@yagni-app/code-staging 1.2.7-staging.2027.1 → 1.2.7-staging.2031.1

package/dist/extension/pipeline/headlessGo.js

@@ -496,8 +496,9 @@ export async function runHeadlessGo(argv, deps = {}) {
             }
         }
     }
-    // The approved plan's checks the host has not seen pass on the unchanged
-    // code (`measureOnBase`), each run once there before the build, on the same
+    // The approved checks the host has not seen pass on the unchanged code
+    // (`measureOnBase`: the plan's, and CI's when the repository's record has
+    // none of its own), each run once there before the build, on the same
     // fresh tree the baseline above reads: a check that already failed there is
     // not this change's to fix. A continuation or a fix round carries a change,
     // so it measures nothing; its host hands it what an earlier session found.

package/dist/extension/pipeline/missionChecks.d.ts

@@ -23,7 +23,8 @@ export interface MissionCheck {
     cause?: string;
     /**
      * The host has not seen it pass on the unchanged code (an approved plan's
-     * check): the session runs it there once before the build, and what that
+     * check, or one CI runs that has no baseline): the session runs it there
+     * once before the build, and what that
      * measures stands over `status` (`makeMeasureChecksOnBase` in verify.ts).
      */
     measureOnBase?: boolean;

package/dist/extension/pipeline/verify.d.ts

@@ -37,7 +37,10 @@
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
  * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command.
+ * failed the same command. On a build that named the repository's toolchain
+ * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
+ * shell and the approved checks do ({@link buildGateVerifyEnv},
+ * {@link buildGateTestEnv}).
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -258,15 +261,36 @@ export declare function detectVerifyTestCommands(cwd: string, opts?: DetectOpts)
  * verify failure.
  */
 export declare function classifyVerifyInfraFailure(output: string, exitCode: number): string | null;
+/**
+ * What a run could not start without, when its output says so in a way the
+ * gate recognises: a credential or variable the environment lacks, or a
+ * prerequisite the sandbox has not installed. Null for anything else, which
+ * stays a real failure. Pure.
+ *
+ * Narrow on purpose, since a match makes the run "could not run" rather than
+ * the change's failure:
+ *  - a named variable counts only when `env` (the environment the command ran
+ *    under) does not have it set: one it has is not why the run failed, and
+ *    no unnamed phrase then stands in for it;
+ *  - a line that quotes a test's expectation or a diff never counts, nor
+ *    one a logger wrote below error level;
+ *  - a repository's own "`A_B` is missing" counts only on an error's line.
+ *
+ * Without `env`, a named variable is taken as unset.
+ */
+export declare function classifyMissingPrerequisite(output: string, env?: NodeJS.ProcessEnv): string | null;
 /** How the pure test classifier read one test run (spec §3d). */
 export type TestFailureClassification = {
     kind: "clean";
 } | {
     kind: "failures";
     findings: Finding[];
-} | {
+}
+/** `needs`: the credential or prerequisite the run lacked ({@link classifyMissingPrerequisite}). */
+ | {
     kind: "infra";
     reason: string;
+    needs?: string;
 } | {
     kind: "uncertain";
 };
@@ -281,7 +305,9 @@ export type TestFailureClassification = {
  *  - infra/env shapes (command not found, module resolution, connection
  *    refused, missing env var, DB/auth, connect timeout) → `infra` with a short
  *    cause; checked FIRST so a suite whose assertions failed only because its
- *    DB was down fails open rather than blocking.
+ *    DB was down fails open rather than blocking. A missing credential or
+ *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
+ *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
  *    TAP + spec reporters) → `failures` with located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
@@ -293,7 +319,7 @@ export type TestFailureClassification = {
  * Callers scrub the output through {@link scrubSecrets} BEFORE classification
  * so findings/notes never carry secrets (§0.9).
  */
-export declare function classifyTestFailure(output: string, exitCode: number, limit?: number): TestFailureClassification;
+export declare function classifyTestFailure(output: string, exitCode: number, limit?: number, env?: NodeJS.ProcessEnv): TestFailureClassification;
 /**
  * Turn a failing verify run into `critical` Findings. A clean (exit 0) run yields
  * none. Located diagnostics (TypeScript first, then a generic file:line form, then
@@ -394,6 +420,22 @@ export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.Process
  * own literal variables.
  */
 export declare function buildRepoCheckEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null, stepEnv?: Record<string, string>): NodeJS.ProcessEnv;
+/**
+ * The environment the gate's own detected test script runs under. On a build
+ * that named a toolchain (a sandbox), an approved check's
+ * ({@link buildRepoCheckEnv}), so the suite runs on the repository's Node,
+ * Ruby or Go as the model's shell does, never the image's, and gives the same
+ * verdict it gives as an approved check. Without one (a developer's terminal),
+ * the user's own ({@link buildTestEnv}), as before.
+ */
+export declare function buildGateTestEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null): NodeJS.ProcessEnv;
+/**
+ * The environment the gate's own detected typecheck or lint script runs
+ * under: the scrubbed {@link buildVerifyEnv} on the build's toolchain, when it
+ * named one. Undefined without one, so the exec seam's default applies, as
+ * before.
+ */
+export declare function buildGateVerifyEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null): NodeJS.ProcessEnv | undefined;
 /** One porcelain line's path, and whether it is untracked. */
 interface TreeEntry {
     path: string;
@@ -431,7 +473,7 @@ export interface MakeRunVerifyOpts {
     detectTests?: (cwd: string, changedDirs: string[]) => VerifyCommand[];
     /** Per-package wall-clock cap for the test half (default VERIFY_TEST_TIMEOUT_MS). */
     testTimeoutMs?: number;
-    /** Test-half env override for determinism in tests (default: buildTestEnv() per run). */
+    /** Test-half env override for determinism in tests (default: buildGateTestEnv() per run). */
     testEnv?: NodeJS.ProcessEnv;
     /**
      * The mission's `checks.json` (the approved checks and the pull request's CI
@@ -451,7 +493,11 @@ export interface MakeRunVerifyOpts {
     changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
     /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */
     repoChecksEnv?: NodeJS.ProcessEnv;
-    /** The toolchain the repository checks run on (default: `YAGNI_TOOLCHAIN_FILE`, when it reads). */
+    /**
+     * The toolchain every command the gate runs is on: the repository checks,
+     * and its own detected typecheck and test scripts (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
     toolchain?: () => ToolchainFile | null;
     repoChecksBuildBudgetMs?: number;
     repoChecksCallBudgetMs?: number;
@@ -529,6 +575,11 @@ export interface MakeWorkstreamCheckOpts {
     timeoutMs?: number;
     /** What the clean tree already failed on (YAG-1003): those failures are not a workstream's. */
     baseline?: VerifyBaseline | null;
+    /**
+     * The toolchain the checks run on, as the full gate's do (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
+    toolchain?: () => ToolchainFile | null;
 }
 /**
  * The per-workstream scoped check the implement diamond runs right after the fan
@@ -575,6 +626,11 @@ export interface MakeTakeVerifyBaselineOpts {
     timeoutMs?: number;
     testTimeoutMs?: number;
     testEnv?: NodeJS.ProcessEnv;
+    /**
+     * The toolchain the commands run on, as the gate's do (default:
+     * `YAGNI_TOOLCHAIN_FILE`, when it reads).
+     */
+    toolchain?: () => ToolchainFile | null;
     budgetMs?: number;
     now?: () => number;
     treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
@@ -625,7 +681,10 @@ export interface ChecksOnBaseResult extends ChecksOnBase {
      */
     treeUndone: boolean;
 }
-/** The whole measurement's cap, before the build starts: the approved plan's own checks, once each. */
+/**
+ * The whole measurement's cap, before the build starts: each check marked to
+ * measure, once, the plan's first.
+ */
 export declare const CHECKS_ON_BASE_BUDGET_MS: number;
 export interface MakeMeasureChecksOnBaseOpts {
     exec?: VerifyExec;
@@ -643,8 +702,9 @@ export interface MakeMeasureChecksOnBaseOpts {
  * Run each approved check `checks.json` marks `measureOnBase` once on the
  * unchanged code, before the build changes anything: a plan's check the
  * host has not seen pass there (none of the record's, or a red one the
- * record may hold from long ago). A check the plan wrote for the change
- * often fails there by design (its test file is not written yet), and a
+ * record may hold from long ago), and a command the repository's CI runs
+ * when the record names no check of its own. A check the plan wrote for the
+ * change often fails there by design (its test file is not written yet), and a
  * failure that says only that (a file not found, no tests to run, output no
  * parser reads) is no verdict: its failures all count after the build, as
  * before. A failure the gate reads (failing tests, located diagnostics, a

package/dist/extension/pipeline/verify.js

@@ -37,7 +37,10 @@
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
  * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
  * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
- * failed the same command.
+ * failed the same command. On a build that named the repository's toolchain
+ * (`YAGNI_TOOLCHAIN_FILE`, a sandbox) both halves run on it, as the model's
+ * shell and the approved checks do ({@link buildGateVerifyEnv},
+ * {@link buildGateTestEnv}).
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -509,18 +512,6 @@ const TEST_INFRA_PATTERNS = [
     [/\bENOTFOUND\b|\bEAI_AGAIN\b/, "DNS/host resolution failed for a test dependency"],
     [/\bEADDRINUSE\b/, "a port the tests need is already in use"],
     [/\bETIMEDOUT\b|\bconnect(?:ion)? timed out\b/i, "connection to a test dependency timed out"],
-    [
-        /\bmissing (?:required )?env(?:ironment)? (?:var(?:iable)?s?)\b/i,
-        "missing environment variable",
-    ],
-    [
-        /\benvironment variable\b[^\n]{0,80}\b(?:is )?(?:not set|missing|required|must be set)\b/i,
-        "missing environment variable",
-    ],
-    [/\bprocess\.env\.[A-Z0-9_]+ is (?:undefined|not set)\b/, "missing environment variable"],
-    // Yarn Berry reading a `${TOKEN}` in .yarnrc.yml that the environment lacks
-    // (staging bench 2026-10-23: GITHUB_PACKAGES_TOKEN): the suite never started.
-    [/\bEnvironment variable not found \([A-Za-z0-9_]+\)/, "missing environment variable"],
     [/\bSASL\b|\bSCRAM-SERVER\b/, "database auth failed (missing DB credentials?)"],
     [/\bpassword authentication failed\b/i, "database auth failed"],
     [/\brole "[^"]*" does not exist\b/i, "database role does not exist"],
@@ -537,6 +528,126 @@ const TEST_INFRA_PATTERNS = [
     [/\bCannot connect to the Docker daemon\b/i, "Docker is not running"],
     [/\bno space left on device\b/i, "the disk is full"],
 ];
+/**
+ * A variable's name as an output names it: `SUPABASE_SECRET_KEY`, `PORT`.
+ * Two characters at least and upper case only, on purpose: a single letter or
+ * a lower-case word beside "is missing" is prose, and reading it as a
+ * variable would make a real failure "could not run".
+ */
+const VAR_NAME = "[A-Z][A-Z0-9_]*[A-Z0-9]";
+/** Words a missing variable is said with after its name. */
+const UNSET_WORDS = "(?:is |was )?(?:not set|not defined|missing|required|undefined|empty|must be set)";
+const ENV_VARIABLE = "[Ee]nv(?:ironment)?[ _-]?[Vv]ar(?:iable)?";
+/**
+ * The ways a run's output says it lacks an environment variable, each with the
+ * name in its first group. Each names the variable as one: a phrase about an
+ * environment variable around it, or `process.env.` before it.
+ */
+const NAMED_MISSING_VARIABLE = [
+    // "Missing required environment variable: SUPABASE_SECRET_KEY", "missing env var FOO"
+    new RegExp(`\\b[Mm]issing (?:[Rr]equired )?${ENV_VARIABLE}s?\\b[\\s:=\`'"([{]*(${VAR_NAME})\\b`, "g"),
+    // "Environment variable SUPABASE_URL is not set"
+    new RegExp(`\\b${ENV_VARIABLE} [\`'"]?(${VAR_NAME})[\`'"]? ${UNSET_WORDS}\\b`, "g"),
+    // "SUPABASE_URL environment variable is not set"
+    new RegExp(`\\b(${VAR_NAME}) ${ENV_VARIABLE} ${UNSET_WORDS}\\b`, "g"),
+    // "process.env.FOO is undefined"
+    new RegExp(`\\bprocess\\.env\\.(${VAR_NAME}) ${UNSET_WORDS}\\b`, "g"),
+    // Yarn Berry reading a `${TOKEN}` in .yarnrc.yml that the environment lacks
+    // (staging bench 2026-10-23: GITHUB_PACKAGES_TOKEN): the suite never started.
+    /\bEnvironment variable not found \(([A-Za-z_][A-Za-z0-9_]*)\)/g,
+    // django-environ: "ImproperlyConfigured: Set the SECRET_KEY environment variable"
+    new RegExp(`\\bSet the (${VAR_NAME}) environment variable\\b`, "g"),
+];
+/**
+ * A repository's own check of its environment, on a line that reads as the
+ * error the run stopped on (staging 2026-10-24, NearMyTown's e2e:
+ * "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY is missing"). The name must look like
+ * a variable's (`A_B`), and the line an error's: a log line that a variable is
+ * missing is not why a run failed. Never "is not defined" or "is undefined":
+ * that is JavaScript's word for a name the code never declared.
+ */
+const BARE_MISSING_VARIABLE = /\b([A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+) (?:is |was )?(?:missing|not set|must be set)\b/g;
+const ERROR_LINE = /(?:Error|Exception)\b|^\s*(?:error|ERROR|fatal|FATAL)\b/;
+/** At most this many missing variables are named in one cause. */
+const MAX_NAMED_VARIABLES = 3;
+/**
+ * A line that quotes what a test expected or received, or a diff of it: a
+ * test of an environment check, never the run's own missing variable.
+ */
+const QUOTED_LINE = /^\s*[-+]\s|\b(?:[Ee]xpected|[Rr]eceived|toThrow|[Aa]ssert)/;
+/**
+ * A line a logger wrote below error level (`warn:`, `[info]`, `DEBUG`,
+ * Next.js's `⚠`): a variable it says is missing is one the run went on
+ * without, never why it failed.
+ */
+const LOG_LINE = /^\s*(?:⚠|[[(]?(?:warn(?:ing)?|info|debug|trace|notice)\b)/i;
+/** Frameworks that say which variable they lack only by what it is for. */
+const MISSING_FRAMEWORK_KEY = [
+    // Rails credentials: "Missing encryption key to decrypt file with. ... ENV["RAILS_MASTER_KEY"]"
+    [/\bMissing encryption key to decrypt file with\b/, "RAILS_MASTER_KEY"],
+    // Laravel's MissingAppKeyException
+    [/\bNo application encryption key has been specified\b/, "APP_KEY"],
+];
+/** Phrases that say a variable is missing without naming it. */
+const UNNAMED_MISSING_VARIABLE = [
+    /\bmissing (?:required )?env(?:ironment)? (?:var(?:iable)?s?)\b/i,
+    /\benvironment variable\b[^\n]{0,80}\b(?:is )?(?:not set|missing|required|must be set)\b/i,
+];
+/**
+ * What a run could not start without, when its output says so in a way the
+ * gate recognises: a credential or variable the environment lacks, or a
+ * prerequisite the sandbox has not installed. Null for anything else, which
+ * stays a real failure. Pure.
+ *
+ * Narrow on purpose, since a match makes the run "could not run" rather than
+ * the change's failure:
+ *  - a named variable counts only when `env` (the environment the command ran
+ *    under) does not have it set: one it has is not why the run failed, and
+ *    no unnamed phrase then stands in for it;
+ *  - a line that quotes a test's expectation or a diff never counts, nor
+ *    one a logger wrote below error level;
+ *  - a repository's own "`A_B` is missing" counts only on an error's line.
+ *
+ * Without `env`, a named variable is taken as unset.
+ */
+export function classifyMissingPrerequisite(output, env) {
+    const unset = (name) => !env?.[name];
+    const lines = output
+        .split("\n")
+        .filter((line) => !QUOTED_LINE.test(line) && !LOG_LINE.test(line));
+    const named = new Set(lines.flatMap((line) => [
+        ...NAMED_MISSING_VARIABLE.flatMap((re) => [...line.matchAll(re)]),
+        ...(ERROR_LINE.test(line) ? [...line.matchAll(BARE_MISSING_VARIABLE)] : []),
+    ].map((match) => match[1])));
+    const missing = [...named].filter(unset);
+    if (missing.length > 0) {
+        const more = missing.length - MAX_NAMED_VARIABLES;
+        return `${missing.slice(0, MAX_NAMED_VARIABLES).join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
+    }
+    const text = lines.join("\n");
+    for (const [re, name] of MISSING_FRAMEWORK_KEY) {
+        if (re.test(text) && unset(name))
+            return name;
+    }
+    // supabase-js `createClient` with no URL or key: the variable it was read from is unset.
+    const supabase = text.match(/\bsupabase(Url|Key) is required\b/);
+    if (supabase) {
+        return `a Supabase ${supabase[1] === "Url" ? "URL" : "key"} (supabase${supabase[1]} is required)`;
+    }
+    // Playwright with no browser of its own version (a prepare installs one; #2758).
+    if (/\bExecutable doesn't exist at /.test(text) &&
+        /\bplaywright install\b|\bbrowserType\.launch\b|\bms-playwright\b/.test(text)) {
+        return "Playwright's browsers (npx playwright install)";
+    }
+    // A variable the output names that the environment has is not missing, and
+    // no unnamed phrase stands in for it. A log line is not read at all, so one
+    // that names a variable never stops an error's own unnamed phrase from
+    // counting: that error says the run lacked a variable, only not which.
+    if (named.size === 0 && UNNAMED_MISSING_VARIABLE.some((re) => re.test(text))) {
+        return "an environment variable the output does not name";
+    }
+    return null;
+}
 /** Strip a trailing `(4 ms)` / `(0.82ms)` duration off a failing-test name. */
 function stripDuration(name) {
     return name.replace(/\s*\(\d+(?:\.\d+)?\s*m?s\)\s*$/, "").trim();
@@ -568,7 +679,9 @@ const FAILURE_SUMMARY = [
  *  - infra/env shapes (command not found, module resolution, connection
  *    refused, missing env var, DB/auth, connect timeout) → `infra` with a short
  *    cause; checked FIRST so a suite whose assertions failed only because its
- *    DB was down fails open rather than blocking.
+ *    DB was down fails open rather than blocking. A missing credential or
+ *    prerequisite ({@link classifyMissingPrerequisite}, given the `env` the
+ *    command ran under) is `infra` with `needs` and the cause "needs <it>".
  *  - recognisable failing-test lines (pnpm-wrapped vitest / jest / node:test
  *    TAP + spec reporters) → `failures` with located `critical` findings
  *    (capped at 25, deduped, locations attached when the runner printed them).
@@ -580,12 +693,15 @@ const FAILURE_SUMMARY = [
  * Callers scrub the output through {@link scrubSecrets} BEFORE classification
  * so findings/notes never carry secrets (§0.9).
  */
-export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDINGS) {
+export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDINGS, env) {
     if (exitCode === 0)
         return { kind: "clean" };
     const spawnInfra = classifyVerifyInfraFailure(output, exitCode);
     if (spawnInfra)
         return { kind: "infra", reason: spawnInfra };
+    const needs = classifyMissingPrerequisite(output, env);
+    if (needs)
+        return { kind: "infra", reason: `needs ${needs}`, needs };
     for (const [re, reason] of TEST_INFRA_PATTERNS) {
         if (re.test(output))
             return { kind: "infra", reason };
@@ -951,8 +1067,40 @@ export function buildRepoCheckEnv(source = process.env, toolchain = null, stepEn
     const env = buildTestEnv(source);
     for (const key of REPO_CHECK_SECRET_KEYS)
         delete env[key];
-    const withToolchain = toolchain ? { ...toolchain.env, ...env, PATH: toolchain.path } : env;
-    return { ...withToolchain, ...stepEnv, CI: "true" };
+    return { ...onToolchain(env, toolchain), ...stepEnv, CI: "true" };
+}
+/**
+ * `env` on the build's toolchain, as the model's shell gets it
+ * (`makeToolchainSpawnHook`): the toolchain's PATH, and its other variables
+ * beneath `env`'s own. No toolchain: `env` as it is.
+ */
+function onToolchain(env, toolchain) {
+    return toolchain ? { ...toolchain.env, ...env, PATH: toolchain.path } : env;
+}
+/**
+ * The environment the gate's own detected test script runs under. On a build
+ * that named a toolchain (a sandbox), an approved check's
+ * ({@link buildRepoCheckEnv}), so the suite runs on the repository's Node,
+ * Ruby or Go as the model's shell does, never the image's, and gives the same
+ * verdict it gives as an approved check. Without one (a developer's terminal),
+ * the user's own ({@link buildTestEnv}), as before.
+ */
+export function buildGateTestEnv(source = process.env, toolchain = null) {
+    return toolchain ? buildRepoCheckEnv(source, toolchain) : buildTestEnv(source);
+}
+/**
+ * The environment the gate's own detected typecheck or lint script runs
+ * under: the scrubbed {@link buildVerifyEnv} on the build's toolchain, when it
+ * named one. Undefined without one, so the exec seam's default applies, as
+ * before.
+ */
+export function buildGateVerifyEnv(source = process.env, toolchain = null) {
+    return toolchain ? onToolchain(buildVerifyEnv(source), toolchain) : undefined;
+}
+/** The toolchain the session's harness named (`YAGNI_TOOLCHAIN_FILE`), when it reads. */
+function sessionToolchain() {
+    const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
+    return path ? readToolchainFile(path) : null;
 }
 /** One repository command as the gate runs it: through bash, as Actions runs a `run:` step. */
 function repoCheckArgv(run) {
@@ -1111,6 +1259,7 @@ export function makeWorkstreamCheck(opts = {}) {
         // command, untagged, by whichever target reaches the command first.
         const uncoveredEmitted = new Set();
         const results = [];
+        const env = buildGateVerifyEnv(process.env, (opts.toolchain ?? sessionToolchain)());
         for (const target of targets) {
             const dirs = claimDirs(cwd, target.files);
             const commands = dirs.length > 0 ? detect(cwd, dirs).filter((c) => dirs.includes(c.cwd)) : [];
@@ -1134,7 +1283,7 @@ export function makeWorkstreamCheck(opts = {}) {
                 if (!run) {
                     const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
                     try {
-                        const { code, output } = await exec(command.argv, command.cwd, composed);
+                        const { code, output } = await exec(command.argv, command.cwd, composed, env);
                         run = { code, output: scrubSecrets(output) };
                     }
                     catch (err) {
@@ -1185,7 +1334,7 @@ export function makeWorkstreamCheck(opts = {}) {
  */
 function repoCommandFindings(failure, at) {
     const limit = at.limit ?? MAX_LOCATED_FINDINGS;
-    const cls = classifyTestFailure(failure.output, failure.code, limit);
+    const cls = classifyTestFailure(failure.output, failure.code, limit, failure.env);
     const parsed = cls.kind === "failures"
         ? cls.findings
         : parseVerifyFailures(failure.output, failure.code, at.label, limit);
@@ -1243,11 +1392,7 @@ export function makeRunVerify(opts = {}) {
             const baseline = new Set(baselinePaths ?? []);
             return parseChangedPaths(snapshot.status).filter((p) => !baseline.has(p));
         });
-    const toolchain = opts.toolchain ??
-        (() => {
-            const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
-            return path ? readToolchainFile(path) : null;
-        });
+    const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
         (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
     const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
@@ -1346,7 +1491,7 @@ export function makeRunVerify(opts = {}) {
             cwd,
             signal,
             left: () => callBudget - (now() - halfStartedAt),
-            toolchainFile: toolchain(),
+            toolchainFile: input.toolchainFile,
             findings,
             reasons,
             labels,
@@ -1389,7 +1534,15 @@ export function makeRunVerify(opts = {}) {
         }
         return { findings, reasons, labels, checks: [...unrunnable, ...run.checks] };
     }
-    /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
+    /**
+     * One repository command's verdict: passed, a note (it could not run), or a
+     * failure with its output. A check that passed on the unchanged code
+     * (`passedOnBase`, measured in this environment) and now says it lacks a
+     * credential failed: the change made it need one, and that is the change's
+     * (`needs` says what). Only the session that measured knows it passed: a
+     * resumed session's host carries forward what failed on the base, never
+     * what passed, so there the same check is could not run, failing open.
+     */
     async function runRepoCommand(run, command, dir, stepEnv, check) {
         const capMs = Math.min(opts.repoCheckTimeoutMs ?? REPO_CHECK_TIMEOUT_MS, run.left());
         const composed = composeAbortSignal(run.signal, AbortSignal.timeout(Math.max(1, capMs)));
@@ -1417,13 +1570,20 @@ export function makeRunVerify(opts = {}) {
                 return { kind: "passed" };
             }
             const output = scrubSecrets(rawOutput);
-            const cls = classifyTestFailure(output, code);
-            if (cls.kind === "infra") {
+            const cls = classifyTestFailure(output, code, MAX_LOCATED_FINDINGS, env);
+            if (cls.kind === "infra" && !(cls.needs && check.passedOnBase)) {
                 const reason = `could not run: ${cls.reason}`;
                 record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
                 return { kind: "note", reason };
             }
-            return { kind: "failed", output, code, record: record(check.baseline) };
+            return {
+                kind: "failed",
+                output,
+                code,
+                env,
+                record: record(check.baseline),
+                ...(cls.kind === "infra" && cls.needs ? { needs: cls.needs } : {}),
+            };
         }
         catch (err) {
             run.checks.push({
@@ -1470,9 +1630,13 @@ export function makeRunVerify(opts = {}) {
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
                 baseline: status,
+                passedOnBase: opts.checksOnBase?.passed.has(check.command.trim()) ?? false,
             });
             if (verdict.kind === "failed")
                 run.approvedFailed.add(canonicalCheckCommand(check.command));
+            if (verdict.kind === "failed" && verdict.needs) {
+                run.reasons.push(`approved check \`${label}\` passed on the unchanged code and now needs ${verdict.needs}: the change's failure`);
+            }
             if (verdict.kind === "note") {
                 run.reasons.push(`approved check \`${label}\` ${verdict.reason}`);
             }
@@ -1612,6 +1776,8 @@ export function makeRunVerify(opts = {}) {
         const findings = [];
         const reasons = [];
         let anyRan = false;
+        // Every half runs on the build's toolchain, as the model's shell does.
+        const toolchainFile = toolchain();
         // Failures the clean tree already had, by command label (YAG-1003).
         const preexisting = new Map();
         const countPreexisting = (label, n) => {
@@ -1638,11 +1804,12 @@ export function makeRunVerify(opts = {}) {
         // recorded reason, no finding) without sinking the verdict for the packages
         // that did run. Output is scrubbed before it can enter a finding (§0.9).
         const typecheckLabels = [];
+        const typecheckEnv = buildGateVerifyEnv(process.env, toolchainFile);
         for (const command of commands) {
             const composed = composeAbortSignal(signal, AbortSignal.timeout(timeoutMs));
             const startedAt = now();
             try {
-                const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed);
+                const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, typecheckEnv);
                 const output = scrubSecrets(rawOutput);
                 if (code !== 0) {
                     // Infra/env failure (command not found in a fresh worktree, Node loader
@@ -1686,7 +1853,7 @@ export function makeRunVerify(opts = {}) {
                 reasons.push("tests skipped: the typecheck half failed; 'clean' still requires a later round's tests");
             }
             else {
-                const testEnv = opts.testEnv ?? buildTestEnv();
+                const testEnv = opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile);
                 let testFindingCount = 0;
                 // A root test script an approved check runs too (`yarn run test`
                 // beside `yarn test`) runs once, as that check, on the repository's
@@ -1707,7 +1874,7 @@ export function makeRunVerify(opts = {}) {
                     try {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
-                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra") {
                             recordCommand(command, null, startedAt, "cannot_run", `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`);
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
@@ -1772,6 +1939,7 @@ export function makeRunVerify(opts = {}) {
                     signal,
                     baselinePaths,
                     callStartedAt,
+                    toolchainFile,
                 });
                 reasons.push(...repo.reasons);
                 repoLabels.push(...repo.labels);
@@ -1879,6 +2047,10 @@ export function makeTakeVerifyBaseline(opts = {}) {
             ...commands.map((command) => ({ command, test: false })),
             ...tests.map((command) => ({ command, test: true })),
         ];
+        // The gate's environments, so a failure keys the same on the clean tree and the build's.
+        const toolchainFile = (opts.toolchain ?? sessionToolchain)();
+        const verifyEnv = buildGateVerifyEnv(process.env, toolchainFile);
+        const testEnv = opts.testEnv ?? buildGateTestEnv(process.env, toolchainFile);
         try {
             for (const { command, test } of runs) {
                 if (signal?.aborted)
@@ -1893,13 +2065,11 @@ export function makeTakeVerifyBaseline(opts = {}) {
                     : (opts.timeoutMs ?? VERIFY_TIMEOUT_MS), left);
                 const composed = composeAbortSignal(signal, AbortSignal.timeout(cap));
                 try {
-                    const { code, output: rawOutput } = test
-                        ? await exec(command.argv, command.cwd, composed, opts.testEnv ?? buildTestEnv())
-                        : await exec(command.argv, command.cwd, composed);
+                    const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, test ? testEnv : verifyEnv);
                     const output = scrubSecrets(rawOutput);
                     let failed;
                     if (test) {
-                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                        const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, testEnv);
                         if (cls.kind === "infra" || cls.kind === "uncertain") {
                             result.notes.push(`${command.label} (${command.cwd}): ${cls.kind === "infra" ? cls.reason : "output not interpretable"}`);
                             if (cls.kind === "uncertain") {
@@ -1945,14 +2115,18 @@ export function makeTakeVerifyBaseline(opts = {}) {
         return result;
     };
 }
-/** The whole measurement's cap, before the build starts: the approved plan's own checks, once each. */
+/**
+ * The whole measurement's cap, before the build starts: each check marked to
+ * measure, once, the plan's first.
+ */
 export const CHECKS_ON_BASE_BUDGET_MS = 10 * 60_000;
 /**
  * Run each approved check `checks.json` marks `measureOnBase` once on the
  * unchanged code, before the build changes anything: a plan's check the
  * host has not seen pass there (none of the record's, or a red one the
- * record may hold from long ago). A check the plan wrote for the change
- * often fails there by design (its test file is not written yet), and a
+ * record may hold from long ago), and a command the repository's CI runs
+ * when the record names no check of its own. A check the plan wrote for the
+ * change often fails there by design (its test file is not written yet), and a
  * failure that says only that (a file not found, no tests to run, output no
  * parser reads) is no verdict: its failures all count after the build, as
  * before. A failure the gate reads (failing tests, located diagnostics, a
@@ -1967,11 +2141,7 @@ export const CHECKS_ON_BASE_BUDGET_MS = 10 * 60_000;
 export function makeMeasureChecksOnBase(opts = {}) {
     const exec = opts.exec ?? defaultExec;
     const now = opts.now ?? Date.now;
-    const toolchain = opts.toolchain ??
-        (() => {
-            const path = process.env.YAGNI_TOOLCHAIN_FILE?.trim();
-            return path ? readToolchainFile(path) : null;
-        });
+    const toolchain = opts.toolchain ?? sessionToolchain;
     const treeStatus = opts.treeStatus ??
         (async (cwd, signal) => (await snapshotWorkspace(cwd, signal)).status);
     const undoTreeWrites = opts.undoTreeWrites ?? defaultUndoTreeWrites;
@@ -2013,12 +2183,12 @@ export function makeMeasureChecksOnBase(opts = {}) {
                         continue;
                     }
                     const output = scrubSecrets(rawOutput);
-                    const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
+                    const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, env);
                     if (cls.kind === "infra") {
                         result.notes.push(`\`${label}\`: could not run: ${cls.reason}`);
                         continue;
                     }
-                    const found = repoCommandFindings({ output, code }, {
+                    const found = repoCommandFindings({ output, code, env }, {
                         label,
                         prefix: approvedPrefix(label),
                         repoRoot: cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2027.1",
+  "version": "1.2.7-staging.2031.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "1dd7310c6a9ff69891182d936aa792a4d375970b"
+  "yagniSourceSha": "38e1c8e1dced29e7f90bc2502b9aaef9fa7415db"
 }