openclaw - 💡(How to fix) Fix Chrome localhost IME input broken after 5.27 security hardening (Chinese/Korean/Japanese text cannot be entered in webchat console)

Problem

After upgrading to OpenClaw 5.27 (and persisting in 5.28), Chinese/Korean/Japanese IME text input is broken in the webchat console when accessing via http://127.0.0.1:18789. Characters cannot be composed via IME — only direct ASCII input works.

Environment

• OpenClaw: 5.27 / 5.28
• Browser: Chrome (latest)
• OS: Windows with WSL2
• Access URL: http://127.0.0.1:18789

Steps to Reproduce

1. Upgrade to OpenClaw 5.27 or later
2. Open Chrome and access webchat at http://127.0.0.1:18789
3. Try to type Chinese text using system IME (e.g., Pinyin input for Chinese, Hangul for Korean, Hiragana for Japanese)
4. IME composition does not appear in the input field — only direct keystrokes register

Expected Behavior

IME text composition should work normally, as it did in OpenClaw 5.26.

Root Cause (speculative)

OpenClaw 5.27 introduced stronger security and content boundaries. One of these changes may have affected how Chrome treats the 127.0.0.1 origin — specifically, Chrome may now more strictly enforce the "secure context" requirement for APIs that IME depends on (such as beforeinput / input events with composed text).

Workaround

Using the WSL2 host IP address instead of 127.0.0.1 works around the issue:

# Get WSL2 host IP
grep -m1 "nameserver" /etc/resolv.conf
# Access via WSL IP instead of 127.0.0.1

This suggests the issue is specifically tied to how Chrome handles localhost / 127.0.0.1 as an origin after the 5.27 security changes, not a general connectivity problem.

Impact

Any user relying on CJK (Chinese, Korean, Japanese) IME input in the webchat console is affected. This is a significant regression for non-Latin script users.

Suggested Fix Direction

• Investigate whether the 5.27 security hardening changed the origin or CSP headers in a way that breaks IME composition on localhost
• Consider binding Gateway with --bind lan or adding a note in docs about WSL IP access for IME users
• Alternatively, ensure the webchat origin is recognized as a secure context for IME purposes