@impeccable/reviews 0.1.12 → 0.1.14

package/dist/cloudflare.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, resolve, sep } from 'node:path';
 import { cloudflarePreviewsFact, cloudflarePreviewsPage, folderOf } from './host-previews.js';
 import { commandRunner } from './netlify.js';
 import { ownFolder, ownNpmCache } from './sandbox.js';
@@ -238,13 +239,50 @@ export const CF_PACKAGE = 'cf@1.0.0-beta.13';
 /**
  * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
  * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
- * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox: every cf
- * command names its project or its account, so none needs the checkout. It fetches cf through a cache of the command's
- * own, never ~/.npm, where a sandboxed install could have planted a cf under the registry's live ETag; the registry is
- * asked afresh, and no install script of cf's runs, which it does without.
+ * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox, and from where cf
+ * itself would read the checkout's .env into its token and account and evaluate its cloudflare.config.ts: every cf
+ * command names its project or its account, so none needs the checkout. Only the sign-in cf picks by folder does: with
+ * `checkout`, each command runs as the profile cf binds to it (`cf auth activate`), which cf names from its own folder
+ * too, so the account is the one the person's cf uses there; where reading the bindings failed, the command fails as well,
+ * never falling back to another sign-in. It fetches cf through a cache of the command's own, never ~/.npm, where a
+ * sandboxed install could have planted a cf under the registry's live ETag; the registry is asked afresh, and no install
+ * script of cf's runs, which it does without.
  */
 export function cfRunner(opts = {}, runner = commandRunner) {
-    return (args, { account, signal } = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...opts, signal, env: { NO_COLOR: '1', ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}) } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    const { checkout, ...run } = opts;
+    const npx = (args, signal, env = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...run, signal, env: { NO_COLOR: '1', ...env } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    let profile;
+    return async (args, { account, signal } = {}) => {
+        // Read once a runner; a failed read is read again by the next command.
+        if (checkout && !profile)
+            profile = npx(['auth', 'list'], signal).then((listed) => boundProfile(listed, checkout)).catch((err) => { profile = undefined; throw err; });
+        const bound = await profile;
+        return npx([...(bound ? ['--profile', bound] : []), ...args], signal, account ? { CLOUDFLARE_ACCOUNT_ID: account } : {});
+    };
+}
+/** The profile `cf auth list` binds to `checkout`, found as cf finds it from there: the longest bound folder that is the checkout's real path or holds it; none where no folder does. A list that is not cf's throws. */
+export function boundProfile(listed, checkout) {
+    const profiles = JSON.parse(listed);
+    if (!Array.isArray(profiles))
+        throw new Error('cf auth list printed no list of profiles');
+    let here = resolve(checkout);
+    try {
+        here = realpathSync(here);
+    }
+    catch { /* cf's own folder, as cf resolves it */ }
+    let found;
+    for (const p of profiles) {
+        const { name, boundDirectories } = record(p) ?? {};
+        if (typeof name !== 'string' || !/^[A-Za-z0-9_-]+$/.test(name) || !Array.isArray(boundDirectories))
+            continue;
+        for (const dir of boundDirectories) {
+            if (typeof dir !== 'string' || !(here === dir || (here.startsWith(dir) && here[dir.length] === sep)))
+                continue;
+            if (!found || dir.length > found.dir.length)
+                found = { name, dir };
+        }
+    }
+    return found?.name;
 }
 /** The status of the API call a cf command failed on, which its error box names on a line of its own ("│ 403 Forbidden", "│ 404 Not Found · HTTP /accounts/…"); null when it names none. */
 export function cfFailure(err) {
@@ -406,7 +444,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     // `project`, one app's told by an earlier read, is the one read: never the project the first check run names, which may be another app's.
     const named = app ? undefined : deps.project ?? github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (config?.kind === 'pages' ? config.name : undefined);
     // cf installs itself through npx on a machine without it, which takes a while the first time. The project's settings are read with the plain evidence, not while a build is waited for.
-    const cf = await fromCf(named, deps.cf ?? cfRunner(), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
+    const cf = await fromCf(named, deps.cf ?? cfRunner({ checkout: cwd }, deps.run), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
     const where = deps.directory ? `the folder ${deps.directory}` : "the repository's root";
     const unmatched = !app ? undefined
         : cf.cli !== 'signed-in' ? `Which Cloudflare Pages project builds ${where} cannot be told: cf here is not signed in with Pages access, and only a project's settings name the folder it builds (its root directory).`

package/dist/main.js

@@ -256,8 +256,8 @@ export async function main(argv) {
                     todo: [...apps.todo, ...report.left],
                     warnings: [...removed, ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
-                // The web page has the report; when it missed it, the report stays here instead.
-                if (!saved?.ok)
+                // The web page has the report; when it missed it, or there is no test drive, whose why it holds, the report stays here as well.
+                if (!saved?.ok || !testPr)
                     say(`\n${plainReport(report.markdown)}`);
                 if (!saved?.ok)
                     reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });

package/dist/netlify.js

@@ -123,6 +123,24 @@ async function fromGitHub(owner, repo, gh, only) {
     }
     return { previews: found, heads: new Map(heads.map((head) => [head.number, head.sha])), failed };
 }
+/** A page of the person's site list, and how many pages are read at most: what `netlify sites:list` reads. */
+const SITES_PER_PAGE = 100;
+const SITE_PAGES = 10;
+/**
+ * The person's Netlify sites, as `netlify sites:list --json` lists them, read through `netlify api listSites`: in a
+ * checkout with several workspace packages the CLI asks which one to work in before sites:list, and without a terminal
+ * exits on that question, while its api command never asks (#319).
+ */
+async function netlifySites(netlify) {
+    const sites = [];
+    for (let page = 1; page <= SITE_PAGES; page++) {
+        const answer = JSON.parse(await netlify(['api', 'listSites', '--data', JSON.stringify({ filter: 'all', page, per_page: SITES_PER_PAGE })]));
+        sites.push(...list(answer));
+        if (!Array.isArray(answer) || answer.length < SITES_PER_PAGE)
+            break;
+    }
+    return sites;
+}
 /** What the Netlify CLI on this machine knows, when it is signed in: the sites built from this repository, and their deploy previews. */
 async function fromCli(owner, repo, netlify, only, directory) {
     const { cli } = await netlifyStatus(netlify);
@@ -135,7 +153,7 @@ async function fromCli(owner, repo, netlify, only, directory) {
     const facts = [];
     let failed = false;
     try {
-        for (const site of list(JSON.parse(await netlify(['sites:list', '--json'])))) {
+        for (const site of await netlifySites(netlify)) {
             const path = record(site.build_settings)?.repo_path;
             // A site is this repository's only when it is built from it: the folder's own link to a site says nothing of that.
             if (typeof site.name !== 'string' || typeof site.id !== 'string' || !new RegExp(`^${SITE}$`).test(site.name) || typeof path !== 'string' || path.toLowerCase() !== slug)
@@ -286,25 +304,54 @@ export async function waitForNetlifyAccess(siteId, deps) {
  * repository's GitHub account, which Netlify names on every site of the person's that the app already builds from that
  * account. GitHub sends the app each push and pull request, so the pull requests build deploy previews. Then the first
  * build says whether the app reads the repository. Only a site this run's own sites:create made takes the connection,
- * and a site built from another repository keeps it: the person's sites are never pointed elsewhere.
+ * and a site built from another repository keeps it: the person's sites are never pointed elsewhere. A folder linked to
+ * no site stands for the one site built from this repository (from `directory`, for one app), which is connected already.
  */
 export async function connectNetlifySite(owner, repo, cwd, deps) {
     const not = (reason, more = {}) => ({ connected: false, reason, ...more });
-    const siteId = linkedNetlifySite(cwd);
-    if (!siteId)
-        return not('This folder is linked to no Netlify site: link or create one first.');
+    const slug = `${owner}/${repo}`.toLowerCase();
+    const ours = (site) => { const path = record(site?.build_settings)?.repo_path; return typeof path === 'string' && path.toLowerCase() === slug; };
+    let siteId = linkedNetlifySite(cwd);
     let site;
-    try {
-        site = await api(deps.netlify, 'getSite', { site_id: siteId });
+    if (siteId) {
+        try {
+            site = await api(deps.netlify, 'getSite', { site_id: siteId });
+        }
+        catch {
+            return not('Netlify did not answer for the linked site.');
+        }
     }
-    catch {
-        return not('Netlify did not answer for the linked site.');
+    // No link (netlify link asks in a terminal when several sites are built from the repository), or a link to the site of another app's folder:
+    // the one site built from this repository with the app's folder as its base (#319). The checks below read it again as built from this
+    // repository, so a site found here is never written to.
+    const otherApp = site !== undefined && deps.directory !== undefined && ours(site) && folderOf(record(site.build_settings)?.base) !== deps.directory;
+    if (!siteId || otherApp) {
+        const linkedTo = otherApp ? "This folder is linked to the Netlify site of another app's folder" : 'This folder is linked to no Netlify site';
+        const where = deps.directory !== undefined ? ` from ${deps.directory || "the repository's root"}` : '';
+        let built;
+        try {
+            built = (await netlifySites(deps.netlify)).filter((one) => typeof one.id === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(one.id) && typeof one.name === 'string' && new RegExp(`^${SITE}$`).test(one.name) && ours(one)
+                && (deps.directory === undefined || folderOf(record(one.build_settings)?.base) === deps.directory));
+        }
+        catch {
+            return not(`${linkedTo}, and the person's Netlify sites could not be read.`);
+        }
+        if (built.length > 1)
+            return not(`${linkedTo}, and several of the person's sites are built from this repository${where} (${built.map((one) => one.name).join(', ')}), so which one to connect cannot be told.`);
+        if (!built.length)
+            return not(`${linkedTo}, and none of the person's sites is built from this repository${where}: create one first.`);
+        siteId = built[0].id;
+        try {
+            site = await api(deps.netlify, 'getSite', { site_id: siteId });
+        }
+        catch {
+            return not('Netlify did not answer for the site built from this repository.');
+        }
     }
     const name = typeof site?.name === 'string' && new RegExp(`^${SITE}$`).test(site.name) ? site.name : undefined;
     if (!site || !name)
         return not('The linked site could not be read.');
     const linked = { id: siteId, name };
-    const slug = `${owner}/${repo}`.toLowerCase();
     const settings = record(site.build_settings);
     let github;
     try {
@@ -335,7 +382,7 @@ export async function connectNetlifySite(owner, repo, cwd, deps) {
     // The app's installation on this GitHub account, as another site of the person's built from it names it.
     let installation;
     try {
-        for (const other of list(JSON.parse(await deps.netlify(['sites:list', '--json'])))) {
+        for (const other of await netlifySites(deps.netlify)) {
             const build = record(other.build_settings);
             const path = typeof build?.repo_path === 'string' ? build.repo_path : '';
             if (build?.provider === 'github' && path.toLowerCase().startsWith(`${owner.toLowerCase()}/`) && positive(build.installation_id)) {

package/dist/playbook/cases/monorepo.md

@@ -8,7 +8,7 @@ The state's repository has an `apps` item: the scan proposed several apps, folde
 2. **Ask which apps this run sets up**, on every run, with impeccable_ask: `id: "apps"`, `kind: "multi"`, and the `prompt` *"Which apps should get Impeccable previews?"*. The tool words the question and lists the state's apps (the repository's own, `main`, only where the Worker kept it as a product of its own), each picked as it is on, or every one after this run's confirm. Mark the Apps task in progress first. Every write and host tool for an app is refused until it is answered. Done when it answered `values`, `named` (the command was started for that one app with `--app`, from its card on the dashboard: the tool showed one confirm screen naming that app instead of the list, and the list all the same when the person asked for other apps there), or a skip, whose `on` lists the apps that are on: the ones this run sets up. After `named`, that app is the one this run sets up: every host read, key, proof, method and check is its own, and no other app is mentioned past that screen.
 3. **Write the picks**, one action a call as the item's instructions give them: `enable` each chosen app that is off, then `disable` each app that is on and was not chosen. The last app that is on cannot be switched off (409), which is why the enables come first. **After `named`**, `enable` that app when it is off, and switch no other off. **After Skip**, write nothing more: the apps that are on stay on. Done when the last answer's `apps` show `enabled` true for every chosen app and false for the rest (after `named`, true for that app), or, after Skip, nothing was written.
 4. **Read the state again** with impeccable_state. Done when the preview item's `apps` names each chosen app's `directory`, `build` and `method` (none yet for an app not set up), and `perApp` its status.
-5. **Set each chosen app up**, one after the other, as the playbook's steps 3 and 4 say for that app alone, `appKey` on every write and check (`preview`, `test-accounts`, `latest-pull-check`, `connection-check`): its method by the case that applies to it (server-previews when its pages need a server, static-site when they do not, a host's case when the host deploys that app as a project of its own, proven on that app's own address: impeccable_hosted_previews, impeccable_netlify_previews and impeccable_cloudflare_previews take its `appKey` and list only the previews of the project or site that builds its folder, so another app's address, project or key never stands in for it; their `unmatched` says why none can be told, and that app goes as server-previews or static-site says, with the reason under "What is not verified"), and its own sign-in when the scan item's `accessByApp` says it has one, each account question's title naming the app (*"Order desk admin account"*). **The lock in front of each app's previews is that app's own**: when its proof answers a `gate`, preview-protection's steps run for that app, with its `appKey`, before any other app's step (the tools refuse the next app's reads and writes until its key tool was called), and the key goes to that app's own project or site; a key saved for one app says nothing about another's, and the state's `keySaved` speaks for one app at most. Done when every chosen app's method is saved, or its preview skipped as server-previews says, and its sign-in saved or skipped, and no other app got a write, a build or a question.
+5. **Set each chosen app up**, one after the other, as the playbook's steps 3 and 4 say for that app alone, `appKey` on every write and check (`preview`, `test-accounts`, `latest-pull-check`, `connection-check`): its method by the case that applies to it (server-previews when its pages need a server, static-site when they do not, a host's case when the host deploys that app as a project of its own, proven on that app's own address: impeccable_hosted_previews, impeccable_netlify_previews and impeccable_cloudflare_previews take its `appKey` and list only the previews of the project or site that builds its folder (impeccable_netlify_connect takes it too, and connects that site), so another app's address, project or key never stands in for it; their `unmatched` says why none can be told, and that app goes as server-previews or static-site says, with the reason under "What is not verified"), and its own sign-in when the scan item's `accessByApp` says it has one, each account question's title naming the app (*"Order desk admin account"*). **The lock in front of each app's previews is that app's own**: when its proof answers a `gate`, preview-protection's steps run for that app, with its `appKey`, before any other app's step (the tools refuse the next app's reads and writes until its key tool was called), and the key goes to that app's own project or site; a key saved for one app says nothing about another's, and the state's `keySaved` speaks for one app at most. Done when every chosen app's method is saved, or its preview skipped as server-previews says, and its sign-in saved or skipped, and no other app got a write, a build or a question.
 6. **The pull requests** as pull-requests says, once for the repository: the setup commit takes the state's one workflow `file` (a job for each chosen static site whose preview Impeccable builds) once every chosen app's method and build settings are saved, or its preview skipped as server-previews says; the test drive adds its page to every chosen app with a preview (an app whose preview was skipped gets none, and goes under "What was skipped, and why"), in that app's own framework and linked from that app's own public page, so one review renders each of them on its own preview; that case's step 3 proves each chosen app with the input that proved it; its step 4 proves the test drive's page on each chosen app's own preview, with that app's key where its lock stands in front; its step 6 checks each chosen app with a preview, with its `appKey`, one call each. Done when pull-requests' steps are done.
    - **A chosen app whose preview was skipped** (server-previews): it stays on, with no method, no job in the workflow and no test drive page. It holds nothing back: the other apps' setup commit, test drive and checks go on as above, and its checkup entry left in `next` counts as done for the playbook's step 5. The report says, on its line and under "What was skipped, and why", that it gets no preview until its host deploys them.
    - **A host previews some chosen apps and Impeccable builds the others**: a host's case speaks for its own app. The setup commit carries the workflow for the others and the test drive branches from it, and pull-requests' step 4 goes each app's way: the host's app proven on the host's build, the others by the workflow. The repository goes without a workflow and a setup pull request only where a host previews every chosen app.

package/dist/playbook/cases/netlify-setup.md

@@ -9,7 +9,8 @@ The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a
    - **`teams` in the answer** (the person has several Netlify teams): ask once which owns the site, `kind: "single"`, `id: "netlify-team"`, `options` the teams as given (the tool words the rest), and pass the pick to `sites:create` as `--account-slug`.
    - **Skip**: set the preview up as server-previews or static-site says, and say under "What was skipped, and why" that Netlify was found and the sign-in was skipped. The steps below do not apply.
 2. **Link or create the site** (run each Netlify command plain, on its own: a command chained after `sites:create` leaves the site unrecorded): `netlify link --git-remote-url <the GitHub origin>` links a site Netlify already builds from this repository; when it finds none, `netlify sites:create --name <name>` creates one in the person's team and links this folder. Name it after the repository: lowercase letters, digits and hyphens, at most 40 characters; a name Netlify says is taken gets `-2`. Done when `netlify status` names the linked project.
-3. **Connect the repository** with impeccable_netlify_connect: it connects the linked site to this repository through Netlify's GitHub app, so pull requests build deploy previews, when that site is the one this run created or one built from this repository already (a site built from another repository, or one the run did not create, is left as it is, with the reason), and asks the person for the app's access when Netlify cannot read the repository. Give `command` and `publish` only where no `netlify.toml` sets the build. Done when it answered `connected: true`; a site `netlify link` found is connected already, and it says so. **Deploy Previews off** on that site (`pullRequestPreviews` in its answer, or in impeccable_netlify_previews', `enabled: false`): the aim holds, so ask once with impeccable_enable_previews (`host: "netlify"`) before step 4, and never a second time. `enabled`: step 4. `skipped` or `refused`: the setup ends here, as "A step fails before the test drive is pushed" says, with the `reason` and the `page` in the report, and `left` empty, since the person was asked in this run.
+   - **A site already built from this repository** (impeccable_netlify_previews named it in `sites`; on a repository with several apps, read with the app's `appKey`): link nothing, since `netlify link` asks in a terminal this run does not have when several sites are built from the repository. Step 3 finds that site by itself.
+3. **Connect the repository** with impeccable_netlify_connect (with the app's `appKey` on a repository with several apps): it connects the linked site to this repository through Netlify's GitHub app, so pull requests build deploy previews, when that site is the one this run created or one built from this repository already (a site built from another repository, or one the run did not create, is left as it is, with the reason), and asks the person for the app's access when Netlify cannot read the repository. Give `command` and `publish` only where no `netlify.toml` sets the build. Done when it answered `connected: true`; a site `netlify link` found is connected already, and it says so. **Deploy Previews off** on that site (`pullRequestPreviews` in its answer, or in impeccable_netlify_previews', `enabled: false`): the aim holds, so ask once with impeccable_enable_previews (`host: "netlify"`) before step 4, and never a second time. `enabled`: step 4. `skipped` or `refused`: the setup ends here, as "A step fails before the test drive is pushed" says, with the `reason` and the `page` in the report, and `left` empty, since the person was asked in this run.
 4. **Build and push the test drive** (the Test drive task) as pull-requests' steps 2 to 4 say, with the changes netlify-previews' reference gives: from the default branch, no setup pull request, built once with the build Netlify runs. Stage the new page and the page that links to it by name: `netlify sites:create` writes `.netlify/` and may add it to `.gitignore`, and that change stays out of the pull request. Done when `git push -u origin impeccable/test-drive` succeeded.
 5. **Its draft, its preview proven and saved, then marked ready** as pull-requests' step 4 (Netlify) and step 5 say: the draft, whose deploy preview is the site's first, the wait for it by `pull`, the test drive's page proven on it, impeccable_write to `preview` as netlify-previews' step 2 says, `gh pr ready`, then the recording. The playbook's step 6 then has no pull request left to open: go on with the playbook's step 4. Done when impeccable_test_pr answered "Recorded".
 

package/dist/tools.js

@@ -137,7 +137,7 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading ("You're all set up", or "Settings saved" without a test drive), about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. */
 export function resultLine(report) {
-    const lead = !report.testPr ? 'No test drive: the report says why.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = !report.testPr ? 'No test drive: the report says why, printed here when this screen closes.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
@@ -293,6 +293,7 @@ const NETLIFY_CONNECT = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         command: { type: 'string', minLength: 1, description: "The build command Netlify runs, only where no netlify.toml sets one: the package's build script." },
         publish: { type: 'string', minLength: 1, description: 'The folder the build writes the pages to, relative to the checkout, only where no netlify.toml sets one.' },
     },
@@ -1833,14 +1834,14 @@ export function createTools(ctx) {
         }, signal);
     }
     /** The connection of the linked Netlify site with this repository, through Netlify's site settings and its GitHub app, with the app's access asked when it cannot read the repository. */
-    async function netlifyConnect(pi, settings, signal) {
+    async function netlifyConnect(pi, settings, signal, directory) {
         // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI.
         if (!hostSetupAgreed(ctx.log, 'netlify'))
             return { connected: false, reason: 'The Netlify sign-in comes first: impeccable_ask with the id netlify-setup.' };
         const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
         const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
-        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}) });
+        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}), ...(directory !== undefined ? { directory } : {}) });
         netlifySite = result.site?.name ?? netlifySite;
         if (result.pullRequestPreviews)
             previewFacts.set('netlify', result.pullRequestPreviews);
@@ -2765,14 +2766,25 @@ export function createTools(ctx) {
                 return JSON.stringify({ ...proof, appKey: app.appKey });
             return JSON.stringify(proof);
         }),
-        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
+        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. With the folder linked to no site, the one site built from this repository already stands for it, with appKey the one whose base directory is that app's folder: no netlify link needed. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
             const command = p.command;
             const publish = p.publish;
             if (command !== undefined && (command.length > 200 || /[\r\n\0]/.test(command)))
                 return 'Refused: the build command is one line of at most 200 characters.';
             if (publish !== undefined && publish !== '.' && !staticRelativePath(publish))
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
-            return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
+            const refused = appRefusal(p.appKey, 'connected') ?? lockRefusal(p.appKey, 'connected');
+            if (refused)
+                return refused;
+            // On a repository with several apps, only the site that builds the app's folder (#319).
+            const appKey = appsRepo ? p.appKey : undefined;
+            const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && directory === undefined)
+                return JSON.stringify({ appKey, connected: false, reason: `The setup state names no folder for the app ${appKey}.` });
+            const result = await netlifyConnect(pi, { command, publish }, signal, directory);
+            if (result.how && result.site)
+                noteApp(appKey, { host_project: result.site.name });
+            return JSON.stringify(appKey !== undefined ? { appKey, ...result } : result);
         }),
         tool('impeccable_enable_previews', 'Pull-request previews', "Turn on previews of pull requests on the host that builds this repository but not its pull requests, as pullRequestPreviews in the answer of impeccable_netlify_previews, impeccable_netlify_connect or impeccable_cloudflare_previews said (enabled false). It does the rest as the person: one screen asking to turn them on, then the host's CLI changes that one setting (Netlify: Deploy Previews on; Cloudflare Pages: preview branch control set to every non-production branch, or the test drive's branch added to the custom includes) and reads it back; where the CLI cannot (the role, a cf sign-in without pages:write, builds stopped altogether), it opens the host's settings page and asks the person to try again once they changed it there. Answers {\"status\": …}: enabled (pull-request previews are on now; by says whether the run or the person turned them on, and project which project or site), skipped (the person skipped a screen; reason says what came before) or refused (still off after the retries; reason says why, and page where it is changed). Vercel builds every branch once Git is connected, so its fact is reported and never changed here.", ENABLE_PREVIEWS, async (p, pi, signal) => {
             const host = p.host;
@@ -2797,7 +2809,7 @@ export function createTools(ctx) {
             const turnOn = async () => {
                 if (host === 'netlify')
                     return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
-                const cf = cfRunner({}, ctx.hostRunner);
+                const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
                 return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
             };
             // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
@@ -2842,8 +2854,8 @@ export function createTools(ctx) {
             if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
                 return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
             // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
-            const cf = cfRunner({}, ctx.hostRunner);
-            const login = cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner);
+            const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner);
             const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
             let status = await cfStatus(cf, signal);
             if (!writes(status)) {
@@ -3121,8 +3133,8 @@ export function createTools(ctx) {
                 answer = await passCloudflareAccess({
                     url: at.url,
                     consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
-                    cf: cfRunner({}, ctx.hostRunner),
-                    login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
+                    cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
                     status: said,
                     apiToken: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,