webfetch follows redirects to URLs the permission rules deny #1658

What happens

webfetch asks for (or auto-allows) the URL the model passed, then calls fetch with the default redirect: "follow". Redirect targets are never checked against the webfetch permission rules. With a config such as

{ "permission": { "webfetch": { "*": "allow", "http://169.254.169.254/*": "deny" } } }

any allowed URL that answers 302 Location: http://169.254.169.254/latest/meta-data gets fetched anyway, and the response goes to the model. The same gap exists for URL credentials: a rule for https://docs.example.com* also matches https://docs.example.com@evil.example/, which actually connects to evil.example.

Expected

• Each redirect target is checked against the rules before it is requested; a denied target fails the tool call (no extra prompt).
• Redirects to non-HTTP schemes and chains longer than 10 hops fail.
• URLs with credentials (user:pass@) are rejected, and rules match the normalized URL without its fragment.

Upstream

Fixed upstream in anomalyco/opencode#59748 (redirect targets), anomalyco/opencode#61701 (credentials, fragments) and anomalyco/opencode#60505 (normalized URL). Tracked in #1478.