From 88299bacb728aac0d12806298539bbba8649b06d Mon Sep 17 00:00:00 2001 From: "openclaw-docs-sync[bot]" Date: Mon, 4 May 2026 03:57:44 +0000 Subject: [PATCH] chore(sync): mirror docs from openclaw/openclaw@f42a2c738c372bfb2d34cb92f7ffe27146c77c7e --- .openclaw-sync/source.json | 4 ++-- docs/cli/proxy.md | 1 + docs/security/network-proxy.md | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json index be4889082..843ff3515 100644 --- a/.openclaw-sync/source.json +++ b/.openclaw-sync/source.json @@ -1,5 +1,5 @@ { "repository": "openclaw/openclaw", - "sha": "484195d14e6d22824b832dcaa92c05498e7ece42", - "syncedAt": "2026-05-04T03:27:42.742Z" + "sha": "f42a2c738c372bfb2d34cb92f7ffe27146c77c7e", + "syncedAt": "2026-05-04T03:55:38.997Z" } diff --git a/docs/cli/proxy.md b/docs/cli/proxy.md index 30237dd66..f60f52b68 100644 --- a/docs/cli/proxy.md +++ b/docs/cli/proxy.md @@ -68,6 +68,7 @@ semantics. - `start` defaults to `127.0.0.1` unless `--host` is set. - `run` starts a local debug proxy and then runs the command after `--`. +- The debug proxy's direct upstream forwarding opens upstream sockets for diagnostics. When OpenClaw managed proxy mode is active, direct forwarding for proxy requests and CONNECT tunnels is disabled by default; set `OPENCLAW_DEBUG_PROXY_ALLOW_DIRECT_CONNECT_WITH_MANAGED_PROXY=1` only for approved local diagnostics. - `validate` exits with code 1 when proxy config or destination checks fail. - Captures are local debugging data; use `openclaw proxy purge` when finished. diff --git a/docs/security/network-proxy.md b/docs/security/network-proxy.md index e8439fdc2..72a26b9cc 100644 --- a/docs/security/network-proxy.md +++ b/docs/security/network-proxy.md @@ -194,6 +194,7 @@ proxy: - The proxy improves coverage for process-local JavaScript HTTP and WebSocket clients, but it is not an OS-level network sandbox. - Raw `net`, `tls`, and `http2` sockets, native addons, and child processes may bypass Node-level proxy routing unless they inherit and respect proxy environment variables. - IRC is a raw TCP/TLS channel outside operator-managed forward proxy routing. In deployments that require all egress through that forward proxy, set `channels.irc.enabled=false` unless direct IRC egress is explicitly approved. +- The local debug proxy is diagnostic tooling and its direct upstream forwarding for proxy requests and CONNECT tunnels is disabled by default while managed proxy mode is active; enable direct forwarding only for approved local diagnostics. - User local WebUIs and local model servers should be allowlisted in the operator proxy policy when needed; OpenClaw does not expose a general local-network bypass for them. - Gateway control-plane proxy bypass is intentionally limited to `localhost` and literal loopback IP URLs. Use `ws://127.0.0.1:18789`, `ws://[::1]:18789`, or `ws://localhost:18789` for local direct Gateway control-plane connections; other hostnames route like ordinary hostname-based traffic. - OpenClaw does not inspect, test, or certify your proxy policy.