PR #71464: fix(control-ui): always blobify relative avatar URLs in refreshChatAvatar

• Repository: openclaw/openclaw
• Author: blaspat
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71464

Description (problem / solution / changelog)

Fixes openclaw/openclaw#71422

Problem

After upgrading to OpenClaw 2026.4.23, the configured assistant avatar renders as the default favicon.svg instead of the custom image in the Control UI chat view.

Root cause

Commit 2ce16e558e (which added auth requirements for avatar routes) introduced a condition in refreshChatAvatar:

if (!authHeader || !isLocalControlUiAvatarUrl(avatarUrl)) {
  setChatAvatarUrl(host, avatarUrl);
  return;
}

The !authHeader || guard caused relative avatar URLs (e.g. /avatar/main) to be set directly as chatAvatarUrl when no auth token was present, bypassing blob conversion. Relative URLs must always be fetched with auth and converted to blob URLs because the browser cannot attach the Authorization header to a direct <img src> request.

Fix

Remove the !authHeader || guard so only non-relative (external) URLs bypass blob conversion:

if (!isLocalControlUiAvatarUrl(avatarUrl)) {
  setChatAvatarUrl(host, avatarUrl);
  return;
}
// Always fetch + blobify relative URLs

The fetch call already handles null authHeader gracefully (passes undefined as headers).

Test update

The test that expected the broken behavior (chatAvatarUrl = '/avatar/main' raw) is updated to properly mock the avatar fetch and expect a blob URL.

Before — configured avatar renders as favicon.svg After — configured avatar renders correctly as blob URL

Changed files

• ui/src/ui/app-chat.test.ts (modified, +92/-5)
• ui/src/ui/app-chat.ts (modified, +2/-2)

PR #71512: fix(control-ui): fetch protected avatar route with device token and use blob URL

• Repository: openclaw/openclaw
• Author: suboss87
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71512

Description (problem / solution / changelog)

Fixes #71422.

Root cause: Commit 2ce16e558e (fix #69775) added auth to the /avatar/* route. The refreshChatAvatar function fetches avatar/{agentId}?meta=1 (unauthenticated, still public) which returns {"avatarUrl": "/avatar/main"}, then stored that relative path in chatAvatarUrl. The chat renderer set that path directly as <img src="/avatar/main"> — which the browser cannot fetch without an Authorization header, so the image silently fails.

Fix: After resolving the avatarUrl from the meta endpoint, if the path is relative (not http/data URL) and a device token is available, fetch the image with Authorization: Bearer <deviceToken> and store a blob: URL instead. The browser can render blob URLs without HTTP auth headers.

Behavior preserved:

• External http/data avatar URLs: used directly (unchanged)
• No device token (pre-auth state): path stored as-is (existing test passes)
• Device token present: image fetched with auth, blob URL stored (new test)

Tests: 3 pass (app-chat.test.ts), including a new case verifying the authenticated fetch and blob URL path.

Changed files

• .gitignore (modified, +1/-0)
• tasks/contributor-status.md (added, +61/-0)
• tasks/evening-report.md (added, +90/-0)
• tasks/midday-check.md (added, +38/-0)
• tasks/pr-monitor-report.md (added, +138/-0)
• ui/src/ui/app-chat.test.ts (modified, +29/-0)
• ui/src/ui/app-chat.ts (modified, +26/-1)

PR #71518: fix: render authenticated control ui avatars

• Repository: openclaw/openclaw
• Author: steipete
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/71518

Description (problem / solution / changelog)

Replacement maintainer rewrite for #71464 and #71512.

Fixes #71422.

Summary:

• fetch route-relative Control UI avatar images into managed blob URLs even when no auth header is available
• keep existing blob URL revocation/stale-response guards
• allow locally generated avatar blobs in the Control UI CSP without allowing remote http(s) images
• update Control UI CSP docs and regression coverage

Validation:

• pnpm test ui/src/ui/app-chat.test.ts ui/src/ui/chat/grouped-render.test.ts ui/src/ui/views/agents-utils.test.ts src/gateway/control-ui-csp.test.ts
• pnpm tsgo:prod
• pnpm check:docs
• pnpm check:changed

Changed files

• CHANGELOG.md (modified, +1/-0)
• docs/web/control-ui.md (modified, +3/-2)
• src/gateway/control-ui-csp.test.ts (modified, +3/-3)
• src/gateway/control-ui-csp.ts (modified, +1/-1)
• ui/src/ui/app-chat.test.ts (modified, +57/-5)
• ui/src/ui/app-chat.ts (modified, +2/-2)