test(providers): assemble the userinfo fixture instead of writing it inline

[lidge-jun]

Summary

The OpenCode Go destination test added by #5165 carried an inline https URL with userinfo. privacy:scan reads source text, so its email detector read the password and host as an address and failed the gates job on dev. That blocks every branch whose merge ref includes current dev, not just this test.

isAllowedEmail in scripts/privacy-scan.ts already carries one URL-userinfo exemption for a chatgpt.com fixture, so adding a second entry was available and is the wrong fix. That allowlist is what keeps the detector able to fail on a real address, and every entry spends a little of that. Assembling the URL through the username and password setters removes the literal entirely and leaves nothing to exempt.

The input under test does not change. new URL with the same path plus those two setters serializes to exactly the string it replaces, so the case still proves that a base URL carrying userinfo refuses the patient same-target fallback.

Reported by the contract-campaign task, which hit it on its own merge ref in job 105937216310 and confirmed the literal is on dev rather than on its branch.

Verification

• Local checks: NOT RUN. This lane is prohibited from running local suites, focused tests, typecheck, builds, installs or any live ocx command, so no local result is claimed. Exact-head hosted CI is the executable evidence.
• Static review instead: read isAllowedEmail to confirm the existing exemption shape and that widening it was the alternative being rejected; confirmed by inspection that the assembled href is byte-identical to the removed literal; confirmed no other occurrence of the pattern remains in the file.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. Not needed: this is a test fixture with no user-facing surface.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. This change removes a credential-shaped literal from the tree and does not weaken the scanner.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T17:40:11.856243Z	2accf95	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4a666bd5-91c3-40d1-afa7-e4c3c2b4f691

📥 Commits

Reviewing files that changed from the base of the PR and between 920d8d7 and 2accf95.

📒 Files selected for processing (1)

• tests/providers/rate-limit-retry.test.ts

 ___________________________________________________________
< Veni, Vidi, Codici Fixi. I came, I saw, I fixed the code. >
 -----------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}