BlueBubbles inbound attachments broken after 2026.4.5 upgrade

Environment

• OpenClaw 2026.4.5 (upgraded from 2026.3.22)
• BlueBubbles 1.9.9, Private API enabled
• macOS 26.3.1, Apple Silicon (M3 Ultra)
• BB webhook registered with new-message event, delivering to http://127.0.0.1:18789/bluebubbles-webhook

Problem

After upgrading to 2026.4.5, inbound iMessage images are no longer delivered to the agent. Messages arrive with <media:image> placeholder tags but no actual image data or file path. The ~/.openclaw/media/inbound/ directory shows no new files since the upgrade.

Root cause investigation

1. Private network blocking (partially fixed): The upgrade introduced a security policy blocking localhost URL fetches. Error: [security] blocked URL fetch (bluebubbles-api) target=http://localhost:1234/api/v1/ping reason=Blocked hostname or private/internal/special-use IP address. Fixed by setting channels.bluebubbles.network.dangerouslyAllowPrivateNetwork: true.

2. Attachments still not downloading: Even after enabling private network access, no attachment download attempts appear in gateway logs. The BB webhook payload includes the message text but OpenClaw doesn't attempt to fetch the attachment from BB's API. No errors related to attachment downloads appear in gateway.err.log.

3. BB server is healthy: GET /api/v1/server/info returns 200, Private API is active, webhook is registered with correct events.

Expected behavior

Inbound images should be downloaded from BB and saved to ~/.openclaw/media/inbound/, then delivered as image content to the agent (as they were on 2026.3.22).

Config

{
  "channels": {
    "bluebubbles": {
      "enabled": true,
      "serverUrl": "http://localhost:1234",
      "webhookPath": "/bluebubbles-webhook",
      "network": {
        "dangerouslyAllowPrivateNetwork": true
      },
      "mediaLocalRoots": ["/Users/jovie/.openclaw/media"]
    }
  }
}

Workaround

None found. Images sent via iMessage are not visible to the agent.