@impeccable/reviews 0.1.10 → 0.1.11

package/README.md

@@ -52,7 +52,7 @@ The sign-in's setup token lasts an hour. A run that goes longer asks you to sign
 
 The agent's commands run in an operating-system sandbox, macOS's seatbelt or Linux's bubblewrap, through Anthropic's sandbox runtime (`@anthropic-ai/sandbox-runtime`), which holds even when the repository talks the agent into something:
 
-- **Reads**: what your account reads, but your credential folders: `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.azure`, `~/.config/gcloud`, `~/.kube`, `~/.docker`, `~/.netrc`, `~/.git-credentials`, `~/.config/gh`, and your keychains on macOS; the Vercel, Netlify and Cloudflare CLIs' sign-ins (`~/Library/Application Support/com.vercel.cli`, `~/Library/Preferences/netlify` and `~/Library/Preferences/.wrangler` on macOS, `~/.local/share/com.vercel.cli`, `~/.config/netlify` and `~/.config/.wrangler` elsewhere, and `~/.vercel`, `~/.netlify` and `~/.wrangler`); the registries' and build tools' tokens (`~/.yarnrc.yml`, `~/.pypirc`, `~/.cargo/credentials`, `~/.gem/credentials`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`, `~/.terraform.d`); Codex's and Claude's (`~/.codex`, `~/.claude`); your git's global settings (`~/.gitconfig`, `~/.config/git/config` and every file they include, whether the include holds for this checkout or not) and `~/.config/git/credentials`; your shells' rc files (`~/.bashrc`, `~/.bash_profile`, `~/.profile`, `~/.zshenv`, `~/.zshrc`, `~/.zprofile` and the rest, and fish's `~/.config/fish`) and their histories; and your browsers' profiles (Chrome's, Chromium's, Brave's, Edge's and Firefox's, and `~/Library/Cookies` on macOS). Where your environment moves one of these, the sandbox denies the place it names instead: the folder `GH_CONFIG_DIR`, `VERCEL_AUTH_CONFIG_DIR`, `GNUPGHOME`, `DOCKER_CONFIG`, `CLOUDSDK_CONFIG`, `AZURE_CONFIG_DIR`, `CODEX_HOME` or `CLAUDE_CONFIG_DIR` names, the files `KUBECONFIG`, `GIT_CONFIG_GLOBAL` and `HISTFILE` name, cargo's credentials under `CARGO_HOME`, zsh's rc files under `ZDOTDIR`, and the same entries under `XDG_CONFIG_HOME` and `XDG_DATA_HOME` as under `~/.config` and `~/.local/share`; the variables themselves stay, since `gh`, the host CLIs and the package managers read them. Git in the sandbox reads a copy of your global settings instead of the file: your name and email, what shapes how git reads the checkout (line endings, case, excludes, attributes, LFS's content filter) and `safe.directory`, and none of http's headers, proxy, cookies and certificates, url rewrites, credential helpers, includes, aliases or programs; another content filter's command is left out, since it could carry a password, and when that filter is required, git in the sandbox refuses the file it would have changed rather than stage it unfiltered. Your `~/.npmrc` stays readable: the sandbox's hosts come from the registries it names, and npm needs its token to install from them.
+- **Reads**: what your account reads, but your credential folders: `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.azure`, `~/.config/gcloud`, `~/.kube`, `~/.docker`, `~/.netrc`, `~/.git-credentials`, `~/.config/gh`, and your keychains on macOS; the Vercel, Netlify and Cloudflare CLIs' sign-ins (`~/Library/Application Support/com.vercel.cli`, `~/Library/Preferences/netlify` and `~/Library/Preferences/.wrangler` on macOS, `~/.local/share/com.vercel.cli`, `~/.config/netlify` and `~/.config/.wrangler` elsewhere, and `~/.vercel`, `~/.netlify` and `~/.wrangler`); the registries' and build tools' tokens (`~/.yarnrc.yml`, `~/.pypirc`, `~/.cargo/credentials`, `~/.gem/credentials`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`, `~/.terraform.d`); Codex's and Claude's (`~/.codex`, `~/.claude`); your git's global settings (`~/.gitconfig`, `~/.config/git/config` and every file they include, whether the include holds for this checkout or not) and `~/.config/git/credentials`; your shells' rc files (`~/.bashrc`, `~/.bash_profile`, `~/.profile`, `~/.zshenv`, `~/.zshrc`, `~/.zprofile` and the rest, and fish's `~/.config/fish`) and their histories; and your browsers' profiles (Chrome's, Chromium's, Brave's, Edge's and Firefox's, and `~/Library/Cookies` on macOS). Where your environment moves one of these, the sandbox denies the place it names instead: the folder `GH_CONFIG_DIR`, `VERCEL_AUTH_CONFIG_DIR`, `GNUPGHOME`, `DOCKER_CONFIG`, `CLOUDSDK_CONFIG`, `AZURE_CONFIG_DIR`, `CODEX_HOME` or `CLAUDE_CONFIG_DIR` names, the files `KUBECONFIG`, `GIT_CONFIG_GLOBAL` and `HISTFILE` name, cargo's credentials under `CARGO_HOME`, zsh's rc files under `ZDOTDIR`, and the same entries under `XDG_CONFIG_HOME` and `XDG_DATA_HOME` as under `~/.config` and `~/.local/share`; the variables themselves stay, since `gh`, the host CLIs and the package managers read them. Git in the sandbox reads a copy of your global settings instead of the file: your name and email, what shapes how git reads the checkout (line endings, case, excludes, attributes, LFS's content filter) and `safe.directory`, and none of http's headers, proxy, cookies and certificates, url rewrites, credential helpers, includes, aliases or programs; another content filter's command is left out, since it could carry a password, and when that filter is required, git in the sandbox refuses the file it would have changed rather than stage it unfiltered. Git's system settings are scrubbed into the same copy and otherwise turned off for it (`GIT_CONFIG_NOSYSTEM`): on a Mac, Apple's git carries a config inside Xcode and the Command Line Tools that names the keychain's credential helper, and git in the sandbox is to have no credential helper at all, so that it asks for no sign-in rather than fail in one; the helper programs that config names (`git-credential-osxkeychain`, in Xcode and in the Command Line Tools) are denied too, so a script that puts the variable back cannot run them, and your keychain itself stays denied, to the helper and to `security` alike. Your `~/.npmrc` stays readable: the sandbox's hosts come from the registries it names, and npm needs its token to install from them.
 - **Writes**: the checkout and its git folder, but never where git takes settings or programs from (its config, hooks, `info`, a `commondir`, the submodules' and the other worktrees' git folders, a `.git` below the checkout's top; on Linux a `commondir` and a nested `.git` are removed at the end of the run instead, as the last paragraph of this section says); the run's scratch folder, where npm's cache and Corepack's package managers go for the run; and the package managers' own caches and stores (pnpm's store, Yarn's and Bun's caches, Prisma's engines), but never `~/.npm`, which your own npm and `npx` read from, nor pnpm's metadata cache, whose `dlx` folder your next `pnpm dlx` runs from (pnpm reads it and goes on without writing it), and of pnpm's home folder only its store, never the global commands it keeps on your PATH. Those stores and caches a sandboxed install could not make itself (pnpm's store on a machine where pnpm never ran, all of them on Linux) are made before the run starts, readable by you alone, and in pnpm's home nothing else is. A sandboxed pnpm is told to use that store, yours, so it never makes one of its own in the checkout, and to copy what it installs from it rather than hard-link it, so a write to an installed file changes only that copy. An install skips the browsers Cypress, Puppeteer and Playwright download, and husky's git hooks.
 - **Network**: only the hosts this setup needs: `--host`; GitHub's hosts an install fetches from (`github.com`, `api.github.com`, `codeload.github.com`, `*.githubusercontent.com`); the public registries your manifests and lockfiles install from (npm's, Yarn's, PyPI); the registries your own `~/.npmrc` names, never one only the repository names; Google's fonts for a Next.js app and Prisma's engines, when the app uses them; and Vercel's or Netlify's API once you said yes to setting that host up; never GitHub over SSH (port 22), which is refused with the reason, since what pushes runs outside the sandbox, as you. The debug log names each host it refused. The list limits where a command's traffic goes, not what it carries (a script can still send what it reads to GitHub or npm over HTTPS, which the sandbox's proxy passes through without reading), so what keeps your sign-ins yours is what the sandbox does not let it read.
 
@@ -62,7 +62,7 @@ The command stops when the sandbox does not start: on macOS inside another tool'
 
 The fence stays the layer inside the sandbox: it keeps the setup to its own steps and out of `.env` files, and the agent's commands get your environment without the tokens, keys and passwords in it, whether their names say so or their values are shaped like a secret (a GitHub token, a private key, a service account's key, a password in a URL), and what runs as you (`git commit` and `push`, `gh`, the host CLIs) gets it without `GH_REPO` and `GH_HOST`, so `gh` works on this checkout's repository on github.com, whatever repository or host they name. The agent's own file tools (read, write, edit, grep, find and ls) open files in the command's process, as you, so for them the fence judges the path pi opens, not the string the agent typed: spelled the way pi spells it (a curly apostrophe for a straight one, among others) and with its symlinks followed, and a path that starts with `@` or `~` or a URL scheme, which pi would open elsewhere, is refused outright; read, write, edit, grep and ls judge each file once more as they open it (ls each entry too, so a symlink out of the checkout is not listed), find judges the folder it searches before fd walks it and every path fd reports after, and a symlinked folder out of the checkout is neither followed nor listed; the names of `.env` files are listed, as `ls -a` shows them, and only a read of one is refused; a grep glob that names `.env` files is refused, and no line of a `.env` file is in what grep reports, whatever glob it was given. It also reads what goes past it: text shaped like a secret (a cloud, GitHub, Google or SendGrid key, a private key, a token, a Slack webhook's address, a password in an address or on a curl command line) in a file the agent writes, a setting, a commit, a pull request or a message to you is refused, read as written and as the screen would show it once an escape sequence is taken out, a command that names a credential file (`~/.ssh`, `.aws/credentials`, `.netrc`, `.env`) is refused, and what the agent reads gets a line saying it is data when it carries text shaped like instructions; the debug log and `--scan-report` list each match. A commit message, a template and a pull request body come inline (`-m`, `--body`), never from a file: the file the fence read is not surely the file git or gh, outside the sandbox, read later, since a command still running in the sandbox can swap it in between. For the same reason the messages of the commits a push carries are read again as the push runs, all of them (past what the remote has: its branch of that name, the default branch, and one the pushed branch is stacked on, such as an earlier run's setup branch under a new test drive), and so is every line they add to a `.env` file's example, which a command may have written, with the same check as a file the agent writes; a push whose commits cannot be read whole is refused, as is one whose remote cannot be reached, since what it carries cannot be checked then (the push can be tried again once the network is back; the remote is asked with no prompt for a password or a passphrase, which would hold it), and one in the same command as the `git commit` or `git checkout -b` that makes what it carries, which is not there yet when it is read: the push runs as a command of its own, after the commit. A commit carries only files the agent wrote, or named in a `git add`: a file a script staged on its own is refused by name, and `git restore --staged` takes it out; a push whose new commits carry such a file (a script can commit on its own, past the index) is refused the same way. Once `impeccable_sync_workflow` wrote the preview workflow, or removed the retired one, a commit carries that file only as the tool left it: the setup state's bytes, or no file. A status line the agent starts a message with shows in the terminal and on the web page only when its progress tool would take it: in the product voice, short, and holding nothing shaped like a secret.
 
-Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
+Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `git branch` and `git remote` in their listing forms, `git ls-remote origin` (in the sandbox, over https, and never held on a prompt for a sign-in), `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
 
 `vercel whoami` and `vercel --version`. Once you said yes to the Vercel setup: `vercel link --yes` in the checkout's root alone (never in a folder of it, whose name would pick one of your projects), `vercel project add` and `vercel deploy` for a preview, on the project named after the folder and in the one team the sign-in settled on (the CLI's current scope, your only team, or the one you pick when it asks): no other `--scope`, `--team` or `--project`, never `vercel project ls`, which names your projects, and a global install of the Vercel CLI itself when it is missing, with npm and pinned to the version this release names (`npm install -g vercel@<version>`; another package manager, version or tag is refused). The sign-in (`vercel login`) and the repository's connection (`vercel git connect`, for a project the run created or one connected to the repository already) are the run's own tools, never the agent's commands. Never a production deploy, a project's removal, its environment variables or protection settings (`vercel project protection`, `api` and `curl` print a project's bypass secrets, so the agent's shell never runs them; the lock before a new project's first deployment and the bypass secret are the run's own tools), or a token on the command line.
 

package/dist/fence.js

@@ -6,7 +6,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { createFindToolDefinition, createGrepToolDefinition, detectSupportedImageMimeTypeFromFile } from '@earendil-works/pi-coding-agent';
 import { linkedNetlifySite } from './netlify.js';
 import { resolveReadPath, resolveToCwd } from './pi-paths.js';
-import { gitEnvironment } from './sandbox.js';
+import { gitEnvironment, NO_PROMPT } from './sandbox.js';
 import { DATA_NOTE, scan, scanRecorder } from './scan.js';
 import { plainText } from './ui/sensitive.js';
 const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
@@ -336,6 +336,35 @@ function printsPatch(sub, args) {
     const revisions = options.filter((a) => !a.startsWith('-'));
     return !(sub === 'show' && revisions.length && revisions.every((a) => a.includes(':')));
 }
+/** git branch's listing flags, alone or in a cluster (-avv): -a, -r, -l, -v and -i. */
+const BRANCH_FLAGS = /^-[arlvi]+$/;
+const BRANCH_LONG_FLAGS = new Set(['--all', '--remotes', '--list', '--verbose', '--show-current', '--ignore-case', '--no-color', '--column', '--no-column', '--no-abbrev', '--omit-empty', '--contains', '--no-contains', '--merged', '--no-merged']);
+/** Its options that take a value, with it after `=`: a bare `--contains HEAD` reads HEAD as its value, but a bare `--format %(refname)` would make a branch named %(refname). */
+const BRANCH_VALUES = /^--(?:contains|no-contains|merged|no-merged|points-at|sort|format|color|abbrev)=/;
+/** Whether `git branch` with these words only lists branches: a word that is no option names a pattern, which only --list takes (without it git makes a branch of that name); -d, -m, -c, -u, --set-upstream-to and --edit-description, among others, are not listing. */
+function listsBranches(args) {
+    const options = args.filter((a) => a.startsWith('-'));
+    const patterns = args.length - options.length;
+    if (!options.every((a) => BRANCH_FLAGS.test(a) || BRANCH_LONG_FLAGS.has(a) || BRANCH_VALUES.test(a)))
+        return false;
+    return patterns === 0 || options.some((a) => a === '--list' || (BRANCH_FLAGS.test(a) && a.includes('l')));
+}
+/** Whether `git remote` with these words only lists: no words, -v, or get-url (with --push or --all) of one remote by name. Every other verb writes the config or fetches, and show without -n asks the remote. */
+function listsRemotes(args) {
+    if (!args.length || (args.length === 1 && (args[0] === '-v' || args[0] === '--verbose')))
+        return true;
+    const [verb, ...rest] = args;
+    return verb === 'get-url' && rest.filter((a) => a.startsWith('-')).every((a) => a === '--push' || a === '--all') && rest.filter((a) => !a.startsWith('-')).length === 1;
+}
+/** git ls-remote's listing options, alone or in a cluster (-ht). */
+const LS_REMOTE_FLAGS = /^-[hbtq]+$/;
+const LS_REMOTE_LONG = new Set(['--heads', '--branches', '--tags', '--refs', '--symref', '--quiet', '--exit-code', '--get-url']);
+/** Whether `git ls-remote` with these words asks origin, named, and only lists: the first word that is no option is the repository, so a pattern comes after `origin`, and with none git asks the current branch's own remote, whichever that is; a URL, another remote, --upload-pack (a program) and -o (sent to the server) are not listing. */
+function listsOrigin(args) {
+    const options = args.filter((a) => a.startsWith('-'));
+    const words = args.filter((a) => !a.startsWith('-'));
+    return options.every((a) => LS_REMOTE_FLAGS.test(a) || LS_REMOTE_LONG.has(a) || a.startsWith('--sort=')) && words[0] === 'origin';
+}
 /** The branch a push's refspec updates on the remote: its destination, else its source, without `+` and `refs/heads/` (or `heads/`, which git reads the same). */
 const pushedBranch = (refspec) => refspec.replace(/^\+/, '').split(':').pop().replace(/^(?:refs\/)?heads\//, '');
 const isFile = (path) => {
@@ -440,6 +469,12 @@ function git(args, where, protectedBranches, held = false) {
     }
     if (sub === 'checkout' && rest[0] === '-b' && rest.length >= 2 && rest.length <= 3)
         return allow();
+    if (sub === 'branch')
+        return listsBranches(rest) ? allow() : deny('git branch lists only: -a, -r, -v, --show-current, --list <pattern>, and --contains, --merged, --points-at, --sort and --format with their value after =; git checkout -b makes a branch');
+    if (sub === 'remote')
+        return listsRemotes(rest) ? allow() : deny('git remote lists only: on its own, -v, or get-url <name>; nothing that adds, removes, renames, points or prunes a remote, and no show, which asks the remote');
+    if (sub === 'ls-remote')
+        return listsOrigin(rest) ? allow() : deny('git ls-remote asks origin only, named: git ls-remote --heads origin, with --tags, --refs, --symref, --get-url and patterns after origin; no other remote, no URL, no --upload-pack, and not without origin, which asks the current branch\'s own remote');
     if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
         const branch = rest[2];
         if (branch.includes(':') || ['HEAD', '@'].includes(pushedBranch(branch)) || protectedBranches.includes(pushedBranch(branch)))
@@ -909,7 +944,7 @@ function newMessages(head, bases, cwd) {
  */
 function unprompted(cwd) {
     const ownSsh = process.env.GIT_SSH_COMMAND || process.env.GIT_SSH || gitRead(['config', '--get', 'core.sshCommand'], cwd);
-    return { GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', GIT_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never', ...(ownSsh ? {} : { GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }) };
+    return { ...NO_PROMPT, ...(ownSsh ? {} : { GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }) };
 }
 /**
  * What a `push -u origin <branch>` adds to, asked of the remote itself: the commits it has on that branch and on the default

package/dist/host-questions.js

@@ -138,7 +138,7 @@ export const HOST_SCREENS = {
         id: 'vercel-bypass',
         kind: 'confirm',
         title: 'Your Vercel previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Vercel keeps yours behind a login. Vercel\'s way in for tools is a bypass secret made for one tool: the run creates one in your project, named "Impeccable reviews". It is stored encrypted, used only to open previews, and you can revoke it any time in Settings → Deployment Protection.',
+        hint: 'Impeccable reviews each pull request on its preview,\nand Vercel keeps yours behind a login.\n\nVercel\'s way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time.',
         prompt: 'Create the secret for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -156,7 +156,7 @@ export const HOST_SCREENS = {
         id: 'netlify-password',
         kind: 'confirm',
         title: 'Your Netlify previews are protected',
-        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps yours behind the site password. The run reads that password from your site as you and stores it encrypted, used only to open previews. Change it any time in ${NETLIFY_PASSWORD_WHERE}.`,
+        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps yours behind the site password.\n\nThe run reads that password from your site as you and stores it encrypted, used only to open previews. Change it any time in ${NETLIFY_PASSWORD_WHERE}.`,
         prompt: 'Store the site password for Impeccable?',
         confirmLabel: 'Store',
         skipLabel: 'Skip',
@@ -193,7 +193,7 @@ export const HOST_SCREENS = {
         id: 'cloudflare-access',
         kind: 'confirm',
         title: 'Your Cloudflare previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login. Cloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login.\n\nCloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
         prompt: 'Create the token for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -216,13 +216,13 @@ export const HOST_SCREENS = {
     },
 };
 /**
- * A key's screen naming the one address the key goes to: the consent to a bypass secret, a site password or a service
- * token is to that address, which the key opens before anything saves it. A confirm says so in its supporting text; a
- * text or account screen, under its prompt.
+ * A key's paste screen naming the one address the key goes to, which the key opens before anything saves it: a text
+ * or account screen says so under its prompt. A confirm screen's consent to a bypass secret, a site password or a
+ * service token no longer names the address, so it comes back as it is.
  */
 export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
-    return screen.kind === 'confirm' ? { ...screen, hint: `${screen.hint} ${line}` } : { ...screen, prompt: `${screen.prompt} ${line}` };
+    return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
 /**
  * The paste screen for Vercel's bypass secret, saying what actually stopped the run's own way (the CLI's read, Vercel's

package/dist/playbook/github-previews.js

@@ -0,0 +1,101 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const LIMIT = 20;
+const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
+const FAILURE = 'GitHub preview evidence could not be read completely.';
+const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function positiveInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+function sha(value) {
+    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
+}
+function previewUrl(value) {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
+export async function readHostedPreviews(owner, repo, dependencies = {}) {
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+    const runGh = dependencies.runGh ?? (async (args) => {
+        const { stdout } = await execFileAsync('gh', args, {
+            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
+        });
+        return stdout;
+    });
+    const base = `/repos/${owner}/${repo}`;
+    async function get(route) {
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const data = JSON.parse(stdout);
+        if (!Array.isArray(data))
+            throw new Error(FAILURE);
+        return data.slice(0, LIMIT);
+    }
+    try {
+        const [deployments, pulls] = await Promise.all([
+            get(`${base}/deployments?per_page=${LIMIT}`),
+            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
+        ]);
+        let incomplete = false;
+        const evidence = [];
+        for (const entry of deployments) {
+            if (dependencies.signal?.aborted) {
+                incomplete = true;
+                break;
+            }
+            const deployment = record(entry);
+            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
+                continue;
+            let latest;
+            try {
+                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
+            }
+            catch {
+                incomplete = true;
+                if (dependencies.signal?.aborted)
+                    break;
+            }
+            const status = STATES.find((state) => state === latest?.state) ?? null;
+            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
+                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
+            const pullRequests = [];
+            for (const item of pulls) {
+                const pull = record(item);
+                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
+                    && record(pull.head)?.sha === deployment.sha) {
+                    pullRequests.push({ number: pull.number, state: pull.state });
+                }
+            }
+            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
+                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
+        }
+        incomplete ||= dependencies.signal?.aborted ?? false;
+        return { coverage: COVERAGE, deployments: evidence,
+            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
+    }
+    catch {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+}

package/dist/playbook/netlify-pattern.js

@@ -0,0 +1,24 @@
+/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
+export function netlifyPatternError(body, observed) {
+    const pattern = body.previewUrlPattern;
+    if (typeof pattern !== 'string')
+        return null;
+    let netlify = /netlify\.app|<site>/i.test(pattern);
+    try {
+        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
+        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
+    }
+    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
+    if (!netlify)
+        return null;
+    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
+    if (!match || match[1].length > 63)
+        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
+    if (Object.hasOwn(body, 'appKey'))
+        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
+    if (body.intendedMethod !== 'preview-deploy')
+        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
+    if (!observed.has(pattern))
+        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
+    return null;
+}

package/dist/playbook/netlify-previews.js

@@ -0,0 +1,144 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const FAILURE = 'Netlify preview evidence could not be read completely.';
+const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
+const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
+const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
+const STATES = ['success', 'pending', 'failure', 'error'];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}
+function cleanUrl(value) {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
+        return;
+    try {
+        const url = new URL(value);
+        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
+            return url;
+    }
+    catch { /* Discard unsafe evidence without returning it. */ }
+}
+function urls(pull, site) {
+    if (`deploy-preview-${pull.number}--${site}`.length > 63)
+        return;
+    return {
+        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
+        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
+    };
+}
+function validTarget(value, pull, site) {
+    if (value === null || value === undefined || value === '')
+        return true;
+    const target = cleanUrl(value);
+    if (!target)
+        return false;
+    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
+        return true;
+    return target.hostname === 'app.netlify.com'
+        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
+}
+/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
+export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
+    const previews = [];
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
+        return { coverage: COVERAGE, previews, error: FAILURE };
+    }
+    const runGh = dependencies.runGh ?? (async (args) => {
+        const { stdout } = await execFileAsync('gh', args, {
+            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
+        });
+        return stdout;
+    });
+    const base = `/repos/${owner}/${repo}`;
+    async function get(route, limit) {
+        if (dependencies.signal?.aborted)
+            throw new Error();
+        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
+        if (dependencies.signal?.aborted)
+            throw new Error();
+        const data = JSON.parse(raw);
+        if (!Array.isArray(data))
+            throw new Error();
+        return data.slice(0, limit);
+    }
+    const [pullRead, commentRead] = await Promise.allSettled([
+        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
+        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
+    ]);
+    if (pullRead.status === 'rejected')
+        return { coverage: COVERAGE, previews, error: FAILURE };
+    let incomplete = false;
+    const warnings = commentRead.status === 'rejected'
+        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
+    const pulls = new Map();
+    for (const item of pullRead.value) {
+        const pull = record(item);
+        const headSha = record(pull?.head)?.sha;
+        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
+            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
+            continue;
+        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
+        if (!pulls.has(issueUrl))
+            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
+    }
+    const seen = new Set();
+    const statusesBySha = new Map();
+    for (const pull of pulls.values()) {
+        if (dependencies.signal?.aborted) {
+            incomplete = true;
+            break;
+        }
+        try {
+            if (!statusesBySha.has(pull.headSha)) {
+                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
+            }
+            for (const item of await statusesBySha.get(pull.headSha)) {
+                const status = record(item);
+                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
+                if (!site || seen.has(`${pull.number}:${site}`))
+                    continue;
+                // GitHub returns newest first: even an invalid latest entry must hide older success.
+                seen.add(`${pull.number}:${site}`);
+                const state = STATES.find((state) => state === status?.state);
+                const canonical = urls(pull, site);
+                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
+                    continue;
+                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
+                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
+            }
+        }
+        catch {
+            incomplete = true;
+        }
+    }
+    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
+        for (const item of commentRead.value) {
+            const comment = record(item);
+            const author = record(comment?.user);
+            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
+            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
+                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
+                continue;
+            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
+                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
+                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
+                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
+                    continue;
+                const site = parts[2];
+                const canonical = urls(pull, site);
+                if (!canonical || seen.has(`${pull.number}:${site}`))
+                    continue;
+                seen.add(`${pull.number}:${site}`);
+                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
+                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
+            }
+        }
+    }
+    if (dependencies.signal?.aborted)
+        incomplete = true;
+    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
+}

package/dist/playbook/probe-preview.js

@@ -0,0 +1,67 @@
+function redirectGate(location, source) {
+    if (!location)
+        return 'redirected';
+    try {
+        const target = new URL(location, source);
+        if (target.protocol !== 'https:')
+            return 'redirected';
+        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
+            && target.searchParams.has('url'))
+            return 'vercel-protection';
+        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
+            && /^\/login(?:\/|$)/.test(target.pathname))
+            return 'vercel-protection';
+        if (target.hostname.endsWith('.cloudflareaccess.com'))
+            return 'cloudflare-access';
+        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
+            return 'app-sign-in';
+        }
+    }
+    catch {
+        // A malformed redirect reveals nothing about preview protection.
+    }
+    return 'redirected';
+}
+/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
+export async function probePreview(url, dependencies = {}) {
+    let target;
+    try {
+        target = new URL(url);
+        if (!isPlatformPreview(target)
+            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
+            throw new Error();
+    }
+    catch {
+        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 15_000);
+    const signal = dependencies.signal
+        ? AbortSignal.any([controller.signal, dependencies.signal])
+        : controller.signal;
+    try {
+        signal.throwIfAborted();
+        const response = dependencies.fetch ? await dependencies.fetch(target, {
+            method: 'GET',
+            headers: { accept: 'text/html' },
+            credentials: 'omit',
+            redirect: 'manual',
+            signal,
+        }) : await publicPreviewRequest(target, signal);
+        const status = response.status;
+        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
+            ? 'vercel-protection' : status >= 300 && status < 400
+            ? redirectGate(response.headers.get('location'), target)
+            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
+        // Bodies and redirect details may contain credentials; never read or return them.
+        await response.body?.cancel().catch(() => undefined);
+        return { status, gate };
+    }
+    catch {
+        return { status: null, gate: 'unavailable', error: 'request-failed' };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -0,0 +1,15 @@
+/** Register credential-shaped write fields before a message can be recorded.
+ * Do not trust the requested path: even a refused or malformed destination must
+ * keep its supplied credentials private. Values remain unchanged in memory.
+ */
+export function protectionWriteSecrets(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    const body = input.body;
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return [];
+    return ['value', 'clientId', 'clientSecret']
+        .map((key) => body[key])
+        .filter((value) => typeof value === 'string' && value.length > 0)
+        .sort((a, b) => b.length - a.length);
+}

package/dist/playbook/public-preview-request.js

@@ -0,0 +1,96 @@
+import { lookup } from 'node:dns/promises';
+import { request } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+const blockedV4 = new BlockList();
+for (const [address, prefix] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
+    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+])
+    blockedV4.addSubnet(address, prefix, 'ipv4');
+const publicV6 = new BlockList();
+publicV6.addSubnet('2000::', 3, 'ipv6');
+const blockedV6 = new BlockList();
+// Conservatively exclude special-purpose, transition and documentation prefixes.
+for (const [address, prefix] of [
+    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
+])
+    blockedV6.addSubnet(address, prefix, 'ipv6');
+export function isPlatformPreview(target) {
+    return target.protocol === 'https:' && !target.username && !target.password && !target.port
+        && !/[?#]/.test(target.href)
+        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
+}
+function isPublicAddress(value) {
+    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
+        return false;
+    const family = isIP(value.address);
+    if (family !== value.family)
+        return false;
+    if (family === 4)
+        return !blockedV4.check(value.address, 'ipv4');
+    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
+}
+/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
+export async function publicPreviewRequest(target, signal, dependencies = {}) {
+    try {
+        if (!isPlatformPreview(target))
+            throw new Error();
+        signal.throwIfAborted();
+        let abortDns = () => { };
+        const aborted = new Promise((_resolve, reject) => {
+            abortDns = () => reject(new Error());
+            signal.addEventListener('abort', abortDns, { once: true });
+        });
+        const addresses = await Promise.race([
+            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
+        ]).finally(() => signal.removeEventListener('abort', abortDns));
+        signal.throwIfAborted();
+        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
+            throw new Error();
+        const pinned = addresses.map(({ address, family }) => ({ address, family }));
+        return await new Promise((resolve, reject) => {
+            const options = {
+                method: 'GET', headers: { accept: 'text/html' }, signal,
+                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
+                lookup(hostname, options, callback) {
+                    if (hostname !== target.hostname)
+                        return callback(new Error('Preview request failed'), '');
+                    if (options.all)
+                        callback(null, pinned.map((address) => ({ ...address })));
+                    else
+                        callback(null, pinned[0].address, pinned[0].family);
+                },
+            };
+            const req = (dependencies.request ?? request)(target, options, (response) => {
+                response.once('error', () => { });
+                try {
+                    const status = response.statusCode;
+                    const headers = new Headers();
+                    for (const name of ['location', 'x-vercel-error']) {
+                        const value = response.headers[name];
+                        if (typeof value === 'string')
+                            headers.set(name, value);
+                    }
+                    if (!status)
+                        reject(new Error());
+                    else
+                        resolve({ status, headers, body: null });
+                }
+                catch {
+                    reject(new Error());
+                }
+                finally {
+                    response.destroy();
+                }
+            });
+            req.once('error', () => reject(new Error()));
+            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
+            req.end();
+        });
+    }
+    catch {
+        throw new Error('Preview request failed');
+    }
+}

package/dist/playbook/publication-wait.js

@@ -0,0 +1,46 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+const INTERVAL_MS = 30_000;
+const DEADLINE_MS = 8 * 60_000;
+/** One publication deadline per setup PR, including time spent checking the preview. */
+export function createPublicationWait(dependencies = {}) {
+    const now = dependencies.now ?? (() => performance.now());
+    const pause = dependencies.sleep ?? ((ms, signal) => sleep(ms, undefined, { signal }));
+    const starts = new Map();
+    return {
+        begin(pr) {
+            if (!starts.has(pr))
+                starts.set(pr, now());
+        },
+        remainingMs(pr) {
+            const start = starts.get(pr);
+            return start === undefined ? null : Math.max(0, DEADLINE_MS - (now() - start));
+        },
+        async wait(pr, signal) {
+            const start = starts.get(pr);
+            if (start === undefined)
+                return null;
+            const result = (status) => {
+                const elapsed = Math.max(0, now() - start);
+                return {
+                    status,
+                    waited_seconds: Math.floor(elapsed / 1000),
+                    remaining_seconds: Math.ceil(Math.max(0, DEADLINE_MS - elapsed) / 1000),
+                };
+            };
+            if (signal?.aborted)
+                return result('cancelled');
+            const remaining = DEADLINE_MS - (now() - start);
+            if (remaining <= 0)
+                return result('timed-out');
+            try {
+                await pause(Math.min(INTERVAL_MS, remaining), signal);
+            }
+            catch {
+                return result('cancelled');
+            }
+            if (signal?.aborted)
+                return result('cancelled');
+            return result(now() - start >= DEADLINE_MS ? 'timed-out' : 'retry');
+        },
+    };
+}

package/dist/playbook/vercel-protection.js

@@ -0,0 +1,121 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+const METADATA_LIMIT = 16 * 1024;
+const OUTPUT_LIMIT = 2 * 1024 * 1024;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}
+/** Only the root's small project-link metadata is read; CLI authentication stays with the CLI. */
+async function linkedProject(cwd) {
+    try {
+        const root = await realpath(cwd);
+        const directory = join(root, '.vercel');
+        const directoryStat = await lstat(directory);
+        if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
+            return;
+        const path = join(directory, 'project.json');
+        if (!(await lstat(path)).isFile())
+            return;
+        const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = await file.stat();
+            const currentDirectory = await lstat(directory);
+            const currentFile = await lstat(path);
+            if (!stat.isFile() || stat.size > METADATA_LIMIT
+                || currentDirectory.dev !== directoryStat.dev || currentDirectory.ino !== directoryStat.ino
+                || currentFile.isSymbolicLink() || currentFile.dev !== stat.dev || currentFile.ino !== stat.ino
+                || await realpath(path) !== path)
+                return;
+            const buffer = Buffer.alloc(METADATA_LIMIT + 1);
+            const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+            if (bytesRead > METADATA_LIMIT)
+                return;
+            const metadata = record(JSON.parse(buffer.toString('utf8', 0, bytesRead)));
+            if (typeof metadata?.projectId !== 'string' || !/^prj_[A-Za-z0-9]{1,128}$/.test(metadata.projectId)
+                || typeof metadata.orgId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(metadata.orgId))
+                return;
+            return { root, projectId: metadata.projectId, orgId: metadata.orgId };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        return;
+    }
+}
+/** Reuse one existing default automation bypass in memory, without exposing project responses or keys. */
+export async function useExistingVercelBypass(input, dependencies) {
+    const { signal } = dependencies;
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(input.owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(input.repo) || input.repo === '.' || input.repo === '..') {
+        return { status: 'project-mismatch' };
+    }
+    const linked = await linkedProject(input.cwd);
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    if (!linked)
+        return { status: 'not-linked' };
+    const runVercel = dependencies.runVercel ?? ((args) => new Promise((resolve, reject) => {
+        const child = execFile('vercel', args, {
+            cwd: linked.root, encoding: 'utf8', timeout: 30_000, maxBuffer: OUTPUT_LIMIT, signal,
+        }, (error, stdout) => error ? reject(new Error('Vercel project lookup failed.')) : resolve(stdout));
+        child.stdin?.end();
+    }));
+    // teamId selects the linked team. Legacy personal projects omit it and still require accountId to match.
+    const route = `/v9/projects/${linked.projectId}${linked.orgId.startsWith('team_') ? `?teamId=${linked.orgId}` : ''}`;
+    let selected;
+    try {
+        const stdout = await runVercel(['api', route, '--method', 'GET', '--raw', '--non-interactive'], signal);
+        if (signal?.aborted)
+            return { status: 'cancelled' };
+        if (Buffer.byteLength(stdout, 'utf8') > OUTPUT_LIMIT)
+            return { status: 'unavailable' };
+        const project = record(JSON.parse(stdout));
+        const link = record(project?.link);
+        if (project?.id !== linked.projectId || project.accountId !== linked.orgId
+            || !link || !['github', 'github-limited'].includes(String(link.type))
+            || typeof link.org !== 'string' || link.org.toLowerCase() !== input.owner.toLowerCase()
+            || typeof link.repo !== 'string' || link.repo.toLowerCase() !== input.repo.toLowerCase()) {
+            return { status: 'project-mismatch' };
+        }
+        const bypasses = record(project.protectionBypass);
+        if (!bypasses || Object.keys(bypasses).length > 128)
+            return { status: 'unavailable' };
+        const candidates = [];
+        for (const [value, metadata] of Object.entries(bypasses)) {
+            const bypass = record(metadata);
+            if (bypass?.scope !== 'automation-bypass')
+                continue;
+            if (!/^[A-Za-z0-9]{32}$/.test(value)
+                || (bypass.isEnvVar !== undefined && typeof bypass.isEnvVar !== 'boolean'))
+                return { status: 'unavailable' };
+            // An omitted isEnvVar is the legacy default. Explicit false keys must never be chosen implicitly.
+            if (bypass.isEnvVar !== false)
+                candidates.push(value);
+        }
+        if (candidates.length > 1)
+            return { status: 'ambiguous' };
+        if (candidates.length === 0)
+            return { status: 'unavailable' };
+        selected = candidates[0];
+        dependencies.rememberSecret(selected);
+    }
+    catch {
+        return { status: signal?.aborted ? 'cancelled' : 'unavailable' };
+    }
+    if (signal?.aborted)
+        return { status: 'cancelled' };
+    try {
+        const status = await dependencies.save(selected);
+        return { status: ['saved', 'save-failed', 'partial-save', 'cancelled'].includes(status) ? status : 'save-failed' };
+    }
+    catch {
+        return { status: signal?.aborted ? 'cancelled' : 'save-failed' };
+    }
+}

package/dist/sandbox.js

@@ -122,7 +122,8 @@ function moved(env, gitConfigs, kept) {
 }
 /**
  * What a command in the sandbox reads and writes: it reads what the person can but the credential folders, where their
- * environment moved them, and the files git's global settings come from (`gitConfigs`), and writes
+ * environment moved them, and the files git's global settings come from and the credential helper programs its system
+ * settings name (`gitConfigs`), and writes
  * in the checkout, its git folders (a worktree's are outside it), the run's scratch folder and the package caches, but
  * never where git reads settings or programs from, nor a .git below the checkout's top. Bubblewrap takes no pattern in
  * a write rule, and puts a file in place of a denied path that is not there: on Linux the names git reads as nothing
@@ -145,7 +146,7 @@ export function sandboxPolicy(o) {
     };
 }
 /**
- * The global git settings a command in the sandbox keeps: the person's name and email, what shapes how git reads the
+ * The git settings, global and system, a command in the sandbox keeps: the person's name and email, what shapes how git reads the
  * checkout (line endings, case, excludes, attributes, and the content filters, which git add runs: of their commands only
  * LFS's, see LFS_COMMAND, and every filter's `required`) and safe.directory. Nothing that carries or names a sign-in (http's
  * headers, proxy, cookies and certificates, url rewrites, credential helpers, sendemail's and imap's passwords, includes),
@@ -158,27 +159,46 @@ const KEPT_SETTINGS = /^(?:user\.(?:name|email)|init\.defaultbranch|core\.(?:aut
  * filtered rather than stage it unfiltered.
  */
 const LFS_COMMAND = /^git(?:-| +)lfs +(?:clean|smudge|filter-process)(?: +--skip)?(?: +(?:-- +)?%f)?$/;
-/** git's `-z --show-origin` listing, setting by setting: the file it came from, its key, and its value when it has one. */
+/** git's `-z --show-scope --show-origin` listing, setting by setting: its scope, the file it came from, its key, and its value when it has one. */
 function* settings(listing) {
     const parts = listing.split('\0');
-    for (let i = 0; i + 1 < parts.length; i += 2) {
-        const origin = parts[i], entry = parts[i + 1];
+    for (let i = 0; i + 2 < parts.length; i += 3) {
+        const scope = parts[i], origin = parts[i + 1], entry = parts[i + 2];
         const at = entry.indexOf('\n');
-        yield { file: origin.startsWith('file:') ? origin.slice('file:'.length) : undefined, key: at < 0 ? entry : entry.slice(0, at), value: at < 0 ? undefined : entry.slice(at + 1) };
+        yield { scope, file: origin.startsWith('file:') ? origin.slice('file:'.length) : undefined, key: at < 0 ? entry : entry.slice(0, at), value: at < 0 ? undefined : entry.slice(at + 1) };
     }
 }
 /**
- * The person's global git settings scrubbed for the sandbox, from git's own `-z --show-origin` listing of them (`file:path`,
- * NUL, the key, a newline and the value, NUL, per setting; the includes that hold for this checkout already read in): the
- * text of a config file that holds the kept settings, and the files they came from, for the deny list.
+ * The scopes outside the checkout, whose settings the sandbox's copy takes: the system config and the global one. Apple's
+ * git reads the config bundled with it (under Xcode or the Command Line Tools, `usr/share/git-core/gitconfig`, which names
+ * the osxkeychain credential helper) under no scope git has a name for, so `--show-scope` says `unknown`; GIT_CONFIG_NOSYSTEM
+ * turns that file off with /etc/gitconfig. The checkout's own settings (local, worktree) git in the sandbox reads as they
+ * are, and the command's own (`-c`, GIT_CONFIG_PARAMETERS) it gets in its environment.
+ */
+const OUTSIDE_SCOPES = new Set(['system', 'unknown', 'global']);
+/**
+ * The person's git settings scrubbed for the sandbox, from git's own `-z --show-scope --show-origin` listing of every scope
+ * (the scope, NUL, `file:path`, NUL, the key, a newline and the value, NUL, per setting; the includes that hold for this
+ * checkout already read in): the text of a config file that holds the kept settings of the system and global scopes, in
+ * git's order, so a global setting still wins over the system one, and the global files they came from, for the deny list.
+ * The system files (Apple git's under Xcode or the Command Line Tools, /etc/gitconfig) hold no sign-in of the person's and
+ * GIT_CONFIG_NOSYSTEM keeps git in the sandbox from reading them, so they are not denied; the checkout's own settings git
+ * reads from the checkout, which the copy does not repeat.
  */
 export function scrubGitConfig(listing) {
     const quoted = (text) => `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\t/g, '\\t')}"`;
     const files = new Set();
+    const helpers = new Set();
     const sections = new Map();
-    for (const { file, key, value } of settings(listing)) {
-        if (file)
+    for (const { scope, file, key, value } of settings(listing)) {
+        if (!OUTSIDE_SCOPES.has(scope))
+            continue;
+        if (file && scope === 'global')
             files.add(file);
+        // A system config's helper by its bare name (`osxkeychain`, `libsecret`): the program git-credential-<name> on git's exec path, which no sandboxed command is to run.
+        const named = scope !== 'global' && /^credential(?:\..+)?\.helper$/i.test(key) ? /^([^\s!/]+)(?:\s|$)/.exec(value ?? '')?.[1] : undefined;
+        if (named)
+            helpers.add(named);
         if (!KEPT_SETTINGS.test(key) || (/^filter\..+\.(?:clean|smudge|process)$/i.test(key) && !LFS_COMMAND.test(value ?? '')))
             continue;
         const section = key.slice(0, key.indexOf('.')), name = key.slice(key.lastIndexOf('.') + 1);
@@ -188,19 +208,23 @@ export function scrubGitConfig(listing) {
         lines.push(value === undefined ? `\t${name}` : `\t${name} = ${quoted(value)}`);
         sections.set(header, lines);
     }
-    return { text: [...sections].map(([header, lines]) => `${[header, ...lines].join('\n')}\n`).join(''), files: [...files] };
+    return { text: [...sections].map(([header, lines]) => `${[header, ...lines].join('\n')}\n`).join(''), files: [...files], helpers: [...helpers] };
 }
+/** Where Apple's gits keep their programs, git-credential-osxkeychain among them: the one xcode-select names answers `git --exec-path`, the other stays, and a script could run either. */
+const APPLE_GIT_CORE = ['/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core', '/Library/Developer/CommandLineTools/usr/libexec/git-core'];
 /** A setting that names a file git includes: include.path, and includeIf.<condition>.path, whose condition may not hold for this checkout. */
 const INCLUDE = /^include(?:if\..*)?\.path$/i;
 /**
  * Every file the settings in a listing include, whether the include holds for this checkout or not, since a token sits as
  * readily behind an includeIf for another one: `~/` from the home folder, a relative path from the including file's folder,
- * an absolute path as it is, and never another user's `~user/`, which only git resolves.
+ * an absolute path as it is, and never another user's `~user/`, which only git resolves. Of one scope's settings only when
+ * `scope` is given: a listing of every scope carries the checkout's own includes too, which git in the sandbox reads as
+ * they are, so they are not for the deny list.
  */
-export function gitIncludes(listing, home) {
+export function gitIncludes(listing, home, scope) {
     const named = new Set();
-    for (const { file, key, value } of settings(listing)) {
-        if (!INCLUDE.test(key) || value === undefined)
+    for (const { scope: own, file, key, value } of settings(listing)) {
+        if ((scope !== undefined && own !== scope) || !INCLUDE.test(key) || value === undefined)
             continue;
         if (value.startsWith('~/'))
             named.add(join(home, value.slice(2)));
@@ -212,46 +236,55 @@ export function gitIncludes(listing, home) {
     return [...named];
 }
 /**
- * The scrubbed copy of the person's global git settings, read as the person from the checkout (an includeIf for it holds)
- * and written where no sandboxed command writes, and the files the settings came from or include, held or not, each read
- * for what it includes in turn. Without a global config git says so and exits 128, and the copy is empty: git in the
- * sandbox then reads the checkout's own settings only. A global config or an include that holds for this checkout that git
- * cannot read otherwise (a bad line, a file it may not open) stops the run, with git's words: what it includes in turn
- * would stay readable, unknown to the deny list. One held for another checkout only is named in the debug log and stays
- * denied, and the run goes on, though what it includes in turn stays unknown.
+ * The scrubbed copy of the person's git settings, system and global, read as the person from the checkout (an includeIf
+ * for it holds): the system scope from a listing of every scope with the global config turned off, since git lists the
+ * system config Apple's git reads under no scope's name only without a scope flag, and `--system` names /etc/gitconfig
+ * alone; the global scope from its own listing, which dies on a global config git may not open where the listing of every
+ * scope would skip it. Written where no sandboxed command writes; and the global files the settings came from or include,
+ * held or not, each read for what it includes in turn. Without a global config git says so and exits 128, and the copy
+ * holds the system settings alone, if any: git in the sandbox then reads the checkout's own settings besides. A config or
+ * an include that holds for this checkout that git cannot read otherwise (a bad line, a file it may not open) stops the
+ * run, with git's words: what it includes in turn would stay readable, unknown to the deny list. One held for another
+ * checkout only is named in the debug log and stays denied, and the run goes on, though what it includes in turn stays
+ * unknown. Also the credential helper programs the system config names, where they are (git's exec path, Apple's two), for
+ * the deny list: GIT_CONFIG_NOSYSTEM keeps git in the sandbox from naming them, and a script that unsets it, or runs one by
+ * its path, finds the program unreadable, so no keychain is asked (the denied keychain folder would answer it nothing anyway).
  */
 function scrubbedGitConfig(root, home, log) {
     const env = gitEnvironment({ ...process.env, HOME: home });
-    const list = (args, unread) => {
+    const list = (args, o = {}) => {
         try {
-            return execFileSync('git', ['config', ...args, '-z', '--list', '--show-origin'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, env });
+            return execFileSync('git', ['config', ...args, '-z', '--list', '--show-scope', '--show-origin'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, env: { ...env, ...o.env } });
         }
         catch (err) {
             const said = String(err.stderr ?? err.message).trim().split('\n').pop() ?? '';
             if (/unable to read config file .*: No such file or directory/.test(said))
                 return '';
-            if (unread) {
-                unread(said);
+            if (o.unread) {
+                o.unread(said);
                 return '';
             }
-            throw new UserError(`Impeccable keeps your global git settings and the files they include out of the sandbox, and git could not read them (${said}). Fix that file, or the setting that includes it, and run impeccable-reviews again.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
+            throw new UserError(`Impeccable keeps your git settings and the files they include out of the sandbox, and git could not read them (${said}). Fix that file, or the setting that includes it, and run impeccable-reviews again.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
         }
     };
-    const listing = list(['--global', '--includes']);
-    const { text, files } = scrubGitConfig(listing);
+    // The system scope first, so a global setting wins over the system one in the copy as it does for git.
+    const listing = list(['--includes'], { env: { GIT_CONFIG_GLOBAL: '/dev/null' } }) + list(['--global', '--includes']);
+    const { text, files, helpers } = scrubGitConfig(listing);
     const seen = new Set(files);
-    const includes = gitIncludes(listing, home);
+    const includes = gitIncludes(listing, home, 'global');
     for (const file of includes) {
         if (seen.has(file))
             continue;
         seen.add(file);
         // The listing above read every include that holds for this checkout and stopped on one git cannot read, so one that
         // fails here holds for another checkout only.
-        includes.push(...gitIncludes(list(['--file', file, '--no-includes'], (said) => log.write('git include not read', { file, said })), home));
+        includes.push(...gitIncludes(list(['--file', file, '--no-includes'], { unread: (said) => log.write('git include not read', { file, said }) }), home));
     }
     const path = join(ownFolder(), `gitconfig-${randomBytes(6).toString('hex')}`);
     writeFileSync(path, text, { mode: 0o600 });
-    return { path, files: [...seen] };
+    const execPath = execFileSync('git', ['--exec-path'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env }).trim();
+    const programs = helpers.flatMap((name) => [...new Set([execPath, ...APPLE_GIT_CORE])].map((dir) => join(dir, `git-credential-${name}`))).filter(present);
+    return { path, files: [...seen], helpers: programs };
 }
 /** Whether `path` is there, a dangling symlink too. */
 function present(path) {
@@ -379,12 +412,23 @@ export function allowedDomains(s) {
         names.push(...(HOST_APIS[agreed] ?? []));
     return [...new Set(names)];
 }
+/**
+ * Nothing that asks for a password, a passphrase or a host's key, on the terminal, in a window or in Git Credential Manager's:
+ * the fence's own reads of the remote run with it, and so does every command in the sandbox, where a `git ls-remote` of a
+ * repository git has no sign-in for would otherwise wait on a prompt in the person's terminal, where the screen is drawing.
+ */
+export const NO_PROMPT = { GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', GIT_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never' };
 /**
  * What a command in the sandbox also gets: Node's fetch through the sandbox's proxy; no browser downloads, which land in
- * caches it does not write, from hosts it does not reach; and no git hooks installed by husky, which writes the git config
- * the sandbox keeps.
+ * caches it does not write, from hosts it does not reach; no git hooks installed by husky, which writes the git config
+ * the sandbox keeps; no prompt for a sign-in; and no system git config, which the sandbox lets git read (Apple's sits
+ * under Xcode or the Command Line Tools, not in a denied folder) and which names the osxkeychain credential helper there,
+ * so that git in the sandbox has no credential helper at all, as it has none from the global config: it asks for no
+ * sign-in rather than fail in a helper. What keeps the sign-in from a script is the denied keychain folder, which holds
+ * for a script that unsets this variable too (the login keychain, where git's helper and gh keep their items, is a file
+ * the asking process opens, so the helper and `security` find no item); this variable takes the asking away. The kept settings come through the scrubbed copy.
  */
-const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0' };
+const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0', GIT_CONFIG_NOSYSTEM: '1', ...NO_PROMPT };
 /** And, for the agent's shell, npm's cache and corepack's package managers in the run's scratch folder: what a sandboxed install fetched stays with the run, and ~/.npm, which the person's npm and npx read from, is never written. */
 const scratchCaches = (scratch) => ({ npm_config_cache: join(scratch, 'npm-cache'), COREPACK_HOME: join(scratch, 'corepack'), COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' });
 /**
@@ -468,7 +512,7 @@ export async function startSandbox(o) {
         }
     })();
     const global = scrubbedGitConfig(git.root, home, o.log);
-    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees, gitConfigs: global.files });
+    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees, gitConfigs: [...global.files, ...global.helpers] });
     const files = checkoutFiles(git.root);
     const sources = { host: o.host, files, read: (path) => readText(join(git.root, path)), npmrc: readText(join(home, '.npmrc')) };
     let domains = allowedDomains({ ...sources, hosts: o.hosts() });
@@ -562,7 +606,7 @@ export async function startSandbox(o) {
             const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
             running++;
             try {
-                // Git in the sandbox reads the scrubbed copy of the global settings: the person's own are denied, and git dies on a global config it cannot read.
+                // Git in the sandbox reads the scrubbed copy of the system and global settings: the person's own global files are denied, the system ones turned off (INSIDE), and git dies on a global config it cannot read.
                 return await exec(wrapped, cwd, { ...options, env: { ...(options.env ?? process.env), ...INSIDE, ...scratchCaches(o.scratch), ...pnpmEnvironment(home, platform), GIT_CONFIG_GLOBAL: global.path } });
             }
             finally {

package/dist/ui/look.js

@@ -63,7 +63,7 @@ function block(lines, width, size = Math.max(0, ...lines.map((line) => visibleWi
     const left = ' '.repeat(Math.max(0, Math.floor((width - Math.min(size, width)) / 2)));
     return lines.map((line) => left + truncateToWidth(line, width - left.length, '…'));
 }
-/** Plain text wrapped to at most `max` columns: a sentence a line when each fits, else lines as even as the words allow. */
+/** A paragraph of plain text wrapped to at most `max` columns: a sentence a line when each fits, else lines as even as the words allow. */
 function balanced(text, max) {
     const sentences = text.split(/(?<=[.!?])\s+/);
     if (sentences.length > 1 && sentences.every((line) => visibleWidth(line) <= max))
@@ -76,8 +76,8 @@ function balanced(text, max) {
     }
     return lines;
 }
-/** Supporting text: wrapped, soft, each line centered. */
-const said = (text, inner, st) => balanced(text, Math.min(TEXT_WIDTH, inner)).map((line) => center(st.soft(line), inner));
+/** Supporting text: wrapped, soft, each line centered; a blank line in it parts paragraphs, each wrapped on its own and an empty row between. */
+const said = (text, inner, st) => text.split('\n\n').flatMap((part, i) => [...(i ? [''] : []), ...balanced(part, Math.min(TEXT_WIDTH, inner)).map((line) => center(st.soft(line), inner))]);
 /** Wrapped text whose first line starts with `first` and the rest line up under it. */
 const hang = (text, width, first) => wrapTextWithAnsi(text, Math.max(10, width - first.length)).map((line, i) => (i ? ' '.repeat(first.length) : first) + line);
 /** An address cut into rows no wider than `width`, after a slash where one falls in the row's last two thirds, each linking to the whole of it, so any row opens it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,