@hamp10/agentforge 0.2.42 → 0.2.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hamp10/agentforge",
-  "version": "0.2.42",
+  "version": "0.2.43",
   "description": "AgentForge worker — connect your machine to agentforge.ai",
   "type": "module",
   "bin": {

package/scripts/check-task-semantics.js

@@ -1064,6 +1064,21 @@ assert.match(
   /isHttpUiReferenceUrl/i,
   'comparable UI visual context should allow same-site non-target reference pages, not only localhost'
 );
+assert.match(
+  openClawSource,
+  /browser verification used a file:\/\/ URL/i,
+  'scoped UI verification should reject file:// after edits because it can bypass local server behavior'
+);
+assert.doesNotMatch(
+  openClawSource,
+  /localhost\/127\.0\.0\.1 or file:\/\//i,
+  'post-edit scoped UI verification should require localhost/127.0.0.1 instead of file://'
+);
+assert.doesNotMatch(
+  openClawSource,
+  /pathToFileURL/i,
+  'auto-verification should not fall back to file:// URLs for edited scoped pages'
+);
 assert.match(
   openClawSource,
   /scopeViolationThisBatch \|\| comparableContextBlockThisBatch\) break/i,

package/src/OpenClawCLI.js

@@ -3,7 +3,6 @@ import { mkdirSync, writeFileSync, readFileSync, existsSync, readdirSync, unlink
 import { EventEmitter } from 'events';
 import { homedir } from 'os';
 import path from 'path';
-import { pathToFileURL } from 'url';
 import { inflateSync } from 'zlib';
 import { resolveOpenclawBin } from './resolveOpenclaw.js';
 import {
@@ -4159,11 +4158,20 @@ export class OpenClawCLI extends EventEmitter {
           summary.text ? `Visible text:\n${summary.text}` : '',
         ].filter(Boolean).join('\n');
       }
-      const isLocalVerificationUrl = /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$)|file:)/i.test(summaryUrl || requestedUrl || '');
+      const isFileVerificationUrl = /^file:/i.test(summaryUrl || requestedUrl || '');
+      const isLocalVerificationUrl = /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$))/i.test(summaryUrl || requestedUrl || '');
+      if (options?.afterMutation && isScopedBrowserTarget && isFileVerificationUrl) {
+        return [
+          `Visual warning: browser verification used a file:// URL (${summaryUrl || requestedUrl || '(current tab)'}) after local file edits.`,
+          'File URLs can skip the project server, component includes, routing, assets, and browser permissions that real users get. Start or use the local dev/static server and verify the changed target screen on localhost or 127.0.0.1.',
+          `URL: ${summary.url || requestedUrl || '(current tab)'}`,
+          summary.text ? `Visible text:\n${summary.text}` : '',
+        ].filter(Boolean).join('\n');
+      }
       if (options?.afterMutation && isScopedBrowserTarget && !isLocalVerificationUrl) {
         return [
           `Visual warning: browser verification used a remote URL (${summaryUrl || requestedUrl || '(current tab)'}) after local file edits.`,
-          'Remote pages do not prove the edited local files render correctly before commit/push. Start or use the local preview server and verify the changed target screen on localhost, 127.0.0.1, or file://.',
+          'Remote pages do not prove the edited local files render correctly before commit/push. Start or use the local preview server and verify the changed target screen on localhost or 127.0.0.1.',
           `URL: ${summary.url || requestedUrl || '(current tab)'}`,
           summary.text ? `Visible text:\n${summary.text}` : '',
         ].filter(Boolean).join('\n');
@@ -4940,7 +4948,7 @@ export class OpenClawCLI extends EventEmitter {
       }
     };
     const isLocalUiUrl = (url) =>
-      /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$)|file:)/i.test(String(url || ''));
+      /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$))/i.test(String(url || ''));
     const isHttpUiReferenceUrl = (url) => {
       try {
         const parsed = new URL(String(url || ''));
@@ -5021,7 +5029,7 @@ export class OpenClawCLI extends EventEmitter {
       const inferredText = inferred.length > 0
         ? ` Suggested local target URL(s): ${inferred.map(item => `${item.slug} -> ${item.url}`).join('; ')}.`
         : '';
-      return `Missing clean local browser verification for edited scoped target(s): ${missing.join(', ')}. Each edited scoped page must be opened on localhost/127.0.0.1 or file:// after its latest edit.${inferredText} Do not use a site index, listing index, shared style file, or reference page as final verification for a scoped page edit.`;
+      return `Missing clean local browser verification for edited scoped target(s): ${missing.join(', ')}. Each edited scoped page must be opened on localhost/127.0.0.1 after its latest edit.${inferredText} Do not use a site index, listing index, shared style file, or reference page as final verification for a scoped page edit.`;
     };
     const inferLocalUrlForScope = (slug) => {
       if (directLocalUrlsByScope.has(slug)) return directLocalUrlsByScope.get(slug);
@@ -5032,10 +5040,6 @@ export class OpenClawCLI extends EventEmitter {
           }
         }
       }
-      const mutationFile = directScopeLastMutationFiles.get(slug);
-      if (mutationFile && this._isDirectPageSourcePath(mutationFile) && existsSync(mutationFile)) {
-        return pathToFileURL(mutationFile).href;
-      }
       return '';
     };
     const autoVerifyMissingScopedTargets = async () => {
@@ -5098,7 +5102,7 @@ export class OpenClawCLI extends EventEmitter {
       if (!urlText) return false;
       const { slugs } = this._extractDirectExplicitScope(semanticTask);
       if (slugs.length > 0 && scopeSlugsMatchingText(urlText, slugs).length === 0) return false;
-      return /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$)|file:)/i.test(urlText);
+      return /^(?:https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])(?::\d+)?(?:\/|$))/i.test(urlText);
     };
     const extractVisualWarning = (result) => {
       const warnings = String(result || '')