Migration: curated stage environment (Slot 6)

If your stage needed it, declare it.

Stages no longer inherit the Host process environment. The child sees an exact-name allowlist (PATH, locale, proxy/CA, STAGEFLOW_HOME, computed cache vars, Slot 2 binding vars) plus only secrets you declare on the stage.

What breaks

Ambient $MY_API_BASE, $CI, $NPM_TOKEN, authenticated gh via operator $HOME, or undeclared proxy vars in stage bash / verify
.mcp.json ${VAR} interpolation that previously resolved from Host ambient env

Migration

Credentials — add secrets: on the stage (or pipeline entry). GitHub tokens default to GIT_ASKPASS + a materialised file (not raw env). Use { name: GITHUB_TOKEN, as: env } when a tool requires the env var (emits a WARN); askpass remains set so plain HTTPS git still authenticates via the helper (not URL-embedded tokens).
Non-secret Host vars — prefer STAGEFLOW_STAGE_ENV_ALLOW=FOO,BAR on the Host.
Stopgap — STAGEFLOW_STAGE_ENV_PASSTHROUGH=all restores ambient vars minus the permanent denylist (control/read tokens, provider keys, undeclared registry secrets). It WARN logs every launch and is removed after two minor releases (target stated in the warning).
MCP — declare secrets with as: env when servers need ${TOKEN} in env, or use ${TOKEN:-} defaults. Helper-only GITHUB_TOKEN grants do not put the value in the curated env for MCP interpolation; { as: env } does (and still sets askpass for git).
Verify — commands run under bash -c (not /bin/sh). Install bash on PATH.

Provider model auth still travels by authPath. A stage whose model is cursor/... also receives host CURSOR_API_KEY when that variable is set. The Cursor extension reads that variable inside the stage process.

In-process execution (STAGEFLOW_STAGE_EXECUTION=inprocess / Vitest default) does not provide isolation — use STAGEFLOW_STAGE_EXECUTION=process for security proofs.