[caigee-cmd]

Summary

Client fingerprint + version alignment for Qoder and WorkBuddy. Kept separate from feat/upstream-align; edits in shared files (qauth.go, credential.go) are minimal (constant/header lines only). New logic lives in qauth/fingerprint.go.

Qoder (ref qoder2api-hub fe62bf6, 513254d, 76716dc)

• One version constant qauth.CosyVersion (1.1.32). qoder.COSYVersion, the OpenAPI UA version, the bearer payload cosyVersion and both cosy-version headers now use it. The stale 0.1.43 is gone.
• Removed hardcoded Go-http-client/2.0. UA comes from qauth.UserAgent(region): QoderWork/<v> for CN, Qoder/<v> for international. The edition is inferred from the request host (*.qoder.sh = international).
• Inference SSE requests (the direct chat Session.Sign path, plus qauth.OpenStreamLines) now send cosy-machineos: x86_64_linux and cosy-machinehostname: DESKTOP-XXXXXXX. The hostname is md5(hostname:+uid), so it is stable for one account and different across accounts. Non-SSE calls do not send them.

qodercli vs desktop: what we emulate and why

• The code emulates qodercli: session_type: "qodercli", product: "cli", cosy-clienttype: 5, COSYVersion "matches the pinned worker CLI", and the CN runtime path is @qodercn-ai/qoderclicn qoderclicn.js. So the version stays on the CLI line (1.1.32), not desktop 1.1.64 as upstream fe62bf6 uses.
• qodercli is not a Go program. npm view @qoder-ai/qodercli shows the bin is bundle/qodercli.js (a Node bundle, 1.1.76). A Node client never sends Go-http-client/2.0, so that UA is a gateway fingerprint either way.
• The 1.1.76 bundle sets Cosy-MachineOS (${arch}_${platform}) on all identity headers. It sets Cosy-MachineHostname (os.hostname) only for requestClass === "infer-sse". That matches 76716dc, and we mirror it.
• For the UA token we follow upstream 513254d's per-edition official names (QoderWork / Qoder) and pair them with our single CLI version. The exact UA that qodercli's fetch emits could not be confirmed statically. If live A/B shows a different string, change it only in qauth/fingerprint.go.
• Not adopted from upstream: the cosy-version bump to 1.1.64 (that is the desktop SDK; we pin the CLI), the api1→api2/api3 gateway fallback, the UUID-shaped machine id and random request id, and the risk telemetry. These are out of scope here.

WorkBuddy (ref workbuddy2api-hub 4ed27f1)

• credential.go: CLI 2.161.0, desktop intl 5.8.4, desktop CN 5.8.3, IDE 2.168.2, all in one place.
• Three-part desktop UAs: WorkBuddy/5.8.4 workbuddy-ai/5.8.4 CLI/2.161.0 (intl) and WorkBuddy/5.8.3 WorkBuddy/5.8.3 CLI/2.161.0 (CN, same middle token as upstream's CN form). Added DesktopUserAgentFor(global). DesktopUserAgent stays an alias of the intl UA, so headers.go is untouched and nothing conflicts with #upstream-align.
• Behavior kept: the CN catalog and chat still use the CLI UA (the earlier live A/B is documented in headers.go). IDEVersion is defined but has no request path in cli2api that uses it yet.

Tests

• qauth/fingerprint_test.go: UA split, hostname stability, payload version, and the JSON-vs-SSE header sets via httptest.
• fingerprint_test.go: the direct Session.Sign carries the UA, version, OS and hostname for both regions.
• workbuddy/versions_test.go: versions and both desktop UAs. Updated the CLI version assertion in client_test.go.
• go test ./... passes; scripts/release-notes.py validate passes.