@impeccable/reviews 0.1.1 → 0.1.2

package/dist/report.js

@@ -0,0 +1,68 @@
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+/** How long the command waits for its reports at the end: never long enough for anyone to notice. */
+const SEND_MS = 2000;
+/** Off with --no-telemetry or DO_NOT_TRACK=1: nothing is sent, not even the launch. */
+export function reportingOff(env, flag) {
+    return flag || /^(1|true|yes)$/i.test(env.DO_NOT_TRACK?.trim() ?? '');
+}
+function version() {
+    try {
+        return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * The command's reporter. Before sign-in it holds its steps, since only a
+ * token names the person they belong to; signing in sends them with it, at the
+ * time each happened. A command that ends without signing in sends them with
+ * no token, under its launch id alone, and the Worker keeps them unnamed.
+ * Nothing it sends can fail the command or hold it past two seconds.
+ */
+export function createReporter(opts) {
+    const send = opts.fetchImpl ?? fetch;
+    const launchId = opts.launchId ?? randomUUID();
+    const about = { launch_id: launchId, version: version(), node_major: Number(process.versions.node.split('.')[0]), os: process.platform };
+    let held = [];
+    let auth;
+    const sending = new Set();
+    const post = (events, token, url = `${opts.host}/app/cli/events`) => {
+        if (!events.length)
+            return;
+        const sent = send(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+            body: JSON.stringify({ ...about, events }),
+            signal: AbortSignal.timeout(SEND_MS),
+        }).catch(() => undefined);
+        sending.add(sent);
+        void sent.finally(() => sending.delete(sent));
+    };
+    return {
+        step(step) {
+            if (opts.off)
+                return;
+            const stamped = { ...step, at: new Date().toISOString() };
+            if (auth)
+                post([stamped], auth.token, auth.url);
+            else
+                held.push(stamped);
+        },
+        signedIn(token, cliApi) {
+            if (opts.off)
+                return;
+            auth = { token, url: `${cliApi.replace(/\/$/, '')}/events` };
+            post(held, token, auth.url);
+            held = [];
+        },
+        async done() {
+            if (opts.off)
+                return;
+            post(held);
+            held = [];
+            await Promise.race([Promise.allSettled([...sending]), new Promise((resolve) => setTimeout(resolve, SEND_MS).unref())]);
+        },
+    };
+}

package/dist/sandbox.js

@@ -0,0 +1,280 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { homedir, tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
+import { createLocalBashOperations } from '@earendil-works/pi-coding-agent';
+import { UserError } from './log.js';
+/** Its git folders, as git names them; readCheckout has already refused a checkout whose own .git holds a commondir. */
+export function gitDirsOf(root) {
+    const git = (...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    return { root: realpathSync(root), gitDir: realpathSync(git('rev-parse', '--absolute-git-dir')), commonDir: realpathSync(resolve(root, git('rev-parse', '--git-common-dir'))) };
+}
+let pinned;
+let own;
+/**
+ * A folder of the command's own, outside the checkout and everything a sandboxed command writes. What runs from here
+ * as the person and fetches a package (npx for cf, a host CLI's install) reads no .npmrc and no node_modules of the
+ * repository's choosing.
+ */
+export function ownFolder() {
+    if (!own) {
+        const folder = (own = mkdtempSync(join(tmpdir(), 'impeccable-reviews-own-')));
+        process.on('exit', () => rmSync(folder, { recursive: true, force: true }));
+    }
+    return own;
+}
+/**
+ * The environment of every git that runs outside the sandbox, the command's own and the person's commands (gh and the
+ * host CLIs run git too): no hooks and no fsmonitor, whose programs a sandboxed command could have written, and, once
+ * the sandbox started, this checkout's git folders named rather than found, so a .git or a commondir a sandboxed
+ * command made is never what git reads.
+ */
+export function gitEnvironment(env = process.env) {
+    const settings = [env.GIT_CONFIG_PARAMETERS, "'core.hooksPath=/dev/null' 'core.fsmonitor=false'"].filter(Boolean).join(' ');
+    return { ...env, GIT_CONFIG_PARAMETERS: settings, ...(pinned ? { GIT_DIR: pinned.gitDir, GIT_COMMON_DIR: pinned.commonDir, GIT_WORK_TREE: pinned.root } : {}) };
+}
+/** Credential folders and files, from the home folder, that no command in the sandbox reads: SSH's, GPG's and the cloud CLIs' keys, and git's, gh's and Docker's sign-ins. */
+const CREDENTIALS = ['.ssh', '.gnupg', '.aws', '.azure', '.config/gcloud', '.kube', '.docker', '.netrc', '.git-credentials', '.config/gh'];
+/** The package managers' caches and stores, which an install writes. */
+const CACHES = ['.npm', '.pnpm-store', '.local/share/pnpm', '.cache/pnpm', '.cache/yarn', '.yarn/berry', '.bun/install/cache', '.cache/node/corepack', '.cache/prisma'];
+/** macOS keeps the keychains, and some of those caches, under Library. */
+const MACOS = { credentials: ['Library/Keychains'], caches: ['Library/pnpm', 'Library/Caches/pnpm', 'Library/Caches/Yarn'] };
+/**
+ * What a command in the sandbox reads and writes: it reads what the person can but the credential folders, and writes
+ * in the checkout, its git folders (a worktree's are outside it), the run's scratch folder and the package caches, but
+ * never where git reads settings or programs from: config, hooks, info, a commondir, the submodules' and the other
+ * worktrees' git folders, and a .git below the checkout's top. Bubblewrap takes no pattern in a write rule, and puts a
+ * file in place of a denied path that is not there, which git would read as an empty commondir: on Linux only what is
+ * there is denied, and the git that runs outside is pinned to this checkout's folders instead.
+ */
+export function sandboxPolicy(o) {
+    const macos = o.platform === 'darwin';
+    const { root, gitDir, commonDir } = o.git;
+    const inHome = (paths) => paths.map((path) => join(o.home, path));
+    const denyWrite = [
+        ...['config', 'config.worktree', 'hooks', 'info', 'modules'].map((name) => join(commonDir, name)),
+        ...['commondir', 'config.worktree'].map((name) => join(gitDir, name)),
+        ...o.worktrees.flatMap((name) => ['commondir', 'config.worktree'].map((file) => join(commonDir, 'worktrees', name, file))),
+        // A worktree's or a submodule's .git is a file that names its git folder.
+        ...(gitDir === join(root, '.git') ? [] : [join(root, '.git')]),
+        ...(macos ? [join(root, '*', '**', '.git')] : []),
+        // Inside npm's cache, which installs write: what npx installed, which the command's own tools run outside the sandbox.
+        join(o.home, '.npm', '_npx'),
+    ];
+    const exists = o.exists ?? existsSync;
+    return {
+        denyRead: inHome([...CREDENTIALS, ...(macos ? MACOS.credentials : [])]),
+        allowWrite: [...new Set([root, gitDir, commonDir, o.scratch, ...inHome([...CACHES, ...(macos ? MACOS.caches : [])])])],
+        denyWrite: [...new Set(macos ? denyWrite : denyWrite.filter((path) => exists(path)))],
+    };
+}
+/** GitHub and the hosts it serves files from, for a dependency on GitHub. */
+const GITHUB = ['github.com', '*.github.com', '*.githubusercontent.com'];
+/** The public registries a kind of manifest or lockfile installs from. */
+const REGISTRIES = [
+    [/(?:^|\/)(?:package\.json|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|bun\.lockb?)$/, ['registry.npmjs.org']],
+    [/(?:^|\/)(?:yarn\.lock|\.yarnrc\.yml)$/, ['registry.npmjs.org', 'registry.yarnpkg.com', 'repo.yarnpkg.com']],
+    [/(?:^|\/)(?:requirements[\w.-]*\.txt|pyproject\.toml|Pipfile|Pipfile\.lock|poetry\.lock|uv\.lock)$/, ['pypi.org', 'files.pythonhosted.org']],
+];
+/** What a dependency downloads while the app installs or builds: Google's fonts for next/font, Prisma's engines. */
+const DOWNLOADS = {
+    next: ['fonts.googleapis.com', 'fonts.gstatic.com'],
+    prisma: ['binaries.prisma.sh'],
+    '@prisma/client': ['binaries.prisma.sh'],
+};
+/** A host's API, once the person said yes to setting that host up. */
+const HOST_APIS = { vercel: ['vercel.com', '*.vercel.com'], netlify: ['netlify.com', '*.netlify.com'] };
+/** The hosts of the registries an npm config names, in its registry=, @scope:registry= and //host/:_authToken= lines; never a value's secret. */
+export function npmrcHosts(text) {
+    const hosts = [];
+    for (const line of text.split(/\r?\n/)) {
+        const registry = /^\s*(?:@[\w.-]+:)?registry\s*=\s*(\S+)/i.exec(line)?.[1];
+        const auth = /^\s*\/\/([^/\s:]+(?::\d+)?)\//.exec(line)?.[1];
+        if (auth)
+            hosts.push(auth.toLowerCase());
+        else if (registry && URL.canParse(registry))
+            hosts.push(new URL(registry).host);
+    }
+    return hosts;
+}
+/** The names of a package.json's dependencies of every kind; none when it cannot be read. */
+function dependenciesOf(json) {
+    try {
+        const manifest = JSON.parse(json ?? '');
+        return ['dependencies', 'devDependencies', 'optionalDependencies'].flatMap((field) => Object.keys(manifest[field] ?? {}));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The hosts a command in the sandbox reaches: --host, GitHub, the public registries the checkout's manifests and
+ * lockfiles install from, what its dependencies download, the registries of the person's own npm config, and a host's
+ * API once they said yes to setting it up. A registry the checkout's own lockfile names is its text, not the person's:
+ * it is reached when it is a public one, or theirs.
+ */
+export function allowedDomains(s) {
+    const host = new URL(s.host);
+    const names = [host.port ? `${host.hostname}:${host.port}` : host.hostname, ...GITHUB];
+    for (const [kind, registries] of REGISTRIES)
+        if (s.files.some((file) => kind.test(file)))
+            names.push(...registries);
+    // The checkout's own manifests: node_modules holds other people's, and can hold thousands.
+    for (const manifest of s.files.filter((file) => /(?:^|\/)package\.json$/.test(file) && !/(?:^|\/)node_modules\//.test(file)))
+        names.push(...dependenciesOf(s.read(manifest)).flatMap((name) => DOWNLOADS[name] ?? []));
+    names.push(...npmrcHosts(s.npmrc ?? ''));
+    for (const agreed of s.hosts)
+        names.push(...(HOST_APIS[agreed] ?? []));
+    return [...new Set(names)];
+}
+/**
+ * What a command in the sandbox also gets: Node's fetch through the sandbox's proxy; no browser downloads, which land in
+ * caches it does not write, from hosts it does not reach; and no git hooks installed by husky, which writes the git config
+ * the sandbox keeps.
+ */
+const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0' };
+/** The sandbox's own command line, which the local preview check runs each command through, in a sandbox of its own. */
+const SRT = createRequire(import.meta.url).resolve('@anthropic-ai/sandbox-runtime/dist/cli.js');
+/** Runs `true` in the sandbox: undefined when it did, else the first line of why not. */
+async function selfTest() {
+    const wrapped = await SandboxManager.wrapWithSandbox('true');
+    return new Promise((done) => {
+        let said = '';
+        const child = spawn(existsSync('/bin/bash') ? '/bin/bash' : 'bash', ['-c', wrapped], { stdio: ['ignore', 'ignore', 'pipe'] });
+        child.stderr.on('data', (chunk) => (said += chunk.toString()));
+        child.once('error', (err) => done(err.message));
+        child.once('close', (code) => done(code === 0 ? undefined : said.trim().split('\n')[0] || `it exited with ${code}`));
+    });
+}
+/** The files the checkout tracks and the new ones it does not ignore, by path from its top. */
+function checkoutFiles(root) {
+    try {
+        return execFileSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 256 * 1024 * 1024, env: gitEnvironment() }).split('\0').filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+const readText = (path) => {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Starts the sandbox for this run, before anything runs: on macOS a sandbox that will not start stops the command,
+ * and elsewhere its commands run unsandboxed, which `warning` says once, on the first screen. From here on git
+ * outside the sandbox is pinned to this checkout's folders.
+ */
+export async function startSandbox(o) {
+    const platform = process.platform;
+    const home = o.home ?? homedir();
+    const git = gitDirsOf(o.root);
+    pinned = git;
+    // Bubblewrap denies only what is there, so the folder npx keeps its installs in is made before any command runs: a command in the sandbox never gets to make it its own.
+    try {
+        mkdirSync(join(home, '.npm', '_npx'), { recursive: true });
+    }
+    catch {
+        // A home that takes no folder takes none from a sandboxed command either.
+    }
+    const worktrees = (() => {
+        try {
+            return readdirSync(join(git.commonDir, 'worktrees'));
+        }
+        catch {
+            return [];
+        }
+    })();
+    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees });
+    const files = checkoutFiles(git.root);
+    const sources = { host: o.host, files, read: (path) => readText(join(git.root, path)), npmrc: readText(join(home, '.npmrc')) };
+    let domains = allowedDomains({ ...sources, hosts: o.hosts() });
+    const config = { network: { allowedDomains: domains, deniedDomains: [] }, filesystem: policy };
+    // Temp files land in the scratch folder: the sandbox's runtime names the folder its commands get as TMPDIR from this variable.
+    const temp = join(o.scratch, 'tmp');
+    mkdirSync(temp, { recursive: true });
+    process.env.CLAUDE_CODE_TMPDIR = temp;
+    // The local preview check's settings sit where no sandboxed command writes.
+    const settings = ownFolder();
+    let off;
+    if (platform !== 'darwin' && platform !== 'linux')
+        off = `no sandbox for ${platform}`;
+    else if (!SandboxManager.isSupportedPlatform())
+        off = 'no sandbox for this system';
+    else {
+        const missing = SandboxManager.checkDependencies().errors;
+        if (missing.length)
+            off = missing.join(', ');
+    }
+    if (!off) {
+        try {
+            // A host off the list is refused by the sandbox's proxy; the debug log names it, which says what a failed install or build wanted.
+            await SandboxManager.initialize(config, async ({ host, port }) => {
+                o.log.write('sandbox refused a host', `${host}:${port}`);
+                return false;
+            });
+            off = await selfTest();
+        }
+        catch (err) {
+            off = (err instanceof Error ? err.message : String(err)).split('\n')[0];
+        }
+        if (off)
+            await SandboxManager.reset().catch(() => { });
+    }
+    if (off && platform === 'darwin') {
+        throw new UserError(`Impeccable runs the setup's commands in macOS's sandbox, and it did not start here (${off}). Run impeccable-reviews in a terminal of your own, outside any other sandbox.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
+    }
+    o.log.write(off ? `sandbox off: ${off}` : 'sandbox on', { domains, ...policy });
+    const local = createLocalBashOperations();
+    let running = 0;
+    const shell = {
+        exec: async (command, cwd, options) => {
+            const place = o.place(command);
+            if (place === 'install')
+                return local.exec(command, ownFolder(), options);
+            if (place === 'person')
+                return local.exec(command, cwd, { ...options, env: gitEnvironment(options.env) });
+            if (off)
+                return local.exec(command, cwd, options);
+            // A host's API joins the list once the person said yes to setting that host up.
+            const next = allowedDomains({ ...sources, hosts: o.hosts() });
+            if (next.join() !== domains.join()) {
+                domains = next;
+                SandboxManager.updateConfig({ ...config, network: { ...config.network, allowedDomains: domains } });
+                o.log.write('sandbox hosts', domains);
+            }
+            const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
+            running++;
+            try {
+                return await local.exec(wrapped, cwd, { ...options, env: { ...(options.env ?? process.env), ...INSIDE } });
+            }
+            finally {
+                // On Linux this takes away the files bubblewrap put in place of absent denied paths: only once no command still runs on them.
+                if (--running === 0)
+                    SandboxManager.cleanupAfterCommand();
+            }
+        },
+    };
+    return {
+        warning: off && `${off[0].toUpperCase()}${off.slice(1)}, so the setup's commands run without a sandbox, with all your access.`,
+        shell,
+        preview(folder) {
+            if (off || platform === 'linux')
+                return null;
+            const file = join(settings, `preview-${randomBytes(6).toString('hex')}.json`);
+            const own = {
+                network: { allowedDomains: domains, deniedDomains: [], allowLocalBinding: true },
+                filesystem: { denyRead: policy.denyRead, allowWrite: [realpathSync(folder)], denyWrite: [] },
+            };
+            writeFileSync(file, JSON.stringify(own), { mode: 0o600 });
+            // The command's TMPDIR comes from CLAUDE_CODE_TMPDIR; the sandbox's own sockets stay in this process's temp folder, whose path fits a socket's.
+            return (command, env) => ({ file: process.execPath, args: [SRT, '--settings', file, '-c', command], env: { ...env, ...INSIDE, CLAUDE_CODE_TMPDIR: env.TMPDIR ?? join(folder, 'tmp'), TMPDIR: tmpdir() } });
+        },
+    };
+}

package/dist/tools.js

@@ -7,12 +7,12 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
 import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
 import { netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
-import { pagesProject, readCloudflarePreviews } from './cloudflare.js';
+import { cfRunner, pagesProject, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
@@ -20,6 +20,7 @@ import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, ve
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
+import { gitEnvironment } from './sandbox.js';
 import { openBrowser } from './login.js';
 import { TASK_STATUSES } from './sync.js';
 import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
@@ -409,7 +410,7 @@ async function stopPreviewChild(child) {
     catch { /* already stopped */ }
 }
 /** Local reproduction only: no credentials, external database, response body or process output leaves this helper. */
-export async function verifyLocalPreview(input, root, signal) {
+export async function verifyLocalPreview(input, root, signal, sandbox) {
     const probes = [];
     const fail = (stage, reason) => ({ verified: false, stage, reason, probes });
     if (process.platform === 'win32')
@@ -506,8 +507,11 @@ export async function verifyLocalPreview(input, root, signal) {
         scratch = await realpath(await mkdtemp(join('/tmp', 'impeccable-preview-')));
         const snapshot = join(scratch, 'checkout'), home = join(scratch, 'home'), temp = join(scratch, 'tmp');
         await Promise.all([snapshot, home, temp].map((p) => mkdir(p, { mode: 0o700 })));
+        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it.
+        const inSandbox = sandbox?.preview(scratch);
+        const confined = (command, processEnv) => inSandbox?.(command, processEnv) ?? { file: '/bin/sh', args: ['-c', command], env: processEnv };
         env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
-        const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true);
+        const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true, 120_000, signal ?? null, gitEnvironment(env));
         if (!listing.ok)
             return fail(stage, 'Could not list checkout files.');
         const files = [...new Set(listing.output.split('\0').filter(Boolean))];
@@ -547,7 +551,7 @@ export async function verifyLocalPreview(input, root, signal) {
             await copyFile(source, target);
             await chmod(target, info.mode & 0o777);
             if (file.split('/').at(-1) === 'package.json') {
-                const baseline = await run('git', ['show', `HEAD:${file}`], root, true);
+                const baseline = await run('git', ['show', `HEAD:${file}`], root, true, 120_000, signal ?? null, gitEnvironment(env));
                 const scripts = (value) => Object.entries(JSON.parse(value).scripts ?? {}).sort(([a], [b]) => a.localeCompare(b));
                 scriptsChanged ||= !baseline.ok || JSON.stringify(scripts(baseline.output)) !== JSON.stringify(scripts(await readFile(source, 'utf8')));
             }
@@ -629,8 +633,9 @@ export async function verifyLocalPreview(input, root, signal) {
             }
             if (!executable)
                 return fail(stage, 'The required Python runtime or virtual environment is unavailable.');
-            // Precreate even for explicit bootstrap steps so every command in a compound step uses it.
-            if (!(await run(executable, ['-m', 'venv', '.venv'], directory)).ok)
+            // Precreate even for explicit bootstrap steps so every command in a compound step uses it. `-m` imports from the folder, the checkout's code, so it runs in the sandbox too.
+            const venv = confined(`'${executable.replace(/'/g, `'\\''`)}' -m venv .venv`, env);
+            if (!(await run(venv.file, venv.args, directory, false, 120_000, signal ?? null, venv.env)).ok)
                 return fail(stage, 'The required Python runtime or virtual environment is unavailable.');
         }
         const environmentFor = (directory) => {
@@ -666,7 +671,8 @@ export async function verifyLocalPreview(input, root, signal) {
         }
         for (const [index, step] of input.steps.entries()) {
             stage = step.phase;
-            if (!(await run('/bin/sh', ['-c', step.command], directories[index], false, 120_000, signal ?? null, environmentFor(directories[index]))).ok)
+            const command = confined(step.command, environmentFor(directories[index]));
+            if (!(await run(command.file, command.args, directories[index], false, 120_000, signal ?? null, command.env)).ok)
                 return fail(stage, signal?.aborted ? 'Verification was cancelled.' : 'The local step failed or exceeded two minutes; its output was not retained.');
         }
         if (staticInput) {
@@ -682,7 +688,8 @@ export async function verifyLocalPreview(input, root, signal) {
         const free = await new Promise((done) => { const check = createServer(); check.once('error', () => done(false)); check.listen(serverInput.port, '127.0.0.1', () => check.close(() => done(true))); });
         if (!free)
             return fail(stage, 'The preview port is already in use; an existing service was not probed.');
-        server = spawn('/bin/sh', ['-c', serverInput.start.command], { cwd: directories.at(-1), env: environmentFor(directories.at(-1)), detached: true, stdio: 'ignore' });
+        const start = confined(serverInput.start.command, environmentFor(directories.at(-1)));
+        server = spawn(start.file, start.args, { cwd: directories.at(-1), env: start.env, detached: true, stdio: 'ignore' });
         let exited = false;
         server.once('error', () => { exited = true; });
         server.once('exit', () => { exited = true; });
@@ -746,7 +753,7 @@ const execFileAsync = promisify(execFile);
  */
 export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
     try {
-        await execFileAsync('git', ['merge-base', '--is-ancestor', `refs/remotes/origin/${setupBranch}`, `refs/remotes/origin/${driveBranch}`], { cwd, timeout: 10_000 });
+        await execFileAsync('git', ['merge-base', '--is-ancestor', `refs/remotes/origin/${setupBranch}`, `refs/remotes/origin/${driveBranch}`], { cwd, timeout: 10_000, env: gitEnvironment() });
         return true;
     }
     catch (err) {
@@ -981,11 +988,11 @@ export function workflowGitEnvironment() {
                 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_CURL_VERBOSE', 'GIT_CONFIG_PARAMETERS', 'GIT_CONFIG',
                 'GIT_CEILING_DIRECTORIES', 'GIT_DISCOVERY_ACROSS_FILESYSTEM', 'GIT_PREFIX', 'GIT_ASKPASS', 'SSH_ASKPASS'].includes(key))
             delete env[key];
-    return Object.assign(env, { GIT_TERMINAL_PROMPT: '0', GH_PROMPT_DISABLED: '1', GCM_INTERACTIVE: 'never',
+    return gitEnvironment(Object.assign(env, { GIT_TERMINAL_PROMPT: '0', GH_PROMPT_DISABLED: '1', GCM_INTERACTIVE: 'never',
         GIT_ASKPASS: '', SSH_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never', GIT_SSH_VARIANT: 'ssh',
         GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o StrictHostKeyChecking=yes',
         // Removing the variables alone still permits globally configured trace2 targets.
-        GIT_TRACE2: '0', GIT_TRACE2_EVENT: '0', GIT_TRACE2_PERF: '0' });
+        GIT_TRACE2: '0', GIT_TRACE2_EVENT: '0', GIT_TRACE2_PERF: '0' }));
 }
 const record = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
 export function workflowDefaultBranch(value) {
@@ -1413,16 +1420,16 @@ export function createTools(ctx) {
     let provenHost;
     let savedHost;
     /**
-     * A host's build, waited for on the screen as the task in progress with its timer: `read` again every so often until
-     * `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
+     * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
+     * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
      */
-    async function awaitBuild(status, read, built, signal) {
+    async function awaitBuild(host, status, read, built, signal) {
         let evidence = await read();
         if (built(evidence))
             return evidence;
         const wait = ctx.previewWait ?? { totalMs: 300_000, everyMs: 15_000 };
         said(status);
-        reportWait({ since: Date.now(), limitMs: wait.totalMs });
+        reportWait({ since: Date.now(), host });
         try {
             for (const end = Date.now() + wait.totalMs; !built(evidence) && Date.now() < end; evidence = await read()) {
                 await sleep(wait.everyMs, undefined, { signal });
@@ -1528,6 +1535,12 @@ export function createTools(ctx) {
     const hostSignIns = new Map();
     /** The teams a host's sign-in offered, each by name and slug: the choices a `<host>-team` question shows, whatever the model lists, so the pick the fence takes is a slug. */
     const teamChoices = new Map();
+    /** A host's setup ended before anything was set up on the host: nothing more is asked for it, and the fence lets its CLI and its hold on pushes go. */
+    const endSetup = (host) => {
+        hostSignIns.set(host, 'skipped');
+        teamChoices.delete(host);
+        endHostSetup(ctx.log, host);
+    };
     const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
@@ -1577,7 +1590,7 @@ export function createTools(ctx) {
         if (!hostSignIns.has(host)) {
             const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`] });
             if (answer.skipped) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true };
             }
             hostSignIns.set(host, 'confirmed');
@@ -1599,11 +1612,11 @@ export function createTools(ctx) {
             if (status.cli === 'signed-in')
                 return signedIn();
             if (attempt === 2) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true, reason: `The ${HOST_NAMES[host]} sign-in did not complete.` };
             }
             if ((await ask(HOST_SCREENS[`${host}-signin-retry`])).skipped) {
-                hostSignIns.set(host, 'skipped');
+                endSetup(host);
                 return { skipped: true };
             }
         }
@@ -1742,7 +1755,7 @@ export function createTools(ctx) {
     return [
         tool('impeccable_workflow_access', 'Check workflow access', 'Check that the setup pull request can carry the workflow: reads the active GitHub CLI account and its scopes, the origin remote and the default branch, and refreshes origin/<defaultBranch>. Call it before branching. needsWorkflowScope true means the account lacks workflow access over HTTPS; base.status "refreshed" means origin/<defaultBranch> is current. Only the push itself proves Git may push.', NO_INPUT, (_p, pi, signal) => workflowAccessTool(pi, signal)),
         tool('impeccable_sync_workflow', 'Update the preview workflow', 'Write the state\'s workflow to .github/workflows/impeccable-preview.yml byte for byte and remove the retired workflow the state names, after checking access as impeccable_workflow_access does. Call it once the settings are saved, and again after committing: stagedMatches and committedMatches true (and retiredRemoval staged and committed) prove the commit holds the exact bytes; null means nothing was compared. It refuses, changing nothing, when the file has the person\'s local edits. It never branches, stages, commits or pushes.', NO_INPUT, (_p, pi, signal) => syncWorkflowTool(pi, signal)),
-        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal))),
+        tool('impeccable_verify_preview', 'Check the local preview', 'Prove the preview on this machine before saving it: runs the steps in a throwaway copy of the checkout, with a throwaway database, and removes everything afterwards. For a server give start, port, paths and host: it starts the app and requests each path as localhost and as the tunnel host. For a static site give output: it checks the build wrote the entry pages. verified covers HTTP answers and files only, never rendering, sign-in or the CI runtime; a failure names its stage.', PREVIEW_VERIFICATION, async (p, pi, signal) => JSON.stringify(await verifyLocalPreview(p, pi.cwd, signal, ctx.sandbox))),
         tool('impeccable_preview_run', 'Read the preview attempt', 'On a rerun, once impeccable_test_pr recorded the setup pull request: read its preview workflow\'s runs. Answers each attempt with its failed stage and a fixed reason (never log text), the three-attempt budget (used, remaining, historyKnown), and adds the attempts to the task list. Reading is free.', PREVIEW_RUN, async (p, pi, signal) => {
             if (!retry.pr)
                 return 'Refused: record the setup pull request with impeccable_test_pr first.';
@@ -1884,8 +1897,12 @@ export function createTools(ctx) {
             if (error)
                 return `Invalid input: ${error}.`;
             const answer = await askPerson(q);
-            if (answer.skipped)
+            if (answer.skipped) {
+                // Without a terminal the Vercel CLI names no team on its own, so a skipped team ends the Vercel setup.
+                if (host?.[1] === 'vercel')
+                    endSetup('vercel');
                 return JSON.stringify({ skipped: true });
+            }
             if (q.kind === 'multi')
                 return JSON.stringify({ values: answer.values ?? [] });
             if (q.kind === 'confirm') {
@@ -1986,7 +2003,7 @@ export function createTools(ctx) {
             const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
             // A head's build is still building until it has a final status.
             const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild(`Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
             listedPreviews.clear();
             vercelMade.clear();
             publicProduction.clear();
@@ -2019,24 +2036,24 @@ export function createTools(ctx) {
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
-            const evidence = pull !== undefined ? await awaitBuild(`Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, signal) : await read();
+            const evidence = pull !== undefined ? await awaitBuild('Netlify', `Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, signal) : await read();
             netlifyListed.clear();
             for (const p of evidence.previews)
                 if (p.state === 'success' || p.state === 'ready')
                     netlifyListed.add(new URL(p.url).origin);
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or wrangler on this machine when it is signed in (read only: it never signs in). cli says whether wrangler is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or wrangler. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
                 return 'Invalid input: give pull or branch, not both.';
             const read = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch });
-            // Cloudflare posts its check run once the build ended: until then the head lists nothing, or wrangler's row says it is building.
-            // GitHub's record unread ends the wait; wrangler's alone does not, since the check run still says when the build ends.
+            // Cloudflare posts its check run once the build ended: until then the head lists nothing, or cf's row says it is building.
+            // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
             const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
             const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
-            const evidence = subject ? await awaitBuild(`Waiting for Cloudflare Pages to build ${subject}`, read, final, signal) : await read();
+            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, signal) : await read();
             cloudflareListed.clear();
             for (const preview of evidence.previews) {
                 if (preview.state !== 'success')
@@ -2142,15 +2159,14 @@ export function createTools(ctx) {
             const at = gated;
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
             let pattern;
-            const prove = async (password) => {
-                const proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password });
+            const prove = async (password, form = false) => {
+                const proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password, form });
                 if (proof.proven && proof.pattern)
                     pattern = proof.pattern;
                 return proof;
             };
-            // A password in hand already: another deploy preview of the same site opens with it.
-            if (passwordSaved && sitePassword && (await prove(sitePassword)).proven) {
-                passwordSites.add(site);
+            // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
+            if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
                 provenPattern = pattern ?? provenPattern;
                 return JSON.stringify(passwordSaved);
             }
@@ -2197,7 +2213,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(passwordOutcome);
         }),
-        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token and one taking the Cloudflare API token that creating it takes, then the token named "Impeccable reviews" created and allowed in the policy of the application in front of the preview; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
             if (accessOutcome?.status === 'skipped')
@@ -2228,6 +2244,10 @@ export function createTools(ctx) {
                 answer = await passCloudflareAccess({
                     url: at.url,
                     consent: async () => !(await ask(HOST_SCREENS['cloudflare-access'])).skipped,
+                    cf: cfRunner({}, ctx.hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
+                    retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
+                    status: said,
                     apiToken: async () => {
                         const typed = await ask(HOST_SCREENS['cloudflare-access-api']);
                         return typed.skipped ? undefined : typed.value;
@@ -2250,7 +2270,7 @@ export function createTools(ctx) {
                     accessProjects.clear();
                 accessToken = value;
                 accessStored = told.status === 'saved';
-                accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}) };
+                accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
                 const project = pagesProject(new URL(at.url).origin);
                 if (project)
                     accessProjects.add(project);