fix(auth): route HTTPS traffic through HTTP_PROXY when no HTTPS proxy is set

crates/forge_app/src/infra.rs

@@ -315,10 +315,15 @@ pub trait OAuthHttpProvider: Send + Sync {
         config: &OAuthConfig,
         code: &str,
         verifier: Option<&str>,
+        http_config: &forge_domain::HttpConfig,
     ) -> anyhow::Result<OAuthTokenResponse>;
 
     /// Creates an HTTP client with provider-specific headers and behavior.
-    fn build_http_client(&self, config: &OAuthConfig) -> anyhow::Result<reqwest::Client>;
+    fn build_http_client(
+        &self,
+        config: &OAuthConfig,
+        http_config: &forge_domain::HttpConfig,
+    ) -> anyhow::Result<reqwest::Client>;
 }
 
 /// Authentication strategy trait

crates/forge_config/src/decimal.rs

@@ -21,7 +21,7 @@ impl std::fmt::Debug for Decimal {
 
 impl Clone for Decimal {
     fn clone(&self) -> Self {
-        Self(self.0)
+        *self
     }
 }
 

crates/forge_config/src/percentage.rs

@@ -43,7 +43,7 @@ impl std::fmt::Debug for Percentage {
 
 impl Clone for Percentage {
     fn clone(&self) -> Self {
-        Self(self.0)
+        *self
     }
 }
 

crates/forge_domain/src/context.rs

@@ -556,6 +556,7 @@ impl Context {
     /// are supported and uses the appropriate format. For models that don't
     /// support tools, use the TransformToolCalls transformer to convert the
     /// context afterward.
+    #[allow(clippy::too_many_arguments)] // Each parameter is a distinct, meaningful field from the model response; grouping them would add a wrapper struct with no semantic benefit.
     pub fn append_message(
         self,
         content: impl ToString,

crates/forge_infra/src/auth/http/anthropic.rs

@@ -66,6 +66,7 @@ impl OAuthHttpProvider for AnthropicHttpProvider {
         config: &OAuthConfig,
         code: &str,
         verifier: Option<&str>,
+        http_config: &forge_domain::HttpConfig,
     ) -> anyhow::Result<OAuthTokenResponse> {
         // Anthropic-specific token exchange
         let (code, state) = if code.contains('#') {
@@ -87,7 +88,7 @@ impl OAuthHttpProvider for AnthropicHttpProvider {
             code_verifier: verifier.to_string(),
         };
 
-        let client = self.build_http_client(config)?;
+        let client = self.build_http_client(config, http_config)?;
         let response = client
             .post(config.token_url.as_str())
             .header("Content-Type", "application/json")
@@ -105,8 +106,12 @@ impl OAuthHttpProvider for AnthropicHttpProvider {
     }
 
     /// Create HTTP client with provider-specific headers/behavior
-    fn build_http_client(&self, config: &OAuthConfig) -> anyhow::Result<reqwest::Client> {
-        build_http_client(config.custom_headers.as_ref())
+    fn build_http_client(
+        &self,
+        config: &OAuthConfig,
+        http_config: &forge_domain::HttpConfig,
+    ) -> anyhow::Result<reqwest::Client> {
+        build_http_client(config.custom_headers.as_ref(), http_config)
     }
 }
 

crates/forge_infra/src/auth/http/github.rs

@@ -19,17 +19,22 @@ impl OAuthHttpProvider for GithubHttpProvider {
         config: &OAuthConfig,
         code: &str,
         verifier: Option<&str>,
+        http_config: &forge_domain::HttpConfig,
     ) -> anyhow::Result<OAuthTokenResponse> {
         // Use standard exchange - quirks handled in HTTP client via
         // github_compliant_http_request
         StandardHttpProvider
-            .exchange_code(config, code, verifier)
+            .exchange_code(config, code, verifier, http_config)
             .await
     }
 
-    fn build_http_client(&self, config: &OAuthConfig) -> anyhow::Result<reqwest::Client> {
+    fn build_http_client(
+        &self,
+        config: &OAuthConfig,
+        http_config: &forge_domain::HttpConfig,
+    ) -> anyhow::Result<reqwest::Client> {
         // GitHub quirk: HTTP 200 responses may contain errors
         // This is handled by the github_compliant_http_request function
-        build_http_client(config.custom_headers.as_ref())
+        build_http_client(config.custom_headers.as_ref(), http_config)
     }
 }

crates/forge_infra/src/auth/http/standard.rs

@@ -57,6 +57,7 @@ impl OAuthHttpProvider for StandardHttpProvider {
         config: &OAuthConfig,
         code: &str,
         verifier: Option<&str>,
+        http_config: &forge_domain::HttpConfig,
     ) -> anyhow::Result<OAuthTokenResponse> {
         use oauth2::{AuthUrl, ClientId, TokenUrl};
 
@@ -69,7 +70,7 @@ impl OAuthHttpProvider for StandardHttpProvider {
             client = client.set_redirect_uri(oauth2::RedirectUrl::new(redirect_uri.clone())?);
         }
 
-        let http_client = self.build_http_client(config)?;
+        let http_client = self.build_http_client(config, http_config)?;
 
         let mut request = client.exchange_code(OAuth2AuthCode::new(code.to_string()));
 
@@ -82,8 +83,12 @@ impl OAuthHttpProvider for StandardHttpProvider {
     }
 
     /// Create HTTP client with provider-specific headers/behavior
-    fn build_http_client(&self, config: &OAuthConfig) -> anyhow::Result<reqwest::Client> {
-        build_http_client(config.custom_headers.as_ref())
+    fn build_http_client(
+        &self,
+        config: &OAuthConfig,
+        http_config: &forge_domain::HttpConfig,
+    ) -> anyhow::Result<reqwest::Client> {
+        build_http_client(config.custom_headers.as_ref(), http_config)
     }
 }