Description

[Description] The OpenShell gateway proxy performs MITM TLS termination on all HTTPS CONNECT tunnels, re-signing with its own CA. However, the sandbox container's /etc/ssl/certs/ does not include this CA, causing all TLS connections through the proxy to fail. Affects git, curl, node https, and any other TLS client inside the sandbox.

[Environment]

• Device: macOS 26.0.1 (arm64)
• NemoClaw: v0.0.14 | OpenShell: 0.0.26

[Steps to Reproduce]

nemoclaw test11 policy-add   # select github
nemoclaw test11 connect
git clone https://github.com/octocat/Hello-World.git /tmp/test

[Expected Result] git clone succeeds

[Actual Result]

fatal: unable to access 'https://github.com/octocat/Hello-World.git/':
  server certificate verification failed. CAfile: none CRLfile: none

Workaround: GIT_SSL_NO_VERIFY=true bypasses the error

[Root Cause] The sandbox image build does not inject the gateway proxy's CA certificate into /etc/ssl/certs/ or run update-ca-certificates. The proxy CA only exists on the gateway side; the sandbox is unaware of it.

[Suggested Fix] Automatically inject the gateway proxy CA cert into the sandbox container's trust store during sandbox creation.

Bug Details

[NVB# 6072119]

[NVB#6072119]