feat: send CLI User-Agent on the OAuth token exchange

The login token exchange used oauth2's default HTTP client, so it sent no
tiger-cli User-Agent — leaving the gateway to record the session's device_name
as the Go default. Route the exchange through a client that sets the CLI
User-Agent, and enrich it with OS/arch (tiger-cli/<version> (os/arch)) via a
shared config.UserAgent() helper reused by the API client.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aprimakina

internal/tiger/api/client_util.go

@@ -44,7 +44,7 @@ func NewTigerClient(cfg *config.Config, apiKey string) (*ClientWithResponses, er
 	authHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(apiKey))
 	client, err := NewClientWithResponses(cfg.APIURL, WithHTTPClient(getHTTPClient()), WithRequestEditorFn(func(_ context.Context, req *http.Request) error {
 		req.Header.Set("Authorization", authHeader)
-		req.Header.Set("User-Agent", fmt.Sprintf("tiger-cli/%s", config.Version))
+		req.Header.Set("User-Agent", config.UserAgent())
 		return nil
 	}))
 	if err != nil {
@@ -82,7 +82,7 @@ func NewTigerClientWithToken(cfg *config.Config, token *oauth2.Token, persist fu
 	httpClient.Timeout = 30 * time.Second
 
 	client, err := NewClientWithResponses(cfg.APIURL, WithHTTPClient(httpClient), WithRequestEditorFn(func(_ context.Context, req *http.Request) error {
-		req.Header.Set("User-Agent", fmt.Sprintf("tiger-cli/%s", config.Version))
+		req.Header.Set("User-Agent", config.UserAgent())
 		return nil
 	}))
 	if err != nil {

internal/tiger/cmd/auth_test.go

@@ -232,6 +232,10 @@ func startMockOAuthServer(t *testing.T, projects []api.Project) *httptest.Server
 				http.Error(w, "Missing required parameters", http.StatusBadRequest)
 				return
 			}
+			// Exchange must carry the CLI User-Agent.
+			if ua := r.Header.Get("User-Agent"); !strings.HasPrefix(ua, "tiger-cli/") {
+				t.Errorf("code exchange User-Agent = %q, want \"tiger-cli/\" prefix", ua)
+			}
 		}
 
 		tokenResponse := map[string]interface{}{

internal/tiger/cmd/oauth.go

@@ -167,6 +167,14 @@ type oauthCallback struct {
 	resultChan    chan<- oauthResult
 }
 
+// userAgentTransport sets the CLI User-Agent on outgoing requests.
+type userAgentTransport struct{ base http.RoundTripper }
+
+func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("User-Agent", config.UserAgent())
+	return t.base.RoundTrip(req)
+}
+
 func (c *oauthCallback) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query()
 
@@ -188,8 +196,10 @@ func (c *oauthCallback) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Exchange authorization code for tokens
-	token, err := c.oauthCfg.Exchange(r.Context(), code, oauth2.VerifierOption(c.codeVerifier))
+	// Set the CLI User-Agent on the exchange so it's recorded as the session's user_agent.
+	ctx := context.WithValue(r.Context(), oauth2.HTTPClient,
+		&http.Client{Transport: &userAgentTransport{base: http.DefaultTransport}})
+	token, err := c.oauthCfg.Exchange(ctx, code, oauth2.VerifierOption(c.codeVerifier))
 	if err != nil {
 		w.WriteHeader(http.StatusInternalServerError)
 		fmt.Fprintf(w, "Failed to exchange authorization code for tokens")

internal/tiger/config/version.go

@@ -1,7 +1,17 @@
 package config
 
+import (
+	"fmt"
+	"runtime"
+)
+
 // These variables are set at build time via ldflags in the GoReleaser pipeline
 // for production releases. Default values are used for local development builds.
 var Version = "dev"
 var BuildTime = "unknown"
 var GitCommit = "unknown"
+
+// UserAgent returns the User-Agent the CLI sends on HTTP requests.
+func UserAgent() string {
+	return fmt.Sprintf("tiger-cli/%s (%s/%s)", Version, runtime.GOOS, runtime.GOARCH)
+}