Gmail access in sandbox failed, but it passed at host.

Agent Diagnostic

Hi experts, does Openshell/Nemoclaw support gmail connection?

I run “curl -v -x http://10.200.0.1:3128/ imaps://imap.gmail.com:993” In the sandbox but it failed,
Run "curl -v imaps://imap.gmail.com:993" successful on the host.
details:
in the sandbox:
root@thorw-j6kn08:/home/horde/projects/hand# nemoclaw my-assistant connect

✓ Connecting to sandbox 'my-assistant'
Inside the sandbox, run openclaw tui to start chatting with the agent.
Type exit (or Ctrl-D) to return to the host shell.

sandbox@my-assistant:~$ curl -v -x http://10.200.0.1:3128/ imaps://imap.gmail.com:993

• Uses proxy env variable no_proxy == 'localhost,127.0.0.1,::1,10.200.0.1'
• Trying 10.200.0.1:3128...
• Connected to 10.200.0.1 (10.200.0.1) port 3128 (#0)
• allocate connect buffer
• Establish HTTP proxy tunnel to imap.gmail.com:993

CONNECT imap.gmail.com:993 HTTP/1.1
Host: imap.gmail.com:993
User-Agent: curl/7.88.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 Connection Established
<

• CONNECT phase completed
• CONNECT tunnel established, response 200
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• CAfile: /etc/openshell-tls/ca-bundle.pem
• CApath: /etc/ssl/certs
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
• Server certificate:
• subject: CN=imap.gmail.com
• start date: Jan 1 00:00:00 1975 GMT
• expire date: Jan 1 00:00:00 4096 GMT
• subjectAltName: host "imap.gmail.com" matched cert's "imap.gmail.com"
• issuer: CN=OpenShell Sandbox CA; O=OpenShell
• SSL certificate verify ok.
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• old SSL session ID is stale, removing

on the host:
root@thorw-j6kn08:/home/horde/projects/hand# curl -v imaps://imap.gmail.com:993

• Trying 74.125.137.109:993...
• Connected to imap.gmail.com (74.125.137.109) port 993 (#0)
• CAfile: /etc/ssl/certs/ca-certificates.crt
• CApath: /etc/ssl/certs
• TLSv1.0 (OUT), TLS header, Certificate Status (22):
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.2 (IN), TLS header, Certificate Status (22):
• TLSv1.3 (IN), TLS handshake, Server hello (2):
• TLSv1.2 (IN), TLS header, Finished (20):
• TLSv1.2 (IN), TLS header, Supplemental data (23):
• TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
• TLSv1.3 (IN), TLS handshake, Certificate (11):
• TLSv1.3 (IN), TLS handshake, CERT verify (15):
• TLSv1.3 (IN), TLS handshake, Finished (20):
• TLSv1.2 (OUT), TLS header, Finished (20):
• TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.2 (OUT), TLS header, Supplemental data (23):
• TLSv1.3 (OUT), TLS handshake, Finished (20):
• SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
• Server certificate:
• subject: CN=imap.gmail.com
• start date: Mar 30 08:36:45 2026 GMT
• expire date: Jun 22 08:36:44 2026 GMT
• subjectAltName: host "imap.gmail.com" matched cert's "imap.gmail.com"
• issuer: C=US; O=Google Trust Services; CN=WR2
• SSL certificate verify ok.
• TLSv1.2 (IN), TLS header, Supplemental data (23):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
• old SSL session ID is stale, removing
• TLSv1.2 (IN), TLS header, Supplemental data (23):
  < * OK Gimap ready for requests from 72.25.66.10 d2e1a72fcca58-82f621abfbamb591652142b3a
• TLSv1.2 (OUT), TLS header, Supplemental data (23):

A001 CAPABILITY

• TLSv1.2 (IN), TLS header, Supplemental data (23):
  < * CAPABILITY IMAP4rev1 UNSELECT IDLE NAMESPACE QUOTA ID XLIST CHILDREN X-GM-EXT-1 XYZZY SASL-IR AUTH=XOAUTH2 AUTH=PLAIN AUTH=PLAIN-CLIENTTOKEN AUTH=OAUTHBEARER
  < A001 OK Thats all she wrote! d2e1a72fcca58-82f621abfbamb591652142b3a
• TLSv1.2 (OUT), TLS header, Supplemental data (23):

A002 LIST "" *

• TLSv1.2 (IN), TLS header, Supplemental data (23):
  < A002 BAD Unknown command d2e1a72fcca58-82f621abfbamb591652142b3a
• TLSv1.2 (OUT), TLS header, Supplemental data (23):

A003 LOGOUT

• TLSv1.2 (IN), TLS header, Supplemental data (23):
  < * BYE Logout Requested d2e1a72fcca58-82f621abfbamb591652142b3a
  < A003 OK Quoth the raven, nevermore... d2e1a72fcca58-82f621abfbamb591652142b3a
• Closing connection 0
• TLSv1.2 (OUT), TLS header, Supplemental data (23):
• TLSv1.3 (OUT), TLS alert, decode error (562):
  curl: (21) Quote command returned error

I have enable the policy and approve the access in the "openshell term":
network_policies:
allow_imap_gmail_com_993:
name: allow_imap_gmail_com_993
endpoints:
- host: imap.gmail.com
port: 993
binaries:
- path: /usr/bin/python3.12
- path: /usr/bin/curl

My question is: does OpenShell support gmail access or just I misuse it.

Description

Trying to access gmail via imap.gmail.com in the sandbox but failed. at host it is all OK.

Reproduction Steps

1. run “curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh” to install openshell
2. openshell sandbox create --from openclaw --forward 18789 -- openclaw onboard
3. openshell policy get/set, adding gmail network_policies.
4. run on host: "curl -v imaps://imap.gmail.com:993"
5. openshell sandbox connect xxx, into the sandbox.
6. run "curl -v -x http://10.200.0.1:3128/ imaps://imap.gmail.com:993" in the sandbox.
7. check the log difference.

Environment

Ubuntu 22.04.5 LTS \n \l
Driver Version: 575.57.08 CUDA Version: 12.9
openshell 0.0.37-dev.29+gbb5bdb48

Logs

Agent-First Checklist

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why

Beginnen Sie damit, den Sandbox-Befehl curl -v -x http://10.200.0.1:3128/ imaps://imap.gmail.com:993 zu reproduzieren, und vergleichen Sie dessen Proxy- und TLS-Ausgabe mit der des Host-Befehls. Prüfen Sie die konfigurierte Richtlinie allow_imap_gmail_com_993 und ermitteln Sie, ob der Gmail-IMAP-Zugriff unterstützt oder falsch konfiguriert ist; abgeschlossen ist die Aufgabe, wenn die Ursache identifiziert und die erforderliche Konfiguration dokumentiert oder korrigiert wurde.