webfetch loops through Google OAuth and times out on developer.android.com

Description

webfetch times out on public developer.android.com pages that are immediately reachable with curl. The browser-like Chrome UA used by packages/opencode/src/tool/webfetch.ts makes Android DevSite start a silent Google OAuth flow. Because webfetch has no browser cookies, the request loops through oauth2authorize -> accounts.google.com -> oauth2callback?error=interaction_required -> the original page until the fetch redirect limit/timeout is reached.

Changing only the UA to opencode returns HTTP 200. The OpenCode-User/1.0 UA fix merged in #43330 appears to cover packages/core/src/tool/plugin/webfetch.ts, but the currently shipped packages/opencode/src/tool/webfetch.ts and current dev branch still use Chrome 143.

Related stale issues: #11299 and #14453. Open PR #39757 also changes both implementations, but includes broader robots.txt behavior.

Plugins

None relevant

OpenCode version

1.18.23; confirmed the same Chrome UA remains in v1.18.25 and current dev source

Steps to reproduce

1. Run webfetch for https://developer.android.com/guide/navigation/navigation-3 or https://developer.android.com/robots.txt.
2. Observe Request timed out.
3. Fetch the same URL with curl and observe HTTP 200.
4. Reproduce with Bun/Node fetch using the Chrome 143 UA from packages/opencode/src/tool/webfetch.ts; Node eventually reports redirect count exceeded.
5. Repeat using User-Agent: opencode; observe HTTP 200.

Expected: public Android Developers pages should return normally. At minimum, both webfetch implementations should use the transparent OpenCode-User/1.0 identity from #43330 rather than the fake browser UA. Redirect-loop detection would also produce a clearer error than a timeout.

Screenshot and/or share link

N/A

Operating System

Debian GNU/Linux 13

Terminal

OpenCode web service