@impeccable/reviews 0.1.1 → 0.1.3

package/dist/cloudflare.js

@@ -1,10 +1,11 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { commandRunner } from './netlify.js';
+import { ownFolder } from './sandbox.js';
 /**
  * Cloudflare Pages: the preview deployments this repository's pull requests
- * get, from GitHub's record and from wrangler on this machine when it is
- * signed in (read only), and whether wrangler is signed in. Cloudflare's
+ * get, from GitHub's record and from cf, Cloudflare's CLI, on this machine
+ * when it is signed in (read only), and whether cf is signed in. Cloudflare's
  * GitHub app records no deployment and no commit status: its record is a
  * check run on each commit it built and a comment on the pull request, both
  * naming the deployment's address (https://<id>.<project>.pages.dev) and the
@@ -27,7 +28,7 @@ const list = (value) => (Array.isArray(value) ? value.map(record).filter((item)
 const sha = (value) => typeof value === 'string' && /^[0-9a-f]{40}$/.test(value);
 /** A branch name GitHub can be asked about: the characters git allows, no `..`, and neither a slash nor a dot at the end. */
 const branchName = (value) => /^[A-Za-z0-9][A-Za-z0-9._/-]{0,254}$/.test(value) && !value.includes('..') && !value.endsWith('/') && !value.endsWith('.');
-/** A branch, as GitHub names it in a check run's summary or a wrangler row: git's characters, and not too long to be one. */
+/** A branch, as GitHub names it in a check run's summary or cf in a deployment: git's characters, and not too long to be one. */
 const branchOf = (value) => (typeof value === 'string' && branchName(value) ? value : undefined);
 /** The project a Pages address belongs to; null for any other address. */
 export function pagesProject(url) {
@@ -153,57 +154,98 @@ export function plainJson(text) {
     }
     return out.replace(/,(\s*[}\]])/g, '$1');
 }
-/** What `wrangler whoami --json` printed, as JSON: the same object signed out, with `loggedIn` false, whatever it exited with. */
-const whoamiOf = (printed) => {
-    const text = String(printed ?? '');
-    return record(JSON.parse(text.slice(text.indexOf('{'), text.lastIndexOf('}') + 1)));
-};
-/** `wrangler whoami --json`: whether wrangler is signed in. */
-export async function wranglerStatus(npx) {
+/** cf, Cloudflare's CLI, at the version this command is built against, run through npx, which installs it on first use. */
+export const CF_PACKAGE = 'cf@1.0.0-beta.8';
+/**
+ * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
+ * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
+ * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
+ * command names its project or its account, so none needs the checkout.
+ */
+export function cfRunner(opts = {}, runner = commandRunner) {
+    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', CF_PACKAGE, ...args]);
+}
+/** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
+export function cfFailure(err) {
+    const said = String(err.stderr ?? '').replace(/\x1b\[[0-9;]*m/g, '');
+    const status = /^│?\s*([1-5]\d\d)(?: [A-Z][A-Za-z ]*)?(?: · HTTP \S*)?\s*$/m.exec(said)?.[1];
+    return status ? Number(status) : null;
+}
+/** `cf auth whoami`, which prints JSON signed in or out: whether it is signed in with a token that works, its scopes and its accounts. */
+export async function cfStatus(cf, signal) {
     let status;
     try {
-        status = whoamiOf(await npx(['--yes', 'wrangler', 'whoami', '--json']));
+        const printed = await cf(['auth', 'whoami'], { signal });
+        status = record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
     }
     catch (err) {
-        if (err.missing)
-            return 'missing';
-        try {
-            status = whoamiOf(err.stdout);
-        }
-        catch {
-            return 'unknown';
-        }
+        return { cli: err.missing ? 'missing' : 'unknown', accounts: [] };
     }
-    return status?.loggedIn === true ? 'signed-in' : status?.loggedIn === false ? 'signed-out' : 'unknown';
+    // A stored sign-in that neither the user's record nor the accounts answer is one to sign in again.
+    if (status?.authenticated === false || (status?.authenticated === true && status.tokenValid === false))
+        return { cli: 'signed-out', accounts: [] };
+    if (status?.authenticated !== true)
+        return { cli: 'unknown', accounts: [] };
+    const scopes = Array.isArray(status.scopes) ? status.scopes.filter((s) => typeof s === 'string') : undefined;
+    const accounts = list(status.accounts).map((a) => a.id).filter((id) => typeof id === 'string' && /^[0-9a-f]{32}$/.test(id));
+    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts };
 }
+/** What a Pages deployment's latest stage says of its build: success once it deployed, and building until a stage failed or it was cancelled or skipped. */
+const stageState = (stage) => stage?.status === 'failure' ? 'failure' : stage?.status === 'canceled' || stage?.status === 'skipped' ? 'canceled' : stage?.status === 'success' && stage.name === 'deploy' ? 'success' : 'building';
+/** A page of cf's list of deployments, and how many it reads of each account at most: the newest pull requests' builds come first. */
+const PER_PAGE = 25;
+const PAGES = 4;
 /**
- * What wrangler lists of the project's preview deployments when it is signed in: `pages deployment list --json` prints
- * one row a deployment, with the branch, the commit's first seven characters, the address and the status (a date once
- * the build succeeded, else the stage's word).
+ * What cf lists of the project's preview deployments when it is signed in with Pages access: `pages deployments list`
+ * prints them as Cloudflare's API has them, each with its address, the branch's alias, the branch and commit it built,
+ * its latest stage and the repository it was built from. Each account the sign-in reaches is read, since another may hold
+ * a project of the same name, a page at a time, until the list ends or every head has its build; a deployment Cloudflare
+ * built from another repository is not this one's.
  */
-async function fromWrangler(project, npx) {
-    const cli = await wranglerStatus(npx);
-    if (cli !== 'signed-in' || !project)
+async function fromCf(project, cf, repository, signal) {
+    const { cli, scopes, accounts } = await cfStatus(cf, signal);
+    const pages = !scopes || scopes.includes('pages:read') || scopes.includes('pages:write');
+    if (cli !== 'signed-in' || !project || !pages)
         return { cli, rows: [], failed: cli === 'unknown' };
-    try {
-        const printed = await npx(['--yes', 'wrangler', 'pages', 'deployment', 'list', '--project-name', project, '--environment', 'preview', '--json']);
-        const rows = list(JSON.parse(printed.slice(printed.indexOf('['), printed.lastIndexOf(']') + 1))).flatMap((row, at) => {
-            const url = typeof row.Deployment === 'string' && PAGES_ADDRESS.test(row.Deployment) ? row.Deployment : undefined;
-            if (!url || !/^preview$/i.test(String(row.Environment)))
-                return [];
-            const status = String(row.Status ?? '');
-            const state = /^(idle|active|queued|building)$/i.test(status) ? 'building' : /^fail/i.test(status) ? 'failure' : /^cancel/i.test(status) ? 'canceled' : 'success';
-            const commit = typeof row.Source === 'string' && /^[0-9a-f]{7,40}$/.test(row.Source) ? row.Source : undefined;
-            return [{ ...(branchOf(row.Branch) ? { branch: row.Branch } : {}), ...(commit ? { sha: commit } : {}), url, state, from: 'wrangler', at: -at }];
-        });
-        return { cli, rows, failed: false };
-    }
-    catch {
-        return { cli, rows: [], failed: true };
+    const same = (value, name) => typeof value === 'string' && value.toLowerCase() === name.toLowerCase();
+    const ours = (d) => {
+        const source = record(record(d.source)?.config);
+        return !source || (same(source.owner, repository.owner) && same(source.repo_name, repository.repo));
+    };
+    const rows = [];
+    const built = () => repository.heads.every((sha) => rows.some((row) => row.sha && sha.startsWith(row.sha)));
+    let failed = false;
+    for (const account of accounts.length ? accounts : [undefined]) {
+        if (rows.length && built())
+            break;
+        for (let page = 1; page <= PAGES; page++) {
+            let listed;
+            try {
+                const printed = await cf(['pages', 'deployments', 'list', '--project-name', project, '--env', 'preview', '--page', String(page), '--per-page', String(PER_PAGE)], { account, signal });
+                listed = list(JSON.parse(printed.slice(printed.indexOf('['), printed.lastIndexOf(']') + 1)));
+            }
+            catch (err) {
+                // An account with no such project answers 404; one that could not be read leaves the others' builds standing.
+                failed ||= cfFailure(err) !== 404;
+                break;
+            }
+            for (const d of listed.filter(ours)) {
+                const url = typeof d.url === 'string' && PAGES_ADDRESS.test(d.url) ? d.url : undefined;
+                if (!url || d.environment !== 'preview')
+                    continue;
+                const trigger = record(record(d.deployment_trigger)?.metadata);
+                const alias = (Array.isArray(d.aliases) ? d.aliases : []).find((a) => typeof a === 'string' && PAGES_ADDRESS.test(a));
+                const commit = typeof trigger?.commit_hash === 'string' && /^[0-9a-f]{7,40}$/.test(trigger.commit_hash) ? trigger.commit_hash : undefined;
+                rows.push({ ...(branchOf(trigger?.branch) ? { branch: trigger.branch } : {}), ...(commit ? { sha: commit } : {}), url, ...(alias ? { alias } : {}), state: stageState(record(d.latest_stage)), from: 'cf', at: -rows.length });
+            }
+            if (listed.length < PER_PAGE || built())
+                break;
+        }
     }
+    return { cli, rows, failed };
 }
 /**
- * Whether this repository's pull requests get Cloudflare Pages previews: the newest, as GitHub and wrangler have them;
+ * Whether this repository's pull requests get Cloudflare Pages previews: the newest, as GitHub and cf have them;
  * with `pull`, that pull request's only; with `branch`, the pushed branch's head's only, before its pull request exists.
  */
 export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
@@ -214,11 +256,11 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         return unread();
     const github = await fromGitHub(owner, repo, deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal }), deps.pull, deps.branch);
     const project = github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (await configuredProject(cwd));
-    // wrangler installs itself through npx on a machine without it, which takes a while the first time.
-    const wrangler = await fromWrangler(project, deps.npx ?? commandRunner('npx', cwd, { signal: deps.signal, timeoutMs: 120_000 }));
+    // cf installs itself through npx on a machine without it, which takes a while the first time.
+    const cf = await fromCf(project, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha) }, deps.signal);
     // A row is the head's when its commit is the head's; the pull request's heads say which. A wait for a pushed branch takes its head's rows alone.
     const head = (row) => github.heads.find((h) => row.sha && h.sha.startsWith(row.sha) && (deps.branch === undefined || h.branch === deps.branch));
-    const rows = wrangler.rows.flatMap((row) => {
+    const rows = cf.rows.flatMap((row) => {
         const of = head(row);
         if (deps.branch !== undefined && !of)
             return [];
@@ -226,8 +268,8 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
             return [];
         return [of ? { ...row, ...(of.number ? { pullRequest: of.number } : {}), branch: of.branch ?? row.branch, sha: of.sha, at: of.at } : row];
     });
-    // Of the same build, the check run outranks wrangler's row, and both the app's comment; each address once.
-    const rank = (p) => (p.from === 'check run' ? 0 : p.from === 'wrangler' ? 1 : 2);
+    // Of the same build, the check run outranks cf's row, and both the app's comment; each address once.
+    const rank = (p) => (p.from === 'check run' ? 0 : p.from === 'cf' ? 1 : 2);
     const previews = [];
     for (const p of [...github.previews, ...rows].sort((a, b) => rank(a) - rank(b))) {
         const twin = previews.find((q) => q.url === p.url && (q.pullRequest ?? q.branch) === (p.pullRequest ?? p.branch));
@@ -236,14 +278,14 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         else if (!twin.alias && p.alias)
             twin.alias = p.alias;
     }
-    // The most recently updated pull request's first; a branch with no pull request among them last, as wrangler lists it.
+    // The most recently updated pull request's first; a branch with no pull request among them last, as cf lists it.
     previews.sort((a, b) => (b.pullRequest ? 1 : 0) - (a.pullRequest ? 1 : 0) || b.at - a.at);
     return {
         ...(project ? { project } : {}),
         previews: previews.slice(0, deps.branch !== undefined ? previews.length : NEWEST).map(({ at, ...preview }) => preview),
-        cli: wrangler.cli,
-        ...(github.failed || wrangler.failed
-            ? { error: "Some of Cloudflare's previews could not be read: what is missing is unknown, not absent.", unread: [...(github.failed ? ['GitHub'] : []), ...(wrangler.failed ? ['wrangler'] : [])] }
+        cli: cf.cli,
+        ...(github.failed || cf.failed
+            ? { error: "Some of Cloudflare's previews could not be read: what is missing is unknown, not absent.", unread: [...(github.failed ? ['GitHub'] : []), ...(cf.failed ? ['cf'] : [])] }
             : {}),
     };
 }

package/dist/fence.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { readFileSync, realpathSync, statSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { gitEnvironment } from './sandbox.js';
 import { DATA_NOTE, scan, scanRecorder } from './scan.js';
 const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
 const deny = (reason) => ({ verdict: 'deny', reason });
@@ -329,7 +330,7 @@ function scriptsIn(dir) {
  * package.json and the files the scripts and listed tools load from the checkout by convention (`*.config.js`, `.*rc`): once the agent
  * changes one, what runs is no longer the repository's own code.
  */
-/** The ci-tunnel case corrects Vite's preview.allowedHosts and proves it with the local preview check, which runs in its own copy and environment: after that edit only the shell stops. */
+/** A rerun on Impeccable's tunnel (first-preview-failure) corrects Vite's preview.allowedHosts and proves it with the local preview check, which runs in its own copy and environment: after that edit only the shell stops. */
 const VITE_CONFIG = /(?:^|\/)vite\.config\.[cm]?[jt]s$/i;
 const LOADED = /(?:^|\/)(?:package\.json|[\w.-]+\.config\.[cm]?[jt]s|\.[\w-]+rc(?:\.\w+)*|tsconfig[^/]*\.json|knexfile\.[^/]+|bunfig\.toml|prisma\/seed\.[^/]+|node_modules\/.+)$/i;
 /** Why scripts and tools stop running: the agent changed a package.json (true when it does not say which), or a file named here that they load. */
@@ -354,6 +355,8 @@ function tool(args, where, scriptsChanged = false) {
     // A version or a tag may follow the name; an alias such as next@npm:other is another package, so it stays on.
     const name = (args[i] ?? '').replace(/@[\w.^~<>=*+-]+$/, '');
     const rest = args.slice(i + 1);
+    if (name === 'cf')
+        return cloudflareCli(rest);
     if (!TOOLS.has(name))
         return deny(`${name || 'that'} is not on the tool list`);
     if (name === 'playwright' && (rest[0] === 'install-deps' || rest.includes('--with-deps')))
@@ -364,6 +367,15 @@ function tool(args, where, scriptsChanged = false) {
         return deny(changedReason(scriptsChanged));
     return inside(rest, where) ? allow() : deny('a path outside the checkout');
 }
+/**
+ * cf, Cloudflare's CLI: the tools run it in the command's own process, as the person (its sign-in, the preview
+ * deployments, and the service token, whose secret it prints), so none of it runs here, and a delete never does.
+ */
+function cloudflareCli(args) {
+    if (args.some((a) => a === 'delete' || a === 'disconnect'))
+        return never('deletes on Cloudflare');
+    return deny("cf runs in the tools, as the person: impeccable_cloudflare_previews reads Cloudflare's previews, and impeccable_cloudflare_access signs in and makes the service token");
+}
 /** A package manager's install, script or version; with `tools`, also a tool from the list through pnpm exec or yarn. */
 function packageManager(pm, args, where, scriptsChanged, tools = true) {
     const [sub = '', ...rest] = args;
@@ -417,6 +429,25 @@ function reader(cmd, args, where) {
 }
 /** A host's CLI package, by host: the one global install that runs, and only once the person said yes to setting that host up. */
 const HOST_CLIS = { netlify: 'netlify-cli', vercel: 'vercel' };
+/** git commit and push, gh and the host CLIs: what uses the person's GitHub, Vercel, Netlify or Cloudflare sign-in, keys or keychain. */
+function asPerson(words) {
+    const [cmd = '', ...args] = words;
+    if (cmd === 'git')
+        return ['commit', 'push'].includes((args[0] === '--no-pager' ? args[1] : args[0]) ?? '');
+    return cmd === 'gh' || cmd === 'vercel' || cmd === 'netlify' || cmd === 'cf';
+}
+/** Where the command runs; null when it joins what runs as the person to what runs in the sandbox, which the fence refuses. cd and git's other commands, which need no sign-in, run on either side. */
+export function placeOf(command) {
+    const commands = (parseCommand(command) ?? []).map(({ words }) => words.slice(envCount(words)));
+    const installs = commands.filter(([pm = '', ...args]) => PACKAGE_MANAGERS.has(pm) && installsHostCli(pm, args, new Set(Object.keys(HOST_CLIS)))).length;
+    if (installs)
+        return installs === commands.length ? 'install' : null;
+    const person = commands.filter(asPerson).length;
+    if (!person)
+        return 'sandbox';
+    const either = commands.filter((words) => !asPerson(words) && (words[0] === 'cd' || words[0] === 'git')).length;
+    return person + either === commands.length ? 'person' : null;
+}
 /** Whether this is a global install of a host's CLI and nothing else, the person having said yes to setting that host up. */
 function installsHostCli(pm, args, hosts) {
     const rest = args.filter((a) => !['-g', '--global', '--location=global'].includes(a));
@@ -427,14 +458,13 @@ function installsHostCli(pm, args, hosts) {
     return global && (verbs[pm] ?? []).includes(verb) && !more.length && Object.entries(HOST_CLIS).some(([host, pkg]) => pkg === cli && hosts.has(host));
 }
 /** The Netlify CLI's options that take a value, of those the rules below allow, so the value is not read as a command. */
-const NETLIFY_VALUES = new Set(['--name', '--context', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
-/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, the one deploy context, a team's slug. */
+const NETLIFY_VALUES = new Set(['--name', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
+/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, a team's slug. */
 const NETLIFY_VALID = {
     '--name': /^[A-Za-z0-9-]{1,63}$/,
     '--id': /^[0-9a-f-]{8,64}$/i,
     '--git-remote-url': /^(?:https:\/\/github\.com\/)?[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}?(?:\.git)?$/,
     '--git-remote-name': /^[A-Za-z0-9._-]{1,50}$/,
-    '--context': /^deploy-preview$/,
     '--account-slug': /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/,
 };
 /** The Vercel project the folder is linked to, as `vercel link` wrote it in `.vercel/project.json`; null with none. */
@@ -447,25 +477,15 @@ function linkedVercelProject(dir) {
         return null;
     }
 }
-/** Whether the folder is linked to a Netlify site: `.netlify/state.json` names it. */
-function linkedToSite(dir) {
-    try {
-        return typeof JSON.parse(readFileSync(join(dir, '.netlify', 'state.json'), 'utf8')).siteId === 'string';
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * The Netlify CLI: `--version` and `status` at any time; once the person signed in to Netlify for the setup, the
- * project's link and creation, in the person's own current team or the one team they chose (`team`), and a built draft
- * deploy for a deploy preview of a linked folder. The sign-in and the repository's connection are the tools' (a
- * `netlify login` outside the sign-in screen, and a `netlify init` that asks its questions in a terminal, never run).
- * Never production or a project's removal, and nothing of its environment variables, its API (which reaches them, and
- * prints a site's password: impeccable_netlify_password runs it in the command's own process) or a token on the
- * command line.
+ * project's link and creation, in the person's own current team or the one team they chose (`team`). The sign-in and
+ * the repository's connection are the tools' (a `netlify login` outside the sign-in screen, and a `netlify init` that
+ * asks its questions in a terminal, never run). Never a deploy, which builds the repository with the Netlify sign-in,
+ * production or a project's removal, and nothing of its environment variables, its API (which reaches them, and prints
+ * a site's password: impeccable_netlify_password runs it in the command's own process) or a token on the command line.
  */
-function netlify(args, where, agreed, team) {
+function netlify(args, agreed, team) {
     const words = [];
     const options = new Map();
     for (let i = 0; i < args.length; i++) {
@@ -509,10 +529,8 @@ function netlify(args, where, agreed, team) {
         case 'sites:create':
             return !rest.length && only('--name', '--json', '--account-slug') ? allow() : deny('a netlify sites:create off the allowlist');
         case 'deploy':
-            if (rest.length || !options.has('--build') || !options.has('--context') || !only('--build', '--context', '--json'))
-                return deny('a netlify deploy other than a built draft for the deploy-preview context');
-            // Where no site is linked the CLI creates one with a random name, which is not what the person said yes to.
-            return linkedToSite(where.cwd) ? allow() : deny('a netlify deploy in a folder linked to no site');
+            // The build runs in the sandbox and the Netlify CLI outside it, as the person: never both at once.
+            return deny("netlify deploy builds the repository with the person's Netlify sign-in, and the two never run together");
         default:
             return deny(sub.startsWith('env') ? "Netlify's environment variables are the person's" : `netlify ${sub || 'without a command'} is not on the allowlist`);
     }
@@ -521,16 +539,8 @@ function netlify(args, where, agreed, team) {
 const VERCEL_VALUES = new Set(['--cwd', '--target', '--scope', '-S', '--team']);
 /** The options that name a team: the CLI never picks one without a terminal, so the run names the one the person chose. */
 const VERCEL_TEAM = ['--scope', '-S', '--team'];
-/**
- * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
- * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
- * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
- * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
- * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
- * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
- * line.
- */
-function vercel(args, where, agreed, team, settlement = null) {
+/** The Vercel CLI's arguments as its words, the subcommand first, and its options, each with the value it takes. */
+function vercelArgs(args) {
     const words = [];
     const options = new Map();
     for (let i = 0; i < args.length; i++) {
@@ -545,6 +555,19 @@ function vercel(args, where, agreed, team, settlement = null) {
         const value = at > 0 ? arg.slice(at + 1) : VERCEL_VALUES.has(name) && args[i + 1] !== undefined && !args[i + 1].startsWith('-') ? args[++i] : true;
         options.set(name, value);
     }
+    return { words, options };
+}
+/**
+ * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
+ * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
+ * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
+ * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
+ * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
+ * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
+ * line.
+ */
+function vercel(args, where, agreed, team, settlement = null) {
+    const { words, options } = vercelArgs(args);
     const [sub = '', ...rest] = words;
     if ([...options.keys()].some((name) => name === '--token' || /^-t/.test(name)))
         return deny('puts a Vercel token on the command line');
@@ -662,9 +685,11 @@ function simpleCommand(seg, where, opts) {
         case 'find':
             return reader(cmd, args, where);
         case 'netlify':
-            return netlify(args, where, opts.hosts.has('netlify'), opts.teams.get('netlify'));
+            return netlify(args, opts.hosts.has('netlify'), opts.teams.get('netlify'));
         case 'vercel':
             return vercel(args, where, opts.hosts.has('vercel'), opts.teams.get('vercel'), opts.vercelSettled);
+        case 'cf':
+            return cloudflareCli(args);
         default:
             if (PACKAGE_MANAGERS.has(cmd) && installsHostCli(cmd, args, opts.hosts))
                 return allow('installs the CLI of the host the person said yes to');
@@ -692,7 +717,7 @@ function readable(path, where) {
 function commitMessages(revisions, cwd) {
     try {
         // The closing -- reads each as a commit even where a file of the same name is there.
-        return execFileSync('git', ['log', '--format=%B', ...revisions, '--'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000, maxBuffer: 16 * 1024 * 1024 });
+        return execFileSync('git', ['log', '--format=%B', ...revisions, '--'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000, maxBuffer: 16 * 1024 * 1024, env: gitEnvironment() });
     }
     catch {
         return null;
@@ -778,6 +803,9 @@ export function classifyCommand(command, root, options = {}) {
         if (seg.words[0] === 'cd' && decision.verdict === 'allow')
             where.cwd = resolve(where.cwd, seg.words[1]);
     }
+    if (result.verdict === 'allow' && placeOf(command) === null) {
+        return deny("joins git commit or push, gh, vercel, netlify or a host CLI's install, which run outside the sandbox as the person, to what runs in it: run them as separate commands");
+    }
     return result;
 }
 /**
@@ -871,14 +899,16 @@ export function classifyPreviewCommand(command, root, options = {}) {
     }
     return allow('inside the disposable preview verifier');
 }
-/** The fence's answer for pi's file tools: writes stay in the checkout and out of .git; reads stay in it or in the run's scratch folder, and off .env files. */
+/** The fence's answer for pi's file tools: writes stay in the checkout and out of every .git, the checkout's and any other a file could make; reads stay in it or in the run's scratch folder, and off .env files. */
 export function classifyFileTool(tool, path, root, scratch) {
     const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
     const p = typeof path === 'string' && path ? path : '.';
     if (tool === 'write' || tool === 'edit') {
         if (outside(p, where))
             return never('writes outside the checkout');
-        return within(realPath(resolve(root, p)), join(where.root, '.git')) ? never('writes into .git, where hooks run') : allow();
+        // A .git file or folder below the top would be where git takes its settings and hooks from there.
+        const inGit = [p, relative(where.root, realPath(resolve(root, p)))].some((q) => q.split(/[\\/]/).includes('.git'));
+        return inGit ? never('writes into .git, where hooks run') : allow();
     }
     if (outside(p, where) && !inScratch(p, where))
         return deny('reads outside the checkout');
@@ -1087,7 +1117,7 @@ export function observePreviewAttempts(state, runs, historyComplete) {
 }
 /** The hosts the person said yes to setting up in this run, by the run's log. */
 const agreedHosts = new WeakMap();
-function hostsAgreed(log) {
+export function hostsAgreed(log) {
     let hosts = agreedHosts.get(log);
     if (!hosts)
         agreedHosts.set(log, (hosts = new Set()));
@@ -1103,6 +1133,42 @@ export function agreeToHostSetup(log, questionId) {
 export function hostSetupAgreed(log, host) {
     return hostsAgreed(log).has(host);
 }
+/** The runs whose `vercel link` left its folder linked to a project: that project may build the next push, so its hold stands until it is settled, whatever ends the setup. */
+const linkedVercel = new WeakSet();
+/**
+ * The host's setup ended before any project of this run's could build a push: the sign-in skipped or not completed, the
+ * team skipped, or the link failed. Its CLI stops and the hold on pushes goes, as though the host was never offered; a
+ * Vercel project linked in this run keeps its hold until it is settled.
+ */
+export function endHostSetup(log, host) {
+    if (host !== 'vercel' || !linkedVercel.has(log))
+        hostsAgreed(log).delete(host);
+}
+/**
+ * What the `vercel link`s of a command that ran left, each in the folder it ran in (the one `--cwd` names, else the
+ * shell's, after its `cd`), whatever the command's exit: a folder linked to a project keeps the hold; links that left
+ * their folders linked to none failed, and end the Vercel setup.
+ */
+function noteVercelLinks(log, root, command) {
+    let cwd = root;
+    const folders = [];
+    for (const { words } of parseCommand(command) ?? []) {
+        if (words[0] === 'cd')
+            cwd = resolve(cwd, words[1] ?? '.');
+        if (words[0] !== 'vercel')
+            continue;
+        const { words: [sub], options } = vercelArgs(words.slice(1));
+        const folder = options.get('--cwd');
+        if (sub === 'link')
+            folders.push(resolve(cwd, typeof folder === 'string' ? folder : '.'));
+    }
+    if (!folders.length)
+        return;
+    if (folders.some((folder) => linkedVercelProject(folder) !== null))
+        linkedVercel.add(log);
+    else
+        endHostSetup(log, 'vercel');
+}
 /** The team the person picked for each host's CLI in this run, by the run's log. */
 const chosenTeams = new WeakMap();
 function teamsChosen(log) {
@@ -1254,6 +1320,8 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
             if (!['read', 'grep', 'bash'].includes(event.toolName))
                 return undefined;
             const input = event.input;
+            if (event.toolName === 'bash')
+                noteVercelLinks(log, root, String(input.command ?? ''));
             const sources = event.toolName === 'bash' ? (parseCommand(String(input.command ?? ''))?.flatMap((seg) => seg.words) ?? []) : [input.path, input.glob].filter((s) => typeof s === 'string');
             const hits = scan('input', event.content.map((c) => (c.type === 'text' ? c.text : '')).join('\n'), sources);
             if (!hits.length)

package/dist/host-questions.js

@@ -81,22 +81,23 @@ export const HOST_SCREENS = {
         prompt: `Netlify keeps your previews behind the site password, and the run could not read it: the Netlify CLI here is signed out, the site is in none of your teams, or Netlify does not give the password back. Find it, or set a new one, in ${NETLIFY_PASSWORD_WHERE}. It is stored encrypted and used only to open previews.`,
         hint: 'Paste the password',
     },
-    // Cloudflare Access in front of the previews: the one consent to a service token the run creates as the person, the API token that takes (wrangler's sign-in cannot reach Access), and the paste where the run does not create one.
+    // Cloudflare Access in front of the previews: the one consent to a service token the run creates as the person through cf, the retry of cf's sign-in, the API token where that sign-in cannot create it, and the paste where the run does not create one.
     'cloudflare-access': {
         id: 'cloudflare-access',
         kind: 'confirm',
         title: 'Your Cloudflare previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login. Cloudflare\'s way in for tools is a service token made for one tool: the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login. Cloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
         prompt: 'Create the token for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
     },
+    'cloudflare-signin-retry': { id: 'cloudflare-signin-retry', kind: 'confirm', title: 'Sign in to Cloudflare', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
     'cloudflare-access-api': {
         id: 'cloudflare-access-api',
         kind: 'text',
         sensitive: true,
         title: 'One Cloudflare API token',
-        prompt: 'Creating the token takes a Cloudflare API token, used for this run only and stored nowhere. Make one at dash.cloudflare.com/profile/api-tokens → Create Token → Create Custom Token, with two permissions: Access: Apps and Policies → Edit, and Access: Service Tokens → Edit.',
+        prompt: 'The Cloudflare CLI here could not create the token, so creating it takes a Cloudflare API token, used for this run only and stored nowhere. Make one at dash.cloudflare.com/profile/api-tokens → Create Token → Create Custom Token, with two permissions: Access: Apps and Policies → Edit, and Access: Service Tokens → Edit.',
         hint: 'Paste the API token',
     },
     'cloudflare-access-key': {

package/dist/hosted.js

@@ -2,6 +2,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { ACCESS_ID_HEADER, ACCESS_SECRET_HEADER } from './cloudflare-access.js';
 import { basicCredentials } from './netlify-password.js';
+import { gitEnvironment } from './sandbox.js';
 import { BYPASS_HEADER } from './vercel-bypass.js';
 /**
  * Previews a host already deploys: what GitHub has on record of the
@@ -124,15 +125,33 @@ function plain(text) {
 /** Whether a file the checkout tracks holds the words; .env files are never read. */
 async function inCheckout(root, words) {
     try {
-        await execFileAsync('git', ['grep', '--quiet', '--fixed-strings', '--ignore-case', '-e', words, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000 });
+        await execFileAsync('git', ['grep', '--quiet', '--fixed-strings', '--ignore-case', '-e', words, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
         return true;
     }
     catch {
         return false;
     }
 }
+/** What a visitor never sees of a page: comments, scripts, styles and templates. */
+const UNSEEN = /<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 /** The words a visitor sees: the title and the text, without comments, scripts, styles, tags or attributes. */
-const visible = (html) => plain(html.replace(/<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ').replace(/<[^>]*>/g, ' '));
+const visible = (html) => plain(html.replace(UNSEEN, ' ').replace(/<[^>]*>/g, ' '));
+/**
+ * Netlify's own lock, never the status alone, as Netlify documents it: the basic challenge (`WWW-Authenticate: Basic`)
+ * its Basic-Auth rules send, which "trigger the built-in basic browser authentication"
+ * (https://docs.netlify.com/manage/security/secure-access-to-sites/basic-authentication-with-custom-http-headers/); the
+ * "generic password prompt" of its Password Protection, where a visitor enters a shared password and nothing else
+ * (https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/); or the "Netlify-branded page"
+ * its team login shows a visitor (https://docs.netlify.com/manage/security/secure-access-to-sites/project-visibility/),
+ * whose title names Netlify other than in the site's own address: a mention in an app's own page, such as a footer, is
+ * not one.
+ */
+function netlifyLock(challenge, html) {
+    const seen = html.replace(UNSEEN, ' ');
+    const fields = [...seen.matchAll(/<input\b[^>]*>/gi)].map(([tag]) => /\stype\s*=\s*["']?([\w-]+)/i.exec(tag)?.[1]?.toLowerCase() ?? 'text').filter((type) => !['hidden', 'submit', 'button', 'reset', 'image'].includes(type));
+    const title = plain(/<title\b[^>]*>([\s\S]*?)<\/title\s*>/i.exec(seen)?.[1] ?? '');
+    return /^basic\b/i.test(challenge ?? '') || (/<form\b/i.test(seen) && fields.join() === 'password') || /\bnetlify\b/.test(title.replace(/\S*\.netlify\.app\S*/g, ' '));
+}
 /** The first `max` bytes of a page, as text. */
 async function pageText(res, max = 1_000_000) {
     const reader = res.body?.getReader();
@@ -181,8 +200,10 @@ async function formOpens(target, password, phrase, open, signal) {
  * `words` that a file of the checkout at `root` holds, so the page is this app's and not another site's. With `bypass`, a
  * Vercel bypass secret, a Vercel address is opened with it in the header Vercel reads it from, as reviews do; with
  * `password`, a Netlify site password, a Netlify address is opened with it as basic credentials in the Authorization
- * header, the one way reviews can send it; with `access`, a Cloudflare Access service token, a Pages address is opened
- * with it in the two headers Access reads it from. None goes to another host.
+ * header, the one way reviews can send it, and with `form` posted to Netlify's form too where the header did not get past
+ * the lock (only for a site whose settings show a password: an app's own password form looks the same); with `access`, a
+ * Cloudflare Access service token, a Pages address is opened with it in the two headers Access reads it from. None goes
+ * to another host.
  */
 export async function provePreview(url, words, root, deps = {}) {
     const unproven = (reason, status = null) => ({ proven: false, status, reason });
@@ -206,7 +227,7 @@ export async function provePreview(url, words, root, deps = {}) {
         ...(withPassword ? { authorization: basicCredentials(deps.password) } : {}),
         ...(withToken ? { [ACCESS_ID_HEADER]: deps.access.id, [ACCESS_SECRET_HEADER]: deps.access.secret } : {}),
     };
-    // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it, or, on Netlify, the app's own sign-in answered past the lock: the address alone cannot say which.
+    // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it.
     const still = opened ? ' even with the bypass secret' : withPassword ? ' even with the password' : withToken ? ' even with the service token' : '';
     let target = new URL(url);
     try {
@@ -225,14 +246,14 @@ export async function provePreview(url, words, root, deps = {}) {
             }
             if (res.status === 401 || (host !== 'vercel' && res.status === 403)) {
                 // Vercel's own page names Vercel; any other 401 there is the app's own sign-in, which a page a visitor opens without signing in gets past.
-                // A password or a login in front of a Netlify preview answers 401 or 403 on every page of it, and its page names nothing to go by.
+                // Netlify's lock shows itself; the app's own 401 or 403 does not, so it gets no site password.
                 // Cloudflare Access names itself on the 401 or 403 it answers a request it will not let in (a service token it does not admit), where a browser gets its login.
                 const page = await pageText(res, 64_000);
-                const named = host === 'netlify' || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
+                const named = (host === 'netlify' && netlifyLock(res.headers.get('www-authenticate'), page)) || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
                 if (!named)
                     return unproven(res.status === 401 ? "The address asked for the app's own sign-in: try a page a visitor opens without signing in." : `The address answered ${res.status}.`, res.status);
                 // A password the header did not get past: Netlify's own form says whether it is the site's password at all.
-                if (withPassword && (await formOpens(target, deps.password, phrase, open, signal))) {
+                if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
                     return { ...unproven("The password opens the address on Netlify's own form, but not in the Authorization header, the one way reviews can send it.", res.status), gate, formOpened: true };
                 }
                 return { ...unproven(`The address asked for ${name}'s login or password${still}.`, res.status), gate };