Description

When opening the Control UI (http://127.0.0.1:18789/) in Chrome, the DevTools console shows repeated Content Security Policy violations:

Content Security Policy of your site blocks the use of 'eval' in JavaScript
Affected: index-BS51oJri.js:182
Directive: script-src
Status: blocked

Additionally, a 401 Unauthorized error appears for /__openclaw/control-ui-config.json on initial page load.

Reproduction

1. Open Control UI at http://127.0.0.1:18789/
2. Open Chrome DevTools → Console / Issues panel
3. Observe CSP eval violations and 401 config fetch error

Occurs in both normal and incognito windows. Not caused by browser extensions.

Root Cause

CSP eval() violation

The Gateway sends this CSP header for Control UI:

Content-Security-Policy: default-src 'self'; base-uri 'none'; object-src 'none'; 
frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; ...

The script-src 'self' directive (without 'unsafe-eval') blocks new Function() calls.

However, the bundled JS (index-BS51oJri.js) contains Zod's JIT compilation code that uses the Function constructor:

// From the bundled JS:
compile() {
    let e = Function, 
        t = this?.args, 
        n = [...(this?.content ?? [""]).map(e => `  ${e}`)]; 
    return new e(...t, n.join("\n"))
}

This is Zod compiling dynamic validation code via new Function() which CSP's script-src treats identically to eval().

401 control-ui-config.json

The JS fires the config fetch in connectedCallback (before WebSocket auth is established), causing a 401 on initial load. The token hasn't been passed as a Bearer header yet.

Environment

• OpenClaw: 2026.5.4 (325df3e)
• OS: macOS 26.4.1 (arm64)
• Browser: Chrome
• Gateway: loopback (127.0.0.1:18789)
• Auth mode: token

Suggested Fix

1. CSP: Either add 'unsafe-eval' to the script-src directive, or configure Zod to disable JIT compilation (e.g., zod.jitless = true or equivalent). The latter is preferred for security.

2. 401 config fetch: Move the /__openclaw/control-ui-config.json fetch to after WebSocket connection/auth is established, or have the JS gracefully retry with proper auth headers.

Impact

• The Zod JIT compilation failure may cause validators to fall back to slower non-JIT paths. Functional impact unknown but potential edge-case breakage.
• The 401 is cosmetic and self-resolves after page load.