Fix ClawBody for current OpenAI Realtime (GA) + OpenClaw 6.x gateway device-auth - #5
Open
KundKMC wants to merge 2 commits into
Open
Fix ClawBody for current OpenAI Realtime (GA) + OpenClaw 6.x gateway device-auth#5KundKMC wants to merge 2 commits into
KundKMC wants to merge 2 commits into
Conversation
OpenAI disabled the beta Realtime API shape server-side; clawbody fails
with: error 4000 invalid_request_error.beta_api_shape_disabled.
- Use client.realtime.connect (GA) instead of client.beta.realtime.connect
- Rewrite session.update payload to GA schema:
- type: realtime, output_modalities, nested audio.input/output
- audio format objects {type: audio/pcm, rate: 24000}
- turn_detection + transcription moved under audio.input
- Update output audio event names to GA:
response.audio.delta -> response.output_audio.delta
response.audio_transcript.{delta,done} -> response.output_audio_transcript.{delta,done}
Verified live: session.created + session.updated received, 8 tools registered.
OpenClaw 6.x rejects device-less operator clients (CONTROL_UI_DEVICE_IDENTITY_REQUIRED)
and grants device-less loopback clients an empty scope set, so chat.send fails.
- New device_identity.py: persistent Ed25519 keypair, device id = sha256(raw
pubkey) hex, sign challenge nonce -> base64url; cache device token.
- Bridge connect now sends device{id,publicKey,signature,signedAt,nonce} and
signs the V2 device-auth payload (gateway verifies V3 or V2 with same sig).
- Widen protocol negotiation to min=3..max=4 (fixes 'protocol mismatch').
- Request scopes operator.read+operator.write (no 'chat' scope in 6.x;
chat.send is write-scoped). First connect -> pairing; approve via
'openclaw devices approve <id>'. Token persisted for reconnects.
Verified live against OpenClaw 2026.6.5: connected with scopes, agent context
retrieved (3364 chars), no fallback identity.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ClawBody currently fails to connect to both OpenAI and the OpenClaw gateway on current versions:
error 4000 invalid_request_error.beta_api_shape_disabled— OpenAI disabled the beta Realtime API shape server-side.CONTROL_UI_DEVICE_IDENTITY_REQUIRED, sochat.sendfails (and the pinned protocol version causesprotocol mismatch).This PR fixes both so ClawBody works again against OpenAI Realtime GA and OpenClaw 2026.6.x.
Changes
1. OpenAI Realtime beta → GA (
openai_realtime.py)client.beta.realtime.connect→client.realtime.connectsession.updaterewritten to the GA schema:type: "realtime", nestedaudio.input/audio.output,output_modalities, audio format objects{type: "audio/pcm", rate: 24000},transcription+turn_detectionmoved underaudio.inputresponse.audio.delta→response.output_audio.delta,response.audio_transcript.{delta,done}→response.output_audio_transcript.{delta,done}2. Gateway device identity for OpenClaw 6.x (
device_identity.py,openclaw_bridge.py)device_identity.py: persistent Ed25519 keypair,device.id = sha256(raw pubkey).hex, signs the connect-challenge nonce (base64url), caches the device token.connect()now sendsdevice{id, publicKey, signature, signedAt, nonce}and signs the V2 device-auth payload (the gateway verifies V3 or V2 against the same signature).minProtocol=3, maxProtocol=4(fixesprotocol mismatch).operator.read+operator.write— there is no separatechatscope in 6.x (chat.sendis write-scoped; the gateway rejectschat). First connect registers a pairing request; approve withopenclaw devices approve <requestId>.Testing
Verified live against OpenClaw 2026.6.5 with a physical Reachy Mini (Lite) on macOS / Apple Silicon:
session.created+session.updated, 8 tools registered, no morebeta_api_shape_disabled.scopes=['operator.read','operator.write'], agent context retrieved (~3.3k chars, no fallback identity).Unrelated macOS note: the reachy-mini daemon must run with media enabled, and GStreamer needs
GST_REGISTRY_FORK=noon first launch.