Risky behavior now covered

webFetch SSRF checks in resolve_and_validate_url_target, is_blocked_ip, and is_blocked_hostname:

• Reserved IPv4 and IPv6 ranges, including CGNAT, link-local, benchmarking, documentation, class E, ULA, and IPv4-mapped private addresses, plus the public addresses just outside those ranges.
• Obfuscated loopback literals (2130706433, 0x7f000001, 0177.0.0.1, 127.1, 0x7f.0.0.1) are blocked as 127.0.0.1 with no DNS lookup.
• Non-HTTP schemes and any non-empty userinfo, including example.com@evil.com, are rejected before DNS. Empty @ userinfo still validates the real host.
• Public IP literals are pinned to themselves and never go through DNS.
• One private DNS answer, including ::ffff:192.168.1.50, blocks the whole name. An empty lookup fails closed. Internal suffixes such as .localhost and .internal do not match lookalikes like localhost.example.

Test files

• Updated crates/cowork-tools/src/web.rs (ssrf_gate_tests).

Why this reduces regression risk

The Rust port of web fetch had only a handful of direct loopback and metadata cases. These tests lock the classifier edges and the ordering of scheme, credential, literal, and DNS checks, so a parser or mask change cannot silently send a saved API-adjacent fetch at a private or rewritten loopback address.

No production behavior changes.

Validation

• cargo test -p cowork-tools --lib ssrf_gate_tests: 7 passed.
• cargo clippy -p cowork-tools --lib --tests -- -D warnings: clean.
• rustfmt --edition 2024 --check crates/cowork-tools/src/web.rs: clean.