git:20261001.16d222b to git:20261004.8e8554b

---

description: Every provider request follows providers[].proxy

- internal/llm/**/*.go

- external/httpserver/*auth*_http.go

- cmd/coddy/codex.go

- cmd/coddy/devin.go

- cmd/coddy/providers.go

---

# Provider transport and proxy boundary

Every outbound request belonging to an LLM provider — completions, streams,

model discovery, account usage, OAuth/device sign-in, token refresh, revoke,

and any provider added later — must follow that row's `providers[].proxy`

setting.

- Production provider helpers accept the row's proxy setting and build their

client through `llm.HTTPClientForProviderProxy`; do not use

`http.DefaultClient`, `&http.Client{}`, `http.Get`, `http.Post`, or

`http.Head` in a provider path.

- A helper that needs a custom `*http.Client` only as a test seam must reject

`nil`; nil must never silently fall back to a direct/environment client.

- Settings sign-in starts before Save. If the form carries an unsaved `proxy`,

apply it after resolving the row, including when the saved row has another

provider type. An absent field retains the row value; `""` / `inherit`

inherit the process proxy; `none` goes direct; invalid settings return 400.

- When changing provider transport, extend `features/provider_proxy.feature`

and `internal/llm/bdd_provider_proxy_test.go` for every new request class,

and keep `TestProviderProxyGuard` green.