app: agent-proxy forwards upstream 3xx Location, sending the browser to the OAuth wall it exists to avoid

[zuckerberg-db]

Found by isaac review of genie-agent vs main, and verified against the source.

What happens

The proxy fetches upstream with redirects unfollowed:

// src/app/api/agent-proxy/[[...path]]/route.ts:154
redirect: "manual",

location is not in STRIPPED_RESPONSE_HEADERS (:57), and there is no 3xx handling anywhere
in the file. A 3xx has no text/html body, so it takes the passthrough branch and the real
Location reaches the browser untouched.

When the agent app redirects an unauthenticated or expired request to Databricks OIDC, the
browser follows that Location cross-origin to databricksapps.com — the exact OAuth wall this
proxy was built to keep guests away from.

Status: latent, not active

This is reachable on token expiry, not on the happy path. Every E2E run has had a valid
session (app.data_path_status=200), so the suite has never exercised it. Guests are the group
most likely to hit it, since their links and sessions lapse by design.

I am flagging the code shape as proven and the user-visible impact as inferred — I have not
observed the redirect in a live run.

Suggested fix

Detect a 3xx upstream response and either rewrite a same-origin/relative Location back under
the /api/agent-proxy mount, or translate an OIDC redirect into a 401 so the client re-mints a
token. Do not pass the raw cross-origin Location through.