Removed the operating-system sign-in for Confluence wikis with public addresses

app/MindWork AI Studio/Tools/ToolCallingSystem/ToolCallingImplementations/ConfluenceSearchTool.cs

@@ -139,10 +139,6 @@ public sealed class ConfluenceSearchTool(WebPageRetrievalService webPageRetrieva
                 UseOsSso = true,
                 IsPrivateHostAllowed = host => IsWikiHost(baseUrl!, host),
 
-                // The wiki address comes from the user or the organization, never from the model,
-                // so the sign-in may also go to a wiki with public addresses:
-                IsOsSsoAllowedForPublicHost = host => IsWikiHost(baseUrl!, host),
-
                 // Checked before every redirect is followed, so the query never reaches a host
                 // outside the wiki:
                 IsTargetAllowed = target => IsWithinWiki(baseUrl!, target),
@@ -162,7 +158,7 @@ public sealed class ConfluenceSearchTool(WebPageRetrievalService webPageRetrieva
             throw new InvalidOperationException(TB("Confluence redirected the search outside the configured wiki."));
 
         if (IsLoginPage(page.FinalUrl))
-            throw new InvalidOperationException(TB("Confluence asked for a sign-in instead of showing search results. Your operating system's sign-in was not accepted by the wiki; open it in your browser to check your access."));
+            throw new InvalidOperationException(TB("Confluence asked for a sign-in instead of showing search results. AI Studio signs in with your operating system account only when your wiki has a private or VPN address, and either the wiki did not accept that sign-in or its address is public. Open the wiki in your browser to check your access."));
 
         var markdown = retrievedPage.ExtractedPage.Markdown;
         if (string.IsNullOrWhiteSpace(markdown))

app/MindWork AI Studio/Tools/Web/WebPageRetrievalOptions.cs

@@ -34,14 +34,5 @@ public sealed class WebPageRetrievalOptions
     /// </summary>
     public Func<Uri, bool>? IsTargetAllowed { get; init; }
 
-    /// <summary>
-    /// Allows the operating system's sign-in for a host which resolves to public addresses.
-    /// </summary>
-    /// <remarks>
-    /// Without it, the sign-in is only sent to allowed private hosts. Use it only for a host
-    /// which the user or the organization configured, never for one a model named.
-    /// </remarks>
-    public Func<string, bool>? IsOsSsoAllowedForPublicHost { get; init; }
-
     public Func<Uri, ConfidenceLevel, Task>? OnPrivateHostProviderBlockAsync { get; init; }
 }

app/MindWork AI Studio/Tools/Web/WebPageRetrievalService.cs

@@ -160,10 +160,9 @@ public sealed class WebPageRetrievalService(HTMLParser htmlParser)
         originalUrl.Host.Equals(candidateUrl.Host, StringComparison.OrdinalIgnoreCase) &&
         originalUrl.Port == candidateUrl.Port &&
         !IsBlockedHostName(candidateUrl.Host) &&
+        options.IsPrivateHostAllowed?.Invoke(candidateUrl.Host) is true &&
         addresses.Count > 0 &&
-        (addresses.All(IsNonPublicAddress)
-            ? options.IsPrivateHostAllowed?.Invoke(candidateUrl.Host) is true
-            : options.IsOsSsoAllowedForPublicHost?.Invoke(candidateUrl.Host) is true);
+        addresses.All(IsNonPublicAddress);
 
     private static IPAddress NormalizeAddress(IPAddress address) => address.IsIPv4MappedToIPv6 ? address.MapToIPv4() : address;