@glubean/cli 0.9.3 → 0.9.5

package/dist/commands/run.js

@@ -374,6 +374,19 @@ export async function discoverTests(filePath) {
                 console.error(`\x1b[31m✗ Contract import failed: ${err.file}\x1b[0m`);
                 console.error(`\x1b[2m  ${err.error}\x1b[0m`);
             }
+            // GLU-155: a contract file that throws during import is a discovery
+            // FAILURE, not an empty file — previously this returned `[]` here,
+            // which is indistinguishable from "this contract file legitimately
+            // exports zero cases." The caller's loop would then silently drop the
+            // whole file: other files still ran, the process still exited 0, and
+            // the final summary never mentioned the import error printed above.
+            // Throwing routes this through the existing per-file catch block below,
+            // which records it as a discovery failure — the run still executes
+            // every OTHER file (no fail-fast), but the summary now reports the
+            // failed file and the process exits non-zero. Message omits the file
+            // path (the caller already labels the error with the relative path) —
+            // just the underlying reason(s), already detailed above.
+            throw new Error(result.errors.map((err) => err.error).join("\n"));
         }
         return [];
     }
@@ -574,8 +587,14 @@ export async function runCommand(target, options = {}) {
                 `${colors.dim}--rerun-failed reads ${lastRunPath}.${colors.reset}\n`);
             process.exit(1);
         }
-        const { selectors, files } = deriveRerunSelectors({ tests: lastRun.tests ?? [] });
-        if (selectors.length === 0) {
+        const { selectors, files, discoveryFailureFiles } = deriveRerunSelectors({
+            tests: lastRun.tests ?? [],
+            discoveryFailures: lastRun.discoveryFailures ?? [],
+        });
+        // GLU-155: a run isn't "nothing to rerun" just because no DISCOVERED test
+        // failed — a file whose import threw last time carries zero test ids and
+        // must still be retried.
+        if (selectors.length === 0 && discoveryFailureFiles.length === 0) {
             console.log(`\n${colors.green}✓ Last run had no failures — nothing to rerun.${colors.reset}\n`);
             process.exit(0);
         }
@@ -592,9 +611,45 @@ export async function runCommand(target, options = {}) {
                 `from the last run are in the current target.${colors.reset}\n`);
             process.exit(1);
         }
-        onlySelectors = selectors;
-        console.log(`${colors.dim}--rerun-failed: ${selectors.length} failed test(s) across ` +
-            `${testFiles.length} file(s)${colors.reset}\n`);
+        // GLU-155 codex R3 P2: a discovery-failure file's test ids were NEVER
+        // recorded (its import threw before any test ran), so `selectors` has no
+        // entry for it. Pushing its freshly-discovered ids into `onlySelectors`
+        // (an earlier version of this fix did that) is unsound for data-driven
+        // exports: `test.each`/`test.pick` discovery yields a TEMPLATE sentinel
+        // id (e.g. "user-$index"), but the harness's `matchOnly` (driven by the
+        // SAME global `GLUBEAN_RUNNER_ONLY_SELECTORS` selector set — one flat
+        // list, not scoped per file) matches CONCRETE expanded row ids by exact
+        // equality. The template id would never match a single row, so the
+        // rerun would exit green having executed ZERO rows from the very file
+        // it was supposed to retry — the same false-green failure mode GLU-155
+        // exists to close, just relocated to `--rerun-failed`.
+        //
+        // There is no way to scope selectors per-file in the current protocol
+        // (one flat list feeds both the CLI's own narrowing below and the
+        // harness env channel), so when a carry-over import-failed file is
+        // ACTUALLY IN THIS RUN'S TARGET, the only sound choice is to drop
+        // id-based narrowing entirely and run every test in every file
+        // `testFiles` was already narrowed to above. This only widens what a
+        // MIXED rerun (real failed tests in one file + an import failure in
+        // another) re-executes inside the failed-test file's OTHER,
+        // previously-passing cases — safe over-inclusion, not a correctness risk.
+        //
+        // GLU-155 codex R4 P2: gate that widening on discovery-failure files
+        // that SURVIVED the `testFiles` filter above — NOT on
+        // `discoveryFailureFiles.length` from the last run. A partial target
+        // (e.g. `glubean run one-failed-test-file.ts --rerun-failed`) that
+        // excludes the import-failed file must keep its precise id narrowing;
+        // otherwise the old run's unrelated import failure would silently
+        // re-run every previously-passing test in the one file being retried.
+        const discoveryFailureFilesAbs = new Set(discoveryFailureFiles.map((f) => resolve(rootDir, f)));
+        const targetedDiscoveryFailures = testFiles.filter((f) => discoveryFailureFilesAbs.has(resolve(f)));
+        onlySelectors = targetedDiscoveryFailures.length > 0 ? [] : selectors;
+        console.log(`${colors.dim}--rerun-failed: ${selectors.length} failed test(s)` +
+            (targetedDiscoveryFailures.length > 0
+                ? ` + ${targetedDiscoveryFailures.length} file(s) that failed to import ` +
+                    `(running those file(s) in full, import-time test ids are unknown)`
+                : "") +
+            ` across ${testFiles.length} file(s)${colors.reset}\n`);
     }
     else {
         onlySelectors = selectorFlags.selectors;
@@ -606,6 +661,23 @@ export async function runCommand(target, options = {}) {
     // `glubean` field lingers in package.json so users know it's inert now.
     await warnIfLegacyPackageJsonConfig(rootDir);
     const glubeanConfig = structuredClone(CONFIG_DEFAULTS);
+    // GLU-155 codex R2 P1: hoisted from its original spot (just before the
+    // runner-stream loop) so discovery-failure error messages can be redacted
+    // BEFORE they're persisted — a contract file can throw with a secret in
+    // its message (e.g. a leaked token interpolated into an error string), and
+    // that string now lands in `.glubean/last-run.result.json` / the Cloud
+    // upload result (see discoveryFailedFiles below). Value is unchanged by
+    // moving it — it only reads `options`/`glubeanConfig`, both already
+    // available here.
+    const effectiveRedaction = options.redactionConfig ?? glubeanConfig.redaction;
+    // Redact a raw error/exception message the same way `redactNonEvent` (further
+    // below) redacts `context`/`customMetadata` — same rules, same replacement
+    // format, just scoped to a single string instead of an arbitrary value tree.
+    const redactDiscoveryError = (message) => redactValue(message, {
+        globalRules: effectiveRedaction.globalRules,
+        replacementFormat: effectiveRedaction.replacementFormat,
+        maxDepth: 64,
+    });
     const effectiveRun = mergeRunOptions(glubeanConfig.run, {
         verbose: options.verbose,
         pretty: options.pretty,
@@ -685,7 +757,7 @@ export async function runCommand(target, options = {}) {
     // resolution happens here (pre-run) so a misconfigured destination fails fast.
     let resolvedUploadTargetId;
     if (options.upload) {
-        const { resolveToken, resolveProjectId, resolveApiUrl, resolveTargetId, resolveDefaultTargetId, checkUploadAuth, checkTargetInProject, } = await import("../lib/auth.js");
+        const { resolveToken, resolveProjectId, resolveApiUrl, resolveTargetId, resolveDefaultTargetId, checkUploadAuth, checkTargetInProject, PLATFORM_API_URL_UNRESOLVED_HINT, } = await import("../lib/auth.js");
         const authOpts = {
             token: options.token,
             project: options.project,
@@ -714,6 +786,11 @@ export async function runCommand(target, options = {}) {
             console.error(`${colors.dim}Use --project or set GLUBEAN_PROJECT_ID.${colors.reset}`);
             process.exit(1);
         }
+        if (!preApiUrl) {
+            console.error(`${colors.red}Error: could not determine the Platform API URL.${colors.reset}`);
+            console.error(`${colors.dim}${PLATFORM_API_URL_UNRESOLVED_HINT}${colors.reset}`);
+            process.exit(1);
+        }
         // Validate against the SAME server runs upload to. Don't pre-judge token
         // format locally — let the server decide. A least-privilege ingest token
         // (runs:write, no projects:read) gets 403 yet can still POST runs, so that
@@ -728,7 +805,7 @@ export async function runCommand(target, options = {}) {
             else if (check.status === 404) {
                 console.error(`${colors.red}Error: project ${preProject} not found (404).${colors.reset}`);
                 console.error(`${colors.dim}Preflight GET: ${preApiUrl}/v1/projects/${preProject}${colors.reset}`);
-                console.error(`${colors.dim}Check that --project / GLUBEAN_PROJECT_ID is a real project id, that --api-url / GLUBEAN_API_URL has no stray trailing slash, and that it points at the platform ingest API (the token-only \`/v1/*\` service) — not a dashboard/session-auth host, which has no \`/v1\` routes and 404s here too.${colors.reset}`);
+                console.error(`${colors.dim}Check that --project / GLUBEAN_PROJECT_ID is a real project id, that --api-url / GLUBEAN_PLATFORM_API_URL / GLUBEAN_API_URL has no stray trailing slash, and that it points at the platform ingest API (the token-only \`/v1/*\` service) — not a dashboard/session-auth host, which has no \`/v1\` routes and 404s here too.${colors.reset}`);
             }
             else if (check.status === 403) {
                 console.error(`${colors.red}Error: access to project ${preProject} is forbidden (403).${colors.reset}`);
@@ -739,7 +816,7 @@ export async function runCommand(target, options = {}) {
             }
             else {
                 console.error(`${colors.red}Error: upload preflight got an unexpected response (${check.status}).${colors.reset}`);
-                console.error(`${colors.dim}Check that --api-url / GLUBEAN_API_URL points at the Glubean platform API.${colors.reset}`);
+                console.error(`${colors.dim}Check that --api-url / GLUBEAN_PLATFORM_API_URL / GLUBEAN_API_URL points at the Glubean platform API.${colors.reset}`);
             }
             process.exit(1);
         }
@@ -762,7 +839,7 @@ export async function runCommand(target, options = {}) {
                 if (tcheck.status === 404) {
                     console.error(`${colors.red}Error: target ${preTarget} not found in project ${preProject} (404).${colors.reset}`);
                     console.error(`${colors.dim}Preflight GET: ${preApiUrl}/v1/projects/${preProject}/targets/${preTarget}${colors.reset}`);
-                    console.error(`${colors.dim}Check upload.targetId / GLUBEAN_TARGET_ID / --upload-target, and that --api-url / GLUBEAN_API_URL points at the platform ingest API.${colors.reset}`);
+                    console.error(`${colors.dim}Check upload.targetId / GLUBEAN_TARGET_ID / --upload-target, and that --api-url / GLUBEAN_PLATFORM_API_URL / GLUBEAN_API_URL points at the platform ingest API.${colors.reset}`);
                 }
                 else if (tcheck.status === 401) {
                     console.error(`${colors.red}Error: authentication failed validating the target (401).${colors.reset}`);
@@ -816,6 +893,15 @@ export async function runCommand(target, options = {}) {
     console.log(`${colors.dim}Discovering tests...${colors.reset}`);
     const allFileTests = [];
     let totalDiscovered = 0;
+    // GLU-155: files whose discovery threw (e.g. a contract that fails on
+    // import) — aggregated so the run keeps executing every OTHER file, but
+    // the final summary + exit code still reflect the failure. Distinct from
+    // a genuinely test-less file (which discoverTests returns `[]` for
+    // without throwing) — this array is ONLY populated on a thrown error.
+    // Persisted into resultPayload.discoveryFailures below so
+    // `.glubean/last-run.result.json` / `--rerun-failed` stay consistent with
+    // the non-zero exit code (codex GLU-155 R1 P2).
+    const discoveryFailedFiles = [];
     for (const filePath of testFiles) {
         try {
             const tests = await discoverTests(filePath);
@@ -839,19 +925,59 @@ export async function runCommand(target, options = {}) {
             totalDiscovered += filteredTests.length;
         }
         catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
             if (isMultiFile) {
                 const relPath = relative(process.cwd(), filePath);
-                console.error(`  ${colors.red}✗${colors.reset} ${relPath}: ${error instanceof Error ? error.message : String(error)}`);
+                console.error(`  ${colors.red}✗${colors.reset} ${relPath}: ${message}`);
+                // GLU-155: record the failure instead of silently moving on — the
+                // rest of the loop still runs every other file (aggregate, not
+                // fail-fast), but this file's absence must be visible in the
+                // summary and must flip the exit code non-zero below. The console
+                // line above stays UNREDACTED (local terminal, not persisted) —
+                // `error` here is redacted because it lands in
+                // `.glubean/last-run.result.json` / the Cloud upload result, which
+                // `context`/`customMetadata` already redact (codex R2 P1).
+                discoveryFailedFiles.push({
+                    filePath: relative(rootDir, filePath),
+                    error: redactDiscoveryError(message),
+                });
             }
             else {
                 console.error(`\n${colors.red}❌ Failed to load test file${colors.reset}`);
-                console.error(`${colors.dim}${error instanceof Error ? error.message : String(error)}${colors.reset}`);
+                console.error(`${colors.dim}${message}${colors.reset}`);
                 process.exit(1);
             }
         }
     }
     if (allFileTests.length === 0) {
         console.error(`\n${colors.red}❌ No test cases found${isMultiFile ? ` in ${testFiles.length} file(s)` : " in file"}${colors.reset}`);
+        if (discoveryFailedFiles.length > 0) {
+            console.error(`${colors.dim}${discoveryFailedFiles.length} file(s) failed to import (see errors above) — ` +
+                `that may be the entire cause.${colors.reset}`);
+            // GLU-155 codex R2 P2: this branch used to exit WITHOUT writing
+            // `.glubean/last-run.result.json` — a run where EVERY targeted file
+            // failed to import (or the ones that did import export zero tests)
+            // left no trace on disk, so a mixed run's discovery failure got
+            // persisted (see resultPayload further below) but this all-or-mostly-
+            // broken one didn't, and `--rerun-failed` had nothing to retry from.
+            // Persist the same minimal shape `writeEmptyResult` uses elsewhere,
+            // plus `discoveryFailures`, before exiting.
+            try {
+                const glubeanDir = resolve(rootDir, ".glubean");
+                await mkdir(glubeanDir, { recursive: true });
+                await writeFile(resolve(glubeanDir, "last-run.result.json"), JSON.stringify({
+                    target: targetDisplay,
+                    files: testFiles.map((f) => relative(rootDir, f)),
+                    runAt: runStartLocal,
+                    summary: { total: 0, passed: 0, failed: 0, skipped: 0, durationMs: 0, stats: {} },
+                    tests: [],
+                    discoveryFailures: discoveryFailedFiles,
+                }, null, 2) + "\n", "utf-8");
+            }
+            catch {
+                // Non-critical — best-effort persistence, matches writeEmptyResult.
+            }
+        }
         console.error(`${colors.dim}Each test file must export tests: export const myTest = test("id")...${colors.reset}\n`);
         process.exit(1);
     }
@@ -1200,7 +1326,10 @@ export async function runCommand(target, options = {}) {
             testEvents.push({
                 type: "status",
                 status: "skipped",
-                ...(skipReason && { reason: skipReason }),
+                // GLU-142 — `!== undefined` (not truthy) so an explicit `ctx.skip("")`
+                // is preserved rather than silently coerced to "no reason", matching
+                // the top-level `reason` field on the pushed CollectedTestRun below.
+                ...(skipReason !== undefined && { reason: skipReason }),
             });
         }
         // GLU-128: `runStats` (→ result JSON `summary.stats`) used to wait for a
@@ -1231,6 +1360,9 @@ export async function runCommand(target, options = {}) {
             groupId: testItem?.meta.groupId,
             rowIndex: testRowIndex,
             each: testEach,
+            // GLU-142 — `!== undefined` (not truthy) preserves an explicit
+            // `ctx.skip("")` instead of silently coercing it to "no reason".
+            ...(skippedClean && skipReason !== undefined && { reason: skipReason }),
         });
         addLogEntry("result", skippedClean ? "SKIPPED" : finalSuccess ? "PASSED" : "FAILED", {
             duration,
@@ -1357,6 +1489,31 @@ export async function runCommand(target, options = {}) {
     // Files ProjectRunner actually started. Any fileGroups entry that never
     // gets file:start is a fail-fast skip — handled post run:complete.
     const startedFiles = new Set();
+    // Redaction (GLU-105): compile scopes ONCE, unconditionally, and redact
+    // every harness event as it arrives — BEFORE it reaches any sink. Every
+    // sink that touches this run's data (`.glubean/last-run.result.json`,
+    // `--result-json`, `.glubean/traces.json`, `--log-file`, `--verbose`
+    // console output, `--emit-full-trace` trace files) must consume the same
+    // redacted stream. Previously redaction only ran on a clone built for
+    // `--upload`, so every local-disk sink got the raw, secret-bearing event
+    // regardless of whether `--upload` was even passed.
+    //
+    // Hoisted above `emitAllSkippedFilesUpTo` below (GLU-142 codex R2 P0): a
+    // capability-skip's synthesized reason (`meta.deferred`/`meta.deprecated`
+    // free text, or the requires-capability strings) is itself redaction-
+    // relevant now that it's promoted into a top-level `reason` field
+    // (`CollectedTestRun.reason` → result JSON / upload `test_result` row).
+    // Compiling scopes here — instead of after this const's original position
+    // just before the runner-stream loop — ensures they exist even for the
+    // "every selected test was capability-skipped" short-circuit, which calls
+    // `emitAllSkippedFilesUpTo` before the runner stream ever starts.
+    // (`effectiveRedaction` itself now lives further up — GLU-155 codex R2 P1 —
+    // so discovery-failure messages can be redacted before this point too.)
+    const compiledScopes = compileScopes({
+        builtinScopes: BUILTIN_SCOPES,
+        globalRules: effectiveRedaction.globalRules,
+        replacementFormat: effectiveRedaction.replacementFormat,
+    });
     // Files that are 100% capability-skipped need ⊘ rows emitted manually
     // because ProjectRunner never starts a file with zero runnable tests
     // (file:start, which normally renders inline skip rows, won't fire).
@@ -1386,16 +1543,23 @@ export async function runCommand(target, options = {}) {
             for (const { ft, reason } of skips) {
                 skipped++;
                 const name = ft.test.meta.name || ft.test.meta.id;
-                console.log(`  ${colors.yellow}⊘${colors.reset} ${name} ${colors.dim}— skipped (${reason})${colors.reset}`);
+                // GLU-142 (codex R2 P0) — a capability-skip's synthesized reason
+                // (meta.deferred/meta.deprecated free text) is redaction-relevant
+                // too now that it's promoted into a persisted/uploaded top-level
+                // field; scrub it through the status.reason scope the same way a
+                // runtime ctx.skip(reason) is, before it reaches console/disk/upload.
+                const redactedReason = redactEvent({ type: "status", status: "skipped", reason }, compiledScopes, effectiveRedaction.replacementFormat).reason;
+                console.log(`  ${colors.yellow}⊘${colors.reset} ${name} ${colors.dim}— skipped (${redactedReason})${colors.reset}`);
                 collectedRuns.push({
                     testId: ft.test.meta.id,
                     testName: name,
                     tags: ft.test.meta.tags,
                     filePath,
-                    events: [{ type: "status", status: "skipped", reason }],
+                    events: [{ type: "status", status: "skipped", reason: redactedReason }],
                     success: true,
                     durationMs: 0,
                     groupId: ft.test.meta.groupId,
+                    reason: redactedReason,
                 });
             }
             fileCapabilitySkips.delete(filePath);
@@ -1430,20 +1594,6 @@ export async function runCommand(target, options = {}) {
         ...(options.inspectBrk !== undefined && { inspectBrk: options.inspectBrk }),
         metricCollector,
     });
-    // Redaction (GLU-105): compile scopes ONCE, unconditionally, and redact
-    // every harness event as it arrives — BEFORE it reaches any sink. Every
-    // sink that touches this run's data (`.glubean/last-run.result.json`,
-    // `--result-json`, `.glubean/traces.json`, `--log-file`, `--verbose`
-    // console output, `--emit-full-trace` trace files) must consume the same
-    // redacted stream. Previously redaction only ran on a clone built for
-    // `--upload`, so every local-disk sink got the raw, secret-bearing event
-    // regardless of whether `--upload` was even passed.
-    const effectiveRedaction = options.redactionConfig ?? glubeanConfig.redaction;
-    const compiledScopes = compileScopes({
-        builtinScopes: BUILTIN_SCOPES,
-        globalRules: effectiveRedaction.globalRules,
-        replacementFormat: effectiveRedaction.replacementFormat,
-    });
     // Only walk the runner stream when there are runnable tests. The empty
     // case has already emitted all capability skips above and falls
     // straight through to the summary.
@@ -1539,16 +1689,20 @@ export async function runCommand(target, options = {}) {
                     for (const { ft, reason } of skips) {
                         skipped++;
                         const name = ft.test.meta.name || ft.test.meta.id;
-                        console.log(`  ${colors.yellow}⊘${colors.reset} ${name} ${colors.dim}— skipped (${reason})${colors.reset}`);
+                        // GLU-142 (codex R2 P0) — same scrub as the other capability-skip
+                        // emission site above (emitAllSkippedFilesUpTo).
+                        const redactedReason = redactEvent({ type: "status", status: "skipped", reason }, compiledScopes, effectiveRedaction.replacementFormat).reason;
+                        console.log(`  ${colors.yellow}⊘${colors.reset} ${name} ${colors.dim}— skipped (${redactedReason})${colors.reset}`);
                         collectedRuns.push({
                             testId: ft.test.meta.id,
                             testName: name,
                             tags: ft.test.meta.tags,
                             filePath: ev.filePath,
-                            events: [{ type: "status", status: "skipped", reason }],
+                            events: [{ type: "status", status: "skipped", reason: redactedReason }],
                             success: true,
                             durationMs: 0,
                             groupId: ft.test.meta.groupId,
+                            reason: redactedReason,
                         });
                     }
                 }
@@ -1881,6 +2035,13 @@ export async function runCommand(target, options = {}) {
         summaryParts.push(`${colors.yellow}${skipped} skipped${colors.reset}`);
     console.log(`${colors.bold}Tests:${colors.reset}  ${summaryParts.join(", ")}`);
     console.log(`${colors.bold}Total:${colors.reset}  ${passed + failed + skipped}`);
+    // GLU-155: a contract/test file that failed to import is NOT reflected in
+    // the pass/fail/skip counts above (its tests never got discovered), so it
+    // gets its own summary line — otherwise a run with import failures reads
+    // as a clean green summary even though whole files silently never ran.
+    if (discoveryFailedFiles.length > 0) {
+        console.log(`${colors.bold}Discovery:${colors.reset} ${colors.red}${discoveryFailedFiles.length} file(s) failed to import${colors.reset} ${colors.dim}(${discoveryFailedFiles.map((d) => d.filePath).join(", ")})${colors.reset}`);
+    }
     if (overallPeakMemoryMB > 0) {
         const memColor = overallPeakMemoryMB > MEMORY_WARNING_THRESHOLD_MB ? colors.yellow : colors.dim;
         console.log(`${colors.bold}Memory:${colors.reset} ${memColor}${overallPeakMemoryMB.toFixed(2)} MB peak${colors.reset}`);
@@ -2063,8 +2224,20 @@ export async function runCommand(target, options = {}) {
             // without depending on a projection join. Undefined for non-each tests
             // (backward compatible: old runs / old CLI builds simply omit the field).
             ...(r.each !== undefined && { each: r.each }),
+            // GLU-142 — surface the runtime skip reason at the top level (it was
+            // already reachable by scanning `events` for a status:"skipped" entry,
+            // but a top-level field lets consumers skip that reconstruction).
+            ...(r.reason !== undefined && { reason: r.reason }),
             filePath: relative(rootDir, r.filePath),
         })),
+        // GLU-155: files that failed to IMPORT (zero test ids ever discovered),
+        // kept alongside `tests` so this run isn't internally inconsistent — the
+        // process already exits non-zero for these, but without this the saved
+        // `summary`/`tests` could read as a clean "N passed" even though a whole
+        // file silently never ran. `filePath` is rootDir-relative, matching
+        // `tests[].filePath`, so `--rerun-failed` (deriveRerunSelectors) can fold
+        // these files back into its target set on the next run.
+        ...(discoveryFailedFiles.length > 0 && { discoveryFailures: discoveryFailedFiles }),
         ...(thresholdSummary && { thresholds: thresholdSummary }),
         ...(options.meta && Object.keys(options.meta).length > 0
             ? { customMetadata: redactNonEvent(options.meta) }
@@ -2141,7 +2314,7 @@ export async function runCommand(target, options = {}) {
     }
     // ── Cloud upload ────────────────────────────────────────────────────────
     if (options.upload) {
-        const { resolveToken, resolveProjectId, resolveApiUrl } = await import("../lib/auth.js");
+        const { resolveToken, resolveProjectId, resolveApiUrl, PLATFORM_API_URL_UNRESOLVED_HINT } = await import("../lib/auth.js");
         const { uploadToCloud, removeUploadedScreenshots } = await import("../lib/upload.js");
         const authOpts = {
             token: options.token,
@@ -2164,6 +2337,11 @@ export async function runCommand(target, options = {}) {
             console.error(`${colors.red}Upload failed: no project ID.${colors.reset}`);
             process.exit(1);
         }
+        else if (!apiUrl) {
+            console.error(`${colors.red}Upload failed: could not determine the Platform API URL.${colors.reset}`);
+            console.error(`${colors.dim}${PLATFORM_API_URL_UNRESOLVED_HINT}${colors.reset}`);
+            process.exit(1);
+        }
         else {
             // `compiledScopes`/`effectiveRedaction` are the SAME instances used
             // above to redact every event as it was collected (GLU-105) — reused
@@ -2204,6 +2382,10 @@ export async function runCommand(target, options = {}) {
                     durationMs: r.durationMs,
                     ...(r.tags && r.tags.length ? { tags: r.tags } : {}),
                     eventCount: r.events.length,
+                    // GLU-142 — run-time `ctx.skip(reason)` text, so `test_result` rows
+                    // carry the actual reason from THIS run instead of only the spec's
+                    // declared reason (which the dashboard falls back to).
+                    ...(r.reason !== undefined && { reason: r.reason }),
                 }));
                 // Metric tags (method/path) can in rare cases embed a secret in a path
                 // segment — redact them with the same engine the projection line uses.
@@ -2237,9 +2419,14 @@ export async function runCommand(target, options = {}) {
                     // Stable idempotency id for this run — reused across the upload retry so
                     // a lost-response retry replaces this run instead of duplicating it (P1).
                     clientRunId: randomUUID(),
-                    // A breached metric threshold fails the run (mirrors the process exit
-                    // below) even when every test passed — don't record it as "passed".
-                    status: failed > 0 || (thresholdSummary && !thresholdSummary.pass) ? "failed" : "passed",
+                    // A breached metric threshold, or a file that failed to import
+                    // (GLU-155 — mirrors the process exit below), fails the run even
+                    // when every DISCOVERED test passed — don't record it as "passed".
+                    status: failed > 0 ||
+                        discoveryFailedFiles.length > 0 ||
+                        (thresholdSummary && !thresholdSummary.pass)
+                        ? "failed"
+                        : "passed",
                     startedAt: runStartTime,
                     completedAt: new Date(Date.parse(runStartTime) + totalDurationMs).toISOString(),
                     durationMs: totalDurationMs,
@@ -2303,7 +2490,12 @@ export async function runCommand(target, options = {}) {
             }
         }
     }
-    if (failed > 0 || (thresholdSummary && !thresholdSummary.pass)) {
+    // GLU-155: a file that failed to import must fail the run even if every
+    // test that WAS discovered passed — otherwise CI reads green while a whole
+    // contract file silently never ran.
+    if (failed > 0 ||
+        discoveryFailedFiles.length > 0 ||
+        (thresholdSummary && !thresholdSummary.pass)) {
         process.exit(1);
     }
 }