[NemoClaw][Linux][Discord] Discord preset connectivity test fails behind proxy: outbound CONNECT to discord.com / cdn.discordapp.com returns HTTP 403 (curl error 56)

[zNeill]

Description

[Description]
When a NemoClaw sandbox is configured with the Discord policy preset, outbound HTTPS traffic to discord.com and cdn.discordapp.com from inside the sandbox is blocked by the environment’s HTTPS proxy (10.200.0.1:3128) with HTTP 403 on CONNECT, so the Discord preset connectivity tests cannot pass as written. Instead of seeing local policy‑layer behavior (curl blocked by binary whitelist, Node allowed), all traffic is rejected upstream by the proxy. This prevents validating the Discord preset’s intended egress and binary‑whitelist behavior in this environment.

This is an environment‑dependent failure of the documented test case (proxy policy vs. preset expectations), not a NemoClaw gateway crash, but it blocks the QA scenario and may warrant either (a) relaxing proxy rules in the test lab or (b) updating the test plan to account for proxy‑restricted deployments.

[Environment]
Device: discord-pre sandbox host
OS: Linux (sandbox container base; NemoClaw/OpenShell default)
Architecture: x86_64
Docker: Standard Docker / container runtime used by NemoClaw sandbox
NemoClaw: v0.0.38
OpenShell CLI: v0.0.32
OpenClaw: v2026.x (exact minor version not required for this proxy behavior)
Network: Outbound HTTPS forced through HTTP proxy http://10.200.0.1:3128 via https_proxy env var, with no_proxy=localhost,127.0.0.1,::1,10.200.0.1

[Steps to Reproduce]

Precondition: NemoClaw sandbox is running and reachable; environment forces HTTPS through 10.200.0.1:3128 proxy.

1. On the host, ensure the sandbox is up and then add the Discord policy preset:bashnemoclaw policy-add

   When prompted, select the “discord” preset. Policy version increments successfully.

2. 
   Connect into the sandbox:bashnemoclaw connect

   You land at a sandbox@...:~$ shell.

3. 
   Inside the sandbox, verify that proxy env vars are set (as observed):bashecho "$https_proxy" echo "$HTTPS_PROXY" echo "$no_proxy"

   Expected (or similar):texthttp://10.200.0.1:3128 http://10.200.0.1:3128 localhost,127.0.0.1,::1,10.200.0.1

4. 
   Still inside the sandbox, run the Discord connectivity checks with verbose output:bashcurl -v --max-time 10 https://discord.com
5. 
   Then:bashcurl -v --max-time 10 https://cdn.discordapp.com

[Expected Behavior]

Per the Discord preset test case specification:

• Step 4: curl -s --max-time 10 https://discord.com inside the sandbox should be blocked locally by NemoClaw/OpenClaw policy because curl is not in the binary whitelist for Discord. This is usually represented as “returns 000” or equivalent local rejection (no external CONNECT attempt).
• Step 5: https://cdn.discordapp.com should be reachable via Node for GET‑only access (status 200 or 301) when using the allowed Node binaries; curl behavior is not the primary signal here, but the policy assumes CDN access is possible when the environment allows it.

In other words, the test is meant to validate sandbox‑level behavior:

• curl blocked by binary whitelist when hitting Discord,
• Node allowed where specified,
• and external network conditions assumed permissive enough that Discord/CDN allow basic HTTPS.

[Actual Behavior]

With the current proxy‑enforced environment:

• Both curl commands go through the proxy:text* Uses proxy env variable https_proxy == 'http://10.200.0.1:3128' * Trying 10.200.0.1:3128... * CONNECT tunnel: HTTP/1.1 negotiated * Establish HTTP proxy tunnel to discord.com:443 > CONNECT discord.com:443 HTTP/1.1 > Host: discord.com:443 > User-Agent: curl/8.14.1 > Proxy-Connection: Keep-Alive ... < HTTP/1.1 403 Forbidden < Content-Type: application/json < Content-Length: 84 < Connection: close * * CONNECT tunnel failed, response 403 * closing connection #0 curl: (56) CONNECT tunnel failed, response 403

  And similarly for cdn.discordapp.com:text> CONNECT cdn.discordapp.com:443 HTTP/1.1 ... < HTTP/1.1 403 Forbidden ... curl: (56) CONNECT tunnel failed, response 403

• 
  echo $? after either command returns 56 (curl error 56: “failure in receiving network data / CONNECT tunnel failed, response 403”).simplified+1

So:

• Outbound HTTPS from the sandbox is reaching the proxy.
• The proxy is actively denying CONNECT to discord.com:443 and cdn.discordapp.com:443 with HTTP 403.
• The test does not exhibit a local “blocked by binary whitelist (000)” behavior; instead, both domains are blocked at the egress proxy, and the sandbox cannot talk to Discord at all, regardless of binary whitelist.

[Impact on Test Case]

• The Discord preset test’s expectations for steps 4–5 cannot be validated in this environment because the external proxy’s policy supersedes NemoClaw/OpenClaw’s sandbox policy behavior.
• Specifically:
  • You cannot observe “curl blocked by sandbox binary whitelist” vs “Node allowed” distinctions; the proxy 403s both equally.
  • Any higher‑level behavior that assumes Discord/CDN reachability (e.g., ws‑proxy‑fix or WebSocket gateway checks) will also fail for environmental reasons, not due to NemoClaw policy bugs.
• This blocks QA from asserting that the Discord preset behaves as documented, unless the environment is changed or the test is marked as “not applicable behind a proxy that denies Discord”.

[Suggested Resolution / Next Steps]

There are two complementary tracks:

1. Environment / Infra change (preferred for full validation):
   • Update the HTTP(S) proxy policy for the discord-pre lab environment to allow: textCONNECT discord.com:443 CONNECT cdn.discordapp.com:443

     at least from the NemoClaw sandbox egress IPs, so the Discord preset test can run as written.

2. Test‑plan / Documentation update:
   • In NemoClaw/OpenShell QA docs for the Discord preset test case, add a note:
     • “This test assumes outbound HTTPS to discord.com and cdn.discordapp.com is permitted by the host’s egress policy. In environments where an external proxy returns 4xx on CONNECT for these domains (e.g., HTTP 403), step 4–5 will fail with curl error 56, and the test should be marked ‘blocked by network policy’, not ‘sandbox policy bug’.”

Optionally, file a separate, lower‑priority feature request:

• Allow the Discord preset test tooling (or nemoclaw diagnostics) to detect and report “proxy 403 on CONNECT for Discord domains” explicitly, so users can distinguish “corporate proxy blocked Discord” from “sandbox policy mis‑configuration” without having to read raw curl -v output.

Bug Details

Field	Value
Priority	Unprioritized
Action	Dev - Open - To fix
Disposition	Open issue
Module	Machine Learning - NemoClaw
Keyword	NemoClaw, NEMOCLAW_GH_SYNC_APPROVAL, NemoClaw-SWQA-RelBlckr-Recommended

---

[NVB#6173802]