test(onboard): exercise registry HTTPS proxy tunnel

[cv]

Summary

The managed registry proxy test now exercises the production-like HTTPS proxy route used by the registry client. Undici 8.10.0 sends an HTTP target as a plain proxy request, so the previous synthetic HTTP target could never reach the test's CONNECT handler and timed out in coverage shard 8.

Changes

• Use an HTTPS registry target so the loopback proxy observes a CONNECT tunnel.
• Abort the test request once that stable behavior boundary is observed.
• Assert both the AbortError rejection and registry.invalid:443 authority.
• Destroy the accepted test socket during deterministic finally cleanup.
• Leave production registry-fetch behavior unchanged.

Stacked landing

This test-only PR is temporarily based on #8175 so CI evaluates the MCP audit fix and this Undici test correction together without creating a circular red dependency. Its public diff remains one test file. Once this PR is approved and green, it should merge into #8175; #8175 can then be revalidated and merged to main when its refreshed exact head is approved and green.

Auto-merge is intentionally disabled.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes one deterministic test route and does not change a public API, CLI, configuration, default, error, or supported product behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The nine-category exact-head review passed at 405bdd6c09e60205003cb032b5a1f7f088c9799d; the signed synchronization commit is empty and preserves reviewed tree c3ad47e26a5387ce62fe95116730cc2777456719. This is a loopback-only test change with no production, dependency, credential, or external-network behavior.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: At exact head 405bdd6c09e60205003cb032b5a1f7f088c9799d, the PR still changes only the loopback HTTPS CONNECT fixture. The signed synchronization commit is empty and has the same tree as reviewed parent 21ed6d13a. No production or user-visible behavior changed; no explanatory comments or test titles changed; the writing review found no findings. git diff --check passed and the focused Vitest file passed 5/5. A docs build is not applicable.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — exact-head focused Vitest passed 5/5; the prior exact behavior correction passed coverage shard 8 in 8m47s.
• Exact-head CLI TypeScript check and git diff --check passed.
• Applicable broad gate passed — exact-head stacked CI is authoritative and pending.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com
Signed-off-by: Julie Yaunches jmyaunch@gmail.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The managed image registry proxy test now uses HTTPS, passes an abort signal to fetch, aborts after CONNECT, destroys the proxy socket, and verifies port 443.

Changes

Managed image registry proxy

Layer / File(s)	Summary
HTTPS tunnel and abort validation src/lib/onboard/managed-image-registry-fetch.test.ts	The test aborts the fetch after recording the CONNECT target, destroys the proxy socket, expects an AbortError, and verifies the tunnel targets registry.invalid:443.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: testing the registry HTTPS proxy tunnel.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/managed-image-registry-fetch-timeout

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 405bdd6 in the fix/managed-image-re... branch remains at 96%, unchanged from commit 6a838ff in the fix/mcp-tool-runtime... branch.

---

_{Updated August 04, 2026 01:47 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/managed-image-registry-fetch.test.ts`:
- Around line 41-47: Update the test around the CONNECT handler and
session.fetchImpl rejection: keep the tunnel socket open while awaiting the
fetch failure, assert that the caught error has name "AbortError" from the
default abort reason, and destroy the socket in a finally block to ensure
cleanup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2a70ba63-e17e-4f9f-9b8d-1115a12664c6

📥 Commits

Reviewing files that changed from the base of the PR and between 15069f9 and 785703c.

📒 Files selected for processing (1)

• src/lib/onboard/managed-image-registry-fetch.test.ts