fix(media): normalizeMediaSource should handle uppercase FILE:// URI schemes by xydt-lcy · Pull Request #103490 · openclaw/openclaw

xydt-lcy · 2026-07-10T06:46:08Z

What Problem This Solves

MEDIA: directives using an uppercase FILE:// URI scheme are left in assistant text instead of being extracted as local media attachments. Uppercase unquoted file URIs containing spaces can also be split and truncated instead of being reassembled as one attachment path. Per RFC 3986, URI schemes are case-insensitive, so MEDIA:FILE:///tmp/generated.png should behave like MEDIA:file:///tmp/generated.png.

Issue: #103473

Why This Change Was Made

The outbound parser used separate case-sensitive checks for prefix removal and spaced-path recovery. It now uses one anchored, case-insensitive file-URL predicate for both decisions, keeping the behavior local to the canonical parser and leaving downstream media access policy unchanged.

User Impact

Assistant or tool output using non-lowercase file URI schemes now delivers the intended local attachment without exposing the raw directive or truncating paths containing spaces. Lowercase behavior and existing safety rejection remain unchanged.

Evidence

Exact head 73f5b3a2319fbc47dd1e756dace7acd55c945789; patch-identical rebase of the validated head onto current main.
Sanitized AWS run run_621c85721cd0 on the patch-identical pre-rebase head: pnpm test src/media/parse.test.ts, 61/61 passed.
Same run: fresh uppercase/lowercase, plain/spaced PNG fixtures all parsed to the complete path and staged byte-for-byte through the production outbound media path; unsupported-scheme and traversal controls stayed unattached.
Matched base run run_e6e856990bca at 2d54be31ba68edb070732dc3d0511afb7c5ad32d: both uppercase cases reproduced red while lowercase and safety controls passed.
Fresh autoreview found the original spaced-uppercase gap; after the maintainer follow-up, a second fresh review reported no findings (0.98 correctness confidence).
Targeted oxfmt --check and git diff --check passed.

clawsweeper · 2026-07-10T11:07:18Z

Codex review: needs real behavior proof before merge. Reviewed July 10, 2026, 7:05 AM ET / 11:05 UTC.

Summary
The PR makes normalizeMediaSource strip file:// case-insensitively and adds uppercase and lowercase media-parser regression cases.

PR surface: Source 0, Tests +2. Total +2 across 2 files.

Reproducibility: yes. from source inspection: uppercase FILE:// survives current main's lowercase-only normalizer and is then rejected by the production media parser. This review did not execute contributor code, so the status is source-reproducible rather than reproduced.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #103473
Summary: This PR is the direct candidate fix for the linked canonical bug report.

Members:

canonical: [Bug]: Uppercase file URI media directives are not extracted #103473 - It documents the same uppercase file-URI failure, source cause, focused reproduction, and expected extracted path.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Attach redacted terminal or copied live output showing the fixed checkout extracts MEDIA:FILE:///tmp/generated.png as /tmp/generated.png.
Refresh the branch against current main before exact-head merge review.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR reports unit tests and an asserted function result but includes no attached redacted terminal or live after-fix output from a real checkout; private information such as paths, endpoints, IPs, and credentials should be redacted. Updating the PR body with proof should trigger a fresh review, otherwise a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] The external PR provides only test-based evidence, not attached after-fix output from a real checkout.
[P1] The branch is behind current main, so final review should be repeated on the refreshed exact head.

Maintainer options:

Decide the mitigation before merge
Refresh the branch against current main, retain the centralized case-insensitive prefix normalization and focused regression coverage, then merge after redacted real-checkout parser output confirms the corrected attachment extraction.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No automated code repair is needed; the remaining merge actions are contributor proof and exact-head refresh.

Security
Cleared: The string-normalization and test-only diff introduces no concrete security or supply-chain concern.

Review details

Best possible solution:

Refresh the branch against current main, retain the centralized case-insensitive prefix normalization and focused regression coverage, then merge after redacted real-checkout parser output confirms the corrected attachment extraction.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: uppercase FILE:// survives current main's lowercase-only normalizer and is then rejected by the production media parser. This review did not execute contributor code, so the status is source-reproducible rather than reproduced.

Is this the best way to solve the issue?

Yes. Updating the existing shared pre-validation normalizer is the narrowest maintainable solution and avoids duplicating scheme-case handling across media-directive and Markdown-image callers.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against dff4c634f1a5.

Label changes

Label changes:

add P2: This fixes deterministic but narrowly triggered, user-visible suppression of a local media attachment.
add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR reports unit tests and an asserted function result but includes no attached redacted terminal or live after-fix output from a real checkout; private information such as paths, endpoints, IPs, and credentials should be redacted. Updating the PR body with proof should trigger a fresh review, otherwise a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

P2: This fixes deterministic but narrowly triggered, user-visible suppression of a local media attachment.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR reports unit tests and an asserted function result but includes no attached redacted terminal or live after-fix output from a real checkout; private information such as paths, endpoints, IPs, and credentials should be redacted. Updating the PR body with proof should trigger a fresh review, otherwise a maintainer can comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source 0, Tests +2. Total +2 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	1	1	0
Tests	1	2	0	+2
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	3	1	+2

What I checked:

Current-main behavior: Current main still strips only a lowercase file:// prefix, so an uppercase scheme remains unchanged. (src/media/parse.ts:37, dff4c634f1a5)
Production failure path: Media directive candidates pass through normalizeMediaSource before validation; an unnormalized uppercase scheme is rejected as a URI scheme rather than accepted as a local path. (src/media/parse.ts:593, dff4c634f1a5)
Focused branch change: The branch changes only the shared normalization expression and adds two table-driven parser cases, with no unrelated churn. (src/media/parse.ts:37, 339b893a378e)
URI contract: RFC 3986 states that implementations should accept uppercase scheme letters as equivalent to lowercase, directly supporting case-insensitive recognition.
Feature provenance: Commit 072998a introduced the shared MEDIA parser and its lowercase-only file-URI normalizer; commit e0c1960 later expanded local-path behavior in the same owner module. (src/media/parse.ts:37, 072998a6ab72)
Recent parser refactor: Pull request feat(ui): render assistant directives and add embed tag #64104 added ordered media segments and preserved the same centralized normalization seam. (src/media/parse.ts:19, cc5c691f0069)

Likely related people:

steipete: Introduced the shared MEDIA parser and later expanded its local-path behavior and regression coverage. (role: feature introducer and subsequent area contributor; confidence: high; commits: 072998a6ab72, e0c19607b7e1; files: src/media/parse.ts, src/media/parse.test.ts)
Takhoffman: Authored the recent assistant-directive and ordered-media-segment refactor that substantially changed the same parser module while retaining its normalization boundary. (role: recent major refactor contributor; confidence: high; commits: cc5c691f0069; files: src/media/parse.ts, src/media/parse.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

URI schemes are case-insensitive per RFC 3986. normalizeMediaSource only matched lowercase 'file://', so MEDIA:FILE:///tmp/generated.png was left in assistant text instead of being extracted as a local media attachment. Replaced startsWith + replace with a case-insensitive regex to handle FILE://, file://, and any mixed-case variant. Fixes openclaw#103473 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

steipete · 2026-07-10T15:42:43Z

Land-ready at exact head 73f5b3a2319fbc47dd1e756dace7acd55c945789.

Maintainer follow-up after fresh autoreview:

Reused one anchored case-insensitive file-URL predicate for both normalization and unquoted spaced-path recovery (src/media/parse.ts:36-40, src/media/parse.ts:606-608).
Added uppercase/lowercase plain and spaced-path regressions (src/media/parse.test.ts:69-72).
Final exact-head autoreview: no findings, correctness confidence 0.98.

Proof:

Sanitized AWS run_621c85721cd0 on the patch-identical pre-rebase head: pnpm test src/media/parse.test.ts, 61/61 passed.
Same run exercised production outbound normalization and attachment staging with fresh uppercase/lowercase plain/spaced PNGs; complete paths and bytes matched. Unsupported-scheme and traversal controls stayed unattached.
Matched base run_e6e856990bca: both uppercase cases reproduced red; lowercase and safety controls passed.
Independent source-blind behavior contract validation: all five clauses and anti-cheat checks passed.
Targeted oxfmt --check and git diff --check passed.
Repo-native prepare verified hosted exact/recent-rebase gates for final head at 2026-07-10 15:42 UTC.

Known proof gaps: none for the touched parser and outbound staging path.

steipete · 2026-07-10T15:43:05Z

Merged via squash.

Prepared head SHA: 73f5b3a2319fbc47dd1e756dace7acd55c945789
Landed commit: e0df20b0b39e636daf8eb1ae119d639b5de09bda

…schemes (openclaw#103490) * fix: normalizeMediaSource should handle uppercase FILE:// URI schemes URI schemes are case-insensitive per RFC 3986. normalizeMediaSource only matched lowercase 'file://', so MEDIA:FILE:///tmp/generated.png was left in assistant text instead of being extracted as a local media attachment. Replaced startsWith + replace with a case-insensitive regex to handle FILE://, file://, and any mixed-case variant. Fixes openclaw#103473 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * fix(media): handle spaced uppercase file URLs --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added the size: XS label Jul 10, 2026

xydt-lcy force-pushed the fix/103473-uppercase-file-uri branch from 01418ba to 339b893 Compare July 10, 2026 07:08

clawsweeper Bot mentioned this pull request Jul 10, 2026

[Bug]: Uppercase file URI media directives are not extracted #103473

Closed

This was referenced Jul 10, 2026

fix(media): normalize uppercase FILE:// URI schemes in media directives #103539

Closed

fix(media): normalize case-insensitive file:// URI schemes in MEDIA directives (#103473) #103584

Closed

steipete self-assigned this Jul 10, 2026

steipete force-pushed the fix/103473-uppercase-file-uri branch 2 times, most recently from 18f871a to 1cc86bb Compare July 10, 2026 15:28

xydt-lcy and others added 2 commits July 10, 2026 16:39

fix(media): handle spaced uppercase file URLs

73f5b3a

steipete force-pushed the fix/103473-uppercase-file-uri branch from 1cc86bb to 73f5b3a Compare July 10, 2026 15:39

steipete merged commit e0df20b into openclaw:main Jul 10, 2026
102 checks passed

github-actions Bot mentioned this pull request Jul 10, 2026

📡 Upstream Digest — 2026-07-10 17:41 UTC curtismercier/openclaw-mods#1252

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(media): normalizeMediaSource should handle uppercase FILE:// URI schemes#103490

fix(media): normalizeMediaSource should handle uppercase FILE:// URI schemes#103490
steipete merged 2 commits into
openclaw:mainfrom
xydt-lcy:fix/103473-uppercase-file-uri

xydt-lcy commented Jul 10, 2026 •

edited by steipete

Loading

Uh oh!

clawsweeper Bot commented Jul 10, 2026

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

xydt-lcy commented Jul 10, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 10, 2026

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

xydt-lcy commented Jul 10, 2026 •

edited by steipete

Loading