openclaw - 💡(How to fix) Fix Control UI tweakcn theme import fails via Tailscale Serve due to CSP/connect-src [1 comments, 2 participants]

Summary

The Control UI tweakcn theme importer can fail with a generic browser error when the Control UI is accessed through a Tailscale Serve HTTPS hostname, even though the same import works when the Control UI is opened directly on loopback.

The error shown in the UI is:

NetworkError when attempting to fetch resource.

Observed behavior

• Accessing Control UI directly at http://127.0.0.1:18789:
  • importing a tweakcn theme works.
• Accessing the same Control UI through a custom Tailscale Serve HTTPS hostname:
  • importing the same theme fails with NetworkError when attempting to fetch resource.

Tested theme inputs included:

https://tweakcn.com/editor/theme?theme=caffeine
https://tweakcn.com/r/themes/caffeine
caffeine

The direct registry endpoint itself is reachable and CORS-friendly:

content-type: application/json
access-control-allow-origin: *

Relevant CSP

Both the loopback and Tailscale-served Control UI responses include a CSP like:

Content-Security-Policy: default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com; worker-src 'self'; connect-src 'self' ws: wss: https://api.openai.com

Notably, connect-src does not include https://tweakcn.com, while the theme importer needs to fetch tweakcn registry URLs such as:

https://tweakcn.com/r/themes/<id>

Expected behavior

The tweakcn theme importer should work from supported Control UI access origins, including Tailscale Serve, or the UI should provide a clearer CSP-related error.

Possible fix

Allow the tweakcn registry origin in the Control UI CSP, for example:

connect-src 'self' ws: wss: https://api.openai.com https://tweakcn.com

Alternatively, proxy the tweakcn registry fetch through the gateway so the browser only connects to 'self'.

Privacy note

This report intentionally omits the actual Tailscale hostname, device names, and internal addressing.