fix: repair URL authority whitespace before web fetches

Port from openclaw/openclaw#91950: normalize LLM-generated URLs like 'https:// docs.example' before web tool safety checks while preserving path and query encoding semantics.

tests/tools/test_url_safety.py

@@ -42,6 +42,24 @@ class TestNormalizeUrlForRequest:
             == "https://xn--mnich-kva.example/K%C3%B6ln"
         )
 
+    def test_repairs_space_between_scheme_and_authority(self):
+        assert (
+            normalize_url_for_request("https:// docs.openclaw.ai")
+            == "https://docs.openclaw.ai"
+        )
+
+    def test_repairs_tab_between_scheme_and_authority(self):
+        assert (
+            normalize_url_for_request("https://	docs.openclaw.ai/path")
+            == "https://docs.openclaw.ai/path"
+        )
+
+    def test_trims_but_preserves_path_and_query_space_semantics(self):
+        assert (
+            normalize_url_for_request(" https://example.com/a b?q=c d ")
+            == "https://example.com/a%20b?q=c%20d"
+        )
+
 
 class TestIsSafeUrl:
     def test_public_url_allowed(self):

tools/url_safety.py

@@ -28,6 +28,7 @@ import logging
 import os
 import socket
 import asyncio
+import re
 from urllib.parse import quote, urlparse, urlsplit, urlunsplit
 
 from utils import is_truthy_value
@@ -51,6 +52,13 @@ def normalize_url_for_request(url: str) -> str:
     if not raw:
         return raw
 
+    # Models sometimes emit otherwise valid URLs with whitespace between the
+    # scheme separator and authority (``https:// docs.example``). That position
+    # is never meaningful in HTTP(S) URLs, and repairing it before parsing keeps
+    # web tools from failing on a formatting artifact while leaving path/query
+    # whitespace to the normal percent-encoding path below.
+    raw = re.sub(r"://\s+", "://", raw)
+
     try:
         parsed = urlsplit(raw)
     except ValueError: