proxy on a provider profile in config.json names an
http://[user:pass@]host[:port] proxy. Every request that profile makes goes
through it while another profile keeps connecting directly, so a provider
whose network is blocked can be reached without moving every provider onto a
proxy. The address is validated when the profile is saved, kept by a partial
save, cleared by null, and listed with the profile by /settings.
Model streams and web search reach the target through a CONNECT tunnel with TLS started over it, so the certificate checked is the target's and the connection pool is keyed by the proxy. The profile's own non-stream calls — the Codex model list, its sign-in exchange, token refreshes — go through a dedicated httpc profile, because httpc takes a proxy per profile rather than per request. Account-level Codex quota polling follows the first Codex profile that names one.
/login asks for it as an "HTTP proxy" step — when a provider is added, and after the model choice that makes a profile from a signed-in account — with blank meaning a direct connection, and every profile's pane says which proxy it uses ("direct" when it has none). The same field is a profile patch any client can send.