[Bug]: BYOK offline test still fails with lowercase proxy variables — the #166 fixture fix covered only test/smoke.test.mjs #171

Product or interface

Source build or repository tooling

Version

Source commit e3724a1 (main, 2026-09-19). Node.js v24.19.0, pnpm 9.12.0 (via Corepack).

Platform

macOS

OS version and architecture

macOS 26.6.2 (build 25G83), arm64

Issue area

Build / CI / source distribution

Desktop log upload ID (optional)

No response

Steps to reproduce

Summary: follow-up to #154 / #166. The smoke fixture now clears all proxy variables (both cases plus NO_PROXY), but test/byok.test.mjs still blanks only the uppercase three. With a lowercase proxy variable set in the environment, pnpm test:byok fails on its offline-audit assertion and pnpm verify stops at the test:byok gate. CI is unaffected because runners have no proxy variables. Root cause and a suggested fix are in "Expected and actual behavior" below.

Reproduction (synthetic unreachable address; no real proxy needed):

1. Checkout main at e3724a1; pnpm install --frozen-lockfile and pnpm build succeed.
2. Controlled experiments, each with every other proxy variable unset:
   • HTTPS_PROXY=http://127.0.0.1:9 pnpm test:byok → 1/1 pass (the fixture blanks the uppercase variable).
   • https_proxy=http://127.0.0.1:9 pnpm test:byok → 1/1 fail, same network-attempt audit signature as [Bug]: Offline smoke tests fail when ambient proxy environment variables are set #154.
3. Full pnpm verify with real ambient proxy variables (uppercase and lowercase set): 13 of 14 gates pass — including test:smoke 15/15 with the new regression suite from test: isolate offline smoke children from ambient proxies #166 — only test:byok fails.

Expected and actual behavior

Expected: the isolation #166 gave the smoke fixture applies wherever the offline harness spawns CLI children. test/byok.test.mjs:164-166 clears only HTTP_PROXY / HTTPS_PROXY / ALL_PROXY (uppercase).

Actual: with any lowercase proxy variable ambient, test:byok fails at the after-hook audit assertion (test/byok.test.mjs:142).

Analysis: same mechanism as #154. resolveTuiProxyConfiguration (packages/tui/src/cli/network-proxy.ts:31-49) is case-insensitive, so a lowercase variable still activates proxy mode; configureTuiNetworkProxy then sets the global undici dispatcher and calls undici.install(), replacing the fetch-level offline mock preloaded by test/network-deny.mjs. Each CLI child the byok scenario spawns then attempts its background managed fetches (for example the models.dev catalog refresh started by the ProviderPresetCatalog constructor) through the ProxyAgent at socket level, where the prototype-level hook records every attempt.

Worth noting: the scenario stays functionally green — all provider/exec commands exit 0 and the local fixture server (allowlisted via MCODE_TEST_ALLOWED_ORIGIN) still receives every request. Only the offline audit is polluted (about a dozen recorded attempts), which is likely why this survives unnoticed on machines without ambient proxies.

Suggested fix: mirror 25d9901's smoke change in the byok fixture — blank HTTP_PROXY / HTTPS_PROXY / ALL_PROXY / NO_PROXY and their four lowercase variants in test/byok.test.mjs's child env. Extracting the clearing into one helper shared by both fixtures would prevent the next divergence. Per the contribution policy I'm not attaching a PR as a non-collaborator; happy to test any direction you prefer.

Related: #154 (original report), #166 (smoke fixture fix).

Redacted error summary

✖ BYOK runs without managed login and resumes its saved conversation (10886ms)
  AssertionError [ERR_ASSERTION]: Error: network-attempt
      at denied (file:///…/test/network-deny.mjs:19:56)
      at Socket.connect (file:///…/test/network-deny.mjs:42:10)
      at Object.connect (node:net:254:17)
      … minified undici dispatcher frames in dist/chunks/
  true !== false  (test/byok.test.mjs:142 — after-hook asserts the audit file does not exist)

# All CLI subcommands in the scenario exit 0; only the offline-audit assertion fails.
# Synthetic address 127.0.0.1:9 used in the controlled experiments; no real proxy, credential, or private data involved.

Screenshots

No response

Before submitting

• I have searched existing issues.
• I have included my version and removed sensitive information.