Bug Report

Version

• OpenClaw: 2026.4.5
• Node: v22 (inside OpenShell sandbox)
• undici: bundled with Node

Description

globalThis.fetch (powered by undici) does not route through HTTP_PROXY/HTTPS_PROXY by default. This means any code path that uses globalThis.fetch or undici's fetch() directly bypasses the proxy entirely.

In proxy-only environments (like OpenShell sandboxes where all traffic must go through an HTTP CONNECT proxy at 10.200.0.1:3128), this causes LLM provider requests to fail silently or with connection errors — the requests attempt direct connections that the network namespace blocks.

Affected Code Paths

• OpenAI SDK v6+ uses globalThis.fetch internally
• Any undici-based HTTP calls in OpenClaw or its plugins
• This is separate from the SSRF fetch-guard DNS pinning issue ([Bug]: trusted env-proxy web_search and web_fetch still fail with EAI_AGAIN in v2026.3.31 #59005) — even with that fix, undici's default Agent dispatcher has no proxy awareness

Workaround

At Node.js startup (via NODE_OPTIONS=--require), manually set the global dispatcher:

const { EnvHttpProxyAgent, setGlobalDispatcher } = require('undici');
if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY) {
  setGlobalDispatcher(new EnvHttpProxyAgent());
}

This makes all globalThis.fetch calls honor proxy env vars. We've been running this in production across 4 OpenShell sandboxes since 2026.4.5.

Expected Behavior

When HTTP_PROXY/HTTPS_PROXY are set, OpenClaw should configure undici's global dispatcher to use EnvHttpProxyAgent so that all fetch-based requests route through the proxy — matching the behavior of Node's http/https modules.

Environment

• OpenShell sandbox with HTTP CONNECT proxy (no direct internet, no DNS)
• HTTP_PROXY=http://10.200.0.1:3128 and HTTPS_PROXY=http://10.200.0.1:3128 exported

Related Issues

• [Bug]: trusted env-proxy web_search and web_fetch still fail with EAI_AGAIN in v2026.3.31 #59005 / PR fix(net): skip DNS pinning before trusted env proxy dispatch #59007 — DNS pinning before proxy check (same proxy environment, different layer)
• Slack Socket Mode WebSocket connections don't honor HTTPS_PROXY #57405 — Slack Socket Mode ws library also doesn't honor HTTPS_PROXY
• [Bug]: memory_search remote embeddings fail with ENOTFOUND when env proxy is configured — withRemoteHttpResponse skips TRUSTED_ENV_PROXY mode #52162 — memory_search remote embeddings fail behind proxy