Summary

• Add opt-in tools.web.fetch.allowPrivateNetwork config key (boolean, default false) so web_fetch can reach private/internal network addresses (localhost, 10.x, 192.168.x, 172.16-31.x) when explicitly enabled.
• Default behavior is unchanged: private networks remain blocked unless the operator explicitly opts in.

Problem

web_fetch blocks all private/internal network addresses via the SSRF guard. There is no config-level way to opt in to private network access, blocking agent architectures where agents need to call local services:

[security] blocked URL fetch (url-fetch) target=http://127.0.0.1:9090/api/...
reason=Blocked hostname or private/internal/special-use IP address

The ToolsWebFetchSchema uses .strict(), so users cannot work around this without an upstream schema change.

Changes

• src/infra/net/ssrf.ts: Add optional options.allowPrivateNetwork parameter to resolvePinnedHostname(). When true, skips blocked-hostname and private-IP checks; pins private IP literals directly without DNS lookup.
• src/agents/tools/web-fetch.ts: Add resolveFetchAllowPrivateNetwork() resolver (defaults false). Thread allowPrivateNetwork through fetchWithRedirects and runWebFetch into resolvePinnedHostname.
• src/config/zod-schema.agent-runtime.ts: Add allowPrivateNetwork: z.boolean().optional() to ToolsWebFetchSchema.
• src/config/types.tools.ts: Add allowPrivateNetwork?: boolean to the fetch config type.
• src/config/schema.ts: Add label and help text for the new config key.
• src/agents/tools/web-fetch.ssrf.test.ts: Add two tests (allow private when enabled; block private when explicitly false). Fix mock to forward the new options parameter.
• CHANGELOG.md: Add entry referencing [Feature]: Add tools.web.fetch.allowPrivateNetwork to allow private network access openclaw/openclaw#39604.

User-visible changes

New config key:

"tools": {
  "web": {
    "fetch": { "allowPrivateNetwork": true }
  }
}

When true, web_fetch can reach private/internal network addresses. Default remains false (no behavior change for existing users).

Security impact

• New capability: opt-in only, default false.
• Risk: operators enabling this in untrusted environments could expose internal services.
• Mitigation: explicit config required; secure default; same trust model as operator-controlled gateway config.

Testing performed

• pnpm lint -- 0 warnings, 0 errors
• pnpm build -- clean
• pnpm test -- 5947 passed, 2 failed (pre-existing lobster subprocess timeout, unrelated)
• SSRF test suite: 7/7 passed (including 2 new tests for the allowPrivateNetwork path)

Closes openclaw#39604