Remove preview protection bypass plumbing from cloud CLI

strix/interface/cloud/http.py

@@ -159,9 +159,6 @@ def request(
     headers = {
         "Authorization": f"Bearer {api_token(token)}",
     }
-    bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip()
-    if bypass:
-        headers["x-vercel-protection-bypass"] = bypass
     workspace_id = _expected_workspace_id(token_override=token is not None)
     if workspace_id:
         headers["X-Strix-Workspace"] = workspace_id

strix/interface/cloud/payment_proxy.py

@@ -8,7 +8,6 @@ requests (challenge and paid retry) to the fixed billing endpoint.
 
 from __future__ import annotations
 
-import os
 import secrets
 import threading
 from contextlib import contextmanager, suppress
@@ -164,9 +163,6 @@ def _make_handler(state: _BridgeState) -> type[BaseHTTPRequestHandler]:
 
             headers = _forward_request_headers(self)
             headers["X-Strix-Authorization"] = state.authorization
-            bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip()
-            if bypass:
-                headers["x-vercel-protection-bypass"] = bypass
             try:
                 response = requests.request(
                     "POST",
@@ -250,7 +246,7 @@ def wallet_payment_bridge(
     expected_body: bytes,
     timeout: float | None = None,
     response_observer: Callable[[WalletUpstreamResponse], None] | None = None,
-) -> Generator[str, None, None]:
+) -> Generator[str]:
     """Yield a one-run loopback URL that injects the Strix API token upstream.
 
     The random path prevents accidental cross-process requests and limits local

strix/interface/platform_cli.py

@@ -11,7 +11,6 @@ from __future__ import annotations
 import argparse
 import contextlib
 import json
-import os
 import sys
 import time
 import webbrowser
@@ -210,7 +209,6 @@ def _run_device_flow(  # noqa: PLR0912, PLR0915
     try:
         response = requests.post(
             f"{app_url}/api/v1/cli/login",
-            headers=_preview_headers(),
             timeout=_HTTP_TIMEOUT_S,
             allow_redirects=False,
         )
@@ -275,7 +273,6 @@ def _run_device_flow(  # noqa: PLR0912, PLR0915
         try:
             poll = requests.post(
                 f"{app_url}/api/v1/cli/login/poll",
-                headers=_preview_headers(),
                 json=poll_body,
                 timeout=_HTTP_TIMEOUT_S,
                 allow_redirects=False,
@@ -415,7 +412,6 @@ def _complete_selection(
     try:
         response = requests.post(
             f"{app_url}/api/v1/cli/login/complete",
-            headers=_preview_headers(),
             json=body,
             timeout=_HTTP_TIMEOUT_S,
             allow_redirects=False,
@@ -581,17 +577,11 @@ def _error_detail(response: requests.Response) -> str:
     return f"HTTP {response.status_code}"
 
 
-def _preview_headers() -> dict[str, str]:
-    bypass = os.environ.get("STRIX_VERCEL_PROTECTION_BYPASS", "").strip()
-    return {"x-vercel-protection-bypass": bypass} if bypass else {}
-
-
 def _session_headers(record: dict[str, Any]) -> dict[str, str]:
     headers = {"Authorization": f"Bearer {record['api_token']}"}
     workspace_id = record.get("organization_id")
     if isinstance(workspace_id, str) and workspace_id:
         headers["X-Strix-Workspace"] = workspace_id
-    headers.update(_preview_headers())
     return headers
 
 

tests/test_cloud_session.py

@@ -35,7 +35,6 @@ def auth_path(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
     monkeypatch.setattr(platform_cli, "AUTH_PATH", path)
     monkeypatch.delenv("STRIX_API_TOKEN", raising=False)
     monkeypatch.delenv("STRIX_WORKSPACE_ID", raising=False)
-    monkeypatch.delenv("STRIX_VERCEL_PROTECTION_BYPASS", raising=False)
     return path
 
 
@@ -69,32 +68,6 @@ def test_http_workspace_pin_is_captured_once(
     assert sent[0]["X-Strix-Workspace"] == "org_start"
 
 
-def test_preview_bypass_is_opt_in_and_shared_by_login_and_api_requests(
-    auth_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    assert auth_path.parent.exists()
-    platform_cli.save_record(
-        {
-            "api_token": "secret",
-            "organization_id": "org_1",
-            "app_url": "https://preview.example.test",
-        }
-    )
-    sent: list[dict[str, str]] = []
-    monkeypatch.setenv("STRIX_VERCEL_PROTECTION_BYPASS", "preview-secret")
-    monkeypatch.setattr(
-        http.requests,
-        "request",
-        lambda *_args, **kwargs: sent.append(dict(kwargs["headers"])) or Response({}),
-    )
-
-    http.configure()
-    http.request("GET", "/scans")
-
-    assert sent[0]["x-vercel-protection-bypass"] == "preview-secret"
-    assert platform_cli._preview_headers() == {"x-vercel-protection-bypass": "preview-secret"}
-
-
 def test_session_scope_update_persists_only_for_stored_session(
     auth_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: Any
 ) -> None: