fix: set User-Agent on outbound fetches to bypass Cloudflare bot filter

Cloudflare blocks Node.js default User-Agent on abs.xyz. Set AGW-CLI/1.0
on all companion app fetches (callback-key, RPC proxy).

Also fix --version output to match package.json.

Bumps CLI to 0.1.3.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jarrodwatts

packages/agw-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abstract-foundation/agw-cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "description": "Agent-first CLI for Abstract Global Wallet workflows",
   "license": "MIT",

packages/agw-cli/src/index.ts

@@ -145,7 +145,7 @@ async function main(): Promise<void> {
   program
     .name("agw-cli")
     .description("Agent-first CLI for Abstract Global Wallet workflows.")
-    .version("0.1.0")
+    .version("0.1.3")
     .showHelpAfterError();
 
   program

packages/agw-core/src/auth/attestation.ts

@@ -1,4 +1,5 @@
 import { createPublicKey, type KeyObject, verify as verifySignature } from "node:crypto";
+import { AGW_HTTP_HEADERS } from "../config/runtime.js";
 
 const DEFAULT_CALLBACK_ISSUER = "agw";
 const DEFAULT_CLOCK_SKEW_SECONDS = 60;
@@ -54,6 +55,7 @@ export async function resolveCallbackVerificationConfig(appUrl: string): Promise
     method: "GET",
     headers: {
       Accept: "application/json",
+      ...AGW_HTTP_HEADERS,
     },
   });
   if (!response.ok) {

packages/agw-core/src/config/runtime.ts

@@ -3,6 +3,10 @@ import path from "node:path";
 import type { AgwOutputMode, AgwSanitizeProfile } from "../registry/types.js";
 
 const DEFAULT_HOME_DIRNAME = ".agw";
+
+export const AGW_HTTP_HEADERS: Record<string, string> = {
+  "User-Agent": "AGW-CLI/1.0",
+};
 const OUTPUT_ENV_KEY = "AGW_OUTPUT";
 const SANITIZE_ENV_KEY = "AGW_SANITIZE_PROFILE";
 const HOME_ENV_KEY = "AGW_HOME";

packages/agw-core/src/privy/client.ts

@@ -1,4 +1,5 @@
 import type { KeyObject } from "node:crypto";
+import { AGW_HTTP_HEADERS } from "../config/runtime.js";
 import { computeAuthorizationSignature, readAuthKeyfile } from "./auth.js";
 import type {
   PrivySignerConfig,
@@ -84,6 +85,7 @@ export class PrivyWalletClient {
         method: "GET",
         headers: {
           Accept: "application/json",
+          ...AGW_HTTP_HEADERS,
         },
       });
       if (!response.ok) {
@@ -139,6 +141,7 @@ export class PrivyWalletClient {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
+            ...AGW_HTTP_HEADERS,
           },
           body: JSON.stringify({
             walletId: this.walletId,