{
  "checker": {
    "details": {
      "checks": [
        {
          "check": "install",
          "details": {
            "argv": [
              "pnpm",
              "install",
              "--frozen-lockfile",
              "--offline"
            ],
            "kind": "cli",
            "needs_browser": false,
            "needs_credentials": false,
            "returncode": 0,
            "scope": "partial: install",
            "stderr": "",
            "stdout": "Lockfile is up to date, resolution step is skipped\nAlready up to date\n\n. postinstall$ node ./bin/postinstall.js\n. postinstall: Done\n. prepare$ node scripts/hooks-install.mjs --tolerate-failure && node scripts/evidence-fold.mjs --install --tolerate-failure\n. prepare: hooks: git is not available here, so no push hook can be wired (nothing to do).\n. prepare: evidence-fold: git config --local merge.evidence-fold.driver failed, so a fold would still stop on a manifest conflict\n. prepare: evidence-fold: this is the `prepare` path, so the install is NOT failed by it. Run `pnpm evidence:fold:check` for the read-only answer, and `pnpm evidence:fold:install` once the cause is fixed.\n. prepare: Done\n\u256d Warning \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502                                                                              \u2502\n[excerpt truncated]",
            "working": false
          },
          "optional": false,
          "status": "PASS"
        },
        {
          "check": "credentials_error",
          "details": {
            "argv": [
              "pnpm",
              "exec",
              "electron-vite",
              "build"
            ],
            "blocker": "product did not produce a clear credential error: {\"returncode\": 1, \"stdout\": \"\", \"stderr\": \"failed to load config from /workspace/electron.vite.config.js\\nerror during build:\\nError: VITE_GOOGLE_CLIENT_ID is not set\\n    at replaceBackendConfigPlugin (/workspace/electron.vite.config.js:5193:11)\\n    at Object.<anonymous> (/workspace/electron.vite.config.js:5258:7)\\n    at Module._compile (node:internal/modules/cjs/loader:1562:14)\\n    at _require.extensions.<computed> [as .js] (file:///workspace/node_modules/.pnpm/electron-vite@3.1.0_vite@6.2.6_@types+node@22.14.1_jiti@2.7.0_lightningcss@1.32.0_yaml@2.7.1_/node_modules/electron-vite/dist/chunks/lib-DyJQBCfr.mjs:1186:24)\\n    at Module.load (node:internal/modules/cjs/loader:1313:32)\\n    at Function._load (node:internal/modules/cjs/loader:1123:12)\\n    at TracingChannel.traceSync (node:diagnostics_channel:322:14)\\n    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)\\n    at Module.require (node:internal/modules/cjs/loader:1335:12)\\n    at require (node:internal/modules/helpers:136:16)\\n\", \"needs_credentials\": false, \"needs_browser\": false}",
            "kind": "cli",
            "needs_browser": false,
            "needs_credentials": false,
            "returncode": 1,
            "stderr": "failed to load config from /workspace/electron.vite.config.js\nerror during build:\nError: VITE_GOOGLE_CLIENT_ID is not set\n    at replaceBackendConfigPlugin (/workspace/electron.vite.config.js:5193:11)\n    at Object.<anonymous> (/workspace/electron.vite.config.js:5258:7)\n    at Module._compile (node:internal/modules/cjs/loader:1562:14)\n    at _require.extensions.<computed> [as .js] (file:///workspace/node_modules/.pnpm/electron-vite@3.1.0_vite@6.2.6_@types+node@22.14.1_jiti@2.7.0_lightningcss@1.32.0_yaml@2.7.1_/node_modules/electron-vite/dist/chunks/lib-DyJQBCfr.mjs:1186:24)\n    at Module.load (node:internal/modules/cjs/loader:1313:32)\n    at Function._load (node:internal/modules/cjs/loader:1123:12)\n    at TracingChannel.traceSync (node:diagnostics_channel:322:14)\n    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)\n    at Module.require (node:internal/modules/cjs/loader:1335:12)\n[excerpt truncated]",
            "stdout": "",
            "working": false
          },
          "optional": false,
          "status": "FAIL"
        }
      ],
      "scope": "partial checks",
      "working": false
    },
    "status": "FAIL"
  },
  "fault_owner": "prerequisite",
  "main_blocker": "Missing build credentials: VITE_GOOGLE_CLIENT_ID is not set (also VITE_GOOGLE_CLIENT_SECRET, VITE_MICROSOFT_CLIENT_ID, VITE_MICROSOFT_TENANT_ID). This is a prerequisite, not a repo defect: the guard is intentional and documented in scripts/check-build-env.mjs.",
  "operation": "Documented build from source: `pnpm build` (README -> docs/BUILD.md 'Building from source'), which runs electron-vite build for the desktop app. Exercised as far as possible: dependency install, then the build's config load, which is where the repo's own credential guard fires.",
  "operation_scope": "Covers install and the build up to config load. Not reached: a successful build, packaging, or running the app. Unmet prerequisites: (1) Google and Microsoft OAuth build variables VITE_GOOGLE_CLIENT_ID, VITE_GOOGLE_CLIENT_SECRET, VITE_MICROSOFT_CLIENT_ID, VITE_MICROSOFT_TENANT_ID are not provided in the VM (scripts/vite-plugins/replace-backend-config.ts throws 'VITE_GOOGLE_CLIENT_ID is not set'). (2) The Electron 44.3.0 runtime cannot be fetched by the prebuild step in this VM (Node fetch ignores HTTPS_PROXY; github.com lookup gives EAI_AGAIN). Not run: the full test and lint suites, per the task.",
  "outcome": "blocked",
  "probe": ".coldpass/probe.json",
  "steps": [
    "Read README.md, .env.template, .env.build.example, scripts/check-build-env.mjs, scripts/vite-plugins/replace-backend-config.ts, docs/BUILD.md",
    "Installed Node v22.13.1 from nodejs.org tarball (matches .nvmrc) and xz-utils via apt",
    "npm i -g pnpm@10 (pnpm 10.34.7)",
    "pnpm install --frozen-lockfile: failed on registry 500/504 three times, then succeeded on the 4th retry",
    "Installed build-essential and python3 via apt, because node-pty's native build needed make/g++ (first attempt failed: 'not found: make')",
    "pnpm build: failed in prebuild (node ./bin/ensure-electron.js) with 'Electron runtime is missing ... could not be fetched' (TypeError: fetch failed, EAI_AGAIN github.com)",
    "pnpm exec electron-vite build (same build, prebuild skipped): failed in config load with 'Error: VITE_GOOGLE_CLIENT_ID is not set' (replace-backend-config plugin)",
    "Did not download Electron through the proxy or substitute placeholder OAuth values, since that would fake the credentials the build guards; no product source changed"
  ],
  "stuck_step": "pnpm build (README 'Building from source' -> docs/BUILD.md). It fails first at the prebuild Electron fetch, and after that at the electron-vite config load, which requires the OAuth build variables.",
  "suggested_fix": "Provide the four OAuth build variables (for example in a .env at the repo root, based on .env.template / .env.build.example) from the project's OAuth apps, then run `pnpm build`. Also make the Electron runtime reachable: either allow github.com egress from the VM, or run `node bin/ensure-electron.js` with a Node that honours HTTPS_PROXY (Node 22.21+ with NODE_USE_ENV_PROXY=1), or pre-place electron-v44.3.0-linux-x64.zip in the electron cache. A non-credential smoke check is the install plus the 'VITE_GOOGLE_CLIENT_ID is not set' config-load failure recorded in probe.json."
}