feat: give each provider its real required headers (first-class, not host-templated)#2
Merged
Merged
Conversation
…host-templated) The Bearer providers differed only by hostname, which reads as generic even though there's no passthrough. Make each a genuine integration: it now carries the provider's real required headers, injected only when the agent didn't set them, so the agent needn't know each API's quirks. - providers.ts: add defaultHeaders per provider - GitHub: User-Agent (GitHub 403s without it) + Accept + X-GitHub-Api-Version - Anthropic: anthropic-version (required by the raw REST API) - Stripe: Stripe-Version (pins API behaviour) - Slack / SendGrid: correct Content-Type - proxy.ts: inject defaultHeaders when absent (agent can still override) - integration-stack.md: document the closed/curated stance + required headers Proven live: GET /github/user through the proxy with NO User-Agent from the agent returns 200 — the integration supplies GitHub's mandatory headers. Stripe still 200 with the pinned version.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This was referenced Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Follow-up to the integration-stack work. Decision: keep the provider set closed and curated — no generic passthrough, and no generic-feeling entries.
Searching the codebase confirmed there was no generic passthrough to remove. The real weakness was that the Bearer providers were just
{host + secret}— identical except for hostname, which reads generic even though it isn't. This PR makes each provider genuinely first-class: it now carries the provider's real required headers, so the integration knows the API's quirks and the agent doesn't have to.Changes
defaultHeadersper provider:User-Agent(GitHub 403s without it),Accept: application/vnd.github+json,X-GitHub-Api-Versionanthropic-version(required by the raw REST API)Stripe-Version(pins API behaviour)Content-TypedefaultHeadersonly when the agent didn't set them (agent can still override).Proof (live, real enclave)
GitHub with no
User-Agentfrom the agent — the integration supplies GitHub's mandatory headers:(Without the injected headers GitHub returns 403.) Stripe still 200 with the pinned version:
Notes
Summary by cubic
Make each provider first-class by adding its required default headers and injecting them when missing, so the integration handles API quirks and agents don’t. Documents the closed, curated provider stance.
defaultHeadersper provider: GitHub (User-Agent, Accept, X-GitHub-Api-Version), Anthropic (anthropic-version), Stripe (Stripe-Version), Slack/SendGrid (Content-Type).Written for commit 60f80be. Summary will update on new commits.