diff --git a/packages/agent/src/agent-loop.ts b/packages/agent/src/agent-loop.ts
index 753466aca..377ea6c57 100644
--- a/packages/agent/src/agent-loop.ts
+++ b/packages/agent/src/agent-loop.ts
@@ -230,9 +230,13 @@ async function streamAssistantResponse(
 	const resolvedApiKey =
 		(config.getApiKey ? await config.getApiKey(config.model.provider) : undefined) || config.apiKey;
 
+	// Create custom fetch if configured
+	const customFetch = config.createFetch?.(config.model);
+
 	const response = await streamFunction(config.model, llmContext, {
 		...config,
 		apiKey: resolvedApiKey,
+		fetch: customFetch,
 		signal,
 	});
 
diff --git a/packages/agent/src/agent.ts b/packages/agent/src/agent.ts
index 2db01d81d..5008108e3 100644
--- a/packages/agent/src/agent.ts
+++ b/packages/agent/src/agent.ts
@@ -71,6 +71,12 @@ export interface AgentOptions {
 	 * Useful for expiring tokens (e.g., GitHub Copilot OAuth).
 	 */
 	getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+
+	/**
+	 * Factory to create a custom fetch function for HTTP requests.
+	 * Use this to intercept, modify, or log HTTP requests made to the LLM provider.
+	 */
+	createFetch?: (model: Model<any>) => typeof globalThis.fetch;
 }
 
 export class Agent {
@@ -97,6 +103,7 @@ export class Agent {
 	public streamFn: StreamFn;
 	private _sessionId?: string;
 	public getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+	public createFetch?: (model: Model<any>) => typeof globalThis.fetch;
 	private runningPrompt?: Promise<void>;
 	private resolveRunningPrompt?: () => void;
 
@@ -109,6 +116,7 @@ export class Agent {
 		this.streamFn = opts.streamFn || streamSimple;
 		this._sessionId = opts.sessionId;
 		this.getApiKey = opts.getApiKey;
+		this.createFetch = opts.createFetch;
 	}
 
 	/**
@@ -313,6 +321,7 @@ export class Agent {
 			convertToLlm: this.convertToLlm,
 			transformContext: this.transformContext,
 			getApiKey: this.getApiKey,
+			createFetch: this.createFetch,
 			getSteeringMessages: async () => {
 				if (this.steeringMode === "one-at-a-time") {
 					if (this.steeringQueue.length > 0) {
diff --git a/packages/agent/src/types.ts b/packages/agent/src/types.ts
index ecdb2057c..e8027b7ce 100644
--- a/packages/agent/src/types.ts
+++ b/packages/agent/src/types.ts
@@ -22,6 +22,12 @@ export type StreamFn = (
 export interface AgentLoopConfig extends SimpleStreamOptions {
 	model: Model<any>;
 
+	/**
+	 * Factory to create a custom fetch function for HTTP requests.
+	 * Use this to intercept, modify, or log HTTP requests made to the LLM provider.
+	 */
+	createFetch?: (model: Model<any>) => typeof globalThis.fetch;
+
 	/**
 	 * Converts AgentMessage[] to LLM-compatible Message[] before each LLM call.
 	 *
diff --git a/packages/ai/src/providers/anthropic.ts b/packages/ai/src/providers/anthropic.ts
index 4be8b3c1a..e723d089a 100644
--- a/packages/ai/src/providers/anthropic.ts
+++ b/packages/ai/src/providers/anthropic.ts
@@ -115,7 +115,12 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 
 		try {
 			const apiKey = options?.apiKey ?? getEnvApiKey(model.provider) ?? "";
-			const { client, isOAuthToken } = createClient(model, apiKey, options?.interleavedThinking ?? true);
+			const { client, isOAuthToken } = createClient(
+				model,
+				apiKey,
+				options?.interleavedThinking ?? true,
+				options?.fetch,
+			);
 			const params = buildParams(model, context, isOAuthToken, options);
 			const anthropicStream = client.messages.stream({ ...params, stream: true }, { signal: options?.signal });
 			stream.push({ type: "start", partial: output });
@@ -282,6 +287,7 @@ function createClient(
 	model: Model<"anthropic-messages">,
 	apiKey: string,
 	interleavedThinking: boolean,
+	customFetch?: typeof globalThis.fetch,
 ): { client: Anthropic; isOAuthToken: boolean } {
 	const betaFeatures = ["fine-grained-tool-streaming-2025-05-14"];
 	if (interleavedThinking) {
@@ -302,6 +308,7 @@ function createClient(
 			baseURL: model.baseUrl,
 			defaultHeaders,
 			dangerouslyAllowBrowser: true,
+			fetch: customFetch,
 		});
 
 		return { client, isOAuthToken: true };
@@ -318,6 +325,7 @@ function createClient(
 			baseURL: model.baseUrl,
 			dangerouslyAllowBrowser: true,
 			defaultHeaders,
+			fetch: customFetch,
 		});
 
 		return { client, isOAuthToken: false };
diff --git a/packages/ai/src/providers/google-gemini-cli.ts b/packages/ai/src/providers/google-gemini-cli.ts
index 7bc8ef9a3..d917dfe0e 100644
--- a/packages/ai/src/providers/google-gemini-cli.ts
+++ b/packages/ai/src/providers/google-gemini-cli.ts
@@ -259,6 +259,7 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 			const headers = isAntigravity ? ANTIGRAVITY_HEADERS : GEMINI_CLI_HEADERS;
 
 			// Fetch with retry logic for rate limits and transient errors
+			const fetchFn = options?.fetch ?? globalThis.fetch;
 			let response: Response | undefined;
 			let lastError: Error | undefined;
 
@@ -268,7 +269,7 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 				}
 
 				try {
-					response = await fetch(url, {
+					response = await fetchFn(url, {
 						method: "POST",
 						headers: {
 							Authorization: `Bearer ${accessToken}`,
diff --git a/packages/ai/src/providers/google.ts b/packages/ai/src/providers/google.ts
index 67893eefa..86df7d486 100644
--- a/packages/ai/src/providers/google.ts
+++ b/packages/ai/src/providers/google.ts
@@ -1,3 +1,11 @@
+/**
+ * Google Generative AI provider using the official @google/genai SDK.
+ *
+ * Note: The @google/genai SDK does not expose a custom fetch option in GoogleGenAIOptions.
+ * The SDK has internal support for custom fetch but it is not accessible via the public
+ * GoogleGenAI constructor. As a result, HTTP hooks will not fire for this provider.
+ * Users who need HTTP hooks should use the google-gemini-cli provider instead.
+ */
 import {
 	type GenerateContentConfig,
 	type GenerateContentParameters,
diff --git a/packages/ai/src/providers/openai-codex-responses.ts b/packages/ai/src/providers/openai-codex-responses.ts
index 0f74b635c..af46d8def 100644
--- a/packages/ai/src/providers/openai-codex-responses.ts
+++ b/packages/ai/src/providers/openai-codex-responses.ts
@@ -141,7 +141,8 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 				headers: redactHeaders(headers),
 			});
 
-			const response = await fetch(url, {
+			const fetchFn = options?.fetch ?? globalThis.fetch;
+			const response = await fetchFn(url, {
 				method: "POST",
 				headers,
 				body: JSON.stringify(transformedBody),
diff --git a/packages/ai/src/providers/openai-completions.ts b/packages/ai/src/providers/openai-completions.ts
index 30ee6ca27..3df8fa451 100644
--- a/packages/ai/src/providers/openai-completions.ts
+++ b/packages/ai/src/providers/openai-completions.ts
@@ -100,7 +100,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 
 		try {
 			const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
-			const client = createClient(model, context, apiKey);
+			const client = createClient(model, context, apiKey, options?.fetch);
 			const params = buildParams(model, context, options);
 			const openaiStream = await client.chat.completions.create(params, { signal: options?.signal });
 			stream.push({ type: "start", partial: output });
@@ -315,7 +315,12 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 	return stream;
 };
 
-function createClient(model: Model<"openai-completions">, context: Context, apiKey?: string) {
+function createClient(
+	model: Model<"openai-completions">,
+	context: Context,
+	apiKey?: string,
+	customFetch?: typeof globalThis.fetch,
+) {
 	if (!apiKey) {
 		if (!process.env.OPENAI_API_KEY) {
 			throw new Error(
@@ -356,6 +361,7 @@ function createClient(model: Model<"openai-completions">, context: Context, apiK
 		baseURL: model.baseUrl,
 		dangerouslyAllowBrowser: true,
 		defaultHeaders: headers,
+		fetch: customFetch,
 	});
 }
 
diff --git a/packages/ai/src/providers/openai-responses.ts b/packages/ai/src/providers/openai-responses.ts
index 884687ae8..f8b9d2fee 100644
--- a/packages/ai/src/providers/openai-responses.ts
+++ b/packages/ai/src/providers/openai-responses.ts
@@ -83,7 +83,7 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 		try {
 			// Create OpenAI client
 			const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
-			const client = createClient(model, context, apiKey);
+			const client = createClient(model, context, apiKey, options?.fetch);
 			const params = buildParams(model, context, options);
 			const openaiStream = await client.responses.create(params, { signal: options?.signal });
 			stream.push({ type: "start", partial: output });
@@ -312,7 +312,12 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 	return stream;
 };
 
-function createClient(model: Model<"openai-responses">, context: Context, apiKey?: string) {
+function createClient(
+	model: Model<"openai-responses">,
+	context: Context,
+	apiKey?: string,
+	customFetch?: typeof globalThis.fetch,
+) {
 	if (!apiKey) {
 		if (!process.env.OPENAI_API_KEY) {
 			throw new Error(
@@ -353,6 +358,7 @@ function createClient(model: Model<"openai-responses">, context: Context, apiKey
 		baseURL: model.baseUrl,
 		dangerouslyAllowBrowser: true,
 		defaultHeaders: headers,
+		fetch: customFetch,
 	});
 }
 
diff --git a/packages/ai/src/stream.ts b/packages/ai/src/stream.ts
index 79bee9846..7661e095b 100644
--- a/packages/ai/src/stream.ts
+++ b/packages/ai/src/stream.ts
@@ -178,6 +178,7 @@ function mapOptionsForApi<TApi extends Api>(
 		signal: options?.signal,
 		apiKey: apiKey || options?.apiKey,
 		sessionId: options?.sessionId,
+		fetch: options?.fetch,
 	};
 
 	// Helper to clamp xhigh to high for providers that don't support it
diff --git a/packages/ai/src/types.ts b/packages/ai/src/types.ts
index 5c81bce9c..1c3fd3270 100644
--- a/packages/ai/src/types.ts
+++ b/packages/ai/src/types.ts
@@ -70,6 +70,12 @@ export interface StreamOptions {
 	 * session-aware features. Ignored by providers that don't support it.
 	 */
 	sessionId?: string;
+	/**
+	 * Custom fetch function for HTTP hooks.
+	 * Note: The google-generative-ai provider does not support custom fetch due to SDK limitations.
+	 * Use google-gemini-cli instead if you need HTTP hooks for Google models.
+	 */
+	fetch?: typeof globalThis.fetch;
 }
 
 // Unified options with reasoning passed to streamSimple() and completeSimple()
diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md
index f023b8654..c7f33e6e1 100644
--- a/packages/coding-agent/CHANGELOG.md
+++ b/packages/coding-agent/CHANGELOG.md
@@ -648,6 +648,13 @@ Total color count increased from 46 to 50. See [docs/theme.md](docs/theme.md) fo
 - **API key priority**: `ANTHROPIC_OAUTH_TOKEN` now takes precedence over `ANTHROPIC_API_KEY`
 - HTML export template split into separate files (template.html, template.css, template.js) for easier maintenance
 
+### Added
+
+- **`http_request` hook event**: Fired before HTTP requests to LLM providers. Hooks can add custom headers or cancel requests. API keys are automatically redacted from headers.
+- **`http_response` hook event**: Fired after HTTP responses from LLM providers. Includes status, headers, and request duration for logging and monitoring.
+
+**Note:** The `google-generative-ai` provider does not support HTTP hooks due to SDK limitations. Use `google-gemini-cli` instead for Google models if you need HTTP hooks.
+
 ### Fixed
 
 - HTML export now properly sanitizes user messages containing HTML tags like `<style>` that could break DOM rendering
diff --git a/packages/coding-agent/src/core/extensions/http.ts b/packages/coding-agent/src/core/extensions/http.ts
new file mode 100644
index 000000000..ab7a5a0df
--- /dev/null
+++ b/packages/coding-agent/src/core/extensions/http.ts
@@ -0,0 +1,150 @@
+import type { Model } from "@mariozechner/pi-ai";
+import type { ExtensionRunner } from "./runner.js";
+
+/**
+ * Headers that should have their values redacted in http_request events.
+ * These headers contain sensitive authentication information.
+ */
+const REDACTED_HEADERS = [
+	"authorization",
+	"x-api-key",
+	"api-key",
+	"x-goog-api-key",
+	"anthropic-api-key",
+	"proxy-authorization",
+	"cookie",
+	"set-cookie",
+];
+
+/**
+ * Patterns to detect sensitive headers by name.
+ * If a header name (lowercase) contains any of these, it should be redacted.
+ */
+const SENSITIVE_HEADER_PATTERNS = ["auth", "token", "key", "secret", "cookie"];
+
+/**
+ * Redact sensitive header values from a headers object.
+ */
+export function redactHeaders(headers: Record<string, string>): Record<string, string> {
+	const result: Record<string, string> = {};
+	for (const [key, value] of Object.entries(headers)) {
+		const lowerKey = key.toLowerCase();
+		const shouldRedact =
+			REDACTED_HEADERS.includes(lowerKey) || SENSITIVE_HEADER_PATTERNS.some((pattern) => lowerKey.includes(pattern));
+		result[key] = shouldRedact ? "[REDACTED]" : value;
+	}
+	return result;
+}
+
+/**
+ * Convert Headers object to plain Record.
+ */
+export function headersToRecord(headers: Headers): Record<string, string> {
+	const result: Record<string, string> = {};
+	headers.forEach((value, key) => {
+		result[key] = value;
+	});
+	return result;
+}
+
+/**
+ * Create a fetch factory function for extension HTTP events.
+ *
+ * Returns undefined if no http_request or http_response handlers are registered,
+ * allowing the Agent to use the default fetch.
+ *
+ * When handlers exist, returns a factory that creates a fetch wrapper which:
+ * - Emits http_request events before requests (with redacted auth headers)
+ * - Allows extensions to add custom headers or cancel requests
+ * - Emits http_response events after responses with timing
+ *
+ * Note: Not all providers support a custom fetch (depends on underlying SDK usage).
+ */
+export function createExtensionFetchFactory(
+	runner: ExtensionRunner | undefined,
+): ((model: Model<any>) => typeof globalThis.fetch) | undefined {
+	if (!runner) return undefined;
+
+	const hasHttpRequestHandlers = runner.hasHandlers("http_request");
+	const hasHttpResponseHandlers = runner.hasHandlers("http_response");
+
+	if (!hasHttpRequestHandlers && !hasHttpResponseHandlers) {
+		return undefined;
+	}
+
+	return (model: Model<any>): typeof globalThis.fetch => {
+		return async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
+			const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+			const method =
+				init?.method || (typeof input !== "string" && !(input instanceof URL) ? input.method : undefined) || "GET";
+
+			const normalizeHeaderValue = (value: unknown): string => {
+				if (Array.isArray(value)) {
+					return value.map((v) => String(v)).join(", ");
+				}
+				if (value === undefined || value === null) return "";
+				return String(value);
+			};
+
+			// Build headers record from input Request + init
+			let headers: Record<string, string> = {};
+
+			if (typeof input !== "string" && !(input instanceof URL)) {
+				headers = headersToRecord(input.headers);
+			}
+
+			if (init?.headers) {
+				if (init.headers instanceof Headers) {
+					headers = { ...headers, ...headersToRecord(init.headers) };
+				} else if (Array.isArray(init.headers)) {
+					for (const [key, value] of init.headers) {
+						headers[key] = normalizeHeaderValue(value);
+					}
+				} else {
+					for (const [key, value] of Object.entries(init.headers)) {
+						headers[key] = normalizeHeaderValue(value);
+					}
+				}
+			}
+
+			// Emit http_request event with redacted headers
+			let extraHeaders: Record<string, string> | undefined;
+			if (hasHttpRequestHandlers) {
+				const result = await runner.emitHttpRequest({
+					provider: model.provider,
+					modelId: model.id,
+					url,
+					method,
+					headers: redactHeaders(headers),
+					body: typeof init?.body === "string" ? init.body : undefined,
+				});
+
+				if (result?.cancel) {
+					throw new Error("HTTP request cancelled by extension");
+				}
+				extraHeaders = result?.headers;
+			}
+
+			const finalInit: RequestInit = { ...init };
+			if (extraHeaders) {
+				finalInit.headers = { ...headers, ...extraHeaders };
+			}
+
+			const startTime = Date.now();
+			const response = await globalThis.fetch(input, finalInit);
+			const durationMs = Date.now() - startTime;
+
+			if (hasHttpResponseHandlers) {
+				await runner.emitHttpResponse({
+					provider: model.provider,
+					modelId: model.id,
+					status: response.status,
+					headers: headersToRecord(response.headers),
+					durationMs,
+				});
+			}
+
+			return response;
+		};
+	};
+}
diff --git a/packages/coding-agent/src/core/extensions/index.ts b/packages/coding-agent/src/core/extensions/index.ts
index 4b7c901b8..aa25ca0f5 100644
--- a/packages/coding-agent/src/core/extensions/index.ts
+++ b/packages/coding-agent/src/core/extensions/index.ts
@@ -40,6 +40,9 @@ export type {
 	GetActiveToolsHandler,
 	GetAllToolsHandler,
 	GrepToolResultEvent,
+	HttpRequestEvent,
+	HttpRequestEventResult,
+	HttpResponseEvent,
 	LoadExtensionsResult,
 	// Loaded Extension
 	LoadedExtension,
diff --git a/packages/coding-agent/src/core/extensions/runner.ts b/packages/coding-agent/src/core/extensions/runner.ts
index 41ad7883d..80536ec3f 100644
--- a/packages/coding-agent/src/core/extensions/runner.ts
+++ b/packages/coding-agent/src/core/extensions/runner.ts
@@ -23,6 +23,9 @@ import type {
 	ExtensionUIContext,
 	GetActiveToolsHandler,
 	GetAllToolsHandler,
+	HttpRequestEvent,
+	HttpRequestEventResult,
+	HttpResponseEvent,
 	LoadedExtension,
 	MessageRenderer,
 	RegisteredCommand,
@@ -465,4 +468,76 @@ export class ExtensionRunner {
 
 		return undefined;
 	}
+
+	/**
+	 * Emit http_request event to all extensions.
+	 * Returns the merged result from all handlers (headers merged, cancel if any).
+	 */
+	async emitHttpRequest(event: Omit<HttpRequestEvent, "type">): Promise<HttpRequestEventResult | undefined> {
+		const ctx = this.createContext();
+		let mergedHeaders: Record<string, string> | undefined;
+		let cancel = false;
+
+		const fullEvent: HttpRequestEvent = { type: "http_request", ...event };
+
+		for (const ext of this.extensions) {
+			const handlers = ext.handlers.get("http_request");
+			if (!handlers || handlers.length === 0) continue;
+
+			for (const handler of handlers) {
+				try {
+					const handlerResult = await handler(fullEvent, ctx);
+					if (handlerResult) {
+						const result = handlerResult as HttpRequestEventResult;
+						if (result.cancel) cancel = true;
+						if (result.headers) {
+							mergedHeaders = { ...mergedHeaders, ...result.headers };
+						}
+					}
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					const stack = err instanceof Error ? err.stack : undefined;
+					this.emitError({
+						extensionPath: ext.path,
+						event: "http_request",
+						error: message,
+						stack,
+					});
+				}
+			}
+		}
+
+		if (cancel || mergedHeaders) {
+			return { cancel, headers: mergedHeaders };
+		}
+		return undefined;
+	}
+
+	/**
+	 * Emit http_response event to all extensions.
+	 */
+	async emitHttpResponse(event: Omit<HttpResponseEvent, "type">): Promise<void> {
+		const ctx = this.createContext();
+		const fullEvent: HttpResponseEvent = { type: "http_response", ...event };
+
+		for (const ext of this.extensions) {
+			const handlers = ext.handlers.get("http_response");
+			if (!handlers || handlers.length === 0) continue;
+
+			for (const handler of handlers) {
+				try {
+					await handler(fullEvent, ctx);
+				} catch (err) {
+					const message = err instanceof Error ? err.message : String(err);
+					const stack = err instanceof Error ? err.stack : undefined;
+					this.emitError({
+						extensionPath: ext.path,
+						event: "http_response",
+						error: message,
+						stack,
+					});
+				}
+			}
+		}
+	}
 }
diff --git a/packages/coding-agent/src/core/extensions/types.ts b/packages/coding-agent/src/core/extensions/types.ts
index 44bd7b6f4..f2d56e5be 100644
--- a/packages/coding-agent/src/core/extensions/types.ts
+++ b/packages/coding-agent/src/core/extensions/types.ts
@@ -413,6 +413,39 @@ export function isLsToolResult(e: ToolResultEvent): e is LsToolResultEvent {
 	return e.toolName === "ls";
 }
 
+// ============================================================================
+// HTTP Events
+// ============================================================================
+
+/**
+ * Fired before an HTTP request is made to an LLM provider.
+ * Extensions can add headers or cancel the request.
+ */
+export interface HttpRequestEvent {
+	type: "http_request";
+	provider: string;
+	modelId: string;
+	url: string;
+	method: string;
+	/** Request headers with sensitive values redacted */
+	headers: Record<string, string>;
+	/** Request body (if present and a string) */
+	body?: string;
+}
+
+/**
+ * Fired after an HTTP response is received from an LLM provider.
+ * Useful for logging and monitoring.
+ */
+export interface HttpResponseEvent {
+	type: "http_response";
+	provider: string;
+	modelId: string;
+	status: number;
+	headers: Record<string, string>;
+	durationMs: number;
+}
+
 /** Union of all event types */
 export type ExtensionEvent =
 	| SessionEvent
@@ -423,7 +456,9 @@ export type ExtensionEvent =
 	| TurnStartEvent
 	| TurnEndEvent
 	| ToolCallEvent
-	| ToolResultEvent;
+	| ToolResultEvent
+	| HttpRequestEvent
+	| HttpResponseEvent;
 
 // ============================================================================
 // Event Results
@@ -471,6 +506,13 @@ export interface SessionBeforeTreeResult {
 	};
 }
 
+export interface HttpRequestEventResult {
+	/** Additional headers to merge into the request */
+	headers?: Record<string, string>;
+	/** If true, cancel the request (throws an error) */
+	cancel?: boolean;
+}
+
 // ============================================================================
 // Message Rendering
 // ============================================================================
@@ -538,6 +580,8 @@ export interface ExtensionAPI {
 	on(event: "turn_end", handler: ExtensionHandler<TurnEndEvent>): void;
 	on(event: "tool_call", handler: ExtensionHandler<ToolCallEvent, ToolCallEventResult>): void;
 	on(event: "tool_result", handler: ExtensionHandler<ToolResultEvent, ToolResultEventResult>): void;
+	on(event: "http_request", handler: ExtensionHandler<HttpRequestEvent, HttpRequestEventResult>): void;
+	on(event: "http_response", handler: ExtensionHandler<HttpResponseEvent>): void;
 
 	// =========================================================================
 	// Tool Registration
diff --git a/packages/coding-agent/src/core/sdk.ts b/packages/coding-agent/src/core/sdk.ts
index e15926e81..41b9318f1 100644
--- a/packages/coding-agent/src/core/sdk.ts
+++ b/packages/coding-agent/src/core/sdk.ts
@@ -27,6 +27,7 @@ import { getAgentDir } from "../config.js";
 import { AgentSession } from "./agent-session.js";
 import { AuthStorage } from "./auth-storage.js";
 import { createEventBus, type EventBus } from "./event-bus.js";
+import { createExtensionFetchFactory } from "./extensions/http.js";
 import {
 	discoverAndLoadExtensions,
 	type ExtensionFactory,
@@ -303,7 +304,6 @@ export function loadSettings(cwd?: string, agentDir?: string): Settings {
 		images: { autoResize: manager.getImageAutoResize(), blockImages: manager.getBlockImages() },
 	};
 }
-
 // Factory
 
 /**
@@ -672,6 +672,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			}
 			return key;
 		},
+		createFetch: createExtensionFetchFactory(extensionRunner),
 	});
 	time("createAgent");
 
diff --git a/packages/coding-agent/test/hooks/http-hooks-integration.test.ts b/packages/coding-agent/test/hooks/http-hooks-integration.test.ts
new file mode 100644
index 000000000..a53b31b4a
--- /dev/null
+++ b/packages/coding-agent/test/hooks/http-hooks-integration.test.ts
@@ -0,0 +1,852 @@
+/**
+ * Integration tests for HTTP extensions with the fetch wrapper.
+ *
+ * Tests the full flow from extension registration through the fetch wrapper
+ * that integrates with pi-ai.
+ */
+
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import type { Api, Model } from "@mariozechner/pi-ai";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createExtensionFetchFactory, headersToRecord, redactHeaders } from "../../src/core/extensions/http.js";
+import { ExtensionRunner } from "../../src/core/extensions/runner.js";
+import type { HttpRequestEvent, HttpResponseEvent, LoadedExtension } from "../../src/core/extensions/types.js";
+import type { ModelRegistry } from "../../src/core/model-registry.js";
+import type { SessionManager } from "../../src/core/session-manager.js";
+
+// Mock SessionManager
+function createMockSessionManager(): SessionManager {
+	return {
+		getCwd: () => "/test",
+		getSessionDir: () => "/test/.pi/sessions",
+		getSessionId: () => "test-session",
+		getSessionFile: () => "/test/.pi/sessions/test.jsonl",
+		getLeafUuid: () => "test-uuid",
+		getLeafEntry: () => undefined,
+		getEntry: () => undefined,
+		getLabel: () => undefined,
+		getPath: () => [],
+		getHeader: () => undefined,
+		getEntries: () => [],
+		getTree: () => ({ roots: [], currentPath: [] }),
+	} as unknown as SessionManager;
+}
+
+// Mock ModelRegistry
+function createMockModelRegistry(): ModelRegistry {
+	return {
+		getApiKey: async () => "test-key",
+		find: () => undefined,
+		getAll: () => [],
+	} as unknown as ModelRegistry;
+}
+
+// Mock Model
+function createMockModel(): Model<Api> {
+	return {
+		id: "claude-sonnet-4-5",
+		name: "Claude Sonnet 4.5",
+		api: "anthropic-messages",
+		provider: "anthropic",
+		baseUrl: "https://api.anthropic.com",
+		reasoning: true,
+		input: ["text", "image"],
+		cost: { input: 3, output: 15, cacheRead: 0.3, cacheWrite: 3.75 },
+		contextWindow: 200000,
+		maxTokens: 8192,
+	} as Model<Api>;
+}
+
+// Create a LoadedExtension
+function createExtension(
+	onHttpRequest?: (event: HttpRequestEvent) => { headers?: Record<string, string>; cancel?: boolean } | undefined,
+	onHttpResponse?: (event: HttpResponseEvent) => undefined,
+): LoadedExtension {
+	const handlers = new Map<string, ((event: unknown, ctx: unknown) => Promise<unknown>)[]>();
+
+	if (onHttpRequest) {
+		handlers.set("http_request", [async (event: unknown) => onHttpRequest(event as HttpRequestEvent)]);
+	}
+
+	if (onHttpResponse) {
+		handlers.set("http_response", [async (event: unknown) => onHttpResponse(event as HttpResponseEvent)]);
+	}
+
+	return {
+		path: "test-extension",
+		resolvedPath: "/test/test-extension.ts",
+		handlers,
+		tools: new Map(),
+		messageRenderers: new Map(),
+		commands: new Map(),
+		flags: new Map(),
+		flagValues: new Map(),
+		shortcuts: new Map(),
+		setSendMessageHandler: () => {},
+		setSendUserMessageHandler: () => {},
+		setAppendEntryHandler: () => {},
+		setGetActiveToolsHandler: () => {},
+		setGetAllToolsHandler: () => {},
+		setSetActiveToolsHandler: () => {},
+		setFlagValue: () => {},
+	};
+}
+
+/**
+ * Helper to create the wrapped fetch using the real createExtensionFetchFactory.
+ */
+function createFetchWithExtensions(extensionRunner: ExtensionRunner, model: Model<Api>): typeof globalThis.fetch {
+	const factory = createExtensionFetchFactory(extensionRunner);
+	if (!factory) {
+		throw new Error("Expected createExtensionFetchFactory to return a factory when extensions are registered");
+	}
+	return factory(model);
+}
+
+describe("HTTP extensions integration", () => {
+	let server: Server;
+	let serverPort: number;
+	let serverUrl: string;
+	let receivedHeaders: Record<string, string | string[] | undefined>;
+	let _receivedBody: string;
+
+	beforeEach(async () => {
+		receivedHeaders = {};
+		_receivedBody = "";
+
+		// Create a simple test server
+		server = createServer((req: IncomingMessage, res: ServerResponse) => {
+			// Capture received headers
+			receivedHeaders = { ...req.headers };
+
+			// Capture body
+			const chunks: Buffer[] = [];
+			req.on("data", (chunk: Buffer) => chunks.push(chunk));
+			req.on("end", () => {
+				_receivedBody = Buffer.concat(chunks).toString();
+				res.writeHead(200, { "content-type": "application/json", "x-server-id": "test-server" });
+				res.end(JSON.stringify({ success: true }));
+			});
+		});
+
+		// Listen on a random available port
+		await new Promise<void>((resolve) => {
+			server.listen(0, "127.0.0.1", () => {
+				const addr = server.address();
+				if (addr && typeof addr === "object") {
+					serverPort = addr.port;
+					serverUrl = `http://127.0.0.1:${serverPort}`;
+				}
+				resolve();
+			});
+		});
+	});
+
+	afterEach(async () => {
+		vi.restoreAllMocks();
+		await new Promise<void>((resolve) => {
+			server.close(() => resolve());
+		});
+	});
+
+	it("should emit http_request and http_response events through fetch wrapper", async () => {
+		const capturedRequestEvents: HttpRequestEvent[] = [];
+		const capturedResponseEvents: HttpResponseEvent[] = [];
+
+		const ext = createExtension(
+			(event) => {
+				capturedRequestEvents.push(event);
+				return undefined;
+			},
+			(event) => {
+				capturedResponseEvents.push(event);
+				return undefined;
+			},
+		);
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		const response = await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ test: true }),
+		});
+
+		expect(response.status).toBe(200);
+
+		// Verify request event
+		expect(capturedRequestEvents).toHaveLength(1);
+		expect(capturedRequestEvents[0].provider).toBe("anthropic");
+		expect(capturedRequestEvents[0].modelId).toBe("claude-sonnet-4-5");
+		expect(capturedRequestEvents[0].url).toBe(serverUrl);
+		expect(capturedRequestEvents[0].method).toBe("POST");
+
+		// Verify response event
+		expect(capturedResponseEvents).toHaveLength(1);
+		expect(capturedResponseEvents[0].provider).toBe("anthropic");
+		expect(capturedResponseEvents[0].modelId).toBe("claude-sonnet-4-5");
+		expect(capturedResponseEvents[0].status).toBe(200);
+		expect(capturedResponseEvents[0].durationMs).toBeGreaterThanOrEqual(0);
+		expect(capturedResponseEvents[0].headers["content-type"]).toBe("application/json");
+		expect(capturedResponseEvents[0].headers["x-server-id"]).toBe("test-server");
+	});
+
+	it("should allow extensions to inject custom headers", async () => {
+		const ext = createExtension(() => ({
+			headers: {
+				"x-custom-header": "injected-value",
+				"x-request-trace": "trace-123",
+			},
+		}));
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: "{}",
+		});
+
+		// Server should receive the injected headers
+		expect(receivedHeaders["x-custom-header"]).toBe("injected-value");
+		expect(receivedHeaders["x-request-trace"]).toBe("trace-123");
+	});
+
+	it("should allow extensions to overwrite existing headers", async () => {
+		const ext = createExtension(() => ({
+			headers: {
+				"x-existing-header": "hook-overwritten-value",
+			},
+		}));
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-existing-header": "original-value",
+			},
+			body: "{}",
+		});
+
+		// Server should receive the hook-overwritten value, not the original
+		expect(receivedHeaders["x-existing-header"]).toBe("hook-overwritten-value");
+	});
+
+	it("should throw error when extension cancels request", async () => {
+		const ext = createExtension(() => ({
+			cancel: true,
+		}));
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await expect(
+			wrappedFetch(serverUrl, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: "{}",
+			}),
+		).rejects.toThrow("HTTP request cancelled by extension");
+	});
+
+	it("should redact authorization header in http_request event", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: "Bearer sk-secret-key-12345",
+			},
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		expect(capturedEvent!.headers.authorization).toBe("[REDACTED]");
+
+		// But actual request should have the real header
+		expect(receivedHeaders.authorization).toBe("Bearer sk-secret-key-12345");
+	});
+
+	it("should redact x-api-key header in http_request event", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-api-key": "anthropic-key-abc123",
+			},
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		expect(capturedEvent!.headers["x-api-key"]).toBe("[REDACTED]");
+
+		// But actual request should have the real header
+		expect(receivedHeaders["x-api-key"]).toBe("anthropic-key-abc123");
+	});
+
+	it("should redact headers matching heuristic patterns", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-auth-token": "token-value",
+				"custom-secret-header": "secret-value",
+				"api-key-custom": "key-value",
+				"session-cookie": "cookie-value",
+			},
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		// All should be redacted due to pattern matching
+		expect(capturedEvent!.headers["x-auth-token"]).toBe("[REDACTED]");
+		expect(capturedEvent!.headers["custom-secret-header"]).toBe("[REDACTED]");
+		expect(capturedEvent!.headers["api-key-custom"]).toBe("[REDACTED]");
+		expect(capturedEvent!.headers["session-cookie"]).toBe("[REDACTED]");
+
+		// But actual request should have real values
+		expect(receivedHeaders["x-auth-token"]).toBe("token-value");
+		expect(receivedHeaders["custom-secret-header"]).toBe("secret-value");
+		expect(receivedHeaders["api-key-custom"]).toBe("key-value");
+		expect(receivedHeaders["session-cookie"]).toBe("cookie-value");
+	});
+
+	it("should not redact non-sensitive headers", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json",
+				"user-agent": "test-agent/1.0",
+				"x-request-id": "12345",
+			},
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		expect(capturedEvent!.headers["content-type"]).toBe("application/json");
+		expect(capturedEvent!.headers.accept).toBe("application/json");
+		expect(capturedEvent!.headers["user-agent"]).toBe("test-agent/1.0");
+		expect(capturedEvent!.headers["x-request-id"]).toBe("12345");
+	});
+
+	it("should normalize array header values to comma-separated string", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Use Headers object which supports append for multiple values
+		const headers = new Headers();
+		headers.append("accept", "application/json");
+		headers.append("accept", "text/plain");
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers,
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		// Headers class joins multiple values with ", "
+		expect(capturedEvent!.headers.accept).toBe("application/json, text/plain");
+	});
+
+	it("should handle string array header values via type assertion", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Pass a string array value directly through init.headers using type assertion
+		const headersWithArray = {
+			"content-type": "application/json",
+			"x-multi-value": ["value1", "value2", "value3"],
+		} as unknown as RequestInit["headers"];
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: headersWithArray,
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		// Array values should be joined into a comma-separated string (with spaces, like Headers class)
+		expect(capturedEvent!.headers["x-multi-value"]).toBe("value1, value2, value3");
+	});
+
+	it("should convert non-string header values to strings", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Use type assertion to force a non-string value (number) through to test normalization
+		// In practice, some libraries might pass numbers which should be converted to strings
+		const headersWithNumber = {
+			"content-type": "application/json",
+			"x-count": 42 as unknown as string, // Force a number through type assertion
+		};
+
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: headersWithNumber,
+			body: "{}",
+		});
+
+		expect(capturedEvent).toBeDefined();
+		expect(typeof capturedEvent!.headers["x-count"]).toBe("string");
+		expect(capturedEvent!.headers["x-count"]).toBe("42");
+
+		// Verify the server also received the header with the string value
+		expect(receivedHeaders["x-count"]).toBe("42");
+	});
+
+	it("should measure response duration accurately", async () => {
+		let capturedDurationMs = 0;
+
+		const ext = createExtension(undefined, (event) => {
+			capturedDurationMs = event.durationMs;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		const startTime = Date.now();
+		await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: "{}",
+		});
+		const totalTime = Date.now() - startTime;
+
+		// Duration should be captured and reasonably close to actual time
+		expect(capturedDurationMs).toBeGreaterThanOrEqual(0);
+		expect(capturedDurationMs).toBeLessThanOrEqual(totalTime + 100); // Allow some margin
+	});
+
+	it("should handle Request object input and capture its headers", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Create a Request object with headers
+		const request = new Request(serverUrl, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-custom-from-request": "request-value",
+			},
+			body: "{}",
+		});
+
+		const response = await wrappedFetch(request);
+
+		expect(response.status).toBe(200);
+		expect(capturedEvent).toBeDefined();
+		// Verify method and url are correctly extracted from the Request object
+		expect(capturedEvent!.method).toBe("POST");
+		// Request object may normalize the URL (e.g., adding trailing slash)
+		expect(capturedEvent!.url).toContain(serverUrl);
+		expect(capturedEvent!.headers["content-type"]).toBe("application/json");
+		expect(capturedEvent!.headers["x-custom-from-request"]).toBe("request-value");
+
+		// Verify server received the headers
+		expect(receivedHeaders["x-custom-from-request"]).toBe("request-value");
+	});
+
+	it("should have undefined body for non-string bodies but request still succeeds", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			return undefined;
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Use Uint8Array as body
+		const binaryBody = new Uint8Array([0x68, 0x65, 0x6c, 0x6c, 0x6f]); // "hello" in bytes
+
+		const response = await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: { "content-type": "application/octet-stream" },
+			body: binaryBody,
+		});
+
+		expect(response.status).toBe(200);
+		expect(capturedEvent).toBeDefined();
+		// Body should be undefined since it's not a string
+		expect(capturedEvent!.body).toBeUndefined();
+
+		// Server should still receive the body
+		expect(_receivedBody).toBe("hello");
+	});
+
+	it("should fire http_request but not http_response on network errors, and propagate the error", async () => {
+		const capturedRequestEvents: HttpRequestEvent[] = [];
+		const capturedResponseEvents: HttpResponseEvent[] = [];
+
+		const ext = createExtension(
+			(event) => {
+				capturedRequestEvents.push(event);
+				return undefined;
+			},
+			(event) => {
+				capturedResponseEvents.push(event);
+				return undefined;
+			},
+		);
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Mock globalThis.fetch to reject - vitest will restore in afterEach
+		const networkError = new Error("Network error: connection refused");
+		vi.spyOn(globalThis, "fetch").mockRejectedValueOnce(networkError);
+
+		await expect(
+			wrappedFetch(serverUrl, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: "{}",
+			}),
+		).rejects.toThrow("Network error: connection refused");
+
+		// http_request should have been emitted before the fetch call
+		expect(capturedRequestEvents).toHaveLength(1);
+		expect(capturedRequestEvents[0].url).toBe(serverUrl);
+
+		// http_response should NOT have been emitted due to the error
+		expect(capturedResponseEvents).toHaveLength(0);
+	});
+
+	it("should not call globalThis.fetch and not emit http_response when hook cancels", async () => {
+		const capturedRequestEvents: HttpRequestEvent[] = [];
+		const capturedResponseEvents: HttpResponseEvent[] = [];
+
+		const ext = createExtension(
+			(event) => {
+				capturedRequestEvents.push(event);
+				return { cancel: true };
+			},
+			(event) => {
+				capturedResponseEvents.push(event);
+				return undefined;
+			},
+		);
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		// Mock globalThis.fetch to track if it's called - vitest will restore in afterEach
+		const fetchSpy = vi.spyOn(globalThis, "fetch");
+
+		await expect(
+			wrappedFetch(serverUrl, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: "{}",
+			}),
+		).rejects.toThrow("HTTP request cancelled by extension");
+
+		// http_request was emitted
+		expect(capturedRequestEvents).toHaveLength(1);
+
+		// globalThis.fetch was NEVER called
+		expect(fetchSpy).not.toHaveBeenCalled();
+
+		// http_response was NEVER emitted
+		expect(capturedResponseEvents).toHaveLength(0);
+	});
+
+	it("should handle hook returning empty object (no headers, no cancel)", async () => {
+		let capturedEvent: HttpRequestEvent | undefined;
+
+		const ext = createExtension((event) => {
+			capturedEvent = event;
+			// Return empty object - should be treated as no modifications
+			return {};
+		});
+
+		const extensionRunner = new ExtensionRunner(
+			[ext],
+			"/test",
+			createMockSessionManager(),
+			createMockModelRegistry(),
+		);
+
+		const model = createMockModel();
+		const wrappedFetch = createFetchWithExtensions(extensionRunner, model);
+
+		const response = await wrappedFetch(serverUrl, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: "{}",
+		});
+
+		// Request should succeed
+		expect(response.status).toBe(200);
+		expect(capturedEvent).toBeDefined();
+	});
+});
+
+describe("exported helper functions", () => {
+	describe("redactHeaders", () => {
+		it("should redact sensitive headers", () => {
+			const headers = {
+				"content-type": "application/json",
+				authorization: "Bearer secret123",
+				"x-api-key": "key123",
+			};
+
+			const result = redactHeaders(headers);
+
+			expect(result["content-type"]).toBe("application/json");
+			expect(result.authorization).toBe("[REDACTED]");
+			expect(result["x-api-key"]).toBe("[REDACTED]");
+		});
+
+		it("should redact headers matching patterns", () => {
+			const headers = {
+				"x-auth-token": "token-value",
+				"custom-secret-value": "secret",
+			};
+
+			const result = redactHeaders(headers);
+
+			expect(result["x-auth-token"]).toBe("[REDACTED]");
+			expect(result["custom-secret-value"]).toBe("[REDACTED]");
+		});
+	});
+
+	describe("headersToRecord", () => {
+		it("should convert Headers to Record", () => {
+			const headers = new Headers();
+			headers.set("content-type", "application/json");
+			headers.set("x-custom", "value");
+
+			const result = headersToRecord(headers);
+
+			expect(result["content-type"]).toBe("application/json");
+			expect(result["x-custom"]).toBe("value");
+		});
+	});
+
+	describe("createExtensionFetchFactory", () => {
+		it("should return undefined when runner is undefined", () => {
+			const result = createExtensionFetchFactory(undefined);
+			expect(result).toBeUndefined();
+		});
+
+		it("should return undefined when no HTTP handlers are registered", () => {
+			const ext: LoadedExtension = {
+				path: "test-extension",
+				resolvedPath: "/test/test-extension.ts",
+				handlers: new Map(), // No handlers
+				tools: new Map(),
+				messageRenderers: new Map(),
+				commands: new Map(),
+				flags: new Map(),
+				flagValues: new Map(),
+				shortcuts: new Map(),
+				setSendMessageHandler: () => {},
+				setSendUserMessageHandler: () => {},
+				setAppendEntryHandler: () => {},
+				setGetActiveToolsHandler: () => {},
+				setGetAllToolsHandler: () => {},
+				setSetActiveToolsHandler: () => {},
+				setFlagValue: () => {},
+			};
+
+			const extensionRunner = new ExtensionRunner(
+				[ext],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+			const result = createExtensionFetchFactory(extensionRunner);
+
+			expect(result).toBeUndefined();
+		});
+	});
+});
diff --git a/packages/coding-agent/test/hooks/http-hooks.test.ts b/packages/coding-agent/test/hooks/http-hooks.test.ts
new file mode 100644
index 000000000..990b92399
--- /dev/null
+++ b/packages/coding-agent/test/hooks/http-hooks.test.ts
@@ -0,0 +1,490 @@
+/**
+ * Tests for HTTP extension events (http_request / http_response).
+ *
+ * These tests verify the extension infrastructure for HTTP events without making real API calls.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ExtensionRunner } from "../../src/core/extensions/runner.js";
+import type {
+	HttpRequestEvent,
+	HttpRequestEventResult,
+	HttpResponseEvent,
+	LoadedExtension,
+} from "../../src/core/extensions/types.js";
+import type { ModelRegistry } from "../../src/core/model-registry.js";
+import type { SessionManager } from "../../src/core/session-manager.js";
+
+// Mock SessionManager (minimal interface for ExtensionRunner)
+function createMockSessionManager(): SessionManager {
+	return {
+		getCwd: () => "/test",
+		getSessionDir: () => "/test/.pi/sessions",
+		getSessionId: () => "test-session",
+		getSessionFile: () => "/test/.pi/sessions/test.jsonl",
+		getLeafUuid: () => "test-uuid",
+		getLeafEntry: () => undefined,
+		getEntry: () => undefined,
+		getLabel: () => undefined,
+		getPath: () => [],
+		getHeader: () => undefined,
+		getEntries: () => [],
+		getTree: () => ({ roots: [], currentPath: [] }),
+	} as unknown as SessionManager;
+}
+
+// Mock ModelRegistry
+function createMockModelRegistry(): ModelRegistry {
+	return {
+		getApiKey: async () => "test-key",
+		find: () => undefined,
+		getAll: () => [],
+	} as unknown as ModelRegistry;
+}
+
+// Create a LoadedExtension with HTTP handlers
+function createExtension(
+	onHttpRequest?: (
+		event: HttpRequestEvent,
+	) => HttpRequestEventResult | undefined | Promise<HttpRequestEventResult | undefined>,
+	onHttpResponse?: (event: HttpResponseEvent) => undefined | Promise<undefined>,
+): LoadedExtension {
+	const handlers = new Map<string, ((event: unknown, ctx: unknown) => Promise<unknown>)[]>();
+
+	if (onHttpRequest) {
+		handlers.set("http_request", [async (event: unknown) => onHttpRequest(event as HttpRequestEvent)]);
+	}
+
+	if (onHttpResponse) {
+		handlers.set("http_response", [async (event: unknown) => onHttpResponse(event as HttpResponseEvent)]);
+	}
+
+	return {
+		path: "test-extension",
+		resolvedPath: "/test/test-extension.ts",
+		handlers,
+		tools: new Map(),
+		messageRenderers: new Map(),
+		commands: new Map(),
+		flags: new Map(),
+		flagValues: new Map(),
+		shortcuts: new Map(),
+		setSendMessageHandler: () => {},
+		setSendUserMessageHandler: () => {},
+		setAppendEntryHandler: () => {},
+		setGetActiveToolsHandler: () => {},
+		setGetAllToolsHandler: () => {},
+		setSetActiveToolsHandler: () => {},
+		setFlagValue: () => {},
+	};
+}
+
+describe("HTTP extensions", () => {
+	let extensionRunner: ExtensionRunner;
+	let capturedRequestEvents: HttpRequestEvent[];
+	let capturedResponseEvents: HttpResponseEvent[];
+
+	beforeEach(() => {
+		capturedRequestEvents = [];
+		capturedResponseEvents = [];
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	describe("http_request event", () => {
+		it("should emit http_request event with correct fields", async () => {
+			const ext = createExtension((event) => {
+				capturedRequestEvents.push(event);
+				return undefined;
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: "[REDACTED]",
+				},
+				body: '{"model":"claude-sonnet-4-5"}',
+			});
+
+			expect(capturedRequestEvents).toHaveLength(1);
+			const event = capturedRequestEvents[0];
+			expect(event.type).toBe("http_request");
+			expect(event.provider).toBe("anthropic");
+			expect(event.modelId).toBe("claude-sonnet-4-5");
+			expect(event.url).toBe("https://api.anthropic.com/v1/messages");
+			expect(event.method).toBe("POST");
+			expect(event.headers["content-type"]).toBe("application/json");
+			expect(event.headers.authorization).toBe("[REDACTED]");
+			expect(event.body).toBe('{"model":"claude-sonnet-4-5"}');
+		});
+
+		it("should allow extensions to add headers via result.headers", async () => {
+			const ext = createExtension(() => {
+				return {
+					headers: {
+						"x-custom-header": "custom-value",
+						"x-request-id": "12345",
+					},
+				};
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "openai",
+				modelId: "gpt-4o",
+				url: "https://api.openai.com/v1/chat/completions",
+				method: "POST",
+				headers: { "content-type": "application/json" },
+			});
+
+			expect(result).toBeDefined();
+			expect(result!.headers).toBeDefined();
+			expect(result!.headers!["x-custom-header"]).toBe("custom-value");
+			expect(result!.headers!["x-request-id"]).toBe("12345");
+			expect(result!.cancel).toBe(false);
+		});
+
+		it("should allow extensions to cancel requests via result.cancel", async () => {
+			const ext = createExtension(() => {
+				return { cancel: true };
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(result).toBeDefined();
+			expect(result!.cancel).toBe(true);
+		});
+
+		it("should merge headers from multiple extensions", async () => {
+			const ext1 = createExtension(() => ({
+				headers: { "x-hook1": "value1" },
+			}));
+			const ext2 = createExtension(() => ({
+				headers: { "x-hook2": "value2" },
+			}));
+
+			extensionRunner = new ExtensionRunner(
+				[ext1, ext2],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(result).toBeDefined();
+			expect(result!.headers!["x-hook1"]).toBe("value1");
+			expect(result!.headers!["x-hook2"]).toBe("value2");
+		});
+
+		it("should return cancel=true if any extension cancels", async () => {
+			const ext1 = createExtension(() => ({
+				headers: { "x-hook1": "value1" },
+			}));
+			const ext2 = createExtension(() => ({
+				cancel: true,
+			}));
+			const ext3 = createExtension(() => ({
+				headers: { "x-hook3": "value3" },
+			}));
+
+			extensionRunner = new ExtensionRunner(
+				[ext1, ext2, ext3],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(result).toBeDefined();
+			expect(result!.cancel).toBe(true);
+			// Headers from all hooks should still be merged
+			expect(result!.headers!["x-hook1"]).toBe("value1");
+			expect(result!.headers!["x-hook3"]).toBe("value3");
+		});
+
+		it("should return undefined if no extensions are registered", async () => {
+			extensionRunner = new ExtensionRunner([], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(result).toBeUndefined();
+		});
+
+		it("should handle extension errors gracefully", async () => {
+			const errorExt = createExtension(() => {
+				throw new Error("Extension error");
+			});
+
+			extensionRunner = new ExtensionRunner(
+				[errorExt],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+
+			const errors: { extensionPath: string; event: string; error: string }[] = [];
+			extensionRunner.onError((err) => errors.push(err));
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(result).toBeUndefined();
+			expect(errors).toHaveLength(1);
+			expect(errors[0].extensionPath).toBe("test-extension");
+			expect(errors[0].event).toBe("http_request");
+			expect(errors[0].error).toContain("Extension error");
+		});
+
+		it("should handle async extension handlers", async () => {
+			const ext = createExtension(async (event) => {
+				await new Promise((resolve) => setTimeout(resolve, 10));
+				capturedRequestEvents.push(event);
+				return { headers: { "x-async": "true" } };
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			const result = await extensionRunner.emitHttpRequest({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				url: "https://api.anthropic.com/v1/messages",
+				method: "POST",
+				headers: {},
+			});
+
+			expect(capturedRequestEvents).toHaveLength(1);
+			expect(result!.headers!["x-async"]).toBe("true");
+		});
+	});
+
+	describe("http_response event", () => {
+		it("should emit http_response event with correct fields", async () => {
+			const ext = createExtension(undefined, (event) => {
+				capturedResponseEvents.push(event);
+				return undefined;
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			await extensionRunner.emitHttpResponse({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				status: 200,
+				headers: {
+					"content-type": "application/json",
+					"x-request-id": "req-12345",
+				},
+				durationMs: 1500,
+			});
+
+			expect(capturedResponseEvents).toHaveLength(1);
+			const event = capturedResponseEvents[0];
+			expect(event.type).toBe("http_response");
+			expect(event.provider).toBe("anthropic");
+			expect(event.modelId).toBe("claude-sonnet-4-5");
+			expect(event.status).toBe(200);
+			expect(event.headers["content-type"]).toBe("application/json");
+			expect(event.headers["x-request-id"]).toBe("req-12345");
+			expect(event.durationMs).toBe(1500);
+		});
+
+		it("should call multiple response handlers in order", async () => {
+			const callOrder: string[] = [];
+
+			const ext1: LoadedExtension = {
+				path: "ext1",
+				resolvedPath: "/test/ext1.ts",
+				handlers: new Map([
+					[
+						"http_response",
+						[
+							async () => {
+								callOrder.push("hook1");
+								return undefined;
+							},
+						],
+					],
+				]),
+				tools: new Map(),
+				messageRenderers: new Map(),
+				commands: new Map(),
+				flags: new Map(),
+				flagValues: new Map(),
+				shortcuts: new Map(),
+				setSendMessageHandler: () => {},
+				setSendUserMessageHandler: () => {},
+				setAppendEntryHandler: () => {},
+				setGetActiveToolsHandler: () => {},
+				setGetAllToolsHandler: () => {},
+				setSetActiveToolsHandler: () => {},
+				setFlagValue: () => {},
+			};
+
+			const ext2: LoadedExtension = {
+				path: "ext2",
+				resolvedPath: "/test/ext2.ts",
+				handlers: new Map([
+					[
+						"http_response",
+						[
+							async () => {
+								callOrder.push("hook2");
+								return undefined;
+							},
+						],
+					],
+				]),
+				tools: new Map(),
+				messageRenderers: new Map(),
+				commands: new Map(),
+				flags: new Map(),
+				flagValues: new Map(),
+				shortcuts: new Map(),
+				setSendMessageHandler: () => {},
+				setSendUserMessageHandler: () => {},
+				setAppendEntryHandler: () => {},
+				setGetActiveToolsHandler: () => {},
+				setGetAllToolsHandler: () => {},
+				setSetActiveToolsHandler: () => {},
+				setFlagValue: () => {},
+			};
+
+			extensionRunner = new ExtensionRunner(
+				[ext1, ext2],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+
+			await extensionRunner.emitHttpResponse({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				status: 200,
+				headers: {},
+				durationMs: 100,
+			});
+
+			expect(callOrder).toEqual(["hook1", "hook2"]);
+		});
+
+		it("should handle response extension errors gracefully", async () => {
+			const errorExt = createExtension(undefined, () => {
+				throw new Error("Response extension error");
+			});
+
+			extensionRunner = new ExtensionRunner(
+				[errorExt],
+				"/test",
+				createMockSessionManager(),
+				createMockModelRegistry(),
+			);
+
+			const errors: { extensionPath: string; event: string; error: string }[] = [];
+			extensionRunner.onError((err) => errors.push(err));
+
+			// Should not throw
+			await extensionRunner.emitHttpResponse({
+				provider: "anthropic",
+				modelId: "claude-sonnet-4-5",
+				status: 200,
+				headers: {},
+				durationMs: 100,
+			});
+
+			expect(errors).toHaveLength(1);
+			expect(errors[0].extensionPath).toBe("test-extension");
+			expect(errors[0].event).toBe("http_response");
+			expect(errors[0].error).toContain("Response extension error");
+		});
+
+		it("should capture non-200 status codes", async () => {
+			const ext = createExtension(undefined, (event) => {
+				capturedResponseEvents.push(event);
+				return undefined;
+			});
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			await extensionRunner.emitHttpResponse({
+				provider: "openai",
+				modelId: "gpt-4o",
+				status: 429,
+				headers: { "retry-after": "60" },
+				durationMs: 50,
+			});
+
+			expect(capturedResponseEvents).toHaveLength(1);
+			expect(capturedResponseEvents[0].status).toBe(429);
+			expect(capturedResponseEvents[0].headers["retry-after"]).toBe("60");
+		});
+	});
+
+	describe("hasHandlers", () => {
+		it("should return true when http_request handlers exist", () => {
+			const ext = createExtension(() => undefined);
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			expect(extensionRunner.hasHandlers("http_request")).toBe(true);
+			expect(extensionRunner.hasHandlers("http_response")).toBe(false);
+		});
+
+		it("should return true when http_response handlers exist", () => {
+			const ext = createExtension(undefined, () => undefined);
+
+			extensionRunner = new ExtensionRunner([ext], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			expect(extensionRunner.hasHandlers("http_request")).toBe(false);
+			expect(extensionRunner.hasHandlers("http_response")).toBe(true);
+		});
+
+		it("should return false when no HTTP handlers exist", () => {
+			extensionRunner = new ExtensionRunner([], "/test", createMockSessionManager(), createMockModelRegistry());
+
+			expect(extensionRunner.hasHandlers("http_request")).toBe(false);
+			expect(extensionRunner.hasHandlers("http_response")).toBe(false);
+		});
+	});
+});