@impeccable/reviews 0.1.1 → 0.1.2

package/dist/login.js

@@ -130,7 +130,7 @@ export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
             },
         };
     }
-    throw new UserError(`Ports ${ports.join(', ')} are all taken on this machine, and sign-in needs one. Close what uses one of them and run it again.`);
+    throw new UserError(`Ports ${ports.join(', ')} are all taken on this machine, and sign-in needs one. Close what uses one of them and run it again.`, { event: 'setup_command_sign_in_ended', outcome: 'ports_busy' });
 }
 /** The code from what the person pasted: the whole callback address, or the code alone. Null when it is neither, or from another sign-in. */
 export function parsePasted(text, state) {
@@ -215,18 +215,20 @@ export async function exchangeCode(host, input, log) {
 }
 /**
  * The browser sign-in: callback server, PKCE and state, the paste fallback,
- * then the token exchange, once per code. `check` stops a token the command
+ * then the token exchange, once per code. `repo` is the checkout's owner/name:
+ * the consent page names it, so the person approves and picks nothing (an
+ * older Impeccable ignores it and asks). `check` stops a token the command
  * cannot use; otherwise the tab that brought the code goes on to the page
  * `landing` resolves to (the web page that mirrors the run, once the command
  * has what it needs to show a run there), or says why it will not.
  */
-export async function signIn(host, log, prompt, check = (t) => t, landing = async (t) => progressPage(host, t)) {
+export async function signIn(host, repo, log, prompt, check = (t) => t, landing = async (t) => progressPage(host, t)) {
     const state = randomBytes(24).toString('base64url');
     const { verifier, challenge } = pkcePair();
     log.secret(verifier);
     const server = await startCallbackServer(state);
     const authorize = new URL(`${host}/app/cli/authorize`);
-    authorize.search = new URLSearchParams({ redirect_uri: server.redirectUri, state, code_challenge: challenge, code_challenge_method: 'S256' }).toString();
+    authorize.search = new URLSearchParams({ redirect_uri: server.redirectUri, state, code_challenge: challenge, code_challenge_method: 'S256', repo }).toString();
     log.write(`callback server at ${server.redirectUri}`);
     prompt.show(authorize.href);
     openBrowser(authorize.href);
@@ -235,8 +237,8 @@ export async function signIn(host, log, prompt, check = (t) => t, landing = asyn
     try {
         const code = await new Promise((resolve, reject) => {
             server.code.then(resolve, reject);
-            stopPaste = prompt.listen(state, resolve, () => reject(new UserError('Sign-in cancelled.')));
-            timer = setTimeout(() => reject(new UserError('Sign-in timed out after 30 minutes. Run impeccable-reviews again.')), LOGIN_TIMEOUT_MS);
+            stopPaste = prompt.listen(state, resolve, () => reject(new UserError('Sign-in cancelled.', { event: 'setup_command_sign_in_ended', outcome: 'cancelled' })));
+            timer = setTimeout(() => reject(new UserError('Sign-in timed out after 30 minutes. Run impeccable-reviews again.', { event: 'setup_command_sign_in_ended', outcome: 'timed_out' })), LOGIN_TIMEOUT_MS);
         });
         log.secret(code);
         const token = check(await exchangeCode(host, { code, verifier, redirectUri: server.redirectUri }, log));

package/dist/main.js

@@ -4,18 +4,20 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { promisify } from 'node:util';
 import { runAgent } from './agent.js';
-import { fenceExtension } from './fence.js';
+import { fenceExtension, hostsAgreed, placeOf } from './fence.js';
 import { focusInstructions, focusState, severalApps } from './focus.js';
 import { requestJson } from './http.js';
 import { copyText, letTabsHear, openBrowser, progressPage, screenPrompt, setupAuth, signIn } from './login.js';
 import { createLog, UserError } from './log.js';
 import { firstMessage, playbook, setupContext } from './playbook.js';
 import { checkoutFrontEnd, parseFlags, readCheckout, stateSaysNoFrontEnd, USAGE } from './preflight.js';
+import { startSandbox } from './sandbox.js';
 import { scanRecorder } from './scan.js';
+import { createReporter, reportingOff } from './report.js';
 import { createSessionSync, syncExtension } from './sync.js';
 import { createTools, resultLine } from './tools.js';
 import { transcriptPaths } from './transcript.js';
-import { atExit, closeScreens, helpMark, recordFrames, showIntro, showOutro, showPullRequest, showRun, showSignIn } from './ui/screens.js';
+import { atExit, closeScreens, helpMark, onScreenExit, recordFrames, showIntro, showOutro, showPullRequest, showRun, showSignIn } from './ui/screens.js';
 const say = (line = '') => console.log(line);
 const execFileAsync = promisify(execFile);
 /** How a run on a repository with no web front end ends, here and on the web page. */
@@ -41,9 +43,11 @@ function previewWait() {
     return Number.isFinite(totalMs) && totalMs > 0 ? { totalMs, everyMs: Math.min(15_000, Math.max(50, Math.floor(totalMs / 5))) } : undefined;
 }
 /** The end of a run with nothing to set up, before the agent: the web page says why too, and the command exits 2. */
-async function nothingToSetUp(sync, title, result, links) {
-    sync.update({ phase: 'error', status: result, question: null });
+async function nothingToSetUp(sync, reporter, why, title, result, links) {
+    sync.update({ phase: 'error', status: result, question: null, stop_reason: why });
     const saved = await settle(sync.flush(), 5000);
+    if (!saved?.ok)
+        reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });
     await showOutro({
         outcome: 'stopped',
         title,
@@ -52,12 +56,14 @@ async function nothingToSetUp(sync, title, result, links) {
         todo: [],
         warnings: saved?.ok ? [] : [`The web page missed this (${saved?.error ?? 'no answer'}), so it may still show the run as going.`],
     });
-    await letTabsHear();
+    await Promise.all([letTabsHear(), reporter.done()]);
     process.exit(2);
 }
 export async function main(argv) {
     let log = createLog(false);
     let sync;
+    // Nothing is reported until the flags say where to and whether to.
+    let reporter = createReporter({ host: '', off: true });
     // The tab the person approved in goes on to the web page once the run is minted, so the page has a run to show; a stop before then is what it says instead.
     let land = () => { };
     const landing = new Promise((resolve, reject) => (land = (outcome) => (typeof outcome === 'string' ? resolve(outcome) : reject(outcome))));
@@ -67,33 +73,64 @@ export async function main(argv) {
         if (flags.help)
             return say(`${helpMark().join('\n').trimEnd()}\n\n${USAGE}`);
         log = createLog(flags.debug);
+        reporter = createReporter({ host: flags.host, off: reportingOff(process.env, flags.noTelemetry) });
+        reporter.step({ event: 'setup_command_launched', outcome: 'launched' });
+        // A screen that ends the command at once (Ctrl+C before a run, a signal), and anything nobody caught, still say so first.
+        onScreenExit(async (why) => {
+            reporter.step({ event: 'setup_command_stopped', outcome: why });
+            await reporter.done();
+        });
+        const crashed = (err) => {
+            console.error(err);
+            reporter.step({ event: 'setup_command_stopped', outcome: 'crashed' });
+            void reporter.done().finally(() => process.exit(1));
+        };
+        process.once('uncaughtException', crashed);
+        process.once('unhandledRejection', crashed);
         // Printed as the command exits, after the screen has gone, so it stays in the scrollback.
         if (log.path)
             atExit(() => [`Debug log: ${log.path}`]);
         log.write('start', { host: flags.host, model: flags.model, effort: flags.effort, yes: flags.yes, node: process.versions.node });
         if (flags.frames)
             recordFrames(flags.frames);
-        const checkout = readCheckout(process.cwd());
+        const checkout = readCheckout(flags.installDir?.path ?? process.cwd(), flags.installDir?.from);
         const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
         const slug = `${checkout.owner}/${checkout.repo}`;
-        if (!(await showIntro()))
-            return;
+        // From the checkout's top, where the sandbox lays its own protections of a checkout.
+        process.chdir(checkout.root);
+        // Scratch output (a server's log, a build's output) goes here and never into the checkout.
+        const scratch = mkdtempSync(join(tmpdir(), 'impeccable-reviews-scratch-'));
+        process.on('exit', () => rmSync(scratch, { recursive: true, force: true }));
+        const sandbox = await startSandbox({
+            root: checkout.root,
+            scratch,
+            host: flags.host,
+            log,
+            place: placeOf,
+            hosts: () => hostsAgreed(log),
+        });
+        if (!(await showIntro(slug, sandbox.warning))) {
+            reporter.step({ event: 'setup_command_sign_in_ended', outcome: 'cancelled' });
+            return void (await reporter.done());
+        }
         const onHost = (url) => URL.canParse(url) && new URL(url).origin === flags.host;
         /** The sign-in's answer, when it is for this checkout and points at --host only. */
         const accept = (t) => {
             log.secret(t.access_token);
             const approved = `${t.repository.owner}/${t.repository.name}`;
             if (approved.toLowerCase() !== slug.toLowerCase()) {
-                throw new UserError(`You approved ${approved}, but this checkout is ${slug}. Run it again and pick ${slug} on the consent page.`);
+                throw new UserError(`You approved ${approved}, but this checkout is ${slug}. Run it again and approve ${slug} on the consent page.`, { event: 'setup_command_sign_in_ended', outcome: 'repo_mismatch' });
             }
             if (!onHost(t.setup_api) || !onHost(t.cli_api)) {
                 throw new UserError(`Impeccable answered with addresses off ${flags.host}, so the command stopped before sending anything there.`);
             }
             return t;
         };
-        const token = await signIn(flags.host, log, screenPrompt(showSignIn), accept, () => landing);
+        const token = await signIn(flags.host, slug, log, screenPrompt(showSignIn), accept, () => landing);
         const setupApi = token.setup_api.replace(/\/$/, '');
         const cliApi = token.cli_api.replace(/\/$/, '');
+        // Signed in: what the command held goes now, on the person who approved.
+        reporter.signedIn(token.access_token, cliApi);
         const page = progressPage(flags.host, token);
         // The run screen opens at once, with its placeholder, while the run starts. Stopping before the agent takes over
         // stops the command, and a run already started shows as stopped on the web page.
@@ -104,13 +141,14 @@ export async function main(argv) {
             stopping = true;
             const why = 'Impeccable stopped before the setup started.';
             if (sync) {
-                sync.update({ phase: 'error', status: why, question: null });
+                sync.update({ phase: 'error', status: why, question: null, stop_reason: 'stopped' });
                 await settle(sync.flush(), 5000);
             }
             land(new UserError(why));
             await closeScreens();
             console.error(why);
-            await letTabsHear();
+            reporter.step({ event: 'setup_command_stopped', outcome: 'ctrl_c' });
+            await Promise.all([letTabsHear(), reporter.done()]);
             process.exit(130);
         };
         showRun({ onCancel: () => void stopEarly() });
@@ -126,6 +164,8 @@ export async function main(argv) {
             throw new UserError(`Impeccable answered with a model gateway off ${flags.host}, so the command stopped before sending anything there.`);
         land(page);
         const runToken = run.run_token;
+        // From here the run's own token, so each step names the run too.
+        reporter.signedIn(runToken, cliApi);
         const sessionUrl = `${cliApi}/sessions/${encodeURIComponent(run.run_id)}`;
         const liveSync = createSessionSync((payload) => requestJson(sessionUrl, { method: 'PUT', token: runToken, body: payload }, log));
         sync = liveSync;
@@ -135,7 +175,7 @@ export async function main(argv) {
         log.write('front end', frontEnd);
         const webPage = { label: 'Web page', url: page };
         if (frontEnd === 'none')
-            await nothingToSetUp(liveSync, 'No web front end', NO_FRONT_END, [webPage]);
+            await nothingToSetUp(liveSync, reporter, 'nothing_to_set_up', 'No web front end', NO_FRONT_END, [webPage]);
         const [instructions, state] = await Promise.all([
             requestJson(`${setupApi}/instructions`, { token: token.access_token }, log),
             requestJson(`${setupApi}/state`, { token: token.access_token }, log),
@@ -145,15 +185,12 @@ export async function main(argv) {
         // When the checkout cannot tell, the setup state's own verdict decides. When it has a web front end Impeccable skipped, the person adds it first.
         if (stateSaysNoFrontEnd(state.data, token.repository.name)) {
             if (frontEnd === 'unknown')
-                await nothingToSetUp(liveSync, 'No web front end', NO_FRONT_END, [webPage]);
+                await nothingToSetUp(liveSync, reporter, 'nothing_to_set_up', 'No web front end', NO_FRONT_END, [webPage]);
             const setupPage = state.data.account?.setupPage;
-            await nothingToSetUp(liveSync, 'Repository skipped', SKIPPED, [...(typeof setupPage === 'string' && onHost(setupPage) ? [{ label: 'Setup page', url: setupPage }] : []), webPage]);
+            await nothingToSetUp(liveSync, reporter, 'skipped_repo', 'Repository skipped', SKIPPED, [...(typeof setupPage === 'string' && onHost(setupPage) ? [{ label: 'Setup page', url: setupPage }] : []), webPage]);
         }
         if (!interactive)
             say('Signed in.\n');
-        // Scratch output (a server's log, a build's output) goes here and never into the checkout.
-        const scratch = mkdtempSync(join(tmpdir(), 'impeccable-reviews-scratch-'));
-        process.on('exit', () => rmSync(scratch, { recursive: true, force: true }));
         // Beside the transcript, named after the run as it is, so a run never writes over another's in the temp folder.
         const scans = scanRecorder(log, flags.scanReport ? join(dirname(transcriptPaths(run.run_id, flags.transcript).markdown), `scan-report-${run.run_id.replace(/[^\w.-]/g, '_')}.json`) : undefined);
         atExit(() => scans.report());
@@ -187,12 +224,18 @@ export async function main(argv) {
                 // The web page has the report; when it missed it, the report stays here instead.
                 if (!saved?.ok)
                     say(`\n${report.markdown.trim()}`);
+                if (!saved?.ok)
+                    reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });
+                await reporter.done();
                 process.exit(0);
             }
             const waiting = liveSync.payload.phase === 'waiting' ? liveSync.payload.question?.prompt : undefined;
             const why = fatal ? `Impeccable stopped: ${fatal}` : waiting ? `Impeccable stopped while waiting for an answer: ${waiting}` : 'Impeccable stopped before the setup finished.';
-            liveSync.update({ phase: 'error', status: why, question: null });
+            const stopped = fatal ? 'model_error' : waiting ? 'unanswered' : cancelled ? 'stopped' : 'failed';
+            liveSync.update({ phase: 'error', status: why, question: null, stop_reason: stopped });
             const saved = await settle(liveSync.flush(), 5000);
+            if (!saved?.ok)
+                reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });
             const missed = saved?.ok ? [] : [`The web page missed this (${saved?.error ?? 'no answer'}), so it may still show the run as going.`];
             const { test_pr: drive, setup_pr: setup } = liveSync.payload;
             await showOutro({
@@ -203,6 +246,7 @@ export async function main(argv) {
                 todo: ['Run impeccable-reviews again to carry on. What was saved stays saved; the web page has the details.'],
                 warnings: missed,
             });
+            await reporter.done();
             process.exit(1);
         };
         await runAgent({
@@ -212,12 +256,12 @@ export async function main(argv) {
             effort: flags.effort,
             gatewayUrl: run.gateway_url,
             runToken,
-            systemPrompt: playbook({ owner: checkout.owner, name: token.repository.name, scratch }),
+            systemPrompt: playbook({ owner: checkout.owner, name: token.repository.name, scratch, sandboxed: !sandbox.warning }),
             firstMessage: firstMessage({ owner: checkout.owner, name: token.repository.name }),
             firstContext: setupContext(focused, focusState(state.data)),
             tools: createTools({
                 setupApi,
-                auth: setupAuth(token, (_pi, why) => signIn(flags.host, log, screenPrompt((link, on) => showSignIn(link, { ...on, why })), accept)),
+                auth: setupAuth(token, (_pi, why) => signIn(flags.host, slug, log, screenPrompt((link, on) => showSignIn(link, { ...on, why })), accept)),
                 owner: token.repository.owner,
                 repo: token.repository.name,
                 instructions: focused,
@@ -227,11 +271,13 @@ export async function main(argv) {
                 onReport: (r) => void (report = r),
                 log,
                 previewWait: previewWait(),
+                sandbox,
             }),
             extensions: [
                 fenceExtension(checkout.root, log, checkout.protectedBranches, scratch, scans),
                 syncExtension(liveSync, { onFatal: (message) => void (fatal = message), onQuit: finish }),
             ],
+            bash: sandbox.shell,
             interactive,
             runId: run.run_id,
             transcript: flags.transcript,
@@ -247,12 +293,19 @@ export async function main(argv) {
         land(new UserError(message));
         log.write('fatal', err instanceof Error ? (err.stack ?? err.message) : String(err));
         if (sync) {
-            sync.update({ phase: 'error', status: message, question: null });
+            // A sign-in the person cancelled mid-run (a renewed one) is a stop they chose, not a failure.
+            const chose = err instanceof UserError && err.step?.event === 'setup_command_sign_in_ended' && err.step.outcome === 'cancelled';
+            sync.update({ phase: 'error', status: message, question: null, stop_reason: chose ? 'stopped' : 'failed' });
             await settle(sync.flush(), 5000);
         }
+        // A stop that ends a step reports it, and anything the command did not expect is a crash; the rest the Worker saw itself.
+        if (!(err instanceof UserError))
+            reporter.step({ event: 'setup_command_stopped', outcome: 'crashed' });
+        else if (err.step)
+            reporter.step(err.step);
         await closeScreens();
         console.error(message);
-        await letTabsHear();
+        await Promise.all([letTabsHear(), reporter.done()]);
         process.exit(1);
     }
 }

package/dist/netlify-password.js

@@ -47,7 +47,8 @@ export async function passNetlifyLock(deps) {
     const finish = async (password, how) => {
         deps.remember(password);
         deps.remember(basicCredentials(password));
-        const proof = await deps.prove(password);
+        // Netlify's form, which an app's own password form looks like, gets the password only on a site whose settings show one.
+        const proof = await deps.prove(password, site !== null);
         // locked: Netlify's lock stood all the same, and its form did not take the password either. Any other failure is the proof's to say: the form took it and the header did not, or the page past the lock is another, or did not answer.
         if (!proof.proven)
             return { reason: proof.reason ?? 'The address did not open with the password.', locked: proof.gate !== undefined && !proof.formOpened };

package/dist/netlify.js

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { promisify } from 'node:util';
+import { gitEnvironment } from './sandbox.js';
 /**
  * Netlify: the deploy previews this repository's pull requests get (from
  * GitHub's record and from the Netlify CLI on this machine when it is signed
@@ -28,11 +29,13 @@ const previewAddress = (pullRequest, site) => (`deploy-preview-${pullRequest}--$
 /**
  * A runner for gh or netlify here: its input ends at once, so nothing waits on it, and no browser opens (a sign-in is the
  * person's) unless `browser` says so, for `netlify login`, which opens one and waits for the person's approval there.
+ * `env` adds settings the command reads, such as the account cf acts in.
  */
 export function commandRunner(name, cwd, opts = {}) {
     return async (args) => {
         try {
-            const env = { ...process.env, ...(opts.browser ? {} : { BROWSER: 'none', CI: 'true' }), GH_PROMPT_DISABLED: '1' };
+            // The CLIs run git in the checkout, outside the sandbox.
+            const env = gitEnvironment({ ...process.env, ...(opts.browser ? {} : { BROWSER: 'none', CI: 'true' }), GH_PROMPT_DISABLED: '1', ...opts.env });
             const run = execFileAsync(name, args, { cwd, encoding: 'utf8', timeout: opts.timeoutMs ?? 30_000, maxBuffer: 16 * 1024 * 1024, signal: opts.signal, env });
             run.child.stdin?.end();
             return (await run).stdout;

package/dist/playbook/cases/cloudflare-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias. Ask it only where the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and wrangler on this machine lists the project's deployments when it is signed in. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
+Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias. Ask it only where the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and cf, Cloudflare's CLI, lists the project's deployments when it is signed in here. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
 ### Steps
 
@@ -13,5 +13,5 @@ Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_pr
 - **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as ci-tunnel or static-site says instead, and say under "What is not verified" what the Cloudflare address answered.
 - **Nothing listed**: Cloudflare's previews are not on record, so set the preview up as ci-tunnel or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
 - **The pull requests**: no setup pull request; the test drive branches from the default branch, and Cloudflare builds every pushed branch, so pull-requests' step 4 goes the Vercel way with impeccable_cloudflare_previews in place of impeccable_hosted_previews: with `branch: "impeccable/test-drive"` it waits up to five minutes for the check run on the pushed head, under a status line with its timer, and the test drive's page is proven on the alias it lists before the pull request opens. In place of pull-requests' step 3, build the test drive branch once with the build Cloudflare runs (the Pages project's build command, which the checkout's `package.json` `build` script usually is), so a page that does not build is never pushed.
-- The evidence is read only: link, deploy and change nothing on Cloudflare, and never sign wrangler in. Cloudflare does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern, the branch's alias: save the pattern the proof answered, and no other.
+- The evidence is read only: link, deploy and change nothing on Cloudflare. The one Cloudflare sign-in is impeccable_cloudflare_access's, behind Access, on the person's yes. Cloudflare does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern, the branch's alias: save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found", and the pattern saved under "What was configured, and by whom". The test drive's own preview, which Cloudflare builds after the run, goes under "What is not verified".

package/dist/playbook/cases/netlify-setup.md

@@ -17,7 +17,7 @@ The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a
 
 - **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the site not created, the repository not connected): the Netlify setup ends there. Set the preview up as ci-tunnel or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Netlify's GitHub app access to the repository", with the `access` page in the report.
 - **No preview for the draft**: save no method, set up no other preview, and leave the draft as it is, unrecorded, as pull-requests' "No preview, no test drive" says; the site and the connection stay, and the report names them.
-  - **The build failed** (`state` is `error` or `failure`): `netlify deploy --build --context deploy-preview` builds this linked checkout as Netlify does, uploads a draft, and prints why it failed, so the report can name the cause.
+  - **The build failed** (`state` is `error` or `failure`): say so under "What is not verified", with the command that builds this linked checkout as Netlify does and prints why, for the person to run: `netlify deploy --build --context deploy-preview`. It never runs here, since it builds with their Netlify sign-in.
   - **No deploy preview within five minutes**: the build had not finished, or Netlify builds no deploy preview for pull requests here: Deploy Previews may be off in the site's settings, so put "Turn Deploy Previews on in the site's Netlify settings" in `left`.
 - **Behind a password or Netlify's login** (`gate: "netlify-protection"`): the preview-protection case's, whose steps come before the save in step 5. A team that keeps new sites private puts Netlify's team login in front of the new site's previews, which no tool gets past: put "Make the site public, or password-protected, in Project configuration → General → Visitor access" in `left`.
 - **The report** names the Netlify site under "What was configured, and by whom", whichever way the run ended, since it stays in the person's Netlify account, with how the repository was connected and the CLI's install when there was one. The site's environment variables are the person's: when the app needs some (`.env.example`), list their names, never their values, under "Before you merge".

package/dist/playbook/cases/preview-protection.md

@@ -4,8 +4,8 @@ impeccable_prove_preview answered a `gate`: the host's own lock stands in front
 
 ### Steps
 
-1. **Get the key in place** (the Preview method task): impeccable_vercel_bypass for Vercel's login, under the status line *"Getting past Vercel's login"*; impeccable_netlify_password for Netlify's lock, under *"Getting past Netlify's password"*; impeccable_cloudflare_access for Cloudflare Access, under *"Getting past Cloudflare Access"*. The tool does the rest: it finds the project's secret labelled "Impeccable reviews", or reads what Netlify's settings say stands in front of the site; shows one screen asking to create the secret, to store the site password Netlify gives back, or to create a service token (then one taking the Cloudflare API token that creating it takes, and it allows the token in the Access application's policy), or, when it cannot make or read one, one screen taking a pasted one; opens the preview with it; and saves it for reviews. The key never comes back to you. Done when it answered `status`:
-   - `saved`: the preview is proven (`proven: true`); `secret`, `password` or `token` says whether it was created, existing or typed, and `project`, `site` or `application` which one holds or allows it; Cloudflare's `pattern` is the address pattern to save with the method. Step 2.
+1. **Get the key in place** (the Preview method task): impeccable_vercel_bypass for Vercel's login, under the status line *"Getting past Vercel's login"*; impeccable_netlify_password for Netlify's lock, under *"Getting past Netlify's password"*; impeccable_cloudflare_access for Cloudflare Access, under *"Getting past Cloudflare Access"*. The tool does the rest: it finds the project's secret labelled "Impeccable reviews", or reads what Netlify's settings say stands in front of the site; shows one screen asking to create the secret, to store the site password Netlify gives back, or to create a service token (then Cloudflare's sign-in in the browser where cf here lacks it, and it creates the token as the person and allows it in the Access application's policy; a screen takes a Cloudflare API token only where that sign-in cannot), or, when it cannot make or read one, one screen taking a pasted one; opens the preview with it; and saves it for reviews. The key never comes back to you. Done when it answered `status`:
+   - `saved`: the preview is proven (`proven: true`); `secret`, `password` or `token` says whether it was created, existing or typed, and `project`, `site` or `application` which one holds or allows it; Cloudflare's `pattern` is the address pattern to save with the method, and `apiToken` says a Cloudflare API token the person made created the token. Step 2.
    - `login` (Netlify): the site is behind Netlify's team login, which no tool gets past; `reason` says so. Step 3.
    - `refused` whose `reason` says to prove a page a visitor opens: Netlify's own site password opened neither the header nor Netlify's form, so the page you proved asks for the app's own sign-in past the lock, or Netlify did not answer. Prove a page a visitor opens without signing in, as netlify-previews' step 1 says, and call the tool again; the consent is not asked a second time. Refused again, step 3.
    - Any other `skipped` or `refused`: nothing was saved; `reason` says what stopped it. Step 3.
@@ -15,7 +15,7 @@ impeccable_prove_preview answered a `gate`: the host's own lock stands in front
 
 ### Reference
 
-- **The report** names, under "What was configured, and by whom", the Vercel project that holds the secret named "Impeccable reviews" (`project`), whether this run created it, found it there or the person typed it, and where it is revoked: the project's Settings → Deployment Protection → Protection Bypass for Automation; or the Netlify site (`site`) whose password is stored, whether this run read it from the site or the person typed it, and where it is changed: the site's Project configuration → General → Visitor access; or the service token named "Impeccable reviews", whether this run created it or the person typed it, the Access application whose policy allows it (`application`), when a created one runs out (`expires`), and where it is revoked: Zero Trust → Access controls → Service credentials → Service Tokens, with the Cloudflare API token the person made for the run theirs to delete (dash.cloudflare.com/profile/api-tokens). Revoking, regenerating or changing it stops reviews until this setup is run again.
+- **The report** names, under "What was configured, and by whom", the Vercel project that holds the secret named "Impeccable reviews" (`project`), whether this run created it, found it there or the person typed it, and where it is revoked: the project's Settings → Deployment Protection → Protection Bypass for Automation; or the Netlify site (`site`) whose password is stored, whether this run read it from the site or the person typed it, and where it is changed: the site's Project configuration → General → Visitor access; or the service token named "Impeccable reviews", whether this run created it or the person typed it, the Access application whose policy allows it (`application`), when a created one runs out (`expires`), and where it is revoked: Zero Trust → Access controls → Service credentials → Service Tokens; with `apiToken`, the Cloudflare API token the person made for the run is theirs to delete (dash.cloudflare.com/profile/api-tokens). Revoking, regenerating or changing it stops reviews until this setup is run again.
 - **The tool does the writes**: the key as Impeccable's credential for the lock, and the setting that sends it in the host's header (`x-vercel-protection-bypass`, `Authorization`, or `CF-Access-Client-Id` and `CF-Access-Client-Secret`), both through the setup API, so impeccable_write refuses those two. The state's `preview-protection` item words the same calls, and shows `keySaved` once they are done.
 - **A key saved before** (the item shows `keySaved` and a `check` that `passed`): the lock was handled by an earlier run or the person. Run step 2's check and go on; call the tool only when that check fails.
 - **The key is never yours**: it goes from the command's own process to the host and to Impeccable, and into no message, status line, file, command or report. `vercel project protection`, `vercel api`, `vercel curl` and `netlify api` print it, and the fence refuses them.

package/dist/playbook/github-previews.js

@@ -0,0 +1,101 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const LIMIT = 20;
+const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
+const FAILURE = 'GitHub preview evidence could not be read completely.';
+const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function positiveInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+function sha(value) {
+    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
+}
+function previewUrl(value) {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
+export async function readHostedPreviews(owner, repo, dependencies = {}) {
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+    const runGh = dependencies.runGh ?? (async (args) => {
+        const { stdout } = await execFileAsync('gh', args, {
+            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
+        });
+        return stdout;
+    });
+    const base = `/repos/${owner}/${repo}`;
+    async function get(route) {
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const data = JSON.parse(stdout);
+        if (!Array.isArray(data))
+            throw new Error(FAILURE);
+        return data.slice(0, LIMIT);
+    }
+    try {
+        const [deployments, pulls] = await Promise.all([
+            get(`${base}/deployments?per_page=${LIMIT}`),
+            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
+        ]);
+        let incomplete = false;
+        const evidence = [];
+        for (const entry of deployments) {
+            if (dependencies.signal?.aborted) {
+                incomplete = true;
+                break;
+            }
+            const deployment = record(entry);
+            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
+                continue;
+            let latest;
+            try {
+                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
+            }
+            catch {
+                incomplete = true;
+                if (dependencies.signal?.aborted)
+                    break;
+            }
+            const status = STATES.find((state) => state === latest?.state) ?? null;
+            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
+                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
+            const pullRequests = [];
+            for (const item of pulls) {
+                const pull = record(item);
+                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
+                    && record(pull.head)?.sha === deployment.sha) {
+                    pullRequests.push({ number: pull.number, state: pull.state });
+                }
+            }
+            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
+                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
+        }
+        incomplete ||= dependencies.signal?.aborted ?? false;
+        return { coverage: COVERAGE, deployments: evidence,
+            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
+    }
+    catch {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+}

package/dist/playbook/netlify-pattern.js

@@ -0,0 +1,24 @@
+/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
+export function netlifyPatternError(body, observed) {
+    const pattern = body.previewUrlPattern;
+    if (typeof pattern !== 'string')
+        return null;
+    let netlify = /netlify\.app|<site>/i.test(pattern);
+    try {
+        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
+        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
+    }
+    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
+    if (!netlify)
+        return null;
+    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
+    if (!match || match[1].length > 63)
+        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
+    if (Object.hasOwn(body, 'appKey'))
+        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
+    if (body.intendedMethod !== 'preview-deploy')
+        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
+    if (!observed.has(pattern))
+        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
+    return null;
+}