From 72704ee4bdea633e085e1f6b8b384aade395e79b Mon Sep 17 00:00:00 2001
From: orangeboyChen <chenenhan@qq.com>
Date: Fri, 21 Aug 2026 01:32:12 +0800
Subject: [PATCH] fix: align CodeBuddy upstream compatibility

---
 app/admin-api/access-keys/[id]/route.ts      |  4 -
 app/admin-api/access-keys/route.ts           |  4 -
 app/credentials/credential-card.tsx          | 11 +++
 app/credentials/credential-group.tsx         |  5 ++
 app/credentials/credentials.tsx              | 19 +++++
 app/page-shell.tsx                           | 18 ++++
 lib/server/domain/access-keys.ts             | 26 +-----
 lib/server/domain/credentials.ts             | 14 +++-
 lib/server/proxy/codebuddy.ts                | 88 +++++++++-----------
 messages/en-US.json                          |  3 +
 messages/ja-JP.json                          |  3 +
 messages/zh-CN.json                          |  3 +
 tests/server/access-keys-credentials.test.ts | 15 +++-
 tests/server/anthropic.test.ts               | 12 +++
 tests/server/units.test.ts                   | 66 +++++++++++----
 15 files changed, 190 insertions(+), 101 deletions(-)

diff --git a/app/admin-api/access-keys/[id]/route.ts b/app/admin-api/access-keys/[id]/route.ts
index 24bac24..785c0c9 100644
--- a/app/admin-api/access-keys/[id]/route.ts
+++ b/app/admin-api/access-keys/[id]/route.ts
@@ -24,10 +24,6 @@ const validateCredentialFilenames = (
     .map((item) => item.trim())
     .filter(Boolean);
 
-  if (!normalized.length) {
-    throw new Error('At least one credential must be selected');
-  }
-
   if (normalized.some((item) => !available.has(item))) {
     throw new Error('Selected credentials must exist');
   }
diff --git a/app/admin-api/access-keys/route.ts b/app/admin-api/access-keys/route.ts
index 13499f7..1bf523d 100644
--- a/app/admin-api/access-keys/route.ts
+++ b/app/admin-api/access-keys/route.ts
@@ -23,10 +23,6 @@ const validateCredentialFilenames = (
     .map((item) => item.trim())
     .filter(Boolean);
 
-  if (!normalized.length) {
-    throw new Error('At least one credential must be selected');
-  }
-
   if (normalized.some((item) => !available.has(item))) {
     throw new Error('Selected credentials must exist');
   }
diff --git a/app/credentials/credential-card.tsx b/app/credentials/credential-card.tsx
index 7966011..d39ee5d 100644
--- a/app/credentials/credential-card.tsx
+++ b/app/credentials/credential-card.tsx
@@ -24,6 +24,7 @@ interface CredentialCardProps {
   current: CurrentCredentialInfo | null;
   form: CredentialFormState;
   onCredentialFirstMessageRoleToSystemChange: (value: boolean) => void;
+  onCredentialFirstSystemMessageRoleToUserChange: (value: boolean) => void;
   onCredentialUpstreamProtocolChange: (value: 'chat' | 'responses') => void;
   onDelete: () => void;
   onEdit: () => void;
@@ -36,6 +37,7 @@ export const CredentialCard = ({
   current,
   form,
   onCredentialFirstMessageRoleToSystemChange,
+  onCredentialFirstSystemMessageRoleToUserChange,
   onCredentialUpstreamProtocolChange,
   onDelete,
   onEdit,
@@ -108,6 +110,9 @@ export const CredentialCard = ({
                 ? text('credentials.credentialUpstreamResponsesTag')
                 : text('credentials.credentialUpstreamChatTag')}
             </Tag>
+            {credential.first_system_message_role_to_user ? (
+              <Tag>{text('credentials.credentialFirstSystemAsUserTag')}</Tag>
+            ) : null}
             <Tag>
               {credential.first_message_role_to_system
                 ? text('credentials.credentialRoleAsSystemTag')
@@ -160,6 +165,12 @@ export const CredentialCard = ({
               onChange={onCredentialFirstMessageRoleToSystemChange}
               title={text('credentials.credentialRoleAsSystem')}
             />
+            <ToggleOption
+              checked={form.firstSystemMessageRoleToUser}
+              description={text('credentials.credentialFirstSystemAsUserHelp')}
+              onChange={onCredentialFirstSystemMessageRoleToUserChange}
+              title={text('credentials.credentialFirstSystemAsUser')}
+            />
           </div>
           <Flexbox gap={8} horizontal>
             <Button icon={X} onClick={onResetCredentialForm}>
diff --git a/app/credentials/credential-group.tsx b/app/credentials/credential-group.tsx
index bf1adb8..feca997 100644
--- a/app/credentials/credential-group.tsx
+++ b/app/credentials/credential-group.tsx
@@ -14,6 +14,7 @@ interface CredentialGroupProps {
   form: CredentialFormState;
   items: CredentialSummary[];
   onCredentialFirstMessageRoleToSystemChange: (value: boolean) => void;
+  onCredentialFirstSystemMessageRoleToUserChange: (value: boolean) => void;
   onCredentialUpstreamProtocolChange: (value: 'chat' | 'responses') => void;
   onDelete: (index: number) => void;
   onEdit: (credential: CredentialSummary) => void;
@@ -27,6 +28,7 @@ export const CredentialGroup = ({
   form,
   items,
   onCredentialFirstMessageRoleToSystemChange,
+  onCredentialFirstSystemMessageRoleToUserChange,
   onCredentialUpstreamProtocolChange,
   onDelete,
   onEdit,
@@ -47,6 +49,9 @@ export const CredentialGroup = ({
           onCredentialFirstMessageRoleToSystemChange={
             onCredentialFirstMessageRoleToSystemChange
           }
+          onCredentialFirstSystemMessageRoleToUserChange={
+            onCredentialFirstSystemMessageRoleToUserChange
+          }
           onCredentialUpstreamProtocolChange={
             onCredentialUpstreamProtocolChange
           }
diff --git a/app/credentials/credentials.tsx b/app/credentials/credentials.tsx
index 5add03f..7dbfb9a 100644
--- a/app/credentials/credentials.tsx
+++ b/app/credentials/credentials.tsx
@@ -35,6 +35,7 @@ export interface CredentialSummary {
   expires_in: number | null;
   filename: string;
   first_message_role_to_system: boolean;
+  first_system_message_role_to_user?: boolean;
   has_refresh_token: boolean;
   index: number;
   is_expired: boolean;
@@ -93,6 +94,7 @@ export interface CredentialFormState {
   bearerToken: string;
   editingIndex: number | null;
   firstMessageRoleToSystem: boolean;
+  firstSystemMessageRoleToUser: boolean;
   upstreamProtocol: 'chat' | 'responses';
   userId: string;
 }
@@ -147,6 +149,7 @@ export const defaultCredentialsState: CredentialsState = {
     bearerToken: '',
     editingIndex: null,
     firstMessageRoleToSystem: false,
+    firstSystemMessageRoleToUser: false,
     upstreamProtocol: 'chat',
     userId: '',
   },
@@ -188,6 +191,7 @@ export interface CredentialsTabController {
   onCallbackUrlChange: (value: string) => void;
   onCopyAuthUrl: () => void;
   onCredentialFirstMessageRoleToSystemChange: (value: boolean) => void;
+  onCredentialFirstSystemMessageRoleToUserChange: (value: boolean) => void;
   onCredentialUpstreamProtocolChange: (value: 'chat' | 'responses') => void;
   onCredentialTokenChange: (value: string) => void;
   onCredentialUserIdChange: (value: string) => void;
@@ -235,6 +239,7 @@ const Credentials = () => {
     onCallbackUrlChange,
     onCopyAuthUrl,
     onCredentialFirstMessageRoleToSystemChange,
+    onCredentialFirstSystemMessageRoleToUserChange,
     onCredentialUpstreamProtocolChange,
     onCredentialTokenChange,
     onCredentialUserIdChange,
@@ -495,6 +500,14 @@ const Credentials = () => {
               onChange={onCredentialFirstMessageRoleToSystemChange}
               title={credentialsText('credentials.credentialRoleAsSystem')}
             />
+            <ToggleOption
+              checked={credentials.form.firstSystemMessageRoleToUser}
+              description={credentialsText(
+                'credentials.credentialFirstSystemAsUserHelp',
+              )}
+              onChange={onCredentialFirstSystemMessageRoleToUserChange}
+              title={credentialsText('credentials.credentialFirstSystemAsUser')}
+            />
           </div>
           <Flexbox horizontal>
             <Button icon={Save} onClick={onAddCredential} type="primary">
@@ -620,6 +633,9 @@ const Credentials = () => {
                 onCredentialFirstMessageRoleToSystemChange={
                   onCredentialFirstMessageRoleToSystemChange
                 }
+                onCredentialFirstSystemMessageRoleToUserChange={
+                  onCredentialFirstSystemMessageRoleToUserChange
+                }
                 onCredentialUpstreamProtocolChange={
                   onCredentialUpstreamProtocolChange
                 }
@@ -635,6 +651,9 @@ const Credentials = () => {
                 onCredentialFirstMessageRoleToSystemChange={
                   onCredentialFirstMessageRoleToSystemChange
                 }
+                onCredentialFirstSystemMessageRoleToUserChange={
+                  onCredentialFirstSystemMessageRoleToUserChange
+                }
                 onCredentialUpstreamProtocolChange={
                   onCredentialUpstreamProtocolChange
                 }
diff --git a/app/page-shell.tsx b/app/page-shell.tsx
index cb8e454..8608562 100644
--- a/app/page-shell.tsx
+++ b/app/page-shell.tsx
@@ -984,6 +984,8 @@ const AdminPageLayoutContent = ({
                 index: credentials.form.editingIndex,
                 first_message_role_to_system:
                   credentials.form.firstMessageRoleToSystem,
+                first_system_message_role_to_user:
+                  credentials.form.firstSystemMessageRoleToUser,
                 upstream_protocol: credentials.form.upstreamProtocol,
               }
             : {
@@ -991,6 +993,8 @@ const AdminPageLayoutContent = ({
                 bearer_token: credentials.form.bearerToken.trim(),
                 first_message_role_to_system:
                   credentials.form.firstMessageRoleToSystem,
+                first_system_message_role_to_user:
+                  credentials.form.firstSystemMessageRoleToUser,
                 upstream_protocol: credentials.form.upstreamProtocol,
                 user_id: credentials.form.userId.trim() || undefined,
               },
@@ -1021,6 +1025,7 @@ const AdminPageLayoutContent = ({
         bearerToken: '',
         editingIndex: null,
         firstMessageRoleToSystem: false,
+        firstSystemMessageRoleToUser: false,
         upstreamProtocol: 'chat',
         userId: '',
       },
@@ -1736,6 +1741,15 @@ const AdminPageLayoutContent = ({
                     },
                   }));
                 },
+                onCredentialFirstSystemMessageRoleToUserChange: (value) => {
+                  setCredentials((current) => ({
+                    ...current,
+                    form: {
+                      ...current.form,
+                      firstSystemMessageRoleToUser: value,
+                    },
+                  }));
+                },
                 onCredentialUpstreamProtocolChange: (value) => {
                   setCredentials((current) => ({
                     ...current,
@@ -1774,6 +1788,9 @@ const AdminPageLayoutContent = ({
                       editingIndex: credential.index,
                       firstMessageRoleToSystem:
                         credential.first_message_role_to_system,
+                      firstSystemMessageRoleToUser: Boolean(
+                        credential.first_system_message_role_to_user,
+                      ),
                       upstreamProtocol: credential.upstream_protocol,
                       userId: credential.user_id ?? '',
                     },
@@ -1827,6 +1844,7 @@ const AdminPageLayoutContent = ({
                       bearerToken: '',
                       editingIndex: null,
                       firstMessageRoleToSystem: false,
+                      firstSystemMessageRoleToUser: false,
                       upstreamProtocol: 'chat',
                       userId: '',
                     },
diff --git a/lib/server/domain/access-keys.ts b/lib/server/domain/access-keys.ts
index fa296f3..742821b 100644
--- a/lib/server/domain/access-keys.ts
+++ b/lib/server/domain/access-keys.ts
@@ -78,11 +78,6 @@ const pruneAccessKeyStore = async (
         changed = true;
       }
 
-      if (!remainingFilenames.length) {
-        changed = true;
-        return null;
-      }
-
       if (
         remainingFilenames.some(
           (filename, index) => filename !== record.credentialFilenames[index],
@@ -101,9 +96,7 @@ const pruneAccessKeyStore = async (
   return {
     changed,
     store: {
-      accessKeys: accessKeys.filter(
-        (record): record is AccessKeyRecord => record !== null,
-      ),
+      accessKeys,
     },
   };
 };
@@ -297,10 +290,6 @@ export const createAccessKey = async ({
     throw new Error('Access key name is required');
   }
 
-  if (!normalizedCredentialFilenames.length) {
-    throw new Error('At least one credential must be selected');
-  }
-
   return mutateAccessKeyStore((store) => {
     const now = new Date().toISOString();
     const record: AccessKeyRecord = {
@@ -338,10 +327,6 @@ export const updateAccessKey = async (
     throw new Error('Access key name is required');
   }
 
-  if (!normalizedCredentialFilenames.length) {
-    throw new Error('At least one credential must be selected');
-  }
-
   return mutateAccessKeyStore((store) => {
     const record = store.accessKeys.find((item) => item.id === id);
 
@@ -375,7 +360,7 @@ export const removeCredentialReferencesFromAccessKeys = async (
 ): Promise<boolean> => {
   return mutateAccessKeyStore((store) => {
     let changed = false;
-    const accessKeys = store.accessKeys.flatMap((record) => {
+    const accessKeys = store.accessKeys.map((record) => {
       const credentialFilenames = normalizeCredentialFilenames(
         record.credentialFilenames,
       ).filter((filename) => filename !== credentialFilename);
@@ -384,11 +369,6 @@ export const removeCredentialReferencesFromAccessKeys = async (
         changed = true;
       }
 
-      if (!credentialFilenames.length) {
-        changed = true;
-        return [];
-      }
-
       if (
         credentialFilenames.some(
           (filename, index) => filename !== record.credentialFilenames[index],
@@ -397,7 +377,7 @@ export const removeCredentialReferencesFromAccessKeys = async (
         changed = true;
       }
 
-      return [{ ...record, credentialFilenames }];
+      return { ...record, credentialFilenames };
     });
 
     if (!changed) {
diff --git a/lib/server/domain/credentials.ts b/lib/server/domain/credentials.ts
index 1179380..4913db5 100644
--- a/lib/server/domain/credentials.ts
+++ b/lib/server/domain/credentials.ts
@@ -32,6 +32,7 @@ export type CredentialData = Record<string, unknown> & {
   responses_passthrough?: boolean;
   upstream_protocol?: 'chat' | 'responses';
   first_message_role_to_system?: boolean;
+  first_system_message_role_to_user?: boolean;
   supported_models?: string;
 };
 
@@ -368,7 +369,7 @@ const getEligibleRecords = (
   records: CredentialRecord[],
   allowedCredentialFilenames?: string[],
 ): CredentialRecord[] => {
-  const allowedSet = allowedCredentialFilenames?.length
+  const allowedSet = allowedCredentialFilenames
     ? new Set(allowedCredentialFilenames)
     : null;
 
@@ -479,6 +480,9 @@ export const listCredentials = async (): Promise<{
         first_message_role_to_system: getBooleanSetting(
           record.data.first_message_role_to_system,
         ),
+        first_system_message_role_to_user: getBooleanSetting(
+          record.data.first_system_message_role_to_user,
+        ),
         user_id:
           record.data.user_id ?? record.data.user_info?.email ?? 'unknown',
       };
@@ -590,6 +594,10 @@ export const addCredential = async (
       credentialData.first_message_role_to_system ??
         existingPayload.first_message_role_to_system,
     ),
+    first_system_message_role_to_user: getBooleanSetting(
+      credentialData.first_system_message_role_to_user ??
+        existingPayload.first_system_message_role_to_user,
+    ),
   };
 
   await writeStorageJson('credentials', jsonFilename, payload);
@@ -795,12 +803,16 @@ export const getCredentialProxySettings = (
   credential: CredentialData | null | undefined,
 ): {
   firstMessageRoleToSystem: boolean;
+  firstSystemMessageRoleToUser: boolean;
   upstreamProtocol: 'chat' | 'responses';
 } => {
   return {
     firstMessageRoleToSystem: getBooleanSetting(
       credential?.first_message_role_to_system,
     ),
+    firstSystemMessageRoleToUser: getBooleanSetting(
+      credential?.first_system_message_role_to_user,
+    ),
     upstreamProtocol:
       credential?.upstream_protocol === 'responses' ||
       (credential?.upstream_protocol !== 'chat' &&
diff --git a/lib/server/proxy/codebuddy.ts b/lib/server/proxy/codebuddy.ts
index 0408657..50d49a6 100644
--- a/lib/server/proxy/codebuddy.ts
+++ b/lib/server/proxy/codebuddy.ts
@@ -37,6 +37,8 @@ interface CacheableTextBlock {
 
 const MIN_AUTO_CACHE_TEXT_LENGTH = 1024;
 const MAX_STREAM_FRAME_LENGTH = 1_000_000;
+const CODEBUDDY_CLI_VERSION = '2.137.1';
+const CODEBUDDY_USER_AGENT = `CLI/${CODEBUDDY_CLI_VERSION} CodeBuddy/${CODEBUDDY_CLI_VERSION}`;
 
 export interface ChatRequestBody {
   model?: string;
@@ -115,6 +117,7 @@ export interface ProxyContext {
   credentialFilename: string | null;
   preferences: {
     firstMessageRoleToSystem: boolean;
+    firstSystemMessageRoleToUser: boolean;
     upstreamProtocol: 'chat' | 'responses';
   };
 }
@@ -560,24 +563,24 @@ const applyPromptCacheControl = (
 const normalizeMessages = (
   messages: OpenAIMessage[],
   firstMessageRoleToSystem: boolean,
+  firstSystemMessageRoleToUser: boolean,
 ): OpenAIMessage[] => {
   const filtered = messages.filter(
     (item) => item.role && item.content !== undefined,
   );
 
-  if (!firstMessageRoleToSystem) {
-    return applyPromptCacheControl(filtered);
-  }
-
-  const normalized = filtered.map((message) => {
-    if (message.role !== 'developer') {
-      return message;
+  const firstSystemIndex = firstSystemMessageRoleToUser
+    ? filtered.findIndex((message) => message.role === 'system')
+    : -1;
+  const normalized = filtered.map((message, index) => {
+    if (
+      (firstMessageRoleToSystem && message.role === 'developer') ||
+      index === firstSystemIndex
+    ) {
+      return { ...message, role: 'user' };
     }
 
-    return {
-      ...message,
-      role: 'user',
-    };
+    return message;
   });
 
   // Preserve role:'tool' messages so the OpenAI-compatible upstream
@@ -729,35 +732,31 @@ const buildUpstreamHeaders = async (
   const conversationMessageId =
     incoming['x-conversation-message-id'] ??
     crypto.randomUUID().replaceAll('-', '');
-  const headers = new Headers({
-    Accept: 'application/json',
-    Authorization: `Bearer ${auth.bearerToken}`,
-    'Content-Type': 'application/json',
-    Host: baseUrl.host,
-    'User-Agent': 'CLI/1.0.7 CodeBuddy/1.0.7',
-    'X-Agent-Intent': 'craft',
-    'X-Conversation-ID': conversationId,
-    'X-Conversation-Message-ID': conversationMessageId,
-    'X-Conversation-Request-ID': conversationRequestId,
-    'X-IDE-Name': 'CLI',
-    'X-IDE-Type': 'CLI',
-    'X-IDE-Version': '1.0.7',
-    'X-Product': 'SaaS',
-    'X-Request-ID': requestId,
-    'X-Requested-With': 'XMLHttpRequest',
-    'X-User-Id': auth.userId,
-    'x-stainless-arch': 'x64',
-    'x-stainless-lang': 'js',
-    'x-stainless-os': 'macOS',
-    'x-stainless-package-version': '5.10.1',
-    'x-stainless-retry-count': '0',
-    'x-stainless-runtime': 'node',
-    'x-stainless-runtime-version': process.version,
-  });
-
-  for (const [name, value] of Object.entries(incoming)) {
-    headers.set(name, value);
-  }
+  const headers = new Headers(incoming);
+  headers.set('Accept', 'application/json');
+  headers.set('Authorization', `Bearer ${auth.bearerToken}`);
+  headers.set('Content-Type', 'application/json');
+  headers.set('Host', baseUrl.host);
+  headers.set('User-Agent', CODEBUDDY_USER_AGENT);
+  headers.set('X-Agent-Intent', 'craft');
+  headers.set('X-Conversation-ID', conversationId);
+  headers.set('X-Conversation-Message-ID', conversationMessageId);
+  headers.set('X-Conversation-Request-ID', conversationRequestId);
+  headers.set('X-IDE-Name', 'CLI');
+  headers.set('X-IDE-Type', 'CLI');
+  headers.set('X-IDE-Version', CODEBUDDY_CLI_VERSION);
+  headers.set('X-Product', 'SaaS');
+  headers.set('X-Product-Version', CODEBUDDY_CLI_VERSION);
+  headers.set('X-Request-ID', requestId);
+  headers.set('X-Requested-With', 'XMLHttpRequest');
+  headers.set('X-User-Id', auth.userId);
+  headers.set('x-stainless-arch', process.arch);
+  headers.set('x-stainless-lang', 'js');
+  headers.set('x-stainless-os', process.platform);
+  headers.set('x-stainless-package-version', CODEBUDDY_CLI_VERSION);
+  headers.set('x-stainless-retry-count', '0');
+  headers.set('x-stainless-runtime', 'node');
+  headers.set('x-stainless-runtime-version', process.version);
 
   const domain = getCredentialValue(auth.credentialData, ['domain']);
   const enterpriseId = getCredentialValue(auth.credentialData, [
@@ -794,6 +793,7 @@ const buildUpstreamBody = async (
   const normalizedMessages = normalizeMessages(
     body.messages ?? [],
     context.preferences.firstMessageRoleToSystem,
+    context.preferences.firstSystemMessageRoleToUser,
   );
   const maxTokens = body.max_tokens ?? body.max_completion_tokens;
   const credentialModels = getCredentialSupportedModels(
@@ -2425,10 +2425,6 @@ export const proxyChatCompletions = async (
       const upstreamHeaders = new Headers(
         await buildUpstreamHeaders(request, resolvedContext.auth),
       );
-      upstreamHeaders.set('User-Agent', 'TCodex/0.0.16 CLI/0.144.5');
-      upstreamHeaders.set('X-IDE-Name', 'TCodex');
-      upstreamHeaders.set('X-IDE-Version', '0.144.5');
-      upstreamHeaders.set('X-Product-Version', '0.0.16');
       const responsesBody = {
         ...buildResponsesBodyFromChat(upstreamBody),
         stream: Boolean(body.stream),
@@ -2644,10 +2640,6 @@ export const proxyResponsesUpstream = async (
     const upstreamHeaders = new Headers(
       await buildUpstreamHeaders(request, resolvedContext.auth),
     );
-    upstreamHeaders.set('User-Agent', 'TCodex/0.0.16 CLI/0.144.5');
-    upstreamHeaders.set('X-IDE-Name', 'TCodex');
-    upstreamHeaders.set('X-IDE-Version', '0.144.5');
-    upstreamHeaders.set('X-Product-Version', '0.0.16');
 
     setDebugUpstreamRequest(debugTrace, {
       body: upstreamBody,
diff --git a/messages/en-US.json b/messages/en-US.json
index fcb1a8c..926ac67 100644
--- a/messages/en-US.json
+++ b/messages/en-US.json
@@ -239,6 +239,9 @@
       "credentialRoleAsSystemHelp": "Sends every developer message as user.",
       "credentialRoleAsSystemTag": "developer → user",
       "credentialRoleKeepDeveloper": "Keep developer",
+      "credentialFirstSystemAsUser": "Send the first system prompt as user",
+      "credentialFirstSystemAsUserHelp": "Converts only the first system message for upstreams that reject system prompts.",
+      "credentialFirstSystemAsUserTag": "First system → user",
       "credentialSectionTitle": "Saved credentials",
       "modelCredential": "Credential",
       "modelRefresh": "Refresh",
diff --git a/messages/ja-JP.json b/messages/ja-JP.json
index 4344a78..4a41dfc 100644
--- a/messages/ja-JP.json
+++ b/messages/ja-JP.json
@@ -239,6 +239,9 @@
       "credentialRoleAsSystemHelp": "すべての developer メッセージを user として送信します。",
       "credentialRoleAsSystemTag": "developer → user",
       "credentialRoleKeepDeveloper": "developer を保持",
+      "credentialFirstSystemAsUser": "最初の system prompt を user として送信",
+      "credentialFirstSystemAsUserHelp": "system prompt を受け付けない上流向けに、最初の system メッセージのみ変換します。",
+      "credentialFirstSystemAsUserTag": "最初の system → user",
       "credentialSectionTitle": "保存済み認証情報",
       "modelCredential": "認証情報",
       "modelRefresh": "更新",
diff --git a/messages/zh-CN.json b/messages/zh-CN.json
index f9fee34..71db5c9 100644
--- a/messages/zh-CN.json
+++ b/messages/zh-CN.json
@@ -235,6 +235,9 @@
       "credentialRoleAsSystemHelp": "所有 developer 消息均作为 user 发送。",
       "credentialRoleAsSystemTag": "developer → user",
       "credentialRoleKeepDeveloper": "保留 developer",
+      "credentialFirstSystemAsUser": "将首条 system prompt 作为 user 发送",
+      "credentialFirstSystemAsUserHelp": "仅转换请求中的第一条 system 消息，用于兼容不接受 system prompt 的上游。",
+      "credentialFirstSystemAsUserTag": "首条 system → user",
       "credentialSectionTitle": "已保存的凭证",
       "modelCredential": "凭据",
       "modelRefresh": "刷新",
diff --git a/tests/server/access-keys-credentials.test.ts b/tests/server/access-keys-credentials.test.ts
index a182fba..0f26f1f 100644
--- a/tests/server/access-keys-credentials.test.ts
+++ b/tests/server/access-keys-credentials.test.ts
@@ -87,7 +87,9 @@ describe('access key credential reconciliation', () => {
     expect((await deleteCredentialByIndex(refreshedSingleIndex)).success).toBe(
       true,
     );
-    expect(await findAccessKeyById(singleKey.access_key.id)).toBeNull();
+    expect(await findAccessKeyById(singleKey.access_key.id)).toMatchObject({
+      credentialFilenames: [],
+    });
   });
 
   it('prunes missing credential references while retaining corrupt ones', async () => {
@@ -126,14 +128,21 @@ describe('access key credential reconciliation', () => {
         credentialFilenames: [firstCredential.filename],
         id: 'stale-and-valid',
       }),
+      expect.objectContaining({
+        credentialFilenames: [],
+        id: 'stale-only',
+      }),
     ]);
     expect(await hasAccessKeys()).toBe(true);
-    expect(await findAccessKeyBySecret('cb2_stalesecret')).toBeNull();
+    expect(await findAccessKeyBySecret('cb2_stalesecret')).toMatchObject({
+      credentialFilenames: [],
+      id: 'stale-only',
+    });
 
     const persisted = JSON.parse(
       fs.readFileSync(path.join(tempDataDir, 'access-keys.json'), 'utf8'),
     ) as { accessKeys: Array<{ credentialFilenames: string[]; id: string }> };
-    expect(persisted.accessKeys).toHaveLength(1);
+    expect(persisted.accessKeys).toHaveLength(2);
 
     const corruptCredential = await addCredential({
       bearer_token: 'token-corrupt',
diff --git a/tests/server/anthropic.test.ts b/tests/server/anthropic.test.ts
index ff92c45..9094cf8 100644
--- a/tests/server/anthropic.test.ts
+++ b/tests/server/anthropic.test.ts
@@ -76,6 +76,7 @@ describe('anthropic messages api', () => {
   it('uses Anthropic errors and converts thinking for Responses upstream', async () => {
     const credential = await addCredential({
       bearer_token: 'anthropic-responses-token',
+      first_system_message_role_to_user: true,
       upstream_protocol: 'responses',
       user_id: 'anthropic-responses@example.com',
     });
@@ -120,6 +121,7 @@ describe('anthropic messages api', () => {
       model: 'hy3',
       max_tokens: 4096,
       messages: [{ role: 'user', content: 'Think' }],
+      system: 'Anthropic system prompt',
       stop_sequences: ['END'],
       thinking: { type: 'adaptive' },
       tool_choice: { disable_parallel_tool_use: true, type: 'auto' },
@@ -135,6 +137,16 @@ describe('anthropic messages api', () => {
     expect(
       JSON.parse(String((fetchMock.mock.calls[0]?.[1] as RequestInit).body)),
     ).toMatchObject({
+      input: [
+        {
+          content: [{ text: 'Anthropic system prompt', type: 'input_text' }],
+          role: 'user',
+        },
+        {
+          content: [{ text: 'Think', type: 'input_text' }],
+          role: 'user',
+        },
+      ],
       parallel_tool_calls: false,
       reasoning: { summary: 'auto' },
     });
diff --git a/tests/server/units.test.ts b/tests/server/units.test.ts
index 9dea633..46d90cf 100644
--- a/tests/server/units.test.ts
+++ b/tests/server/units.test.ts
@@ -976,12 +976,18 @@ describe('server units', () => {
       }),
     );
 
-    expect(await hasAccessKeys()).toBe(false);
-    expect(await findAccessKeyById('valid-id')).toBeNull();
-    expect(await findAccessKeyBySecret('shortsecret')).toBeNull();
-    expect(await getAccessKeySecret('valid-id')).toBeNull();
-    expect(await listStoredAccessKeys()).toEqual([]);
-    expect((await listAccessKeys()).access_keys).toEqual([]);
+    expect(await hasAccessKeys()).toBe(true);
+    expect(await findAccessKeyById('valid-id')).toMatchObject({
+      credentialFilenames: [],
+    });
+    expect(await findAccessKeyBySecret('shortsecret')).toMatchObject({
+      id: 'valid-id',
+    });
+    expect(await getAccessKeySecret('valid-id')).toMatchObject({
+      id: 'valid-id',
+    });
+    expect(await listStoredAccessKeys()).toHaveLength(1);
+    expect((await listAccessKeys()).access_keys).toHaveLength(1);
 
     fs.writeFileSync(path.join(tempDataDir, 'access-keys.json'), '{');
     expect(await listStoredAccessKeys()).toEqual([]);
@@ -1035,12 +1041,11 @@ describe('server units', () => {
         name: '   ',
       }),
     ).rejects.toThrow('Access key name is required');
-    await expect(
-      createAccessKey({
-        credentialFilenames: ['   '],
-        name: 'Missing Credentials',
-      }),
-    ).rejects.toThrow('At least one credential must be selected');
+    const emptyKey = await createAccessKey({
+      credentialFilenames: ['   '],
+      name: 'Missing Credentials',
+    });
+    expect(emptyKey.access_key.credentialFilenames).toEqual([]);
 
     const created = await createAccessKey({
       credentialFilenames: [
@@ -1067,9 +1072,9 @@ describe('server units', () => {
     await expect(
       updateAccessKey(created.access_key.id, {
         credentialFilenames: [],
-        name: 'Still Bad',
+        name: 'No Credentials',
       }),
-    ).rejects.toThrow('At least one credential must be selected');
+    ).resolves.toMatchObject({ credentialFilenames: [] });
     await expect(
       updateAccessKey('missing-id', {
         credentialFilenames: [firstCredential.filename],
@@ -1131,7 +1136,9 @@ describe('server units', () => {
     expect((await deleteCredentialByIndex(refreshedSingleIndex)).success).toBe(
       true,
     );
-    expect(await findAccessKeyById(singleKey.access_key.id)).toBeNull();
+    expect(await findAccessKeyById(singleKey.access_key.id)).toMatchObject({
+      credentialFilenames: [],
+    });
   });
 
   it('prunes stale credential references when reading access keys', async () => {
@@ -1170,14 +1177,21 @@ describe('server units', () => {
         credentialFilenames: [firstCredential.filename],
         id: 'stale-and-valid',
       }),
+      expect.objectContaining({
+        credentialFilenames: [],
+        id: 'stale-only',
+      }),
     ]);
     expect(await hasAccessKeys()).toBe(true);
-    expect(await findAccessKeyBySecret('cb2_stalesecret')).toBeNull();
+    expect(await findAccessKeyBySecret('cb2_stalesecret')).toMatchObject({
+      credentialFilenames: [],
+      id: 'stale-only',
+    });
 
     const persisted = JSON.parse(
       fs.readFileSync(path.join(tempDataDir, 'access-keys.json'), 'utf8'),
     ) as { accessKeys: Array<{ credentialFilenames: string[]; id: string }> };
-    expect(persisted.accessKeys).toHaveLength(1);
+    expect(persisted.accessKeys).toHaveLength(2);
   });
 
   it('supports direct credential reference cleanup helper', async () => {
@@ -1321,6 +1335,11 @@ describe('server units', () => {
     );
     expect(upstreamHeaders.get('tracestate')).toBe('vendor=value');
     expect(upstreamHeaders.get('Authorization')).toBe('Bearer token-a');
+    expect(upstreamHeaders.get('User-Agent')).toBe(
+      'CLI/2.137.1 CodeBuddy/2.137.1',
+    );
+    expect(upstreamHeaders.get('X-IDE-Version')).toBe('2.137.1');
+    expect(upstreamHeaders.get('X-Product-Version')).toBe('2.137.1');
     expect(
       JSON.parse(String((fetchMock.mock.calls[2]?.[1] as RequestInit).body))
         .max_tokens,
@@ -1422,6 +1441,14 @@ describe('server units', () => {
     expect(String(fetchMock.mock.calls[0]?.[0])).toBe(
       'https://copilot.tencent.com/responses',
     );
+    const upstreamHeaders = new Headers(
+      (fetchMock.mock.calls[0]?.[1] as RequestInit).headers,
+    );
+    expect(upstreamHeaders.get('User-Agent')).toBe(
+      'CLI/2.137.1 CodeBuddy/2.137.1',
+    );
+    expect(upstreamHeaders.get('X-IDE-Name')).toBe('CLI');
+    expect(upstreamHeaders.get('X-IDE-Version')).toBe('2.137.1');
     expect(
       JSON.parse(String((fetchMock.mock.calls[0]?.[1] as RequestInit).body)),
     ).toMatchObject({
@@ -2527,6 +2554,7 @@ describe('server units', () => {
       bearer_token: 'token-dev-role',
       created_at: Math.floor(Date.now() / 1000),
       first_message_role_to_system: true,
+      first_system_message_role_to_user: true,
       user_id: 'developer-role@example.com',
     });
 
@@ -2578,7 +2606,7 @@ describe('server units', () => {
       { role: 'user', content: 'first developer' },
       { role: 'user', content: 'hello' },
       { role: 'user', content: 'later developer' },
-      { role: 'system', content: 'existing system' },
+      { role: 'user', content: 'existing system' },
       { role: 'user', content: 'after system developer' },
     ]);
   });
@@ -3927,6 +3955,7 @@ describe('server units', () => {
     const createdCredential = await addCredential({
       bearer_token: 'token-from-bearer-token',
       first_message_role_to_system: true,
+      first_system_message_role_to_user: true,
       user_id: 'helper@example.com',
     });
 
@@ -3942,6 +3971,7 @@ describe('server units', () => {
     const created = createProxyContextFromCredential(credentialRecord);
     expect(created.auth.bearerToken).toBe('token-from-bearer-token');
     expect(created.preferences.firstMessageRoleToSystem).toBe(true);
+    expect(created.preferences.firstSystemMessageRoleToUser).toBe(true);
     expect(created.accessKeyId).toBeNull();
 
     const resolved = await resolveProxyContextByCredentialFilename(