With a person at the terminal the coworker asks, they allow the site from outside, and it tries again.
With auto-answer it reports the block in its answer, as before.
With OPENSHELL_SANDBOX=1 the agent is pointed at OpenShell's policy skill when it exists, and at the openshell command when it does not.
web_fetch hands a name to OpenShell's proxy; a literal internal address is still refused.