feat(intercept): check every redirect hop against the target gate (S3b 1.9)

WebFetch and the custom http tool followed redirects with net/http's
default policy, so a pinned host could send the client to a target nobody
approved. RedirectCheck is now the CheckRedirect policy of both clients.

- Gate off, or no scope (operator test endpoint): only the 10-hop limit,
  same error text; nothing is parsed, resolved, read or written.
- Gate on: each hop runs through the call's decision code (URL rules on
  the hop URL, block rules before any lookup, exemptions, resolution,
  pins). A hop no pin covers is not followed and never waits: its request
  row is found or created and the call fails with TARGET_APPROVAL_PENDING.
  http -> https asks again for port 443 unless a (host, 0) pin exists. An
  unreadable hop is blocked with TARGET_GATE_UNAVAILABLE.
- Rows raised by a hop record redirect_from in the audit targets.
- Norma v0.4.7 has WebFetchConfig.CheckRedirect but no agentcore option,
  so the four agent kinds build WebFetch themselves (same proxy, CA and
  position in the tool list) instead of EnableWebFetch. Norma carries the
  policy to the direct retry client.

agent/chat.go

@@ -128,13 +128,10 @@ func (c *ChatAgent) Chat(ctx context.Context, agentKey, sessionID, message strin
 		Provider:        c.prov,
 		SystemPrompt:    system,
 		DynamicBoundary: boundary,
-		Tools:           tools,
+		Tools:           withWebFetch(tools, c.proxyAddr, c.proxyCACert), // WebFetch: routed through the recording proxy for tracing; loads the proxy CA to verify MITM-resigned HTTPS certificates; every redirect hop is gated
 		DeferredTools:   def.Deferred,
 		UnlockSet:       def.Unlock,
 		PermissionMode:  permission.ModeBypass,
-		EnableWebFetch:  true, // routed through the recording proxy for tracing; loads the proxy CA to verify MITM-resigned HTTPS certificates
-		WebFetchProxy:   c.proxyAddr,
-		WebFetchCACert:  c.proxyCACert,
 		// Web search (optional). ddgs needs no key; brave-free needs BraveKey; tavily needs TavilyKey.
 		// WebSearchProxy is a dedicated egress proxy (http/https/socks5), unrelated to the traffic-recording MITM proxy; empty = direct.
 		EnableWebSearch:       ws.Enabled,

agent/mainagent.go

@@ -144,13 +144,10 @@ func (m *MainAgent) Chat(ctx context.Context, taskID int64, mainSeg int, as *db.
 		Provider:        m.prov,
 		SystemPrompt:    system,
 		DynamicBoundary: boundary,
-		Tools:           tools,
+		Tools:           withWebFetch(tools, m.proxyAddr, m.proxyCACert), // WebFetch: routed through the recording proxy for tracing; loads the proxy CA to verify MITM-resigned HTTPS certificates; every redirect hop is gated
 		DeferredTools:   def.Deferred,
 		UnlockSet:       def.Unlock,
 		PermissionMode:  permission.ModeBypass,
-		EnableWebFetch:  true, // routed through the recording proxy for tracing; loads the proxy CA to verify MITM-resigned HTTPS certificates
-		WebFetchProxy:   m.proxyAddr,
-		WebFetchCACert:  m.proxyCACert,
 		// Web search (optional). ddgs needs no key; brave-free needs BraveKey; tavily needs TavilyKey.
 		// WebSearchProxy is a dedicated egress proxy (http/https/socks5), unrelated to the traffic-recording MITM proxy; empty = direct.
 		EnableWebSearch:       m.webSearch.Enabled,

agent/planner.go

@@ -426,13 +426,10 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 		Provider:        p.prov,
 		SystemPrompt:    system,
 		DynamicBoundary: boundary,
-		Tools:           tools,
+		Tools:           withWebFetch(tools, p.proxyAddr, p.proxyCACert), // WebFetch: route through the recording proxy for traceability; load the proxy CA to verify MITM-re-signed HTTPS certs; every redirect hop is gated
 		DeferredTools:   def.Deferred,
 		UnlockSet:       def.Unlock,
 		PermissionMode:  permission.ModeBypass,
-		EnableWebFetch:  true, // route through the recording proxy for traceability; load the proxy CA to verify MITM-re-signed HTTPS certs
-		WebFetchProxy:   p.proxyAddr,
-		WebFetchCACert:  p.proxyCACert,
 		// Web search (optional). ddgs needs no key; brave-free needs BraveKey; tavily needs TavilyKey.
 		// WebSearchProxy is a dedicated egress proxy (http/https/socks5), unrelated to the traffic-recording MITM proxy; empty = direct.
 		EnableWebSearch:       p.webSearch.Enabled,

agent/webfetch.go

@@ -0,0 +1,19 @@
+package agent
+
+import (
+	"github.com/Autumn-27/artex/intercept"
+	actool "github.com/Autumn-27/norma/tool"
+)
+
+// withWebFetch returns tools plus the WebFetch tool of an agent session. Every
+// agent kind builds WebFetch here instead of through agentcore's EnableWebFetch,
+// which has no option for a redirect policy: every redirect hop goes through the
+// target gate (intercept.RedirectCheck), on the client that uses proxy and on
+// the direct retry client alike. The tool is added after the session's own
+// tools, where agentcore adds it, so the tool list keeps its order. caCert is the
+// recording proxy's CA, trusted to verify the HTTPS it re-signs. tools is not
+// modified.
+func withWebFetch(tools []actool.CoreTool, proxy, caCert string) []actool.CoreTool {
+	webFetch := actool.NewWebFetch(actool.WebFetchConfig{Proxy: proxy, CACert: caCert, CheckRedirect: intercept.RedirectCheck("WebFetch")})
+	return append(tools[:len(tools):len(tools)], webFetch)
+}

agent/webfetch_redirect_test.go

@@ -0,0 +1,228 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/guard"
+	"github.com/Autumn-27/artex/intercept"
+	"github.com/Autumn-27/norma/llm"
+	actool "github.com/Autumn-27/norma/tool"
+)
+
+// Step 1.9: the WebFetch tool of every agent kind checks each redirect hop
+// against the target gate, on the primary client and on the direct retry
+// client. With the gate off it follows redirects as before.
+
+// passHooks lets every tool call run.
+type passHooks struct{}
+
+func (passHooks) PreToolUse(context.Context, string, []byte) (bool, string, []byte) {
+	return false, "", nil
+}
+
+func (passHooks) PostToolUse(context.Context, string, []byte, []byte, bool) {}
+
+func (passHooks) Stop(context.Context, []llm.Message) (bool, []string, string) {
+	return false, nil, ""
+}
+
+// redirectPair is a server that redirects to a second one on another port of
+// 127.0.0.1, so the hop is another target (an IP literal: never resolved).
+type redirectPair struct {
+	start, final         string // URLs
+	startHits, finalHits *atomic.Int64
+	finalKey             string // host:port of the redirect target
+}
+
+func newRedirectPair(t *testing.T) redirectPair {
+	t.Helper()
+	p := redirectPair{startHits: &atomic.Int64{}, finalHits: &atomic.Int64{}}
+	final := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		p.finalHits.Add(1)
+		w.Header().Set("Content-Type", "text/plain")
+		_, _ = w.Write([]byte("redirect-target-reached"))
+	}))
+	t.Cleanup(final.Close)
+	start := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		p.startHits.Add(1)
+		http.Redirect(w, r, final.URL+"/final", http.StatusFound)
+	}))
+	t.Cleanup(start.Close)
+	u, _ := url.Parse(final.URL)
+	p.start, p.final, p.finalKey = start.URL+"/start", final.URL+"/final", u.Host
+	return p
+}
+
+// gatedScope is a gated target scope on task taskID, whose rows are removed
+// afterwards.
+func gatedScope(t *testing.T, d *db.DB, taskID string) intercept.TargetScope {
+	t.Helper()
+	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM intercept_pending WHERE task_id=$1`, taskID) })
+	return intercept.TargetScope{TaskID: taskID, Enabled: func() bool { return true },
+		WaitBound: intercept.DefaultTargetWaitBound, Interceptor: intercept.New(d)}
+}
+
+// openRedirectRequests returns the target keys of the open requests of task.
+func openRedirectRequests(t *testing.T, d *db.DB, taskID string) []string {
+	t.Helper()
+	rows, err := d.Query(`SELECT target_key FROM intercept_pending WHERE task_id=$1 AND status='pending' AND target_key IS NOT NULL ORDER BY id`, taskID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var keys []string
+	for rows.Next() {
+		var k string
+		if err := rows.Scan(&k); err != nil {
+			t.Fatal(err)
+		}
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+func fetchInputJSON(u string) string {
+	b, _ := json.Marshal(map[string]string{"url": u})
+	return string(b)
+}
+
+// Each agent kind runs a scripted WebFetch on a URL that redirects to a target
+// no pin covers. The hooks let the call run, so the hop is what the gate sees:
+// each kind must stop at the hop, leave the redirect target untouched and open
+// one request for it. A fifth agent kind added without the redirect policy
+// fails this table once it is added to it.
+func TestWebFetchRedirectCheckWiredOnEveryAgentKind(t *testing.T) {
+	for _, kind := range []string{"worker", "planner", "mainagent", "chat"} {
+		t.Run(kind, func(t *testing.T) {
+			f := newHookReachFixture(t)
+			d := testDB(t)
+			t.Cleanup(func() { _ = d.Close() })
+			pair := newRedirectPair(t)
+			scope := gatedScope(t, d, f.taskID)
+			ctx := intercept.WithTargetScope(t.Context(), scope)
+			prov := toolCallThenStop("WebFetch", fetchInputJSON(pair.start))
+
+			switch kind {
+			case "worker":
+				payload := map[string]any{"summary": "redirect probe"}
+				intentID, err := f.ts.AddNode("intent", payload, 0, "running", "planner", nil)
+				if err != nil {
+					t.Fatal(err)
+				}
+				raw, _ := json.Marshal(payload)
+				w := NewWorker(prov, "test-model", f.workDir, nil, 0, 3)
+				if _, _, err := w.Execute(ctx, "work#1", f.expID, nil, f.ts, &db.Node{ID: intentID, Payload: raw}, passHooks{}, nil, nil, nil); err != nil {
+					t.Fatal(err)
+				}
+			case "planner":
+				p := NewPlanner(prov, "test-model", f.workDir, nil, 0, 3)
+				if _, _, err := p.Plan(ctx, f.expID, nil, f.ts, "probe goal", nil, passHooks{}, nil); err != nil {
+					t.Fatal(err)
+				}
+			case "mainagent":
+				m := NewMainAgent(prov, "test-model", f.workDir, nil, 0, 3)
+				if _, err := m.Chat(ctx, f.expID, 0, nil, f.ts, "probe goal", "status?", passHooks{}, nil, nil, nil, nil, nil); err != nil {
+					t.Fatal(err)
+				}
+			case "chat":
+				c := NewChatAgent(prov, "test-model", t.TempDir(), nil, 0)
+				c.SetGuard(guard.New())
+				if _, err := c.Chat(ctx, "assistant", "conv-redirect-probe", "fetch it", 3, 0, false, nil); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			if pair.startHits.Load() != 1 {
+				t.Fatalf("the fetch did not run: %d hits on the origin", pair.startHits.Load())
+			}
+			if pair.finalHits.Load() != 0 {
+				t.Fatal("the redirect was followed to a target no pin covers")
+			}
+			if keys := openRedirectRequests(t, d, f.taskID); len(keys) != 1 || keys[0] != pair.finalKey {
+				t.Fatalf("open requests = %v, want one for %s", keys, pair.finalKey)
+			}
+		})
+	}
+}
+
+// The direct retry client carries the policy too: with a proxy that refuses
+// the connection, WebFetch retries without it, reaches the origin, and the
+// hop is still stopped.
+func TestWebFetchRedirectCheckOnDirectRetry(t *testing.T) {
+	d := testDB(t)
+	t.Cleanup(func() { _ = d.Close() })
+	expID, err := d.CreateExploration("redirect retry probe", "the direct retry client checks redirects")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM explorations WHERE id=$1`, expID) })
+	taskID := fmt.Sprint(expID)
+	pair := newRedirectPair(t)
+	ctx := intercept.WithTargetScope(t.Context(), gatedScope(t, d, taskID))
+
+	out, isErr := callWebFetch(t, ctx, "http://127.0.0.1:1", pair.start)
+	if !isErr || !strings.Contains(out, intercept.TargetApprovalPending) || !strings.Contains(out, "redirects to "+pair.finalKey) {
+		t.Fatalf("retried fetch: error=%v out=%q", isErr, out)
+	}
+	if pair.startHits.Load() != 1 || pair.finalHits.Load() != 0 {
+		t.Fatalf("hits origin=%d target=%d, want the origin reached by the retry and the target untouched", pair.startHits.Load(), pair.finalHits.Load())
+	}
+	if keys := openRedirectRequests(t, d, taskID); len(keys) != 1 || keys[0] != pair.finalKey {
+		t.Fatalf("open requests = %v, want one for %s", keys, pair.finalKey)
+	}
+}
+
+// With the gate off, or without a scope, WebFetch follows redirects as it did
+// with agentcore's own tool: to the end of the chain, and the same error after
+// 10 hops. No database.
+func TestWebFetchRedirectGateOffUnchanged(t *testing.T) {
+	loop := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, r.URL.Path+"x", http.StatusFound)
+	}))
+	t.Cleanup(loop.Close)
+	for name, ctx := range map[string]context.Context{
+		"no scope": t.Context(),
+		"flag off": intercept.WithTargetScope(t.Context(), intercept.TargetScope{TaskID: "7", Enabled: func() bool { return false },
+			WaitBound: time.Minute, Interceptor: intercept.New(nil)}),
+	} {
+		pair := newRedirectPair(t)
+		for _, proxy := range []string{"", "http://127.0.0.1:1"} {
+			if out, isErr := callWebFetch(t, ctx, proxy, pair.start); isErr || !strings.Contains(out, "redirect-target-reached") {
+				t.Fatalf("%s, proxy %q: error=%v out=%q", name, proxy, isErr, out)
+			}
+		}
+		if pair.finalHits.Load() != 2 {
+			t.Fatalf("%s: %d hits on the redirect target, want 2", name, pair.finalHits.Load())
+		}
+		got, _ := callWebFetch(t, ctx, "", loop.URL+"/l")
+		want := actool.NewWebFetch(actool.WebFetchConfig{}).Call
+		res, err := want(ctx, json.RawMessage(fetchInputJSON(loop.URL+"/l")), &actool.ToolContext{})
+		if err != nil || got != res.Flatten() || !strings.Contains(got, "stopped after 10 redirects") {
+			t.Fatalf("%s: redirect loop: %q, want agentcore's %q", name, got, res.Flatten())
+		}
+	}
+}
+
+// callWebFetch runs the WebFetch tool the agents build, with proxy.
+func callWebFetch(t *testing.T, ctx context.Context, proxy, u string) (string, bool) {
+	t.Helper()
+	tools := withWebFetch(nil, proxy, "")
+	if len(tools) != 1 || tools[0].Name() != "WebFetch" {
+		t.Fatalf("withWebFetch built %d tools", len(tools))
+	}
+	res, err := tools[0].Call(ctx, json.RawMessage(fetchInputJSON(u)), &actool.ToolContext{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return res.Flatten(), res.IsError
+}

agent/worker.go

@@ -482,16 +482,14 @@ func (w *Worker) execute(ctx context.Context, name string, taskID int64, as *db.
 		Provider:        w.prov,
 		SystemPrompt:    system,
 		DynamicBoundary: boundary,
-		Tools:           tools,
+		Tools:           withWebFetch(tools, w.proxyAddr, w.proxyCACert),
 		DeferredTools:   def.Deferred,
 		UnlockSet:       def.Unlock,
 		PermissionMode:  permission.ModeBypass,
-		// WebFetch goes through the recording proxy, so its HTTP is recorded just like
-		// curl; loading the proxy CA lets MITM-re-signed HTTPS certs [verify normally]
-		// (rather than disabling verification). Direct when proxy is empty.
-		EnableWebFetch: true,
-		WebFetchProxy:  w.proxyAddr,
-		WebFetchCACert: w.proxyCACert,
+		// WebFetch (added to Tools above) goes through the recording proxy, so its
+		// HTTP is recorded just like curl; loading the proxy CA lets MITM-re-signed
+		// HTTPS certs [verify normally] (rather than disabling verification). Direct
+		// when proxy is empty. Every redirect hop goes through the target gate.
 		// Web search (optional). ddgs needs no key; brave-free needs BraveKey; tavily needs TavilyKey.
 		// WebSearchProxy is a dedicated egress proxy (http/https/socks5), unrelated to the traffic-recording MITM proxy; empty = direct.
 		EnableWebSearch:       w.webSearch.Enabled,

db/asset_intercept_match.go

@@ -45,6 +45,12 @@ func (r AssetInterceptRule) Reason() string {
 
 // matchOne checks whether a single enabled rule matches the given domain/IP/URL
 // candidates, and returns the concrete matched value.
+//
+// URL rules match the URL string as given, with no normalisation. Known limit:
+// exact_url misses any other spelling of the same URL (case, percent-encoding
+// such as %2F, a trailing slash, an added query, /./), and fuzzy_url misses an
+// encoded form of its substring. At tool dispatch the string is the URL the
+// call declares (intercept, targetCheck.run).
 func matchOne(r AssetInterceptRule, domains, ips, urls []string) (string, bool) {
 	p := strings.TrimSpace(r.Pattern)
 	if p == "" {

db/intercept_detail.go

@@ -76,6 +76,9 @@ type InterceptTarget struct {
 	// ExemptVoid: a stored exemption names this target, and did not apply because
 	// the name resolved to a private, loopback or otherwise local address.
 	ExemptVoid bool `json:"exempt_void,omitempty"`
+	// RedirectFrom: the origin (host:port) of the redirect hop that led to this
+	// target; empty when the call named the target itself.
+	RedirectFrom string `json:"redirect_from,omitempty"`
 }
 
 type InterceptDetail struct {

go.mod

@@ -61,4 +61,4 @@ require (
 	modernc.org/memory v1.11.0 // indirect
 )
 
-replace github.com/Autumn-27/norma => github.com/BaaRai/Norma v0.4.6
+replace github.com/Autumn-27/norma => github.com/BaaRai/Norma v0.4.7

go.sum

@@ -1,5 +1,5 @@
-github.com/BaaRai/Norma v0.4.6 h1:sEm58Gx7gw+UU/05aHZBZ+Xqm5dMYiuSQpc1aXnbElc=
-github.com/BaaRai/Norma v0.4.6/go.mod h1:BudWrf7iHl96FgHqFr/HwN3mKYmGjJDt+xL2ZHXfFZw=
+github.com/BaaRai/Norma v0.4.7 h1:MJTKF7Dpuh3hjRJpmKtLJ8RknX30FEntDz08Q2y4iDs=
+github.com/BaaRai/Norma v0.4.7/go.mod h1:BudWrf7iHl96FgHqFr/HwN3mKYmGjJDt+xL2ZHXfFZw=
 github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro=
 github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=

guard/target_gate_test.go

@@ -282,18 +282,27 @@ type gateDB struct {
 	task string // task id
 }
 
-// stubResolver answers every name with the addresses it holds.
+// stubResolver answers every name with the addresses it holds, and counts the
+// lookups.
 type stubResolver struct {
 	mu  sync.Mutex
 	ips []string
 	err error
+	n   int
 }
 
 func (r *stubResolver) Name() string { return "stub" }
 
+func (r *stubResolver) lookups() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.n
+}
+
 func (r *stubResolver) LookupIPs(context.Context, string) ([]netip.Addr, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
+	r.n++
 	if r.err != nil {
 		return nil, r.err
 	}
@@ -576,8 +585,8 @@ func TestGateOffLeavesEveryBranchUnchanged(t *testing.T) {
 	}
 }
 
-// A deny by a rule blocks first, as before: the gate is not consulted and no
-// target request exists.
+// A deny by a rule or by the judge blocks first, as before: the gate is not
+// consulted, nothing is resolved and no target request exists.
 func TestDenyRuleWinsBeforeTargetRequest(t *testing.T) {
 	g := newGateDB(t)
 	m := marker(t)
@@ -601,8 +610,77 @@ func TestDenyRuleWinsBeforeTargetRequest(t *testing.T) {
 	if block, _ := pre(guard, g.ctx(true, time.Minute), "Bash", `{"command":"curl https://app.example.com/ # `+m+`"}`); !block {
 		t.Fatal("deny did not block")
 	}
-	if len(g.pending()) != 0 || len(g.pins()) != 0 {
-		t.Fatalf("pending=%+v pins=%+v, want none", g.pending(), g.pins())
+	if len(g.pending()) != 0 || len(g.pins()) != 0 || g.res.lookups() != 0 {
+		t.Fatalf("pending=%+v pins=%+v lookups=%d, want none", g.pending(), g.pins(), g.res.lookups())
+	}
+
+	// A deny by the judge takes the same branch.
+	g.judge("deny")
+	input := `{"command":"curl https://judged.example.com/"}`
+	gate = &fakeGate{t: t, check: unpinnedOnce}
+	guard = NewWithInterceptor(g.ic)
+	guard.gate = gate
+	before := len(g.rows())
+	if block, msg := pre(guard, g.ctx(true, time.Minute), "Bash", input); !block || !strings.Contains(msg, "judge says deny") || strings.Contains(msg, "TARGET_") {
+		t.Fatalf("judge deny: block=%v msg=%q", block, msg)
+	}
+	if gate.checks != 0 || len(gate.asked) != 0 {
+		t.Fatalf("judge deny: the gate was reached: %d checks, %d requests", gate.checks, len(gate.asked))
+	}
+	if rows := g.rows()[before:]; len(rows) != 1 || rows[0].status != "denied" || rows[0].decidedBy != "model" || rows[0].targetKey != "" {
+		t.Fatalf("judge deny: rows = %+v, want the denied judge row only", rows)
+	}
+	guard = NewWithInterceptor(g.ic)
+	if block, _ := pre(guard, g.ctx(true, time.Minute), "Bash", input); !block {
+		t.Fatal("judge deny did not block")
+	}
+	if len(g.pending()) != 0 || len(g.pins()) != 0 || g.res.lookups() != 0 {
+		t.Fatalf("judge deny: pending=%+v pins=%+v lookups=%d, want none", g.pending(), g.pins(), g.res.lookups())
+	}
+}
+
+// An asset block rule wins over an allow and an ask, of a rule or of the
+// judge: the call is blocked, the allow is not logged, no human is asked, and
+// the rule hits on what the call declares, so nothing is resolved. A name rule
+// and a URL rule behave the same.
+func TestBlockRuleWinsOverAllowAndAsk(t *testing.T) {
+	const input = `{"command":"curl https://app.example.com/blocked-path # %s"}`
+	for _, block := range []struct{ name, kind, pattern string }{
+		{"name rule", "exact_domain", "app.example.com"},
+		{"URL rule", "fuzzy_url", "/blocked-path"},
+	} {
+		for _, v := range []struct{ name, by, action string }{
+			{"rule allow", "rule", "allow"},
+			{"judge allow", "judge", "allow"},
+			{"rule ask", "rule", "ask"},
+			{"judge ask", "judge", "ask"},
+		} {
+			t.Run(block.name+" over "+v.name, func(t *testing.T) {
+				g := newGateDB(t)
+				id, _ := strconv.ParseInt(g.task, 10, 64)
+				if _, err := g.d.Assets().CreateTaskInterceptRule(id, "block", block.kind, block.pattern, "guard test", true); err != nil {
+					t.Fatal(err)
+				}
+				m := marker(t)
+				if v.by == "rule" {
+					g.rule(v.action, m)
+				} else {
+					g.judge(v.action)
+				}
+				guard := NewWithInterceptor(g.ic)
+				r := g.result(call(guard, g.ctx(true, time.Minute), "Bash", fmt.Sprintf(input, m)))
+				if !r.block || !strings.Contains(r.msg, intercept.TargetRuleBlocked+": ") || !strings.Contains(r.msg, block.pattern) {
+					t.Fatalf("block=%v msg=%q, want %s", r.block, r.msg, intercept.TargetRuleBlocked)
+				}
+				rows := g.rows()
+				if len(rows) != 1 || rows[0].status != "denied" || rows[0].decidedBy != "system" || rows[0].ruleID != 0 {
+					t.Fatalf("rows = %+v, want the one block row of the gate: no allow logged, nobody asked", rows)
+				}
+				if n := g.res.lookups(); n != 0 || len(g.pins()) != 0 {
+					t.Fatalf("%d lookups, pins %+v; want none", n, g.pins())
+				}
+			})
+		}
 	}
 }
 

intercept/target_declared_test.go

@@ -0,0 +1,193 @@
+package intercept
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// The declared forms of a call decide first: the URL block rules on the URLs
+// the call writes, then the block rules on every name, IP literal and range as
+// written. Nothing is resolved before that, so a hit costs no lookup.
+
+func TestExtractDeclaredURLs(t *testing.T) {
+	raw := func(v any) []byte {
+		b, _ := json.Marshal(v)
+		return b
+	}
+	for _, c := range []struct {
+		name  string
+		tool  string
+		input []byte
+		want  []string
+	}{
+		{"WebFetch", "WebFetch", raw(map[string]string{"url": " https://app.example.com/admin?x=1 "}), []string{"https://app.example.com/admin?x=1"}},
+		{"WebFetch without a target", "WebFetch", raw(map[string]string{"url": "http:///path"}), nil},
+		{"Bash, query kept", "Bash", raw(command("curl -s 'https://a.example.com/admin?x=1'")), []string{"https://a.example.com/admin?x=1"}},
+		{"Bash, two URLs", "Bash", raw(command("curl http://a.example.com/x && curl https://b.example.com:8443/y")),
+			[]string{"http://a.example.com/x", "https://b.example.com:8443/y"}},
+		{"shell_send", "shell_send", raw(map[string]string{"text": "curl http://a.example.com/x\n"}), []string{"http://a.example.com/x"}},
+		{"Monitor", "Monitor", raw(command("watch curl http://198.51.100.9:8080/status")), []string{"http://198.51.100.9:8080/status"}},
+		{"MCP string leaves", "mcp__scan__run", []byte(`{"target":"http://a.example.com/p","opts":{"list":["https://b.example.com/q"]}}`),
+			[]string{"http://a.example.com/p", "https://b.example.com/q"}},
+		{"ExecuteExtraTool unwrap", executeExtraTool, raw(map[string]any{"tool_name": "WebFetch", "params": map[string]string{"url": "https://a.example.com/z"}}),
+			[]string{"https://a.example.com/z"}},
+		{"tool without a target", "web_search", raw(map[string]string{"query": "https://a.example.com/admin"}), nil},
+		{"wrapped tool without a target", executeExtraTool, raw(map[string]any{"tool_name": "web_search", "params": map[string]string{"query": "https://a.example.com/admin"}}), nil},
+		{"authority that names no host", "Bash", raw(command("curl http://$HOST/x https://${H}:8443/admin")), nil},
+	} {
+		d := extractDeclared(c.tool, c.input)
+		if !slices.Equal(d.urls, c.want) {
+			t.Errorf("%s: urls = %q, want %q", c.name, d.urls, c.want)
+		}
+		// The targets are those ExtractTargets returns.
+		if !slices.Equal(d.targets, ExtractTargets(c.tool, c.input)) {
+			t.Errorf("%s: targets differ from ExtractTargets", c.name)
+		}
+		if len(d.urls) > 0 && len(d.targets) == 0 {
+			t.Errorf("%s: a URL without a target", c.name)
+		}
+	}
+}
+
+// A name that a name rule blocks is blocked on the name as written: no lookup
+// is made for it, nor for another name of the same call that no rule blocks.
+func TestBlockRuleOnDeclaredNameNeedsNoLookup(t *testing.T) {
+	for _, rule := range []db.AssetInterceptRule{
+		{Enabled: true, Kind: "exact_domain", Pattern: "blocked.example.com"},
+		{Enabled: true, Kind: "fuzzy_domain", Pattern: "blocked.example"},
+	} {
+		g := newGate(t)
+		g.res.set("ok.example.com", "203.0.113.7")
+		g.res.set("blocked.example.com", "203.0.113.8")
+		g.store.rules = []db.AssetInterceptRule{rule}
+		for name, v := range map[string]verdict{
+			"WebFetch": g.fetch("https://blocked.example.com/"),
+			// The unblocked name comes first in the call.
+			"two names": g.check("Bash", `{"command":"curl https://ok.example.com/ https://blocked.example.com/"}`),
+		} {
+			res := g.blocked(rule.Kind+", "+name, TargetRuleBlocked, v)
+			if res.Host != "blocked.example.com" || !strings.Contains(res.Reason, rule.Pattern) {
+				t.Fatalf("%s, %s: result = %+v", rule.Kind, name, res)
+			}
+		}
+		if n := g.res.total(); n != 0 {
+			t.Fatalf("%s: %d lookups, want none", rule.Kind, n)
+		}
+		for _, row := range g.store.logged {
+			if a := row.Audit.Targets[0]; a.Outcome != "rule_blocked" || len(a.ResolvedIPs) != 0 {
+				t.Fatalf("%s: logged target = %+v, want rule_blocked with no address", rule.Kind, a)
+			}
+		}
+	}
+}
+
+// URL rules apply at dispatch, on the URLs the call declares, before anything
+// is resolved. A hit blocks with the code of every block rule, opens no
+// request, and wins over a pin and an exemption.
+func TestURLBlockRuleAtDispatch(t *testing.T) {
+	g := newGate(t)
+	g.res.set("app.example.com", "203.0.113.7")
+	g.res.set("pypi.org", "151.101.0.223")
+	g.store.exempt = []db.TargetExemption{{Host: "pypi.org", Port: 443}}
+	g.store.approve(TargetRequest{Host: "app.example.com", Port: 443, ResolvedIPs: []string{"203.0.113.7"}})
+	g.passes("pinned", g.fetch("https://app.example.com/admin"))
+	g.passes("exempt", g.fetch("https://pypi.org/admin"))
+
+	rule := func(kind, pattern string, enabled bool) []db.AssetInterceptRule {
+		return []db.AssetInterceptRule{{Enabled: enabled, Kind: kind, Pattern: pattern}}
+	}
+	// A disabled URL rule blocks nothing.
+	g.store.rules = rule("exact_url", "https://app.example.com/admin", false)
+	g.passes("disabled rule", g.fetch("https://app.example.com/admin"))
+
+	lookups, rows := g.res.total(), len(g.store.logged)
+	for _, c := range []struct {
+		name       string
+		rules      []db.AssetInterceptRule
+		v          func() verdict
+		host       string
+		port       int
+		matchedURL string
+	}{
+		{"exact_url, WebFetch of a pinned host", rule("exact_url", "https://app.example.com/admin", true),
+			func() verdict { return g.fetch("https://app.example.com/admin") }, "app.example.com", 443, "https://app.example.com/admin"},
+		{"fuzzy_url, exempt host", rule("fuzzy_url", "/admin", true),
+			func() verdict { return g.fetch("https://pypi.org/admin") }, "pypi.org", 443, "https://pypi.org/admin"},
+		{"fuzzy_url, Bash with a query", rule("fuzzy_url", "/admin", true),
+			func() verdict { return g.check("Bash", `{"command":"curl -s 'https://app.example.com/admin?x=1'"}`) }, "app.example.com", 443, "https://app.example.com/admin?x=1"},
+		{"fuzzy_url, second URL of the call", rule("fuzzy_url", "/admin", true),
+			func() verdict {
+				return g.check("Bash", `{"command":"curl https://app.example.com/ && curl http://198.51.100.9:8080/admin"}`)
+			}, "198.51.100.9", 8080, "http://198.51.100.9:8080/admin"},
+		{"fuzzy_url, MCP input", rule("fuzzy_url", "/ADMIN", true),
+			func() verdict { return g.check("mcp__scan__run", `{"target":"https://app.example.com/admin/users"}`) }, "app.example.com", 443, "https://app.example.com/admin/users"},
+		{"exact_url, wrapped WebFetch", rule("exact_url", "https://app.example.com/admin", true),
+			func() verdict {
+				return g.check(executeExtraTool, `{"tool_name":"WebFetch","params":{"url":"https://app.example.com/admin"}}`)
+			}, "app.example.com", 443, "https://app.example.com/admin"},
+	} {
+		g.store.rules = c.rules
+		g.res.set("app.example.com", "198.51.100.200") // a lookup would make a pinned host ask
+		res := g.blocked(c.name, TargetRuleBlocked, c.v())
+		if res.Host != c.host || res.Port != c.port || !strings.Contains(res.Reason, c.matchedURL+" is blocked by an asset rule") ||
+			!strings.Contains(res.Reason, c.rules[0].Pattern) {
+			t.Errorf("%s: result = %+v", c.name, res)
+		}
+	}
+	if n := g.res.total() - lookups; n != 0 {
+		t.Fatalf("%d lookups for calls a URL rule blocks, want none", n)
+	}
+	if got := g.store.outcomes()[rows:]; len(got) != 6 || slices.ContainsFunc(got, func(o string) bool { return o != "denied/rule_blocked" }) {
+		t.Fatalf("logged rows = %v, want 6 rule_blocked rows", got)
+	}
+
+	// The rendered URL of a custom http tool and the URLs of a rendered command
+	// meet the same rules, with no lookup.
+	g.store.rules = rule("exact_url", "https://app.example.com/admin", true)
+	if res := GateRenderedURL(g.ctx(), "probe_http", "https://app.example.com/admin"); res.Code != TargetRuleBlocked || res.Host != "app.example.com" {
+		t.Fatalf("rendered URL: %+v", res)
+	}
+	g.store.rules = rule("fuzzy_url", "/admin", true)
+	if res := GateRenderedCommand(g.ctx(), "probe_cmd", "curl 'https://app.example.com/admin'"); res.Code != TargetRuleBlocked {
+		t.Fatalf("rendered command: %+v", res)
+	}
+	if n := g.res.total() - lookups; n != 0 {
+		t.Fatalf("%d lookups for rendered calls a URL rule blocks, want none", n)
+	}
+}
+
+// Documents the known limit of URL rules: they match the URL as the call
+// writes it. Another spelling of the same URL is not blocked. For a host, a
+// domain, IP or CIDR rule is the one to write.
+func TestExactURLRuleMatchesOnlyAsWritten(t *testing.T) {
+	g := newGate(t)
+	g.res.set("app.example.com", "203.0.113.7")
+	g.store.approve(TargetRequest{Host: "app.example.com", Port: 443, ResolvedIPs: []string{"203.0.113.7"}})
+
+	g.store.rules = []db.AssetInterceptRule{{Enabled: true, Kind: "exact_url", Pattern: "https://app.example.com/admin"}}
+	g.blocked("as written", TargetRuleBlocked, g.fetch("https://app.example.com/admin"))
+	for _, u := range []string{
+		"https://APP.example.com/admin",     // case of the host
+		"https://app.example.com/Admin",     // case of the path
+		"https://app.example.com/admin/",    // trailing slash
+		"https://app.example.com/admin?x=1", // added query
+		"https://app.example.com/%61dmin",   // percent-encoding
+		"https://app.example.com/./admin",   // dot segment
+		"https://app.example.com:443/admin", // default port written out
+	} {
+		g.passes("exact_url, "+u, g.fetch(u))
+	}
+
+	g.store.rules = []db.AssetInterceptRule{{Enabled: true, Kind: "fuzzy_url", Pattern: "/admin"}}
+	g.blocked("fuzzy, as written", TargetRuleBlocked, g.fetch("https://app.example.com/x/admin"))
+	for _, u := range []string{"https://app.example.com/%61dmin", "https://app.example.com/adm%69n", "https://app.example.com//%2fadmin"} {
+		if strings.Contains(strings.ToLower(u), "/admin") {
+			t.Fatalf("%s contains the pattern; the case documents an encoded form", u)
+		}
+		g.passes("fuzzy_url, "+u, g.fetch(u))
+	}
+}

intercept/target_extract.go

@@ -62,6 +62,13 @@ func toolSet(names ...string) map[string]bool {
 // names on its own. The gate detects a declared target; it does not prevent an
 // undeclared connection.
 func ExtractTargets(toolName string, input []byte) []Target {
+	return extractDeclared(toolName, input).targets
+}
+
+// extractDeclared reads what a tool call declares: its targets, as
+// ExtractTargets returns them, and the URLs it writes, as written, for the URL
+// block rules. A URL is kept only when it names a target.
+func extractDeclared(toolName string, input []byte) targetList {
 	if toolName == executeExtraTool {
 		var in struct {
 			ToolName string          `json:"tool_name"`
@@ -72,13 +79,15 @@ func ExtractTargets(toolName string, input []byte) []Target {
 		}
 	}
 	if noTargetTools[toolName] {
-		return nil
+		return targetList{}
 	}
 	var out targetList
 	switch toolName {
 	case "WebFetch":
-		if t, ok := NormalizeTarget(declaredFields(input).URL); ok {
+		u := declaredFields(input).URL
+		if t, ok := NormalizeTarget(u); ok {
 			out.add(t)
+			out.urls = append(out.urls, strings.TrimSpace(u))
 		}
 	case "Bash", "shell_open", "Monitor":
 		out.scan(declaredFields(input).Command)
@@ -87,7 +96,7 @@ func ExtractTargets(toolName string, input []byte) []Target {
 	default:
 		out.scanStrings(input)
 	}
-	return out.targets
+	return out
 }
 
 // declaredInput holds the fields of the built-in tools that carry a target.
@@ -109,6 +118,7 @@ func declaredFields(input []byte) declaredInput {
 type targetList struct {
 	targets []Target
 	seen    map[Target]bool
+	urls    []string // the URLs that name a target, as written
 }
 
 func (l *targetList) add(t Target) {
@@ -207,6 +217,10 @@ func (l *targetList) scan(s string) {
 				found = true
 			}
 		}
+		if found {
+			// The whole token, path and query included, from the original string.
+			l.urls = append(l.urls, s[m[0]:m[1]])
+		}
 		// The scheme and what follows the authority are never read again. An
 		// authority that named no host is: an address written in it still counts.
 		blank(m[0], m[4])

intercept/target_gate.go

@@ -93,12 +93,12 @@ func (i *Interceptor) CheckTargets(ctx context.Context, scope TargetScope, toolN
 	if scope.Enabled == nil || !scope.Enabled() {
 		return nil, TargetResult{}
 	}
-	targets := ExtractTargets(toolName, input)
-	if len(targets) == 0 {
+	declared := extractDeclared(toolName, input)
+	if len(declared.targets) == 0 {
 		return nil, TargetResult{}
 	}
-	c := &targetCheck{i: i, ctx: ctx, scope: scope, tool: toolName, input: input}
-	return c.run(targets)
+	c := &targetCheck{i: i, ctx: ctx, scope: scope, tool: toolName, input: input, urls: declared.urls}
+	return c.run(declared.targets)
 }
 
 // targetCheck is one run of the gate decision.
@@ -109,6 +109,9 @@ type targetCheck struct {
 	ref   db.TargetScopeRef
 	tool  string
 	input []byte
+	urls  []string // the URLs the call declares, as written, for the URL block rules
+	// redirectFrom is the origin (host:port) of a redirect hop; empty for a call.
+	redirectFrom string
 }
 
 // checkedTarget is one target of the call and what the gate learned about it.
@@ -146,23 +149,47 @@ func (c *targetCheck) run(targets []Target) ([]TargetRequest, TargetResult) {
 		return c.block(TargetGateUnavailable, "gate_unavailable", first, "the exemption list could not be read: "+err.Error())
 	}
 
-	// Block rules come first, on the name and on what it resolves to: an exempt
-	// or pinned host that matches one is blocked. A name the configuration
-	// exempts is never resolved.
+	// Block rules come first, and an exempt or pinned host that matches one is
+	// blocked. They are matched on what the call declares before anything is
+	// resolved: a hit there costs no lookup, for any target of the call.
+	//
+	// URL rules (exact_url, fuzzy_url) are matched once per decision, on the
+	// URLs as the call writes them. That is a known limit: exact_url compares
+	// the string as written, so another case, encoding (%2F), a trailing slash,
+	// an added query or /./ does not match, and fuzzy_url is evaded by encoding
+	// the substring; a command can also build its URL at run time. To keep an
+	// agent away from a host, a domain, IP or CIDR rule is the one to write.
+	if rule, u, hit := db.MatchAssetInterceptRules(rules, nil, nil, c.urls); hit {
+		ct := &checkedTarget{Target: targets[0]}
+		if t, ok := NormalizeTarget(u); ok {
+			ct.Target = t
+		}
+		return c.block(TargetRuleBlocked, "rule_blocked", ct, fmt.Sprintf("%s is blocked by an asset rule. %s", u, rule.Reason()))
+	}
+	// Then the declared form of every target: the name as written, the IP
+	// literal, the range.
 	checked := make([]*checkedTarget, len(targets))
 	for n, t := range targets {
 		ct := &checkedTarget{Target: t}
 		checked[n] = ct
-		switch {
-		case t.Kind != TargetDomain:
+		if t.Kind != TargetDomain {
 			ct.ips, ct.resolver, ct.resolvedAt = []string{t.Host}, literalResolver, time.Now().UTC()
-		case !ex.derived[db.TargetKey(t.Host, t.Port)]:
-			c.resolve(ct, false)
 		}
 		if rule, hit := blockRule(rules, ct); hit {
 			return c.block(TargetRuleBlocked, "rule_blocked", ct, fmt.Sprintf("%s is blocked by an asset rule. %s", t, rule.Reason()))
 		}
 	}
+	// Only then are the names resolved, and the rules matched on the addresses.
+	// A name the configuration exempts is never resolved.
+	for _, ct := range checked {
+		if ct.Kind != TargetDomain || ex.derived[db.TargetKey(ct.Host, ct.Port)] {
+			continue
+		}
+		c.resolve(ct, false)
+		if rule, hit := blockRule(rules, ct); hit {
+			return c.block(TargetRuleBlocked, "rule_blocked", ct, fmt.Sprintf("%s is blocked by an asset rule. %s", ct.Target, rule.Reason()))
+		}
+	}
 
 	i.mu.RLock()
 	proxied := i.upstreamProxy
@@ -278,6 +305,9 @@ func (c *targetCheck) log(status, reason, configDigest string, targets ...db.Int
 		// The row records that a pin or an exemption was used, not this one call.
 		audit.ExecutionStatus = "unknown"
 	}
+	for n := range targets {
+		targets[n].RedirectFrom = c.redirectFrom
+	}
 	audit.Targets = targets
 	_, agentName := taskInfoFromCtx(c.ctx)
 	_ = c.i.targets.LogDecision(db.TargetDecision{Scope: c.ref, AgentName: agentName, ToolName: c.tool,
@@ -306,7 +336,8 @@ func (c *targetCheck) pinUsed(ct *checkedTarget, pin *db.TargetPin) {
 }
 
 // blockRule matches the asset block rules against a target: its name, and its
-// addresses. A range is matched as written and by its network address.
+// addresses. A range is matched as written and by its network address. URL
+// rules are not matched here: run matches them once, on the declared URLs.
 func blockRule(rules []db.AssetInterceptRule, ct *checkedTarget) (db.AssetInterceptRule, bool) {
 	var domains []string
 	ips := ct.ips

intercept/target_redirect.go

@@ -0,0 +1,107 @@
+package intercept
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+)
+
+// The HTTP clients the platform owns (WebFetch and the custom http tool)
+// follow redirects. The hook and the rendered-URL gate decide on the URL a call
+// names; a redirect sends the client to a URL nobody checked. RedirectCheck is
+// the redirect policy of those clients: the client asks it before it follows
+// each hop, and the hop goes through the same target decision as the call, on
+// the URL the client is about to request: the asset block rules on that URL and
+// on its target, before any lookup, then exemptions, resolution and pins.
+
+// maxRedirects is the limit net/http applies to a client without a redirect
+// policy. Setting a policy replaces it, so RedirectCheck restates it, with the
+// same error text.
+const maxRedirects = 10
+
+// RedirectCheck returns the redirect policy (http.Client.CheckRedirect) of a
+// platform-owned client run by the tool toolName. Everything it needs comes
+// from the context of the request, which net/http keeps on every hop: the
+// target scope of the session and the Interceptor that owns its gate.
+//
+// With the gate off, or with no scope in the context (the operator's test
+// endpoint), it only applies the limit of 10 hops: nothing is parsed, resolved,
+// read or written, and the client behaves as with the default policy.
+//
+// A hop no pin or exemption covers is not followed, and the policy never waits:
+// the fetch has its own deadline, which a human decision does not fit in. The
+// request row for the hop's target is found or created (it is durable, so an
+// approval given later lets the retried call follow), and the call fails at
+// once with TARGET_APPROVAL_PENDING. A block rule, a failed lookup or a hop
+// whose target cannot be read fails the call with its block code, and opens no
+// request.
+func RedirectCheck(toolName string) func(req *http.Request, via []*http.Request) error {
+	return func(req *http.Request, via []*http.Request) error {
+		if len(via) >= maxRedirects {
+			return errors.New("stopped after 10 redirects")
+		}
+		ctx := req.Context()
+		scope, on := renderedScope(ctx)
+		if !on {
+			return nil
+		}
+		return checkRedirectHop(ctx, scope, toolName, req.URL.String(), via[len(via)-1].URL.String())
+	}
+}
+
+// checkRedirectHop runs the gate decision on one hop, from the URL that
+// redirected (from) to the URL the client will request (hop).
+func checkRedirectHop(ctx context.Context, scope TargetScope, toolName, hop, from string) error {
+	input, _ := json.Marshal(map[string]string{"url": hop, "redirect_from": from})
+	blocked := func(res TargetResult) error {
+		return &redirectError{res: res, from: from, hop: hop, scope: scope.scopeName()}
+	}
+	t, err := urlTarget(hop)
+	if err != nil {
+		return blocked(undeterminedTarget(ctx, scope, toolName, input, "the target of the redirect could not be read ("+err.Error()+")"))
+	}
+	i := scope.Interceptor
+	if i == nil {
+		return blocked(TargetResult{Code: TargetGateUnavailable, Host: t.Host, Port: t.Port, Reason: "the session's target scope carries no gate"})
+	}
+	var origin string
+	if o, err := urlTarget(from); err == nil {
+		origin = o.String()
+	}
+	ctx = WithCall(ctx, toolName, input)
+	c := &targetCheck{i: i, ctx: ctx, scope: scope, tool: toolName, input: input, urls: []string{hop}, redirectFrom: origin}
+	unpinned, res := c.run([]Target{t})
+	if res.Code == "" && len(unpinned) > 0 {
+		// Wait bound 0: the request is found or created, and the call does not wait.
+		scope.WaitBound = 0
+		for n := range unpinned {
+			unpinned[n].RedirectFrom = origin
+		}
+		res = i.RequestTargets(ctx, scope, toolName, input, unpinned, nil)
+	}
+	if res.Code == "" {
+		return nil
+	}
+	return blocked(res)
+}
+
+// redirectError is what the client returns when a hop is not followed. Both
+// tools hand the client error to the model as the tool result.
+type redirectError struct {
+	res              TargetResult
+	from, hop, scope string
+}
+
+func (e *redirectError) Error() string {
+	target := e.hop
+	if e.res.Host != "" {
+		target = targetName(TargetRequest{Host: e.res.Host, Port: e.res.Port})
+	}
+	msg := "[ARTEX platform control, not target defense] " + e.res.Code + ": " + e.from + " redirects to " + target
+	if e.res.Code == TargetApprovalPending {
+		return msg + ", which is not approved for " + e.scope + ". The redirect was not followed and an approval was requested. " +
+			"Retry the same call after the approval. Do not fetch the redirect target directly or with another tool."
+	}
+	return msg + ": " + e.res.Reason + ". The redirect was not followed. Do not fetch the redirect target directly or with another tool."
+}

intercept/target_redirect_pg_test.go

@@ -0,0 +1,95 @@
+package intercept
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Step 1.9 against PostgreSQL: a hop no pin covers opens the durable request
+// and fails the call at once; an approval lets the same call follow.
+
+// A hop to an unpinned target is not followed: the redirect target receives
+// nothing, exactly one request row is opened for it, and the call fails with
+// TARGET_APPROVAL_PENDING without waiting, although the scope would wait five
+// minutes at the hook. The same call again attaches to that row. After the
+// approval it follows.
+func TestRedirectToUnpinnedHostNotFollowed(t *testing.T) {
+	d := targetTestDB(t)
+	ic, res := pgGate(t, d)
+	scope := taskScope(t, d, ic, 5*time.Minute)
+	ctx := WithTargetScope(t.Context(), scope)
+	final, finalHits, finalKey := hopServer(t, "")
+	start, startHits, startKey := hopServer(t, final.URL+"/final")
+
+	began := time.Now()
+	_, err := gatedFetch(ctx, start.URL+"/start")
+	if err == nil || !strings.Contains(err.Error(), TargetApprovalPending) ||
+		!strings.Contains(err.Error(), start.URL+"/start redirects to "+finalKey) || !strings.Contains(err.Error(), "not followed") {
+		t.Fatalf("unpinned hop: %v", err)
+	}
+	if elapsed := time.Since(began); elapsed > 10*time.Second {
+		t.Fatalf("the hop waited %v", elapsed)
+	}
+	if startHits.Load() != 1 || finalHits.Load() != 0 {
+		t.Fatalf("hits start=%d final=%d, want the redirect target untouched", startHits.Load(), finalHits.Load())
+	}
+	ids := openRows(t, d, scope)
+	if len(ids) != 1 || allRows(t, d, scope) != 1 {
+		t.Fatalf("open requests = %v (%d rows), want one", ids, allRows(t, d, scope))
+	}
+	detail, err := d.GetInterceptDetail(ids[0])
+	if err != nil || detail == nil || detail.Audit == nil || len(detail.Audit.Targets) != 1 {
+		t.Fatalf("request detail = %+v, %v", detail, err)
+	}
+	if tgt := detail.Audit.Targets[0]; tgt.Host+":"+strconv.Itoa(tgt.Port) != finalKey || tgt.RedirectFrom != startKey || tgt.Outcome != "requested" {
+		t.Fatalf("requested target = %+v, want %s from %s", tgt, finalKey, startKey)
+	}
+	if !strings.Contains(detail.Reason, "A redirect from "+startKey) || !strings.Contains(string(detail.ToolInput), start.URL+"/start") {
+		t.Fatalf("request reason %q / input %s, want the origin of the redirect", detail.Reason, detail.ToolInput)
+	}
+
+	// The retried call stops at the same hop and attaches to the same row.
+	if _, err := gatedFetch(ctx, start.URL+"/start"); err == nil || !strings.Contains(err.Error(), TargetApprovalPending) || finalHits.Load() != 0 {
+		t.Fatalf("retry before the approval: %v, final hits %d", err, finalHits.Load())
+	}
+	if again := openRows(t, d, scope); len(again) != 1 || again[0] != ids[0] || allRows(t, d, scope) != 1 {
+		t.Fatalf("after the retry: open %v, %d rows; want the same single request", again, allRows(t, d, scope))
+	}
+
+	approveAll(t, d, ic, scope)
+	if resp, err := gatedFetch(ctx, start.URL+"/start"); err != nil || resp.StatusCode != 200 || finalHits.Load() != 1 {
+		t.Fatalf("after the approval: %v, final hits %d", err, finalHits.Load())
+	}
+	if res.total() != 0 {
+		t.Fatalf("%d lookups for IP literals", res.total())
+	}
+}
+
+// http -> https on the same host is another key (port 443, not 80): a pin on
+// (host, 80) does not cover it, and the hop asks again.
+func TestRedirectHTTPToHTTPSAsksAgain(t *testing.T) {
+	d := targetTestDB(t)
+	ic, res := pgGate(t, d)
+	res.set("app.example.com", "203.0.113.7")
+	scope := taskScope(t, d, ic, time.Minute)
+	pinURL(t, d, ic, scope, "http://app.example.com/")
+	ctx := WithTargetScope(t.Context(), scope)
+
+	if err := hop(ctx, "http://app.example.com/next", "http://app.example.com/"); err != nil {
+		t.Fatalf("hop on the pinned key: %v", err)
+	}
+	err := hop(ctx, "https://app.example.com/", "http://app.example.com/")
+	if err == nil || !strings.Contains(err.Error(), TargetApprovalPending) || !strings.Contains(err.Error(), "redirects to app.example.com:443") {
+		t.Fatalf("http -> https: %v", err)
+	}
+	ids := openRows(t, d, scope)
+	if len(ids) != 1 {
+		t.Fatalf("open requests = %v, want the one for port 443", ids)
+	}
+	detail, err := d.GetInterceptDetail(ids[0])
+	if err != nil || detail == nil || detail.Audit == nil || detail.Audit.Targets[0].Port != 443 || detail.Audit.Targets[0].RedirectFrom != "app.example.com:80" {
+		t.Fatalf("request = %+v, %v", detail, err)
+	}
+}

intercept/target_redirect_test.go

@@ -0,0 +1,229 @@
+package intercept
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// Step 1.9: every redirect hop of a platform-owned client goes through the gate.
+// Without a database: a hop that would open a request is covered by the
+// PostgreSQL tests.
+
+// hopServer counts its requests and answers a fixed page, or a redirect to
+// location when it is set.
+func hopServer(t *testing.T, location string) (srv *httptest.Server, hits *atomic.Int64, key string) {
+	t.Helper()
+	hits = &atomic.Int64{}
+	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		if location != "" {
+			http.Redirect(w, r, location, http.StatusFound)
+			return
+		}
+		_, _ = w.Write([]byte("hop-reached"))
+	}))
+	t.Cleanup(srv.Close)
+	u, err := url.Parse(srv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return srv, hits, u.Host
+}
+
+// hop calls the redirect policy of tool on one hop, as the client does.
+func hop(ctx context.Context, to string, from ...string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, to, nil)
+	if err != nil {
+		panic(err)
+	}
+	via := make([]*http.Request, len(from))
+	for n, f := range from {
+		if via[n], err = http.NewRequestWithContext(ctx, http.MethodGet, f, nil); err != nil {
+			panic(err)
+		}
+	}
+	return RedirectCheck("WebFetch")(req, via)
+}
+
+func gatedFetch(ctx context.Context, rawURL string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := (&http.Client{CheckRedirect: RedirectCheck("WebFetch")}).Do(req)
+	if resp != nil {
+		resp.Body.Close()
+	}
+	return resp, err
+}
+
+// With the gate off, or without a scope, the policy is net/http's default:
+// every hop is followed, up to 10, with the same error after that. Nothing is
+// parsed, resolved, read or logged, not even a hop whose target cannot be read.
+func TestRedirectGateOffKeepsDefaultPolicy(t *testing.T) {
+	g := newGate(t)
+	g.res.set("app.example.com", "203.0.113.7")
+	chain := make([]string, maxRedirects)
+	for n := range chain {
+		chain[n] = "http://app.example.com/"
+	}
+	for name, ctx := range map[string]context.Context{
+		"no scope": context.Background(),
+		"no flag":  WithTargetScope(context.Background(), TargetScope{TaskID: "7", WaitBound: time.Minute, Interceptor: g.ic}),
+		"flag off": WithTargetScope(context.Background(), TargetScope{TaskID: "7", Enabled: func() bool { return false }, Interceptor: g.ic}),
+	} {
+		if err := hop(ctx, "https://other.example.com/", chain[:1]...); err != nil {
+			t.Errorf("%s: %v, want the hop followed", name, err)
+		}
+		if err := hop(ctx, "http:///no-host", chain[:1]...); err != nil {
+			t.Errorf("%s, no host: %v, want the hop followed", name, err)
+		}
+		if err := hop(ctx, "https://other.example.com/", chain[:maxRedirects-1]...); err != nil {
+			t.Errorf("%s, hop 9: %v", name, err)
+		}
+		if err := hop(ctx, "https://other.example.com/", chain...); err == nil || err.Error() != "stopped after 10 redirects" {
+			t.Errorf("%s, hop 10: %v, want net/http's limit", name, err)
+		}
+
+		// Through a real client: a hop to another port, which the gate would ask
+		// for, is followed.
+		final, finalHits, _ := hopServer(t, "")
+		start, _, _ := hopServer(t, final.URL+"/final")
+		if resp, err := gatedFetch(ctx, start.URL+"/start"); err != nil || resp.StatusCode != http.StatusOK || finalHits.Load() != 1 {
+			t.Errorf("%s: chain not followed: %v, hits=%d", name, err, finalHits.Load())
+		}
+		loop := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			http.Redirect(w, r, r.URL.Path+"x", http.StatusFound)
+		}))
+		_, gotErr := gatedFetch(ctx, loop.URL+"/l")
+		_, wantErr := (&http.Client{}).Get(loop.URL + "/l")
+		loop.Close()
+		if gotErr == nil || wantErr == nil || gotErr.Error() != wantErr.Error() {
+			t.Errorf("%s: redirect loop: %v, want the default policy's %v", name, gotErr, wantErr)
+		}
+	}
+	if g.store.reads != 0 || len(g.store.logged) != 0 || g.res.total() != 0 {
+		t.Errorf("gate off: %d store reads, %d rows, %d lookups, want none", g.store.reads, len(g.store.logged), g.res.total())
+	}
+	// Gate on, the limit holds as well, before anything is read.
+	if err := hop(g.ctx(), "https://app.example.com/", chain...); err == nil || err.Error() != "stopped after 10 redirects" || g.store.reads != 0 {
+		t.Errorf("gate on, hop 10: %v, %d store reads", err, g.store.reads)
+	}
+}
+
+// A hop to a pinned target is followed, through a real client: the redirected
+// request keeps the context of the call, so the policy finds the scope. The
+// first use of the pin is logged with the origin of the redirect.
+func TestRedirectToPinnedHostFollowed(t *testing.T) {
+	g := newGate(t)
+	final, finalHits, finalKey := hopServer(t, "")
+	start, startHits, startKey := hopServer(t, final.URL+"/final")
+	host, port, _ := net.SplitHostPort(finalKey)
+	pin := &db.TargetPin{ID: 1, Host: host, Port: atoiPort(t, port), Version: 1, Status: db.TargetPinActive, PinnedIPs: []string{host}}
+	g.store.pins = []*db.TargetPin{pin}
+
+	resp, err := gatedFetch(g.ctx(), start.URL+"/start")
+	if err != nil || resp.StatusCode != http.StatusOK || startHits.Load() != 1 || finalHits.Load() != 1 {
+		t.Fatalf("pinned hop: %v, hits start=%d final=%d", err, startHits.Load(), finalHits.Load())
+	}
+	if got := g.store.outcomes(); len(got) != 1 || got[0] != "allowed/pin_match" {
+		t.Fatalf("rows = %v, want the first use of the pin", got)
+	}
+	row := g.store.logged[0]
+	if tgt := row.Audit.Targets[0]; tgt.Host != host || tgt.RedirectFrom != startKey || tgt.PinID != pin.ID {
+		t.Fatalf("logged target = %+v, want %s from %s", tgt, finalKey, startKey)
+	}
+	if !strings.Contains(string(row.ToolInput), final.URL+"/final") || !strings.Contains(string(row.ToolInput), start.URL+"/start") {
+		t.Fatalf("logged input = %s, want the hop and its origin", row.ToolInput)
+	}
+	if g.res.total() != 0 {
+		t.Fatalf("%d lookups for an IP literal", g.res.total())
+	}
+}
+
+// A (host, 0) pin covers every port: http -> https on that host is followed.
+func TestRedirectToPortZeroPinnedHostFollowed(t *testing.T) {
+	g := newGate(t)
+	g.res.set("app.example.com", "203.0.113.7")
+	g.store.pins = []*db.TargetPin{{ID: 1, Host: "app.example.com", Port: 0, Version: 1, Status: db.TargetPinActive, PinnedIPs: []string{"203.0.113.7"}}}
+	if err := hop(g.ctx(), "https://app.example.com/login", "http://app.example.com/login"); err != nil {
+		t.Fatalf("http -> https under a (host, 0) pin: %v", err)
+	}
+}
+
+// A block rule stops a hop before anything is resolved, whether it names the
+// hop's host or its URL, and even when the hop stays on a pinned host. No
+// request is opened.
+func TestRedirectToBlockedNameNotResolved(t *testing.T) {
+	g := newGate(t)
+	g.res.set("app.example.com", "203.0.113.7")
+	g.res.set("evil.example", "198.51.100.9")
+	g.store.pins = []*db.TargetPin{{ID: 1, Host: "app.example.com", Port: 443, Version: 1, Status: db.TargetPinActive, PinnedIPs: []string{"203.0.113.7"}}}
+	g.store.rules = []db.AssetInterceptRule{
+		{Enabled: true, Kind: "exact_domain", Pattern: "evil.example"},
+		{Enabled: true, Kind: "exact_url", Pattern: "https://app.example.com/admin"},
+	}
+
+	err := hop(g.ctx(), "http://evil.example/x", "https://app.example.com/")
+	if err == nil || !strings.Contains(err.Error(), TargetRuleBlocked) || !strings.Contains(err.Error(), "https://app.example.com/ redirects to evil.example:80") {
+		t.Fatalf("hop to a blocked name: %v", err)
+	}
+	if n := g.res.lookups("evil.example"); n != 0 {
+		t.Fatalf("the blocked name was resolved %d times", n)
+	}
+	err = hop(g.ctx(), "https://app.example.com/admin", "https://app.example.com/")
+	if err == nil || !strings.Contains(err.Error(), TargetRuleBlocked) {
+		t.Fatalf("hop to a blocked URL on a pinned host: %v", err)
+	}
+	if got := g.store.outcomes(); len(got) != 2 || got[0] != "denied/rule_blocked" || got[1] != "denied/rule_blocked" {
+		t.Fatalf("rows = %v, want two blocks", got)
+	}
+	if from := g.store.logged[0].Audit.Targets[0].RedirectFrom; from != "app.example.com:443" {
+		t.Fatalf("redirect_from = %q", from)
+	}
+	if g.res.total() != 0 {
+		t.Fatalf("%d lookups, want none", g.res.total())
+	}
+}
+
+// A hop whose target cannot be read is blocked with TARGET_GATE_UNAVAILABLE, as
+// a rendered URL is, and opens no request.
+func TestRedirectUnreadableHopBlocked(t *testing.T) {
+	g := newGate(t)
+	for _, to := range []*url.URL{
+		{Scheme: "http", Path: "/no-host"},
+		{Scheme: "http", Host: "app.example.com:99999", Path: "/"},
+	} {
+		req, _ := http.NewRequestWithContext(g.ctx(), http.MethodGet, "http://placeholder.example/", nil)
+		req.URL = to
+		via, _ := http.NewRequestWithContext(g.ctx(), http.MethodGet, "https://app.example.com/", nil)
+		err := RedirectCheck("WebFetch")(req, []*http.Request{via})
+		if err == nil || !strings.Contains(err.Error(), TargetGateUnavailable) {
+			t.Errorf("%s: %v, want TARGET_GATE_UNAVAILABLE", to, err)
+		}
+	}
+	if got := g.store.outcomes(); len(got) != 2 || got[0] != "denied/gate_unavailable" {
+		t.Fatalf("rows = %v", got)
+	}
+	if g.res.total() != 0 {
+		t.Fatalf("%d lookups, want none", g.res.total())
+	}
+}
+
+func atoiPort(t *testing.T, s string) int {
+	t.Helper()
+	p := validPort(s)
+	if p == 0 {
+		t.Fatalf("port %q", s)
+	}
+	return p
+}

intercept/target_rendered.go

@@ -40,7 +40,7 @@ func GateRenderedURL(ctx context.Context, toolName, rawURL string) TargetResult
 	if err != nil {
 		return undeterminedTarget(ctx, scope, toolName, input, "the target of the rendered URL could not be read ("+err.Error()+")")
 	}
-	return gateRendered(ctx, scope, toolName, input, []Target{t})
+	return gateRendered(ctx, scope, toolName, input, []Target{t}, []string{rawURL})
 }
 
 // GateRenderedCommand is the target gate for the command a custom command tool
@@ -62,7 +62,7 @@ func GateRenderedCommand(ctx context.Context, toolName, command string, readings
 	for _, r := range readings {
 		l.scan(r)
 	}
-	return gateRendered(ctx, scope, toolName, renderedInput("command", command), l.targets)
+	return gateRendered(ctx, scope, toolName, renderedInput("command", command), l.targets, l.urls)
 }
 
 func renderedScope(ctx context.Context) (TargetScope, bool) {
@@ -79,9 +79,10 @@ func renderedInput(field, value string) []byte {
 
 // gateRendered runs the gate decision on the targets of a rendered call, asks
 // for the approval of those no pin covers, and checks again after the
-// decisions. It never merges an ask: the rules and the judge decided at the
-// hook, before the tool ran.
-func gateRendered(ctx context.Context, scope TargetScope, toolName string, input []byte, targets []Target) TargetResult {
+// decisions. urls are the URLs the call renders, for the URL block rules. It
+// never merges an ask: the rules and the judge decided at the hook, before the
+// tool ran.
+func gateRendered(ctx context.Context, scope TargetScope, toolName string, input []byte, targets []Target, urls []string) TargetResult {
 	if len(targets) == 0 {
 		return TargetResult{}
 	}
@@ -95,7 +96,7 @@ func gateRendered(ctx context.Context, scope TargetScope, toolName string, input
 		if !scope.Enabled() {
 			return nil, TargetResult{}
 		}
-		c := &targetCheck{i: i, ctx: ctx, scope: scope, tool: toolName, input: input}
+		c := &targetCheck{i: i, ctx: ctx, scope: scope, tool: toolName, input: input, urls: urls}
 		return c.run(targets)
 	}
 	unpinned, res := check()

intercept/target_request.go

@@ -41,6 +41,9 @@ type TargetRequest struct {
 	Reason      string        // no_pin | new_ip | revoked
 	Pin         *db.TargetPin // the active pin an approval would extend (new_ip); nil otherwise
 	ExemptVoid  bool          // a stored exemption names the target and was void for this call
+	// RedirectFrom is the origin (host:port) of the redirect that leads to the
+	// target; empty when the call names the target itself.
+	RedirectFrom string
 }
 
 // TargetResult is the outcome of RequestTargets. Code is empty when every
@@ -248,6 +251,7 @@ func (i *Interceptor) openTargetRequest(ctx context.Context, ref db.TargetScopeR
 		Host: t.Host, Port: t.Port, Kind: t.Kind,
 		ResolvedIPs: t.ResolvedIPs, Resolver: t.Resolver, ResolvedAt: t.ResolvedAt,
 		Reason: t.Reason, Outcome: "requested", NameOnlyEffective: nameOnly, ExemptVoid: t.ExemptVoid,
+		RedirectFrom: t.RedirectFrom,
 	}
 	if t.Pin != nil {
 		target.PinID, target.PinVersion, target.PinnedIPs = t.Pin.ID, t.Pin.Version, t.Pin.PinnedIPs
@@ -363,6 +367,9 @@ func targetReason(scope TargetScope, t TargetRequest, ask *Decision, nameOnly bo
 		b.WriteString(ask.Message)
 		b.WriteString("\nThis call also names a target that needs approval. ")
 	}
+	if t.RedirectFrom != "" {
+		fmt.Fprintf(&b, "A redirect from %s leads to this target; the redirect was not followed. ", t.RedirectFrom)
+	}
 	name, bound := targetName(t), scope.scopeName()
 	if t.Port == 0 {
 		name += " (port not declared: every port)"

server/customtool.go

@@ -455,6 +455,8 @@ func (s *Server) runHTTPTool(ctx context.Context, key string, execRaw json.RawMe
 		req.Header.Set(k, renderTemplate(v, params, identity))
 	}
 	client := &http.Client{Timeout: timeoutOr(spec.TimeoutMs, 30000)}
+	// Every redirect hop goes through the target gate, as the rendered URL did.
+	client.CheckRedirect = intercept.RedirectCheck(key)
 	if tr := s.httpProxyTransport(spec); tr != nil {
 		client.Transport = tr
 	}

server/customtool_target_gate_test.go

@@ -571,6 +571,49 @@ func TestDenyRuleWinsBeforeRenderedTarget(t *testing.T) {
 	}
 }
 
+// Documents a known limit: script tools stay advisory (D9). A custom script
+// tool's target is in its stored code, which neither the hook nor the tool
+// reads, so in a gated task the call is allowed and the script reaches a target
+// nobody approved: no lookup, no request, no row. This test changes only if
+// that decision changes.
+func TestBypass_CustomScriptToolTargetNotGated(t *testing.T) {
+	if detectPython() == "" {
+		t.Skip("python3 unavailable")
+	}
+	g := newGateServer(t)
+	on := true
+	task := g.newTask(t, db.TaskCreateOptions{TargetGate: &on})
+	res := &countingResolver{answers: map[string][]string{"localhost": {"127.0.0.1"}}}
+	g.m.interceptor.SetResolver(res)
+	_, hits, _, port := countingServer(t)
+
+	code := "import urllib.request\n" +
+		"opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))\n" +
+		"print(opener.open('http://localhost:" + port + "/script', timeout=20).read().decode())\n"
+	tool := g.s.buildCustomTool(&db.Tool{Key: "probe_script", Kind: "script", Exec: execJSON(t, map[string]any{"code": code})})
+	// The gate sees no target in the call: only the parameters reach the hook.
+	if got := intercept.ExtractTargets("probe_script", []byte(`{}`)); len(got) != 0 {
+		t.Fatalf("the hook reads %+v; the test needs a target only the stored code names", got)
+	}
+
+	p := &toolScript{calls: []scriptedCall{{"probe_script", `{}`}}, results: make(chan string, 16)}
+	done := runScriptedWorker(t, g, task, p, tool)
+	if r := p.next(t); !strings.Contains(r, "probe-reached") || strings.Contains(r, "TARGET_") {
+		t.Fatalf("script tool in a gated task: %q, want it allowed and the target reached", r)
+	}
+	select {
+	case <-done:
+	case <-time.After(60 * time.Second):
+		t.Fatal("the worker run did not end")
+	}
+	if hits.Load() != 1 {
+		t.Fatalf("%d requests reached the unapproved target, want 1 (the gap)", hits.Load())
+	}
+	if n, rows := res.lookups(), targetRowCount(t, g.m.pg, task.ID); n != 0 || rows != 0 {
+		t.Fatalf("%d lookups, %d target rows; the gate did see the script's target", n, rows)
+	}
+}
+
 // A task with the gate off (the default) runs as before: a worker's WebFetch
 // and the custom tools reach their targets, and the gate writes no row and
 // resolves no name.

server/target_redirect_test.go

@@ -0,0 +1,162 @@
+package server
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// Step 1.9: the redirect hops of the custom http tool and of a worker's
+// WebFetch go through the target gate.
+
+// redirectingServer answers every request with a redirect to location and
+// counts the requests. Its host:port is an IP literal: the gate never resolves it.
+func redirectingServer(t *testing.T, location string) (srv *httptest.Server, hits *atomic.Int64, key string) {
+	t.Helper()
+	hits = &atomic.Int64{}
+	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		http.Redirect(w, r, location, http.StatusFound)
+	}))
+	t.Cleanup(srv.Close)
+	return srv, hits, srv.Listener.Addr().String()
+}
+
+func decide(t *testing.T, g *gateServer, id int64, decision string) {
+	t.Helper()
+	if code, body := g.do(t, "POST", fmt.Sprintf("/api/intercept/pending/%d/decide", id), `{"decision":"`+decision+`"}`); code != 200 {
+		t.Fatalf("decide %d: %d %v", id, code, body)
+	}
+}
+
+// A custom http tool whose rendered URL is pinned, and which redirects to a
+// target no pin covers: the hop is not followed, one request is opened for its
+// target, and the call fails at once. After the approval the same call follows.
+func TestCustomHTTPRedirectTargetGated(t *testing.T) {
+	g := newGateServer(t)
+	on := true
+	task := g.newTask(t, db.TaskCreateOptions{TargetGate: &on})
+	pg := g.m.pg
+	final, finalHits, fhost, fport := countingServer(t)
+	finalKey := net.JoinHostPort(fhost, fport)
+	start, startHits, startKey := redirectingServer(t, final.URL+"/final")
+
+	tool := g.s.buildCustomTool(&db.Tool{Key: "probe_redirect", Kind: "http",
+		Exec: execJSON(t, map[string]any{"method": "GET", "url": start.URL + "/start"})})
+	// The rendered URL itself first: its request, approved.
+	if out, isErr := callTool(t, tool, gatedCtx(task, 0), `{}`, nil); !isErr || !strings.Contains(out, "TARGET_APPROVAL_PENDING") || startHits.Load() != 0 {
+		t.Fatalf("rendered URL: error=%v out=%q", isErr, out)
+	}
+	id, _, _, ok := openTargetRequest(t, pg, task.ID, startKey)
+	if !ok {
+		t.Fatal("no request for the rendered URL")
+	}
+	decide(t, g, id, "allowed")
+
+	// The wait bound is long: the hop must not use it.
+	began := time.Now()
+	out, isErr := callTool(t, tool, gatedCtx(task, time.Minute), `{}`, nil)
+	if !isErr || !strings.Contains(out, "TARGET_APPROVAL_PENDING") || !strings.Contains(out, start.URL+"/start redirects to "+finalKey) {
+		t.Fatalf("redirect to an unpinned target: error=%v out=%q", isErr, out)
+	}
+	if elapsed := time.Since(began); elapsed > 10*time.Second {
+		t.Fatalf("the hop waited %v", elapsed)
+	}
+	if startHits.Load() != 1 || finalHits.Load() != 0 {
+		t.Fatalf("hits origin=%d target=%d, want the target untouched", startHits.Load(), finalHits.Load())
+	}
+	hopID, toolName, toolInput, ok := openTargetRequest(t, pg, task.ID, finalKey)
+	if !ok || toolName != "probe_redirect" || !strings.Contains(toolInput, final.URL+"/final") || !strings.Contains(toolInput, start.URL+"/start") {
+		t.Fatalf("request for the hop: ok=%v tool=%q input=%s", ok, toolName, toolInput)
+	}
+	var requests int
+	if err := pg.QueryRow(`SELECT count(*) FROM intercept_pending WHERE task_id=$1 AND target_key IS NOT NULL`, task.ID).Scan(&requests); err != nil || requests != 2 {
+		t.Fatalf("%d requests, %v; want the origin's and the hop's", requests, err)
+	}
+
+	decide(t, g, hopID, "allowed")
+	if out, isErr := callTool(t, tool, gatedCtx(task, 0), `{}`, nil); isErr || !strings.Contains(out, "probe-reached") || finalHits.Load() != 1 {
+		t.Fatalf("after the approval: error=%v out=%q target hits=%d", isErr, out, finalHits.Load())
+	}
+}
+
+// The custom-tool test endpoint has no approval scope (D14): its redirects are
+// followed as before, and nothing is written.
+func TestCustomToolTestEndpointRedirectUngated(t *testing.T) {
+	g := newGateServer(t)
+	on := true
+	g.newTask(t, db.TaskCreateOptions{TargetGate: &on})
+	final, finalHits, _, _ := countingServer(t)
+	start, _, _ := redirectingServer(t, final.URL+"/final")
+	count := func() int {
+		var n int
+		if err := g.m.pg.QueryRow(`SELECT count(*) FROM intercept_pending WHERE decision_source='target' OR target_key IS NOT NULL`).Scan(&n); err != nil {
+			t.Fatal(err)
+		}
+		return n
+	}
+	before := count()
+	code, out := g.do(t, "POST", "/api/tools/custom/test", fmt.Sprintf(`{"kind":"http","exec":{"url":%q}}`, start.URL+"/start"))
+	if code != 200 || out["is_error"] != false || !strings.Contains(fmt.Sprint(out["output"]), "probe-reached") || finalHits.Load() != 1 {
+		t.Fatalf("test endpoint: %d %v target hits=%d", code, out, finalHits.Load())
+	}
+	if after := count(); after != before {
+		t.Fatalf("the test endpoint wrote %d target rows", after-before)
+	}
+}
+
+// A gated worker's WebFetch end to end: the origin is approved at the hook, the
+// redirect stops at the hop with TARGET_APPROVAL_PENDING and leaves one request
+// open; once it is approved through the API, the same call follows.
+func TestRedirectRequestSurvivesAndRetryPasses(t *testing.T) {
+	g := newGateServer(t)
+	on := true
+	task := g.newTask(t, db.TaskCreateOptions{TargetGate: &on})
+	pg := g.m.pg
+	final, finalHits, fhost, fport := countingServer(t)
+	finalKey := net.JoinHostPort(fhost, fport)
+	start, startHits, startKey := redirectingServer(t, final.URL+"/final")
+	p := &toolScript{calls: fetches(start.URL+"/start", start.URL+"/start"), results: make(chan string, 16),
+		hold: map[int64]chan struct{}{2: make(chan struct{})}}
+	done := runScriptedWorker(t, g, task, p)
+
+	var id int64
+	waitUntil(t, "the request for the origin", func() bool {
+		var ok bool
+		id, _, _, ok = openTargetRequest(t, pg, task.ID, startKey)
+		return ok
+	})
+	decide(t, g, id, "allowed")
+	if r := p.next(t); !strings.Contains(r, "TARGET_APPROVAL_PENDING") || !strings.Contains(r, "redirects to "+finalKey) {
+		t.Fatalf("first call: %q", r)
+	}
+	if startHits.Load() != 1 || finalHits.Load() != 0 {
+		t.Fatalf("hits origin=%d target=%d, want the target untouched", startHits.Load(), finalHits.Load())
+	}
+	hopID, toolName, _, ok := openTargetRequest(t, pg, task.ID, finalKey)
+	if !ok || toolName != "WebFetch" {
+		t.Fatalf("request for the hop: ok=%v tool=%q", ok, toolName)
+	}
+	detail, err := pg.GetInterceptDetail(hopID)
+	if err != nil || detail == nil || detail.Audit == nil || len(detail.Audit.Targets) != 1 || detail.Audit.Targets[0].RedirectFrom != startKey {
+		t.Fatalf("hop request detail = %+v, %v", detail, err)
+	}
+
+	decide(t, g, hopID, "allowed")
+	close(p.hold[2])
+	if r := p.next(t); !strings.Contains(r, "probe-reached") || finalHits.Load() != 1 {
+		t.Fatalf("the same call after the approval: %q target hits=%d", r, finalHits.Load())
+	}
+	select {
+	case <-done:
+	case <-time.After(60 * time.Second):
+		t.Fatal("the worker run did not end")
+	}
+}