From 834524d626ebe3df3d8c1e3b2aa8b7636d5e3e0f Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 23:50:28 +0000
Subject: [PATCH 01/11] fix(webview): prevent CSP injection through OpenRouter
 URLs

<!-- coderabbit-ai-generated:v1 -->
---
 src/core/webview/ClineProvider.ts             | 13 +++---
 .../webview/__tests__/ClineProvider.spec.ts   | 44 +++++++++++++++++++
 src/core/webview/webviewCsp.ts                | 19 ++++++++
 3 files changed, 68 insertions(+), 8 deletions(-)
 create mode 100644 src/core/webview/webviewCsp.ts

diff --git a/src/core/webview/ClineProvider.ts b/src/core/webview/ClineProvider.ts
index 6cec3bdbe7..1bd953f059 100644
--- a/src/core/webview/ClineProvider.ts
+++ b/src/core/webview/ClineProvider.ts
@@ -154,6 +154,7 @@ import {
 import { readTaskMessages } from "../task-persistence/taskMessages"
 import { readFileWithMissingRetry } from "../task-persistence/readFileWithMissingRetry"
 import { getNonce } from "./getNonce"
+import { getOpenRouterCspOrigin, escapeCspAttribute } from "./webviewCsp"
 import { getUri } from "./getUri"
 import { omitOriginalContentFromExtensionMessage } from "./stripOriginalContent"
 import { REQUESTY_BASE_URL } from "../../shared/utils/requesty"
@@ -1848,9 +1849,7 @@ export class ClineProvider
 
 		// Get the OpenRouter base URL from configuration
 		const { apiConfiguration } = await this.getState()
-		const openRouterBaseUrl = apiConfiguration.openRouterBaseUrl || "https://openrouter.ai"
-		// Extract the domain for CSP
-		const openRouterDomain = openRouterBaseUrl.match(/^(https?:\/\/[^/]+)/)?.[1] || "https://openrouter.ai"
+		const openRouterDomain = getOpenRouterCspOrigin(apiConfiguration.openRouterBaseUrl)
 
 		const stylesUri = getUri(webview, this.contextProxy.extensionUri, [
 			"webview-ui",
@@ -1897,7 +1896,7 @@ export class ClineProvider
 				<head>
 					<meta charset="utf-8">
 					<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
-					<meta http-equiv="Content-Security-Policy" content="${csp.join("; ")}">
+					<meta http-equiv="Content-Security-Policy" content="${escapeCspAttribute(csp.join("; "))}">
 					<link rel="stylesheet" type="text/css" href="${stylesUri}">
 					<link href="${codiconsUri}" rel="stylesheet" />
 					<script nonce="${nonce}">
@@ -1964,9 +1963,7 @@ export class ClineProvider
 
 		// Get the OpenRouter base URL from configuration
 		const { apiConfiguration } = await this.getState()
-		const openRouterBaseUrl = apiConfiguration.openRouterBaseUrl || "https://openrouter.ai"
-		// Extract the domain for CSP
-		const openRouterDomain = openRouterBaseUrl.match(/^(https?:\/\/[^/]+)/)?.[1] || "https://openrouter.ai"
+		const openRouterDomain = getOpenRouterCspOrigin(apiConfiguration.openRouterBaseUrl)
 
 		// Tip: Install the es6-string-html VS Code extension to enable code highlighting below
 		return /*html*/ `
@@ -1976,7 +1973,7 @@ export class ClineProvider
             <meta charset="utf-8">
             <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
             <meta name="theme-color" content="#000000">
-            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com https://avatars.githubusercontent.com https://lh3.googleusercontent.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic'; connect-src ${webview.cspSource} ${openRouterDomain} https://api.requesty.ai https://us.i.posthog.com;">
+            <meta http-equiv="Content-Security-Policy" content="${escapeCspAttribute(`default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com https://avatars.githubusercontent.com https://lh3.googleusercontent.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic'; connect-src ${webview.cspSource} ${openRouterDomain} https://api.requesty.ai https://us.i.posthog.com;`)}">
             <link rel="stylesheet" type="text/css" href="${stylesUri}">
 			<link href="${codiconsUri}" rel="stylesheet" />
 			<script nonce="${nonce}">
diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index 464889418e..1e6b48740f 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -3052,6 +3052,50 @@ describe("ClineProvider", () => {
 		})
 	})
 
+	test("escapes the complete CSP attribute in production and HMR HTML", async () => {
+		vi.mocked(axios.get).mockResolvedValue({ data: "" })
+		const webview = { ...mockWebviewView.webview, cspSource: 'https://test/?x=&quot;"><tag>' }
+		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
+			const html = await provider[build](webview)
+			const csp = html.match(/http-equiv="Content-Security-Policy" content="([^"]*)"/)?.[1]
+			expect(csp).toContain("https://test/?x=&amp;quot;&quot;&gt;&lt;tag&gt;")
+			expect(csp).not.toMatch(/[<>]/)
+		}
+	})
+
+	test.each([
+		[undefined, "https://openrouter.ai"],
+		["https://user:password@EXAMPLE.com:8443/api/v1?key=secret#fragment", "https://example.com:8443"],
+		["http://localhost:3000/api/v1", "http://localhost:3000"],
+		["http://[::1]:3000/api", "http://[::1]:3000"],
+		['https://example.com/path;script-src?x="><script>attack()</script>', "https://example.com"],
+		["https://example.com;script-src", "https://openrouter.ai"],
+		[`https://example.com; script-src-elem 'unsafe-inline'"><script>attack()</script>`, "https://openrouter.ai"],
+		["https://example.com'", "https://openrouter.ai"],
+		['https://example.com"><script>attack()</script>', "https://openrouter.ai"],
+		["javascript:attack()", "https://openrouter.ai"],
+		["file:///tmp/test", "https://openrouter.ai"],
+		["invalid", "https://openrouter.ai"],
+	])("builds safe production and HMR CSPs for endpoint %s", async (baseUrl, origin) => {
+		const state = await provider.getState()
+		vi.spyOn(provider, "getState").mockResolvedValue({
+			...state,
+			apiConfiguration: { ...state.apiConfiguration, openRouterBaseUrl: baseUrl },
+		})
+		vi.mocked(axios.get).mockResolvedValue({ data: "" })
+
+		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
+			const html = await provider[build](mockWebviewView.webview)
+			const csp = html.match(/http-equiv="Content-Security-Policy" content="([^"]*)"/)?.[1]
+			expect(csp).toBeDefined()
+			expect(csp).toContain(`connect-src vscode-webview://test-csp-source ${origin} `)
+			expect(csp?.match(/script-src /g)).toHaveLength(1)
+			expect(csp).toContain("'nonce-")
+			expect(html).not.toContain("attack()")
+			expect(html).not.toContain("password")
+		}
+	})
+
 	test("resolveWebviewView sets up webview correctly in development mode even if local server is not running", async () => {
 		const developmentContext = { ...mockContext, extensionMode: vscode.ExtensionMode.Development }
 		provider = new ClineProvider(
diff --git a/src/core/webview/webviewCsp.ts b/src/core/webview/webviewCsp.ts
new file mode 100644
index 0000000000..0969ca1a40
--- /dev/null
+++ b/src/core/webview/webviewCsp.ts
@@ -0,0 +1,19 @@
+/** Return one CSP source, never configuration-supplied policy or markup. */
+export function getOpenRouterCspOrigin(baseUrl?: string): string {
+	try {
+		const url = new URL(baseUrl || "https://openrouter.ai")
+		// URL hostnames can contain CSP delimiters such as semicolons and quotes.
+		// Allow DNS names, IPv4 and bracketed IPv6, including local proxy hosts.
+		if ((url.protocol === "https:" || url.protocol === "http:") && /^[a-z0-9._:[\]-]+$/i.test(url.hostname)) {
+			return url.origin
+		}
+	} catch {
+		// Invalid endpoints must not prevent the webview from rendering safely.
+	}
+	return "https://openrouter.ai"
+}
+
+/** Escape a complete CSP for a double-quoted HTML attribute. */
+export function escapeCspAttribute(policy: string): string {
+	return policy.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+}

From 1638b42f214dc623196c9a983afbd2756fce64bf Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sat, 14 Nov 2026 19:55:38 +0000
Subject: [PATCH 02/11] test(webview): add unit coverage for webviewCsp helpers

---
 .../webview/__tests__/ClineProvider.spec.ts   | 36 ++++++------
 src/core/webview/__tests__/webviewCsp.spec.ts | 57 +++++++++++++++++++
 2 files changed, 74 insertions(+), 19 deletions(-)
 create mode 100644 src/core/webview/__tests__/webviewCsp.spec.ts

diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index 1e6b48740f..bf489e9dc8 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -3057,38 +3057,36 @@ describe("ClineProvider", () => {
 		const webview = { ...mockWebviewView.webview, cspSource: 'https://test/?x=&quot;"><tag>' }
 		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
 			const html = await provider[build](webview)
-			const csp = html.match(/http-equiv="Content-Security-Policy" content="([^"]*)"/)?.[1]
+			// Capture through the stylesheet link so a raw quote in any cspSource cannot truncate the check.
+			const csp = html.match(
+				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
+			)?.[1]
 			expect(csp).toContain("https://test/?x=&amp;quot;&quot;&gt;&lt;tag&gt;")
-			expect(csp).not.toMatch(/[<>]/)
+			expect(csp).not.toMatch(/["<>]/)
 		}
 	})
 
-	test.each([
-		[undefined, "https://openrouter.ai"],
-		["https://user:password@EXAMPLE.com:8443/api/v1?key=secret#fragment", "https://example.com:8443"],
-		["http://localhost:3000/api/v1", "http://localhost:3000"],
-		["http://[::1]:3000/api", "http://[::1]:3000"],
-		['https://example.com/path;script-src?x="><script>attack()</script>', "https://example.com"],
-		["https://example.com;script-src", "https://openrouter.ai"],
-		[`https://example.com; script-src-elem 'unsafe-inline'"><script>attack()</script>`, "https://openrouter.ai"],
-		["https://example.com'", "https://openrouter.ai"],
-		['https://example.com"><script>attack()</script>', "https://openrouter.ai"],
-		["javascript:attack()", "https://openrouter.ai"],
-		["file:///tmp/test", "https://openrouter.ai"],
-		["invalid", "https://openrouter.ai"],
-	])("builds safe production and HMR CSPs for endpoint %s", async (baseUrl, origin) => {
+	test("builds the production and HMR CSPs from the webviewCsp helpers", async () => {
 		const state = await provider.getState()
 		vi.spyOn(provider, "getState").mockResolvedValue({
 			...state,
-			apiConfiguration: { ...state.apiConfiguration, openRouterBaseUrl: baseUrl },
+			apiConfiguration: {
+				...state.apiConfiguration,
+				// The origin helper must strip credentials and paths; the escape helper must escape quotes.
+				openRouterBaseUrl:
+					'https://user:password@example.com:8443/api;script-src?x="><script>attack()</script>',
+			},
 		})
 		vi.mocked(axios.get).mockResolvedValue({ data: "" })
 
 		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
 			const html = await provider[build](mockWebviewView.webview)
-			const csp = html.match(/http-equiv="Content-Security-Policy" content="([^"]*)"/)?.[1]
+			const csp = html.match(
+				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
+			)?.[1]
 			expect(csp).toBeDefined()
-			expect(csp).toContain(`connect-src vscode-webview://test-csp-source ${origin} `)
+			// The host survives with its port; credentials, path and payload do not.
+			expect(csp).toContain("connect-src vscode-webview://test-csp-source https://example.com:8443 ")
 			expect(csp?.match(/script-src /g)).toHaveLength(1)
 			expect(csp).toContain("'nonce-")
 			expect(html).not.toContain("attack()")
diff --git a/src/core/webview/__tests__/webviewCsp.spec.ts b/src/core/webview/__tests__/webviewCsp.spec.ts
new file mode 100644
index 0000000000..937704bcf9
--- /dev/null
+++ b/src/core/webview/__tests__/webviewCsp.spec.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest"
+
+import { escapeCspAttribute, getOpenRouterCspOrigin } from "../webviewCsp"
+
+describe("getOpenRouterCspOrigin", () => {
+	it.each([
+		[undefined, "https://openrouter.ai"],
+		["https://openrouter.ai/api/v1", "https://openrouter.ai"],
+		// Credentials, paths, queries and fragments are stripped, not echoed.
+		["https://user:password@EXAMPLE.com:8443/api/v1?key=secret#fragment", "https://example.com:8443"],
+		// Local proxy hosts, IPv4 and bracketed IPv6 stay allowed.
+		["http://localhost:3000/api/v1", "http://localhost:3000"],
+		["http://127.0.0.1:3000/api", "http://127.0.0.1:3000"],
+		["http://[::1]:3000/api", "http://[::1]:3000"],
+		["http://my_proxy:8080", "http://my_proxy:8080"],
+		// CSP delimiters and markup in the path or host fall back to the default.
+		['https://example.com/path;script-src?x="><script>attack()</script>', "https://example.com"],
+		["https://example.com;script-src", "https://openrouter.ai"],
+		[`https://example.com; script-src-elem 'unsafe-inline'"><script>attack()</script>`, "https://openrouter.ai"],
+		["https://example.com'", "https://openrouter.ai"],
+		['https://example.com"><script>attack()</script>', "https://openrouter.ai"],
+		// The hostname regex rejects wildcard and list syntax that CSP would misread.
+		["https://*.example.com", "https://openrouter.ai"],
+		["https://a,b.com", "https://openrouter.ai"],
+		// The protocol allowlist rejects non-http(s) schemes before the host is read.
+		["javascript:attack()", "https://openrouter.ai"],
+		["file:///tmp/test", "https://openrouter.ai"],
+		["ftp://example.com", "https://openrouter.ai"],
+		["ws://example.com", "https://openrouter.ai"],
+		// Malformed input falls back to the default.
+		["invalid", "https://openrouter.ai"],
+		["", "https://openrouter.ai"],
+	])("maps endpoint %s to origin %s", (baseUrl, origin) => {
+		expect(getOpenRouterCspOrigin(baseUrl)).toBe(origin)
+	})
+})
+
+describe("escapeCspAttribute", () => {
+	it.each([
+		["&", "&amp;"],
+		['"', "&quot;"],
+		["<", "&lt;"],
+		[">", "&gt;"],
+	])("escapes %s as %s", (raw, escaped) => {
+		expect(escapeCspAttribute(`a ${raw} b`)).toBe(`a ${escaped} b`)
+	})
+
+	it("leaves safe characters unchanged", () => {
+		expect(escapeCspAttribute("default-src 'none'; script-src 'nonce-abc'")).toBe(
+			"default-src 'none'; script-src 'nonce-abc'",
+		)
+	})
+
+	it("escapes every character so no raw markup survives", () => {
+		expect(escapeCspAttribute('&"><script>')).toBe("&amp;&quot;&gt;&lt;script&gt;")
+	})
+})

From db4e921237a18ccf39fcf17ae4c80998809a7eab Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sat, 14 Nov 2026 20:13:09 +0000
Subject: [PATCH 03/11] test(webview): prove CSP origin rejection through both
 HTML builders

Add a three-row matrix that runs undefined, a rejected hostname and a
rejected protocol through getHtmlContent and getHMRHtmlContent. Each
case asserts the default origin appears in connect-src and the rejected
value does not. The accept-path test alone cannot catch a builder that
skips hostname or protocol validation.
---
 .../webview/__tests__/ClineProvider.spec.ts   | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index bf489e9dc8..57e2928750 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -3094,6 +3094,32 @@ describe("ClineProvider", () => {
 		}
 	})
 
+	// Rejection must also hold through the builders, not only in the pure helper.
+	test.each([
+		[undefined, null],
+		["https://example.com;script-src", "https://example.com;script-src"],
+		["ftp://example.com", "ftp://example.com"],
+	])("falls back to the default origin for endpoint %s in both HTML builders", async (baseUrl, rejectedValue) => {
+		const state = await provider.getState()
+		vi.spyOn(provider, "getState").mockResolvedValue({
+			...state,
+			apiConfiguration: { ...state.apiConfiguration, openRouterBaseUrl: baseUrl },
+		})
+		vi.mocked(axios.get).mockResolvedValue({ data: "" })
+
+		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
+			const html = await provider[build](mockWebviewView.webview)
+			const csp = html.match(
+				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
+			)?.[1]
+			expect(csp).toBeDefined()
+			expect(csp).toContain("connect-src vscode-webview://test-csp-source https://openrouter.ai ")
+			if (rejectedValue) {
+				expect(csp).not.toContain(rejectedValue)
+			}
+		}
+	})
+
 	test("resolveWebviewView sets up webview correctly in development mode even if local server is not running", async () => {
 		const developmentContext = { ...mockContext, extensionMode: vscode.ExtensionMode.Development }
 		provider = new ClineProvider(

From 87fa28817ef42110316e1a26fe8bd6e6776c0899 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sat, 14 Nov 2026 20:43:10 +0000
Subject: [PATCH 04/11] test(webview): cover hyphenated host and quote-only
 rejection

Add a hyphenated hostname row so removing the trailing hyphen from the
hostname class fails the suite. Add a quote-only hostname row that the
URL parser accepts, so only the hostname regex can reject it. Reword a
provider test comment that credited the escape helper for work the
origin helper does.
---
 src/core/webview/__tests__/ClineProvider.spec.ts | 2 +-
 src/core/webview/__tests__/webviewCsp.spec.ts    | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index 57e2928750..a4744cafd6 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -3072,7 +3072,7 @@ describe("ClineProvider", () => {
 			...state,
 			apiConfiguration: {
 				...state.apiConfiguration,
-				// The origin helper must strip credentials and paths; the escape helper must escape quotes.
+				// The origin helper must strip credentials and paths. The cspSource test covers escaping.
 				openRouterBaseUrl:
 					'https://user:password@example.com:8443/api;script-src?x="><script>attack()</script>',
 			},
diff --git a/src/core/webview/__tests__/webviewCsp.spec.ts b/src/core/webview/__tests__/webviewCsp.spec.ts
index 937704bcf9..4ebe92d7b7 100644
--- a/src/core/webview/__tests__/webviewCsp.spec.ts
+++ b/src/core/webview/__tests__/webviewCsp.spec.ts
@@ -13,12 +13,15 @@ describe("getOpenRouterCspOrigin", () => {
 		["http://127.0.0.1:3000/api", "http://127.0.0.1:3000"],
 		["http://[::1]:3000/api", "http://[::1]:3000"],
 		["http://my_proxy:8080", "http://my_proxy:8080"],
+		["https://my-proxy.example.com:8443/api", "https://my-proxy.example.com:8443"],
 		// CSP delimiters and markup in the path or host fall back to the default.
 		['https://example.com/path;script-src?x="><script>attack()</script>', "https://example.com"],
 		["https://example.com;script-src", "https://openrouter.ai"],
 		[`https://example.com; script-src-elem 'unsafe-inline'"><script>attack()</script>`, "https://openrouter.ai"],
 		["https://example.com'", "https://openrouter.ai"],
 		['https://example.com"><script>attack()</script>', "https://openrouter.ai"],
+		// Only the hostname regex rejects this quote; the URL parses without it.
+		['https://example.com"', "https://openrouter.ai"],
 		// The hostname regex rejects wildcard and list syntax that CSP would misread.
 		["https://*.example.com", "https://openrouter.ai"],
 		["https://a,b.com", "https://openrouter.ai"],

From dd09f9151933512f606921e0603149f39bc61e25 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 00:25:38 +0000
Subject: [PATCH 05/11] fix(webview): move provider lookups to the extension
 host

---
 packages/types/src/vscode-extension-host.ts   |  11 +
 src/core/webview/ClineProvider.ts             |  15 +-
 .../webview/__tests__/ClineProvider.spec.ts   |  98 +++------
 .../__tests__/providerInfoHandler.spec.ts     | 168 +++++++++++++++
 src/core/webview/__tests__/webviewCsp.spec.ts |  60 ------
 src/core/webview/providerInfoHandler.ts       | 195 ++++++++++++++++++
 src/core/webview/webviewCsp.ts                |  19 --
 src/core/webview/webviewMessageHandler.ts     |   4 +
 .../__tests__/providerInfoHooks.spec.tsx      | 173 ++++++++++++++++
 .../__tests__/useOpenRouterKeyInfo.spec.tsx   | 123 -----------
 .../useOpenRouterModelProviders.spec.tsx      | 190 -----------------
 .../__tests__/useRequestyKeyInfo.spec.tsx     | 122 -----------
 .../ui/hooks/requestProviderInfo.ts           |  38 ++++
 .../ui/hooks/useOpenRouterKeyInfo.ts          |  49 +----
 .../ui/hooks/useOpenRouterModelProviders.ts   |  86 +-------
 .../components/ui/hooks/useRequestyKeyInfo.ts |  43 +---
 webview-ui/src/utils/test-utils.tsx           |  33 ---
 17 files changed, 648 insertions(+), 779 deletions(-)
 create mode 100644 src/core/webview/__tests__/providerInfoHandler.spec.ts
 delete mode 100644 src/core/webview/__tests__/webviewCsp.spec.ts
 create mode 100644 src/core/webview/providerInfoHandler.ts
 delete mode 100644 src/core/webview/webviewCsp.ts
 create mode 100644 webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
 delete mode 100644 webview-ui/src/components/ui/hooks/__tests__/useOpenRouterKeyInfo.spec.tsx
 delete mode 100644 webview-ui/src/components/ui/hooks/__tests__/useOpenRouterModelProviders.spec.tsx
 delete mode 100644 webview-ui/src/components/ui/hooks/__tests__/useRequestyKeyInfo.spec.tsx
 create mode 100644 webview-ui/src/components/ui/hooks/requestProviderInfo.ts

diff --git a/packages/types/src/vscode-extension-host.ts b/packages/types/src/vscode-extension-host.ts
index 8a006c0639..c58ab6145c 100644
--- a/packages/types/src/vscode-extension-host.ts
+++ b/packages/types/src/vscode-extension-host.ts
@@ -27,6 +27,15 @@ import type { WorktreeIncludeStatus } from "./worktree.js"
  * ExtensionMessage
  * Extension -> Webview | CLI
  */
+/** Provider lookups the extension host runs for the webview, keeping provider origins out of the CSP. */
+export type ProviderInfoKind = "openRouterKeyInfo" | "openRouterModelProviders" | "requestyKeyInfo"
+
+export interface ProviderInfoParams {
+	apiKey?: string
+	baseUrl?: string
+	modelId?: string
+}
+
 export interface ExtensionMessage {
 	type:
 		| "action"
@@ -66,6 +75,7 @@ export interface ExtensionMessage {
 		| "ttsStart"
 		| "ttsStop"
 		| "fileSearchResults"
+		| "providerInfo"
 		| "toggleApiConfigPin"
 		| "acceptInput"
 		| "setHistoryPreviewCollapsed"
@@ -549,6 +559,7 @@ export interface WebviewMessage {
 		| "resetState"
 		| typeof RouterModelsMessageType.flushRouterModels
 		| typeof RouterModelsMessageType.requestRouterModels
+		| "requestProviderInfo"
 		| typeof OpenAiModelsMessageType.requestOpenAiModels
 		| typeof OllamaModelsMessageType.requestOllamaModels
 		| typeof LmStudioModelsMessageType.requestLmStudioModels
diff --git a/src/core/webview/ClineProvider.ts b/src/core/webview/ClineProvider.ts
index 1bd953f059..333c646ff9 100644
--- a/src/core/webview/ClineProvider.ts
+++ b/src/core/webview/ClineProvider.ts
@@ -154,7 +154,6 @@ import {
 import { readTaskMessages } from "../task-persistence/taskMessages"
 import { readFileWithMissingRetry } from "../task-persistence/readFileWithMissingRetry"
 import { getNonce } from "./getNonce"
-import { getOpenRouterCspOrigin, escapeCspAttribute } from "./webviewCsp"
 import { getUri } from "./getUri"
 import { omitOriginalContentFromExtensionMessage } from "./stripOriginalContent"
 import { REQUESTY_BASE_URL } from "../../shared/utils/requesty"
@@ -1847,10 +1846,6 @@ export class ClineProvider
 
 		const nonce = getNonce()
 
-		// Get the OpenRouter base URL from configuration
-		const { apiConfiguration } = await this.getState()
-		const openRouterDomain = getOpenRouterCspOrigin(apiConfiguration.openRouterBaseUrl)
-
 		const stylesUri = getUri(webview, this.contextProxy.extensionUri, [
 			"webview-ui",
 			"build",
@@ -1887,7 +1882,7 @@ export class ClineProvider
 			`img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com https://avatars.githubusercontent.com https://lh3.googleusercontent.com data:`,
 			`media-src ${webview.cspSource}`,
 			`script-src 'unsafe-eval' ${webview.cspSource} https://*.posthog.com http://${localServerUrl} http://0.0.0.0:${localPort} 'nonce-${nonce}'`,
-			`connect-src ${webview.cspSource} ${openRouterDomain} https://* https://*.posthog.com ws://${localServerUrl} ws://0.0.0.0:${localPort} http://${localServerUrl} http://0.0.0.0:${localPort}`,
+			`connect-src ${webview.cspSource} https://* https://*.posthog.com ws://${localServerUrl} ws://0.0.0.0:${localPort} http://${localServerUrl} http://0.0.0.0:${localPort}`,
 		]
 
 		return /*html*/ `
@@ -1896,7 +1891,7 @@ export class ClineProvider
 				<head>
 					<meta charset="utf-8">
 					<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
-					<meta http-equiv="Content-Security-Policy" content="${escapeCspAttribute(csp.join("; "))}">
+					<meta http-equiv="Content-Security-Policy" content="${csp.join("; ")}">
 					<link rel="stylesheet" type="text/css" href="${stylesUri}">
 					<link href="${codiconsUri}" rel="stylesheet" />
 					<script nonce="${nonce}">
@@ -1961,10 +1956,6 @@ export class ClineProvider
 		*/
 		const nonce = getNonce()
 
-		// Get the OpenRouter base URL from configuration
-		const { apiConfiguration } = await this.getState()
-		const openRouterDomain = getOpenRouterCspOrigin(apiConfiguration.openRouterBaseUrl)
-
 		// Tip: Install the es6-string-html VS Code extension to enable code highlighting below
 		return /*html*/ `
         <!DOCTYPE html>
@@ -1973,7 +1964,7 @@ export class ClineProvider
             <meta charset="utf-8">
             <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
             <meta name="theme-color" content="#000000">
-            <meta http-equiv="Content-Security-Policy" content="${escapeCspAttribute(`default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com https://avatars.githubusercontent.com https://lh3.googleusercontent.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic'; connect-src ${webview.cspSource} ${openRouterDomain} https://api.requesty.ai https://us.i.posthog.com;`)}">
+            <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com https://avatars.githubusercontent.com https://lh3.googleusercontent.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' 'strict-dynamic'; connect-src ${webview.cspSource} https://us.i.posthog.com;">
             <link rel="stylesheet" type="text/css" href="${stylesUri}">
 			<link href="${codiconsUri}" rel="stylesheet" />
 			<script nonce="${nonce}">
diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index a4744cafd6..0053808315 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -2110,7 +2110,8 @@ describe("ClineProvider", () => {
 
 		test("bounds failed HTML generation and reports the exhausted budget once", async () => {
 			await provider.resolveWebviewView(mockWebviewView)
-			const generate = vi.spyOn(provider, "getState").mockRejectedValue(new Error("cannot generate"))
+			const generate = vi.fn().mockRejectedValue(new Error("cannot generate"))
+			provider["getWebviewHtml"] = generate
 			const assignHtml = trackHtmlAssignments()
 
 			await vi.advanceTimersByTimeAsync(600_000)
@@ -2137,7 +2138,8 @@ describe("ClineProvider", () => {
 		test("gives a user-opened replacement a fresh budget after unavailable host recovery", async () => {
 			await provider.resolveWebviewView(mockWebviewView)
 			vi.mocked(vscode.commands.getCommands).mockResolvedValue([])
-			const generateHtml = vi.spyOn(provider, "getState")
+			const generateHtml = vi.fn(provider["getWebviewHtml"].bind(provider))
+			provider["getWebviewHtml"] = generateHtml
 
 			await vi.advanceTimersByTimeAsync(130_000)
 			expect(generateHtml).toHaveBeenCalledTimes(1)
@@ -2262,18 +2264,18 @@ describe("ClineProvider", () => {
 			await provider.resolveWebviewView(mockWebviewView)
 			expect(vi.getTimerCount()).toBe(timersAfterFirstResolve)
 
-			// getHtmlContent regenerates the HTML via one getState() call per reload,
-			// so getState invocations after this point count watchdog reloads.
-			const getStateSpy = vi.spyOn(provider, "getState")
+			// Each watchdog reload regenerates the HTML once, so calls after this point count reloads.
+			const regenerate = vi.fn(provider["getWebviewHtml"].bind(provider))
+			provider["getWebviewHtml"] = regenerate
 
 			await vi.advanceTimersByTimeAsync(120_000)
 
-			expect(getStateSpy).toHaveBeenCalledTimes(1)
+			expect(regenerate).toHaveBeenCalledTimes(1)
 		})
 
 		test("logs when regenerating the reload HTML fails", async () => {
 			await provider.resolveWebviewView(mockWebviewView)
-			vi.spyOn(provider, "getState").mockRejectedValue(new Error("regen boom"))
+			provider["getWebviewHtml"] = vi.fn().mockRejectedValue(new Error("regen boom"))
 			;(mockOutputChannel.appendLine as ReturnType<typeof vi.fn>).mockClear()
 
 			await vi.advanceTimersByTimeAsync(120_000)
@@ -3052,73 +3054,35 @@ describe("ClineProvider", () => {
 		})
 	})
 
-	test("escapes the complete CSP attribute in production and HMR HTML", async () => {
-		vi.mocked(axios.get).mockResolvedValue({ data: "" })
-		const webview = { ...mockWebviewView.webview, cspSource: 'https://test/?x=&quot;"><tag>' }
-		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
-			const html = await provider[build](webview)
-			// Capture through the stylesheet link so a raw quote in any cspSource cannot truncate the check.
-			const csp = html.match(
-				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
-			)?.[1]
-			expect(csp).toContain("https://test/?x=&amp;quot;&quot;&gt;&lt;tag&gt;")
-			expect(csp).not.toMatch(/["<>]/)
-		}
-	})
-
-	test("builds the production and HMR CSPs from the webviewCsp helpers", async () => {
-		const state = await provider.getState()
-		vi.spyOn(provider, "getState").mockResolvedValue({
-			...state,
-			apiConfiguration: {
-				...state.apiConfiguration,
-				// The origin helper must strip credentials and paths. The cspSource test covers escaping.
-				openRouterBaseUrl:
-					'https://user:password@example.com:8443/api;script-src?x="><script>attack()</script>',
-			},
-		})
-		vi.mocked(axios.get).mockResolvedValue({ data: "" })
+	// Provider lookups run in the extension host, so configured endpoints must never reach the CSP.
+	test.each(["getHtmlContent", "getHMRHtmlContent"] as const)(
+		"%s keeps configured provider endpoints out of the CSP",
+		async (build) => {
+			const state = await provider.getState()
+			vi.spyOn(provider, "getState").mockResolvedValue({
+				...state,
+				apiConfiguration: {
+					...state.apiConfiguration,
+					openRouterBaseUrl: "https://evil.example;script-src 'unsafe-inline'\"><script>attack()</script>",
+					requestyBaseUrl: "https://requesty.example",
+				},
+			})
+			vi.mocked(axios.get).mockResolvedValue({ data: "" })
 
-		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
 			const html = await provider[build](mockWebviewView.webview)
 			const csp = html.match(
 				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
 			)?.[1]
+
 			expect(csp).toBeDefined()
-			// The host survives with its port; credentials, path and payload do not.
-			expect(csp).toContain("connect-src vscode-webview://test-csp-source https://example.com:8443 ")
+			expect(csp).toContain("connect-src vscode-webview://test-csp-source ")
+			expect(csp).not.toContain("evil.example")
+			expect(csp).not.toContain("requesty")
+			expect(csp).not.toContain("openrouter")
 			expect(csp?.match(/script-src /g)).toHaveLength(1)
-			expect(csp).toContain("'nonce-")
 			expect(html).not.toContain("attack()")
-			expect(html).not.toContain("password")
-		}
-	})
-
-	// Rejection must also hold through the builders, not only in the pure helper.
-	test.each([
-		[undefined, null],
-		["https://example.com;script-src", "https://example.com;script-src"],
-		["ftp://example.com", "ftp://example.com"],
-	])("falls back to the default origin for endpoint %s in both HTML builders", async (baseUrl, rejectedValue) => {
-		const state = await provider.getState()
-		vi.spyOn(provider, "getState").mockResolvedValue({
-			...state,
-			apiConfiguration: { ...state.apiConfiguration, openRouterBaseUrl: baseUrl },
-		})
-		vi.mocked(axios.get).mockResolvedValue({ data: "" })
-
-		for (const build of ["getHtmlContent", "getHMRHtmlContent"] as const) {
-			const html = await provider[build](mockWebviewView.webview)
-			const csp = html.match(
-				/http-equiv="Content-Security-Policy" content="([\s\S]*?)">\s*<link rel="stylesheet"/,
-			)?.[1]
-			expect(csp).toBeDefined()
-			expect(csp).toContain("connect-src vscode-webview://test-csp-source https://openrouter.ai ")
-			if (rejectedValue) {
-				expect(csp).not.toContain(rejectedValue)
-			}
-		}
-	})
+		},
+	)
 
 	test("resolveWebviewView sets up webview correctly in development mode even if local server is not running", async () => {
 		const developmentContext = { ...mockContext, extensionMode: vscode.ExtensionMode.Development }
@@ -3143,7 +3107,7 @@ describe("ClineProvider", () => {
 
 		// Verify Content Security Policy contains the necessary PostHog domains
 		expect(mockWebviewView.webview.html).toContain(
-			"connect-src vscode-webview://test-csp-source https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com",
+			"connect-src vscode-webview://test-csp-source https://us.i.posthog.com",
 		)
 
 		// Extract the script-src directive section and verify required security elements
diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
new file mode 100644
index 0000000000..0101295f07
--- /dev/null
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -0,0 +1,168 @@
+import type { WebviewMessage } from "@roo-code/types"
+
+import type { ClineProvider } from "../ClineProvider"
+import { handleRequestProviderInfo } from "../providerInfoHandler"
+
+const KEY_INFO = {
+	label: "sk-or-v1-...abc",
+	usage: 12.5,
+	is_free_tier: false,
+	is_provisioning_key: false,
+	rate_limit: { requests: 60, interval: "1m" },
+	limit: 100,
+}
+
+const REQUESTY_KEY_INFO = {
+	name: "key",
+	monthly_limit: "100",
+	monthly_spend: "5",
+	org_balance: "95",
+	config: {},
+}
+
+const ENDPOINTS = {
+	data: {
+		id: "openai/gpt-4o",
+		name: "GPT-4o",
+		description: "desc",
+		architecture: { input_modalities: ["text", "image"], output_modalities: ["text"] },
+		endpoints: [
+			{
+				name: "OpenAI | gpt-4o",
+				tag: "openai",
+				context_length: 128000,
+				max_completion_tokens: 16384,
+				pricing: { prompt: "0.000005", completion: "0.000015", input_cache_read: "0.0000025" },
+			},
+		],
+	},
+}
+
+const jsonResponse = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
+
+describe("handleRequestProviderInfo", () => {
+	const postMessageToWebview = vi.fn()
+	const provider = { postMessageToWebview, log: vi.fn() } as unknown as ClineProvider // Only these two members are used.
+	let fetchSpy: ReturnType<typeof vi.spyOn>
+
+	const send = (values: WebviewMessage["values"]) =>
+		handleRequestProviderInfo(provider, { type: "requestProviderInfo", requestId: "req-1", values })
+
+	beforeEach(() => {
+		postMessageToWebview.mockReset()
+		fetchSpy = vi.spyOn(globalThis, "fetch")
+		vi.spyOn(console, "error").mockImplementation(() => {})
+	})
+
+	afterEach(() => {
+		vi.restoreAllMocks()
+	})
+
+	it("fetches OpenRouter key info from the default endpoint with a bearer token", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse({ data: KEY_INFO }))
+
+		await send({ kind: "openRouterKeyInfo", apiKey: "sk-or-v1-test" })
+
+		expect(fetchSpy.mock.calls[0]![0]).toBe("https://openrouter.ai/api/v1/key")
+		expect(fetchSpy.mock.calls[0]![1]).toMatchObject({ headers: { Authorization: "Bearer sk-or-v1-test" } })
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			values: { data: KEY_INFO },
+		})
+	})
+
+	it("uses a caller-supplied OpenRouter base URL", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse({ data: KEY_INFO }))
+
+		await send({ kind: "openRouterKeyInfo", apiKey: "k", baseUrl: "https://proxy.example.com/api/v1" })
+
+		expect(fetchSpy.mock.calls[0]![0]).toBe("https://proxy.example.com/api/v1/key")
+	})
+
+	it.each(["openRouterKeyInfo", "requestyKeyInfo"])(
+		"returns null without a request when %s has no apiKey",
+		async (kind) => {
+			await send({ kind })
+
+			expect(fetchSpy).not.toHaveBeenCalled()
+			expect(postMessageToWebview).toHaveBeenCalledWith({
+				type: "providerInfo",
+				requestId: "req-1",
+				values: { data: null },
+			})
+		},
+	)
+
+	it("fetches Requesty key info from the api service URL", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse(REQUESTY_KEY_INFO))
+
+		await send({ kind: "requestyKeyInfo", apiKey: "rk" })
+
+		expect(fetchSpy.mock.calls[0]![0]).toBe("https://api.requesty.ai/x/apikey")
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			values: { data: REQUESTY_KEY_INFO },
+		})
+	})
+
+	it("maps OpenRouter endpoints to model info keyed by provider tag", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse(ENDPOINTS))
+
+		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o" })
+
+		expect(fetchSpy.mock.calls[0]![0]).toBe("https://openrouter.ai/api/v1/models/openai/gpt-4o/endpoints")
+		const { values } = postMessageToWebview.mock.calls[0]![0]
+		expect(values.data.openai).toMatchObject({
+			label: "openai",
+			maxTokens: 16384,
+			contextWindow: 128000,
+			supportsImages: true,
+			supportsPromptCache: true,
+			inputPrice: 5,
+			outputPrice: 15,
+			cacheReadsPrice: 2.5,
+		})
+	})
+
+	it("returns no providers for an image-output model", async () => {
+		const body = { data: { ...ENDPOINTS.data, architecture: { output_modalities: ["image"] } } }
+		fetchSpy.mockResolvedValue(jsonResponse(body))
+
+		await send({ kind: "openRouterModelProviders", modelId: "m" })
+
+		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: {} })
+	})
+
+	it("returns null for a schema-invalid key response", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse({ data: { label: 1 } }))
+
+		await send({ kind: "openRouterKeyInfo", apiKey: "k" })
+
+		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: null })
+	})
+
+	it("posts an error without the configured URL when the request fails", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse({}, 401))
+
+		await send({ kind: "openRouterKeyInfo", apiKey: "k", baseUrl: "https://secret.example.com" })
+
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			error: "Provider info request failed",
+		})
+	})
+
+	it.each([undefined, "unknown", "__proto__", "constructor"])("rejects unknown kind %s", async (kind) => {
+		await send({ kind })
+
+		expect(fetchSpy).not.toHaveBeenCalled()
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			error: "Unknown provider info kind",
+		})
+	})
+})
diff --git a/src/core/webview/__tests__/webviewCsp.spec.ts b/src/core/webview/__tests__/webviewCsp.spec.ts
deleted file mode 100644
index 4ebe92d7b7..0000000000
--- a/src/core/webview/__tests__/webviewCsp.spec.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { describe, expect, it } from "vitest"
-
-import { escapeCspAttribute, getOpenRouterCspOrigin } from "../webviewCsp"
-
-describe("getOpenRouterCspOrigin", () => {
-	it.each([
-		[undefined, "https://openrouter.ai"],
-		["https://openrouter.ai/api/v1", "https://openrouter.ai"],
-		// Credentials, paths, queries and fragments are stripped, not echoed.
-		["https://user:password@EXAMPLE.com:8443/api/v1?key=secret#fragment", "https://example.com:8443"],
-		// Local proxy hosts, IPv4 and bracketed IPv6 stay allowed.
-		["http://localhost:3000/api/v1", "http://localhost:3000"],
-		["http://127.0.0.1:3000/api", "http://127.0.0.1:3000"],
-		["http://[::1]:3000/api", "http://[::1]:3000"],
-		["http://my_proxy:8080", "http://my_proxy:8080"],
-		["https://my-proxy.example.com:8443/api", "https://my-proxy.example.com:8443"],
-		// CSP delimiters and markup in the path or host fall back to the default.
-		['https://example.com/path;script-src?x="><script>attack()</script>', "https://example.com"],
-		["https://example.com;script-src", "https://openrouter.ai"],
-		[`https://example.com; script-src-elem 'unsafe-inline'"><script>attack()</script>`, "https://openrouter.ai"],
-		["https://example.com'", "https://openrouter.ai"],
-		['https://example.com"><script>attack()</script>', "https://openrouter.ai"],
-		// Only the hostname regex rejects this quote; the URL parses without it.
-		['https://example.com"', "https://openrouter.ai"],
-		// The hostname regex rejects wildcard and list syntax that CSP would misread.
-		["https://*.example.com", "https://openrouter.ai"],
-		["https://a,b.com", "https://openrouter.ai"],
-		// The protocol allowlist rejects non-http(s) schemes before the host is read.
-		["javascript:attack()", "https://openrouter.ai"],
-		["file:///tmp/test", "https://openrouter.ai"],
-		["ftp://example.com", "https://openrouter.ai"],
-		["ws://example.com", "https://openrouter.ai"],
-		// Malformed input falls back to the default.
-		["invalid", "https://openrouter.ai"],
-		["", "https://openrouter.ai"],
-	])("maps endpoint %s to origin %s", (baseUrl, origin) => {
-		expect(getOpenRouterCspOrigin(baseUrl)).toBe(origin)
-	})
-})
-
-describe("escapeCspAttribute", () => {
-	it.each([
-		["&", "&amp;"],
-		['"', "&quot;"],
-		["<", "&lt;"],
-		[">", "&gt;"],
-	])("escapes %s as %s", (raw, escaped) => {
-		expect(escapeCspAttribute(`a ${raw} b`)).toBe(`a ${escaped} b`)
-	})
-
-	it("leaves safe characters unchanged", () => {
-		expect(escapeCspAttribute("default-src 'none'; script-src 'nonce-abc'")).toBe(
-			"default-src 'none'; script-src 'nonce-abc'",
-		)
-	})
-
-	it("escapes every character so no raw markup survives", () => {
-		expect(escapeCspAttribute('&"><script>')).toBe("&amp;&quot;&gt;&lt;script&gt;")
-	})
-})
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
new file mode 100644
index 0000000000..223bf51a99
--- /dev/null
+++ b/src/core/webview/providerInfoHandler.ts
@@ -0,0 +1,195 @@
+import { z } from "zod"
+
+import type { ModelInfo, ProviderInfoKind, ProviderInfoParams, WebviewMessage } from "@roo-code/types"
+
+import type { ClineProvider } from "./ClineProvider"
+import { parseApiPrice } from "../../shared/cost"
+import { toRequestyServiceUrl } from "../../shared/utils/requesty"
+
+const FETCH_TIMEOUT_MS = 10_000
+const OPENROUTER_DEFAULT_BASE_URL = "https://openrouter.ai/api/v1"
+
+const openRouterKeyInfoSchema = z.object({
+	data: z.object({
+		label: z.string(),
+		usage: z.number(),
+		is_free_tier: z.boolean(),
+		is_provisioning_key: z.boolean(),
+		rate_limit: z.object({
+			requests: z.number(),
+			interval: z.string(),
+		}),
+		limit: z.number().nullable(),
+	}),
+})
+
+const priceSchema = z.union([z.string(), z.number()]).optional()
+
+const openRouterEndpointsSchema = z.object({
+	data: z.object({
+		id: z.string(),
+		name: z.string(),
+		description: z.string().optional(),
+		architecture: z
+			.object({
+				input_modalities: z.array(z.string()).nullish(),
+				output_modalities: z.array(z.string()).nullish(),
+				tokenizer: z.string().nullish(),
+			})
+			.nullish(),
+		endpoints: z.array(
+			z.object({
+				name: z.string(),
+				tag: z.string().optional(),
+				context_length: z.number(),
+				max_completion_tokens: z.number().nullish(),
+				pricing: z
+					.object({
+						prompt: priceSchema,
+						completion: priceSchema,
+						input_cache_read: priceSchema,
+						input_cache_write: priceSchema,
+					})
+					.optional(),
+			}),
+		),
+	}),
+})
+
+const requestyKeyInfoSchema = z.object({
+	name: z.string(),
+	monthly_limit: z.string(),
+	monthly_spend: z.string(),
+	org_balance: z.string(),
+	config: z.object({
+		aliases: z.record(z.string(), z.any()).optional(),
+	}),
+})
+
+async function getJson(url: string, headers?: Record<string, string>): Promise<unknown> {
+	const response = await fetch(url, {
+		method: "GET",
+		headers,
+		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+	})
+
+	if (!response.ok) {
+		throw new Error(`Request failed with status code ${response.status}`)
+	}
+
+	return response.json()
+}
+
+async function getOpenRouterKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
+	if (!apiKey) return null
+
+	const body = await getJson(`${baseUrl || OPENROUTER_DEFAULT_BASE_URL}/key`, {
+		Authorization: `Bearer ${apiKey}`,
+	})
+	const result = openRouterKeyInfoSchema.safeParse(body)
+
+	if (!result.success) {
+		console.error("OpenRouter API key info validation failed:", result.error)
+		return null
+	}
+
+	return result.data.data
+}
+
+async function getOpenRouterModelProviders({ modelId, baseUrl }: ProviderInfoParams) {
+	const models: Record<string, ModelInfo & { label: string }> = {}
+
+	if (!modelId) return models
+
+	const body = await getJson(`${baseUrl || OPENROUTER_DEFAULT_BASE_URL}/models/${modelId}/endpoints`)
+	const result = openRouterEndpointsSchema.safeParse(body)
+
+	if (!result.success) {
+		console.error("OpenRouter API response validation failed:", result.error)
+		return models
+	}
+
+	const { description, architecture, endpoints } = result.data.data
+
+	// Skip image generation models (models that output images).
+	if (architecture?.output_modalities?.includes("image")) return models
+
+	for (const endpoint of endpoints) {
+		const label = endpoint.tag ?? endpoint.name
+		const cacheReadsPrice = parseApiPrice(endpoint.pricing?.input_cache_read)
+
+		models[label] = {
+			maxTokens: endpoint.max_completion_tokens || endpoint.context_length,
+			contextWindow: endpoint.context_length,
+			supportsImages: architecture?.input_modalities?.includes("image") ?? false,
+			supportsPromptCache: typeof cacheReadsPrice !== "undefined",
+			cacheReadsPrice,
+			cacheWritesPrice: parseApiPrice(endpoint.pricing?.input_cache_write),
+			inputPrice: parseApiPrice(endpoint.pricing?.prompt),
+			outputPrice: parseApiPrice(endpoint.pricing?.completion),
+			description,
+			label,
+		}
+	}
+
+	return models
+}
+
+async function getRequestyKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
+	if (!apiKey) return null
+
+	const apiKeyUrl = new URL("x/apikey", toRequestyServiceUrl(baseUrl, "api"))
+	const body = await getJson(apiKeyUrl.toString(), {
+		Authorization: `Bearer ${apiKey}`,
+		"Content-Type": "application/json",
+	})
+	const result = requestyKeyInfoSchema.safeParse(body)
+
+	if (!result.success) {
+		console.error("Requesty API key info validation failed:", result.error)
+		return null
+	}
+
+	return result.data
+}
+
+const fetchers: Record<ProviderInfoKind, (params: ProviderInfoParams) => Promise<unknown>> = {
+	openRouterKeyInfo: getOpenRouterKeyInfo,
+	openRouterModelProviders: getOpenRouterModelProviders,
+	requestyKeyInfo: getRequestyKeyInfo,
+}
+
+const isProviderInfoKind = (kind: unknown): kind is ProviderInfoKind =>
+	typeof kind === "string" && Object.hasOwn(fetchers, kind)
+
+/**
+ * Fetch provider key and model info in the extension host so the webview CSP
+ * needs no provider origins. The webview sends unsaved settings values, so the
+ * handler reads credentials from the message, not from saved config.
+ */
+export async function handleRequestProviderInfo(provider: ClineProvider, message: WebviewMessage): Promise<void> {
+	const { kind, ...params } = (message.values ?? {}) as { kind?: unknown } & ProviderInfoParams
+
+	if (!isProviderInfoKind(kind)) {
+		await provider.postMessageToWebview({
+			type: "providerInfo",
+			requestId: message.requestId,
+			error: "Unknown provider info kind",
+		})
+		return
+	}
+
+	try {
+		const data = await fetchers[kind](params)
+		await provider.postMessageToWebview({ type: "providerInfo", requestId: message.requestId, values: { data } })
+	} catch (error) {
+		// Log the kind only. The error text can carry a configured URL.
+		provider.log(`Failed to fetch provider info (${kind})`)
+		console.error(`Error fetching provider info (${kind}):`, error instanceof Error ? error.name : "unknown")
+		await provider.postMessageToWebview({
+			type: "providerInfo",
+			requestId: message.requestId,
+			error: "Provider info request failed",
+		})
+	}
+}
diff --git a/src/core/webview/webviewCsp.ts b/src/core/webview/webviewCsp.ts
deleted file mode 100644
index 0969ca1a40..0000000000
--- a/src/core/webview/webviewCsp.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/** Return one CSP source, never configuration-supplied policy or markup. */
-export function getOpenRouterCspOrigin(baseUrl?: string): string {
-	try {
-		const url = new URL(baseUrl || "https://openrouter.ai")
-		// URL hostnames can contain CSP delimiters such as semicolons and quotes.
-		// Allow DNS names, IPv4 and bracketed IPv6, including local proxy hosts.
-		if ((url.protocol === "https:" || url.protocol === "http:") && /^[a-z0-9._:[\]-]+$/i.test(url.hostname)) {
-			return url.origin
-		}
-	} catch {
-		// Invalid endpoints must not prevent the webview from rendering safely.
-	}
-	return "https://openrouter.ai"
-}
-
-/** Escape a complete CSP for a double-quoted HTML attribute. */
-export function escapeCspAttribute(policy: string): string {
-	return policy.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
-}
diff --git a/src/core/webview/webviewMessageHandler.ts b/src/core/webview/webviewMessageHandler.ts
index c5abbc0a12..cf9d209191 100644
--- a/src/core/webview/webviewMessageHandler.ts
+++ b/src/core/webview/webviewMessageHandler.ts
@@ -31,6 +31,7 @@ import {
 	VsCodeLmModelsMessageType,
 	isTelemetryOptedIn,
 } from "@roo-code/types"
+import { handleRequestProviderInfo } from "./providerInfoHandler"
 import { customToolRegistry } from "@roo-code/core"
 import { CloudService } from "@roo-code/cloud"
 import { TelemetryService } from "@roo-code/telemetry"
@@ -1161,6 +1162,9 @@ export const webviewMessageHandler = async (
 		case "resetState":
 			await provider.resetState()
 			break
+		case "requestProviderInfo":
+			await handleRequestProviderInfo(provider, message)
+			break
 		case RouterModelsMessageType.flushRouterModels: {
 			const { apiConfiguration } = await provider.getState()
 			const routerNameFlush: RouterName = toRouterName(message.text)
diff --git a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
new file mode 100644
index 0000000000..c065f2ed13
--- /dev/null
+++ b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
@@ -0,0 +1,173 @@
+import React from "react"
+import { act, renderHook, waitFor } from "@testing-library/react"
+import { QueryClientProvider, type UseQueryResult } from "@tanstack/react-query"
+
+import type { WebviewMessage } from "@roo-code/types"
+
+import { vscode } from "@src/utils/vscode"
+import { createTestQueryClient } from "@src/utils/test-utils"
+
+import { requestProviderInfo } from "../requestProviderInfo"
+import { useOpenRouterKeyInfo } from "../useOpenRouterKeyInfo"
+import { useOpenRouterModelProviders } from "../useOpenRouterModelProviders"
+import { useRequestyKeyInfo } from "../useRequestyKeyInfo"
+
+vi.mock("@src/utils/vscode", () => ({ vscode: { postMessage: vi.fn() } }))
+
+const wrapper = ({ children }: React.PropsWithChildren) => (
+	<QueryClientProvider client={createTestQueryClient()}>{children}</QueryClientProvider>
+)
+
+beforeEach(() => {
+	vi.mocked(vscode.postMessage).mockReset()
+})
+
+type Reply = { data?: unknown; error?: string }
+
+// Answers each requestProviderInfo message like the extension host and records the messages.
+const stubHost = (reply: (values: Record<string, unknown>) => Reply | null) => {
+	const sent: WebviewMessage[] = []
+
+	vi.mocked(vscode.postMessage).mockImplementation((message: WebviewMessage) => {
+		sent.push(message)
+		const answer = reply(message.values ?? {})
+		if (!answer) return
+		window.dispatchEvent(
+			new MessageEvent("message", {
+				data: {
+					type: "providerInfo",
+					requestId: message.requestId,
+					...(answer.error ? { error: answer.error } : { values: { data: answer.data } }),
+				},
+			}),
+		)
+	})
+
+	return { sent }
+}
+
+describe("requestProviderInfo", () => {
+	afterEach(() => {
+		vi.restoreAllMocks()
+		vi.useRealTimers()
+	})
+
+	it("posts the kind and params with a request id and resolves with the reply data", async () => {
+		const { sent } = stubHost(() => ({ data: { ok: true } }))
+
+		await expect(
+			requestProviderInfo("openRouterKeyInfo", { apiKey: "k", baseUrl: "https://x.test" }),
+		).resolves.toEqual({
+			ok: true,
+		})
+
+		expect(sent).toEqual([
+			{
+				type: "requestProviderInfo",
+				requestId: expect.any(String),
+				values: { kind: "openRouterKeyInfo", apiKey: "k", baseUrl: "https://x.test" },
+			},
+		])
+	})
+
+	it("rejects with the host error message", async () => {
+		stubHost(() => ({ error: "Provider info request failed" }))
+
+		await expect(requestProviderInfo("requestyKeyInfo", { apiKey: "k" })).rejects.toThrow(
+			"Provider info request failed",
+		)
+	})
+
+	it("ignores replies for other request ids and rejects on timeout", async () => {
+		vi.useFakeTimers()
+		stubHost(() => null)
+
+		const promise = requestProviderInfo("requestyKeyInfo", { apiKey: "k" })
+		const settled = expect(promise).rejects.toThrow("Provider info request timed out")
+
+		window.dispatchEvent(
+			new MessageEvent("message", {
+				data: { type: "providerInfo", requestId: "other", values: { data: { stolen: true } } },
+			}),
+		)
+		await act(() => vi.advanceTimersByTimeAsync(15_000))
+
+		await settled
+	})
+})
+
+describe("provider info hooks", () => {
+	afterEach(() => {
+		vi.restoreAllMocks()
+	})
+
+	it.each<[string, () => UseQueryResult<unknown>]>([
+		["useOpenRouterKeyInfo", () => useOpenRouterKeyInfo(undefined)],
+		["useRequestyKeyInfo", () => useRequestyKeyInfo(undefined, undefined)],
+	])("%s sends nothing without an apiKey", async (_name, useHook) => {
+		stubHost(() => ({ data: {} }))
+
+		const { result } = renderHook(useHook, { wrapper })
+
+		await waitFor(() => expect(result.current.fetchStatus).toBe("idle"))
+		expect(result.current.data).toBeUndefined()
+		expect(vscode.postMessage).not.toHaveBeenCalled()
+	})
+
+	it("useOpenRouterModelProviders returns an empty record without a modelId", async () => {
+		stubHost(() => ({ data: { unexpected: {} } }))
+
+		const { result } = renderHook(() => useOpenRouterModelProviders(undefined), { wrapper })
+
+		await waitFor(() => expect(result.current.isSuccess).toBe(true))
+		expect(result.current.data).toEqual({})
+		expect(vscode.postMessage).not.toHaveBeenCalled()
+	})
+
+	it.each<[string, () => UseQueryResult<unknown>, Record<string, string>, unknown]>([
+		[
+			"useOpenRouterKeyInfo",
+			() => useOpenRouterKeyInfo("sk-or", "https://proxy.test/api/v1"),
+			{ kind: "openRouterKeyInfo", apiKey: "sk-or", baseUrl: "https://proxy.test/api/v1" },
+			{ label: "abc" },
+		],
+		[
+			"useRequestyKeyInfo",
+			() => useRequestyKeyInfo("https://custom.requesty.ai/v1", "rk"),
+			{ kind: "requestyKeyInfo", apiKey: "rk", baseUrl: "https://custom.requesty.ai/v1" },
+			{ name: "my-key" },
+		],
+		[
+			"useOpenRouterModelProviders",
+			() => useOpenRouterModelProviders("vendor/model", "https://proxy.test/api/v1"),
+			{ kind: "openRouterModelProviders", modelId: "vendor/model", baseUrl: "https://proxy.test/api/v1" },
+			{ "provider-a": { label: "provider-a" } },
+		],
+	])("%s asks the host and returns its data", async (_name, useHook, values, data) => {
+		const { sent } = stubHost(() => ({ data }))
+
+		const { result } = renderHook(useHook, { wrapper })
+
+		await waitFor(() => expect(result.current.isSuccess).toBe(true))
+		expect(result.current.data).toEqual(data)
+		expect(sent.map((message) => message.values)).toEqual([values])
+	})
+
+	it.each<[string, () => UseQueryResult<unknown>, unknown]>([
+		["useOpenRouterKeyInfo", () => useOpenRouterKeyInfo("sk-or"), null],
+		["useRequestyKeyInfo", () => useRequestyKeyInfo(undefined, "rk"), null],
+		["useOpenRouterModelProviders", () => useOpenRouterModelProviders("vendor/model"), {}],
+	])("%s falls back and logs when the host reports an error", async (_name, useHook, fallback) => {
+		stubHost(() => ({ error: "Provider info request failed" }))
+		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
+
+		const { result } = renderHook(useHook, { wrapper })
+
+		await waitFor(() => expect(result.current.isSuccess).toBe(true))
+		expect(result.current.data).toEqual(fallback)
+		expect(consoleError).toHaveBeenCalledWith(
+			expect.stringContaining("Error fetching"),
+			expect.objectContaining({ message: "Provider info request failed" }),
+		)
+	})
+})
diff --git a/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterKeyInfo.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterKeyInfo.spec.tsx
deleted file mode 100644
index 2e7bf65c24..0000000000
--- a/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterKeyInfo.spec.tsx
+++ /dev/null
@@ -1,123 +0,0 @@
-import { renderHook, waitFor } from "@testing-library/react"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
-import React from "react"
-
-import { stubTransport } from "@src/utils/test-utils"
-
-import { useOpenRouterKeyInfo } from "../useOpenRouterKeyInfo"
-
-const KEY_INFO = {
-	label: "sk-or-v1-...abc",
-	usage: 12.5,
-	is_free_tier: false,
-	is_provisioning_key: false,
-	rate_limit: { requests: 60, interval: "1m" },
-	limit: 100,
-}
-
-const wrapper = ({ children }: React.PropsWithChildren) => (
-	<QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
-		{children}
-	</QueryClientProvider>
-)
-
-describe("useOpenRouterKeyInfo", () => {
-	afterEach(() => {
-		vi.restoreAllMocks()
-	})
-
-	it("returns undefined and issues no request when apiKey is missing", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: { data: KEY_INFO } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo(undefined), { wrapper })
-
-		await waitFor(() => expect(result.current.fetchStatus).toBe("idle"))
-		expect(result.current.data).toBeUndefined()
-		expect(calls).toHaveLength(0)
-		expect(consoleError).not.toHaveBeenCalled()
-	})
-
-	it("requests the default key endpoint with a bearer token and returns the parsed key info", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: { data: KEY_INFO } }))
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual(KEY_INFO)
-		expect(calls).toEqual([
-			{
-				url: "https://openrouter.ai/api/v1/key",
-				method: "GET",
-				headers: { authorization: "Bearer sk-or-v1-test" },
-			},
-		])
-	})
-
-	it("uses a caller-supplied baseUrl verbatim", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: { data: KEY_INFO } }))
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test", "https://proxy.example.com/api/v1"), {
-			wrapper,
-		})
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(calls[0].url).toBe("https://proxy.example.com/api/v1/key")
-	})
-
-	it("returns null and logs a validation failure when the payload does not match the schema", async () => {
-		stubTransport(() => ({ status: 200, body: { data: { label: "only-label" } } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith(
-			"OpenRouter API key info validation failed:",
-			expect.objectContaining({
-				issues: expect.arrayContaining([expect.objectContaining({ path: ["data", "usage"] })]),
-			}),
-		)
-	})
-
-	it("returns null and logs a fetch failure when the response is not 2xx", async () => {
-		stubTransport(() => ({ status: 401, body: { error: { message: "No auth credentials found" } } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith(
-			"Error fetching OpenRouter key info:",
-			expect.objectContaining({ message: "Request failed with status code 401" }),
-		)
-	})
-
-	it("returns null and logs a fetch failure when the request rejects", async () => {
-		const failure = new Error("network down")
-		stubTransport(() => {
-			throw failure
-		})
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith("Error fetching OpenRouter key info:", failure)
-	})
-
-	it("returns null and logs a fetch failure when a 2xx body is not valid JSON", async () => {
-		const parseFailure = new SyntaxError("Unexpected token '<', \"<html>\" is not valid JSON")
-		stubTransport(() => ({ status: 200, body: undefined, jsonRejects: parseFailure }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterKeyInfo("sk-or-v1-test"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith("Error fetching OpenRouter key info:", parseFailure)
-	})
-})
diff --git a/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterModelProviders.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterModelProviders.spec.tsx
deleted file mode 100644
index f16edbd8a8..0000000000
--- a/webview-ui/src/components/ui/hooks/__tests__/useOpenRouterModelProviders.spec.tsx
+++ /dev/null
@@ -1,190 +0,0 @@
-import { renderHook, waitFor } from "@testing-library/react"
-import { QueryClientProvider } from "@tanstack/react-query"
-import React from "react"
-
-import { createTestQueryClient, stubTransport } from "@src/utils/test-utils"
-
-import { useOpenRouterModelProviders } from "../useOpenRouterModelProviders"
-
-const endpointsPayload = (overrides: Record<string, unknown> = {}) => ({
-	data: {
-		id: "vendor/model",
-		name: "Vendor Model",
-		description: "A test model",
-		architecture: { input_modalities: ["text", "image"], output_modalities: ["text"] },
-		endpoints: [
-			{
-				name: "Provider A",
-				tag: "provider-a",
-				context_length: 128000,
-				max_completion_tokens: 4096,
-				pricing: {
-					prompt: "0.000003",
-					completion: "0.000015",
-					input_cache_read: "0.0000003",
-					input_cache_write: "0.0000036",
-				},
-			},
-			{
-				name: "Provider B",
-				context_length: 32000,
-				pricing: { prompt: "0.000001", completion: "0.000002" },
-			},
-		],
-		...overrides,
-	},
-})
-
-const wrapper = ({ children }: React.PropsWithChildren) => (
-	<QueryClientProvider client={createTestQueryClient()}>{children}</QueryClientProvider>
-)
-
-describe("useOpenRouterModelProviders", () => {
-	afterEach(() => {
-		vi.restoreAllMocks()
-	})
-
-	it("returns an empty record without a request when modelId is missing", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: endpointsPayload() }))
-
-		const { result } = renderHook(() => useOpenRouterModelProviders(undefined), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-		expect(calls).toHaveLength(0)
-	})
-
-	it("requests the endpoints URL and maps each endpoint to provider model info", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: endpointsPayload() }))
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-
-		expect(calls).toEqual([
-			{ url: "https://openrouter.ai/api/v1/models/vendor/model/endpoints", method: "GET", headers: {} },
-		])
-
-		expect(result.current.data).toEqual({
-			"provider-a": {
-				maxTokens: 4096,
-				contextWindow: 128000,
-				supportsImages: true,
-				supportsPromptCache: true,
-				cacheReadsPrice: 0.3,
-				cacheWritesPrice: expect.closeTo(3.6, 10),
-				inputPrice: 3,
-				outputPrice: 15,
-				description: "A test model",
-				label: "provider-a",
-			},
-			"Provider B": {
-				maxTokens: 32000,
-				contextWindow: 32000,
-				supportsImages: true,
-				supportsPromptCache: false,
-				cacheReadsPrice: undefined,
-				cacheWritesPrice: undefined,
-				inputPrice: 1,
-				outputPrice: 2,
-				description: "A test model",
-				label: "Provider B",
-			},
-		})
-	})
-
-	it.each([
-		{ name: "text-only architecture", architecture: { input_modalities: ["text"], output_modalities: ["text"] } },
-		{ name: "omitted architecture", architecture: undefined },
-	])("disables image support for $name", async ({ architecture }) => {
-		stubTransport(() => ({ status: 200, body: endpointsPayload({ architecture }) }))
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toMatchObject({
-			"provider-a": { supportsImages: false },
-			"Provider B": { supportsImages: false },
-		})
-	})
-
-	it("uses a caller-supplied baseUrl", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: endpointsPayload() }))
-
-		const { result } = renderHook(
-			() => useOpenRouterModelProviders("vendor/model", "https://proxy.example.com/api/v1"),
-			{ wrapper },
-		)
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(calls[0].url).toBe("https://proxy.example.com/api/v1/models/vendor/model/endpoints")
-	})
-
-	it("returns no providers for image-generation models", async () => {
-		stubTransport(() => ({
-			status: 200,
-			body: endpointsPayload({ architecture: { input_modalities: ["text"], output_modalities: ["image"] } }),
-		}))
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-	})
-
-	it("logs a validation failure and returns no providers when the payload does not match the schema", async () => {
-		stubTransport(() => ({ status: 200, body: { data: { id: "vendor/model" } } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-		expect(consoleError).toHaveBeenCalledWith(
-			"OpenRouter API response validation failed:",
-			expect.objectContaining({
-				issues: expect.arrayContaining([expect.objectContaining({ path: ["data", "endpoints"] })]),
-			}),
-		)
-	})
-
-	it("logs a fetch failure and returns no providers when the response is not 2xx", async () => {
-		stubTransport(() => ({ status: 500, body: { error: "boom" } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-		expect(consoleError).toHaveBeenCalledWith(
-			"Error fetching OpenRouter providers:",
-			expect.objectContaining({ message: "Request failed with status code 500" }),
-		)
-	})
-
-	it("logs a fetch failure and returns no providers when the request rejects", async () => {
-		const failure = new Error("network down")
-		stubTransport(() => {
-			throw failure
-		})
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-		expect(consoleError).toHaveBeenCalledWith("Error fetching OpenRouter providers:", failure)
-	})
-
-	it("logs a fetch failure and returns no providers when a 2xx body is not valid JSON", async () => {
-		const parseFailure = new SyntaxError("Unexpected token '<', \"<html>\" is not valid JSON")
-		stubTransport(() => ({ status: 200, body: undefined, jsonRejects: parseFailure }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useOpenRouterModelProviders("vendor/model"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual({})
-		expect(consoleError).toHaveBeenCalledWith("Error fetching OpenRouter providers:", parseFailure)
-	})
-})
diff --git a/webview-ui/src/components/ui/hooks/__tests__/useRequestyKeyInfo.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/useRequestyKeyInfo.spec.tsx
deleted file mode 100644
index 22688db698..0000000000
--- a/webview-ui/src/components/ui/hooks/__tests__/useRequestyKeyInfo.spec.tsx
+++ /dev/null
@@ -1,122 +0,0 @@
-import { renderHook, waitFor } from "@testing-library/react"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
-import React from "react"
-
-import { stubTransport } from "@src/utils/test-utils"
-
-import { useRequestyKeyInfo } from "../useRequestyKeyInfo"
-
-const KEY_INFO = {
-	name: "my-key",
-	monthly_limit: "20",
-	monthly_spend: "1.25",
-	org_balance: "18.75",
-	config: { aliases: { "gpt-4o": "openai/gpt-4o" } },
-}
-
-const wrapper = ({ children }: React.PropsWithChildren) => (
-	<QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
-		{children}
-	</QueryClientProvider>
-)
-
-describe("useRequestyKeyInfo", () => {
-	afterEach(() => {
-		vi.restoreAllMocks()
-	})
-
-	it("returns undefined and issues no request when apiKey is missing", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: KEY_INFO }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, undefined), { wrapper })
-
-		await waitFor(() => expect(result.current.fetchStatus).toBe("idle"))
-		expect(result.current.data).toBeUndefined()
-		expect(calls).toHaveLength(0)
-		expect(consoleError).not.toHaveBeenCalled()
-	})
-
-	it("requests the default api key endpoint with bearer auth and returns the parsed key info", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: KEY_INFO }))
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, "test-key"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toEqual(KEY_INFO)
-		expect(calls).toEqual([
-			{
-				url: "https://api.requesty.ai/x/apikey",
-				method: "GET",
-				headers: { authorization: "Bearer test-key", "content-type": "application/json" },
-			},
-		])
-	})
-
-	it("keeps a caller-supplied host that does not contain 'router' and drops the version suffix", async () => {
-		const { calls } = stubTransport(() => ({ status: 200, body: KEY_INFO }))
-
-		const { result } = renderHook(() => useRequestyKeyInfo("https://custom.requesty.ai/v1", "test-key"), {
-			wrapper,
-		})
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(calls[0].url).toBe("https://custom.requesty.ai/x/apikey")
-	})
-
-	it("returns null and logs a validation failure when the payload does not match the schema", async () => {
-		stubTransport(() => ({ status: 200, body: { name: "my-key" } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, "test-key"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith(
-			"Requesty API key info validation failed:",
-			expect.objectContaining({
-				issues: expect.arrayContaining([expect.objectContaining({ path: ["monthly_limit"] })]),
-			}),
-		)
-	})
-
-	it("returns null and logs a fetch failure when the response is not 2xx", async () => {
-		stubTransport(() => ({ status: 403, body: { detail: "forbidden" } }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, "test-key"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith(
-			"Error fetching Requesty key info:",
-			expect.objectContaining({ message: "Request failed with status code 403" }),
-		)
-	})
-
-	it("returns null and logs a fetch failure when the request rejects", async () => {
-		const failure = new Error("network down")
-		stubTransport(() => {
-			throw failure
-		})
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, "test-key"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith("Error fetching Requesty key info:", failure)
-	})
-
-	it("returns null and logs a fetch failure when a 2xx body is not valid JSON", async () => {
-		const parseFailure = new SyntaxError("Unexpected token '<', \"<html>\" is not valid JSON")
-		stubTransport(() => ({ status: 200, body: undefined, jsonRejects: parseFailure }))
-		const consoleError = vi.spyOn(console, "error").mockImplementation(() => {})
-
-		const { result } = renderHook(() => useRequestyKeyInfo(undefined, "test-key"), { wrapper })
-
-		await waitFor(() => expect(result.current.isSuccess).toBe(true))
-		expect(result.current.data).toBeNull()
-		expect(consoleError).toHaveBeenCalledWith("Error fetching Requesty key info:", parseFailure)
-	})
-})
diff --git a/webview-ui/src/components/ui/hooks/requestProviderInfo.ts b/webview-ui/src/components/ui/hooks/requestProviderInfo.ts
new file mode 100644
index 0000000000..3dc5a203b8
--- /dev/null
+++ b/webview-ui/src/components/ui/hooks/requestProviderInfo.ts
@@ -0,0 +1,38 @@
+import type { ExtensionMessage, ProviderInfoKind, ProviderInfoParams } from "@roo-code/types"
+
+import { vscode } from "@src/utils/vscode"
+
+const TIMEOUT_MS = 15_000
+
+/** Ask the extension host to run a provider lookup. The webview CSP allows no provider origins. */
+export const requestProviderInfo = <T>(kind: ProviderInfoKind, params: ProviderInfoParams): Promise<T> =>
+	new Promise<T>((resolve, reject) => {
+		const requestId = crypto.randomUUID()
+
+		const cleanup = () => {
+			clearTimeout(timeout)
+			window.removeEventListener("message", handler)
+		}
+
+		const timeout = setTimeout(() => {
+			cleanup()
+			reject(new Error("Provider info request timed out"))
+		}, TIMEOUT_MS)
+
+		const handler = (event: MessageEvent) => {
+			const message: ExtensionMessage = event.data
+
+			if (message.type !== "providerInfo" || message.requestId !== requestId) return
+
+			cleanup()
+
+			if (message.error) {
+				reject(new Error(message.error))
+			} else {
+				resolve(message.values?.data as T)
+			}
+		}
+
+		window.addEventListener("message", handler)
+		vscode.postMessage({ type: "requestProviderInfo", requestId, values: { kind, ...params } })
+	})
diff --git a/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts b/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
index 406da24eb9..a0b53009da 100644
--- a/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
+++ b/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
@@ -1,50 +1,21 @@
-import { z } from "zod"
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
 
-// Define schema for OpenRouter key response
-const openRouterKeyInfoSchema = z.object({
-	data: z.object({
-		label: z.string(),
-		usage: z.number(),
-		is_free_tier: z.boolean(),
-		is_provisioning_key: z.boolean(),
-		rate_limit: z.object({
-			requests: z.number(),
-			interval: z.string(),
-		}),
-		limit: z.number().nullable(),
-	}),
-})
+import { requestProviderInfo } from "./requestProviderInfo"
 
-export type OpenRouterKeyInfo = z.infer<typeof openRouterKeyInfoSchema>["data"]
+export type OpenRouterKeyInfo = {
+	label: string
+	usage: number
+	is_free_tier: boolean
+	is_provisioning_key: boolean
+	rate_limit: { requests: number; interval: string }
+	limit: number | null
+}
 
 async function getOpenRouterKeyInfo(apiKey?: string, baseUrl?: string) {
 	if (!apiKey) return null
 
 	try {
-		// Use the provided base URL or default to OpenRouter's API URL
-		const apiBaseUrl = baseUrl || "https://openrouter.ai/api/v1"
-
-		const keyEndpoint = `${apiBaseUrl}/key`
-
-		const response = await fetch(keyEndpoint, {
-			method: "GET",
-			headers: {
-				Authorization: `Bearer ${apiKey}`,
-			},
-		})
-
-		if (!response.ok) {
-			throw new Error(`Request failed with status code ${response.status}`)
-		}
-
-		const result = openRouterKeyInfoSchema.safeParse(await response.json())
-		if (!result.success) {
-			console.error("OpenRouter API key info validation failed:", result.error)
-			return null
-		}
-
-		return result.data.data
+		return await requestProviderInfo<OpenRouterKeyInfo | null>("openRouterKeyInfo", { apiKey, baseUrl })
 	} catch (error) {
 		console.error("Error fetching OpenRouter key info:", error)
 		return null
diff --git a/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts b/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
index 175ee7b8df..7f94b923f0 100644
--- a/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
+++ b/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
@@ -1,99 +1,25 @@
-import { z } from "zod"
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
 
 import type { ModelInfo } from "@roo-code/types"
 
-import { parseApiPrice } from "@roo/cost"
+import { requestProviderInfo } from "./requestProviderInfo"
 
 export const OPENROUTER_DEFAULT_PROVIDER_NAME = "[default]"
 
-const openRouterEndpointsSchema = z.object({
-	data: z.object({
-		id: z.string(),
-		name: z.string(),
-		description: z.string().optional(),
-		architecture: z
-			.object({
-				input_modalities: z.array(z.string()).nullish(),
-				output_modalities: z.array(z.string()).nullish(),
-				tokenizer: z.string().nullish(),
-			})
-			.nullish(),
-		endpoints: z.array(
-			z.object({
-				name: z.string(),
-				tag: z.string().optional(),
-				context_length: z.number(),
-				max_completion_tokens: z.number().nullish(),
-				pricing: z
-					.object({
-						prompt: z.union([z.string(), z.number()]).optional(),
-						completion: z.union([z.string(), z.number()]).optional(),
-						input_cache_read: z.union([z.string(), z.number()]).optional(),
-						input_cache_write: z.union([z.string(), z.number()]).optional(),
-					})
-					.optional(),
-			}),
-		),
-	}),
-})
-
 type OpenRouterModelProvider = ModelInfo & {
 	label: string
 }
 
 async function getOpenRouterProvidersForModel(modelId: string, baseUrl?: string) {
-	const models: Record<string, OpenRouterModelProvider> = {}
-
 	try {
-		const apiBaseUrl = baseUrl || "https://openrouter.ai/api/v1"
-		const response = await fetch(`${apiBaseUrl}/models/${modelId}/endpoints`, { method: "GET" })
-
-		if (!response.ok) {
-			throw new Error(`Request failed with status code ${response.status}`)
-		}
-
-		const result = openRouterEndpointsSchema.safeParse(await response.json())
-
-		if (!result.success) {
-			console.error("OpenRouter API response validation failed:", result.error)
-			return models
-		}
-
-		const { description, architecture, endpoints } = result.data.data
-
-		// Skip image generation models (models that output images)
-		if (architecture?.output_modalities?.includes("image")) {
-			return models
-		}
-
-		for (const endpoint of endpoints) {
-			const providerName = endpoint.tag ?? endpoint.name
-			const inputPrice = parseApiPrice(endpoint.pricing?.prompt)
-			const outputPrice = parseApiPrice(endpoint.pricing?.completion)
-			const cacheReadsPrice = parseApiPrice(endpoint.pricing?.input_cache_read)
-			const cacheWritesPrice = parseApiPrice(endpoint.pricing?.input_cache_write)
-
-			const modelInfo: OpenRouterModelProvider = {
-				maxTokens: endpoint.max_completion_tokens || endpoint.context_length,
-				contextWindow: endpoint.context_length,
-				supportsImages: architecture?.input_modalities?.includes("image") ?? false,
-				supportsPromptCache: typeof cacheReadsPrice !== "undefined",
-				cacheReadsPrice,
-				cacheWritesPrice,
-				inputPrice,
-				outputPrice,
-				description,
-				label: providerName,
-			}
-
-			models[providerName] = modelInfo
-		}
+		return await requestProviderInfo<Record<string, OpenRouterModelProvider>>("openRouterModelProviders", {
+			modelId,
+			baseUrl,
+		})
 	} catch (error) {
 		console.error(`Error fetching OpenRouter providers:`, error)
+		return {}
 	}
-
-	return models
 }
 
 type UseOpenRouterModelProvidersOptions = Omit<
diff --git a/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts b/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
index defc295173..45419f2202 100644
--- a/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
+++ b/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
@@ -1,45 +1,20 @@
-import { z } from "zod"
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
-import { toRequestyServiceUrl } from "@roo/utils/requesty"
 
-const requestyKeyInfoSchema = z.object({
-	name: z.string(),
-	monthly_limit: z.string(),
-	monthly_spend: z.string(),
-	org_balance: z.string(),
-	config: z.object({
-		aliases: z.record(z.string(), z.any()).optional(),
-	}),
-})
+import { requestProviderInfo } from "./requestProviderInfo"
 
-export type RequestyKeyInfo = z.infer<typeof requestyKeyInfoSchema>
+export type RequestyKeyInfo = {
+	name: string
+	monthly_limit: string
+	monthly_spend: string
+	org_balance: string
+	config: { aliases?: Record<string, unknown> }
+}
 
 async function getRequestyKeyInfo(baseUrl?: string, apiKey?: string) {
 	if (!apiKey) return null
 
-	const url = toRequestyServiceUrl(baseUrl, "api")
-	const apiKeyUrl = new URL("x/apikey", url)
-
 	try {
-		const response = await fetch(apiKeyUrl.toString(), {
-			method: "GET",
-			headers: {
-				Authorization: `Bearer ${apiKey}`,
-				"Content-Type": "application/json",
-			},
-		})
-
-		if (!response.ok) {
-			throw new Error(`Request failed with status code ${response.status}`)
-		}
-
-		const result = requestyKeyInfoSchema.safeParse(await response.json())
-		if (!result.success) {
-			console.error("Requesty API key info validation failed:", result.error)
-			return null
-		}
-
-		return result.data
+		return await requestProviderInfo<RequestyKeyInfo | null>("requestyKeyInfo", { apiKey, baseUrl })
 	} catch (error) {
 		console.error("Error fetching Requesty key info:", error)
 		return null
diff --git a/webview-ui/src/utils/test-utils.tsx b/webview-ui/src/utils/test-utils.tsx
index b64d88e0b6..847c401f2c 100644
--- a/webview-ui/src/utils/test-utils.tsx
+++ b/webview-ui/src/utils/test-utils.tsx
@@ -84,36 +84,3 @@ export * from "@testing-library/react"
 
 // override render method
 export { customRender as render }
-
-type TransportCall = { url: string; method: string; headers: Record<string, string> }
-type TransportResult = { status: number; body: unknown; jsonRejects?: Error }
-
-// Stubs global fetch and records the calls.
-export const stubTransport = (handler: (call: TransportCall) => TransportResult | Promise<TransportResult>) => {
-	const calls: TransportCall[] = []
-
-	vi.spyOn(globalThis, "fetch").mockImplementation(async (input, init) => {
-		const request = typeof input === "object" && "url" in input ? input : undefined
-		const call: TransportCall = {
-			url: request?.url ?? String(input),
-			method: init?.method ?? request?.method ?? "GET",
-			headers: Object.fromEntries(new Headers(init?.headers ?? request?.headers).entries()),
-		}
-		calls.push(call)
-		const result = await handler(call)
-
-		// The hooks consume only ok, status, and json from this response double.
-		return {
-			ok: result.status >= 200 && result.status < 300,
-			status: result.status,
-			json: async () => {
-				if (result.jsonRejects) {
-					throw result.jsonRejects
-				}
-				return result.body
-			},
-		} as Response
-	})
-
-	return { calls }
-}

From f47be91456d2f7b7c8944881ecafacc87f938372 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 01:12:56 +0000
Subject: [PATCH 06/11] test(webview): cap provider response size and cover
 cleanup

---
 .../__tests__/providerInfoHandler.spec.ts     | 47 +++++++++++++++++--
 src/core/webview/providerInfoHandler.ts       | 25 +++++++++-
 .../__tests__/providerInfoHooks.spec.tsx      | 24 +++++++++-
 3 files changed, 91 insertions(+), 5 deletions(-)

diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
index 0101295f07..8b835e7191 100644
--- a/src/core/webview/__tests__/providerInfoHandler.spec.ts
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -126,6 +126,24 @@ describe("handleRequestProviderInfo", () => {
 		})
 	})
 
+	it("keys an untagged endpoint by its name next to a tagged one", async () => {
+		const [tagged] = ENDPOINTS.data.endpoints
+		const untagged = { name: "Provider B", context_length: 32000, pricing: { prompt: "0.000001" } }
+		fetchSpy.mockResolvedValue(jsonResponse({ data: { ...ENDPOINTS.data, endpoints: [tagged, untagged] } }))
+
+		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o" })
+
+		const { values } = postMessageToWebview.mock.calls[0]![0]
+		expect(Object.keys(values.data)).toEqual(["openai", "Provider B"])
+		expect(values.data["Provider B"]).toMatchObject({
+			label: "Provider B",
+			maxTokens: 32000,
+			contextWindow: 32000,
+			inputPrice: 1,
+			supportsPromptCache: false,
+		})
+	})
+
 	it("returns no providers for an image-output model", async () => {
 		const body = { data: { ...ENDPOINTS.data, architecture: { output_modalities: ["image"] } } }
 		fetchSpy.mockResolvedValue(jsonResponse(body))
@@ -135,12 +153,35 @@ describe("handleRequestProviderInfo", () => {
 		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: {} })
 	})
 
-	it("returns null for a schema-invalid key response", async () => {
-		fetchSpy.mockResolvedValue(jsonResponse({ data: { label: 1 } }))
+	it.each([
+		["openRouterKeyInfo", { apiKey: "k" }, { data: { label: 1 } }, null],
+		["requestyKeyInfo", { apiKey: "k" }, { name: 1 }, null],
+		["openRouterModelProviders", { modelId: "m" }, { data: { id: "m" } }, {}],
+	])("returns the fallback and logs when %s gets a schema-invalid body", async (kind, params, body, fallback) => {
+		fetchSpy.mockResolvedValue(jsonResponse(body))
+
+		await send({ kind, ...params })
+
+		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: fallback })
+		expect(console.error).toHaveBeenCalled()
+	})
+
+	it("rejects a response body above the size cap", async () => {
+		const cancel = vi.fn()
+		const oversized = new ReadableStream<Uint8Array>({
+			pull: (controller) => controller.enqueue(new Uint8Array(512 * 1024)),
+			cancel,
+		})
+		fetchSpy.mockResolvedValue(new Response(oversized, { status: 200 }))
 
 		await send({ kind: "openRouterKeyInfo", apiKey: "k" })
 
-		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: null })
+		expect(cancel).toHaveBeenCalled()
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			error: "Provider info request failed",
+		})
 	})
 
 	it("posts an error without the configured URL when the request fails", async () => {
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
index 223bf51a99..761e6b7684 100644
--- a/src/core/webview/providerInfoHandler.ts
+++ b/src/core/webview/providerInfoHandler.ts
@@ -7,6 +7,8 @@ import { parseApiPrice } from "../../shared/cost"
 import { toRequestyServiceUrl } from "../../shared/utils/requesty"
 
 const FETCH_TIMEOUT_MS = 10_000
+// Far above any real provider response. The cap stops a configured endpoint from filling host memory.
+const MAX_BODY_BYTES = 1024 * 1024
 const OPENROUTER_DEFAULT_BASE_URL = "https://openrouter.ai/api/v1"
 
 const openRouterKeyInfoSchema = z.object({
@@ -66,6 +68,27 @@ const requestyKeyInfoSchema = z.object({
 	}),
 })
 
+async function readBoundedText(response: Response): Promise<string> {
+	// Count bytes as they arrive. Content-Length can be missing or wrong.
+	const reader = response.body?.getReader()
+	const chunks: Uint8Array[] = []
+	let total = 0
+
+	while (reader) {
+		const { done, value } = await reader.read()
+		if (done) break
+
+		total += value.byteLength
+		if (total > MAX_BODY_BYTES) {
+			await reader.cancel()
+			throw new Error("Response body too large")
+		}
+		chunks.push(value)
+	}
+
+	return Buffer.concat(chunks).toString("utf8")
+}
+
 async function getJson(url: string, headers?: Record<string, string>): Promise<unknown> {
 	const response = await fetch(url, {
 		method: "GET",
@@ -77,7 +100,7 @@ async function getJson(url: string, headers?: Record<string, string>): Promise<u
 		throw new Error(`Request failed with status code ${response.status}`)
 	}
 
-	return response.json()
+	return JSON.parse(await readBoundedText(response))
 }
 
 async function getOpenRouterKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
diff --git a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
index c065f2ed13..eceeac9f29 100644
--- a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
+++ b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
@@ -1,4 +1,5 @@
 import React from "react"
+import type { MockInstance } from "vitest"
 import { act, renderHook, waitFor } from "@testing-library/react"
 import { QueryClientProvider, type UseQueryResult } from "@tanstack/react-query"
 
@@ -52,7 +53,22 @@ describe("requestProviderInfo", () => {
 		vi.useRealTimers()
 	})
 
+	// Each settlement path must remove the exact listener it added and clear its timer.
+	const expectCleanedUp = (add: MockInstance, remove: MockInstance) => {
+		const added = add.mock.calls.filter(([type]) => type === "message").map(([, listener]) => listener)
+		const removed = remove.mock.calls.filter(([type]) => type === "message").map(([, listener]) => listener)
+		expect(added).toHaveLength(1)
+		expect(removed).toEqual(added)
+		expect(vi.getTimerCount()).toBe(0)
+	}
+
+	const spyOnListeners = () => {
+		vi.useFakeTimers()
+		return [vi.spyOn(window, "addEventListener"), vi.spyOn(window, "removeEventListener")] as const
+	}
+
 	it("posts the kind and params with a request id and resolves with the reply data", async () => {
+		const [add, remove] = spyOnListeners()
 		const { sent } = stubHost(() => ({ data: { ok: true } }))
 
 		await expect(
@@ -68,18 +84,22 @@ describe("requestProviderInfo", () => {
 				values: { kind: "openRouterKeyInfo", apiKey: "k", baseUrl: "https://x.test" },
 			},
 		])
+		expectCleanedUp(add, remove)
 	})
 
 	it("rejects with the host error message", async () => {
+		const [add, remove] = spyOnListeners()
 		stubHost(() => ({ error: "Provider info request failed" }))
 
 		await expect(requestProviderInfo("requestyKeyInfo", { apiKey: "k" })).rejects.toThrow(
 			"Provider info request failed",
 		)
+
+		expectCleanedUp(add, remove)
 	})
 
 	it("ignores replies for other request ids and rejects on timeout", async () => {
-		vi.useFakeTimers()
+		const [add, remove] = spyOnListeners()
 		stubHost(() => null)
 
 		const promise = requestProviderInfo("requestyKeyInfo", { apiKey: "k" })
@@ -90,9 +110,11 @@ describe("requestProviderInfo", () => {
 				data: { type: "providerInfo", requestId: "other", values: { data: { stolen: true } } },
 			}),
 		)
+		expect(remove).not.toHaveBeenCalledWith("message", expect.anything())
 		await act(() => vi.advanceTimersByTimeAsync(15_000))
 
 		await settled
+		expectCleanedUp(add, remove)
 	})
 })
 

From 56631e931c7a39cb294914ce26d8c2abe28f03a1 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 03:59:05 +0000
Subject: [PATCH 07/11] test(webview): close review gaps in provider info
 handling

---
 packages/types/src/vscode-extension-host.ts   |  8 +--
 .../webview/__tests__/ClineProvider.spec.ts   |  3 +
 .../__tests__/providerInfoHandler.spec.ts     | 72 ++++++++++++++++++-
 ...webviewMessageHandler.providerInfo.spec.ts | 30 ++++++++
 src/core/webview/providerInfoHandler.ts       | 16 +++--
 .../__tests__/providerInfoHooks.spec.tsx      | 21 ++++++
 6 files changed, 139 insertions(+), 11 deletions(-)
 create mode 100644 src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts

diff --git a/packages/types/src/vscode-extension-host.ts b/packages/types/src/vscode-extension-host.ts
index c58ab6145c..bc1b7ac6aa 100644
--- a/packages/types/src/vscode-extension-host.ts
+++ b/packages/types/src/vscode-extension-host.ts
@@ -23,10 +23,6 @@ import type { RuleMetadata } from "./rules.js"
 import type { TelemetrySetting } from "./telemetry.js"
 import type { WorktreeIncludeStatus } from "./worktree.js"
 
-/**
- * ExtensionMessage
- * Extension -> Webview | CLI
- */
 /** Provider lookups the extension host runs for the webview, keeping provider origins out of the CSP. */
 export type ProviderInfoKind = "openRouterKeyInfo" | "openRouterModelProviders" | "requestyKeyInfo"
 
@@ -36,6 +32,10 @@ export interface ProviderInfoParams {
 	modelId?: string
 }
 
+/**
+ * ExtensionMessage
+ * Extension -> Webview | CLI
+ */
 export interface ExtensionMessage {
 	type:
 		| "action"
diff --git a/src/core/webview/__tests__/ClineProvider.spec.ts b/src/core/webview/__tests__/ClineProvider.spec.ts
index 0053808315..693e63fbb1 100644
--- a/src/core/webview/__tests__/ClineProvider.spec.ts
+++ b/src/core/webview/__tests__/ClineProvider.spec.ts
@@ -3076,6 +3076,9 @@ describe("ClineProvider", () => {
 
 			expect(csp).toBeDefined()
 			expect(csp).toContain("connect-src vscode-webview://test-csp-source ")
+			if (build === "getHtmlContent") {
+				expect(csp).toContain("connect-src vscode-webview://test-csp-source https://us.i.posthog.com;")
+			}
 			expect(csp).not.toContain("evil.example")
 			expect(csp).not.toContain("requesty")
 			expect(csp).not.toContain("openrouter")
diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
index 8b835e7191..7281545695 100644
--- a/src/core/webview/__tests__/providerInfoHandler.spec.ts
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -107,6 +107,34 @@ describe("handleRequestProviderInfo", () => {
 		})
 	})
 
+	it("fetches Requesty key info from a custom base URL with auth headers", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse(REQUESTY_KEY_INFO))
+
+		await send({ kind: "requestyKeyInfo", apiKey: "rk", baseUrl: "https://router.custom.example/v1" })
+
+		const [url, init] = fetchSpy.mock.calls[0]!
+		expect(url).not.toBe("https://api.requesty.ai/x/apikey")
+		expect(String(url)).toMatch(/^https:\/\/[^/]*custom\.example\/.*x\/apikey$/)
+		expect(init).toMatchObject({
+			headers: { Authorization: "Bearer rk", "Content-Type": "application/json" },
+		})
+	})
+
+	it("returns no providers and sends no request without a modelId", async () => {
+		await send({ kind: "openRouterModelProviders" })
+
+		expect(fetchSpy).not.toHaveBeenCalled()
+		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: {} })
+	})
+
+	it("passes an abort signal with the request", async () => {
+		fetchSpy.mockResolvedValue(jsonResponse({ data: KEY_INFO }))
+
+		await send({ kind: "openRouterKeyInfo", apiKey: "k" })
+
+		expect(fetchSpy.mock.calls[0]![1]!.signal).toBeInstanceOf(AbortSignal)
+	})
+
 	it("maps OpenRouter endpoints to model info keyed by provider tag", async () => {
 		fetchSpy.mockResolvedValue(jsonResponse(ENDPOINTS))
 
@@ -184,8 +212,29 @@ describe("handleRequestProviderInfo", () => {
 		})
 	})
 
-	it("posts an error without the configured URL when the request fails", async () => {
-		fetchSpy.mockResolvedValue(jsonResponse({}, 401))
+	it("accepts a body of exactly the size cap and rejects one byte more", async () => {
+		const MAX = 1024 * 1024
+		const padded = (bytes: number) => {
+			const head = '{"data":null,"pad":"'
+			const tail = '"}'
+			return head + "a".repeat(bytes - head.length - tail.length) + tail
+		}
+
+		fetchSpy.mockResolvedValueOnce(new Response(padded(MAX), { status: 200 }))
+		await send({ kind: "openRouterKeyInfo", apiKey: "k" })
+		expect(postMessageToWebview.mock.calls[0]![0].error).toBeUndefined()
+
+		fetchSpy.mockResolvedValueOnce(new Response(padded(MAX + 1), { status: 200 }))
+		await send({ kind: "openRouterKeyInfo", apiKey: "k" })
+		expect(postMessageToWebview.mock.calls[1]![0].error).toBe("Provider info request failed")
+	})
+
+	it.each([
+		["a failed status", () => jsonResponse({}, 401)],
+		["a non-JSON 2xx body", () => new Response("<html>", { status: 200 })],
+		["a rejected fetch", () => Promise.reject(new Error("https://secret.example.com/key refused"))],
+	])("posts a generic error that leaks no URL on %s", async (_name, makeResponse) => {
+		fetchSpy.mockImplementation(async () => makeResponse())
 
 		await send({ kind: "openRouterKeyInfo", apiKey: "k", baseUrl: "https://secret.example.com" })
 
@@ -194,6 +243,23 @@ describe("handleRequestProviderInfo", () => {
 			requestId: "req-1",
 			error: "Provider info request failed",
 		})
+		const logged = JSON.stringify([vi.mocked(provider.log).mock.calls, vi.mocked(console.error).mock.calls])
+		expect(logged).not.toContain("secret.example.com")
+	})
+
+	it.each([
+		["apiKey", 5],
+		["baseUrl", {}],
+		["modelId", ["m"]],
+	])("rejects a non-string %s without a request", async (field, value) => {
+		await send({ kind: "openRouterKeyInfo", [field]: value })
+
+		expect(fetchSpy).not.toHaveBeenCalled()
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			error: "Invalid provider info request",
+		})
 	})
 
 	it.each([undefined, "unknown", "__proto__", "constructor"])("rejects unknown kind %s", async (kind) => {
@@ -203,7 +269,7 @@ describe("handleRequestProviderInfo", () => {
 		expect(postMessageToWebview).toHaveBeenCalledWith({
 			type: "providerInfo",
 			requestId: "req-1",
-			error: "Unknown provider info kind",
+			error: "Invalid provider info request",
 		})
 	})
 })
diff --git a/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts b/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
new file mode 100644
index 0000000000..1078e30f65
--- /dev/null
+++ b/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
@@ -0,0 +1,30 @@
+// npx vitest core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
+
+import type { ClineProvider } from "../ClineProvider"
+import { webviewMessageHandler } from "../webviewMessageHandler"
+
+vi.mock("../../../api/providers/fetchers/modelCache")
+
+describe("webviewMessageHandler - requestProviderInfo", () => {
+	// The handler uses only these two members for this message.
+	const postMessageToWebview = vi.fn()
+	const provider = { postMessageToWebview, log: vi.fn() } as unknown as ClineProvider
+
+	beforeEach(() => {
+		postMessageToWebview.mockReset()
+	})
+
+	it("routes the message to the provider info handler and posts a providerInfo reply", async () => {
+		await webviewMessageHandler(provider, {
+			type: "requestProviderInfo",
+			requestId: "req-9",
+			values: { kind: "nope" },
+		})
+
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-9",
+			error: "Invalid provider info request",
+		})
+	})
+})
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
index 761e6b7684..853dd3a52d 100644
--- a/src/core/webview/providerInfoHandler.ts
+++ b/src/core/webview/providerInfoHandler.ts
@@ -185,25 +185,33 @@ const fetchers: Record<ProviderInfoKind, (params: ProviderInfoParams) => Promise
 const isProviderInfoKind = (kind: unknown): kind is ProviderInfoKind =>
 	typeof kind === "string" && Object.hasOwn(fetchers, kind)
 
+// Non-string params fail the parse, so a bad value never reaches a fetcher.
+const providerInfoParamsSchema = z.object({
+	apiKey: z.string().optional(),
+	baseUrl: z.string().optional(),
+	modelId: z.string().optional(),
+})
+
 /**
  * Fetch provider key and model info in the extension host so the webview CSP
  * needs no provider origins. The webview sends unsaved settings values, so the
  * handler reads credentials from the message, not from saved config.
  */
 export async function handleRequestProviderInfo(provider: ClineProvider, message: WebviewMessage): Promise<void> {
-	const { kind, ...params } = (message.values ?? {}) as { kind?: unknown } & ProviderInfoParams
+	const { kind, ...rawParams } = message.values ?? {}
+	const parsed = providerInfoParamsSchema.safeParse(rawParams)
 
-	if (!isProviderInfoKind(kind)) {
+	if (!isProviderInfoKind(kind) || !parsed.success) {
 		await provider.postMessageToWebview({
 			type: "providerInfo",
 			requestId: message.requestId,
-			error: "Unknown provider info kind",
+			error: "Invalid provider info request",
 		})
 		return
 	}
 
 	try {
-		const data = await fetchers[kind](params)
+		const data = await fetchers[kind](parsed.data)
 		await provider.postMessageToWebview({ type: "providerInfo", requestId: message.requestId, values: { data } })
 	} catch (error) {
 		// Log the kind only. The error text can carry a configured URL.
diff --git a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
index eceeac9f29..9f1a5f620c 100644
--- a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
+++ b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
@@ -87,6 +87,27 @@ describe("requestProviderInfo", () => {
 		expectCleanedUp(add, remove)
 	})
 
+	it("gives each request its own id and settles out-of-order replies by id", async () => {
+		const { sent } = stubHost(() => null)
+
+		const first = requestProviderInfo<string>("requestyKeyInfo", { apiKey: "a" })
+		const second = requestProviderInfo<string>("requestyKeyInfo", { apiKey: "b" })
+		const [idA, idB] = sent.map((message) => message.requestId)
+		expect(idA).not.toBe(idB)
+
+		for (const [requestId, data] of [
+			[idB, "second"],
+			[idA, "first"],
+		]) {
+			window.dispatchEvent(
+				new MessageEvent("message", { data: { type: "providerInfo", requestId, values: { data } } }),
+			)
+		}
+
+		await expect(first).resolves.toBe("first")
+		await expect(second).resolves.toBe("second")
+	})
+
 	it("rejects with the host error message", async () => {
 		const [add, remove] = spyOnListeners()
 		stubHost(() => ({ error: "Provider info request failed" }))

From c7e1b720f8187940d01904ee00f38b38a1424a61 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 04:12:26 +0000
Subject: [PATCH 08/11] refactor(webview): reuse the OpenRouter endpoint
 fetcher for provider info

---
 packages/types/src/vscode-extension-host.ts   | 22 +++++-
 .../fetchers/__tests__/openrouter.spec.ts     | 29 +++++++
 src/api/providers/fetchers/openrouter.ts      |  4 +
 .../__tests__/providerInfoHandler.spec.ts     | 78 ++++---------------
 src/core/webview/providerInfoHandler.ts       | 78 ++-----------------
 .../__tests__/providerInfoHooks.spec.tsx      | 14 ++--
 .../ui/hooks/requestProviderInfo.ts           | 14 ++--
 .../ui/hooks/useOpenRouterKeyInfo.ts          | 17 ++--
 .../ui/hooks/useOpenRouterModelProviders.ts   |  8 +-
 .../components/ui/hooks/useRequestyKeyInfo.ts | 16 ++--
 10 files changed, 110 insertions(+), 170 deletions(-)

diff --git a/packages/types/src/vscode-extension-host.ts b/packages/types/src/vscode-extension-host.ts
index bc1b7ac6aa..ed075c90ca 100644
--- a/packages/types/src/vscode-extension-host.ts
+++ b/packages/types/src/vscode-extension-host.ts
@@ -24,7 +24,7 @@ import type { TelemetrySetting } from "./telemetry.js"
 import type { WorktreeIncludeStatus } from "./worktree.js"
 
 /** Provider lookups the extension host runs for the webview, keeping provider origins out of the CSP. */
-export type ProviderInfoKind = "openRouterKeyInfo" | "openRouterModelProviders" | "requestyKeyInfo"
+export type ProviderInfoKind = keyof ProviderInfoResultMap
 
 export interface ProviderInfoParams {
 	apiKey?: string
@@ -32,6 +32,26 @@ export interface ProviderInfoParams {
 	modelId?: string
 }
 
+/** Result of each lookup. The host and the webview share it, so the kind fixes the result type. */
+export interface ProviderInfoResultMap {
+	openRouterKeyInfo: {
+		label: string
+		usage: number
+		is_free_tier: boolean
+		is_provisioning_key: boolean
+		rate_limit: { requests: number; interval: string }
+		limit: number | null
+	} | null
+	openRouterModelProviders: Record<string, ModelInfo & { label: string }>
+	requestyKeyInfo: {
+		name: string
+		monthly_limit: string
+		monthly_spend: string
+		org_balance: string
+		config: { aliases?: Record<string, unknown> }
+	} | null
+}
+
 /**
  * ExtensionMessage
  * Extension -> Webview | CLI
diff --git a/src/api/providers/fetchers/__tests__/openrouter.spec.ts b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
index 2eca76e401..5d8d4faaba 100644
--- a/src/api/providers/fetchers/__tests__/openrouter.spec.ts
+++ b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
@@ -332,11 +332,40 @@ describe("OpenRouter API", () => {
 				"https://openrouter.ai/api/v1/models/anthropic/claude-sonnet-4/endpoints",
 				{
 					timeout: MODEL_CATALOG_FETCH_TIMEOUT_MS,
+					maxContentLength: 1024 * 1024,
 				},
 			)
 
 			getSpy.mockRestore()
 		})
+
+		it("returns no endpoints for an image-output model", async () => {
+			const axios = await import("axios")
+			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({
+				data: {
+					data: {
+						id: "vendor/image-model",
+						name: "Image Model",
+						architecture: { output_modalities: ["image"] },
+						endpoints: [{ provider_name: "P", context_length: 1000 }],
+					},
+				},
+			})
+
+			await expect(getOpenRouterModelEndpoints("vendor/image-model")).resolves.toEqual({})
+
+			getSpy.mockRestore()
+		})
+
+		it("returns no endpoints for a body without an endpoints list", async () => {
+			const axios = await import("axios")
+			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({ data: { data: { id: "m" } } })
+			vi.spyOn(console, "error").mockImplementation(() => {})
+
+			await expect(getOpenRouterModelEndpoints("m")).resolves.toEqual({})
+
+			getSpy.mockRestore()
+		})
 	})
 
 	describe("parseOpenRouterModel", () => {
diff --git a/src/api/providers/fetchers/openrouter.ts b/src/api/providers/fetchers/openrouter.ts
index 000f83643c..66b4334251 100644
--- a/src/api/providers/fetchers/openrouter.ts
+++ b/src/api/providers/fetchers/openrouter.ts
@@ -16,6 +16,8 @@ import { throwIfAborted } from "../utils/abort-signal"
 
 import { MODEL_CATALOG_FETCH_TIMEOUT_MS } from "./modelCache"
 
+const MAX_ENDPOINTS_BODY_BYTES = 1024 * 1024
+
 /**
  * OpenRouterBaseModel
  */
@@ -159,6 +161,8 @@ export async function getOpenRouterModelEndpoints(
 		// forever, and later callers would join that pending promise instead of retrying.
 		const response = await axios.get<OpenRouterModelEndpointsResponse>(`${baseURL}/models/${modelId}/endpoints`, {
 			timeout: MODEL_CATALOG_FETCH_TIMEOUT_MS,
+			// The base URL can come from user settings. The cap stops a huge body from filling host memory.
+			maxContentLength: MAX_ENDPOINTS_BODY_BYTES,
 		})
 		const result = openRouterModelEndpointsResponseSchema.safeParse(response.data)
 		const data = result.success ? result.data.data : response.data.data
diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
index 7281545695..be0dd7a6b2 100644
--- a/src/core/webview/__tests__/providerInfoHandler.spec.ts
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -1,8 +1,11 @@
 import type { WebviewMessage } from "@roo-code/types"
 
 import type { ClineProvider } from "../ClineProvider"
+import { getOpenRouterModelEndpoints } from "../../../api/providers/fetchers/openrouter"
 import { handleRequestProviderInfo } from "../providerInfoHandler"
 
+vi.mock("../../../api/providers/fetchers/openrouter", () => ({ getOpenRouterModelEndpoints: vi.fn() }))
+
 const KEY_INFO = {
 	label: "sk-or-v1-...abc",
 	usage: 12.5,
@@ -20,24 +23,6 @@ const REQUESTY_KEY_INFO = {
 	config: {},
 }
 
-const ENDPOINTS = {
-	data: {
-		id: "openai/gpt-4o",
-		name: "GPT-4o",
-		description: "desc",
-		architecture: { input_modalities: ["text", "image"], output_modalities: ["text"] },
-		endpoints: [
-			{
-				name: "OpenAI | gpt-4o",
-				tag: "openai",
-				context_length: 128000,
-				max_completion_tokens: 16384,
-				pricing: { prompt: "0.000005", completion: "0.000015", input_cache_read: "0.0000025" },
-			},
-		],
-	},
-}
-
 const jsonResponse = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status })
 
 describe("handleRequestProviderInfo", () => {
@@ -50,6 +35,7 @@ describe("handleRequestProviderInfo", () => {
 
 	beforeEach(() => {
 		postMessageToWebview.mockReset()
+		vi.mocked(getOpenRouterModelEndpoints).mockReset()
 		fetchSpy = vi.spyOn(globalThis, "fetch")
 		vi.spyOn(console, "error").mockImplementation(() => {})
 	})
@@ -124,6 +110,7 @@ describe("handleRequestProviderInfo", () => {
 		await send({ kind: "openRouterModelProviders" })
 
 		expect(fetchSpy).not.toHaveBeenCalled()
+		expect(getOpenRouterModelEndpoints).not.toHaveBeenCalled()
 		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: {} })
 	})
 
@@ -135,56 +122,25 @@ describe("handleRequestProviderInfo", () => {
 		expect(fetchSpy.mock.calls[0]![1]!.signal).toBeInstanceOf(AbortSignal)
 	})
 
-	it("maps OpenRouter endpoints to model info keyed by provider tag", async () => {
-		fetchSpy.mockResolvedValue(jsonResponse(ENDPOINTS))
-
-		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o" })
-
-		expect(fetchSpy.mock.calls[0]![0]).toBe("https://openrouter.ai/api/v1/models/openai/gpt-4o/endpoints")
-		const { values } = postMessageToWebview.mock.calls[0]![0]
-		expect(values.data.openai).toMatchObject({
-			label: "openai",
-			maxTokens: 16384,
-			contextWindow: 128000,
-			supportsImages: true,
-			supportsPromptCache: true,
-			inputPrice: 5,
-			outputPrice: 15,
-			cacheReadsPrice: 2.5,
-		})
-	})
-
-	it("keys an untagged endpoint by its name next to a tagged one", async () => {
-		const [tagged] = ENDPOINTS.data.endpoints
-		const untagged = { name: "Provider B", context_length: 32000, pricing: { prompt: "0.000001" } }
-		fetchSpy.mockResolvedValue(jsonResponse({ data: { ...ENDPOINTS.data, endpoints: [tagged, untagged] } }))
-
-		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o" })
-
-		const { values } = postMessageToWebview.mock.calls[0]![0]
-		expect(Object.keys(values.data)).toEqual(["openai", "Provider B"])
-		expect(values.data["Provider B"]).toMatchObject({
-			label: "Provider B",
-			maxTokens: 32000,
-			contextWindow: 32000,
-			inputPrice: 1,
-			supportsPromptCache: false,
-		})
-	})
-
-	it("returns no providers for an image-output model", async () => {
-		const body = { data: { ...ENDPOINTS.data, architecture: { output_modalities: ["image"] } } }
-		fetchSpy.mockResolvedValue(jsonResponse(body))
+	it("delegates OpenRouter model providers to the shared endpoint fetcher", async () => {
+		const providers = { "provider-a": { contextWindow: 128000, supportsPromptCache: true } }
+		vi.mocked(getOpenRouterModelEndpoints).mockResolvedValue(providers)
 
-		await send({ kind: "openRouterModelProviders", modelId: "m" })
+		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o", baseUrl: "https://proxy.test/v1" })
 
-		expect(postMessageToWebview.mock.calls[0]![0].values).toEqual({ data: {} })
+		expect(getOpenRouterModelEndpoints).toHaveBeenCalledWith("openai/gpt-4o", {
+			openRouterBaseUrl: "https://proxy.test/v1",
+		})
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-1",
+			values: { data: { "provider-a": { ...providers["provider-a"], label: "provider-a" } } },
+		})
 	})
 
 	it.each([
 		["openRouterKeyInfo", { apiKey: "k" }, { data: { label: 1 } }, null],
 		["requestyKeyInfo", { apiKey: "k" }, { name: 1 }, null],
-		["openRouterModelProviders", { modelId: "m" }, { data: { id: "m" } }, {}],
 	])("returns the fallback and logs when %s gets a schema-invalid body", async (kind, params, body, fallback) => {
 		fetchSpy.mockResolvedValue(jsonResponse(body))
 
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
index 853dd3a52d..917aa5585b 100644
--- a/src/core/webview/providerInfoHandler.ts
+++ b/src/core/webview/providerInfoHandler.ts
@@ -1,9 +1,9 @@
 import { z } from "zod"
 
-import type { ModelInfo, ProviderInfoKind, ProviderInfoParams, WebviewMessage } from "@roo-code/types"
+import type { ProviderInfoKind, ProviderInfoParams, ProviderInfoResultMap, WebviewMessage } from "@roo-code/types"
 
 import type { ClineProvider } from "./ClineProvider"
-import { parseApiPrice } from "../../shared/cost"
+import { getOpenRouterModelEndpoints } from "../../api/providers/fetchers/openrouter"
 import { toRequestyServiceUrl } from "../../shared/utils/requesty"
 
 const FETCH_TIMEOUT_MS = 10_000
@@ -25,39 +25,6 @@ const openRouterKeyInfoSchema = z.object({
 	}),
 })
 
-const priceSchema = z.union([z.string(), z.number()]).optional()
-
-const openRouterEndpointsSchema = z.object({
-	data: z.object({
-		id: z.string(),
-		name: z.string(),
-		description: z.string().optional(),
-		architecture: z
-			.object({
-				input_modalities: z.array(z.string()).nullish(),
-				output_modalities: z.array(z.string()).nullish(),
-				tokenizer: z.string().nullish(),
-			})
-			.nullish(),
-		endpoints: z.array(
-			z.object({
-				name: z.string(),
-				tag: z.string().optional(),
-				context_length: z.number(),
-				max_completion_tokens: z.number().nullish(),
-				pricing: z
-					.object({
-						prompt: priceSchema,
-						completion: priceSchema,
-						input_cache_read: priceSchema,
-						input_cache_write: priceSchema,
-					})
-					.optional(),
-			}),
-		),
-	}),
-})
-
 const requestyKeyInfoSchema = z.object({
 	name: z.string(),
 	monthly_limit: z.string(),
@@ -119,43 +86,14 @@ async function getOpenRouterKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
 	return result.data.data
 }
 
+// Reuse the shared fetcher. It returns {} on failure, which the webview treats as no providers.
+// The key is the provider label, so the webview select can show it.
 async function getOpenRouterModelProviders({ modelId, baseUrl }: ProviderInfoParams) {
-	const models: Record<string, ModelInfo & { label: string }> = {}
-
-	if (!modelId) return models
+	if (!modelId) return {}
 
-	const body = await getJson(`${baseUrl || OPENROUTER_DEFAULT_BASE_URL}/models/${modelId}/endpoints`)
-	const result = openRouterEndpointsSchema.safeParse(body)
-
-	if (!result.success) {
-		console.error("OpenRouter API response validation failed:", result.error)
-		return models
-	}
-
-	const { description, architecture, endpoints } = result.data.data
-
-	// Skip image generation models (models that output images).
-	if (architecture?.output_modalities?.includes("image")) return models
-
-	for (const endpoint of endpoints) {
-		const label = endpoint.tag ?? endpoint.name
-		const cacheReadsPrice = parseApiPrice(endpoint.pricing?.input_cache_read)
-
-		models[label] = {
-			maxTokens: endpoint.max_completion_tokens || endpoint.context_length,
-			contextWindow: endpoint.context_length,
-			supportsImages: architecture?.input_modalities?.includes("image") ?? false,
-			supportsPromptCache: typeof cacheReadsPrice !== "undefined",
-			cacheReadsPrice,
-			cacheWritesPrice: parseApiPrice(endpoint.pricing?.input_cache_write),
-			inputPrice: parseApiPrice(endpoint.pricing?.prompt),
-			outputPrice: parseApiPrice(endpoint.pricing?.completion),
-			description,
-			label,
-		}
-	}
+	const endpoints = await getOpenRouterModelEndpoints(modelId, { openRouterBaseUrl: baseUrl })
 
-	return models
+	return Object.fromEntries(Object.entries(endpoints).map(([label, info]) => [label, { ...info, label }]))
 }
 
 async function getRequestyKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
@@ -176,7 +114,7 @@ async function getRequestyKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
 	return result.data
 }
 
-const fetchers: Record<ProviderInfoKind, (params: ProviderInfoParams) => Promise<unknown>> = {
+const fetchers: { [K in ProviderInfoKind]: (params: ProviderInfoParams) => Promise<ProviderInfoResultMap[K]> } = {
 	openRouterKeyInfo: getOpenRouterKeyInfo,
 	openRouterModelProviders: getOpenRouterModelProviders,
 	requestyKeyInfo: getRequestyKeyInfo,
diff --git a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
index 9f1a5f620c..d50f08179e 100644
--- a/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
+++ b/webview-ui/src/components/ui/hooks/__tests__/providerInfoHooks.spec.tsx
@@ -90,22 +90,22 @@ describe("requestProviderInfo", () => {
 	it("gives each request its own id and settles out-of-order replies by id", async () => {
 		const { sent } = stubHost(() => null)
 
-		const first = requestProviderInfo<string>("requestyKeyInfo", { apiKey: "a" })
-		const second = requestProviderInfo<string>("requestyKeyInfo", { apiKey: "b" })
+		const first = requestProviderInfo("requestyKeyInfo", { apiKey: "a" })
+		const second = requestProviderInfo("requestyKeyInfo", { apiKey: "b" })
 		const [idA, idB] = sent.map((message) => message.requestId)
 		expect(idA).not.toBe(idB)
 
 		for (const [requestId, data] of [
-			[idB, "second"],
-			[idA, "first"],
+			[idB, { name: "second" }],
+			[idA, { name: "first" }],
 		]) {
 			window.dispatchEvent(
 				new MessageEvent("message", { data: { type: "providerInfo", requestId, values: { data } } }),
 			)
 		}
 
-		await expect(first).resolves.toBe("first")
-		await expect(second).resolves.toBe("second")
+		await expect(first).resolves.toMatchObject({ name: "first" })
+		await expect(second).resolves.toMatchObject({ name: "second" })
 	})
 
 	it("rejects with the host error message", async () => {
@@ -132,7 +132,7 @@ describe("requestProviderInfo", () => {
 			}),
 		)
 		expect(remove).not.toHaveBeenCalledWith("message", expect.anything())
-		await act(() => vi.advanceTimersByTimeAsync(15_000))
+		await act(() => vi.advanceTimersByTimeAsync(20_000))
 
 		await settled
 		expectCleanedUp(add, remove)
diff --git a/webview-ui/src/components/ui/hooks/requestProviderInfo.ts b/webview-ui/src/components/ui/hooks/requestProviderInfo.ts
index 3dc5a203b8..7702def0a9 100644
--- a/webview-ui/src/components/ui/hooks/requestProviderInfo.ts
+++ b/webview-ui/src/components/ui/hooks/requestProviderInfo.ts
@@ -1,12 +1,16 @@
-import type { ExtensionMessage, ProviderInfoKind, ProviderInfoParams } from "@roo-code/types"
+import type { ExtensionMessage, ProviderInfoKind, ProviderInfoParams, ProviderInfoResultMap } from "@roo-code/types"
 
 import { vscode } from "@src/utils/vscode"
 
-const TIMEOUT_MS = 15_000
+// Longer than every host-side fetch timeout (15 s at most), so the host answers first.
+const TIMEOUT_MS = 20_000
 
 /** Ask the extension host to run a provider lookup. The webview CSP allows no provider origins. */
-export const requestProviderInfo = <T>(kind: ProviderInfoKind, params: ProviderInfoParams): Promise<T> =>
-	new Promise<T>((resolve, reject) => {
+export const requestProviderInfo = <K extends ProviderInfoKind>(
+	kind: K,
+	params: ProviderInfoParams,
+): Promise<ProviderInfoResultMap[K]> =>
+	new Promise<ProviderInfoResultMap[K]>((resolve, reject) => {
 		const requestId = crypto.randomUUID()
 
 		const cleanup = () => {
@@ -29,7 +33,7 @@ export const requestProviderInfo = <T>(kind: ProviderInfoKind, params: ProviderI
 			if (message.error) {
 				reject(new Error(message.error))
 			} else {
-				resolve(message.values?.data as T)
+				resolve(message.values?.data as ProviderInfoResultMap[K])
 			}
 		}
 
diff --git a/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts b/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
index a0b53009da..6dd6385491 100644
--- a/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
+++ b/webview-ui/src/components/ui/hooks/useOpenRouterKeyInfo.ts
@@ -1,30 +1,25 @@
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
 
+import type { ProviderInfoResultMap } from "@roo-code/types"
+
 import { requestProviderInfo } from "./requestProviderInfo"
 
-export type OpenRouterKeyInfo = {
-	label: string
-	usage: number
-	is_free_tier: boolean
-	is_provisioning_key: boolean
-	rate_limit: { requests: number; interval: string }
-	limit: number | null
-}
+type OpenRouterKeyInfo = ProviderInfoResultMap["openRouterKeyInfo"]
 
 async function getOpenRouterKeyInfo(apiKey?: string, baseUrl?: string) {
 	if (!apiKey) return null
 
 	try {
-		return await requestProviderInfo<OpenRouterKeyInfo | null>("openRouterKeyInfo", { apiKey, baseUrl })
+		return await requestProviderInfo("openRouterKeyInfo", { apiKey, baseUrl })
 	} catch (error) {
 		console.error("Error fetching OpenRouter key info:", error)
 		return null
 	}
 }
 
-type UseOpenRouterKeyInfoOptions = Omit<UseQueryOptions<OpenRouterKeyInfo | null>, "queryKey" | "queryFn">
+type UseOpenRouterKeyInfoOptions = Omit<UseQueryOptions<OpenRouterKeyInfo>, "queryKey" | "queryFn">
 export const useOpenRouterKeyInfo = (apiKey?: string, baseUrl?: string, options?: UseOpenRouterKeyInfoOptions) => {
-	return useQuery<OpenRouterKeyInfo | null>({
+	return useQuery<OpenRouterKeyInfo>({
 		queryKey: ["openrouter-key-info", apiKey, baseUrl],
 		queryFn: () => getOpenRouterKeyInfo(apiKey, baseUrl),
 		staleTime: 30 * 1000, // 30 seconds
diff --git a/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts b/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
index 7f94b923f0..1150b1df89 100644
--- a/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
+++ b/webview-ui/src/components/ui/hooks/useOpenRouterModelProviders.ts
@@ -1,18 +1,16 @@
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
 
-import type { ModelInfo } from "@roo-code/types"
+import type { ProviderInfoResultMap } from "@roo-code/types"
 
 import { requestProviderInfo } from "./requestProviderInfo"
 
 export const OPENROUTER_DEFAULT_PROVIDER_NAME = "[default]"
 
-type OpenRouterModelProvider = ModelInfo & {
-	label: string
-}
+type OpenRouterModelProvider = ProviderInfoResultMap["openRouterModelProviders"][string]
 
 async function getOpenRouterProvidersForModel(modelId: string, baseUrl?: string) {
 	try {
-		return await requestProviderInfo<Record<string, OpenRouterModelProvider>>("openRouterModelProviders", {
+		return await requestProviderInfo("openRouterModelProviders", {
 			modelId,
 			baseUrl,
 		})
diff --git a/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts b/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
index 45419f2202..622e28ac8e 100644
--- a/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
+++ b/webview-ui/src/components/ui/hooks/useRequestyKeyInfo.ts
@@ -1,29 +1,25 @@
 import { useQuery, UseQueryOptions } from "@tanstack/react-query"
 
+import type { ProviderInfoResultMap } from "@roo-code/types"
+
 import { requestProviderInfo } from "./requestProviderInfo"
 
-export type RequestyKeyInfo = {
-	name: string
-	monthly_limit: string
-	monthly_spend: string
-	org_balance: string
-	config: { aliases?: Record<string, unknown> }
-}
+type RequestyKeyInfo = ProviderInfoResultMap["requestyKeyInfo"]
 
 async function getRequestyKeyInfo(baseUrl?: string, apiKey?: string) {
 	if (!apiKey) return null
 
 	try {
-		return await requestProviderInfo<RequestyKeyInfo | null>("requestyKeyInfo", { apiKey, baseUrl })
+		return await requestProviderInfo("requestyKeyInfo", { apiKey, baseUrl })
 	} catch (error) {
 		console.error("Error fetching Requesty key info:", error)
 		return null
 	}
 }
 
-type UseRequestyKeyInfoOptions = Omit<UseQueryOptions<RequestyKeyInfo | null>, "queryKey" | "queryFn">
+type UseRequestyKeyInfoOptions = Omit<UseQueryOptions<RequestyKeyInfo>, "queryKey" | "queryFn">
 export const useRequestyKeyInfo = (baseUrl?: string, apiKey?: string, options?: UseRequestyKeyInfoOptions) => {
-	return useQuery<RequestyKeyInfo | null>({
+	return useQuery<RequestyKeyInfo>({
 		queryKey: ["requesty-key-info", baseUrl, apiKey],
 		queryFn: () => getRequestyKeyInfo(baseUrl, apiKey),
 		staleTime: 30 * 1000, // 30 seconds

From 0900387154f1946d58b263205679fa77266ef09b Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 04:42:32 +0000
Subject: [PATCH 09/11] fix(webview): validate and redact the OpenRouter model
 providers lookup

---
 .../fetchers/__tests__/openrouter.spec.ts     | 31 +++++++++++++++++++
 src/api/providers/fetchers/openrouter.ts      | 10 +++++-
 .../__tests__/providerInfoHandler.spec.ts     |  8 +++--
 ...webviewMessageHandler.providerInfo.spec.ts | 21 +++++++++++++
 src/core/webview/providerInfoHandler.ts       |  6 +++-
 5 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/src/api/providers/fetchers/__tests__/openrouter.spec.ts b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
index 5d8d4faaba..79008f75bf 100644
--- a/src/api/providers/fetchers/__tests__/openrouter.spec.ts
+++ b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
@@ -357,6 +357,37 @@ describe("OpenRouter API", () => {
 			getSpy.mockRestore()
 		})
 
+		it("with untrustedBaseUrl returns no endpoints for a non-numeric context_length", async () => {
+			const axios = await import("axios")
+			const body = { data: { id: "m", name: "M", endpoints: [{ provider_name: "P", context_length: "bad" }] } }
+			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({ data: body })
+			vi.spyOn(console, "error").mockImplementation(() => {})
+
+			await expect(getOpenRouterModelEndpoints("m", undefined, { untrustedBaseUrl: true })).resolves.toEqual({})
+			// Trusted callers keep the lenient fallback.
+			await expect(getOpenRouterModelEndpoints("m")).resolves.toHaveProperty("P")
+
+			getSpy.mockRestore()
+		})
+
+		it("with untrustedBaseUrl logs no host name when the request fails", async () => {
+			const axios = await import("axios")
+			const getSpy = vi
+				.spyOn(axios.default, "get")
+				.mockRejectedValue(new Error("getaddrinfo ENOTFOUND secret.example.com"))
+			const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {})
+
+			await getOpenRouterModelEndpoints(
+				"m",
+				{ openRouterBaseUrl: "https://secret.example.com" },
+				{ untrustedBaseUrl: true },
+			)
+
+			expect(JSON.stringify(errorSpy.mock.calls)).not.toContain("secret.example.com")
+
+			getSpy.mockRestore()
+		})
+
 		it("returns no endpoints for a body without an endpoints list", async () => {
 			const axios = await import("axios")
 			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({ data: { data: { id: "m" } } })
diff --git a/src/api/providers/fetchers/openrouter.ts b/src/api/providers/fetchers/openrouter.ts
index 66b4334251..db5f928863 100644
--- a/src/api/providers/fetchers/openrouter.ts
+++ b/src/api/providers/fetchers/openrouter.ts
@@ -151,9 +151,13 @@ export async function getOpenRouterModels(
 export async function getOpenRouterModelEndpoints(
 	modelId: string,
 	options?: ApiHandlerOptions,
+	// untrustedBaseUrl: the base URL comes from unsaved webview settings. Reject schema-invalid
+	// bodies and keep the URL out of error logs.
+	opts?: { untrustedBaseUrl?: boolean },
 ): Promise<Record<string, ModelInfo>> {
 	const models: Record<string, ModelInfo> = {}
 	const baseURL = options?.openRouterBaseUrl || "https://openrouter.ai/api/v1"
+	const untrusted = opts?.untrustedBaseUrl === true
 
 	try {
 		// This request runs outside getModels()' single-flight, so it needs its own bound:
@@ -169,6 +173,7 @@ export async function getOpenRouterModelEndpoints(
 
 		if (!result.success) {
 			console.error("OpenRouter model endpoints response is invalid", result.error.format())
+			if (untrusted) return models
 		}
 
 		const { id, architecture, endpoints } = data
@@ -188,8 +193,11 @@ export async function getOpenRouterModelEndpoints(
 			})
 		}
 	} catch (error) {
+		// The error text can carry a configured host name.
 		console.error(
-			`Error fetching OpenRouter model endpoints: ${JSON.stringify(error, Object.getOwnPropertyNames(error), 2)}`,
+			untrusted
+				? `Error fetching OpenRouter model endpoints: ${error instanceof Error ? error.name : "unknown"}`
+				: `Error fetching OpenRouter model endpoints: ${JSON.stringify(error, Object.getOwnPropertyNames(error), 2)}`,
 		)
 	}
 
diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
index be0dd7a6b2..7bc0c16f81 100644
--- a/src/core/webview/__tests__/providerInfoHandler.spec.ts
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -128,9 +128,11 @@ describe("handleRequestProviderInfo", () => {
 
 		await send({ kind: "openRouterModelProviders", modelId: "openai/gpt-4o", baseUrl: "https://proxy.test/v1" })
 
-		expect(getOpenRouterModelEndpoints).toHaveBeenCalledWith("openai/gpt-4o", {
-			openRouterBaseUrl: "https://proxy.test/v1",
-		})
+		expect(getOpenRouterModelEndpoints).toHaveBeenCalledWith(
+			"openai/gpt-4o",
+			{ openRouterBaseUrl: "https://proxy.test/v1" },
+			{ untrustedBaseUrl: true },
+		)
 		expect(postMessageToWebview).toHaveBeenCalledWith({
 			type: "providerInfo",
 			requestId: "req-1",
diff --git a/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts b/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
index 1078e30f65..5d48c8169a 100644
--- a/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
+++ b/src/core/webview/__tests__/webviewMessageHandler.providerInfo.spec.ts
@@ -5,6 +5,8 @@ import { webviewMessageHandler } from "../webviewMessageHandler"
 
 vi.mock("../../../api/providers/fetchers/modelCache")
 
+const KEY_INFO = { name: "key", monthly_limit: "100", monthly_spend: "5", org_balance: "95", config: {} }
+
 describe("webviewMessageHandler - requestProviderInfo", () => {
 	// The handler uses only these two members for this message.
 	const postMessageToWebview = vi.fn()
@@ -27,4 +29,23 @@ describe("webviewMessageHandler - requestProviderInfo", () => {
 			error: "Invalid provider info request",
 		})
 	})
+
+	it("routes a valid request to the fetcher and posts the success reply", async () => {
+		const fetchSpy = vi
+			.spyOn(globalThis, "fetch")
+			.mockResolvedValue(new Response(JSON.stringify(KEY_INFO), { status: 200 }))
+
+		await webviewMessageHandler(provider, {
+			type: "requestProviderInfo",
+			requestId: "req-10",
+			values: { kind: "requestyKeyInfo", apiKey: "rk" },
+		})
+
+		expect(postMessageToWebview).toHaveBeenCalledWith({
+			type: "providerInfo",
+			requestId: "req-10",
+			values: { data: KEY_INFO },
+		})
+		fetchSpy.mockRestore()
+	})
 })
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
index 917aa5585b..63b541b86e 100644
--- a/src/core/webview/providerInfoHandler.ts
+++ b/src/core/webview/providerInfoHandler.ts
@@ -91,7 +91,11 @@ async function getOpenRouterKeyInfo({ apiKey, baseUrl }: ProviderInfoParams) {
 async function getOpenRouterModelProviders({ modelId, baseUrl }: ProviderInfoParams) {
 	if (!modelId) return {}
 
-	const endpoints = await getOpenRouterModelEndpoints(modelId, { openRouterBaseUrl: baseUrl })
+	const endpoints = await getOpenRouterModelEndpoints(
+		modelId,
+		{ openRouterBaseUrl: baseUrl },
+		{ untrustedBaseUrl: true },
+	)
 
 	return Object.fromEntries(Object.entries(endpoints).map(([label, info]) => [label, { ...info, label }]))
 }

From eb7ed4d55ad264a27f01ba578f58408c09dc13be Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 18:39:39 +0000
Subject: [PATCH 10/11] fix(webview): apply the 10 s timeout to the model
 providers lookup

---
 .../fetchers/__tests__/openrouter.spec.ts     | 34 ++++++++++++++++---
 src/api/providers/fetchers/openrouter.ts      |  4 +--
 .../__tests__/providerInfoHandler.spec.ts     |  2 +-
 src/core/webview/providerInfoHandler.ts       |  2 +-
 4 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/src/api/providers/fetchers/__tests__/openrouter.spec.ts b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
index 79008f75bf..b334db247e 100644
--- a/src/api/providers/fetchers/__tests__/openrouter.spec.ts
+++ b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
@@ -357,15 +357,39 @@ describe("OpenRouter API", () => {
 			getSpy.mockRestore()
 		})
 
-		it("with untrustedBaseUrl returns no endpoints for a non-numeric context_length", async () => {
+		it.each([
+			["a non-numeric", "bad", false],
+			["a numeric", 4096, true],
+		])("with untrustedBaseUrl handles %s context_length", async (_name, contextLength, accepted) => {
 			const axios = await import("axios")
-			const body = { data: { id: "m", name: "M", endpoints: [{ provider_name: "P", context_length: "bad" }] } }
+			const endpoint = { name: "P", provider_name: "P", context_length: contextLength }
+			const body = { data: { id: "m", name: "M", endpoints: [endpoint] } }
 			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({ data: body })
 			vi.spyOn(console, "error").mockImplementation(() => {})
 
-			await expect(getOpenRouterModelEndpoints("m", undefined, { untrustedBaseUrl: true })).resolves.toEqual({})
-			// Trusted callers keep the lenient fallback.
-			await expect(getOpenRouterModelEndpoints("m")).resolves.toHaveProperty("P")
+			const result = await getOpenRouterModelEndpoints("m", undefined, { untrustedBaseUrl: true })
+
+			if (accepted) {
+				expect(Object.keys(result)).toEqual(["P"])
+				expect(result["P"]).toMatchObject({ contextWindow: 4096 })
+			} else {
+				expect(result).toEqual({})
+				// Trusted callers keep the lenient fallback.
+				await expect(getOpenRouterModelEndpoints("m")).resolves.toHaveProperty("P")
+			}
+
+			getSpy.mockRestore()
+		})
+
+		it("uses the caller timeout when given", async () => {
+			const axios = await import("axios")
+			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({
+				data: { data: { id: "m", name: "M", endpoints: [] } },
+			})
+
+			await getOpenRouterModelEndpoints("m", undefined, { timeoutMs: 10_000 })
+
+			expect(getSpy).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ timeout: 10_000 }))
 
 			getSpy.mockRestore()
 		})
diff --git a/src/api/providers/fetchers/openrouter.ts b/src/api/providers/fetchers/openrouter.ts
index db5f928863..fc60189a0e 100644
--- a/src/api/providers/fetchers/openrouter.ts
+++ b/src/api/providers/fetchers/openrouter.ts
@@ -153,7 +153,7 @@ export async function getOpenRouterModelEndpoints(
 	options?: ApiHandlerOptions,
 	// untrustedBaseUrl: the base URL comes from unsaved webview settings. Reject schema-invalid
 	// bodies and keep the URL out of error logs.
-	opts?: { untrustedBaseUrl?: boolean },
+	opts?: { untrustedBaseUrl?: boolean; timeoutMs?: number },
 ): Promise<Record<string, ModelInfo>> {
 	const models: Record<string, ModelInfo> = {}
 	const baseURL = options?.openRouterBaseUrl || "https://openrouter.ai/api/v1"
@@ -164,7 +164,7 @@ export async function getOpenRouterModelEndpoints(
 		// a stalled endpoint response would otherwise keep the caller's catalog load pending
 		// forever, and later callers would join that pending promise instead of retrying.
 		const response = await axios.get<OpenRouterModelEndpointsResponse>(`${baseURL}/models/${modelId}/endpoints`, {
-			timeout: MODEL_CATALOG_FETCH_TIMEOUT_MS,
+			timeout: opts?.timeoutMs ?? MODEL_CATALOG_FETCH_TIMEOUT_MS,
 			// The base URL can come from user settings. The cap stops a huge body from filling host memory.
 			maxContentLength: MAX_ENDPOINTS_BODY_BYTES,
 		})
diff --git a/src/core/webview/__tests__/providerInfoHandler.spec.ts b/src/core/webview/__tests__/providerInfoHandler.spec.ts
index 7bc0c16f81..e8c4d66f50 100644
--- a/src/core/webview/__tests__/providerInfoHandler.spec.ts
+++ b/src/core/webview/__tests__/providerInfoHandler.spec.ts
@@ -131,7 +131,7 @@ describe("handleRequestProviderInfo", () => {
 		expect(getOpenRouterModelEndpoints).toHaveBeenCalledWith(
 			"openai/gpt-4o",
 			{ openRouterBaseUrl: "https://proxy.test/v1" },
-			{ untrustedBaseUrl: true },
+			{ untrustedBaseUrl: true, timeoutMs: 10_000 },
 		)
 		expect(postMessageToWebview).toHaveBeenCalledWith({
 			type: "providerInfo",
diff --git a/src/core/webview/providerInfoHandler.ts b/src/core/webview/providerInfoHandler.ts
index 63b541b86e..aac43cd2cc 100644
--- a/src/core/webview/providerInfoHandler.ts
+++ b/src/core/webview/providerInfoHandler.ts
@@ -94,7 +94,7 @@ async function getOpenRouterModelProviders({ modelId, baseUrl }: ProviderInfoPar
 	const endpoints = await getOpenRouterModelEndpoints(
 		modelId,
 		{ openRouterBaseUrl: baseUrl },
-		{ untrustedBaseUrl: true },
+		{ untrustedBaseUrl: true, timeoutMs: FETCH_TIMEOUT_MS },
 	)
 
 	return Object.fromEntries(Object.entries(endpoints).map(([label, info]) => [label, { ...info, label }]))

From 5d9ac31603a25a51e7e6d5632441f59998df8ae8 Mon Sep 17 00:00:00 2001
From: Elliott de Launay <edelauna@gmail.com>
Date: Sun, 15 Nov 2026 20:26:40 +0000
Subject: [PATCH 11/11] fix(webview): bound the total time of the endpoints
 request

---
 .../fetchers/__tests__/openrouter.spec.ts     | 33 +++++++++++++++++++
 src/api/providers/fetchers/openrouter.ts      |  7 ++--
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/src/api/providers/fetchers/__tests__/openrouter.spec.ts b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
index b334db247e..ba629b7302 100644
--- a/src/api/providers/fetchers/__tests__/openrouter.spec.ts
+++ b/src/api/providers/fetchers/__tests__/openrouter.spec.ts
@@ -1,5 +1,8 @@
 // npx vitest run api/providers/fetchers/__tests__/openrouter.spec.ts
 
+import http from "http"
+import nock from "nock"
+import type { AddressInfo } from "net"
 import * as path from "path"
 
 import { back as nockBack } from "nock"
@@ -332,6 +335,7 @@ describe("OpenRouter API", () => {
 				"https://openrouter.ai/api/v1/models/anthropic/claude-sonnet-4/endpoints",
 				{
 					timeout: MODEL_CATALOG_FETCH_TIMEOUT_MS,
+					signal: expect.any(AbortSignal),
 					maxContentLength: 1024 * 1024,
 				},
 			)
@@ -381,6 +385,35 @@ describe("OpenRouter API", () => {
 			getSpy.mockRestore()
 		})
 
+		it("bounds the total time of a body that streams slowly after the headers arrive", async () => {
+			const server = http.createServer((_req, res) => {
+				res.writeHead(200, { "Content-Type": "application/json" })
+				// One byte at a time keeps the socket active, so only a total deadline can stop it.
+				const timer = setInterval(() => res.write(" "), 50)
+				res.on("close", () => clearInterval(timer))
+			})
+			await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+			const { port } = server.address() as AddressInfo
+			vi.spyOn(console, "error").mockImplementation(() => {})
+			nock.enableNetConnect("127.0.0.1")
+
+			try {
+				const start = Date.now()
+				const result = await getOpenRouterModelEndpoints(
+					"m",
+					{ openRouterBaseUrl: `http://127.0.0.1:${port}` },
+					{ untrustedBaseUrl: true, timeoutMs: 300 },
+				)
+
+				expect(result).toEqual({})
+				expect(Date.now() - start).toBeLessThan(2000)
+			} finally {
+				nock.disableNetConnect()
+				server.closeAllConnections()
+				await new Promise((resolve) => server.close(resolve))
+			}
+		})
+
 		it("uses the caller timeout when given", async () => {
 			const axios = await import("axios")
 			const getSpy = vi.spyOn(axios.default, "get").mockResolvedValue({
diff --git a/src/api/providers/fetchers/openrouter.ts b/src/api/providers/fetchers/openrouter.ts
index fc60189a0e..dda19b54c8 100644
--- a/src/api/providers/fetchers/openrouter.ts
+++ b/src/api/providers/fetchers/openrouter.ts
@@ -12,7 +12,7 @@ import {
 import type { ApiHandlerOptions } from "../../../shared/api"
 import { parseApiPrice } from "../../../shared/cost"
 
-import { throwIfAborted } from "../utils/abort-signal"
+import { hasUsableTimeout, mergeAbortSignalAndTimeout, throwIfAborted, toSdkTimeoutMs } from "../utils/abort-signal"
 
 import { MODEL_CATALOG_FETCH_TIMEOUT_MS } from "./modelCache"
 
@@ -158,13 +158,16 @@ export async function getOpenRouterModelEndpoints(
 	const models: Record<string, ModelInfo> = {}
 	const baseURL = options?.openRouterBaseUrl || "https://openrouter.ai/api/v1"
 	const untrusted = opts?.untrustedBaseUrl === true
+	const timeoutMs = hasUsableTimeout(opts?.timeoutMs) ? opts.timeoutMs : MODEL_CATALOG_FETCH_TIMEOUT_MS
 
 	try {
 		// This request runs outside getModels()' single-flight, so it needs its own bound:
 		// a stalled endpoint response would otherwise keep the caller's catalog load pending
 		// forever, and later callers would join that pending promise instead of retrying.
 		const response = await axios.get<OpenRouterModelEndpointsResponse>(`${baseURL}/models/${modelId}/endpoints`, {
-			timeout: opts?.timeoutMs ?? MODEL_CATALOG_FETCH_TIMEOUT_MS,
+			timeout: toSdkTimeoutMs(timeoutMs),
+			// Also bound the whole body read, in case the transport stops its timer after the headers.
+			signal: mergeAbortSignalAndTimeout(undefined, timeoutMs),
 			// The base URL can come from user settings. The cap stops a huge body from filling host memory.
 			maxContentLength: MAX_ENDPOINTS_BODY_BYTES,
 		})