Skip to content

web_fetch: auto-enable useTrustedEnvProxy when HTTP_PROXY is detected #95560

Description

@Footree

Problem

tools.web.fetch.useTrustedEnvProxy (introduced in 2026.6.6) successfully routes web_fetch through the system proxy when enabled. However, users must manually discover and enable this setting — there is no feedback loop telling them it exists.

When a Gateway process has HTTP_PROXY/HTTPS_PROXY environment variables set but useTrustedEnvProxy is not configured, web_fetch silently uses direct connections. This leads to confusing timeout failures on networks where direct access is blocked (e.g., behind GFW, corporate firewall).

Current Behavior

  1. User configures HTTP_PROXY/HTTPS_PROXY in shell/env
  2. exec + curl works fine (curl respects env proxy vars)
  3. web_search may work (some providers are directly accessible)
  4. web_fetch silently fails with timeout → user has no clue why

The user only discovers useTrustedEnvProxy by:

Proposed Solution

When HTTP_PROXY or HTTPS_PROXY is present in the Gateway process environment:

  1. Default useTrustedEnvProxy to true (or at minimum)
  2. Log a warning during startup: "Proxy env vars detected but tools.web.fetch.useTrustedEnvProxy is not enabled — web_fetch will use direct connections"

Option (2) is lower risk and avoids the NO_PROXY gap (#93807) affecting users who do NOT want proxy routing.

Related Issues

Environment

  • OpenClaw 2026.6.6 (macOS)
  • Proxy: HTTP_PROXY=http://127.0.0.1:7897

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Normal backlog priority with limited blast radius.clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.impact:otherThis issue has meaningful maintainer-visible impact outside the owned taxonomy.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions