@impeccable/reviews 0.1.0 → 0.1.2

package/dist/fence.js

@@ -1,5 +1,8 @@
+import { execFileSync } from 'node:child_process';
 import { readFileSync, realpathSync, statSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { gitEnvironment } from './sandbox.js';
+import { DATA_NOTE, scan, scanRecorder } from './scan.js';
 const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
 const deny = (reason) => ({ verdict: 'deny', reason });
 const never = (reason) => ({ verdict: 'never', reason });
@@ -179,10 +182,12 @@ function pathsOf(args) {
     return args.flatMap((a) => (a.startsWith('--') && a.includes('=') ? [a.slice(a.indexOf('=') + 1)] : a.startsWith('-') ? [] : [a]));
 }
 const inside = (args, where) => !pathsOf(args).some((a) => outside(a, where));
+/** Files named as examples, whose secrets are placeholders. */
+const EXAMPLE = /\.(example|sample|template|dist)$/;
 /** A .env file, or a pattern that can name one, holds live secrets; the examples next to it do not. */
 export function isSecretFile(path) {
     const name = basename(path);
-    return name.startsWith('.env') && !/\.(example|sample|template|dist)$/.test(name);
+    return name.startsWith('.env') && !EXAMPLE.test(name);
 }
 function rmRecursiveForce(words) {
     const at = words.indexOf('rm');
@@ -275,7 +280,7 @@ function commitReads(args) {
     }
     return values;
 }
-function git(args, where, protectedBranches) {
+function git(args, where, protectedBranches, held = false) {
     const [sub, ...rest] = args[0] === '--no-pager' ? args.slice(1) : args;
     if (sub === 'status' || sub === 'diff' || sub === 'log' || sub === 'show' || sub === 'add') {
         const excluded = sub === 'add' && rest.includes(EXCLUDE_ENV);
@@ -304,7 +309,10 @@ function git(args, where, protectedBranches) {
         return allow();
     if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
         const branch = rest[2];
-        return branch.includes(':') || branch === 'HEAD' || protectedBranches.includes(branch) ? deny('a push to the default branch') : allow();
+        if (branch.includes(':') || branch === 'HEAD' || protectedBranches.includes(branch))
+            return deny('a push to the default branch');
+        // A connected Vercel project builds every push, and calls a new project's first deployment Production, public at the project's own address.
+        return held ? deny("a push before impeccable_vercel_connect settled the linked Vercel project's first deployment: run it first") : allow();
     }
     return deny('a git command off the allowlist');
 }
@@ -347,6 +355,8 @@ function tool(args, where, scriptsChanged = false) {
     // A version or a tag may follow the name; an alias such as next@npm:other is another package, so it stays on.
     const name = (args[i] ?? '').replace(/@[\w.^~<>=*+-]+$/, '');
     const rest = args.slice(i + 1);
+    if (name === 'cf')
+        return cloudflareCli(rest);
     if (!TOOLS.has(name))
         return deny(`${name || 'that'} is not on the tool list`);
     if (name === 'playwright' && (rest[0] === 'install-deps' || rest.includes('--with-deps')))
@@ -357,6 +367,15 @@ function tool(args, where, scriptsChanged = false) {
         return deny(changedReason(scriptsChanged));
     return inside(rest, where) ? allow() : deny('a path outside the checkout');
 }
+/**
+ * cf, Cloudflare's CLI: the tools run it in the command's own process, as the person (its sign-in, the preview
+ * deployments, and the service token, whose secret it prints), so none of it runs here, and a delete never does.
+ */
+function cloudflareCli(args) {
+    if (args.some((a) => a === 'delete' || a === 'disconnect'))
+        return never('deletes on Cloudflare');
+    return deny("cf runs in the tools, as the person: impeccable_cloudflare_previews reads Cloudflare's previews, and impeccable_cloudflare_access signs in and makes the service token");
+}
 /** A package manager's install, script or version; with `tools`, also a tool from the list through pnpm exec or yarn. */
 function packageManager(pm, args, where, scriptsChanged, tools = true) {
     const [sub = '', ...rest] = args;
@@ -410,6 +429,25 @@ function reader(cmd, args, where) {
 }
 /** A host's CLI package, by host: the one global install that runs, and only once the person said yes to setting that host up. */
 const HOST_CLIS = { netlify: 'netlify-cli', vercel: 'vercel' };
+/** git commit and push, gh and the host CLIs: what uses the person's GitHub, Vercel, Netlify or Cloudflare sign-in, keys or keychain. */
+function asPerson(words) {
+    const [cmd = '', ...args] = words;
+    if (cmd === 'git')
+        return ['commit', 'push'].includes((args[0] === '--no-pager' ? args[1] : args[0]) ?? '');
+    return cmd === 'gh' || cmd === 'vercel' || cmd === 'netlify' || cmd === 'cf';
+}
+/** Where the command runs; null when it joins what runs as the person to what runs in the sandbox, which the fence refuses. cd and git's other commands, which need no sign-in, run on either side. */
+export function placeOf(command) {
+    const commands = (parseCommand(command) ?? []).map(({ words }) => words.slice(envCount(words)));
+    const installs = commands.filter(([pm = '', ...args]) => PACKAGE_MANAGERS.has(pm) && installsHostCli(pm, args, new Set(Object.keys(HOST_CLIS)))).length;
+    if (installs)
+        return installs === commands.length ? 'install' : null;
+    const person = commands.filter(asPerson).length;
+    if (!person)
+        return 'sandbox';
+    const either = commands.filter((words) => !asPerson(words) && (words[0] === 'cd' || words[0] === 'git')).length;
+    return person + either === commands.length ? 'person' : null;
+}
 /** Whether this is a global install of a host's CLI and nothing else, the person having said yes to setting that host up. */
 function installsHostCli(pm, args, hosts) {
     const rest = args.filter((a) => !['-g', '--global', '--location=global'].includes(a));
@@ -420,34 +458,34 @@ function installsHostCli(pm, args, hosts) {
     return global && (verbs[pm] ?? []).includes(verb) && !more.length && Object.entries(HOST_CLIS).some(([host, pkg]) => pkg === cli && hosts.has(host));
 }
 /** The Netlify CLI's options that take a value, of those the rules below allow, so the value is not read as a command. */
-const NETLIFY_VALUES = new Set(['--name', '--context', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
-/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, the one deploy context, a team's slug. */
+const NETLIFY_VALUES = new Set(['--name', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
+/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, a team's slug. */
 const NETLIFY_VALID = {
     '--name': /^[A-Za-z0-9-]{1,63}$/,
     '--id': /^[0-9a-f-]{8,64}$/i,
     '--git-remote-url': /^(?:https:\/\/github\.com\/)?[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}?(?:\.git)?$/,
     '--git-remote-name': /^[A-Za-z0-9._-]{1,50}$/,
-    '--context': /^deploy-preview$/,
     '--account-slug': /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/,
 };
-/** Whether the folder is linked to a Netlify site: `.netlify/state.json` names it. */
-function linkedToSite(dir) {
+/** The Vercel project the folder is linked to, as `vercel link` wrote it in `.vercel/project.json`; null with none. */
+function linkedVercelProject(dir) {
     try {
-        return typeof JSON.parse(readFileSync(join(dir, '.netlify', 'state.json'), 'utf8')).siteId === 'string';
+        const id = JSON.parse(readFileSync(join(dir, '.vercel', 'project.json'), 'utf8')).projectId;
+        return typeof id === 'string' ? id : null;
     }
     catch {
-        return false;
+        return null;
     }
 }
 /**
  * The Netlify CLI: `--version` and `status` at any time; once the person signed in to Netlify for the setup, the
- * project's link and creation, in the person's own current team or the one team they chose (`team`), and a built draft
- * deploy for a deploy preview of a linked folder. The sign-in and the repository's connection are the tools' (a
- * `netlify login` outside the sign-in screen, and a `netlify init` that asks its questions in a terminal, never run).
- * Never production or a project's removal, and nothing of its environment variables, its API (which reaches them) or
- * a token on the command line.
+ * project's link and creation, in the person's own current team or the one team they chose (`team`). The sign-in and
+ * the repository's connection are the tools' (a `netlify login` outside the sign-in screen, and a `netlify init` that
+ * asks its questions in a terminal, never run). Never a deploy, which builds the repository with the Netlify sign-in,
+ * production or a project's removal, and nothing of its environment variables, its API (which reaches them, and prints
+ * a site's password: impeccable_netlify_password runs it in the command's own process) or a token on the command line.
  */
-function netlify(args, where, agreed, team) {
+function netlify(args, agreed, team) {
     const words = [];
     const options = new Map();
     for (let i = 0; i < args.length; i++) {
@@ -477,6 +515,8 @@ function netlify(args, where, agreed, team) {
         return deny('the Netlify sign-in is impeccable_ask\'s, with the id netlify-setup: it opens the browser from the sign-in screen');
     if (sub === 'init')
         return deny('netlify init asks its questions in a terminal this run does not have: impeccable_netlify_connect connects the repository');
+    if (sub === 'api')
+        return deny("netlify api prints a site's settings, its password among them: impeccable_netlify_password and impeccable_netlify_connect run it in the command's own process");
     if (!agreed)
         return deny('sets Netlify up, and the person has not signed in to Netlify for that');
     /** Only these options, each with a value of its kind. */
@@ -489,10 +529,8 @@ function netlify(args, where, agreed, team) {
         case 'sites:create':
             return !rest.length && only('--name', '--json', '--account-slug') ? allow() : deny('a netlify sites:create off the allowlist');
         case 'deploy':
-            if (rest.length || !options.has('--build') || !options.has('--context') || !only('--build', '--context', '--json'))
-                return deny('a netlify deploy other than a built draft for the deploy-preview context');
-            // Where no site is linked the CLI creates one with a random name, which is not what the person said yes to.
-            return linkedToSite(where.cwd) ? allow() : deny('a netlify deploy in a folder linked to no site');
+            // The build runs in the sandbox and the Netlify CLI outside it, as the person: never both at once.
+            return deny("netlify deploy builds the repository with the person's Netlify sign-in, and the two never run together");
         default:
             return deny(sub.startsWith('env') ? "Netlify's environment variables are the person's" : `netlify ${sub || 'without a command'} is not on the allowlist`);
     }
@@ -501,16 +539,8 @@ function netlify(args, where, agreed, team) {
 const VERCEL_VALUES = new Set(['--cwd', '--target', '--scope', '-S', '--team']);
 /** The options that name a team: the CLI never picks one without a terminal, so the run names the one the person chose. */
 const VERCEL_TEAM = ['--scope', '-S', '--team'];
-/**
- * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
- * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
- * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
- * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
- * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
- * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
- * line.
- */
-function vercel(args, where, agreed, team) {
+/** The Vercel CLI's arguments as its words, the subcommand first, and its options, each with the value it takes. */
+function vercelArgs(args) {
     const words = [];
     const options = new Map();
     for (let i = 0; i < args.length; i++) {
@@ -525,6 +555,19 @@ function vercel(args, where, agreed, team) {
         const value = at > 0 ? arg.slice(at + 1) : VERCEL_VALUES.has(name) && args[i + 1] !== undefined && !args[i + 1].startsWith('-') ? args[++i] : true;
         options.set(name, value);
     }
+    return { words, options };
+}
+/**
+ * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
+ * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
+ * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
+ * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
+ * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
+ * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
+ * line.
+ */
+function vercel(args, where, agreed, team, settlement = null) {
+    const { words, options } = vercelArgs(args);
     const [sub = '', ...rest] = words;
     if ([...options.keys()].some((name) => name === '--token' || /^-t/.test(name)))
         return deny('puts a Vercel token on the command line');
@@ -551,9 +594,17 @@ function vercel(args, where, agreed, team) {
         case 'project':
             return ['add', 'ls', 'list'].includes(rest[0] ?? '') && rest.length <= 2 && only(...VERCEL_TEAM) ? allow() : deny('a vercel project command off the allowlist');
         case 'git':
+            // Vercel could not reach the repository, which released the push as it built nothing: a connection now would let it build the project's first deployment, served publicly, so the tool that locks the project makes it.
+            if (settlement?.how === 'connection')
+                return deny('a vercel git connect after Vercel could not reach the repository: impeccable_vercel_connect connects it and locks a new project before anything is pushed');
             return rest.join(' ') === 'connect' && only(...VERCEL_TEAM) ? allow() : deny('a vercel git command other than connect');
-        case 'deploy':
+        case 'deploy': {
+            // A deploy builds the project the folder it runs in is linked to: the one --cwd names, else this one.
+            const folder = resolve(where.cwd, typeof cwd === 'string' ? cwd : '.');
+            if (!(settlement?.how === 'project' && settlement.projectId === linkedVercelProject(folder)))
+                return deny("a deploy before impeccable_vercel_connect settled the first deployment of the project this folder is linked to: a deploy from here builds it whether or not Vercel reaches the repository");
             return rest.length <= 1 && inside(rest, where) && only('--yes', '-y', '--target', ...VERCEL_TEAM) ? allow() : deny('a vercel deploy off the preview allowlist');
+        }
         case 'env':
             return deny("Vercel's environment variables are the person's");
         default:
@@ -611,7 +662,7 @@ function simpleCommand(seg, where, opts) {
                 return deny('a cd that runs only sometimes: put it first, or after ;');
             return isFolder(realPath(resolve(where.cwd, args[0]))) ? allow() : deny('a cd into a folder that is not there');
         case 'git':
-            return git(args, where, opts.protectedBranches);
+            return git(args, where, opts.protectedBranches, opts.hosts.has('vercel') && !(opts.vercelSettled && opts.vercelSettled.projectId === linkedVercelProject(where.root)));
         case 'gh':
             if (args[0] === 'pr' && (args[1] === 'create' || args[1] === 'view'))
                 return allow();
@@ -634,18 +685,105 @@ function simpleCommand(seg, where, opts) {
         case 'find':
             return reader(cmd, args, where);
         case 'netlify':
-            return netlify(args, where, opts.hosts.has('netlify'), opts.teams.get('netlify'));
+            return netlify(args, opts.hosts.has('netlify'), opts.teams.get('netlify'));
         case 'vercel':
-            return vercel(args, where, opts.hosts.has('vercel'), opts.teams.get('vercel'));
+            return vercel(args, where, opts.hosts.has('vercel'), opts.teams.get('vercel'), opts.vercelSettled);
+        case 'cf':
+            return cloudflareCli(args);
         default:
             if (PACKAGE_MANAGERS.has(cmd) && installsHostCli(cmd, args, opts.hosts))
                 return allow('installs the CLI of the host the person said yes to');
             return PACKAGE_MANAGERS.has(cmd) ? packageManager(cmd, args, where, opts.scriptsChanged) : deny(`${cmd} is not on the allowlist`);
     }
 }
+/** A refusal by a content check: a command naming a file that holds credentials, or text shaped like a secret where `sink` would take it off the machine. */
+const found = (pattern, sink) => ({
+    verdict: 'deny',
+    reason: pattern.context === 'command' ? `names ${pattern.description}, which holds credentials (${pattern.name})` : `${sink} holds text shaped like ${pattern.description} (${pattern.name})`,
+    hit: { pattern, sink },
+});
+/** A file's text, when the command may read it (in the checkout or the scratch folder, and no .env file); null otherwise, or when it cannot be read. */
+function readable(path, where) {
+    if (path.startsWith('~') || /[$*?[]/.test(path) || isSecretFile(path) || (outside(path, where) && !inScratch(path, where)))
+        return null;
+    try {
+        return readFileSync(resolve(where.cwd, path), 'utf8').slice(0, 1_000_000);
+    }
+    catch {
+        return null;
+    }
+}
+/** The messages of the commits `revisions` name, as git log gives them; null when git cannot read them. */
+function commitMessages(revisions, cwd) {
+    try {
+        // The closing -- reads each as a commit even where a file of the same name is there.
+        return execFileSync('git', ['log', '--format=%B', ...revisions, '--'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000, maxBuffer: 16 * 1024 * 1024, env: gitEnvironment() });
+    }
+    catch {
+        return null;
+    }
+}
+/** The words of a git commit or a gh pr create that are its message, title or body: text, not paths. */
+function textWords(words) {
+    const text = new Set();
+    const commit = words[0] === 'git' && (words[1] === 'commit' || (words[1] === '--no-pager' && words[2] === 'commit'));
+    if (!commit && !(words[0] === 'gh' && words[1] === 'pr' && words[2] === 'create'))
+        return text;
+    words.forEach((w, i) => {
+        if (commit ? /^-[a-zA-Z]*m$|^--message$/.test(w) : /^(?:-t|--title|-b|--body)$/.test(w))
+            text.add(i + 1);
+        else if (commit ? /^-[a-zA-Z]*m.|^--message=/.test(w) : /^-[tb].|^--(?:title|body)=/.test(w))
+            text.add(i);
+    });
+    return text;
+}
+/**
+ * The content checks on a command the fence allows: a file that holds credentials, named anywhere in it but its message; and
+ * text shaped like a secret in what it sends off the machine: a commit's message, or the file or commit it takes one from, and
+ * a pull request's title, body, body file, or the commit messages --fill takes them from.
+ */
+function contentCheck(seg, where, defaultBranch) {
+    const text = textWords(seg.words);
+    for (const [i, word] of [...seg.words, ...seg.redirects.map((r) => r.target)].entries()) {
+        if (text.has(i))
+            continue;
+        const path = word.startsWith('-') && word.includes('=') ? word.slice(word.indexOf('=') + 1) : word;
+        const hit = scan('command', word).find((p) => !p.outsideOnly || outside(path, where));
+        if (hit)
+            return found(hit, 'the command');
+    }
+    const [cmd, ...rest] = seg.words;
+    const args = cmd === 'git' && rest[0] === '--no-pager' ? rest.slice(1) : rest;
+    const texts = [];
+    if (cmd === 'git' && args[0] === 'commit') {
+        texts.push(['the commit message', args.slice(1).join('\n')]);
+        // -F reads a file, and -c and -C take another commit's message: a value may name both, a file and a commit, so both are read.
+        for (const v of commitReads(args.slice(1)))
+            texts.push(['the commit message file', readable(v, where)], ['the commit message it reuses', commitMessages(['-1', '--end-of-options', v], where.cwd)]);
+    }
+    else if (cmd === 'gh' && args[0] === 'pr' && args[1] === 'create') {
+        const parsed = createArguments(args.slice(2));
+        texts.push(["the pull request's title or body", args.slice(2).join('\n')]);
+        if (parsed?.bodyFile)
+            texts.push(["the pull request's body file", readable(parsed.bodyFile, where)]);
+        if (parsed?.filled) {
+            // What gh fills the title and body from: the commits on the head that the base does not have, or the newest hundred when git cannot tell which.
+            const base = parsed.base ?? defaultBranch, head = parsed.head ?? 'HEAD';
+            const ranges = [...(base ? [`origin/${base}..${head}`, `${base}..${head}`].map((range) => ['--end-of-options', range]) : []), ['-n', '100', '--end-of-options', head]];
+            const messages = ranges.reduce((read, range) => read ?? commitMessages(range, where.cwd), null);
+            texts.push(["the commit messages --fill takes the pull request's title and body from", messages]);
+        }
+    }
+    for (const [sink, text] of texts) {
+        const hit = text ? scan('output', text)[0] : undefined;
+        if (hit)
+            return found(hit, sink);
+    }
+    return null;
+}
 /** The fence's answer for one shell command run from the checkout's top folder. */
 export function classifyCommand(command, root, options = {}) {
-    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map() };
+    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null };
     const segments = parseCommand(command);
     if (!segments)
         return deny('uses shell syntax the fence does not read');
@@ -654,7 +792,9 @@ export function classifyCommand(command, root, options = {}) {
     const where = { root: realPath(root), cwd: root, scratch: options.scratch && realPath(options.scratch) };
     let result = allow();
     for (const seg of segments) {
-        const decision = simpleCommand(seg, where, opts);
+        let decision = simpleCommand(seg, where, opts);
+        if (decision.verdict === 'allow')
+            decision = contentCheck(seg, where, opts.protectedBranches[0]) ?? decision;
         if (decision.verdict === 'never')
             return decision;
         if (decision.verdict === 'deny' && result.verdict === 'allow')
@@ -663,6 +803,9 @@ export function classifyCommand(command, root, options = {}) {
         if (seg.words[0] === 'cd' && decision.verdict === 'allow')
             where.cwd = resolve(where.cwd, seg.words[1]);
     }
+    if (result.verdict === 'allow' && placeOf(command) === null) {
+        return deny("joins git commit or push, gh, vercel, netlify or a host CLI's install, which run outside the sandbox as the person, to what runs in it: run them as separate commands");
+    }
     return result;
 }
 /**
@@ -756,14 +899,16 @@ export function classifyPreviewCommand(command, root, options = {}) {
     }
     return allow('inside the disposable preview verifier');
 }
-/** The fence's answer for pi's file tools: writes stay in the checkout and out of .git; reads stay in it or in the run's scratch folder, and off .env files. */
+/** The fence's answer for pi's file tools: writes stay in the checkout and out of every .git, the checkout's and any other a file could make; reads stay in it or in the run's scratch folder, and off .env files. */
 export function classifyFileTool(tool, path, root, scratch) {
     const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
     const p = typeof path === 'string' && path ? path : '.';
     if (tool === 'write' || tool === 'edit') {
         if (outside(p, where))
             return never('writes outside the checkout');
-        return within(realPath(resolve(root, p)), join(where.root, '.git')) ? never('writes into .git, where hooks run') : allow();
+        // A .git file or folder below the top would be where git takes its settings and hooks from there.
+        const inGit = [p, relative(where.root, realPath(resolve(root, p)))].some((q) => q.split(/[\\/]/).includes('.git'));
+        return inGit ? never('writes into .git, where hooks run') : allow();
     }
     if (outside(p, where) && !inScratch(p, where))
         return deny('reads outside the checkout');
@@ -830,7 +975,7 @@ function createArguments(args) {
         return;
     if (values.has('body-file') && (!bodyFile || bodyFile === '-'))
         return;
-    return { head, repository: values.get('repo'), bodyFile };
+    return { head, repository: values.get('repo'), bodyFile, base: values.get('base'), filled };
 }
 /** Called synchronously only after the ordinary fence allows the entire command. */
 export function reservePreviewCommand(state, command, root, scratch) {
@@ -972,7 +1117,7 @@ export function observePreviewAttempts(state, runs, historyComplete) {
 }
 /** The hosts the person said yes to setting up in this run, by the run's log. */
 const agreedHosts = new WeakMap();
-function hostsAgreed(log) {
+export function hostsAgreed(log) {
     let hosts = agreedHosts.get(log);
     if (!hosts)
         agreedHosts.set(log, (hosts = new Set()));
@@ -988,6 +1133,42 @@ export function agreeToHostSetup(log, questionId) {
 export function hostSetupAgreed(log, host) {
     return hostsAgreed(log).has(host);
 }
+/** The runs whose `vercel link` left its folder linked to a project: that project may build the next push, so its hold stands until it is settled, whatever ends the setup. */
+const linkedVercel = new WeakSet();
+/**
+ * The host's setup ended before any project of this run's could build a push: the sign-in skipped or not completed, the
+ * team skipped, or the link failed. Its CLI stops and the hold on pushes goes, as though the host was never offered; a
+ * Vercel project linked in this run keeps its hold until it is settled.
+ */
+export function endHostSetup(log, host) {
+    if (host !== 'vercel' || !linkedVercel.has(log))
+        hostsAgreed(log).delete(host);
+}
+/**
+ * What the `vercel link`s of a command that ran left, each in the folder it ran in (the one `--cwd` names, else the
+ * shell's, after its `cd`), whatever the command's exit: a folder linked to a project keeps the hold; links that left
+ * their folders linked to none failed, and end the Vercel setup.
+ */
+function noteVercelLinks(log, root, command) {
+    let cwd = root;
+    const folders = [];
+    for (const { words } of parseCommand(command) ?? []) {
+        if (words[0] === 'cd')
+            cwd = resolve(cwd, words[1] ?? '.');
+        if (words[0] !== 'vercel')
+            continue;
+        const { words: [sub], options } = vercelArgs(words.slice(1));
+        const folder = options.get('--cwd');
+        if (sub === 'link')
+            folders.push(resolve(cwd, typeof folder === 'string' ? folder : '.'));
+    }
+    if (!folders.length)
+        return;
+    if (folders.some((folder) => linkedVercelProject(folder) !== null))
+        linkedVercel.add(log);
+    else
+        endHostSetup(log, 'vercel');
+}
 /** The team the person picked for each host's CLI in this run, by the run's log. */
 const chosenTeams = new WeakMap();
 function teamsChosen(log) {
@@ -1002,6 +1183,14 @@ export function chooseHostTeam(log, questionId, team) {
     if (host && Object.hasOwn(HOST_CLIS, host) && hostsAgreed(log).has(host) && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(team))
         teamsChosen(log).set(host, team);
 }
+/** What impeccable_vercel_connect settled of the linked Vercel project's first deployment in this run, by the run's log. */
+const settledVercel = new WeakMap();
+export function settleVercelFirstDeployment(log, settlement) {
+    settledVercel.set(log, settlement);
+}
+export function vercelFirstDeploymentSettled(log) {
+    return settledVercel.get(log) ?? null;
+}
 /** Tool calls a run makes before the fence refuses more: a setup takes far fewer, and a run steered elsewhere stops there. */
 export const MAX_TOOL_CALLS = 400;
 /** What still runs past the cap, so the run can say where it got to and end. */
@@ -1010,14 +1199,56 @@ const FINISHING = new Set(['impeccable_progress', 'impeccable_report']);
 const CREDENTIAL = /TOKEN|SECRET|PASSW(?:OR)?D|PASSPHRASE|CREDENTIAL|PRIVATE|(?:^|_)(?:API_?)?KEY(?:_|$)|APIKEY|AUTH(?!OR)|COOKIE|_PWD$|DATABASE_URL$|^(?:AWS|AZURE|ANTHROPIC|OPENAI|OP_SESSION)_/i;
 /**
  * The environment for the agent's shell: the person's, without credentials, whether by name or as a URL's password (a database's
- * connection string), a proxy's too. A folder or a socket is a place, not a secret, so VERCEL_AUTH_CONFIG_DIR and SSH_AUTH_SOCK stay; gh
- * and git sign in from their own config and keychain.
+ * connection string), a proxy's too. A folder, a socket or AWS's region setting is a place, not a secret, whatever its name looks like, so
+ * VERCEL_AUTH_CONFIG_DIR, SSH_AUTH_SOCK and AWS_REGION stay; gh and git sign in from their own config and keychain.
  */
+const PLACE = /_(?:DIR|HOME|SOCK)$|^AWS_(?:DEFAULT_)?REGION$/;
 export function shellEnvironment(env) {
-    return Object.fromEntries(Object.entries(env).filter(([name, value]) => /_(?:DIR|HOME|SOCK)$/.test(name)
-        || (!CREDENTIAL.test(name) && !/:\/\/[^/@\s:]*:[^/@\s]+@/.test(value ?? ''))));
+    return Object.fromEntries(Object.entries(env).filter(([name, value]) => (PLACE.test(name) || !CREDENTIAL.test(name)) && !/:\/\/[^/@\s:]*:[^/@\s]+@/.test(value ?? '')));
+}
+/** The impeccable_* tools whose input is saved, sent to the web page or shown to the person. */
+const OUTPUT_TOOLS = new Set(['impeccable_write', 'impeccable_report', 'impeccable_progress', 'impeccable_ask']);
+/** Every string in a value, by where it sits: body.env.API_TOKEN, tasks[2].title. */
+function strings(value, at = '') {
+    if (typeof value === 'string')
+        return [[at, value]];
+    if (Array.isArray(value))
+        return value.flatMap((v, i) => strings(v, `${at}[${i}]`));
+    if (value && typeof value === 'object')
+        return Object.entries(value).flatMap(([k, v]) => strings(v, at ? `${at}.${k}` : k));
+    return [];
+}
+/**
+ * Text shaped like a secret in what a tool call writes, saves or shows: the new text of a write or an edit (never what it
+ * replaces, and nothing in a .env file's example such as .env.example), and every string the impeccable_* tools take.
+ * Each string is read with its field's name in front, so a secret-like name set to a random value is seen too.
+ */
+function outputCheck(tool, input) {
+    let fields;
+    if (tool === 'write' || tool === 'edit') {
+        // A .env file's example holds placeholders; another file named as an example (config.ts.example) is checked like any file.
+        if (basename(String(input.path ?? '')).startsWith('.env') && EXAMPLE.test(String(input.path ?? '')))
+            return null;
+        fields = tool === 'write' ? [['content', input.content]] : [['newText', input.newText], ...strings(input.edits, 'edits').filter(([at]) => at.endsWith('.newText'))];
+    }
+    else {
+        fields = strings(input);
+    }
+    // The one reference impeccable_write swaps for what the person typed: a test account's password.
+    const swapped = (at, text) => tool === 'impeccable_write' && /(?:^|\/)test-accounts$/.test(String(input.path)) && /^body\.accounts\[\d+\]\.password$/.test(at) && /^secret:[0-9a-f]{12}$/.test(text);
+    for (const [at, text] of fields) {
+        if (typeof text !== 'string' || swapped(at, text))
+            continue;
+        const hit = scan('output', `${at.replace(/\[\d+\]/g, '').split('.').pop()}: ${text}`)[0];
+        if (hit)
+            return found(hit, at);
+    }
+    return null;
 }
-export function fenceExtension(root, log, protectedBranches, scratch) {
+/** What the model reads after an output check refused a call: why, and the way a setup carries a secret instead. */
+const SECRET_RULE = 'A secret never goes into a file, a setting, a commit, a pull request or a message, so nothing was done: take it out. Where the setup needs one, name it as a repository secret, ${{ secrets.NAME }}, and put "Add the NAME repository secret" in the report\'s left.';
+/** `scans` takes every content check's match: the debug log's, and --scan-report's file when there is one. */
+export function fenceExtension(root, log, protectedBranches, scratch, scans = scanRecorder(log)) {
     const retry = previewRetryState(log);
     return (pi) => {
         /** The first file the agent changed that the scripts and tools load, and the first of those but vite.config, which also stops the local preview check. */
@@ -1035,7 +1266,7 @@ export function fenceExtension(root, log, protectedBranches, scratch) {
             let shown;
             if (event.toolName === 'bash') {
                 shown = String(input.command ?? '');
-                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log) });
+                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log), vercelSettled: vercelFirstDeploymentSettled(log) });
                 if (decision.verdict === 'allow')
                     decision = reservePreviewCommand(retry, shown, root, scratch);
             }
@@ -1046,6 +1277,8 @@ export function fenceExtension(root, log, protectedBranches, scratch) {
             else if (['read', 'write', 'edit', 'grep', 'find', 'ls'].includes(event.toolName)) {
                 shown = `${event.toolName} ${String(input.path ?? '.')}`;
                 decision = classifyFileTool(event.toolName, input.path, root, scratch);
+                if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow')
+                    decision = outputCheck(event.toolName, input) ?? decision;
                 // The name written to and the file it resolves to: through a symlink, a vite.config may be another config.
                 const loaded = [String(input.path), realPath(resolve(root, String(input.path)))].filter((p) => LOADED.test(p));
                 if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow' && loaded.length) {
@@ -1054,12 +1287,27 @@ export function fenceExtension(root, log, protectedBranches, scratch) {
                         previewChanged ??= String(input.path);
                 }
             }
+            else if (OUTPUT_TOOLS.has(event.toolName)) {
+                const refused = outputCheck(event.toolName, input);
+                if (!refused)
+                    return undefined;
+                shown = event.toolName;
+                decision = refused;
+            }
             else {
                 return undefined;
             }
+            if (decision.hit) {
+                scans.record({ pattern: decision.hit.pattern.name, severity: decision.hit.pattern.severity, sink: decision.hit.sink, tool: event.toolName, action: 'block' });
+                // The command or the path only: never the text that matched.
+                if (event.toolName === 'bash')
+                    shown = 'bash';
+            }
             log.write(`fence ${decision.verdict} (${decision.reason})`, shown);
             if (decision.verdict === 'allow')
                 return undefined;
+            if (decision.hit?.pattern.context === 'output')
+                return { block: true, reason: `Refused: ${decision.reason}. ${SECRET_RULE}` };
             if (decision.verdict === 'never')
                 return { block: true, reason: `Blocked: ${decision.reason}. Impeccable never does this; find another way.` };
             return {
@@ -1067,5 +1315,20 @@ export function fenceExtension(root, log, protectedBranches, scratch) {
                 reason: `Refused: ${decision.reason}. The person is never asked to run a command. Find another way with what runs (a package script, a config change, another tool on the list); if there is none, leave the step undone and put it in the report under "What was skipped, and why", with the exact command for the person.`,
             };
         });
+        // What the agent reads is data: text in it shaped like instructions gets a line saying so, and the result is otherwise as it was.
+        pi.on('tool_result', (event) => {
+            if (!['read', 'grep', 'bash'].includes(event.toolName))
+                return undefined;
+            const input = event.input;
+            if (event.toolName === 'bash')
+                noteVercelLinks(log, root, String(input.command ?? ''));
+            const sources = event.toolName === 'bash' ? (parseCommand(String(input.command ?? ''))?.flatMap((seg) => seg.words) ?? []) : [input.path, input.glob].filter((s) => typeof s === 'string');
+            const hits = scan('input', event.content.map((c) => (c.type === 'text' ? c.text : '')).join('\n'), sources);
+            if (!hits.length)
+                return undefined;
+            for (const hit of hits)
+                scans.record({ pattern: hit.name, severity: hit.severity, sink: 'the result', tool: event.toolName, action: 'tag' });
+            return { content: [{ type: 'text', text: DATA_NOTE }, ...event.content] };
+        });
     };
 }