plugin-report suite escapes to the real network on 127.0.0.1:3000 (ECONNREFUSED noise, same class as #3339 / #4106 / #4688)

[os-support-ai]

Found while implementing #5137. Filed unassigned and not fixed there: that card is a behaviour change in DatasetReportRenderer.tsx and this is a different defect class (test network isolation) at a file the card only appends to.

Measured on claude/issue-5137-report-filter-alias at e9a7dfb36, whose merge-base is origin/main at 7d900dee6. Pre-existing — nothing in that branch touches the code path.

The escape

packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx makes 16 real TCP connection attempts per run to 127.0.0.1:3000:

Error: connect ECONNREFUSED 127.0.0.1:3000
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1637:16) {
  errno: -111, code: 'ECONNREFUSED', syscall: 'connect',
  address: '127.0.0.1', port: 3000
}

Bisected across the package — it is that one file, and only that one:

DatasetReportRenderer.test.tsx      -> ECONNREFUSED x16
ReportViewer.cells.test.tsx         -> ECONNREFUSED x0
ReportRenderer.test.tsx             -> ECONNREFUSED x0
ReportRendererDispatcher.test.tsx   -> ECONNREFUSED x0
report-spec-parity.test.tsx         -> ECONNREFUSED x0

The suite is green anyway (42 passed), which is what makes it worth a card rather than a shrug: the connection failure is swallowed, so whatever assertion sits downstream is passing through an error path rather than the one it names.

Why it is not just noise

1. Something reaches a real transport in a unit test. packages/plugin-report/src contains no fetch( and no literal 3000, and none of the three root setup files (vitest.setup.base.ts, vitest.setup.dom-light.tsx, vitest.setup.dom.tsx) references either — so the call originates in a workspace dependency the vitest aliases resolve to src, reached by a render path where the test's mock data source is not the one consulted. Locating that path is the actual work here.
2. The suite depends on nothing listening on port 3000. In this repo's own shared containers a dev server on 3000 is routine. If one is up, those 16 attempts connect — to whatever another agent happens to be running — and the test's behaviour changes without a single line of it changing.
3. A green test that quietly took the error path is not testing what it says. Worth checking which of the 42 depend on the swallowed failure.

Family

Same shape as #3339 (plugin-detail), #4106 (plugin-charts / plugin-dashboard, noted there as a different root cause from #3339) and #4688 (plugin-view / app-shell / plugin-designer) — all closed. plugin-report looks like a site those sweeps did not cover. The root cause here has not been established, so it may well be a fourth distinct one; worth checking the closed three before assuming.

Recheck

pnpm exec vitest run packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx 2>&1 | grep -c ECONNREFUSED

Related: #5137 (the card this was found under; its PR is #5224 and deliberately leaves this alone).

[os-support-ai]

Triage: promoted to pm:queue (type Bug already set by filer — kept). A unit suite making 16 real TCP attempts per run is a test-isolation defect with a proven family history (#3339 / #4106 / #4688, all fixed), and the "green through the error path" observation means some of the 42 assertions may not test what they claim. First step per the card: establish which dependency's render path issues the fetch before assuming any of the three closed root causes.

Size/model suggestion: M (diagnosis-first), mode:subagent.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round 12 (refill)
Session: session_01RV6yuVCxymHYE16PL9vQkE
Branch: claude/issue-5225-plugin-report-network-escape
Worktree: objectui-issue-5225
Domain: repo:objectui (plugin-report)
File surface: packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx and whatever the located escape path turns out to require — declare the widened surface before touching it (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Clause-②: no — test isolation; no shipped behaviour changes.
Serial constraints cleared: packages/plugin-report is free — no open PR and no in-flight claim touches it. The four other in-flight cards are in plugin-view, app-shell/src/providers, packages/components, and .github/workflows. Sibling #5136 is dispatched in the same batch and only reads the report renderer to describe it (docs-only write surface, content/docs/core/report-schema.mdx) — no write overlap.

Stale-premise check: the card measured on a feature branch (claude/issue-5137-report-filter-alias @ e9a7dfb36, merge-base origin/main @ 7d900dee6) and asserts the defect is pre-existing. That branch has since merged (PR5224). So the dev must re-measure on current origin/main with the card's own recheck command before doing anything else — a card whose only measurement came from a since-merged branch is exactly the shape that goes stale silently.

---

Generated by Claude Code