@impeccable/reviews 0.1.0 → 0.1.2

package/dist/tools.js

@@ -7,16 +7,20 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
 import { requestJson } from './http.js';
-import { focusCheckup, focusState } from './focus.js';
+import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
 import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
-import { previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { cfRunner, pagesProject, readCloudflarePreviews } from './cloudflare.js';
+import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
-import { connectVercelProject, vercelStatus, vercelTeams, waitForVercelAccess } from './vercel.js';
+import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelStatus, vercelTeams, waitForVercelAccess } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
+import { gitEnvironment } from './sandbox.js';
 import { openBrowser } from './login.js';
 import { TASK_STATUSES } from './sync.js';
 import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
@@ -196,12 +200,20 @@ const NETLIFY_PREVIEWS = {
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
     },
 };
+const CLOUDFLARE_PREVIEWS = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
+        branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the build of its head only, and waits up to five minutes for it to finish.' },
+    },
+};
 const PROVE_PREVIEW = {
     type: 'object',
     additionalProperties: false,
     required: ['url', 'expect'],
     properties: {
-        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews or impeccable_netlify_previews listed, or a page on it.' },
+        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or a page on it.' },
         expect: { type: 'string', minLength: 1, description: 'Words the page shows that a file of this checkout holds, such as the app\'s name in its title.' },
     },
 };
@@ -222,7 +234,7 @@ const ASK = {
         options: {
             type: 'array',
             description: 'single and multi: the choices, at least two.',
-            items: { type: 'object', additionalProperties: false, required: ['label', 'value'], properties: { label: { type: 'string', minLength: 1 }, value: { type: 'string', minLength: 1 } } },
+            items: { type: 'object', additionalProperties: false, required: ['label', 'value'], properties: { label: { type: 'string', minLength: 1 }, value: { type: 'string', minLength: 1 }, selected: { type: 'boolean', description: 'multi only: picked when the question opens; the person can unpick it.' } } },
         },
         prefill: { type: 'string', minLength: 1, description: 'text, not with sensitive, and account: what the (username) field holds when the dialog opens, such as the seed\'s username. The person can change it.' },
         confirmLabel: { type: 'string', minLength: 1, description: 'confirm only: the way on, such as "Share test accounts".' },
@@ -252,6 +264,8 @@ function askError(q) {
         return q.options ? 'input.options is for single and multi only' : null;
     if (values.length < 2)
         return `input.options needs at least two choices for ${q.kind}`;
+    if (q.kind === 'single' && q.options.some((o) => o.selected !== undefined))
+        return 'input.options[].selected is for multi only';
     return new Set(values).size === values.length ? null : 'input.options has a value twice';
 }
 /** Why `url` is not pull request `number` of owner/repo on GitHub; null when it is. */
@@ -396,7 +410,7 @@ async function stopPreviewChild(child) {
     catch { /* already stopped */ }
 }
 /** Local reproduction only: no credentials, external database, response body or process output leaves this helper. */
-export async function verifyLocalPreview(input, root, signal) {
+export async function verifyLocalPreview(input, root, signal, sandbox) {
     const probes = [];
     const fail = (stage, reason) => ({ verified: false, stage, reason, probes });
     if (process.platform === 'win32')
@@ -493,8 +507,11 @@ export async function verifyLocalPreview(input, root, signal) {
         scratch = await realpath(await mkdtemp(join('/tmp', 'impeccable-preview-')));
         const snapshot = join(scratch, 'checkout'), home = join(scratch, 'home'), temp = join(scratch, 'tmp');
         await Promise.all([snapshot, home, temp].map((p) => mkdir(p, { mode: 0o700 })));
+        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it.
+        const inSandbox = sandbox?.preview(scratch);
+        const confined = (command, processEnv) => inSandbox?.(command, processEnv) ?? { file: '/bin/sh', args: ['-c', command], env: processEnv };
         env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
-        const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true);
+        const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true, 120_000, signal ?? null, gitEnvironment(env));
         if (!listing.ok)
             return fail(stage, 'Could not list checkout files.');
         const files = [...new Set(listing.output.split('\0').filter(Boolean))];
@@ -534,7 +551,7 @@ export async function verifyLocalPreview(input, root, signal) {
             await copyFile(source, target);
             await chmod(target, info.mode & 0o777);
             if (file.split('/').at(-1) === 'package.json') {
-                const baseline = await run('git', ['show', `HEAD:${file}`], root, true);
+                const baseline = await run('git', ['show', `HEAD:${file}`], root, true, 120_000, signal ?? null, gitEnvironment(env));
                 const scripts = (value) => Object.entries(JSON.parse(value).scripts ?? {}).sort(([a], [b]) => a.localeCompare(b));
                 scriptsChanged ||= !baseline.ok || JSON.stringify(scripts(baseline.output)) !== JSON.stringify(scripts(await readFile(source, 'utf8')));
             }
@@ -616,8 +633,9 @@ export async function verifyLocalPreview(input, root, signal) {
             }
             if (!executable)
                 return fail(stage, 'The required Python runtime or virtual environment is unavailable.');
-            // Precreate even for explicit bootstrap steps so every command in a compound step uses it.
-            if (!(await run(executable, ['-m', 'venv', '.venv'], directory)).ok)
+            // Precreate even for explicit bootstrap steps so every command in a compound step uses it. `-m` imports from the folder, the checkout's code, so it runs in the sandbox too.
+            const venv = confined(`'${executable.replace(/'/g, `'\\''`)}' -m venv .venv`, env);
+            if (!(await run(venv.file, venv.args, directory, false, 120_000, signal ?? null, venv.env)).ok)
                 return fail(stage, 'The required Python runtime or virtual environment is unavailable.');
         }
         const environmentFor = (directory) => {
@@ -653,7 +671,8 @@ export async function verifyLocalPreview(input, root, signal) {
         }
         for (const [index, step] of input.steps.entries()) {
             stage = step.phase;
-            if (!(await run('/bin/sh', ['-c', step.command], directories[index], false, 120_000, signal ?? null, environmentFor(directories[index]))).ok)
+            const command = confined(step.command, environmentFor(directories[index]));
+            if (!(await run(command.file, command.args, directories[index], false, 120_000, signal ?? null, command.env)).ok)
                 return fail(stage, signal?.aborted ? 'Verification was cancelled.' : 'The local step failed or exceeded two minutes; its output was not retained.');
         }
         if (staticInput) {
@@ -669,7 +688,8 @@ export async function verifyLocalPreview(input, root, signal) {
         const free = await new Promise((done) => { const check = createServer(); check.once('error', () => done(false)); check.listen(serverInput.port, '127.0.0.1', () => check.close(() => done(true))); });
         if (!free)
             return fail(stage, 'The preview port is already in use; an existing service was not probed.');
-        server = spawn('/bin/sh', ['-c', serverInput.start.command], { cwd: directories.at(-1), env: environmentFor(directories.at(-1)), detached: true, stdio: 'ignore' });
+        const start = confined(serverInput.start.command, environmentFor(directories.at(-1)));
+        server = spawn(start.file, start.args, { cwd: directories.at(-1), env: start.env, detached: true, stdio: 'ignore' });
         let exited = false;
         server.once('error', () => { exited = true; });
         server.once('exit', () => { exited = true; });
@@ -733,7 +753,7 @@ const execFileAsync = promisify(execFile);
  */
 export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
     try {
-        await execFileAsync('git', ['merge-base', '--is-ancestor', `refs/remotes/origin/${setupBranch}`, `refs/remotes/origin/${driveBranch}`], { cwd, timeout: 10_000 });
+        await execFileAsync('git', ['merge-base', '--is-ancestor', `refs/remotes/origin/${setupBranch}`, `refs/remotes/origin/${driveBranch}`], { cwd, timeout: 10_000, env: gitEnvironment() });
         return true;
     }
     catch (err) {
@@ -968,11 +988,11 @@ export function workflowGitEnvironment() {
                 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_CURL_VERBOSE', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG',
                 'GIT_CEILING_DIRECTORIES', 'GIT_DISCOVERY_ACROSS_FILESYSTEM', 'GIT_PREFIX', 'GIT_ASKPASS', 'SSH_ASKPASS'].includes(key))
             delete env[key];
-    return Object.assign(env, { GIT_TERMINAL_PROMPT: '0', GH_PROMPT_DISABLED: '1', GCM_INTERACTIVE: 'never',
+    return gitEnvironment(Object.assign(env, { GIT_TERMINAL_PROMPT: '0', GH_PROMPT_DISABLED: '1', GCM_INTERACTIVE: 'never',
         GIT_ASKPASS: '', SSH_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never', GIT_SSH_VARIANT: 'ssh',
         GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o StrictHostKeyChecking=yes',
         // Removing the variables alone still permits globally configured trace2 targets.
-        GIT_TRACE2: '0', GIT_TRACE2_EVENT: '0', GIT_TRACE2_PERF: '0' });
+        GIT_TRACE2: '0', GIT_TRACE2_EVENT: '0', GIT_TRACE2_PERF: '0' }));
 }
 const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
 export function workflowDefaultBranch(value) {
@@ -1388,25 +1408,28 @@ export function createTools(ctx) {
     }
     /** What the person typed into sensitive questions, by the reference the model holds instead. */
     const typed = new Map();
-    /** The origins of the successful Preview deployments of pull requests GitHub listed, and of the built deploy previews Netlify's evidence listed, which a proof may open; whether one answered with this app; and the address pattern a Netlify proof answered. */
+    /** The origins of the successful Preview deployments of pull requests GitHub listed, and of the built previews Netlify's and Cloudflare's evidence listed, which a proof may open; whether one answered with this app; and the address pattern a Netlify or Cloudflare proof answered. */
     const listedPreviews = new Set();
     const netlifyListed = new Set();
+    /** The origins of Production deployments Vercel made of a pushed branch that no locked project of this folder's made: served at a project's own address without a login, so no proof opens them. */
+    const publicProduction = new Set();
+    const cloudflareListed = new Set();
     let hostedPreviewProven = false;
     let provenPattern;
     /** The host whose preview a proof answered with this app, and the one whose previews impeccable_write then saved as the method. */
     let provenHost;
     let savedHost;
     /**
-     * A host's build, waited for on the screen as the task in progress with its timer: `read` again every so often until
-     * `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
+     * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
+     * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
      */
-    async function awaitBuild(status, read, built, signal) {
+    async function awaitBuild(host, status, read, built, signal) {
         let evidence = await read();
         if (built(evidence))
             return evidence;
         const wait = ctx.previewWait ?? { totalMs: 300_000, everyMs: 15_000 };
         said(status);
-        reportWait({ since: Date.now(), limitMs: wait.totalMs });
+        reportWait({ since: Date.now(), host });
         try {
             for (const end = Date.now() + wait.totalMs; !built(evidence) && Date.now() < end; evidence = await read()) {
                 await sleep(wait.everyMs, undefined, { signal });
@@ -1424,7 +1447,7 @@ export function createTools(ctx) {
     };
     /** Of the origins listed, those of deployments Vercel's own bot made: the only addresses a bypass secret is ever sent to, since a deployment anyone with write access can record names any address. */
     const vercelMade = new Set();
-    /** The address impeccable_prove_preview met Vercel's login at, and the words it looked for there. */
+    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, and whose lock it was. */
     let gated;
     /** The bypass secret saved in this run, for the proof of a Vercel address to send; never for the model. It is one project's, so it goes only to the origins impeccable_vercel_bypass proved it on, never to another project's deployment of this repository. */
     let bypassSecret;
@@ -1432,6 +1455,24 @@ export function createTools(ctx) {
     /** What impeccable_vercel_bypass answered, less the secret: a skip is asked once, so that answer stands; the saved one is what an address the secret opens later gets. */
     let bypassOutcome;
     let bypassSaved;
+    /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
+    let sitePassword;
+    const passwordSites = new Set();
+    /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, and the team login stays. Another site of the repository is read on its own. */
+    const passwordStands = new Map();
+    /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
+    const passwordConsented = new Set();
+    /** The saved answer, what an address the password opens later gets. */
+    let passwordSaved;
+    /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
+    let accessGated;
+    /** The service token that opened a preview in this run, what the tool said of it, the Pages projects it opened and whether the store holds it: once it does, the proofs of those projects' previews send it; never the model. */
+    let accessToken;
+    let accessMade = {};
+    const accessProjects = new Set();
+    let accessStored = false;
+    /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
+    let accessOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
     const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer();
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
@@ -1494,6 +1535,12 @@ export function createTools(ctx) {
     const hostSignIns = new Map();
     /** The teams a host's sign-in offered, each by name and slug: the choices a `<host>-team` question shows, whatever the model lists, so the pick the fence takes is a slug. */
     const teamChoices = new Map();
+    /** A host's setup ended before anything was set up on the host: nothing more is asked for it, and the fence lets its CLI and its hold on pushes go. */
+    const endSetup = (host) => {
+        hostSignIns.set(host, 'skipped');
+        teamChoices.delete(host);
+        endHostSetup(ctx.log, host);
+    };
     const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
@@ -1543,7 +1590,7 @@ export function createTools(ctx) {
         if (!hostSignIns.has(host)) {
             const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`] });
             if (answer.skipped) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true };
             }
             hostSignIns.set(host, 'confirmed');
@@ -1565,11 +1612,11 @@ export function createTools(ctx) {
             if (status.cli === 'signed-in')
                 return signedIn();
             if (attempt === 2) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true, reason: `The ${HOST_NAMES[host]} sign-in did not complete.` };
             }
             if ((await ask(HOST_SCREENS[`${host}-signin-retry`])).skipped) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true };
             }
         }
@@ -1607,14 +1654,29 @@ export function createTools(ctx) {
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
             ? { connected: true, site: result.site, how: 'github-app' } : result), signal);
     }
-    /** The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked when Vercel's GitHub app cannot reach the repository. */
+    /**
+     * The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked
+     * when Vercel's GitHub app cannot reach the repository; then, connected, the project locked behind Vercel's login at
+     * every address while it has no production deployment, before anything is pushed: Vercel makes a new project's first
+     * deployment Production whatever branch it builds, and serves it at the project's own address.
+     */
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
         const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
-        const result = await connectVercelProject(vercel);
         // Tried again every 20 s until the app reaches the repository: the person is giving it access meanwhile.
-        return hostAccess('vercel', result, () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
+        const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
+        // The fence holds pushes and deploys from the sign-in until the linked project's first deployment is settled: Vercel's app cannot reach the repository (a push builds nothing), production is deployed already, or the project is locked at every address.
+        const link = await readLink(pi.cwd);
+        if (!result.connected) {
+            if (result.access !== undefined)
+                settleVercelFirstDeployment(ctx.log, { projectId: link?.projectId ?? null, how: 'connection' });
+            return result;
+        }
+        const first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        if (link && (first.production === 'exists' || first.locked === true))
+            settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'project' });
+        return { ...result, ...first };
     }
     async function syncWorkflowTool(pi, signal) {
         try {
@@ -1658,15 +1720,42 @@ export function createTools(ctx) {
         const res = await requestJson(url, { ...init, token: await ctx.auth.token(pi) }, ctx.log);
         return res.status === 401 ? requestJson(url, { ...init, token: await ctx.auth.renew(pi) }, ctx.log) : res;
     };
-    /** A read of the setup API, trimmed to this setup before the model sees it. */
+    /**
+     * Saves a host's key for reviews: the key as Impeccable's credential for the lock, then the setting that sends it in
+     * `header`, both through the setup API. `stored` says the first write took; `failed` what stopped it, else null.
+     */
+    const saveLock = async (pi, what, header, value) => {
+        const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
+        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value } })).ok)
+            return { stored: false, failed: `The setup API did not store the ${what}.` };
+        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header } })).ok)
+            return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
+        return { stored: true, failed: null };
+    };
+    /** The instructions the writes are checked against: the first state may have come before the scan proposed the apps, so a later read that shows them brings the apps write in. */
+    let instructions = ctx.instructions;
+    /** Whether the run signed in again for apps the scan proposed after the sign-in. */
+    let renewedForApps = false;
+    /**
+     * A read of the state or the checkup, trimmed to this setup before the model sees it. The setup token covers the apps
+     * there were at sign-in, so an app the scan proposed later reads `not-selected`: the run signs in again, for a token
+     * that covers every app there is now, and reads again. Once it has, a card still left out goes into the report.
+     */
     const get = async (pi, path, focus) => {
-        const res = await call(pi, `${ctx.setupApi}${path}`);
+        let res = await call(pi, `${ctx.setupApi}${path}`);
+        if (res.ok && !renewedForApps && appsLeftOut(res.data, ctx.repo)) {
+            await ctx.auth.renew(pi, 'apps');
+            renewedForApps = true;
+            res = await call(pi, `${ctx.setupApi}${path}`);
+        }
+        if (res.ok && ctx.allInstructions !== undefined && severalApps(res.data))
+            instructions = focusInstructions(ctx.allInstructions, { apps: true });
         return answerText(res.ok ? { ...res, data: focus(res.data) } : res);
     };
     return [
         tool('impeccable_workflow_access', 'Check workflow access', 'Check that the setup pull request can carry the workflow: reads the active GitHub CLI account and its scopes, the origin remote and the default branch, and refreshes origin/<defaultBranch>. Call it before branching. needsWorkflowScope true means the account lacks workflow access over HTTPS; base.status "refreshed" means origin/<defaultBranch> is current. Only the push itself proves Git may push.', NO_INPUT, (_p, pi, signal) => workflowAccessTool(pi, signal)),
         tool('impeccable_sync_workflow', 'Update the preview workflow', 'Write the state\'s workflow to .github/workflows/impeccable-preview.yml byte for byte and remove the retired workflow the state names, after checking access as impeccable_workflow_access does. Call it once the settings are saved, and again after committing: stagedMatches and committedMatches true (and retiredRemoval staged and committed) prove the commit holds the exact bytes; null means nothing was compared. It refuses, changing nothing, when the file has the person\'s local edits. It never branches, stages, commits or pushes.', NO_INPUT, (_p, pi, signal) => syncWorkflowTool(pi, signal)),
-        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal))),
+        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal, ctx.sandbox))),
         tool('impeccable_preview_run', 'Read the preview attempt', 'On a rerun, once impeccable_test_pr recorded the setup pull request: read its preview workflow\'s runs. Answers each attempt with its failed stage and a fixed reason (never log text), the three-attempt budget (used, remaining, historyKnown), and adds the attempts to the task list. Reading is free.', PREVIEW_RUN, async (p, pi, signal) => {
             if (!retry.pr)
                 return 'Refused: record the setup pull request with impeccable_test_pr first.';
@@ -1735,20 +1824,20 @@ export function createTools(ctx) {
             reportTasks(tasks);
             return JSON.stringify({ ...observation, attempts: attempts(), budget: budget() });
         }),
-        tool('impeccable_state', 'Setup state', 'Read the setup state again, trimmed to this setup: each repository\'s scan, preview and sign-in items, and the setup page\'s other cards in notPartOfThisSetup.', NO_INPUT, (_p, pi) => get(pi, '/state', focusState)),
+        tool('impeccable_state', 'Setup state', 'Read the setup state again, trimmed to this setup: each repository\'s scan, preview and sign-in items, its apps item where the scan proposed several apps, and the setup page\'s other cards in notPartOfThisSetup.', NO_INPUT, (_p, pi) => get(pi, '/state', focusState)),
         tool('impeccable_checkup', 'Checkup', 'Run the checkup for this setup\'s items: it reads GitHub again and answers status (complete, waiting or incomplete), next (what to do, in order), forPerson (what only the person can do) and waitingFor (what needs time).', NO_INPUT, (_p, pi) => get(pi, '/checkup', focusCheckup)),
         tool('impeccable_write', 'Write a setting', 'Write a setting through the setup API, at an endpoint the instructions list and with the method they give.', WRITE, async (p, pi, signal) => {
-            const target = resolveWrite(ctx.instructions, ctx.setupApi, ctx.repo, p.path);
+            const target = resolveWrite(instructions, ctx.setupApi, ctx.repo, p.path);
             if ('error' in target)
                 return `Refused: ${target.error}`;
             if (/\/(preview-auth\/[^/]+|preview-protection)$/.test(target.url))
-                return 'Refused: a Vercel bypass secret is saved by impeccable_vercel_bypass, which opens the preview with it first, and never through this tool. Nothing was saved.';
+                return "Refused: a host's key is saved by impeccable_vercel_bypass (a Vercel bypass secret), impeccable_netlify_password (a Netlify site password) or impeccable_cloudflare_access (a Cloudflare Access service token), which opens the preview with it first, and never through this tool. Nothing was saved.";
             if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && !hostedPreviewProven) {
                 return "Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app. Nothing was saved.";
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
-                return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify preview. Nothing was saved.';
+                return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify or Cloudflare Pages preview. Nothing was saved.';
             }
             const testAccounts = target.url.endsWith('/test-accounts');
             let body = p.body;
@@ -1808,8 +1897,12 @@ export function createTools(ctx) {
             if (error)
                 return `Invalid input: ${error}.`;
             const answer = await askPerson(q);
-            if (answer.skipped)
+            if (answer.skipped) {
+                // Without a terminal the Vercel CLI names no team on its own, so a skipped team ends the Vercel setup.
+                if (host?.[1] === 'vercel')
+                    endSetup('vercel');
                 return JSON.stringify({ skipped: true });
+            }
             if (q.kind === 'multi')
                 return JSON.stringify({ values: answer.values ?? [] });
             if (q.kind === 'confirm') {
@@ -1901,24 +1994,39 @@ export function createTools(ctx) {
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
-        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer (a project\'s first deployment is called Production, whatever branch it builds, and counts). It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, _pi, signal) => {
+        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
             const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
-            // With `branch` the evidence holds only the deployments of its head, and Vercel's is its preview whatever environment it is called: the first deployment of a
+            // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
             // project is its Production one, even from a branch. Another integration's deployment of the same commit says nothing about it. Without it a preview is a Preview.
-            const preview = (d) => (branch !== undefined ? d.vercel : /preview/i.test(d.environment ?? ''));
-            // A head's preview is still building until it has a final status.
-            const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => preview(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild(`Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
+            const isPreview = (d) => /preview/i.test(d.environment ?? '');
+            const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
+            // A head's build is still building until it has a final status.
+            const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
             listedPreviews.clear();
             vercelMade.clear();
+            publicProduction.clear();
+            /** The hosts of the linked project's deployments while it is locked at every address, read from Vercel once a Production deployment turns up, and once per call. */
+            let locked;
             for (const d of evidence.deployments) {
-                if (d.state === 'success' && d.url && preview(d) && (d.pullRequests.length || branch !== undefined)) {
-                    const { origin } = new URL(d.url);
-                    listedPreviews.add(origin);
-                    if (d.vercel)
-                        vercelMade.add(origin);
+                if (d.state !== 'success' || !d.url || !ofBranch(d) || !(d.pullRequests.length || branch !== undefined))
+                    continue;
+                const url = new URL(d.url);
+                // A pushed branch's Production deployment is its preview only as the locked project's own: under Standard Protection a project's own address serves it to anyone, and another project of this repository may have made it.
+                if (branch !== undefined && !isPreview(d)) {
+                    locked ??= await (async () => {
+                        const link = await readLink(pi.cwd);
+                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link) : new Set();
+                    })();
+                    if (!locked.has(url.host)) {
+                        publicProduction.add(url.origin);
+                        continue;
+                    }
                 }
+                listedPreviews.add(url.origin);
+                if (d.vercel)
+                    vercelMade.add(url.origin);
             }
             return JSON.stringify(evidence);
         }),
@@ -1928,25 +2036,59 @@ export function createTools(ctx) {
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
-            const evidence = pull !== undefined ? await awaitBuild(`Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, signal) : await read();
+            const evidence = pull !== undefined ? await awaitBuild('Netlify', `Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, signal) : await read();
             netlifyListed.clear();
             for (const p of evidence.previews)
                 if (p.state === 'success' || p.state === 'ready')
                     netlifyListed.add(new URL(p.url).origin);
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews or impeccable_netlify_previews listed for a pull request or a pushed branch (a successful Preview deployment, or a deploy preview that is ready), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify it answers the address pattern to save beside it. gate "vercel-protection" or "netlify-protection" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+            const pull = p.pull;
+            const branch = p.branch;
+            if (pull !== undefined && branch !== undefined)
+                return 'Invalid input: give pull or branch, not both.';
+            const read = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch });
+            // Cloudflare posts its check run once the build ended: until then the head lists nothing, or cf's row says it is building.
+            // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
+            const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
+            const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
+            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, signal) : await read();
+            cloudflareListed.clear();
+            for (const preview of evidence.previews) {
+                if (preview.state !== 'success')
+                    continue;
+                cloudflareListed.add(new URL(preview.url).origin);
+                if (preview.alias)
+                    cloudflareListed.add(new URL(preview.alias).origin);
+            }
+            return JSON.stringify(evidence);
+        }),
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
-            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin)))
-                return 'Refused: open the address of a preview that impeccable_hosted_previews or impeccable_netlify_previews listed for a pull request or a pushed branch, or a page on it.';
-            const proof = await provePreview(url, p.expect, pi.cwd, { fetch: ctx.previewFetch, signal, ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}) });
+            if (URL.canParse(url) && publicProduction.has(new URL(url).origin))
+                return "Refused: Vercel called this deployment Production, as it calls a project's first whatever branch it builds, and no project of this folder's that is locked at every address made it, so it is served at a project's own address without a login: it is no preview, and nothing was opened. No test drive, as the vercel-setup case says.";
+            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin) || cloudflareListed.has(new URL(url).origin)))
+                return 'Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it.';
+            const site = netlifySiteOf(url);
+            // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
+            const project = pagesProject(new URL(url).origin);
+            const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
+            const proof = await provePreview(url, p.expect, pi.cwd, {
+                fetch: ctx.previewFetch, signal,
+                ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}),
+                ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
+                ...(token ? { access: token } : {}),
+            });
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
             if (proof.proven && proof.pattern)
                 provenPattern = proof.pattern;
-            if (proof.gate === 'vercel-protection')
-                gated = { url, expect: p.expect };
+            if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
+                gated = { url, expect: p.expect, gate: proof.gate };
+            if (proof.gate === 'cloudflare-access' && cloudflareListed.has(new URL(url).origin))
+                accessGated = { url, expect: p.expect };
             return JSON.stringify(proof);
         }),
         tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
@@ -1958,9 +2100,9 @@ export function createTools(ctx) {
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
             return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
         }),
-        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits. connected true means the repository is connected, or was already. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
+        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
         tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
-            if (!gated || !vercelMade.has(new URL(gated.url).origin))
+            if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
             if (bypassOutcome?.status === 'skipped')
                 return JSON.stringify(bypassOutcome);
@@ -1983,13 +2125,9 @@ export function createTools(ctx) {
                 },
                 prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
                 save: async (secret) => {
-                    const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
-                    if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value: secret } })).ok)
-                        return 'The setup API did not store the secret.';
-                    stored = true;
-                    if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: BYPASS_HEADER } })).ok)
-                        return 'The setup API stored the secret, but not the setting that sends it: it is turned on under Deployment protection on the setup page.';
-                    return null;
+                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret);
+                    stored = saved.stored;
+                    return saved.failed;
                 },
                 remember: noteSensitiveAnswer,
             });
@@ -2011,5 +2149,141 @@ export function createTools(ctx) {
             }
             return JSON.stringify(bypassOutcome);
         }),
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), login (Netlify\'s team login stands in front, which no tool gets past: protection says so, and reason why), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+            const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
+            if (!gated || !site)
+                return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
+            const stands = passwordStands.get(site);
+            if (stands)
+                return JSON.stringify(stands);
+            const at = gated;
+            /** The address pattern the proof with the password answers, saved as the method once the password is. */
+            let pattern;
+            const prove = async (password, form = false) => {
+                const proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password, form });
+                if (proof.proven && proof.pattern)
+                    pattern = proof.pattern;
+                return proof;
+            };
+            // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
+            if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
+                provenPattern = pattern ?? provenPattern;
+                return JSON.stringify(passwordSaved);
+            }
+            /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
+            let stored = false;
+            const { value, ...told } = await passNetlifyLock({
+                run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
+                site,
+                consent: async () => {
+                    if (passwordConsented.has(site) || !(await ask(HOST_SCREENS['netlify-password'])).skipped)
+                        return passwordConsented.add(site), true;
+                    return false;
+                },
+                paste: async () => {
+                    const answer = await ask(HOST_SCREENS['netlify-password-key']);
+                    return answer.skipped ? undefined : answer.value?.trim();
+                },
+                prove,
+                save: async (password) => {
+                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password));
+                    stored = saved.stored;
+                    return saved.failed;
+                },
+                remember: noteSensitiveAnswer,
+            });
+            const passwordOutcome = { ...told, ...(told.status === 'saved' ? { proven: true } : {}) };
+            if (told.status === 'skipped' || told.status === 'login')
+                passwordStands.set(site, passwordOutcome);
+            if (value) {
+                // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
+                sitePassword = value;
+                passwordSites.clear();
+                passwordSites.add(site);
+                hostedPreviewProven = true;
+                provenHost = 'Netlify';
+                provenPattern = pattern ?? provenPattern;
+                passwordSaved = passwordOutcome;
+            }
+            else if (told.status === 'save-failed' && stored) {
+                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through.
+                sitePassword = undefined;
+                passwordSites.clear();
+                passwordSaved = undefined;
+            }
+            return JSON.stringify(passwordOutcome);
+        }),
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+            if (!accessGated)
+                return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
+            if (accessOutcome?.status === 'skipped')
+                return JSON.stringify(accessOutcome);
+            const at = accessGated;
+            let proof;
+            const prove = async (token) => (proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token }));
+            const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
+            const save = async (token) => {
+                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret } })).ok)
+                    return 'The setup API did not store the service token.';
+                // An app that signs in with Access sends this token already: the setting would make it a second credential, which the setup API refuses.
+                const repos = object((await call(pi, `${ctx.setupApi}/state`)).data)?.repos;
+                const lock = Array.isArray(repos) ? object(object(repos.map(object).find((r) => r?.name === ctx.repo)?.items)?.['preview-protection']) : undefined;
+                if (lock?.authMethod === 'access')
+                    return null;
+                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access' } })).ok)
+                    return 'The setup API stored the service token, but not the setting that sends it: it is turned on under Preview protection on the setup page.';
+                return null;
+            };
+            let answer;
+            if (accessToken && (await prove(accessToken)).proven) {
+                // The token in hand opens this address too: stored already, or stored now.
+                const failed = accessStored ? null : await save(accessToken);
+                answer = { status: failed ? 'save-failed' : 'saved', ...accessMade, ...(failed ? { reason: failed } : {}), value: accessToken };
+            }
+            else {
+                answer = await passCloudflareAccess({
+                    url: at.url,
+                    consent: async () => !(await ask(HOST_SCREENS['cloudflare-access'])).skipped,
+                    cf: cfRunner({}, ctx.hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
+                    retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
+                    status: said,
+                    apiToken: async () => {
+                        const typed = await ask(HOST_SCREENS['cloudflare-access-api']);
+                        return typed.skipped ? undefined : typed.value;
+                    },
+                    paste: async () => {
+                        const typed = await ask(HOST_SCREENS['cloudflare-access-key']);
+                        return typed.skipped ? undefined : { id: typed.username, secret: typed.password };
+                    },
+                    prove,
+                    save,
+                    remember: noteSensitiveAnswer,
+                    signal,
+                    ...(ctx.hostWait?.policy ? { wait: ctx.hostWait.policy } : {}),
+                });
+            }
+            const { value, ...told } = answer;
+            if (value) {
+                // What is in hand follows the store, which holds one token: a new one is the one saved now, and the projects the last one opened no longer stand.
+                if (value !== accessToken)
+                    accessProjects.clear();
+                accessToken = value;
+                accessStored = told.status === 'saved';
+                accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
+                const project = pagesProject(new URL(at.url).origin);
+                if (project)
+                    accessProjects.add(project);
+            }
+            const pattern = told.status === 'saved' ? proof?.pattern : undefined;
+            accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };
+            if (told.status === 'saved') {
+                hostedPreviewProven = true;
+                provenHost = 'Cloudflare Pages';
+                if (pattern)
+                    provenPattern = pattern;
+            }
+            return JSON.stringify(accessOutcome);
+        }),
     ];
 }