#59748 fix(core): apply webfetch URL rules to redirect targets

Problem

webfetch checked the URL rules for the URL the model asked for, then let fetch follow redirects on its own. So a webfetch deny rule (or a policy that only allows certain hosts) didn't apply to wherever the page redirected.

Change

webfetch now follows redirects itself and checks each new URL against the rules first. It never prompts for a redirect, it only stops when a rule denies the target.

fetch url (asks as before)
  302 → next url
    rules deny next?  → stop, "Permission denied: webfetch"
    otherwise         → follow it
  ... up to 10 redirects

• Adds Permission.assertNotDenied: same evaluation as assert (config, session rules, saved approvals, plugin hooks) but it never asks, it only fails on deny.
• Redirects to non http(s) URLs are rejected, and chains stop after 10 redirects.
• No redirect means no change in behavior. Default setups see no new prompts.

Out of scope

A redirect to a URL that would normally ask is still followed without asking.

Verification

• bun test test/permission.test.ts test/tool-webfetch.test.ts test/plugin/permission-assert.test.ts in packages/core: 200 pass
• bun run check from the repo root: passes

---

Added by the opencode bot (AI-generated).

Related: #55232