini-cli 测试验证了
x-goog-api-client: GeminiCLI/1.0头的注入这些测试与 Issue #515 的修复目标一致，确保请求不会被 CF 拦截。
src/app/v1/_lib/proxy/forwarder.ts (2)
859-868: LGTM！Gemini 分支现在使用统一的头部处理逻辑。将 Gemini 头部构建委托给
buildGeminiHeaders方法，解决了之前使用new Headers()导致User-Agent丢失和过滤器失效的问题。注释清晰说明了改动原因。
1801-1844: 头部处理逻辑正确，安全性得到保障。实现正确处理了以下关键点：
认证头安全：通过黑名单移除客户端的
x-api-key和x-goog-api-key，authorization由createForProxy默认设置preserveAuthorization: false自动加入黑名单，然后通过 overrides 设置上游认证。User-Agent 解析链：
session.headers.get("user-agent") ?? session.userAgent ?? "claude-code-hub"正确实现了优先级顺序。gemini-cli 特殊处理：正确注入
x-goog-api-client头。
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review Summary
No significant issues identified in this PR.
PR Size: M
- Lines changed: 239
- Files changed: 2
Review Coverage
- Logic and correctness - Clean
- Security (OWASP Top 10) - Clean
- Error handling - Clean
- Type safety - Clean
- Documentation accuracy - Clean
- Test coverage - Adequate
- Code clarity - Good
Automated review by Codex AI
github-project-automation
bot
moved this from Backlog
to Done
in Claude Code Hub Roadmap
There was a problem hiding this comment.
Code Review Summary
This PR successfully fixes the User-Agent header loss issue in Gemini provider forwarding by implementing header passthrough similar to the Codex provider approach. The implementation is clean, well-tested, and follows established patterns in the codebase.
PR Size: M
- Lines changed: 239 (218 additions, 21 deletions)
- Files changed: 2
Issues Found
| Category | Critical | High | Medium | Low |
|---|---|---|---|---|
| Logic/Bugs | 0 | 0 | 0 | 0 |
| Security | 0 | 0 | 0 | 0 |
| Error Handling | 0 | 0 | 0 | 0 |
| Types | 0 | 0 | 0 | 0 |
| Comments/Docs | 0 | 0 | 0 | 0 |
| Tests | 0 | 0 | 0 | 0 |
| Simplification | 0 | 0 | 0 | 0 |
Code Quality Assessment
Strengths:
- ✅ Comprehensive test coverage (5 new test cases covering all scenarios)
- ✅ Proper security: Proxy authentication headers correctly blacklisted
- ✅ Consistent with existing codebase patterns (follows Codex provider approach)
- ✅ Error handling properly delegated to existing retry/circuit breaker logic
- ✅ Type-safe implementation with no
anyusage - ✅ All automated checks pass (tests, typecheck, lint, build)
Implementation Details Verified:
- User-Agent resolution uses 3-tier fallback: filter-modified → original → default
- Authorization headers properly sanitized (proxy credentials removed, upstream credentials added)
- Header passthrough via
HeaderProcessorwith appropriate blacklist - OAuth vs API key authentication modes both handled correctly
- Gemini-CLI specific headers (
x-goog-api-client) properly injected
Architecture Alignment:
This PR completes the header passthrough standardization across all provider types:
- Claude/OpenAI: Uses
buildHeaders()withHeaderProcessor - Codex: Uses
buildHeaders()with modification tracking (#465) - Gemini: Now uses
buildGeminiHeaders()with sameHeaderProcessorpattern ✓
Review Coverage
- Logic and correctness - Clean
- Security (OWASP Top 10) - Clean
- Error handling - Clean
- Type safety - Clean
- Documentation accuracy - Clean
- Test coverage - Comprehensive
- Code clarity - Good
Recommendation: Approve and merge ✅
Automated review by Claude AI
1 participant
Summary
Fixes User-Agent header loss in Gemini provider forwarding, which caused Cloudflare to block requests. This PR implements header passthrough for Gemini providers similar to the approach used in PR #465 for Codex.
修复 Gemini 供应商转发时 User-Agent 请求头丢失的问题，该问题导致 Cloudflare 拦截请求。此 PR 为 Gemini 供应商实现了类似 PR #465 中 Codex 的请求头透传机制。
Problem
Related Issues:
Root Cause:
In the Gemini/Gemini-CLI forwarding branch, the code used
new Headers()to rebuild request headers from scratch, which caused:Gemini/Gemini-CLI 转发分支使用
new Headers()重建请求头，导致：Solution
Changed Gemini branch to use header passthrough based on
session.headerswith unified filtering/override viaHeaderProcessor:buildGeminiHeaders()method: Centralized header processing for Gemini providerssession.headers(includes filter modifications)authorization,x-api-key,x-goog-api-key) to prevent leaking proxy user keys to upstreamsession.headers["user-agent"]session.userAgent"claude-code-hub"x-goog-api-key(API key mode) orAuthorization: Bearer(OAuth mode) for upstream修改 Gemini 分支改为基于
session.headers进行透传，使用HeaderProcessor统一过滤/覆盖：buildGeminiHeaders()方法统一处理 Gemini 供应商请求头session.headers（包含过滤器修改）Changes
Core Changes (src/app/v1/_lib/proxy/forwarder.ts)
new Headers()logic in Gemini forwarding branch (lines 851-872)buildGeminiHeaders()private method (+51 lines):HeaderProcessorpreserveClientIp(X-Forwarded-For, X-Real-IP)x-goog-api-client)Test Coverage (tests/unit/proxy/proxy-forwarder.test.ts)
Added 5 comprehensive test cases for
buildGeminiHeaders()(+163 lines):userAgentwhen filter deletes user-agentAuthorization: Bearerand removesx-goog-api-keyx-goog-api-clientheaderBreaking Changes
None. This is a bug fix that aligns Gemini provider behavior with other provider types.
Testing
Automated Tests
Manual Testing Needed
To verify the fix for #515:
user-agentArchitecture Note
This PR applies the same header modification tracking pattern introduced in #465 (for Codex) to Gemini providers, ensuring consistent header handling across all provider types:
buildHeaders()with modification tracking (fix(request-filter): track header modifications for proper display in session details (#457) #465)buildHeaders()withHeaderProcessorbuildGeminiHeaders()with sameHeaderProcessorpattern ✨Checklist
🤖 Description enhanced by Claude AI