docs(v0.9): file R-v0.9-NEW-16 — no User-Agent header on outbound requests

Surfaced by a user inspection of the transport layer at v0.10
candidate-selection close-out (post-handoff). src/api/transport.ts:
102-107 (JSON) and src/api/multipart-transport.ts (multipart) set
exactly three headers — Authorization, API-Version, Content-Type —
with zero hits across src/ for user-agent. Node's global fetch
(undici) therefore sends the default literal `User-Agent: node`
(live-confirmed via httpbin probe at Node v24.10.0), indistinguishable
from any other Node script hitting Monday's API.

Filed LOW-priority because no shipped bug — Monday accepts requests
fine, agents see no failure mode. But the gap is real: Monday's
ops/abuse teams can't correlate traffic to monday-cli, can't
selectively rate-limit by UA, can't whitelist us; an issue report
carrying "monday-cli sent these calls" can't be cross-referenced
against Monday-side logs. Lift adds a `monday-cli/<version>
(node/<node-version>)` header on both transports + extends the
reservedHeaderLowerNames set (matches the existing header-lockdown
discipline at transport.ts:90-94 + security.md "Header lockdown").

Trigger: any session touching transport headers, a Monday ops
request, a debugging session needing UA correlation, or a ride-along
on an unrelated milestone already in src/api/transport.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Nick Webster

docs/v0.9-plan.md

@@ -1450,3 +1450,55 @@ pending the user):
   drifts AND the release-prep checklist fails to catch it.
   Cross-refs R-NEW-82 (the release-prep cross-doc grep sibling —
   the same audit-discipline muscle applied to a different surface).
+
+- **R-v0.9-NEW-16 — No `User-Agent` header on outbound requests**
+  (code / observability gap, watch-item). Filed at v0.10
+  candidate-selection close-out (2026-05-22), surfaced by a user
+  inspection of the transport layer.
+  `src/api/transport.ts:102-107` (JSON) and
+  `src/api/multipart-transport.ts` (multipart) construct exactly
+  three caller-visible headers — `Authorization`, `API-Version`,
+  `Content-Type` — with zero hits across `src/` for `user-agent`.
+  Node's global `fetch` (undici) therefore sends the default literal
+  `User-Agent: node` (live-confirmed via httpbin probe 2026-05-22 at
+  Node v24.10.0), indistinguishable from any other Node script
+  targeting Monday's API. Monday's ops/abuse teams can't correlate
+  traffic to the CLI, can't selectively rate-limit by UA, can't
+  whitelist us; and an issue report carrying "`monday-cli` sent
+  these calls" can't be cross-referenced against Monday-side logs.
+
+  **Candidate:** add a `User-Agent` header on both transports with a
+  polite identifiable shape — e.g. `monday-cli/<version>
+  (node/<node-version>)` — sourced from `package.json` at startup
+  (single `getUserAgent()` helper in `src/api/transport.ts` or a new
+  `src/api/user-agent.ts`). Add `user-agent` to the
+  `reservedHeaderLowerNames` set at `transport.ts:90-94` so
+  caller-supplied headers can't spoof it (matches the `Authorization`
+  / `API-Version` / `Content-Type` header-lockdown discipline +
+  `security.md` "Header lockdown" rule). The same UA goes on the
+  multipart transport via the parallel header-construction path.
+  Test surface: extend the existing transport unit tests with a
+  UA-presence assertion + a caller-spoofing-rejection assertion (the
+  reserved-set sibling test pattern).
+
+  **Cost / over-fit notes:** trivial. One helper + two
+  header-bag insertions + two `reservedHeaderLowerNames` updates +
+  ~3 test additions. No new wire surface, no new ERROR_CODE, no
+  envelope change. The SDK-typed path (`@mondaydotcomorg/api`) may
+  set its own UA; the raw-GraphQL `client.request<T>()` legs + the
+  multipart upload path both go through our transport which doesn't,
+  so the CLI is "partly identifiable" today depending on call path —
+  the lift normalises this.
+
+  **Priority:** LOW (no shipped bug; identification / observability
+  gap only — Monday accepts the requests fine, agents see no failure
+  mode). **1st instance:** 2026-05-22 transport-layer audit at v0.10
+  candidate-selection close-out. **Trigger:** any session touching
+  the transport headers, OR a Monday-side request from their ops
+  team for identifiable traffic, OR a coordinated CLI / server-side
+  debugging session needing UA correlation, OR pre-flight on an
+  unrelated milestone that already touches `src/api/transport.ts`
+  (lift the header alongside as a small ride). Cross-refs the
+  `security.md` "Header lockdown" rule (the reserved-set discipline
+  the new header would extend) + `monday-api.md` (the endpoint
+  contract).