test(web): pnpm/Node cannot fetch npm deps through the sandbox proxy, blocking pnpm run test:web and check-dependency-age

[markturansky]

Summary

During an autonomous reconcile checkpoint on a lean build/test/lint sandbox, the web unit tests (pnpm run test:web) and the make check sub-target check-dependency-age could not run because the JS dependency install cannot complete. The blocker is not the network in general — it is a Node/undici proxy incompatibility:

• The sandbox reaches the internet only through an HTTP proxy (HTTPS_PROXY).
• curl downloads npm metadata and tarballs through that proxy fine (verified: registry.npmjs.org package metadata and .tgz tarballs, including a 9 MB PatternFly tarball, return 200).
• Go module downloads through GOPROXY also work.
• pnpm / Node's built-in fetch (undici) fails. With NODE_USE_ENV_PROXY=1, fetch() to a registry tarball throws TypeError: fetch failed with cause Request was cancelled.; without the env proxy it is UND_ERR_CONNECT_TIMEOUT. Every pnpm tarball GET reports error (0) and the install aborts with downloaded 0, added 0.

Net effect: pnpm install (and therefore make lint / pnpm run test:web / check-dependency-age, which walk every lockfile entry over the network) cannot run in this class of environment, even though the Go toolchain and curl can.

The pre-seeded pnpm store is also insufficient for a fully offline install (no packument metadata cache; pnpm install --offline still attempts network).

Proposed decision (pick one or more)

1. Ship a complete offline pnpm store / cache (store + metadata) pinned to the committed pnpm-lock.yaml, so pnpm install --offline --frozen-lockfile succeeds with zero network in lean sandboxes.
2. Provide a proxy-compatible fetch path for pnpm/Node in the sandbox image (e.g., a working undici EnvHttpProxyAgent/ProxyAgent configuration, or a Node version where NODE_USE_ENV_PROXY tunnels correctly through the squid proxy that curl already uses).
3. Vendor the web dependencies (or a CI cache artifact) that the sandbox can restore, decoupling web verification from live npm access.

Verified in this run despite the blocker

• Go side is fully green at be9be50: go build ./..., go test ./... (control-plane, cli, cli-generator, sdk-generator), api-server go build/go vet, and golangci-lint for control-plane, api-server, and cli (0 issues each).
• make check sub-targets check-forbidden-terms, check-dependency-pins, check-ci-components, check-openshell-version, and test-release-bundle all pass. Only check-dependency-age fails, for the same npm-over-proxy reason above.

Why this needs a decision

It is an environment/tooling tradeoff (image contents, offline strategy, or Node proxy config), not a code change in the product. A maintainer should choose the approach so future reconcile runs can execute pnpm run test:web and check-dependency-age.

Filed per the reconcile skill: GitHub issues are the single source of truth for deferred gaps.

[markturansky]

Triage — Robert (build agent)

Type: kind/bug — pnpm/Node's undici fetch fails through the sandbox HTTP proxy, blocking web tests and check-dependency-age in lean sandboxes.

Severity: priority/important-longterm — Go-side verification is fully green; this blocks only web-side test coverage in proxy-only environments.

Duplicates/Related: None found.

Missing information: None — root cause (Node/undici EnvHttpProxyAgent incompatibility with the squid proxy) is fully documented with reproduction details.

Next action: Maintainer chooses among the three proposed approaches: (1) complete offline pnpm store, (2) proxy-compatible Node fetch configuration, or (3) vendored/cached web dependencies. This is an environment/tooling decision, not a code fix.