fix(slack): honor HTTPS_PROXY for Socket Mode WebSocket connections by mjamiv · Pull Request #62878 · openclaw/openclaw

mjamiv · 2026-04-08T03:24:24Z

Summary

Slack Socket Mode ignores HTTPS_PROXY/HTTP_PROXY env vars — the ws library opens a direct WebSocket connection to wss-primary.slack.com, bypassing any configured proxy. This breaks Socket Mode in proxy-only environments (sandboxed containers, corporate networks, NVIDIA OpenShell).

This PR creates an HttpsProxyAgent from proxy env vars and passes it as the agent option through @slack/bolt → @slack/socket-mode → SlackWebSocket → ws, so the WebSocket upgrade request is tunneled through the HTTP CONNECT proxy.

Changes

extensions/slack/src/client.ts: resolveSlackWebClientOptions() and resolveSlackWriteClientOptions() now set agent to an HttpsProxyAgent when HTTPS_PROXY/HTTP_PROXY env vars are present. Follows undici EnvHttpProxyAgent semantics (lower-case takes precedence).
extensions/slack/package.json: Added https-proxy-agent dependency (same version as Discord extension).
extensions/slack/src/client.test.ts: Tests for proxy agent creation, env var precedence, explicit agent override, and no-op when no proxy is configured.

How it works

The agent flows through:

resolveSlackWebClientOptions() → { agent: HttpsProxyAgent }
new App({ clientOptions }) (Bolt)
new SocketModeReceiver({ clientOptions }) → new SocketModeClient({ clientOptions })
SlackWebSocket({ httpAgent: clientOptions.agent })
new ws.WebSocket(url, { agent: httpAgent }) — tunneled through proxy ✅

Prior art

Mirrors the existing Discord gateway proxy support in extensions/discord/src/monitor/gateway-plugin.ts, which uses the same https-proxy-agent library.

Production validation

We've been running an equivalent monkey-patch (openclaw-ws-proxy-patch.js) across 4 OpenClaw agents on NVIDIA OpenShell sandboxes since March 2026, routing all Slack Socket Mode traffic through an HTTP CONNECT proxy at 10.200.0.1:3128. This PR replaces that workaround with a proper fix.

Fixes #57405

Test plan

HTTPS_PROXY set → Socket Mode connects through proxy
No proxy env vars → Socket Mode connects directly (no behavior change)
Explicit clientOptions.agent → not overridden by proxy detection
HTTP_PROXY fallback when HTTPS_PROXY not set
Lower-case https_proxy takes precedence over upper-case HTTPS_PROXY
Unit tests pass: extensions/slack/src/client.test.ts

greptile-apps · 2026-04-08T03:26:34Z

Greptile Summary

This PR fixes Slack Socket Mode ignoring proxy env vars by creating an HttpsProxyAgent from HTTPS_PROXY/HTTP_PROXY and passing it as the agent option through Bolt → @slack/socket-mode → ws. The change is well-scoped, correctly uses ?? to preserve any explicit agent override, and mirrors the existing Discord gateway proxy pattern.

Confidence Score: 5/5

Safe to merge; the only finding is a P2 gap where NO_PROXY exclusions are not honored, which doesn't affect the primary use case.

All findings are P2. The proxy detection and agent wiring are correct for the stated goal (proxy-only environments). The NO_PROXY gap is a completeness concern, not a present breakage for the target users.

extensions/slack/src/client.ts — resolveSlackProxyAgent does not check NO_PROXY/no_proxy.

Vulnerabilities

No security concerns identified. Proxy URL is read from standard env vars, not user input, and HttpsProxyAgent does its own URL parsing without eval or command injection risk.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/slack/src/client.ts
Line: 27-40

Comment:
**`NO_PROXY` not honored**

`HttpsProxyAgent` does not respect the `NO_PROXY` / `no_proxy` exclusion list, so any host matched by `NO_PROXY` would still be tunneled through the proxy. The PR description claims undici `EnvHttpProxyAgent` semantics, but `EnvHttpProxyAgent` is the component that handles `NO_PROXY` exclusions — `HttpsProxyAgent` alone does not.

The core uses `EnvHttpProxyAgent` (via `resolveProxyFetchFromEnv` in `src/infra/net/proxy-fetch.ts`) precisely because it handles `NO_PROXY`. For the WebSocket `agent` slot that `ws` requires, consider checking `NO_PROXY` / `no_proxy` before constructing the agent and short-circuiting to `undefined` when the target host is excluded. Alternatively, document explicitly that `NO_PROXY` is not respected for Socket Mode connections.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(slack): honor HTTPS_PROXY for Socket..." | Re-trigger Greptile}

greptile-apps · 2026-04-08T03:26:37Z

+function resolveSlackProxyAgent(): HttpsProxyAgent<string> | undefined {
+  // Match undici EnvHttpProxyAgent semantics: lower-case takes precedence,
+  // HTTPS prefers https_proxy then falls back to http_proxy.
+  const proxyUrl =
+    process.env.https_proxy?.trim() ||
+    process.env.HTTPS_PROXY?.trim() ||
+    process.env.http_proxy?.trim() ||
+    process.env.HTTP_PROXY?.trim() ||
+    undefined;
+  if (!proxyUrl) {
+    return undefined;
+  }
+  return new HttpsProxyAgent<string>(proxyUrl);
+}


NO_PROXY not honored

HttpsProxyAgent does not respect the NO_PROXY / no_proxy exclusion list, so any host matched by NO_PROXY would still be tunneled through the proxy. The PR description claims undici EnvHttpProxyAgent semantics, but EnvHttpProxyAgent is the component that handles NO_PROXY exclusions — HttpsProxyAgent alone does not.

The core uses EnvHttpProxyAgent (via resolveProxyFetchFromEnv in src/infra/net/proxy-fetch.ts) precisely because it handles NO_PROXY. For the WebSocket agent slot that ws requires, consider checking NO_PROXY / no_proxy before constructing the agent and short-circuiting to undefined when the target host is excluded. Alternatively, document explicitly that NO_PROXY is not respected for Socket Mode connections.

Prompt To Fix With AI

This is a comment left during a code review. Path: extensions/slack/src/client.ts Line: 27-40 Comment: **`NO_PROXY` not honored** `HttpsProxyAgent` does not respect the `NO_PROXY` / `no_proxy` exclusion list, so any host matched by `NO_PROXY` would still be tunneled through the proxy. The PR description claims undici `EnvHttpProxyAgent` semantics, but `EnvHttpProxyAgent` is the component that handles `NO_PROXY` exclusions — `HttpsProxyAgent` alone does not. The core uses `EnvHttpProxyAgent` (via `resolveProxyFetchFromEnv` in `src/infra/net/proxy-fetch.ts`) precisely because it handles `NO_PROXY`. For the WebSocket `agent` slot that `ws` requires, consider checking `NO_PROXY` / `no_proxy` before constructing the agent and short-circuiting to `undefined` when the target host is excluded. Alternatively, document explicitly that `NO_PROXY` is not respected for Socket Mode connections. How can I resolve this? If you propose a fix, please make it concise.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 071c7da815

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-08T03:28:14Z

+    process.env.https_proxy?.trim() ||
+    process.env.HTTPS_PROXY?.trim() ||
+    process.env.http_proxy?.trim() ||
+    process.env.HTTP_PROXY?.trim() ||


Treat empty lowercase proxy vars as authoritative

Use lower-case proxy env vars as authoritative even when they are intentionally blank. With the current || chain, https_proxy="" (or whitespace) falls back to HTTPS_PROXY, which contradicts the repo’s documented EnvHttpProxyAgent-style precedence and can unexpectedly force Slack traffic through a proxy that operators explicitly disabled for this process.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-08T03:28:14Z

+  if (!proxyUrl) {
+    return undefined;
+  }
+  return new HttpsProxyAgent<string>(proxyUrl);


Guard proxy agent creation against malformed env URLs

Handle invalid proxy env values defensively before constructing the agent. new HttpsProxyAgent(proxyUrl) is called without validation or a fallback path, so a malformed HTTPS_PROXY/HTTP_PROXY value can fail option resolution during startup and prevent the Slack channel from initializing, whereas this path should degrade gracefully to direct connectivity.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4e968f9ef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-08T03:35:50Z

+      return true;
+    }
+    // Exact match or suffix match (with leading dot)
+    if (lower === entry || lower.endsWith(entry.startsWith(".") ? entry : `.${entry}`)) {


Honor leading-dot NO_PROXY for apex slack.com

Treating a leading-dot entry as a pure suffix check misses the apex host: with NO_PROXY=.slack.com, resolveSlackProxyAgent() checks isHostExcludedByNoProxy("slack.com"), but "slack.com".endsWith(".slack.com") is false, so the proxy agent is still applied. This breaks a common exclusion pattern and can force Slack traffic through a proxy even when operators explicitly excluded the Slack domain.

Useful? React with 👍 / 👎.

When HTTPS_PROXY or HTTP_PROXY env vars are set, create an HttpsProxyAgent and pass it as the `agent` option through @slack/bolt → @slack/socket-mode → ws, so the WebSocket upgrade request is tunneled through the proxy. This fixes Slack Socket Mode in environments where all outbound traffic must go through an HTTP CONNECT proxy (e.g. sandboxed containers, corporate networks). Previously the ws library opened a direct connection to wss-primary.slack.com, ignoring proxy env vars entirely. The approach mirrors the existing Discord gateway proxy support (extensions/discord/src/monitor/gateway-plugin.ts) which uses the same https-proxy-agent library. Fixes openclaw#57405

- Check NO_PROXY/no_proxy before creating HttpsProxyAgent; skip proxy when slack.com matches an exclusion entry (exact, suffix, or wildcard). - Wrap HttpsProxyAgent construction in try/catch so malformed proxy URLs degrade to direct connectivity instead of crashing Slack channel init. - Extract resolveProxyUrlFromEnv and isHostExcludedByNoProxy as testable helpers. - Add tests for NO_PROXY exclusion, wildcard, unrelated hosts, and malformed URL resilience.

`.slack.com` in NO_PROXY should match both `slack.com` (apex) and `wss-primary.slack.com` (subdomain). Strip the leading dot before comparison so the suffix check works for both cases.

…amiv

…amiv)

steipete · 2026-04-08T04:39:06Z

Landed via temp rebase onto main.

Gate: pnpm test extensions/slack/src/client.test.ts; committer pre-commit gate (pnpm check)
Land commit: fb32cf822b4bf9680eb216ece32eca1a093c9d89
Merge commit: b4034b32c365c69db0d5ad7ff649bc9920842f40

Thanks @mjamiv!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fb32cf822b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-08T04:42:14Z

+    return undefined;
+  }
+  // Slack Socket Mode connects to these hosts; skip proxy if excluded.
+  if (isHostExcludedByNoProxy("slack.com")) {


Evaluate NO_PROXY against Socket Mode hostnames

resolveSlackProxyAgent() only checks NO_PROXY against the apex slack.com, but Socket Mode WebSockets connect to concrete hosts like wss-primary.slack.com / wss-backup.slack.com. When operators use targeted exclusions such as NO_PROXY=wss-primary.slack.com, this condition never matches, so we still attach HttpsProxyAgent and force the WebSocket through the proxy unexpectedly. That can break connectivity in environments that rely on host-specific bypass rules.

Useful? React with 👍 / 👎.

The Discord extension's gateway plugin relies on @buape/carbon via ws, which doesn't honour HTTPS_PROXY and opens a direct TCP socket to gateway.discord.gg. The sandbox netns blocks direct egress, so the WSS handshake never reaches Discord and the bot loops on close-code 1006. DiscordAccountConfig already exposes a first-class proxy field that the gateway plugin threads through to the ws agent option, so extending the existing Telegram bake to Discord is enough to route the upgrade through the OpenShell proxy. The pattern precedent for this NemoClaw-side workaround is openclaw/openclaw#62878 (Slack Socket Mode), openclaw/openclaw#61541 (WhatsApp), and openclaw/openclaw#41835 (Feishu) — each a mirror of the same ignores-env-vars footgun in a different channel's client lib. Remove once OpenClaw lands an equivalent env-var- honouring fix for the Discord gateway. Fixes #1738  ## Summary  ## Related Issue  ## Changes  ## Type of Change - [X] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification  - [X] `npx prek run --all-files` passes - [X] `npm test` passes - [ ] Tests added or updated for new or changed behavior - [ ] No secrets, API keys, or credentials committed - [ ] Docs updated for user-facing behavior changes - [ ] `make docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ## AI Disclosure  - [X] AI-assisted — tool: Claude Code ---  Signed-off-by: Tinson Lai <tinsonl@nvidia.com>  ## Summary by CodeRabbit * **Bug Fixes** * Discord proxy routing is now aligned with Telegram's proxy routing configuration.  Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>

…amiv

…amiv)

…amiv

…amiv)

…amiv

…amiv)

openclaw-barnacle Bot added channel: slack Channel integration: slack size: S labels Apr 8, 2026

greptile-apps Bot reviewed Apr 8, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

mjamiv mentioned this pull request Apr 8, 2026

Feature: Add global HTTP proxy support via environment variables #43821

Closed

mjamiv and others added 4 commits April 8, 2026 05:34

fix: handle leading-dot NO_PROXY entries matching apex domain

b08d630

`.slack.com` in NO_PROXY should match both `slack.com` (apex) and `wss-primary.slack.com` (subdomain). Strip the leading dot before comparison so the suffix check works for both cases.

fix: honor Slack Socket Mode env proxies (openclaw#62878) (thanks @mj…

fb32cf8

…amiv)

steipete force-pushed the fix/slack-socket-mode-proxy-support branch from bf16be9 to fb32cf8 Compare April 8, 2026 04:38

steipete merged commit b4034b3 into openclaw:main Apr 8, 2026
9 checks passed

openclaw-barnacle Bot added size: M and removed size: S labels Apr 8, 2026

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

This was referenced Apr 8, 2026

Update ghcr.io/openclaw/openclaw Docker tag to v2026.4.8 claytono/infra#1923

Merged

📡 Upstream Digest — 2026-04-08 07:08 UTC curtismercier/openclaw-mods#506

Open

This was referenced Apr 8, 2026

globalThis.fetch (undici) does not honor HTTP_PROXY/HTTPS_PROXY env vars #62181

Closed

docs: add OpenShell deployment guide #54959

Closed

eleqtrizit pushed a commit that referenced this pull request Apr 8, 2026

fix: honor Slack Socket Mode env proxies (#62878) (thanks @mjamiv)

d5207ba

This was referenced Apr 12, 2026

[Feature]: auto-propagate proxy env vars to MCP stdio server child processes #65526

Closed

[Bug]: MCP stdio servers don't inherit NODE_OPTIONS — breaks proxy-only sandbox environments #65525

Open

KeWang0622 mentioned this pull request Apr 12, 2026

fix(mcp-stdio): propagate proxy env vars to child processes #65574

Open

12 tasks

dawei41468 mentioned this pull request Apr 14, 2026

Telegram media download fails through proxy since v2026.4.8 (regression from DNS pinning change) #66245

Closed

laitingsheng mentioned this pull request Apr 21, 2026

fix(sandbox): bake proxy field into Discord account config NVIDIA/NemoClaw#2187

Merged

13 tasks

BingqingLyu mentioned this pull request Apr 28, 2026

fix(mcp-stdio): propagate proxy env vars to child processes BingqingLyu/openclaw#2393

Open

12 tasks

lovewanwan pushed a commit to lovewanwan/openclaw that referenced this pull request Apr 28, 2026

fix: honor Slack Socket Mode env proxies (openclaw#62878) (thanks @mj…

53f0e4e

…amiv)

ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026

fix: honor Slack Socket Mode env proxies (openclaw#62878) (thanks @mj…

cd4ba08

…amiv)

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026

fix: honor Slack Socket Mode env proxies (openclaw#62878) (thanks @mj…

1f81ff2

…amiv)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(slack): honor HTTPS_PROXY for Socket Mode WebSocket connections#62878

fix(slack): honor HTTPS_PROXY for Socket Mode WebSocket connections#62878
steipete merged 4 commits intoopenclaw:mainfrom
mjamiv:fix/slack-socket-mode-proxy-support

mjamiv commented Apr 8, 2026

Uh oh!

greptile-apps Bot commented Apr 8, 2026

Vulnerabilities

Uh oh!

greptile-apps Bot Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Uh oh!

Uh oh!

steipete commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mjamiv commented Apr 8, 2026

Summary

Changes

How it works

Prior art

Production validation

Test plan

Uh oh!

greptile-apps Bot commented Apr 8, 2026

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Uh oh!

greptile-apps Bot Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

steipete commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants