Send per-install id to the wpcom AI proxy

[gcsecsey]

Related issues

• Related to STU-2147
• Related to 231063-ghe-Automattic/wpcom

How AI was used in this PR

I used Claude to locate the existing per-install identifier and the single place Studio attaches the AI proxy headers, write the change and tests, and verify the typecheck and the affected suites. I reviewed the identifier choice, the spoofability tradeoff, and the logic.

Proposed Changes

In 231063-ghe-Automattic/wpcom we added caps to curb Studio Code abuse where single users ran many parallel agent turns. This PR sends a X-WPCOM-AI-Install-Id header:

• Reuses the existing anonymous per-install UUID (the Tracks install id already shared by Studio and the CLI) rather than minting a new identifier. It is a random UUID with nothing user-identifying, which is what the server expects.
• Sends the header on both the Anthropic and OpenAI proxy lanes.
• Empty or absent is handled gracefully, so this is safe to ship in any order relative to the wpcom deploy. A shared-config read hiccup simply omits the header instead of failing the AI request.

Tradeoff worth calling out

The header is client-supplied, and Studio's bundle is not obfuscated, so it is trivially spoofable. It bounds accidental fan-out from a single install, not a determined abuser. The per-account cap is what holds when this value is rotated or absent.

Testing Instructions

• Run the affected unit tests: npm test -- apps/cli/ai/tests/auth.test.ts
• Optionally exercise it end to end: log the app into WordPress.com, start a Studio Code session against the wpcom provider, and confirm the outbound AI proxy requests carry X-WPCOM-AI-Install-Id set to the analyticsInstallId value in ~/.studio/shared.json.
• Once the wpcom side is deployed, sending more than 15 AI requests within 10 seconds from one install returns HTTP 429 with X-Burst-Limit-Reached: install.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[Copilot]

Pull request overview

This PR updates the Studio CLI’s WP.com AI proxy integration to send a per-install identifier (X-WPCOM-AI-Install-Id) derived from the existing shared anonymous analytics install UUID, enabling WP.com to apply per-install burst caps across both Anthropic and OpenAI proxy lanes.

Changes:

• Add X-WPCOM-AI-Install-Id to the WP.com AI proxy headers for both Anthropic and OpenAI request paths.
• Make the install-id lookup best-effort (failures omit the header rather than failing the AI request).
• Extend unit tests to cover inclusion and omission behavior for the new header.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
apps/cli/ai/providers.ts	Resolves the shared analytics install UUID and conditionally attaches it as X-WPCOM-AI-Install-Id to WP.com AI proxy headers (Anthropic + OpenAI).
apps/cli/ai/tests/auth.test.ts	Updates and adds tests asserting the install-id header is included when available and omitted when the shared-config lookup fails.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.