test: unit tests cannot reach the network, enforced below fetch

.github/workflows/quality.yml

@@ -409,10 +409,10 @@ jobs:
           done
           RC=0
           if [ ${#REST[@]} -gt 0 ]; then
-            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
+            node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --import ./tests/_setup/blockNetwork.ts --test --test-force-exit --test-concurrency=4 "${REST[@]}" || RC=$?
           fi
           if [ ${#DASH[@]} -gt 0 ]; then
-            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
+            node --import tsx --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --import ./tests/_setup/blockNetwork.ts --test --test-force-exit --test-concurrency=4 "${DASH[@]}" || RC=$?
           fi
           exit $RC
       # #8084 shadow evidence: keep the raw selection downloadable so TIA misses can be

config/quality/file-size-baseline.json

@@ -197,6 +197,7 @@
   "cap": 1200,
   "testCap": 1200,
   "testFrozen": {
+    "_rebaseline_2026_09_19_network_guard_hermetic_outbound": "Network guard (unit tests cannot reach the network): every test file that production code made an incidental outbound call from now installs the hermetic outbound layer, a fixed 3-line block (comment + `await (await import(\"./_helpers/offlineOutbound.ts\")).installOfflineOutbound();`). Three frozen test files carry that block and had zero headroom: models-catalog-route.test.ts 1652->1656, route-edge-coverage.test.ts 1244->1248, vscode-token-routes.test.ts 1267->1271 (+4 each: the 3-line block plus the blank line that separates it). The block cannot be smaller and cannot move to a shared setup — it must run AFTER each file's own imports, because open-sse/utils/proxyFetch.ts replaces globalThis.fetch at import time. Structural shrink of these files stays tracked in #3501.",
     "_rebaseline_2026_06_27_5193_antigravity_test": "#5193 own test growth: oauth-providers-config.test.ts 870->873 (+3: antigravity projectId assertion + 50ms tick for the now fire-and-forget onboarding, matching the no-PKCE/no-openid flow).",
     "_rebaseline_2026_07_02_5928_base_red": "web-cookie-providers-new.test.ts 845->850: #5928 (test(security) Kimi Web URL host parse, CodeQL #689) grew the file +5 lines and merged into release/v3.8.44 WITHOUT rebaselining, leaving a fast-gates base-red that blocked every subsequent PR->release. Test growth is legitimate (a security regression test); maintainer absorbs the drift here. Frozen at 850.",
     "_rebaseline_2026_07_09_6126_clinepass_dualauth": "#6126 (ClinePass dual-auth) own test growth: oauth-providers-config.test.ts 842->845 (+3: clinepass key/config/required-fields entries reusing the Cline WorkOS flow config, needed after registering clinepass in the oauth.ts PROVIDERS enum).",
@@ -221,12 +222,12 @@
     "tests/unit/executor-default-base.test.ts": 1632,
     "tests/unit/grok-web.test.ts": 2985,
     "tests/unit/image-generation-handler.test.ts": 2133,
-    "tests/unit/models-catalog-route.test.ts": 1652,
+    "tests/unit/models-catalog-route.test.ts": 1656,
     "tests/unit/perplexity-web.test.ts": 1384,
     "tests/unit/provider-models-route.test.ts": 1783,
     "tests/unit/provider-validation-specialty.test.ts": 2912,
     "tests/unit/reasoning-cache.test.ts": 1291,
-    "tests/unit/route-edge-coverage.test.ts": 1244,
+    "tests/unit/route-edge-coverage.test.ts": 1248,
     "tests/unit/sse-auth.test.ts": 1729,
     "tests/unit/stream-utils.test.ts": 2517,
     "tests/unit/token-refresh-service.test.ts": 1407,
@@ -235,7 +236,7 @@
     "tests/unit/translator-openai-to-kiro.test.ts": 1275,
     "tests/unit/translator-resp-gemini-to-openai.test.ts": 1234,
     "tests/unit/usage-service-hardening.test.ts": 1487,
-    "tests/unit/vscode-token-routes.test.ts": 1267,
+    "tests/unit/vscode-token-routes.test.ts": 1271,
     "tests/unit/tls-client-wreq-migration.test.ts": 1374
   },
   "_rebaseline_2026_06_09": "Re-baseline consciente pre-release v3.8.19: 9 arquivos cresceram durante o ciclo (features mergeadas: RequestLoggerV2 +281 request-logger rework, stream +101, combo +73, chatCore +45, catalog +32 fable-5/catalog-flag, callLogs +4, accountFallback +2, usageHistory novo 840) + core.ts +7 (fix resetAllDbModuleState, PR 3536). A catraca segue valendo destes valores — proximo crescimento falha. Decisao: encolher (esp. RequestLoggerV2/chatCore) e a issue #3501 ficam para o ciclo seguinte.",