PR #78543: fix(gateway): allow tweakcn.com in Control UI CSP connect-src

• Repository: openclaw/openclaw
• Author: AzaelMew
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/78543

Description (problem / solution / changelog)

Summary

The Control UI fetches https://tweakcn.com/r/themes/<id> directly from the browser when importing custom themes, but the served CSP did not include that origin in connect-src. This aligns the CSP with the approved direct-fetch design documented in the tweakcn custom-theme import spec.

Changes

• Added https://tweakcn.com to the connect-src directive in buildControlUiCspHeader()
• Updated control-ui-csp.test.ts to expect the new origin in the CSP allowlist
• Added changelog entry under Unreleased

Testing

• pnpm test src/gateway/control-ui-csp.test.ts — CSP unit test updated to assert the new origin is present
• pnpm test src/gateway/control-ui.http.test.ts — HTTP handler test passes (no CSP assertion changes needed)

Real behavior proof

Screen recording demonstrating the fix:

The video shows a local Control UI session where a tweakcn share link is imported via Appearance → Custom Theme → Import from tweakcn. Before the fix, this triggers a CSP connect-src violation in the browser console. With the patched CSP (adding https://tweakcn.com to connect-src), the fetch succeeds and the theme is applied without any CSP errors.

https://github.com/user-attachments/assets/d3443157-71b7-4955-ae10-cade0bb0e89c

Key frames in the recording:

• Control UI loads with the patched Gateway CSP
• importCustomThemeFromUrl() resolves the tweakcn link to https://tweakcn.com/r/themes/{id}
• The browser fetch completes (no violates the following Content Security Policy directive error)
• Custom theme tokens are applied to the UI

Fixes openclaw/openclaw#78504

AI-assisted: Yes. This fix was identified, implemented, and tested with assistance from OpenClaw.

• Mark as AI-assisted in the PR title or description
• Include human-run real behavior proof from your own setup
• Confirm I understand what the code does: the CSP connect-src directive is a browser security policy that restricts which origins the Control UI can fetch from. The tweakcn theme import feature was documented but broken in practice because the CSP allowlist did not include the origin the UI actually fetches from. This is a narrowly scoped allowlist addition.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/gateway/control-ui-csp.test.ts (modified, +1/-0)
• src/gateway/control-ui-csp.ts (modified, +1/-1)