rekram1-node · Nov 2, 2026 · Oct 30, 2026 · Oct 30, 2026
diff --git a/packages/core/src/codemode/fetch.ts b/packages/core/src/codemode/fetch.ts
@@ -21,6 +21,7 @@ const fetch = (input: string | URL, init: Init = {}) =>
       return yield* Effect.fail(new Error("fetch cannot be used for filesystem access."))
     const execution = yield* CodeModeExecution.Service
     const permission = yield* Permission.Service
+    const source = { type: "tool" as const, messageID: execution.messageID, id: execution.id }
     // The same rules as the webfetch tool, so a URL denied there is denied here.
     yield* permission
       .assert({
@@ -30,33 +31,85 @@ const fetch = (input: string | URL, init: Init = {}) =>
         metadata: display([input, init]),
         sessionID: execution.sessionID,
         agent: execution.agent,
-        source: { type: "tool", messageID: execution.messageID, id: execution.id },
+        source,
       })
       .pipe(
         // The feedback is the user talking to the model, so it must reach the program as the error's message.
         Effect.catchTag("Permission.CorrectedError", (error) =>
           Effect.fail(new Error(`The user rejected fetching ${url}: ${error.feedback}`)),
         ),
       )
-    return yield* Effect.tryPromise({ try: () => send(input, init), catch: (error) => error })
+    // Redirects are followed here so each new URL meets the same deny rules as the webfetch tool's hops.
+    const check = (next: string) =>
+      permission.assertNotDenied({
+        action: "webfetch",
+        resources: [next],
+        metadata: { ...display([next, init]), redirectedFrom: url },
+        sessionID: execution.sessionID,
+        agent: execution.agent,
+        source,
+      })
+    const signal = AbortSignal.timeout(TIMEOUT_MS)
+    const follow = (
+      target: string,
+      request: Init,
+      redirects: number,
+    ): Effect.Effect<{ response: Response; url: string; redirects: number }, unknown> =>
+      Effect.tryPromise({
+        try: () => globalThis.fetch(target, { ...request, redirect: "manual", signal }),
+        catch: (error) => error,
+      }).pipe(
+        Effect.flatMap((response) => {
+          const location = response.headers.get("location")
+          if (!redirectStatuses.has(response.status) || location === null)
+            return Effect.succeed({ response, url: target, redirects })
+          if (redirects >= MAX_REDIRECTS)
+            return Effect.fail(new Error(`Too many redirects (more than ${MAX_REDIRECTS})`))
+          const next = new URL(location, target)
+          if (next.protocol !== "http:" && next.protocol !== "https:")
+            return Effect.fail(new Error(`fetch cannot follow a redirect to ${next.protocol} URLs.`))
+          return check(next.href).pipe(
+            Effect.andThen(follow(next.href, redirected(request, response.status, target, next), redirects + 1)),
+          )
+        }),
+      )
+    const result = yield* follow(url, init, 0)
+    return yield* Effect.tryPromise({ try: () => read(result), catch: (error) => error })
   })
 
-const send = async (input: string | URL, init: Init) => {
-  const response = await globalThis.fetch(input, {
-    method: init.method,
-    headers: init.headers,
-    body: init.body,
-    signal: AbortSignal.timeout(TIMEOUT_MS),
-  })
+export const MAX_REDIRECTS = 20
+const redirectStatuses = new Set([301, 302, 303, 307, 308])
+
+// The request a browser sends after a redirect: 303, and 301/302 after a POST, become a GET without a body, and
+// credentials are not sent to another origin.
+const redirected = (request: Init, status: number, from: string, to: URL): Init => {
+  const method = request.method?.toUpperCase() ?? "GET"
+  const toGet = status === 303 ? method !== "HEAD" : (status === 301 || status === 302) && method === "POST"
+  const headers = new Headers(request.headers)
+  if (toGet)
+    ["content-type", "content-length", "content-encoding", "content-language", "content-location"].forEach((name) =>
+      headers.delete(name),
+    )
+  if (new URL(from).origin !== to.origin)
+    ["authorization", "cookie", "proxy-authorization"].forEach((name) => headers.delete(name))
+  return {
+    method: toGet ? "GET" : request.method,
+    headers: Array.from(headers),
+    body: toGet ? undefined : request.body,
+  }
+}
+
+const read = async (result: { response: Response; url: string; redirects: number }) => {
+  const response = result.response
   const bytes = await response.bytes()
   const headers = Object.fromEntries(response.headers)
   const text = () => new TextDecoder().decode(bytes)
   return {
-    url: response.url,
+    url: result.url,
     status: response.status,
     statusText: response.statusText,
     ok: response.ok,
-    redirected: response.redirected,
+    redirected: result.redirects > 0,
     headers: {
       get: (name: string) => headers[name.toLowerCase()] ?? null,
       has: (name: string) => name.toLowerCase() in headers,

diff --git a/packages/core/test/tool-execute.test.ts b/packages/core/test/tool-execute.test.ts
@@ -54,7 +54,9 @@ describe("fetch permissions", () => {
     server = Bun.serve({
       port: 0,
       fetch: (request) => {
-        hits.push(`${request.method} ${new URL(request.url).pathname}`)
+        const url = new URL(request.url)
+        hits.push(`${request.method} ${url.pathname}`)
+        if (url.pathname === "/redirect") return Response.redirect(`${url.origin}/blocked`, 302)
         return new Response("ok")
       },
     })
@@ -87,6 +89,24 @@ describe("fetch permissions", () => {
     ])
   })
 
+  test("a redirect to a URL denied for webfetch is never requested", async () => {
+    hits.length = 0
+    const denied = permissionService({
+      assert: () => Effect.void,
+      assertNotDenied: (input) =>
+        Effect.fail(new Permission.BlockedError({ rules: [], permission: input.action, resources: input.resources })),
+    })
+    const result = await Effect.runPromise(
+      createCodeMode(new Map(), denied).execute(
+        { code: `try { await fetch("${server.url.origin}/redirect") } catch (e) { return e.message }` },
+        context,
+      ),
+    )
+
+    expect(result.output.output).toContain("Permission denied")
+    expect(hits).toEqual(["GET /redirect"])
+  })
+
   test("a rejection with feedback reaches the program as the error message", async () => {
     hits.length = 0
     const url = `${server.url.origin}/corrected`