Description

After enabling the bundled Tavily plugin and configuring tools.web.search.provider: "tavily", all web search calls fail with getaddrinfo EAI_AGAIN api.tavily.com. The Tavily network policy preset is applied and approved in openshell term. Direct curl from inside the sandbox succeeds ({"message":"Alive"}), confirming the proxy and policy work correctly.
This is the same root cause as #396 — OpenClaw's guarded fetch performs a local DNS lookup before routing through the TRUSTED_ENV_PROXY, which fails in the sandboxed network namespace.

Reproduction Steps

1. nemoclaw onboard on DGX Spark
2. Create and apply a Tavily policy preset allowing api.tavily.com:443
3. Approve the rule in openshell term
4. Enable the Tavily plugin: plugins.entries.tavily.enabled: true
5. Set provider: tools.web.search.provider: "tavily"
6. Set env: TAVILY_API_KEY=<key>
7. Ask the agent to search — fails with EAI_AGAIN
8. curl -v https://api.tavily.com/ from inside sandbox succeeds via proxy

Expected: Tavily search works since the proxy and policy allow the traffic
Actual: Node.js DNS lookup fails before reaching the proxy

Workaround: None found. Waiting for the fix described in #396.

Environment

• Host: NVIDIA DGX Spark, Ubuntu 24.04.4 LTS (aarch64)
• Docker: 29.1.3
• NemoClaw: v0.1.0
• OpenClaw: 2026.3.24 (upgraded from 2026.3.11 inside sandbox)
• Node: v22.22.1

Debug Output

Logs

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate