Send CORGEA-CLI-VERSION header on every Corgea request

[Ibrahimrahhal]

Summary

Every request the CLI makes to Corgea now carries CORGEA-CLI-VERSION: <Cargo.toml version>, so doghouse can record which CLI release triggered a scan (Corgea/doghouse cursor/save-cli-version-on-scan-60b8 stores it in the scan's meta_info).

• vuln_api::default_headers() builds the header once from CARGO_PKG_VERSION; it is installed as a client default on both the shared utils::api client and the vuln-api client, so it goes out on every call, authenticated or not, and no call site can forget it.
• exchange_code_for_token (OAuth login) built its own bare reqwest::blocking::Client; it now uses the shared client, so it gets the header plus the standard timeout/proxy settings.
• The third-party registry client in verify_deps is intentionally untouched (it is not Corgea and already identifies itself via User-Agent).

Tests

• New unauthenticated_requests_send_cli_version asserts the header on the pre-login code exchange through the shared client.
• public_check_sends_no_auth_headers (vuln-api) now also asserts the version header.
• ./harness check → clippy, fmt, 952 tests passed.

  

[corgea-security]

critical: Uppercase static header name panics during client initialization

HeaderMap::insert receives CLI_VERSION_HEADER as a &'static str, which is converted through HeaderName::from_static. Rust's http crate requires static header names to be lowercase and panics for "CORGEA-CLI-VERSION". Because default_headers() initializes both shared clients, this can prevent all affected API requests. Define the value as lowercase (HTTP header matching remains case-insensitive), preferably as a typed HeaderName.

Proof or reproduction:

#[test]
#[should_panic(expected = "invalid HTTP header name")]
fn uppercase_header_panics() {
    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("CORGEA-CLI-VERSION", reqwest::header::HeaderValue::from_static("1"));
}

[corgea-security]

Automated review risk: 5/5.

The uppercase static header name causes a runtime panic whenever either HTTP client initializes, breaking API requests and tests.

Critical or high-priority changes must be addressed.

Automatic approval was not submitted: automated review found critical or high-priority findings.

[cursor]

No merge blocker.

CORGEA-CLI-VERSION is a client default on both Corgea HTTP clients (src/utils/api.rs shared client and vuln_api::http_client). reqwest 0.12.23 merges those defaults in execute_request after RequestBuilder::build(), and only when the name is vacant. DebugRequestBuilder::send then adds auth_headers() (Authorization / CORGEA-TOKEN plus CORGEA-SOURCE) and calls client.execute(), so a logged-in POST /start-scan and the final archive PATCH still send the version.

exchange_code_for_token was the only Corgea call built on a bare Client. It now uses the shared client, so the login exchange gets the header, the 150s timeout, and CORGEA_ACCEPT_CERT like every other Corgea call. The shared cookie jar is in-memory only, and corgea login exits after the exchange, so those cookies are not reused on a later command.

The npm/PyPI client in verify_deps is unchanged. CARGO_PKG_VERSION (1.16.2) is a valid header value. No previous review threads on this PR.

  

_{Sent by Cursor Automation: pr-flow}