Function webFetch

src/tools/builtin/web_browse.js:135–151

(url, maxChars = 5000)

// ─── Web Fetch (extract readable content) ────────────────────────────────────

async function webFetch(url, maxChars = 5000) {
  // SSRF guard — refuse URLs targeting metadata, RFC1918, or loopback
  // unless the operator explicitly opted in. This blocks an LLM from
  // tricking us into reading cloud metadata or local admin panels.
  try {
    _assertUrlSafe(String(url || ''));
  } catch (e) {
    return `Refused: ${e.message}`;
  }
  // Try Playwright for JS-heavy pages
  const browser = await getBrowser();
  if (browser) {
    return await _fetchWithBrowser(browser, url, maxChars);
  }
  // Fallback: simple fetch
  return await _fetchSimple(url, maxChars);
}

async function _fetchWithBrowser(browser, url, maxChars) {
  const page = await browser.newPage();