diff --git a/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml b/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
index 32e817b4f8c..9eb01f78faf 100644
--- a/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
+++ b/.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
@@ -20,7 +20,7 @@ paths:
   - src/agents/tools/web-shared.ts
   - src/plugin-sdk/ssrf-policy.ts
   - src/web-fetch
-  - src/web/provider-runtime-shared.ts
+  - packages/web-content-core/src/provider-runtime-shared.ts
   - packages/memory-host-sdk/src/host/ssrf-policy.ts
   - packages/net-policy/src
 
diff --git a/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml b/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml
index a805a8844d3..6cfa5331198 100644
--- a/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml
+++ b/.github/codeql/codeql-web-media-runtime-boundary-critical-quality.yml
@@ -16,7 +16,7 @@ query-filters:
 paths:
   - src/web-fetch
   - src/web-search
-  - src/web/provider-runtime-shared.ts
+  - packages/web-content-core/src/provider-runtime-shared.ts
   - src/media
   - src/media-understanding
   - src/image-generation
diff --git a/src/agents/tools/web-fetch.ts b/src/agents/tools/web-fetch.ts
index 7fbda27a1be..240f8acaab2 100644
--- a/src/agents/tools/web-fetch.ts
+++ b/src/agents/tools/web-fetch.ts
@@ -17,7 +17,7 @@ import { wrapExternalContent, wrapWebContent } from "../../security/external-con
 import { createLazyImportLoader } from "../../shared/lazy-promise.js";
 import { isRecord } from "../../utils.js";
 import { extractReadableContent } from "../../web-fetch/content-extractors.runtime.js";
-import { resolveWebProviderConfig } from "../../web/provider-runtime-shared.js";
+import { resolveWebProviderConfig } from "../../../packages/web-content-core/src/provider-runtime-shared.js";
 import { stringEnum } from "../schema/string-enum.js";
 import { setToolTerminalPresentation } from "../tool-terminal-presentation.js";
 import type { AnyAgentTool } from "./common.js";
diff --git a/src/web-fetch/runtime.ts b/src/web-fetch/runtime.ts
index c2f75f2444b..76fdfc8a048 100644
--- a/src/web-fetch/runtime.ts
+++ b/src/web-fetch/runtime.ts
@@ -19,7 +19,7 @@ import {
   readWebProviderEnvValue,
   resolveWebProviderConfig,
   resolveWebProviderDefinition,
-} from "../web/provider-runtime-shared.js";
+} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 
 // Runtime provider selection for the web_fetch tool. It resolves config,
 // credentials, runtime metadata, and sandbox-safe bundled provider scopes.
diff --git a/src/web-search/runtime.ts b/src/web-search/runtime.ts
index 60be4a61fa5..70985d0d9d8 100644
--- a/src/web-search/runtime.ts
+++ b/src/web-search/runtime.ts
@@ -27,7 +27,7 @@ import {
   providerRequiresCredential,
   readWebProviderEnvValue,
   resolveWebProviderConfig,
-} from "../web/provider-runtime-shared.js";
+} from "../../packages/web-content-core/src/provider-runtime-shared.js";
 import type {
   ResolveWebSearchDefinitionParams,
   RunWebSearchParams,
diff --git a/src/web/provider-runtime-shared.ts b/src/web/provider-runtime-shared.ts
deleted file mode 100644
index d504c714ec4..00000000000
--- a/src/web/provider-runtime-shared.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-// Core facade for shared web-provider runtime helpers from the package layer.
-// Keeps src imports stable while provider logic lives in web-content-core.
-export * from "../../packages/web-content-core/src/provider-runtime-shared.js";