Bug Report

Version

2026.6.6

Summary

tools.web.fetch.useTrustedEnvProxy ignores the NO_PROXY env variable, causing all requests (including local addresses) to be routed through the proxy.

Current Behavior

When useTrustedEnvProxy: true is set, web_fetch reads HTTP_PROXY/HTTPS_PROXY from environment variables but does not respect NO_PROXY. As a result, requests to localhost, 127.0.0.1, or 192.168.* addresses are still sent through the proxy instead of being accessed directly.

Expected Behavior

web_fetch should check NO_PROXY (or no_proxy) and bypass the proxy for matching domains/IPs, consistent with standard HTTP client behavior.

Reproduction Steps

1. Configure environment variables:

   HTTP_PROXY=http://192.168.31.164:7890
   HTTPS_PROXY=http://192.168.31.164:7890
   NO_PROXY=localhost,192.168.*,127.0.0.1
   

2. Set OpenClaw config:

   {
     tools: {
       web: {
         fetch: {
           useTrustedEnvProxy: true
         }
       }
     }
   }

3. Use web_fetch to access a local address (e.g., http://192.168.31.33:8123 or http://localhost:8080)
4. Observe that the request is routed through the proxy instead of direct access

Impact

• Local services (Home Assistant, internal APIs) fail or suffer unnecessary latency
• Users must choose between: (a) no proxy for external sites, or (b) proxy for everything including local

Workaround

Use exec + curl with manual proxy control for local access, or disable useTrustedEnvProxy and accept that external sites won't work through proxy.

Related

• useTrustedEnvProxy was introduced in 2026.6.6
• ssrfPolicy allows fake-IP proxy ranges, but does not address the NO_PROXY gap