From 3832393555b569a85acb2d5176adc89f22a57288 Mon Sep 17 00:00:00 2001
From: sunkinux <sunkinux@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:31:07 +0800
Subject: [PATCH] fix(web-fetch): allow RFC 2544 benchmark range for fake-ip
 proxy compatibility

When using proxy software with fake-ip mode (like Clash), DNS resolves
to 198.18.0.0/15 range which is blocked by SSRF guard. This adds
allowRfc2544BenchmarkRange policy to web_fetch to support these users.
---
 src/agents/tools/web-fetch.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/agents/tools/web-fetch.ts b/src/agents/tools/web-fetch.ts
index 4ac7a1d7bfd..35d1ef6e471 100644
--- a/src/agents/tools/web-fetch.ts
+++ b/src/agents/tools/web-fetch.ts
@@ -527,6 +527,9 @@ async function runWebFetch(params: WebFetchRuntimeParams): Promise<Record<string
       url: params.url,
       maxRedirects: params.maxRedirects,
       timeoutSeconds: params.timeoutSeconds,
+      policy: {
+        allowRfc2544BenchmarkRange: true,
+      },
       init: {
         headers: {
           Accept: "text/markdown, text/html;q=0.9, */*;q=0.1",