Harden Confluence search and return its sources and let trusted providers continue chats that hold confidential tool results

app/MindWork AI Studio/Tools/Web/WebPageRetrievalOptions.cs

@@ -30,5 +30,20 @@ public sealed class WebPageRetrievalOptions
 
     public Func<string, bool>? IsPrivateHostAllowed { get; init; }
 
+    /// <summary>
+    /// Decides for every URL, the first one as well as each redirect target, whether it may be
+    /// requested at all. It runs before anything is sent, so a refused target never sees the URL.
+    /// </summary>
+    public Func<Uri, bool>? IsTargetAllowed { get; init; }
+
+    /// <summary>
+    /// Allows the operating system's sign-in for a host which resolves to public addresses.
+    /// </summary>
+    /// <remarks>
+    /// Without it, the sign-in is only sent to allowed private hosts. Use it only for a host
+    /// which the user or the organization configured, never for one a model named.
+    /// </remarks>
+    public Func<string, bool>? IsOsSsoAllowedForPublicHost { get; init; }
+
     public Func<Uri, ConfidenceLevel, Task>? OnPrivateHostProviderBlockAsync { get; init; }
 }