fix(security): strip punctuation before slashes in URL normalization

_normalize_url() was stripping "/" then ".,;:", so a captured URL like
"https://x.com/." normalized to "https://x.com/" instead of
"https://x.com", causing grounded URLs to be flagged as hallucinated.
Reversed the order: strip punctuation first, then trailing slashes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agent_bench/security/output_validator.py

@@ -62,8 +62,8 @@ class OutputValidator:
 
     @staticmethod
     def _normalize_url(url: str) -> str:
-        """Strip trailing slashes and punctuation for comparison."""
-        return url.rstrip("/").rstrip(".,;:")
+        """Strip trailing punctuation then trailing slashes for comparison."""
+        return url.rstrip(".,;:").rstrip("/")
 
     def _check_urls(self, output: str, retrieved_chunks: list[str]) -> list[str]:
         url_pattern = re.compile(r"https?://[^\s\)\"'>]+")

tests/test_output_validator.py

@@ -73,6 +73,15 @@ class TestURLValidation:
         assert verdict.passed is True
         assert verdict.violations == []
 
+    def test_trailing_slash_with_sentence_punctuation(self, validator):
+        """Chunk URL followed by period: 'https://x.com/.' must match 'https://x.com/'."""
+        chunks = ["Visit https://fastapi.tiangolo.com/."]
+        verdict = validator.validate(
+            output="See https://fastapi.tiangolo.com/ for details.",
+            retrieved_chunks=chunks,
+        )
+        assert verdict.passed is True
+
     def test_trailing_slash_normalization_reverse(self, validator):
         """Chunk without slash, output with slash."""
         chunks = ["Visit https://fastapi.tiangolo.com for docs."]