spoof User-Agent for Agent Router calls to bypass unauthorized client detection

app/services/ai.py

@@ -76,6 +76,10 @@ async def call_ai(
 
     if settings.ai_api_base:
         kwargs["api_base"] = settings.ai_api_base
+        if "agentrouter.org" in settings.ai_api_base.lower():
+            kwargs["extra_headers"] = {
+                "User-Agent": "claude-code/0.2.9",
+            }
 
     # JSON mode: supported natively by OpenAI and LiteLLM proxied Gemini.
     # For providers that don't support it, LiteLLM silently ignores the flag.

cli/securelens/ai/__init__.py

@@ -53,6 +53,10 @@ async def call_ai(
 
     if api_base:
         kwargs["api_base"] = api_base
+        if "agentrouter.org" in api_base.lower():
+            kwargs["extra_headers"] = {
+                "User-Agent": "claude-code/0.2.9",
+            }
 
     if json_mode:
         kwargs["response_format"] = {"type": "json_object"}

tests/test_cli_api_base.py

@@ -94,3 +94,21 @@ async def test_analyze_file_passes_api_base():
             mock_call_ai_json.assert_called_once()
             called_kwargs = mock_call_ai_json.call_args[1]
             assert called_kwargs["api_base"] == "https://agentrouter.org/v1"
+
+@pytest.mark.asyncio
+async def test_call_ai_injects_agentrouter_headers():
+    with patch("litellm.acompletion", new_callable=AsyncMock) as mock_acompletion:
+        mock_acompletion.return_value.choices = [
+            AsyncMock(message=AsyncMock(content="Mock response"))
+        ]
+        
+        await call_ai(
+            prompt="Hello",
+            api_key="mock_key",
+            model="openai/deepseek-chat",
+            api_base="https://agentrouter.org/v1"
+        )
+        
+        mock_acompletion.assert_called_once()
+        called_kwargs = mock_acompletion.call_args[1]
+        assert called_kwargs["extra_headers"] == {"User-Agent": "claude-code/0.2.9"}