openclaw - 💡(How to fix) Fix Control UI Realtime Talk: CSP blocks OpenAI WebRTC and UI hides realtime audio errors [1 comments, 2 participants]

Summary

On OpenClaw 2026.4.26, the Control UI Realtime Talk flow can fail in two hard-to-debug ways when using the bundled OpenAI realtime browser provider.

1. The Control UI CSP only allowed connect-src 'self' ws: wss:. The browser WebRTC setup posts the SDP offer directly to https://api.openai.com/v1/realtime/calls, so Chrome blocks the request unless https://api.openai.com is added to connect-src.
2. After patching CSP locally, the dashboard can show Talk live while the user gets no spoken response. The bundled WebRTC client only handles transcript and function-call events from the oai-events data channel. It ignores error, speech start/stop, response lifecycle, and other diagnostic events, so the UI provides no actionable failure state.

Environment

• OpenClaw: 2026.4.26 / be8c246
• Install path: npm/Homebrew global install
• Browser: Chrome 147 on macOS
• Provider: bundled OpenAI realtime browser provider (transport: webrtc-sdp, model gpt-realtime-1.5)

Repro

1. Configure OpenAI realtime credentials so talk.realtime.session returns a WebRTC session.
2. Open the Control UI.
3. Click the Realtime Talk button.
4. Observe CSP failure before patching connect-src.
5. After patching CSP, the WebRTC session can connect, but realtime API errors / VAD failures are swallowed by the UI because the data-channel handler ignores them.

Expected

• Control UI CSP should allow the OpenAI realtime call endpoint when the OpenAI realtime provider is available, likely connect-src ... https://api.openai.com.
• The WebRTC session should be created with explicit audio input settings for browser speech-to-speech sessions, including server VAD / auto response settings.
• The UI should surface realtime error events and at least basic speech/response lifecycle status so users are not left staring at Talk live with no reply.

Local workaround used

Patched the installed bundle locally to add https://api.openai.com to connect-src, and patched the OpenAI browser session minting payload to include explicit audio input config:

audio: {
  input: {
    turn_detection: {
      type: "server_vad",
      create_response: true,
      interrupt_response: true
    },
    transcription: { model: "whisper-1" }
  },
  output: { voice }
}

This confirms the API key/session mint path is healthy, but the fix should live upstream because upgrades overwrite the bundled files.