Summary

NemoClaw currently carries a downstream OpenClaw patch to make web_search and web_fetch work in OpenShell proxy-only sandboxes where local DNS is unavailable.

The underlying bug is upstream in OpenClaw: trusted env-proxy mode still performs local DNS resolution before switching to EnvHttpProxyAgent, so requests fail with getaddrinfo EAI_AGAIN before they ever reach the trusted proxy.

Why this issue exists

NemoClaw should not keep carrying a Dockerfile patch indefinitely for upstream fetch-guard behaviour. We need a tracking issue so the downstream workaround is removed once the upstream fix is merged and released.

Current downstream behaviour

• NemoClaw patches the packaged OpenClaw fetch-guard runtime during image build.
• This avoids local DNS pinning when trusted env-proxy mode is active.
• The workaround has been verified in the live OpenShell sandbox environment.

Done when

• Upstream OpenClaw issue and PR are linked here.
• NemoClaw updates to an upstream OpenClaw release that contains the fix.
• The downstream Dockerfile/runtime patch is removed.
• A regression check confirms web_search and a normal follow-up reply both work in the same proxy-only sandbox session.