🤖 feat: add AI app attribution headers (#1141)

Adds default app attribution headers (`HTTP-Referer`, `X-Title`) to all
AI SDK provider requests, enabling OpenRouter (and compatible gateways)
to attribute mux usage.

- Implemented `buildAppAttributionHeaders` (case-insensitive merge,
never overwrites user-provided values)
- Applied during model creation so all `streamText()` calls inherit it
- Added unit tests

---

<details>
<summary>📋 Implementation Plan</summary>

# 🤖 Plan: Add app attribution headers to AI SDK streaming (OpenRouter
leaderboard)

## Goal
Ensure mux’s `streamText()` calls include **app attribution** so
OpenRouter (and any other compatible gateway) can attribute traffic to
mux (e.g., for leaderboards).

For OpenRouter specifically, this means sending these request headers:
- `HTTP-Referer`: a stable URL for the app (recommended by OpenRouter)
- `X-Title`: a human-readable app name

## Recommended approach (A): Inject attribution headers for **all
providers** in `AIService.createModel()` (default-on)
**Net new product LoC:** ~30–55

### Why this approach
- Covers **every** provider (OpenRouter + others) without needing to
touch `streamText()` call sites.
- Future-proof: any future non-streaming usage will automatically carry
the same attribution.
- Allows user overrides via `providers.jsonc` `headers` (we never
overwrite existing `HTTP-Referer` / `X-Title`, case-insensitive).

### Implementation steps
1. **Add centralized constants** for mux attribution values
   - Add `src/constants/appAttribution.ts` exporting:
     - `MUX_APP_ATTRIBUTION_TITLE` = `"mux"`
     - `MUX_APP_ATTRIBUTION_URL` = `"https://mux.coder.com"`

2. **Add a small, tested header-merge helper** (defensive +
case-insensitive)
   - In `src/node/services/aiService.ts`, export:
- `buildAppAttributionHeaders(existing?: Record<string, string>):
Record<string, string>`
   - Behavior:
     - Preserve all unrelated headers.
- Add missing headers using canonical casing (`HTTP-Referer`,
`X-Title`).
     - Never overwrite existing values (match keys case-insensitively).

3. **Wire into model creation once**
- In `AIService.createModel()` (after baseUrl → baseURL normalization),
apply:
- `providerConfig.headers =
buildAppAttributionHeaders(providerConfig.headers)`
- This automatically affects OpenRouter and every other provider branch
because they all pass `headers` through to the provider factory.

4. **Unit tests**
- Extend `src/node/services/aiService.test.ts` with
`describe("buildAppAttributionHeaders", ...)`.
   - Test cases:
     - adds both headers when no headers exist
     - adds only the missing header when one is present
- does not overwrite existing values (including different casing like
`http-referer`, `X-TITLE`)
     - preserves unrelated headers

### Validation
- `make typecheck`
- `bun test src/node/services/aiService.test.ts`
- Manual: run a request through any provider (especially OpenRouter) and
confirm the headers appear upstream.

## Rollout / compatibility notes
- This should be a non-breaking behavioral addition.
- We must ensure we **never** overwrite user-provided `HTTP-Referer` /
`X-Title` (case-insensitive check).

</details>

---
_Generated with `mux` • Model: "unknown" • Thinking: "unknown"_

Signed-off-by: Thomas Kosiewski <tk@coder.com>

Author: ThomasK33

src/constants/appAttribution.ts

@@ -0,0 +1,7 @@
+// App attribution values for AI provider requests.
+//
+// These are used by OpenRouter (and other compatible platforms) to attribute
+// requests to mux (e.g., for leaderboards).
+
+export const MUX_APP_ATTRIBUTION_TITLE = "mux";
+export const MUX_APP_ATTRIBUTION_URL = "https://mux.coder.com";

src/node/services/aiService.test.ts

@@ -7,12 +7,14 @@ import {
   AIService,
   normalizeAnthropicBaseURL,
   buildAnthropicHeaders,
+  buildAppAttributionHeaders,
   ANTHROPIC_1M_CONTEXT_HEADER,
 } from "./aiService";
 import { HistoryService } from "./historyService";
 import { PartialService } from "./partialService";
 import { InitStateManager } from "./initStateManager";
 import { Config } from "@/node/config";
+import { MUX_APP_ATTRIBUTION_TITLE, MUX_APP_ATTRIBUTION_URL } from "@/constants/appAttribution";
 
 describe("AIService", () => {
   let service: AIService;
@@ -117,3 +119,46 @@ describe("buildAnthropicHeaders", () => {
     expect(result).toEqual({ "anthropic-beta": ANTHROPIC_1M_CONTEXT_HEADER });
   });
 });
+
+describe("buildAppAttributionHeaders", () => {
+  it("adds both headers when no headers exist", () => {
+    expect(buildAppAttributionHeaders(undefined)).toEqual({
+      "HTTP-Referer": MUX_APP_ATTRIBUTION_URL,
+      "X-Title": MUX_APP_ATTRIBUTION_TITLE,
+    });
+  });
+
+  it("adds only the missing header when one is present", () => {
+    const existing = { "HTTP-Referer": "https://example.com" };
+    const result = buildAppAttributionHeaders(existing);
+    expect(result).toEqual({
+      "HTTP-Referer": "https://example.com",
+      "X-Title": MUX_APP_ATTRIBUTION_TITLE,
+    });
+  });
+
+  it("does not overwrite existing values (case-insensitive)", () => {
+    const existing = { "http-referer": "https://example.com", "X-TITLE": "My App" };
+    const result = buildAppAttributionHeaders(existing);
+    expect(result).toEqual(existing);
+  });
+
+  it("preserves unrelated headers", () => {
+    const existing = { "x-custom": "value" };
+    const result = buildAppAttributionHeaders(existing);
+    expect(result).toEqual({
+      "x-custom": "value",
+      "HTTP-Referer": MUX_APP_ATTRIBUTION_URL,
+      "X-Title": MUX_APP_ATTRIBUTION_TITLE,
+    });
+  });
+
+  it("does not mutate the input object", () => {
+    const existing = { "x-custom": "value" };
+    const existingSnapshot = { ...existing };
+
+    buildAppAttributionHeaders(existing);
+
+    expect(existing).toEqual(existingSnapshot);
+  });
+});

src/node/services/aiService.ts

@@ -60,6 +60,7 @@ import { EnvHttpProxyAgent, type Dispatcher } from "undici";
 import { getPlanFilePath } from "@/common/utils/planStorage";
 import { getPlanModeInstruction } from "@/common/utils/ui/modeUtils";
 import type { UIMode } from "@/common/types/mode";
+import { MUX_APP_ATTRIBUTION_TITLE, MUX_APP_ATTRIBUTION_URL } from "@/constants/appAttribution";
 import { readPlanFile } from "@/node/utils/runtime/helpers";
 
 // Export a standalone version of getToolsForModel for use in backend
@@ -238,6 +239,35 @@ export function buildAnthropicHeaders(
   return { "anthropic-beta": ANTHROPIC_1M_CONTEXT_HEADER };
 }
 
+/**
+ * Build app attribution headers used by OpenRouter (and other compatible platforms).
+ *
+ * Attribution docs:
+ * - OpenRouter: https://openrouter.ai/docs/app-attribution
+ * - Vercel AI Gateway: https://vercel.com/docs/ai-gateway/app-attribution
+ *
+ * Exported for testing.
+ */
+export function buildAppAttributionHeaders(
+  existingHeaders: Record<string, string> | undefined
+): Record<string, string> {
+  // Clone to avoid mutating caller-provided objects.
+  const headers: Record<string, string> = existingHeaders ? { ...existingHeaders } : {};
+
+  // Header names are case-insensitive. Preserve user-provided values by never overwriting.
+  const existingLowercaseKeys = new Set(Object.keys(headers).map((key) => key.toLowerCase()));
+
+  if (!existingLowercaseKeys.has("http-referer")) {
+    headers["HTTP-Referer"] = MUX_APP_ATTRIBUTION_URL;
+  }
+
+  if (!existingLowercaseKeys.has("x-title")) {
+    headers["X-Title"] = MUX_APP_ATTRIBUTION_TITLE;
+  }
+
+  return headers;
+}
+
 /**
  * Preload AI SDK provider modules to avoid race conditions in concurrent test environments.
  * This function loads @ai-sdk/anthropic, @ai-sdk/openai, and ollama-ai-provider-v2 eagerly
@@ -435,6 +465,13 @@ export class AIService extends EventEmitter {
         ? { ...configWithoutBaseUrl, baseURL: baseUrl }
         : configWithoutBaseUrl;
 
+      // Inject app attribution headers (used by OpenRouter and other compatible platforms).
+      // We never overwrite user-provided values (case-insensitive header matching).
+      providerConfig = {
+        ...providerConfig,
+        headers: buildAppAttributionHeaders(providerConfig.headers),
+      };
+
       // Handle Anthropic provider
       if (providerName === "anthropic") {
         // Anthropic API key can come from: