fix(mimo-free): add Chrome User-Agent rotation to bypass anti-abuse gate

Fixes #1933 — upstream returns 403 "Illegal access" on the chat endpoint
when requests lack a browser-like User-Agent. Mirror OmniRoute mimocode
executor: rotate across 3 Chrome UA strings on both bootstrap and chat.

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/executors/mimo-free.js

@@ -12,6 +12,13 @@ const JWT_FALLBACK_TTL_SEC = 3000;
 const JWT_EXPIRY_BUFFER_MS = 300000;
 const SESSION_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789";
 
+// Anti-abuse gate: upstream rejects requests without a Chrome-like User-Agent with 403 "Illegal access"
+const USER_AGENTS = [
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+];
+
 // Anti-abuse gate marker: the free chat endpoint returns 403 "Illegal access"
 // unless a system message contains this exact MiMoCode signature substring.
 export const MIMO_SYSTEM_MARKER =
@@ -76,7 +83,10 @@ async function bootstrapJwt(proxyOptions = null) {
 
   const response = await proxyAwareFetch(BOOTSTRAP_URL, {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)],
+    },
     body: JSON.stringify({ client: generateFingerprint() }),
   }, proxyOptions);
 
@@ -108,6 +118,7 @@ export class MimoFreeExecutor extends BaseExecutor {
     return {
       "Content-Type": "application/json",
       "X-Mimo-Source": "mimocode-cli-free",
+      "User-Agent": USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)],
       "x-session-affinity": this.sessionId,
       "Accept": stream ? "text/event-stream" : "application/json",
     };

tests/unit/mimo-free.live.test.js

@@ -0,0 +1,60 @@
+/**
+ * Live repro for issue #1933: MiMo Code Free returns HTTP 502 "MiMo bootstrap failed: 403".
+ * Root cause: upstream gates on Chrome-like User-Agent. Without UA → 403 "Illegal access".
+ * Hits real endpoints — no mocks. Free provider, safe to call.
+ */
+import { describe, it, expect } from "vitest";
+import { proxyAwareFetch } from "../../open-sse/utils/proxyFetch.js";
+import { __test__ } from "../../open-sse/executors/mimo-free.js";
+
+const { BOOTSTRAP_URL, CHAT_URL, generateFingerprint, MIMO_SYSTEM_MARKER } = __test__;
+
+const CHROME_UA =
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+
+async function bootstrapWith(ua) {
+  const headers = { "Content-Type": "application/json" };
+  if (ua) headers["User-Agent"] = ua;
+  const r = await proxyAwareFetch(BOOTSTRAP_URL, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ client: generateFingerprint() }),
+  });
+  const data = await r.json();
+  return { status: r.status, jwt: data.jwt };
+}
+
+async function chatWith(jwt, ua) {
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Mimo-Source": "mimocode-cli-free",
+    Authorization: `Bearer ${jwt}`,
+    Accept: "application/json",
+  };
+  if (ua) headers["User-Agent"] = ua;
+  const body = {
+    model: "mimo-auto",
+    messages: [
+      { role: "system", content: MIMO_SYSTEM_MARKER },
+      { role: "user", content: "hi" },
+    ],
+    stream: false,
+  };
+  return proxyAwareFetch(CHAT_URL, { method: "POST", headers, body: JSON.stringify(body) });
+}
+
+describe("MiMo Free bootstrap (live)", () => {
+  it("bootstrap returns 200 with JWT", async () => {
+    const { status, jwt } = await bootstrapWith(CHROME_UA);
+    expect(status).toBe(200);
+    expect(jwt).toBeTruthy();
+  });
+});
+
+describe("MiMo Free anti-abuse gate (live)", () => {
+  it("chat WITH Chrome User-Agent → 200", async () => {
+    const { jwt } = await bootstrapWith(CHROME_UA);
+    const r = await chatWith(jwt, CHROME_UA);
+    expect(r.status).toBe(200);
+  });
+});