Web search restrictions after internal content (#1074)

Co-authored-by: Thorsten Sommer <SommerEngineering@users.noreply.github.com>

app/MindWork AI Studio/Tools/Web/WebPageRetrievalService.cs

@@ -16,6 +16,7 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
     {
         var triedOsSso = false;
         var requiredProviderConfidence = ConfidenceLevel.NONE;
+        var lastAddressIsNonPublic = false;
 
         // Always overwritten: the media type is validated before the body is read, so no page
         // arrives without the check having decided what it is.
@@ -29,7 +30,10 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
                 async (candidateUrl, validationToken) =>
                 {
                     var addresses = await ResolveValidatedUrlAddressesAsync(candidateUrl, options, validationToken);
-                    if (addresses.Any(IsNonPublicAddress))
+                    // Overwritten with every request, so it holds what the last one reached, the
+                    // one which returned the page:
+                    lastAddressIsNonPublic = addresses.Any(IsNonPublicAddress);
+                    if (lastAddressIsNonPublic)
                         requiredProviderConfidence = ConfidenceLevel.HIGH;
 
                     return addresses;
@@ -76,6 +80,7 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
             },
             RetrievedAtUtc = DateTimeOffset.UtcNow,
             RequiredProviderConfidence = requiredProviderConfidence,
+            ReachedNonPublicAddress = lastAddressIsNonPublic,
         };
     }
 
@@ -118,6 +123,12 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
         if (addresses.Count == 0)
             throw new InvalidOperationException($"The host '{url.Host}' did not resolve to an IP address.");
 
+        // Before the exemption for targets the user chose, because it guards what the address may
+        // carry. Every address has to be non-public, since the connection may go to any of them.
+        // The text names no address, so a caller may hand it on without repeating one:
+        if (options.NonPublicTargetsOnly && !addresses.All(IsNonPublicAddress))
+            throw new WebPageAccessBlockedException("The web page or one of its redirects leads to a public address, which this request may not reach.", WebPageAccessBlockReason.PUBLIC_TARGET_NOT_ALLOWED);
+
         //
         // Where the target came from decides which targets are acceptable. A URL a model produced
         // may not reach into the local network, because the model was talked into it by whatever