security: block loopback/private/metadata addresses in model-supplied URL fetches

web_fetch and browser_read_url take a URL straight from the model. The model's
input is untrusted by design - both tools' own descriptions call fetched
content "data to evaluate, not instructions" - and web_fetch is
requires_approval=False, so nothing prompts the user before the request goes
out.

Neither validated the address. Verified against a scratch server on loopback:

    web_fetch("http://127.0.0.1:9931/")
    -> {"text": "Directory listing for /\n.git/\n.github/..."}

No prompt, no error. The same call reaches http://169.254.169.254/ for cloud
metadata when OpenWorker runs on a VM, an Ollama instance on :11434, or any
service on the user's LAN. It cannot reach OpenWorker's own sidecar, which
requires COWORKER_API_TOKEN.

Adds coworker/web/guard.py: resolve the host and refuse when any answer lands
in loopback, private, link-local (which covers the metadata endpoint),
multicast or reserved space. Checking every resolved address means a name with
one public and one private A record is refused rather than raced.

Redirects are the usual bypass, so follow_redirects is off and the chain is
walked here with each hop checked before it is requested. _request grows an
opt-in check_addresses flag used only by browser_read_url; the hardcoded vendor
endpoints the rest of the connectors call skip the guard and its DNS lookup.

Not covered, and stated in the module docstring: DNS rebinding. The name is
resolved by the guard and again by the client when it connects, so a near-zero
TTL record can change in between. Closing that needs connection-level IP
pinning. The hop check is the cheap 90%.

Tests: tests/test_url_address_guard.py - literals, IPv4-mapped IPv6 loopback,
names resolving into private space, split-horizon answers, non-http schemes,
redirect into loopback proven not to be requested, and a bounded redirect
loop.

coworker/web/fetch.py

@@ -13,6 +13,8 @@ from typing import Any, Callable
 
 import aisuite as ai
 
+from .guard import get_checked
+
 _MAX = 20000  # default chars returned
 
 _SCHEMA = {
@@ -84,16 +86,20 @@ def make_web_fetch_tool() -> Callable[..., Any]:
         try:
             import httpx
 
+            # follow_redirects=False: guard.get_checked walks the chain so every hop is
+            # address-checked, not just the URL the model first supplied.
             with httpx.Client(
-                follow_redirects=True,
+                follow_redirects=False,
                 timeout=20.0,
                 headers={"User-Agent": "coworker/0.1 (+desktop)"},
             ) as client:
-                resp = client.get(url)
+                resp = get_checked(client, url)
                 resp.raise_for_status()
                 ctype = resp.headers.get("content-type", "")
                 body = resp.text
                 final_url = str(resp.url)
+        except PermissionError as exc:  # blocked address (loopback, private, metadata)
+            return {"error": str(exc)}
         except Exception as exc:  # network / HTTP / TLS
             return {"error": f"fetch failed: {exc}"}
         text = _html_to_text(body) if "html" in ctype.lower() else body

coworker/web/guard.py

@@ -0,0 +1,109 @@
+"""Address guard for URLs the model chooses.
+
+`web_fetch` and `browser_read_url` take a URL straight from the model, and the model's
+input is untrusted by design — it reads web pages, email and Slack messages, all of which
+are documented as "data, not instructions". A page that talks the agent into fetching
+`http://169.254.169.254/` or `http://127.0.0.1:11434/` turns a read-only research tool into
+a probe of the machine's own network position, and `web_fetch` is `requires_approval=False`,
+so no prompt ever appears.
+
+This blocks the ranges that are only reachable *because* OpenWorker runs on the user's
+machine: loopback, RFC1918 and other private space, link-local (which covers the cloud
+metadata endpoint at 169.254.169.254), and the reserved/multicast blocks.
+
+Every hop is checked, not just the first: `follow_redirects=True` otherwise lets a public
+URL 302 straight to loopback, which is the standard way this filter is bypassed.
+
+Not covered: DNS rebinding. The name is resolved here and resolved again by the client when
+it connects, so a record with a ~0 TTL can change between the two. Closing that needs
+connection-level IP pinning; the hop check is the cheap 90% and is stated as such.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import socket
+from typing import Optional
+from urllib.parse import urlsplit
+
+MAX_REDIRECTS = 5
+
+
+def _blocked_reason(ip: ipaddress._BaseAddress) -> Optional[str]:
+    if ip.is_loopback:
+        return "loopback"
+    if ip.is_link_local:
+        return "link-local (includes the cloud metadata endpoint)"
+    if ip.is_private:
+        return "a private network"
+    if ip.is_multicast:
+        return "multicast"
+    if ip.is_reserved or ip.is_unspecified:
+        return "a reserved range"
+    return None
+
+
+def check_url(url: str) -> Optional[str]:
+    """None if the URL may be fetched, else a human-readable refusal reason.
+
+    Resolves the host and rejects when *any* answer lands in a blocked range, so a name
+    with both a public and a private A record cannot be used to slip through.
+    """
+    parts = urlsplit(url)
+    if parts.scheme not in ("http", "https"):
+        return "url must start with http:// or https://"
+    host = parts.hostname
+    if not host:
+        return "url has no host"
+
+    # A literal address needs no lookup.
+    try:
+        literal = ipaddress.ip_address(host)
+    except ValueError:
+        literal = None
+    if literal is not None:
+        reason = _blocked_reason(literal)
+        return f"refusing to fetch {host}: {reason}" if reason else None
+
+    try:
+        infos = socket.getaddrinfo(host, parts.port or (443 if parts.scheme == "https" else 80),
+                                   proto=socket.IPPROTO_TCP)
+    except OSError as exc:
+        return f"could not resolve {host}: {exc}"
+
+    for info in infos:
+        raw = info[4][0]
+        try:
+            ip = ipaddress.ip_address(raw)
+        except ValueError:
+            continue
+        # ::ffff:127.0.0.1 and friends must be judged as the v4 address they carry.
+        mapped = getattr(ip, "ipv4_mapped", None)
+        if mapped is not None:
+            ip = mapped
+        reason = _blocked_reason(ip)
+        if reason:
+            return f"refusing to fetch {host} ({ip}): {reason}"
+    return None
+
+
+def get_checked(client, url: str, *, max_redirects: int = MAX_REDIRECTS):
+    """GET `url`, validating the address before every hop.
+
+    `client` must be built with `follow_redirects=False`; redirects are walked here so each
+    Location is checked. Returns the final response. Raises `PermissionError` when a hop is
+    refused, `RuntimeError` when the redirect budget is exhausted.
+    """
+    seen = url
+    for _ in range(max_redirects + 1):
+        reason = check_url(seen)
+        if reason:
+            raise PermissionError(reason)
+        resp = client.get(seen)
+        if resp.status_code not in (301, 302, 303, 307, 308):
+            return resp
+        location = resp.headers.get("location")
+        if not location:
+            return resp
+        seen = str(resp.url.join(location))
+    raise RuntimeError(f"too many redirects (>{max_redirects})")