cloudflare-ai-gateway provider returns 401 for Workers AI models #32051

When using the cloudflare-ai-gateway provider with Workers AI models (e.g. workers-ai/@cf/google/gemma-4-26b-a4b-it), every request fails with:

Unauthorized: {"result":null,"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[]}

BYOK models (Anthropic, OpenAI) routed through the same gateway work fine.

Root cause: createUnified() is called without an apiKey, so ai-gateway-provider injects a placeholder CF_TEMP_TOKEN as the authorization header. Before sending the universal endpoint request, the package strips any header containing CF_TEMP_TOKEN (this is by design for unified billing). The result: the Workers AI sub-request arrives at the gateway with no authorization header, causing a 401.

Affected code:

• packages/core/src/plugin/provider/cloudflare-ai-gateway.ts line 27
• packages/opencode/src/provider/provider.ts line 811

Steps to reproduce:

1. Set CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_GATEWAY_ID, CLOUDFLARE_API_TOKEN
2. Add cloudflare-ai-gateway to enabled_providers
3. Select any cloudflare-ai-gateway/workers-ai/* model
4. Send a message → 401 Authentication error

OpenCode version: 1.17.4