[BUG] Cloudflare 1010 blocks OpenAI Codex CLI from OpenCode Go API → "stream disconnected ... error decoding response body"

[Miracle-Tang]

Description

The OpenCode Go API (https://opencode.ai/zen/go/v1) is intermittently inaccessible from the OpenAI Codex CLI because Cloudflare returns HTTP 403 error 1010 ("The owner of this website (opencode.ai) has banned your access based on your browser's signature") for requests that fail bot detection. Since Codex CLI expects a JSON/SSE response, the HTML block page surfaces as:

stream disconnected before completion: Transport error: network error: error decoding response body

followed by automatic retries (retrying 1/5, 2/5, ...). The retries usually succeed eventually, but the failure rate is high enough to be disruptive.

This is the same root cause as #24284 (Copilot extension hitting Cloudflare 1010 on the same endpoint). The Copilot workaround was to set a browser-like User-Agent header — but Codex CLI does not expose a way to override the User-Agent for model API requests, so that workaround is not available here. A proxy also does not help because the block is based on the client signature (UA/TLS fingerprint), not the IP.

Environment

• OpenAI Codex CLI / Codex Desktop: codex-cli 0.147.0-alpha.6.5 (macOS arm64)
• OpenCode Go subscription, API key from OpenCode Zen
• Custom provider config:

  [model_providers.custom]
  name = "OpenCode Go"
  base_url = "https://opencode.ai/zen/go/v1"
  wire_api = "responses"
  requires_openai_auth = true

• Model: deepseek-v4-flash

Steps to reproduce

1. Configure Codex CLI with the OpenCode Go custom provider above.
2. Start a session and send a prompt (long agent turns with tool calls / reasoning make it more frequent).
3. Observe intermittent stream disconnected before completion: Transport error: network error: error decoding response body, then automatic retries.

Evidence

• Reproduced locally: a plain HTTP client with a non-browser default User-Agent (Python-urllib/3.x) gets HTTP 403 with body error code: 1010 from https://opencode.ai/zen/go/v1/responses.
• Same request with a browser-like or curl User-Agent returns 200 and streams normally (event: response.created, etc.).
• The codex-cli/* User-Agent mostly passes, but the block is intermittent from certain network paths (e.g. China mainland → Cloudflare US edges), which matches the reported high retry frequency.
• Related: unable to use opencode go API with copilot #24284 — Cloudflare 1010 "Access denied" HTML page on opencode.ai/zen/go/v1/* for a CLI client.

Expected behavior

Official/well-known CLI clients such as the OpenAI Codex CLI should be able to use the documented OpenAI-compatible endpoints (/zen/go/v1/responses, /zen/go/v1/chat/completions) without being blocked by Cloudflare's browser-signature WAF rule, i.e.:

• Whitelist the official codex-cli/* User-Agent (and TLS signature) on opencode.ai/zen/* API paths, or
• Relax/disable the 1010 browser-signature rule for /zen/* API endpoints (they are API paths, not browser pages), or
• Document supported User-Agent header values / a supported-client allowlist for third-party clients.

Actual behavior

Intermittent 403 error 1010 HTML responses → Codex CLI fails to decode the response body → repeated automatic retries → slow/unstable agent sessions.

Workaround currently used

• Explicitly routing Codex through a local Clash proxy (still intermittent, because the block is client-signature based).
• Relying on Codex CLI's automatic retries (frequently needed).

Operating System

macOS (arm64)

Terminal

Codex CLI / Codex Desktop

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• HTTP Error 403: Forbidden if user agent starts with Python-urllib #39374: Same root cause — Cloudflare WAF on opencode.ai/zen/go/v1 returns HTTP 403 based on the client's User-Agent signature (Python-urllib in that case; codex-cli/* here intermittently). Both trace back to the same bot-detection rule on the API path.
• unable to use opencode go API with copilot #24284: Copilot extension hitting Cloudflare 1010 on the same endpoint (closed, already referenced in your report).
• OpenCode Go service (zen/go/v1) frequent intermittent outages — HTTP 000 / 503 / Cloudflare 524 #36889: Broader intermittent outages on the same zen/go/v1 service (HTTP 000 / 503 / Cloudflare 524).

If your issue is specifically the User-Agent/TLS-fingerprint WAF block (1010) rather than general outages, #39374 is the closest match. You may want to add your findings there instead.