@impeccable/reviews 0.1.0 → 0.1.1

package/dist/tools.js

@@ -7,13 +7,16 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
 import { requestJson } from './http.js';
-import { focusCheckup, focusState } from './focus.js';
+import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
 import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
-import { previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { pagesProject, readCloudflarePreviews } from './cloudflare.js';
+import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
-import { connectVercelProject, vercelStatus, vercelTeams, waitForVercelAccess } from './vercel.js';
+import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelStatus, vercelTeams, waitForVercelAccess } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
@@ -196,12 +199,20 @@ const NETLIFY_PREVIEWS = {
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
     },
 };
+const CLOUDFLARE_PREVIEWS = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
+        branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the build of its head only, and waits up to five minutes for it to finish.' },
+    },
+};
 const PROVE_PREVIEW = {
     type: 'object',
     additionalProperties: false,
     required: ['url', 'expect'],
     properties: {
-        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews or impeccable_netlify_previews listed, or a page on it.' },
+        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or a page on it.' },
         expect: { type: 'string', minLength: 1, description: 'Words the page shows that a file of this checkout holds, such as the app\'s name in its title.' },
     },
 };
@@ -222,7 +233,7 @@ const ASK = {
         options: {
             type: 'array',
             description: 'single and multi: the choices, at least two.',
-            items: { type: 'object', additionalProperties: false, required: ['label', 'value'], properties: { label: { type: 'string', minLength: 1 }, value: { type: 'string', minLength: 1 } } },
+            items: { type: 'object', additionalProperties: false, required: ['label', 'value'], properties: { label: { type: 'string', minLength: 1 }, value: { type: 'string', minLength: 1 }, selected: { type: 'boolean', description: 'multi only: picked when the question opens; the person can unpick it.' } } },
         },
         prefill: { type: 'string', minLength: 1, description: 'text, not with sensitive, and account: what the (username) field holds when the dialog opens, such as the seed\'s username. The person can change it.' },
         confirmLabel: { type: 'string', minLength: 1, description: 'confirm only: the way on, such as "Share test accounts".' },
@@ -252,6 +263,8 @@ function askError(q) {
         return q.options ? 'input.options is for single and multi only' : null;
     if (values.length < 2)
         return `input.options needs at least two choices for ${q.kind}`;
+    if (q.kind === 'single' && q.options.some((o) => o.selected !== undefined))
+        return 'input.options[].selected is for multi only';
     return new Set(values).size === values.length ? null : 'input.options has a value twice';
 }
 /** Why `url` is not pull request `number` of owner/repo on GitHub; null when it is. */
@@ -1388,9 +1401,12 @@ export function createTools(ctx) {
     }
     /** What the person typed into sensitive questions, by the reference the model holds instead. */
     const typed = new Map();
-    /** The origins of the successful Preview deployments of pull requests GitHub listed, and of the built deploy previews Netlify's evidence listed, which a proof may open; whether one answered with this app; and the address pattern a Netlify proof answered. */
+    /** The origins of the successful Preview deployments of pull requests GitHub listed, and of the built previews Netlify's and Cloudflare's evidence listed, which a proof may open; whether one answered with this app; and the address pattern a Netlify or Cloudflare proof answered. */
     const listedPreviews = new Set();
     const netlifyListed = new Set();
+    /** The origins of Production deployments Vercel made of a pushed branch that no locked project of this folder's made: served at a project's own address without a login, so no proof opens them. */
+    const publicProduction = new Set();
+    const cloudflareListed = new Set();
     let hostedPreviewProven = false;
     let provenPattern;
     /** The host whose preview a proof answered with this app, and the one whose previews impeccable_write then saved as the method. */
@@ -1424,7 +1440,7 @@ export function createTools(ctx) {
     };
     /** Of the origins listed, those of deployments Vercel's own bot made: the only addresses a bypass secret is ever sent to, since a deployment anyone with write access can record names any address. */
     const vercelMade = new Set();
-    /** The address impeccable_prove_preview met Vercel's login at, and the words it looked for there. */
+    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, and whose lock it was. */
     let gated;
     /** The bypass secret saved in this run, for the proof of a Vercel address to send; never for the model. It is one project's, so it goes only to the origins impeccable_vercel_bypass proved it on, never to another project's deployment of this repository. */
     let bypassSecret;
@@ -1432,6 +1448,24 @@ export function createTools(ctx) {
     /** What impeccable_vercel_bypass answered, less the secret: a skip is asked once, so that answer stands; the saved one is what an address the secret opens later gets. */
     let bypassOutcome;
     let bypassSaved;
+    /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
+    let sitePassword;
+    const passwordSites = new Set();
+    /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, and the team login stays. Another site of the repository is read on its own. */
+    const passwordStands = new Map();
+    /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
+    const passwordConsented = new Set();
+    /** The saved answer, what an address the password opens later gets. */
+    let passwordSaved;
+    /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
+    let accessGated;
+    /** The service token that opened a preview in this run, what the tool said of it, the Pages projects it opened and whether the store holds it: once it does, the proofs of those projects' previews send it; never the model. */
+    let accessToken;
+    let accessMade = {};
+    const accessProjects = new Set();
+    let accessStored = false;
+    /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
+    let accessOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
     const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer();
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
@@ -1607,14 +1641,29 @@ export function createTools(ctx) {
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
             ? { connected: true, site: result.site, how: 'github-app' } : result), signal);
     }
-    /** The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked when Vercel's GitHub app cannot reach the repository. */
+    /**
+     * The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked
+     * when Vercel's GitHub app cannot reach the repository; then, connected, the project locked behind Vercel's login at
+     * every address while it has no production deployment, before anything is pushed: Vercel makes a new project's first
+     * deployment Production whatever branch it builds, and serves it at the project's own address.
+     */
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
         const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
-        const result = await connectVercelProject(vercel);
         // Tried again every 20 s until the app reaches the repository: the person is giving it access meanwhile.
-        return hostAccess('vercel', result, () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
+        const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
+        // The fence holds pushes and deploys from the sign-in until the linked project's first deployment is settled: Vercel's app cannot reach the repository (a push builds nothing), production is deployed already, or the project is locked at every address.
+        const link = await readLink(pi.cwd);
+        if (!result.connected) {
+            if (result.access !== undefined)
+                settleVercelFirstDeployment(ctx.log, { projectId: link?.projectId ?? null, how: 'connection' });
+            return result;
+        }
+        const first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        if (link && (first.production === 'exists' || first.locked === true))
+            settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'project' });
+        return { ...result, ...first };
     }
     async function syncWorkflowTool(pi, signal) {
         try {
@@ -1658,9 +1707,36 @@ export function createTools(ctx) {
         const res = await requestJson(url, { ...init, token: await ctx.auth.token(pi) }, ctx.log);
         return res.status === 401 ? requestJson(url, { ...init, token: await ctx.auth.renew(pi) }, ctx.log) : res;
     };
-    /** A read of the setup API, trimmed to this setup before the model sees it. */
+    /**
+     * Saves a host's key for reviews: the key as Impeccable's credential for the lock, then the setting that sends it in
+     * `header`, both through the setup API. `stored` says the first write took; `failed` what stopped it, else null.
+     */
+    const saveLock = async (pi, what, header, value) => {
+        const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
+        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value } })).ok)
+            return { stored: false, failed: `The setup API did not store the ${what}.` };
+        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header } })).ok)
+            return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
+        return { stored: true, failed: null };
+    };
+    /** The instructions the writes are checked against: the first state may have come before the scan proposed the apps, so a later read that shows them brings the apps write in. */
+    let instructions = ctx.instructions;
+    /** Whether the run signed in again for apps the scan proposed after the sign-in. */
+    let renewedForApps = false;
+    /**
+     * A read of the state or the checkup, trimmed to this setup before the model sees it. The setup token covers the apps
+     * there were at sign-in, so an app the scan proposed later reads `not-selected`: the run signs in again, for a token
+     * that covers every app there is now, and reads again. Once it has, a card still left out goes into the report.
+     */
     const get = async (pi, path, focus) => {
-        const res = await call(pi, `${ctx.setupApi}${path}`);
+        let res = await call(pi, `${ctx.setupApi}${path}`);
+        if (res.ok && !renewedForApps && appsLeftOut(res.data, ctx.repo)) {
+            await ctx.auth.renew(pi, 'apps');
+            renewedForApps = true;
+            res = await call(pi, `${ctx.setupApi}${path}`);
+        }
+        if (res.ok && ctx.allInstructions !== undefined && severalApps(res.data))
+            instructions = focusInstructions(ctx.allInstructions, { apps: true });
         return answerText(res.ok ? { ...res, data: focus(res.data) } : res);
     };
     return [
@@ -1735,20 +1811,20 @@ export function createTools(ctx) {
             reportTasks(tasks);
             return JSON.stringify({ ...observation, attempts: attempts(), budget: budget() });
         }),
-        tool('impeccable_state', 'Setup state', 'Read the setup state again, trimmed to this setup: each repository\'s scan, preview and sign-in items, and the setup page\'s other cards in notPartOfThisSetup.', NO_INPUT, (_p, pi) => get(pi, '/state', focusState)),
+        tool('impeccable_state', 'Setup state', 'Read the setup state again, trimmed to this setup: each repository\'s scan, preview and sign-in items, its apps item where the scan proposed several apps, and the setup page\'s other cards in notPartOfThisSetup.', NO_INPUT, (_p, pi) => get(pi, '/state', focusState)),
         tool('impeccable_checkup', 'Checkup', 'Run the checkup for this setup\'s items: it reads GitHub again and answers status (complete, waiting or incomplete), next (what to do, in order), forPerson (what only the person can do) and waitingFor (what needs time).', NO_INPUT, (_p, pi) => get(pi, '/checkup', focusCheckup)),
         tool('impeccable_write', 'Write a setting', 'Write a setting through the setup API, at an endpoint the instructions list and with the method they give.', WRITE, async (p, pi, signal) => {
-            const target = resolveWrite(ctx.instructions, ctx.setupApi, ctx.repo, p.path);
+            const target = resolveWrite(instructions, ctx.setupApi, ctx.repo, p.path);
             if ('error' in target)
                 return `Refused: ${target.error}`;
             if (/\/(preview-auth\/[^/]+|preview-protection)$/.test(target.url))
-                return 'Refused: a Vercel bypass secret is saved by impeccable_vercel_bypass, which opens the preview with it first, and never through this tool. Nothing was saved.';
+                return "Refused: a host's key is saved by impeccable_vercel_bypass (a Vercel bypass secret), impeccable_netlify_password (a Netlify site password) or impeccable_cloudflare_access (a Cloudflare Access service token), which opens the preview with it first, and never through this tool. Nothing was saved.";
             if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && !hostedPreviewProven) {
                 return "Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app. Nothing was saved.";
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
-                return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify preview. Nothing was saved.';
+                return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify or Cloudflare Pages preview. Nothing was saved.';
             }
             const testAccounts = target.url.endsWith('/test-accounts');
             let body = p.body;
@@ -1901,24 +1977,39 @@ export function createTools(ctx) {
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
-        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer (a project\'s first deployment is called Production, whatever branch it builds, and counts). It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, _pi, signal) => {
+        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
             const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
-            // With `branch` the evidence holds only the deployments of its head, and Vercel's is its preview whatever environment it is called: the first deployment of a
+            // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
             // project is its Production one, even from a branch. Another integration's deployment of the same commit says nothing about it. Without it a preview is a Preview.
-            const preview = (d) => (branch !== undefined ? d.vercel : /preview/i.test(d.environment ?? ''));
-            // A head's preview is still building until it has a final status.
-            const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => preview(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
+            const isPreview = (d) => /preview/i.test(d.environment ?? '');
+            const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
+            // A head's build is still building until it has a final status.
+            const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
             const evidence = branch !== undefined ? await awaitBuild(`Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
             listedPreviews.clear();
             vercelMade.clear();
+            publicProduction.clear();
+            /** The hosts of the linked project's deployments while it is locked at every address, read from Vercel once a Production deployment turns up, and once per call. */
+            let locked;
             for (const d of evidence.deployments) {
-                if (d.state === 'success' && d.url && preview(d) && (d.pullRequests.length || branch !== undefined)) {
-                    const { origin } = new URL(d.url);
-                    listedPreviews.add(origin);
-                    if (d.vercel)
-                        vercelMade.add(origin);
+                if (d.state !== 'success' || !d.url || !ofBranch(d) || !(d.pullRequests.length || branch !== undefined))
+                    continue;
+                const url = new URL(d.url);
+                // A pushed branch's Production deployment is its preview only as the locked project's own: under Standard Protection a project's own address serves it to anyone, and another project of this repository may have made it.
+                if (branch !== undefined && !isPreview(d)) {
+                    locked ??= await (async () => {
+                        const link = await readLink(pi.cwd);
+                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link) : new Set();
+                    })();
+                    if (!locked.has(url.host)) {
+                        publicProduction.add(url.origin);
+                        continue;
+                    }
                 }
+                listedPreviews.add(url.origin);
+                if (d.vercel)
+                    vercelMade.add(url.origin);
             }
             return JSON.stringify(evidence);
         }),
@@ -1935,18 +2026,52 @@ export function createTools(ctx) {
                     netlifyListed.add(new URL(p.url).origin);
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews or impeccable_netlify_previews listed for a pull request or a pushed branch (a successful Preview deployment, or a deploy preview that is ready), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify it answers the address pattern to save beside it. gate "vercel-protection" or "netlify-protection" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or wrangler on this machine when it is signed in (read only: it never signs in). cli says whether wrangler is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or wrangler. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+            const pull = p.pull;
+            const branch = p.branch;
+            if (pull !== undefined && branch !== undefined)
+                return 'Invalid input: give pull or branch, not both.';
+            const read = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch });
+            // Cloudflare posts its check run once the build ended: until then the head lists nothing, or wrangler's row says it is building.
+            // GitHub's record unread ends the wait; wrangler's alone does not, since the check run still says when the build ends.
+            const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
+            const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
+            const evidence = subject ? await awaitBuild(`Waiting for Cloudflare Pages to build ${subject}`, read, final, signal) : await read();
+            cloudflareListed.clear();
+            for (const preview of evidence.previews) {
+                if (preview.state !== 'success')
+                    continue;
+                cloudflareListed.add(new URL(preview.url).origin);
+                if (preview.alias)
+                    cloudflareListed.add(new URL(preview.alias).origin);
+            }
+            return JSON.stringify(evidence);
+        }),
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
-            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin)))
-                return 'Refused: open the address of a preview that impeccable_hosted_previews or impeccable_netlify_previews listed for a pull request or a pushed branch, or a page on it.';
-            const proof = await provePreview(url, p.expect, pi.cwd, { fetch: ctx.previewFetch, signal, ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}) });
+            if (URL.canParse(url) && publicProduction.has(new URL(url).origin))
+                return "Refused: Vercel called this deployment Production, as it calls a project's first whatever branch it builds, and no project of this folder's that is locked at every address made it, so it is served at a project's own address without a login: it is no preview, and nothing was opened. No test drive, as the vercel-setup case says.";
+            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin) || cloudflareListed.has(new URL(url).origin)))
+                return 'Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it.';
+            const site = netlifySiteOf(url);
+            // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
+            const project = pagesProject(new URL(url).origin);
+            const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
+            const proof = await provePreview(url, p.expect, pi.cwd, {
+                fetch: ctx.previewFetch, signal,
+                ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}),
+                ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
+                ...(token ? { access: token } : {}),
+            });
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
             if (proof.proven && proof.pattern)
                 provenPattern = proof.pattern;
-            if (proof.gate === 'vercel-protection')
-                gated = { url, expect: p.expect };
+            if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
+                gated = { url, expect: p.expect, gate: proof.gate };
+            if (proof.gate === 'cloudflare-access' && cloudflareListed.has(new URL(url).origin))
+                accessGated = { url, expect: p.expect };
             return JSON.stringify(proof);
         }),
         tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
@@ -1958,9 +2083,9 @@ export function createTools(ctx) {
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
             return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
         }),
-        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits. connected true means the repository is connected, or was already. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
+        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
         tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
-            if (!gated || !vercelMade.has(new URL(gated.url).origin))
+            if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
             if (bypassOutcome?.status === 'skipped')
                 return JSON.stringify(bypassOutcome);
@@ -1983,13 +2108,9 @@ export function createTools(ctx) {
                 },
                 prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
                 save: async (secret) => {
-                    const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
-                    if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value: secret } })).ok)
-                        return 'The setup API did not store the secret.';
-                    stored = true;
-                    if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: BYPASS_HEADER } })).ok)
-                        return 'The setup API stored the secret, but not the setting that sends it: it is turned on under Deployment protection on the setup page.';
-                    return null;
+                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret);
+                    stored = saved.stored;
+                    return saved.failed;
                 },
                 remember: noteSensitiveAnswer,
             });
@@ -2011,5 +2132,138 @@ export function createTools(ctx) {
             }
             return JSON.stringify(bypassOutcome);
         }),
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), login (Netlify\'s team login stands in front, which no tool gets past: protection says so, and reason why), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+            const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
+            if (!gated || !site)
+                return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
+            const stands = passwordStands.get(site);
+            if (stands)
+                return JSON.stringify(stands);
+            const at = gated;
+            /** The address pattern the proof with the password answers, saved as the method once the password is. */
+            let pattern;
+            const prove = async (password) => {
+                const proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password });
+                if (proof.proven && proof.pattern)
+                    pattern = proof.pattern;
+                return proof;
+            };
+            // A password in hand already: another deploy preview of the same site opens with it.
+            if (passwordSaved && sitePassword && (await prove(sitePassword)).proven) {
+                passwordSites.add(site);
+                provenPattern = pattern ?? provenPattern;
+                return JSON.stringify(passwordSaved);
+            }
+            /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
+            let stored = false;
+            const { value, ...told } = await passNetlifyLock({
+                run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
+                site,
+                consent: async () => {
+                    if (passwordConsented.has(site) || !(await ask(HOST_SCREENS['netlify-password'])).skipped)
+                        return passwordConsented.add(site), true;
+                    return false;
+                },
+                paste: async () => {
+                    const answer = await ask(HOST_SCREENS['netlify-password-key']);
+                    return answer.skipped ? undefined : answer.value?.trim();
+                },
+                prove,
+                save: async (password) => {
+                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password));
+                    stored = saved.stored;
+                    return saved.failed;
+                },
+                remember: noteSensitiveAnswer,
+            });
+            const passwordOutcome = { ...told, ...(told.status === 'saved' ? { proven: true } : {}) };
+            if (told.status === 'skipped' || told.status === 'login')
+                passwordStands.set(site, passwordOutcome);
+            if (value) {
+                // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
+                sitePassword = value;
+                passwordSites.clear();
+                passwordSites.add(site);
+                hostedPreviewProven = true;
+                provenHost = 'Netlify';
+                provenPattern = pattern ?? provenPattern;
+                passwordSaved = passwordOutcome;
+            }
+            else if (told.status === 'save-failed' && stored) {
+                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through.
+                sitePassword = undefined;
+                passwordSites.clear();
+                passwordSaved = undefined;
+            }
+            return JSON.stringify(passwordOutcome);
+        }),
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token and one taking the Cloudflare API token that creating it takes, then the token named "Impeccable reviews" created and allowed in the policy of the application in front of the preview; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+            if (!accessGated)
+                return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
+            if (accessOutcome?.status === 'skipped')
+                return JSON.stringify(accessOutcome);
+            const at = accessGated;
+            let proof;
+            const prove = async (token) => (proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token }));
+            const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
+            const save = async (token) => {
+                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret } })).ok)
+                    return 'The setup API did not store the service token.';
+                // An app that signs in with Access sends this token already: the setting would make it a second credential, which the setup API refuses.
+                const repos = object((await call(pi, `${ctx.setupApi}/state`)).data)?.repos;
+                const lock = Array.isArray(repos) ? object(object(repos.map(object).find((r) => r?.name === ctx.repo)?.items)?.['preview-protection']) : undefined;
+                if (lock?.authMethod === 'access')
+                    return null;
+                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access' } })).ok)
+                    return 'The setup API stored the service token, but not the setting that sends it: it is turned on under Preview protection on the setup page.';
+                return null;
+            };
+            let answer;
+            if (accessToken && (await prove(accessToken)).proven) {
+                // The token in hand opens this address too: stored already, or stored now.
+                const failed = accessStored ? null : await save(accessToken);
+                answer = { status: failed ? 'save-failed' : 'saved', ...accessMade, ...(failed ? { reason: failed } : {}), value: accessToken };
+            }
+            else {
+                answer = await passCloudflareAccess({
+                    url: at.url,
+                    consent: async () => !(await ask(HOST_SCREENS['cloudflare-access'])).skipped,
+                    apiToken: async () => {
+                        const typed = await ask(HOST_SCREENS['cloudflare-access-api']);
+                        return typed.skipped ? undefined : typed.value;
+                    },
+                    paste: async () => {
+                        const typed = await ask(HOST_SCREENS['cloudflare-access-key']);
+                        return typed.skipped ? undefined : { id: typed.username, secret: typed.password };
+                    },
+                    prove,
+                    save,
+                    remember: noteSensitiveAnswer,
+                    signal,
+                    ...(ctx.hostWait?.policy ? { wait: ctx.hostWait.policy } : {}),
+                });
+            }
+            const { value, ...told } = answer;
+            if (value) {
+                // What is in hand follows the store, which holds one token: a new one is the one saved now, and the projects the last one opened no longer stand.
+                if (value !== accessToken)
+                    accessProjects.clear();
+                accessToken = value;
+                accessStored = told.status === 'saved';
+                accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}) };
+                const project = pagesProject(new URL(at.url).origin);
+                if (project)
+                    accessProjects.add(project);
+            }
+            const pattern = told.status === 'saved' ? proof?.pattern : undefined;
+            accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };
+            if (told.status === 'saved') {
+                hostedPreviewProven = true;
+                provenHost = 'Cloudflare Pages';
+                if (pattern)
+                    provenPattern = pattern;
+            }
+            return JSON.stringify(accessOutcome);
+        }),
     ];
 }

package/dist/ui/bridge.js

@@ -120,17 +120,20 @@ async function askOnStdin(q) {
     }
     if (q.kind === 'account') {
         // An empty username keeps the one the field would hold; an empty password skips the account.
-        out.write(`\n${q.title ? `${q.title}. ` : ''}${q.prompt}\n${q.hint ? `${q.hint}\n` : ''}Username or email${q.prefill ? ` (Enter for ${q.prefill})` : ''}: `);
+        const [first, second] = q.fields ?? ['Username or email', 'Password'];
+        out.write(`\n${q.title ? `${q.title}. ` : ''}${q.prompt}\n${q.hint ? `${q.hint}\n` : ''}${first}${q.prefill ? ` (Enter for ${q.prefill})` : ''}: `);
         const username = (await nextLine())?.trim() || q.prefill;
         if (!username)
             return { skipped: true };
-        out.write('Password, or Enter to skip: ');
+        out.write(`${second}, or Enter to skip: `);
         const password = await (process.stdin.isTTY ? hiddenLine : nextLine)();
         return password ? { skipped: false, username, password } : { skipped: true };
     }
     const how = q.kind === 'text' ? (q.skippable ? '(Enter to skip)' : '') : q.kind === 'single' ? `Type a number${q.skippable ? ', or Enter to skip' : ''}:` : `Type the numbers, separated by commas${q.skippable ? ', or Enter to skip' : ''}:`;
     out.write(`\n${q.prompt}\n${q.hint ? `${q.hint}\n` : ''}`);
-    (q.options ?? []).forEach((o, i) => out.write(`  ${i + 1}. ${o.label}\n`));
+    // A multi choice that opens with picks shows them; on a pipe the numbers typed are the whole answer.
+    const marked = q.kind === 'multi' && (q.options ?? []).some((o) => o.selected);
+    (q.options ?? []).forEach((o, i) => out.write(`  ${i + 1}. ${marked ? `[${o.selected ? 'x' : ' '}] ` : ''}${o.label}\n`));
     // A sensitive answer typed at a terminal is not echoed.
     const read = q.sensitive && process.stdin.isTTY ? hiddenLine : nextLine;
     out.write(how ? `${how} ` : '');

package/dist/ui/look.js

@@ -20,6 +20,11 @@ const FIELD_WIDTH = 48;
 /** The running task's spinner: one glyph every third frame. */
 const SPINNER = ['◐', '◓', '◑', '◒'];
 const START = { heading: "Let's set up your app", text: 'This wizard detects your framework and wires up all the essentials.' };
+/** The sign-in over a run, by why it signs in again. */
+const AGAIN = {
+    'ran-out': 'Your sign-in ran out. Approve again in your browser to carry on.',
+    apps: 'Impeccable found your apps after you signed in. Approve again in your browser to set them up.',
+};
 /** The invitation to the test drive, on whichever end screen shows it; the words "test drive" stay off it. */
 export const SEE_THE_REVIEW = 'See Impeccable review a change: we opened a small pull request just for that.';
 const WORDMARK = 'I M P E C C A B L E';
@@ -162,7 +167,8 @@ function questionPage(qv, inner, st) {
         const width = Math.min(FIELD_WIDTH, inner);
         const label = (text) => `  ${st.soft(text)}`;
         const hint = q.hint ? [...wrapTextWithAnsi(q.hint, width - 2).map(label), ''] : [];
-        const fields = [...fieldBox('Username or email', qv.field(width - 2), width, qv.focus !== 1, st), ...fieldBox('Password', qv.password?.() ?? '', width, qv.focus === 1, st)];
+        const [first, second] = q.fields ?? ['Username or email', 'Password'];
+        const fields = [...fieldBox(first, qv.field(width - 2), width, qv.focus !== 1, st), ...fieldBox(second, qv.password?.() ?? '', width, qv.focus === 1, st)];
         return {
             heading: q.title ?? 'A test account',
             text: said(q.prompt, inner, st),
@@ -279,7 +285,7 @@ function pageOf(f, inner) {
             const link = block(urlRows(scene.link, ruleWidth(inner), st.soft, st), inner);
             return {
                 heading: scene.again ? 'Sign in again' : START.heading,
-                text: said(scene.again ? 'Your sign-in ran out. Approve again in your browser to carry on.' : 'Sign in with GitHub in your browser, then approve this repository.', inner, st),
+                text: said(scene.again ? AGAIN[scene.again] : 'Sign in with GitHub in your browser, then approve this repository.', inner, st),
                 rule: divider(inner, st),
                 action: [...link, ...(under ? ['', center(st.full(under), inner)] : []), ...(scene.copied === false ? ['', copyWay(inner, st)] : [])],
             };

package/dist/ui/screens.js

@@ -155,7 +155,9 @@ class Wizard {
                 this.state.touch();
                 resolve(answer);
             };
-            this.questions.push({ q, resolve: answered, field, password: q.kind === 'account' ? new Input() : undefined, focus: 0, cursor: 0, picked: new Set() });
+            // A multi choice opens with the options the question marks selected picked.
+            const picked = new Set(q.kind === 'multi' ? (q.options ?? []).flatMap((o, i) => (o.selected ? [i] : [])) : []);
+            this.questions.push({ q, resolve: answered, field, password: q.kind === 'account' ? new Input() : undefined, focus: 0, cursor: 0, picked });
             this.redraw();
         });
     }
@@ -289,14 +291,19 @@ class Wizard {
         else if (matchesKey(data, 'enter')) {
             if (choices && q.kind === 'single')
                 return done({ skipped: false, value: choices[question.cursor].value });
-            if (choices)
+            // A multi choice answers what is picked; with nothing picked, Skip is the way to say none.
+            if (choices && question.picked.size)
                 return done({ skipped: false, values: choices.filter((_, i) => question.picked.has(i)).map((o) => o.value) });
-            const value = question.field.getValue().trim();
-            if (value)
-                return done({ skipped: false, value });
-            if (q.skippable)
-                return done({ skipped: true });
-            question.note = 'Type an answer first.';
+            if (choices)
+                question.note = 'Pick at least one, or skip.';
+            else {
+                const value = question.field.getValue().trim();
+                if (value)
+                    return done({ skipped: false, value });
+                if (q.skippable)
+                    return done({ skipped: true });
+                question.note = 'Type an answer first.';
+            }
         }
         else if (!choices) {
             question.field.handleInput(data);
@@ -443,7 +450,7 @@ export function showSignIn(link, opts) {
         console.log(link);
         return { close() { } };
     }
-    const view = { kind: 'signin', link, opts, pasting: false, again: screen.views.some((v) => v.kind === 'run') };
+    const view = { kind: 'signin', link, opts, pasting: false, again: screen.views.some((v) => v.kind === 'run') && (opts.why ?? 'ran-out') };
     screen.push(view);
     screen.copy(view);
     return { close: () => screen.remove(view) };