[Bug]: BYOK offline test still fails with lowercase proxy variables — the #166 fixture fix covered only test/smoke.test.mjs

[jimpablo]

Product or interface

Source build or repository tooling

Version

Source commit e3724a1 (main, 2026-09-19). Node.js v24.19.0, pnpm 9.12.0 (via Corepack).

Platform

macOS

OS version and architecture

macOS 26.6.2 (build 25G83), arm64

Issue area

Build / CI / source distribution

Desktop log upload ID (optional)

No response

Steps to reproduce

Summary: follow-up to #154 / #166. The smoke fixture now clears all proxy variables (both cases plus NO_PROXY), but test/byok.test.mjs still blanks only the uppercase three. With a lowercase proxy variable set in the environment, pnpm test:byok fails on its offline-audit assertion and pnpm verify stops at the test:byok gate. CI is unaffected because runners have no proxy variables. Root cause and a suggested fix are in "Expected and actual behavior" below.

Reproduction (synthetic unreachable address; no real proxy needed):

1. Checkout main at e3724a1; pnpm install --frozen-lockfile and pnpm build succeed.
2. Controlled experiments, each with every other proxy variable unset:
   • HTTPS_PROXY=http://127.0.0.1:9 pnpm test:byok → 1/1 pass (the fixture blanks the uppercase variable).
   • https_proxy=http://127.0.0.1:9 pnpm test:byok → 1/1 fail, same network-attempt audit signature as [Bug]: Offline smoke tests fail when ambient proxy environment variables are set #154.
3. Full pnpm verify with real ambient proxy variables (uppercase and lowercase set): 13 of 14 gates pass — including test:smoke 15/15 with the new regression suite from test: isolate offline smoke children from ambient proxies #166 — only test:byok fails.

Expected and actual behavior

Expected: the isolation #166 gave the smoke fixture applies wherever the offline harness spawns CLI children. test/byok.test.mjs:164-166 clears only HTTP_PROXY / HTTPS_PROXY / ALL_PROXY (uppercase).

Actual: with any lowercase proxy variable ambient, test:byok fails at the after-hook audit assertion (test/byok.test.mjs:142).

Analysis: same mechanism as #154. resolveTuiProxyConfiguration (packages/tui/src/cli/network-proxy.ts:31-49) is case-insensitive, so a lowercase variable still activates proxy mode; configureTuiNetworkProxy then sets the global undici dispatcher and calls undici.install(), replacing the fetch-level offline mock preloaded by test/network-deny.mjs. Each CLI child the byok scenario spawns then attempts its background managed fetches (for example the models.dev catalog refresh started by the ProviderPresetCatalog constructor) through the ProxyAgent at socket level, where the prototype-level hook records every attempt.

Worth noting: the scenario stays functionally green — all provider/exec commands exit 0 and the local fixture server (allowlisted via MCODE_TEST_ALLOWED_ORIGIN) still receives every request. Only the offline audit is polluted (about a dozen recorded attempts), which is likely why this survives unnoticed on machines without ambient proxies.

Suggested fix: mirror 25d9901's smoke change in the byok fixture — blank HTTP_PROXY / HTTPS_PROXY / ALL_PROXY / NO_PROXY and their four lowercase variants in test/byok.test.mjs's child env. Extracting the clearing into one helper shared by both fixtures would prevent the next divergence. Per the contribution policy I'm not attaching a PR as a non-collaborator; happy to test any direction you prefer.

Related: #154 (original report), #166 (smoke fixture fix).

Redacted error summary

✖ BYOK runs without managed login and resumes its saved conversation (10886ms)
  AssertionError [ERR_ASSERTION]: Error: network-attempt
      at denied (file:///…/test/network-deny.mjs:19:56)
      at Socket.connect (file:///…/test/network-deny.mjs:42:10)
      at Object.connect (node:net:254:17)
      … minified undici dispatcher frames in dist/chunks/
  true !== false  (test/byok.test.mjs:142 — after-hook asserts the audit file does not exist)

# All CLI subcommands in the scenario exit 0; only the offline-audit assertion fails.
# Synthetic address 127.0.0.1:9 used in the controlled experiments; no real proxy, credential, or private data involved.

Screenshots

No response

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.

[hetaoBackend]

Thanks for the precise reproduction. The fix is in #172: smoke and BYOK now share isolation for all eight uppercase/lowercase HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY variables, with ten BYOK regression cases. Production proxy handling and the outbound-network audit remain unchanged.

All 14 local verification gates passed, and the Linux/macOS/Windows CI reports confirm smoke and BYOK passed. These are offline fixture checks, not live-provider or real-proxy acceptance. The PR is open for review and has not been merged or released.

[hetaoBackend]

#172 has now merged as 497f99c1fdf6b747bd82fc521becb31d2d805833. The shared offline-proxy isolation fix is in the default branch. Its full local verification and Linux/macOS/Windows CI passed as reported above; those offline checks do not establish live-provider or real-proxy acceptance, and a source merge alone does not establish npm release delivery.

[jimpablo]

Confirmed fixed in the original environment. After updating to main (81b666a, including 497f99c) and rebuilding, pnpm test:byok passes 11/11 and a full pnpm verify passes all 14 gates with my real ambient proxy variables still set (uppercase and lowercase, no env -u workaround). Thanks for extracting the shared isolation into test/offline-environment.mjs.