dev_agentandClaude Opus 5.5
bb0a9c3129
The provider HTTP client now has a redirect policy: every redirect target must pass secureurl.Check, and an https:// request never follows a redirect to plain http://, so a 307/308 from the token endpoint cannot resend the client secret in plaintext. Transport errors from the code exchange no longer include the (possibly provider-supplied) URL. The callback's provider-error path logs a fixed category instead of the raw error and error_description query values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>