Respect existing Authorization header in web_fetch (case-insensitive)

[GopiB9119]

Motivation

• Prevent web_fetch from auto-injecting or overriding an Authorization header when the caller already provided one in any casing.

Description

• Perform a case-insensitive check for an existing Authorization header before injecting the bearer token and add a regression test that ensures a lowercase authorization header supplied by the caller is preserved.

Testing

• Ran pytest -q agent/agent/tests/test_web_tools.py and full test suite pytest -q, and both completed successfully (tests passed).

---

Codex Task

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[Copilot]

Pull request overview

Updates web_fetch to avoid injecting/overriding an Authorization header when the caller already provided one, regardless of header name casing.

Changes:

• Detect an existing Authorization header case-insensitively before adding the bearer token.
• Add a regression test ensuring a caller-supplied lowercase authorization header is preserved.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
agent/agent/web_tools.py	Adds a case-insensitive check for an existing Authorization header prior to bearer injection.
agent/agent/tests/test_web_tools.py	Adds a regression test for preserving a caller-provided authorization header.