openclaw - ✅(Solved) Fix v2026.4.14 regression: models.providers.*.request.allowPrivateNetwork no longer applied for audio transcription [2 pull requests, 1 comments, 2 participants]

jhsmith409 · 2026-04-14T17:05:31Z

[openclaw] After upgrading to v2026.4.14, voice message transcription via OpenAI-compatible self-hosted STT endpoints e.g. Parakeet on a LAN IP fails with an S… After upgrading to v2026.4.14, voice message transcription via OpenAI-compatible self-hosted STT endpoints (e.g. Parakeet on a LAN IP) fails with an SSRF block, even when `models.providers. .request.allowPrivateNetwork: true` is set in config. This worked correctly in v2026.4.12 and v2026.4.13. # PR #66692: fix(audio): restore allowPrivateNetwork for self-hosted STT endpoints (v2026.4.14 regression) - Repository: openclaw/openclaw - Author: jhsmith409 - State: closed | merged: True - Link: https://github.com/openclaw/openclaw/pull/66692 ## Description (problem / solution / changelog) ## Summary Fixes #66691 — regression introduced in v2026.4.14 where `models.providers.*.request.allowPrivateNetwork: true` no longer takes effect for audio transcription, causing SSRF blocks for self-hosted STT endpoints on private/LAN IPs. Two source-level bugs, both required to reproduce the failure: **Bug 1 — `runner.entries.ts`**: `resolveProviderExecutionContext` built the `request` passed to `transcribeAudio` using only `sanitizeConfiguredProviderRequest` on tool-level config and entry config. This function strips `allowPrivateNetwork`. The provider-level request config (`models.providers. .request`) was never included in the merge. **Bug 2 — `provider-request-config.ts`**: `resolveProviderRequestPolicyConfig` only read `allowPrivateNetwork` from the explicit `params.allowPrivateNetwork` parameter; it ignored `params.request?.allowPrivateNetwork` even when present. ## Changes - **`src/media-understanding/runner.entries.ts`**: use `mergeModelProviderRequestOverrides` with `sanitizeConfiguredModelProviderRequest(providerConfig?.request)` so `models.providers.*.request.allowPrivateNetwork` flows into the media execution context - **`src/agents/provider-request-config.ts`**: fall back to `params.request?.allowPrivateNetwork` when `params.allowPrivateNetwork` is `undefined` ## Test plan - [ ] Configure a self-hosted OpenAI-compatible STT endpoint on a private IP with `models.providers. .request.allowPrivateNetwork: true` - [ ] Send a voice message — transcription should succeed without SSRF block - [ ] Confirm no regression for public STT endpoints (OpenAI, Deepgram, Mistral) 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Changed files - `CHANGELOG.md` (modified, +1/-0) - `src/agents/provider-request-config.ts` (modified, +1/-1) - `src/media-understanding/runner.entries.ts` (modified, +4/-1) - `src/media-understanding/runner.proxy.test.ts` (modified, +52/-0) --- # PR #66777: fix(media): honor allowPrivateNetwork for audio transcription providers (#66691) - Repository: openclaw/openclaw - Author: MukundaKatta - State: open | merged: False - Link: https://github.com/openclaw/openclaw/pull/66777 ## Description (problem / solution / changelog) ## Summary - Fixes #66691 (regression vs 2026.4.12 / 2026.4.13) - Voice message transcription via OpenAI-compatible self-hosted STT endpoints on LAN IPs (Parakeet etc.) was failing with SSRF blocks even when \`models.providers. .request.allowPrivateNetwork: true\` was set, because the flag was dropped in two places along the audio transcription path. ## Two cooperating bugs — fixed together **1. \`resolveProviderExecutionContext\` (media-understanding/runner.entries.ts)** Merged request overrides via the base \`mergeProviderRequestOverrides\` + \`sanitizeConfiguredProviderRequest\` helpers, which deliberately strip \`allowPrivateNetwork\`. It also never included the provider-level (\`providerConfig?.request\`) layer at all. → Swap to \`mergeModelProviderRequestOverrides\` + \`sanitizeConfiguredModelProviderRequest\` (which preserve the flag) and add the provider-level request as the lowest-precedence layer in the merge. **2. \`resolveProviderRequestPolicyConfig\` (agents/provider-request-config.ts)** Read only top-level \`params.allowPrivateNetwork\`, ignoring \`params.request?.allowPrivateNetwork\`. All audio transcription callers pass the flag inside \`request\`, so (1) alone would still be discarded here. → Fall back to \`params.request?.allowPrivateNetwork\` when the top-level flag is unset. Explicit top-level flag stays authoritative when both are provided. Both fixes are needed — (1) alone is silently re-dropped by (2). ## Test plan - [x] \`pnpm vitest run src/agents/provider-request-config.test.ts\` — 23/23 pass, including 3 new regression cases for the precedence rules - [x] \`pnpm check\` (via pre-commit) — green, including typecheck of the widened \`request\` type flowing through runner.entries - [x] Existing \`allowPrivateNetwork\` tests on \`sanitizeConfiguredModelProviderRequest\` / \`mergeModelProviderRequestOverrides\` still pass ## AI-assisted disclosure - [x] AI-assisted (Claude) - Testing: fully tested — unit coverage for the precedence rules. Did not exercise a live Parakeet STT endp

openclaw2026-04-14 17:05:31

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#66691•Fetched 2026-04-15 06:24:54

View on GitHub

Comments

Participants

Timeline

Reactions

Author

jhsmith409

Participants

Artyomkun

jhsmith409

Timeline (top)

referenced ×4cross-referenced ×3closed ×1commented ×1

After upgrading to v2026.4.14, voice message transcription via OpenAI-compatible self-hosted STT endpoints (e.g. Parakeet on a LAN IP) fails with an SSRF block, even when models.providers.<id>.request.allowPrivateNetwork: true is set in config. This worked correctly in v2026.4.12 and v2026.4.13.

Error Message

[security] blocked URL fetch (url-fetch) target=http://192.168.x.x:5092/v1/audio/transcriptions reason=Blocked hostname or private/internal/special-use IP address
[media-understanding] audio: failed (0/1) reason=SsrFBlockedError

Root Cause

Root Cause (two related bugs)

Fix Action

Workaround

Patch the two dist files locally and mount them via volume until a fix ships upstream.

PR fix notes

PR #66692: fix(audio): restore allowPrivateNetwork for self-hosted STT endpoints (v2026.4.14 regression)

Repository: openclaw/openclaw
Author: jhsmith409
State: closed | merged: True
Link: https://github.com/openclaw/openclaw/pull/66692

Description (problem / solution / changelog)

Summary

Fixes #66691 — regression introduced in v2026.4.14 where models.providers.*.request.allowPrivateNetwork: true no longer takes effect for audio transcription, causing SSRF blocks for self-hosted STT endpoints on private/LAN IPs.

Two source-level bugs, both required to reproduce the failure:

Bug 1 — runner.entries.ts: resolveProviderExecutionContext built the request passed to transcribeAudio using only sanitizeConfiguredProviderRequest on tool-level config and entry config. This function strips allowPrivateNetwork. The provider-level request config (models.providers.<id>.request) was never included in the merge.

Bug 2 — provider-request-config.ts: resolveProviderRequestPolicyConfig only read allowPrivateNetwork from the explicit params.allowPrivateNetwork parameter; it ignored params.request?.allowPrivateNetwork even when present.

Changes

src/media-understanding/runner.entries.ts: use mergeModelProviderRequestOverrides with sanitizeConfiguredModelProviderRequest(providerConfig?.request) so models.providers.*.request.allowPrivateNetwork flows into the media execution context
src/agents/provider-request-config.ts: fall back to params.request?.allowPrivateNetwork when params.allowPrivateNetwork is undefined

Test plan

Configure a self-hosted OpenAI-compatible STT endpoint on a private IP with models.providers.<id>.request.allowPrivateNetwork: true
Send a voice message — transcription should succeed without SSRF block
Confirm no regression for public STT endpoints (OpenAI, Deepgram, Mistral)

🤖 Generated with Claude Code

Changed files

CHANGELOG.md (modified, +1/-0)
src/agents/provider-request-config.ts (modified, +1/-1)
src/media-understanding/runner.entries.ts (modified, +4/-1)
src/media-understanding/runner.proxy.test.ts (modified, +52/-0)

PR #66777: fix(media): honor allowPrivateNetwork for audio transcription providers (#66691)

Repository: openclaw/openclaw
Author: MukundaKatta
State: open | merged: False
Link: https://github.com/openclaw/openclaw/pull/66777

Description (problem / solution / changelog)

Summary

Fixes #66691 (regression vs 2026.4.12 / 2026.4.13)
Voice message transcription via OpenAI-compatible self-hosted STT endpoints on LAN IPs (Parakeet etc.) was failing with SSRF blocks even when `models.providers.<id>.request.allowPrivateNetwork: true` was set, because the flag was dropped in two places along the audio transcription path.

Two cooperating bugs — fixed together

1. `resolveProviderExecutionContext` (media-understanding/runner.entries.ts) Merged request overrides via the base `mergeProviderRequestOverrides` + `sanitizeConfiguredProviderRequest` helpers, which deliberately strip `allowPrivateNetwork`. It also never included the provider-level (`providerConfig?.request`) layer at all. → Swap to `mergeModelProviderRequestOverrides` + `sanitizeConfiguredModelProviderRequest` (which preserve the flag) and add the provider-level request as the lowest-precedence layer in the merge.

2. `resolveProviderRequestPolicyConfig` (agents/provider-request-config.ts) Read only top-level `params.allowPrivateNetwork`, ignoring `params.request?.allowPrivateNetwork`. All audio transcription callers pass the flag inside `request`, so (1) alone would still be discarded here. → Fall back to `params.request?.allowPrivateNetwork` when the top-level flag is unset. Explicit top-level flag stays authoritative when both are provided.

Both fixes are needed — (1) alone is silently re-dropped by (2).

Test plan

`pnpm vitest run src/agents/provider-request-config.test.ts` — 23/23 pass, including 3 new regression cases for the precedence rules
`pnpm check` (via pre-commit) — green, including typecheck of the widened `request` type flowing through runner.entries
Existing `allowPrivateNetwork` tests on `sanitizeConfiguredModelProviderRequest` / `mergeModelProviderRequestOverrides` still pass

AI-assisted disclosure

AI-assisted (Claude)
Testing: fully tested — unit coverage for the precedence rules. Did not exercise a live Parakeet STT endpoint; the issue's root-cause analysis is concrete enough that the unit-level fix is high-confidence.
Prompt context: issue #66691 (root-cause analysis + proposed fixes), plus reads of `src/media-understanding/runner.entries.ts`, `src/agents/provider-request-config.ts`, and the existing tests.
I understand what the code does.

Changed files

src/agents/provider-request-config.test.ts (modified, +36/-0)
src/agents/provider-request-config.ts (modified, +7/-0)
src/media-understanding/runner.entries.ts (modified, +9/-0)

Code Example

[security] blocked URL fetch (url-fetch) target=http://192.168.x.x:5092/v1/audio/transcriptions reason=Blocked hostname or private/internal/special-use IP address
[media-understanding] audio: failed (0/1) reason=SsrFBlockedError

---

request: mergeProviderRequestOverrides(
  sanitizeConfiguredProviderRequest(params.config?.request),
  sanitizeConfiguredProviderRequest(params.entry.request)
)

---

request: mergeModelProviderRequestOverrides(
  sanitizeConfiguredModelProviderRequest(providerConfig?.request),
  sanitizeConfiguredProviderRequest(params.config?.request),
  sanitizeConfiguredProviderRequest(params.entry.request)
)

---

allowPrivateNetwork: params.allowPrivateNetwork ?? false

---

allowPrivateNetwork: params.allowPrivateNetwork ?? params.request?.allowPrivateNetwork ?? false

---

{
  "models": {
    "providers": {
      "openai": {
        "apiKey": "local",
        "baseUrl": "http://192.168.x.x:5092/v1",
        "request": {
          "allowPrivateNetwork": true
        }
      }
    }
  },
  "tools": {
    "media": {
      "audio": {
        "enabled": true,
        "models": [{ "provider": "openai", "model": "parakeet" }]
      }
    }
  }
}

RAW_BUFFERClick to expand / collapse

Summary

Error

[security] blocked URL fetch (url-fetch) target=http://192.168.x.x:5092/v1/audio/transcriptions reason=Blocked hostname or private/internal/special-use IP address
[media-understanding] audio: failed (0/1) reason=SsrFBlockedError

Root Cause (two related bugs)

Bug 1 — `resolveProviderExecutionContext` drops `allowPrivateNetwork` from provider config

In runner.entries-*.js, resolveProviderExecutionContext builds the request object passed to transcribeAudio using only sanitizeConfiguredProviderRequest on the tool-level config and entry config:

request: mergeProviderRequestOverrides(
  sanitizeConfiguredProviderRequest(params.config?.request),
  sanitizeConfiguredProviderRequest(params.entry.request)
)

sanitizeConfiguredProviderRequest handles only headers, auth, proxy, and tls — it explicitly excludes allowPrivateNetwork. The provider-level config (models.providers.<id>.request) is never included in this merge, so allowPrivateNetwork: true from that config is silently dropped.

Fix: Use mergeModelProviderRequestOverrides and include sanitizeConfiguredModelProviderRequest(providerConfig?.request) in the merge:

request: mergeModelProviderRequestOverrides(
  sanitizeConfiguredModelProviderRequest(providerConfig?.request),
  sanitizeConfiguredProviderRequest(params.config?.request),
  sanitizeConfiguredProviderRequest(params.entry.request)
)

Bug 2 — `resolveProviderRequestPolicyConfig` ignores `allowPrivateNetwork` in `params.request`

In provider-request-config-*.js, resolveProviderRequestPolicyConfig returns:

allowPrivateNetwork: params.allowPrivateNetwork ?? false

params.allowPrivateNetwork is only set when the caller passes it explicitly. All audio transcription callers (transcribeOpenAiCompatibleAudio, transcribeDeepgramAudio, etc.) derive allowPrivateNetwork from resolveProviderHttpRequestConfig without passing it explicitly — they pass request: params.request and expect the config to be read from there. But resolveProviderRequestPolicyConfig ignores params.request?.allowPrivateNetwork.

Fix:

allowPrivateNetwork: params.allowPrivateNetwork ?? params.request?.allowPrivateNetwork ?? false

Both bugs are required to reproduce the failure

Even with Bug 1 fixed, Bug 2 would silently discard the value. Both need to be corrected together.

Config that should work but doesn't

{
  "models": {
    "providers": {
      "openai": {
        "apiKey": "local",
        "baseUrl": "http://192.168.x.x:5092/v1",
        "request": {
          "allowPrivateNetwork": true
        }
      }
    }
  },
  "tools": {
    "media": {
      "audio": {
        "enabled": true,
        "models": [{ "provider": "openai", "model": "parakeet" }]
      }
    }
  }
}

Regression introduced in

v2026.4.14 — worked in v2026.4.12/v2026.4.13.

The schema entry models.providers.*.request.allowPrivateNetwork (added in #63671 for v2026.4.12) documents this config path as the supported way to allow private-network STT/media endpoints, so the regression breaks the documented operator workflow.

Workaround

Patch the two dist files locally and mount them via volume until a fix ships upstream.

extent analysis

TL;DR

To fix the voice message transcription issue via OpenAI-compatible self-hosted STT endpoints, apply the provided code fixes for both Bug 1 and Bug 2.

Guidance

Identify the affected code files (runner.entries-*.js and provider-request-config-*.js) and apply the suggested fixes to include allowPrivateNetwork from the provider config.
Verify that the models.providers.<id>.request.allowPrivateNetwork config is correctly merged and used in the request policy config.
Test the transcription functionality with the updated code to ensure the SSRF block is lifted for private network IPs.
Consider applying the provided workaround by patching the dist files locally and mounting them via volume until an official fix is released.

Example

The fixes involve updating the resolveProviderExecutionContext and resolveProviderRequestPolicyConfig functions as shown:

// Fix for Bug 1
request: mergeModelProviderRequestOverrides(
  sanitizeConfiguredModelProviderRequest(providerConfig?.request),
  sanitizeConfiguredProviderRequest(params.config?.request),
  sanitizeConfiguredProviderRequest(params.entry.request)
)

// Fix for Bug 2
allowPrivateNetwork: params.allowPrivateNetwork ?? params.request?.allowPrivateNetwork ?? false

Notes

The provided fixes assume that the issue is caused by the two identified bugs and that applying these fixes will resolve the problem. However, additional testing and verification may be necessary to ensure the solution works as expected.

Recommendation

Apply the workaround by patching the dist files locally and mounting them via volume until a fix ships upstream, as this provides a temporary solution to the regression introduced in v2026.4.14.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #ssr #device allocation #model download #tokenizer error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

openclaw - ✅(Solved) Fix v2026.4.14 regression: models.providers.*.request.allowPrivateNetwork no longer applied for audio transcription [2 pull requests, 1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Root Cause (two related bugs)

Fix Action

Workaround

PR fix notes

PR #66692: fix(audio): restore allowPrivateNetwork for self-hosted STT endpoints (v2026.4.14 regression)

Description (problem / solution / changelog)

Summary

Changes

Test plan

Changed files

PR #66777: fix(media): honor allowPrivateNetwork for audio transcription providers (#66691)

Description (problem / solution / changelog)

Summary

Two cooperating bugs — fixed together

Test plan

AI-assisted disclosure

Changed files

Code Example

Summary

Error

Root Cause (two related bugs)

Bug 1 — resolveProviderExecutionContext drops allowPrivateNetwork from provider config

Bug 2 — resolveProviderRequestPolicyConfig ignores allowPrivateNetwork in params.request

Both bugs are required to reproduce the failure

Config that should work but doesn't

Regression introduced in

Workaround

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

Still need to ship something?

RELATED_DISCOVERY

TRENDING

Bug 1 — `resolveProviderExecutionContext` drops `allowPrivateNetwork` from provider config

Bug 2 — `resolveProviderRequestPolicyConfig` ignores `allowPrivateNetwork` in `params.request`