fix(sandbox): corepack's download prompt hangs the dev server forever

[pedrofrxncx]

The bug

Every pod in the tenant-electrolux-prod warm pool has a cloned repo and a full node_modules, and a dev task that has never produced a byte of output:

sandbox  79  0.0  sh -c cd /app/repo && yarn run dev
sandbox  80  0.0  node /usr/local/bin/yarn run dev

/usr/local/bin/yarn is the corepack shim. Its first line is process.env.COREPACK_ENABLE_DOWNLOAD_PROMPT ??= '1', so when it has to fetch a yarn version it asks:

! Corepack is about to download https://registry.yarnpkg.com/yarn/-/yarn-1.22.22.tgz
? Do you want to continue? [Y/n]

Tasks spawn on a PTY, so corepack sees a tty, prints the prompt, and blocks on stdin. Nothing times it out. The dev port never opens, so the preview sits on "Starting your preview…" until the sandbox is reaped — and a warm pool of these is a pool of pods that are warm in every respect except the one that matters.

Verified on the live pod: with COREPACK_ENABLE_DOWNLOAD_PROMPT=0, yarn --version returns instantly.

The fix

install.go and SpawnStep already pin COREPACK_ENABLE_STRICT=0 / COREPACK_ENABLE_DOWNLOAD_PROMPT=0 — that's why install succeeded while dev hung. buildEnv in the task manager is the third spawner and was missed; it's the one that runs the dev server, /exec, and /bash.

Two lines in buildEnv, seeded before extra/overrides so caller env still wins.

Testing

• TestBuildEnvSilencesCorepackPrompt — asserts both vars on the pty and pipe paths, and that caller overrides survive.
• go build ./... && go test ./internal/proc/ ./internal/setup/ ./internal/routes/ pass.

Only affects repos whose package manager is a corepack shim (yarn, pnpm). npm/bun were never blocked, which is why this hid until a yarn tenant showed up.

---

Summary by cubic

Prevent dev server hangs caused by corepack’s interactive download prompt by disabling it in task-run envs. Repos using yarn/pnpm now start previews reliably.

• Bug Fixes
  • Set COREPACK_ENABLE_STRICT=0 and COREPACK_ENABLE_DOWNLOAD_PROMPT=0 in buildEnv before applying overrides.
  • Covers PTY and pipe spawns; caller env still wins.
  • Added TestBuildEnvSilencesCorepackPrompt.

^{Written for commit 688d31e. Summary will update on new commits.}