refactor(think): share the private-host policy with agents/webfetch

[ben-reitz]

Summary

One SSRF list instead of two. Think's fetch_url drops its own isBlockedHost/isBlockedIpv4/isBlockedIpv6 and uses the policy from #2526, at the request and at every redirect hop. No new tool for Think in this stack.

 packages/think/src/tools/fetch.ts
-  isBlockedHost / isBlockedIpv4 / isBlockedIpv6      # ~60 lines, its own ranges
+  import { isPrivateOrLocalHost } from "agents/webfetch"
   fetchUrl(url)
-    if isBlockedHost(url.hostname) → disallowed_url
+    if isPrivateOrLocalHost(url.hostname) → disallowed_url
   onRedirect(next)
-    if isBlockedHost(next.hostname) → disallowed_redirect
+    if isPrivateOrLocalHost(next.hostname) → disallowed_redirect

fetch_url keeps every block it had and gains 192.0.0/24, 198.18/15, multicast, 240/4, ::/96, NAT64, 6to4, fec0::/10, ff00::/8 (none routable from Workers). Because Think now imports from agents/webfetch, the agents peer floor rises >=0.25.0 → >=0.28.0, the first release with that entry point (same move as 6c8f85a for websearch).

Evidence

• Before: two hand-maintained range lists that already disagreed (agents blocked .local and 6to4, Think rejected all-digit hosts).
  After: packages/think/src/tests/fetch-tools.test.ts → 51 passed with no test changes: every blocked-host case (localhost, 127.0.0.1, 10.x, 169.254.169.254, [::1], [::ffff:…], redirect to a private host) still blocks. typecheck → 132 projects.

Merge Danger

Door: two-way

Blast Radius: small

Peer-dep floor bump: users on agents 0.25–0.27 get a peer warning when they upgrade @cloudflare/think. fetch_url blocks a few more reserved ranges than before.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 31c7348

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[agent-think]

✅ agents import sizes: no significant changes (64eac888 → 31c7348c, workflow run)

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@2521

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@2521

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@2521

hono-agents

npm i https://pkg.pr.new/hono-agents@2521

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@2521

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@2521

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@2521

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@2521

commit: 31c7348