1. src/agents/tools/web-fetch.ts, line 163-169 (link)

   Runtime cast from SsrFPolicyConfig to SsrFPolicy

   SsrFPolicyConfig (config layer, types.browser.ts) and SsrFPolicy (infra layer, ssrf.ts) are currently structurally identical, so the as SsrFPolicy cast is safe. However, the two types now have to be kept in sync manually — a field added to one must be added to the other, or the cast will silently drop it at runtime.

   This is a known trade-off of the config/infra layer separation, but worth calling out. If the circular-dependency constraint allows it, importing SsrFPolicy directly into types.browser.ts (or re-exporting from a shared barrel) would eliminate the need for this cast entirely.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/agents/tools/web-fetch.ts
   Line: 163-169
   
   Comment:
   **Runtime cast from `SsrFPolicyConfig` to `SsrFPolicy`**
   
   `SsrFPolicyConfig` (config layer, `types.browser.ts`) and `SsrFPolicy` (infra layer, `ssrf.ts`) are currently structurally identical, so the `as SsrFPolicy` cast is safe. However, the two types now have to be kept in sync manually — a field added to one must be added to the other, or the cast will silently drop it at runtime.
   
   This is a known trade-off of the config/infra layer separation, but worth calling out. If the circular-dependency constraint allows it, importing `SsrFPolicy` directly into `types.browser.ts` (or re-exporting from a shared barrel) would eliminate the need for this cast entirely.
   
   How can I resolve this? If you propose a fix, please make it concise.

Best possible solution:

Rebase onto current main, keep the cache-safe web_fetch implementation, and land the citationRedirect and remoteMedia policy surfaces only with policy-aware cache identity plus complete sender coverage.

Do we have a high-confidence way to reproduce the issue?

Yes. The reproduction path is code-based: permissive SSRF policy can populate web_fetch or Gemini search caches, then stricter calls can read policy-agnostic cached data before the guard reruns; remoteMedia inconsistency is visible from send paths that omit the policy option.

Is this the best way to solve the issue?

No. The direction is reasonable, but this PR is not the best current form until it preserves current main's cache isolation, adds citation redirect policy to Gemini cache identity, and completes remote-media routing.

Full review comments:

• [P1] Include SSRF policy in the web_fetch cache key — src/agents/tools/web-fetch.ts:549
  The branch forwards params.ssrfPolicy into guarded fetches, but cache hits are still keyed without that policy. A permissive run can populate the cache and a later stricter run can return cached content before the SSRF guard runs, so the cache key needs a stable policy component or policy-sensitive bypass.
  Confidence: 0.93
• [P2] Add citation redirect policy to Gemini cache identity — extensions/google/src/gemini-web-search-provider.ts:225
  The branch threads citationRedirectSsrFPolicy into redirect resolution, but Gemini search caching still ignores that policy. Resolved citations from a permissive run can be reused by stricter later calls without reapplying redirect SSRF checks.
  Confidence: 0.88
• [P2] Wire remoteMedia policy through every media sender — src/config/zod-schema.session.ts:188-193
  The new messages.remoteMedia.ssrfPolicy setting is global, but not every outbound media sender is wired to pass it into media loading. Channels that omit the option will still enforce default SSRF behavior, creating channel-dependent config behavior.
  Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.89

Security concerns:

• [high] Policy-agnostic caches can bypass stricter SSRF settings — src/agents/tools/web-fetch.ts:549
  The branch applies permissive SSRF policy during web_fetch and Gemini citation redirect resolution without including that policy in the relevant cache identities, allowing later stricter calls to receive previously cached results.
  Confidence: 0.92
• [medium] Global remote media SSRF config is partially enforced — src/config/zod-schema.session.ts:188
  Accepting messages.remoteMedia.ssrfPolicy while leaving some channel media paths unwired creates a misleading security control whose behavior depends on the channel implementation.
  Confidence: 0.86

What I checked:

• Current main web_fetch policy is cache-separated: Current main scopes web_fetch SSRF opt-ins to RFC2544/IPv6 ULA markers and includes those markers in the cache key before cache reads. (src/agents/tools/web-fetch.ts:399, a4f2bf273a21)
• Current main has a regression test for strict-after-permissive web_fetch: The test allows an RFC2544 URL with opt-in policy, then verifies a stricter cached tool still blocks the same URL. (src/agents/tools/web-fetch.ssrf.test.ts:162, a4f2bf273a21)
• PR web_fetch diff forwards policy without cache-key isolation: The PR adds policy forwarding to guarded fetch but its diff does not add an SSRF policy component to the earlier cache identity. (src/agents/tools/web-fetch.ts:549, 92333510421e)
• Current main lacks citationRedirect config/runtime policy: Current main's web-search schema has no citationRedirect object, and resolveCitationRedirectUrl accepts only the URL. (src/config/zod-schema.agent-runtime.ts:320, a4f2bf273a21)
• Gemini cache identity is policy-agnostic on current main: The Gemini cache key includes provider/query/count/baseUrl/model/time range, but no citation redirect SSRF policy component. (extensions/google/src/gemini-web-search-provider.runtime.ts:284, a4f2bf273a21)
• Remote media policy is not a current main config surface: MessagesSchema currently jumps from suppressToolErrors to tts, with no messages.remoteMedia config object. (src/config/zod-schema.session.ts:196, a4f2bf273a21)

Likely related people:

• steipete: Recent GitHub commit history shows repeated work on Gemini web search, config schemas, outbound media, and channel send paths affected by this PR. (role: recent maintainer and adjacent owner; confidence: high; commits: 66336bf7c846, 1143f7384233, 43ef8a5a8657; files: src/agents/tools/web-fetch.ts, extensions/google/src/gemini-web-search-provider.runtime.ts, src/config/zod-schema.agent-runtime.ts)
• vincentkoc: Recent history includes web_fetch cache/provider maintenance and config work near the current implementation. (role: recent maintainer; confidence: medium; commits: dade5f913342, fbf9132b32da, 69b66dd5483e; files: src/agents/tools/web-fetch.ts, src/config/zod-schema.session.ts)
• jeffrey701: Authored the current main SSRF fake-IP opt-in work that added policy-sensitive web_fetch behavior and tests. (role: introduced adjacent behavior; confidence: medium; commits: 9b6670d5c924; files: src/agents/tools/web-fetch.ts, src/config/zod-schema.agent-runtime.ts)

Remaining risk / open question:

• The PR is stale relative to current main's narrower web_fetch SSRF implementation, so a rebase may need conflict resolution and security-policy review.
• The proposed remoteMedia config is global, but the branch does not visibly prove every outbound media sender honors it consistently.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a4f2bf273a21.