Problem
When running OpenClaw inside a proxy-only network environment (e.g., NVIDIA OpenShell sandboxes), Slack Socket Mode WebSocket connections fail because the ws library does not natively honor the HTTPS_PROXY / HTTP_PROXY environment variables.
All outbound traffic in these environments must route through an HTTP CONNECT proxy. REST API calls work correctly because undici's EnvHttpProxyAgent respects proxy env vars. However, WebSocket connections to wss-primary.slack.com and wss-backup.slack.com bypass the proxy entirely and fail.
Additionally, Slack file downloads via Node's native https module (files.slack.com) also do not honor proxy env vars, so those fail as well.
Current Workaround
We wrote a NODE_OPTIONS=--require preload script that monkey-patches:
- The
ws WebSocket constructor — intercepts new WebSocket(url, ...) calls targeting Slack WebSocket hosts, injects a custom https.Agent (via the https-proxy-agent package) that tunnels through the CONNECT proxy.
- Node's
https.request / https.get — intercepts calls to files.slack.com and similarly injects a proxy-aware agent.
This works but is fragile, version-sensitive, and shouldn't be necessary.
Suggested Fix
When HTTPS_PROXY (or HTTP_PROXY / ALL_PROXY) is set, OpenClaw should pass a proxy-aware agent to the ws WebSocket constructor for Slack Socket Mode connections. For example, using https-proxy-agent or hpagent:
const { HttpsProxyAgent } = require('https-proxy-agent');
const proxyAgent = new HttpsProxyAgent(process.env.HTTPS_PROXY);
const ws = new WebSocket(slackWssUrl, { agent: proxyAgent });The same approach should apply to any https.request / https.get calls for Slack file downloads — pass the proxy agent via the agent option.
This would bring WebSocket and file-download behavior in line with how undici already handles REST calls via EnvHttpProxyAgent.
Environment
- OpenClaw version: 2026.3.28
- Node.js version: 22.22.1
- Runtime: NVIDIA OpenShell v0.0.16 sandbox (Linux, isolated network namespace)
- Proxy: HTTP CONNECT proxy at local bridge interface, no direct internet access
- Slack integration: Socket Mode enabled
Related
Problem
When running OpenClaw inside a proxy-only network environment (e.g., NVIDIA OpenShell sandboxes), Slack Socket Mode WebSocket connections fail because the
wslibrary does not natively honor theHTTPS_PROXY/HTTP_PROXYenvironment variables.All outbound traffic in these environments must route through an HTTP CONNECT proxy. REST API calls work correctly because undici's
EnvHttpProxyAgentrespects proxy env vars. However, WebSocket connections towss-primary.slack.comandwss-backup.slack.combypass the proxy entirely and fail.Additionally, Slack file downloads via Node's native
httpsmodule (files.slack.com) also do not honor proxy env vars, so those fail as well.Current Workaround
We wrote a
NODE_OPTIONS=--requirepreload script that monkey-patches:wsWebSocket constructor — interceptsnew WebSocket(url, ...)calls targeting Slack WebSocket hosts, injects a customhttps.Agent(via thehttps-proxy-agentpackage) that tunnels through the CONNECT proxy.https.request/https.get— intercepts calls tofiles.slack.comand similarly injects a proxy-aware agent.This works but is fragile, version-sensitive, and shouldn't be necessary.
Suggested Fix
When
HTTPS_PROXY(orHTTP_PROXY/ALL_PROXY) is set, OpenClaw should pass a proxy-aware agent to thewsWebSocket constructor for Slack Socket Mode connections. For example, usinghttps-proxy-agentorhpagent:The same approach should apply to any
https.request/https.getcalls for Slack file downloads — pass the proxy agent via theagentoption.This would bring WebSocket and file-download behavior in line with how undici already handles REST calls via
EnvHttpProxyAgent.Environment
Related