What
The WebFetch tool's permission check is now a standalone checkPermissions function rather than being computed inline once. When a fetch is redirected or denied for provenance reasons, the retry flow can now call checkPermissions again against the new URL (via precheck/ask callbacks) before asking the user for permission a second time.
Why
This lets WebFetch re-evaluate permission for the actual destination URL after a redirect, rather than only checking the originally requested URL.