diff --git a/internal/sandbox/macos.go b/internal/sandbox/macos.go
index da93c56..ba4a6f9 100644
--- a/internal/sandbox/macos.go
+++ b/internal/sandbox/macos.go
@@ -767,11 +767,18 @@ func WrapCommandMacOS(cfg *config.Config, command string, exposedPorts []int, da
 			// HTTP CONNECT proxy (port 42051) for apps that only understand
 			// HTTP proxies (opencode, Node.js tools, etc.). The CONNECT
 			// proxy resolves DNS server-side.
-			proxyHost := "localhost"
-			if u, err := url.Parse(socks5hURL); err == nil && u.Hostname() != "" {
-				proxyHost = u.Hostname()
+			httpProxyURL := "http://localhost:42051"
+			if u, err := url.Parse(socks5hURL); err == nil {
+				userinfo := ""
+				if u.User != nil {
+					userinfo = u.User.String() + "@"
+				}
+				host := u.Hostname()
+				if host == "" {
+					host = "localhost"
+				}
+				httpProxyURL = "http://" + userinfo + host + ":42051"
 			}
-			httpProxyURL := "http://" + proxyHost + ":42051"
 			sandboxEnvs = append(sandboxEnvs,
 				"ALL_PROXY="+socks5hURL, "all_proxy="+socks5hURL,
 				"HTTP_PROXY="+httpProxyURL, "http_proxy="+httpProxyURL,