Bug type

Bug

Summary

Remote media fetched from an HTTP URL can surface a percent-encoded URL path basename as the filename when there is no Content-Disposition filename or caller filePathHint.

For example, a URL like:

https://example.com/files/My%20Report.pdf

is exposed as:

My%20Report.pdf

instead of:

My Report.pdf

Steps to reproduce

On current main, the URL fallback in src/media/fetch.ts parses finalUrl, reads parsed.pathname, and passes that pathname directly to basenameFromAnyPath.

URL.pathname preserves percent escapes, so the fallback filename remains encoded:

new URL("https://example.com/files/My%20Report.pdf").pathname

returns /files/My%20Report.pdf, and the saved/read media filename becomes My%20Report.pdf.

Expected behavior

The URL path basename fallback should decode valid percent escapes before exposing the filename, so ordinary URL-safe filenames such as My%20Report.pdf become My Report.pdf.

Actual behavior

The raw encoded path basename is exposed as the media filename.

Impact

Agents and chat integrations that rely on OpenClaw's remote media filename fallback can show or forward URL-encoded filenames to users. This is visible whenever the remote response lacks a filename-bearing Content-Disposition header and the caller does not provide a filename hint.

Duplicate check

I searched current open issues and PRs for:

• remote media filename
• remote URL filename
• URL filename percent encoded
• percent-encoded filename
• src/media/fetch.ts filename

I found related closed Feishu/local-file filename issues such as #44988, #43840, and #31179, plus closed Feishu PRs such as #43916, #43860, and #43983. Those cover Feishu upload/download/local-file filename handling; I did not find an open issue or PR for the generic remote media URL fallback in src/media/fetch.ts.