fix(mimo-free): add Chrome User-Agent rotation to bypass anti-abuse gate

Fixes #1933 — upstream returns 403 "Illegal access" on the chat endpoint when requests lack a browser-like User-Agent. Mirror OmniRoute mimocode executor: rotate across 3 Chrome UA strings on both bootstrap and chat. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-22 13:38:31 +00:00 · 2026-06-21 16:51:47 +07:00
parent 7baf293ccb
commit 36153fedbd
2 changed files with 72 additions and 1 deletions
@@ -0,0 +1,60 @@
+/**
+ * Live repro for issue #1933: MiMo Code Free returns HTTP 502 "MiMo bootstrap failed: 403".
+ * Root cause: upstream gates on Chrome-like User-Agent. Without UA → 403 "Illegal access".
+ * Hits real endpoints — no mocks. Free provider, safe to call.
+ */
+import { describe, it, expect } from "vitest";
+import { proxyAwareFetch } from "../../open-sse/utils/proxyFetch.js";
+import { __test__ } from "../../open-sse/executors/mimo-free.js";
+
+const { BOOTSTRAP_URL, CHAT_URL, generateFingerprint, MIMO_SYSTEM_MARKER } = __test__;
+
+const CHROME_UA =
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+
+async function bootstrapWith(ua) {
+  const headers = { "Content-Type": "application/json" };
+  if (ua) headers["User-Agent"] = ua;
+  const r = await proxyAwareFetch(BOOTSTRAP_URL, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ client: generateFingerprint() }),
+  });
+  const data = await r.json();
+  return { status: r.status, jwt: data.jwt };
+}
+
+async function chatWith(jwt, ua) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mimo-Source": "mimocode-cli-free",
+    Authorization: `Bearer ${jwt}`,
+    Accept: "application/json",
+  };
+  if (ua) headers["User-Agent"] = ua;
+  const body = {
+    model: "mimo-auto",
+    messages: [
+      { role: "system", content: MIMO_SYSTEM_MARKER },
+      { role: "user", content: "hi" },
+    ],
+    stream: false,
+  };
+  return proxyAwareFetch(CHAT_URL, { method: "POST", headers, body: JSON.stringify(body) });
+}
+
+describe("MiMo Free bootstrap (live)", () => {
+  it("bootstrap returns 200 with JWT", async () => {
+    const { status, jwt } = await bootstrapWith(CHROME_UA);
+    expect(status).toBe(200);
+    expect(jwt).toBeTruthy();
+  });
+});
+
+describe("MiMo Free anti-abuse gate (live)", () => {
+  it("chat WITH Chrome User-Agent → 200", async () => {
+    const { jwt } = await bootstrapWith(CHROME_UA);
+    const r = await chatWith(jwt, CHROME_UA);
+    expect(r.status).toBe(200);
+  });
+});