@impeccable/reviews 0.1.16 → 0.1.18

package/README.md

@@ -15,7 +15,7 @@ npx @impeccable/reviews
 
 `npm install -g @impeccable/reviews` puts the `impeccable-reviews` command on your PATH instead.
 
-Your browser opens Impeccable's consent page; after Approve it goes on to the run's web page. Keep that tab open: it shows the task list, a question waiting for you, the pull requests and, at the end, the report and the review. The terminal takes over its window while it works, one screen at a time in the same frame (the start; the sign-in, its link copied to the clipboard when you press C; understanding your app; a question when it needs you; the tasks; the test drive, then the setup pull request, each opened in your browser and copied to the clipboard as its screen appears), and gives it back with a short summary: the outcome, the test drive, the setup pull request, the web page and what is left for you. What the agent writes there (its status lines, the tasks, its questions, what is left and the report) shows as plain text: an escape sequence that would have the terminal write the clipboard, retitle the window, link words to another address or clear the screen is taken out, and the agent's status line or line of what is left that holds one is refused.
+Your browser opens Impeccable's consent page; after Approve it goes on to the run's web page. Keep that tab open: it shows the task list, a question waiting for you, the pull requests and, at the end, the report and the review. The terminal takes over its window while it works, one screen at a time in the same frame (the start; the sign-in, its link copied to the clipboard when you press C; understanding your app; a question when it needs you; the tasks; the test drive, then the setup pull request, each opened in your browser and copied to the clipboard as its screen appears), and gives it back with a short summary: the outcome, the account or team and the project or site it used on each host whose preview it opened, the test drive, the setup pull request, the web page and what is left for you. What the agent writes there (its status lines, the tasks, its questions, what is left and the report) shows as plain text: an escape sequence that would have the terminal write the clipboard, retitle the window, link words to another address or clear the screen is taken out, and the agent's status line or line of what is left that holds one is refused.
 
 Keys: Enter goes on, Esc cancels the intro or the sign-in and skips a question (every question can be skipped); on the run screen, Esc twice (or Ctrl+C) stops the run. A screen taller than the terminal scrolls with ↑↓ and PgUp PgDn (↑↓ still move among a question's choices). The screens are black and white, with emphasis by intensity: greys on a terminal that takes true colour and reports its background, bold and dim elsewhere, and under `NO_COLOR`. The mark at the top is the logo's own image in a terminal that shows images (iTerm2, kitty, Ghostty, WezTerm; never under tmux), a square with its slash beside the letter-spaced wordmark elsewhere, and plain text on a dumb terminal.
 

package/dist/agent.js

@@ -142,10 +142,14 @@ export async function runAgent(opts) {
     const session = runtime.session;
     /** The run asked to end: the report, a model error pi cannot get past, or the person pressing Ctrl+C. */
     let ending = false;
+    /** The run is over: the screen stays up until the end screen, and a stop pressed there stops nothing. */
+    let over = false;
     let lastStop;
     const screen = opts.interactive
         ? showRun({
             onCancel: () => {
+                if (over)
+                    return;
                 ending = true;
                 opts.onCancel?.();
                 void session.abort();
@@ -181,8 +185,10 @@ export async function runAgent(opts) {
         unsubscribe();
     }
     finally {
+        over = true;
         forgetSecrets();
-        await screen?.close();
     }
+    // The run screen stays up, its last task ticked, until the end screen takes its place: closing it here put a new screen's
+    // start ("One moment…") up between the two (#312). An error leaves through the command's own close.
     await runtime.dispose();
 }

package/dist/cloudflare-access.js

@@ -104,9 +104,9 @@ const granted = (s) => s.cli === 'signed-in' && (!s.scopes || ACCESS_SCOPES.ever
  * a retry, and two failed retries end it. The new sign-in asks for the scopes it held as well, so whatever else the
  * person uses cf for goes on working.
  */
-async function reach(deps) {
+async function reach(deps, read) {
     const through = (s) => ({ way: throughCf(deps.cf, s.accounts, deps.signal) });
-    let status = await cfStatus(deps.cf, deps.signal);
+    let status = read;
     if (granted(status))
         return through(status);
     if (status.cli === 'missing' || status.cli === 'unknown')
@@ -196,6 +196,8 @@ async function covering(way, url) {
         return unread ? stop(way, unread, '') : { reason: `No Access application ${way.who} reaches covers ${url.host}.` };
     return { apps };
 }
+/** Why no token is made where several applications cover the address. */
+const unclear = (count, host) => `${count} Access applications cover ${host}, so which one's policy should allow the token is not clear.`;
 /**
  * As the person, the way they reach Cloudflare's API: on the one application in front of the address, the service
  * token, then a Service Auth policy that allows it. An application on reusable policies (every one the dashboard makes
@@ -208,7 +210,7 @@ async function create(way, deps, found) {
     const api = way.call;
     const url = new URL(deps.url);
     if (found.length > 1)
-        return { reason: `${found.length} Access applications cover ${url.host}, so which one's policy should allow the token is not clear.` };
+        return { reason: unclear(found.length, url.host) };
     const { account, app } = found[0];
     const base = `/accounts/${account}/access`;
     let links = list(app.policies).flatMap((p, i) => (uid(p.id) ? [{ id: p.id, precedence: typeof p.precedence === 'number' ? p.precedence : i + 1 }] : []));
@@ -313,10 +315,6 @@ export async function passCloudflareAccess(deps) {
         covered ||= 'apps' in found;
         return found;
     };
-    const build = async (way) => {
-        const found = await find(way);
-        return 'apps' in found ? create(way, deps, found.apps) : found;
-    };
     /** A token that opened the address, saved for reviews. */
     const keep = async (token, how, made = {}) => {
         const failed = await deps.save(token);
@@ -325,16 +323,37 @@ export async function passCloudflareAccess(deps) {
     /** Why the run's own way ended without a token that opens the address, for the paste screen's skip, and how to make one by hand there. */
     let stopped;
     let manual;
-    if (!(await deps.consent())) {
-        stopped = 'The person skipped creating a service token.';
-        // cf signed in here, with whatever scopes, says whether an application of the person's covers the address, since reading takes no write; a skip opens no sign-in for it.
-        const status = await cfStatus(deps.cf, deps.signal);
-        if (status.cli === 'signed-in')
-            await find(throughCf(deps.cf, status.accounts, deps.signal));
-    }
+    // cf signed in here, with whatever scopes, reads the Access application in front of the address before anything is asked, since reading takes no write
+    // (#357): none covering it asks nothing, and the consent names the one that does. Signed out, or refused the read, the consent comes first, as its yes opens
+    // the sign-in or the API token screen that finding it takes.
+    const status = await cfStatus(deps.cf, deps.signal);
+    const reads = status.cli === 'signed-in' && (!status.scopes || status.scopes.some((scope) => /^access\.(read|write)$/.test(scope)));
+    const early = reads ? await find(throughCf(deps.cf, status.accounts, deps.signal)) : undefined;
+    const apps = early && 'apps' in early ? early.apps : undefined;
+    const named = apps?.length === 1 ? apps[0] : undefined;
+    /** An application as the consent names it. */
+    const described = ({ account, app }) => ({ id: String(app.id), application: typeof app.name === 'string' && app.name ? app.name : url.host, account });
+    const SKIPPED = 'The person skipped creating a service token.';
+    if (early && 'reason' in early)
+        stopped = early.reason;
+    else if (apps && apps.length > 1)
+        stopped = unclear(apps.length, url.host);
+    else if (!(await deps.consent(named && described(named))))
+        stopped = SKIPPED;
     else {
-        const reached = await reach(deps);
-        let made = 'way' in reached ? await build(reached.way) : 'stopped' in reached ? { reason: reached.stopped } : reached;
+        /** Read anew, by a new sign-in or the API token: an application other than the one the yes named is asked about before anything is made on it. */
+        const rebuild = async (way) => {
+            const found = await find(way);
+            if (!('apps' in found))
+                return found;
+            const target = found.apps.length === 1 ? found.apps[0] : undefined;
+            if (named && target && (String(target.app.id) !== String(named.app.id) || target.account !== named.account) && !(await deps.consent(described(target))))
+                return { reason: SKIPPED };
+            return create(way, deps, found.apps);
+        };
+        const reached = await reach(deps, status);
+        // The sign-in that read the applications makes the token on the one it found, or answers the same refusal, without reading them again; a new sign-in reads its accounts.
+        let made = 'way' in reached ? (early && granted(status) ? ('apps' in early ? await create(reached.way, deps, early.apps) : early) : await rebuild(reached.way)) : 'stopped' in reached ? { reason: reached.stopped } : reached;
         let apiToken = false;
         if ('fallback' in made) {
             // Where cf's sign-in cannot make the token, an API token the person makes for the run can.
@@ -344,7 +363,7 @@ export async function passCloudflareAccess(deps) {
             else {
                 deps.remember(key);
                 apiToken = true;
-                made = await build(withApiToken(key, deps));
+                made = await rebuild(withApiToken(key, deps));
             }
         }
         if (!('token' in made)) {

package/dist/cloudflare.js

@@ -306,8 +306,9 @@ export async function cfStatus(cf, signal) {
     if (status?.authenticated !== true)
         return { cli: 'unknown', accounts: [] };
     const scopes = Array.isArray(status.scopes) ? status.scopes.filter((s) => typeof s === 'string') : undefined;
-    const accounts = list(status.accounts).map((a) => a.id).filter((id) => typeof id === 'string' && /^[0-9a-f]{32}$/.test(id));
-    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts };
+    const listed = list(status.accounts).filter((a) => typeof a.id === 'string' && /^[0-9a-f]{32}$/.test(a.id));
+    const names = Object.fromEntries(listed.flatMap((a) => (typeof a.name === 'string' && a.name && a.name.length <= 100 ? [[a.id, a.name]] : [])));
+    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts: listed.map((a) => a.id), ...(Object.keys(names).length ? { names } : {}) };
 }
 /** What a Pages deployment's latest stage says of its build: success once it deployed, and building until a stage failed or it was cancelled or skipped. */
 const stageState = (stage) => stage?.status === 'failure' ? 'failure' : stage?.status === 'canceled' || stage?.status === 'skipped' ? 'canceled' : stage?.status === 'success' && stage.name === 'deploy' ? 'success' : 'building';
@@ -322,7 +323,7 @@ const PAGES = 4;
  * built from another repository is not this one's.
  */
 async function fromCf(named, cf, repository, settings, signal) {
-    const { cli, scopes, accounts } = await cfStatus(cf, signal);
+    const { cli, scopes, accounts, names } = await cfStatus(cf, signal);
     const pages = !scopes || scopes.includes('pages:read') || scopes.includes('pages:write');
     if (cli !== 'signed-in' || !pages)
         return { cli, rows: [], failed: cli === 'unknown' };
@@ -361,7 +362,8 @@ async function fromCf(named, cf, repository, settings, signal) {
             subdomain = typeof ours.project.subdomain === 'string' && new RegExp(`^${LABEL}\\.pages\\.dev$`).test(ours.project.subdomain) ? ours.project.subdomain : undefined;
         }
     }
-    const settled = { ...(pullRequestPreviews ? { pullRequestPreviews } : {}), ...(account ? { account } : {}), ...(subdomain ? { subdomain } : {}) };
+    const accountName = account ? names?.[account] : undefined;
+    const settled = { ...(pullRequestPreviews ? { pullRequestPreviews } : {}), ...(account ? { account } : {}), ...(accountName ? { accountName } : {}), ...(subdomain ? { subdomain } : {}) };
     if (!project)
         return { cli, rows: [], failed: false, ...settled };
     const ours = (d) => {
@@ -450,6 +452,9 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         : cf.cli !== 'signed-in' ? `Which Cloudflare Pages project builds ${where} cannot be told: cf here is not signed in with Pages access, and only a project's settings name the folder it builds (its root directory).`
             : (cf.matching?.length ?? 0) > 1 ? `Several Cloudflare Pages projects build ${where} (${cf.matching.join(', ')}), so which one is this app's cannot be told.`
                 : !cf.project ? `No Cloudflare Pages project of this repository builds ${where} (its root directory), as far as cf here can see.` : undefined;
+    // The name of the account the project was found in goes to the last screen alone, never into the evidence (#360).
+    if (cf.accountName && !unmatched)
+        deps.onAccountName?.(cf.accountName);
     if (unmatched)
         github.previews = [];
     // A preview's address names the project's own host, which a taken name suffixes (crewline-x1y.pages.dev), not always its name.

package/dist/fence.js

@@ -467,10 +467,20 @@ function git(args, where, protectedBranches, held = false) {
             return deny('a path outside the checkout, or a pattern');
         return allow();
     }
-    if (sub === 'checkout' && rest[0] === '-b' && rest.length >= 2 && rest.length <= 3)
-        return allow();
+    if (sub === 'checkout' || sub === 'switch') {
+        // -q only quiets git. A branch's name and its start are words of their own, never an option (`-b -f x`).
+        const words = rest.filter((a) => a !== '-q' && a !== '--quiet');
+        const make = sub === 'checkout' ? '-b' : '-c';
+        if (words[0] === make && words.length >= 2 && words.length <= 3 && words.slice(1).every((a) => !a.startsWith('-')))
+            return allow();
+        // Back onto a branch the checkout has, by its name alone, which git takes as that branch and never as a path whose changes it throws away.
+        // show-ref takes the ref as written, where rev-parse would take `main~1` too and detach HEAD.
+        if (words.length === 1 && !words[0].startsWith('-') && gitRead(['show-ref', '--verify', '--quiet', `refs/heads/${words[0]}`], where.cwd) !== null)
+            return allow();
+        return deny(`git ${sub} makes a branch, git ${sub} ${make} <name> [<start>], or goes back to a branch the checkout has, by its name alone; -q may join either, and nothing else does`);
+    }
     if (sub === 'branch')
-        return listsBranches(rest) ? allow() : deny('git branch lists only: -a, -r, -v, --show-current, --list <pattern>, and --contains, --merged, --points-at, --sort and --format with their value after =; git checkout -b makes a branch');
+        return listsBranches(rest) ? allow() : deny('git branch lists only: -a, -r, -v, --show-current, --list <pattern>, and --contains, --merged, --points-at, --sort and --format with their value after =; git checkout -b or git switch -c makes a branch');
     if (sub === 'remote')
         return listsRemotes(rest) ? allow() : deny('git remote lists only: on its own, -v, or get-url <name>; nothing that adds, removes, renames, points or prunes a remote, and no show, which asks the remote');
     if (sub === 'ls-remote')
@@ -592,9 +602,16 @@ function reader(cmd, args, where) {
         if (!args.some((a) => a === '-e' || a === '-f' || a.startsWith('--regexp') || a.startsWith('--file')))
             paths = paths.slice(1);
     }
+    // tail -f waits for more until the command's time runs out.
+    // Its long options only as these, since GNU tail takes any start of one's name (--fol is --follow).
+    if (cmd === 'tail' && args.some((a) => /^-[^-]*[fF]/.test(a) || (a.startsWith('--') && !/^--(?:lines|bytes)=|^--(?:quiet|silent|verbose)$/.test(a))))
+        return deny('a tail that follows a file, and never ends, or with a long option other than --lines= and --bytes=');
     // The scratch folder holds what this run wrote there, such as a build's log, so it may be read back.
     if (paths.some((p) => outside(p, where) && !inScratch(p, where)))
         return deny('reads outside the checkout');
+    // A diff of a folder reads the files in it nobody named, .env ones too, and a pattern can name a folder once the shell expands it.
+    if (cmd === 'diff' && (args.some((a) => /^-[^-]*r/.test(a) || a === '--recursive') || paths.some((p) => /[*?[]/.test(p) || isFolder(realPath(resolve(where.cwd, p))))))
+        return deny('a diff of a folder or a pattern reads every file it names, .env files too: name the files');
     // The shell expands `.e*` to .env too.
     if (cmd !== 'ls' && paths.some((p) => readsSecret(p, where) || /^\.[^/]*[*?[]/.test(basename(p))))
         return deny('reads a .env file, or a pattern that can match one');
@@ -877,6 +894,8 @@ function simpleCommand(seg, where, opts) {
             // gh runs as the person, who can read other repositories' pull requests: this run's own, by number or branch, in this repository.
             if (args[0] === 'pr' && args[1] === 'view')
                 return ghView(args.slice(2)) ? allow() : deny("gh pr view takes a pull request's number or this run's branch, --repo for this repository, --json and --comments");
+            if (args[0] === 'pr' && args[1] === 'checks')
+                return ghView(args.slice(2), '--required') ? allow() : deny("gh pr checks takes a pull request's number or this run's branch, --repo for this repository, --json and --required");
             // The test drive opens as a draft where its preview needs the pull request first, and is marked ready once that preview is proven: the test drive's branch by name, nothing else.
             if (args[0] === 'pr' && args[1] === 'ready')
                 return ghReady(args.slice(2)) !== null ? allow() : deny('gh pr ready takes the test drive branch by name, and --repo');
@@ -892,9 +911,18 @@ function simpleCommand(seg, where, opts) {
         case 'ls':
         case 'cat':
         case 'head':
+        case 'tail':
+        case 'diff':
         case 'grep':
         case 'find':
             return reader(cmd, args, where);
+        case 'mkdir':
+            // Folders in the checkout (the rule above stops one outside it), never in a .git, where git takes its settings and hooks.
+            if (args.some((a) => a.startsWith('-') && !['-p', '--parents', '-v', '--verbose'].includes(a)))
+                return deny('mkdir takes -p and the folders to make, nothing else');
+            return positional.some((a) => [a, relative(where.root, realPath(resolve(where.cwd, a)))].some((p) => p.split(/[\\/]/).includes('.git'))) ? never('makes a folder in .git, where hooks run') : allow();
+        case 'sleep':
+            return args.length === 1 && /^\d+(?:\.\d+)?$/.test(args[0]) && Number(args[0]) <= 300 ? allow() : deny('sleep takes a number of seconds, 300 at most, and nothing else');
         case 'netlify':
             return netlify(args, opts.hosts.has('netlify'), opts.teams.get('netlify'), opts.repository);
         case 'vercel':
@@ -973,7 +1001,7 @@ function pushBases(branch, defaultBranch, cwd) {
     return [...bases, ...(known ?? '').split('\n').filter((line) => line.endsWith(' commit')).map((line) => line.split(' ')[0])];
 }
 const UNREAD_PUSH = 'the commits the push would carry past what the remote has could not be read here';
-const UNMADE_PUSH = 'a push in the same command as the git commit or git checkout -b that makes what it carries, which is not there yet when the fence reads what the push would carry: run git push as a command of its own, after the commit';
+const UNMADE_PUSH = 'a push in the same command as the git commit, git checkout -b or git switch -c that makes what it carries, which is not there yet when the fence reads what the push would carry: run git push as a command of its own, after the commit';
 const UNREACHED_PUSH = 'the remote could not be reached, so what the push would carry could not be checked: try the push again once the network is back';
 /** The paths every commit `head` has that none of `bases` has touches, from the checkout's top: a file a later commit removes again is still in what the push sends, and a merge's own changes too. Null when git cannot read them. */
 function newPaths(head, bases, cwd) {
@@ -1163,8 +1191,12 @@ function unsyncedWorkflows(where, named, carried, synced) {
 export function classifyCommand(command, root, options = {}) {
     const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null, repository: options.repository };
     const segments = parseCommand(command);
-    if (!segments)
-        return deny('uses shell syntax the fence does not read');
+    if (!segments) {
+        // A here-document is how a file or a message gets written in one command: the write tool, -m and --body do that.
+        if (/<<-?\s*['"]?\w/.test(command))
+            return deny("a here-document, which the fence does not read: write a file with the write tool, a commit's message with -m and a pull request's body with --body");
+        return deny('uses shell syntax the fence does not read: a variable, $( ), a subshell, braces, a here-document or a background job; run plain commands, joined with &&, ; or |');
+    }
     if (!segments.length)
         return deny('an empty command');
     const where = { root: realPath(root), cwd: root, scratch: options.scratch && realPath(options.scratch) };
@@ -1177,14 +1209,14 @@ export function classifyCommand(command, root, options = {}) {
         return remote.get(branch);
     };
     let result = allow();
-    /** A git commit or checkout -b earlier in the command, whose commits or branch are not there yet when a push after it is judged. */
+    /** A git commit, checkout -b or switch -c earlier in the command, whose commits or branch are not there yet when a push after it is judged. */
     let unmade = false;
     for (const seg of segments) {
         let decision = simpleCommand(seg, where, opts);
         const gitSub = seg.words[0] === 'git' ? gitArgs(seg.words.slice(1))?.[0] : undefined;
         if (decision.verdict === 'allow' && gitSub === 'push' && unmade)
             decision = deny(UNMADE_PUSH);
-        if (gitSub === 'commit' || gitSub === 'checkout')
+        if (gitSub === 'commit' || gitSub === 'checkout' || gitSub === 'switch')
             unmade = true;
         if (decision.verdict === 'allow')
             decision = contentCheck(seg, where, opts.protectedBranches[0], basesOf) ?? decision;
@@ -1595,21 +1627,21 @@ function ghReady(args) {
     const repository = inline ?? (rest[0] === '--repo' || rest[0] === '-R' ? rest[1] : undefined);
     return rest.length === (inline !== undefined ? 1 : 2) && typeof repository === 'string' && REPOSITORY.test(repository) ? { branch, repository } : null;
 }
-/** `gh pr view [<number> | this run's branch] [--repo <owner>/<name>] [--json <fields>] [--comments]`, each once: the repository named, or null. */
-function ghView(args) {
+/** `gh pr view [<number> | this run's branch] [--repo <owner>/<name>] [--json <fields>] [--comments]`, each once, and `gh pr checks` the same with --required for --comments: the repository named, or null. */
+function ghView(args, flag = '--comments') {
     const seen = new Map();
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         const at = arg.startsWith('--') ? arg.indexOf('=') : -1;
-        const flag = at < 0 ? arg : arg.slice(0, at);
-        const name = flag === '-R' ? '--repo' : flag === '-c' ? '--comments' : flag;
+        const given = at < 0 ? arg : arg.slice(0, at);
+        const name = given === '-R' ? '--repo' : given === '-c' && flag === '--comments' ? '--comments' : given;
         let value = '';
         if (name === '--repo' || name === '--json') {
             value = (at < 0 ? args[++i] : arg.slice(at + 1)) ?? '';
             if (!value || value.startsWith('-'))
                 return null;
         }
-        else if (name !== '--comments' || at >= 0) {
+        else if (name !== flag || at >= 0) {
             if (arg.startsWith('-') || !(/^[1-9]\d*$/.test(arg) || setupBranch(arg) || driveBranch(arg)))
                 return null;
         }
@@ -1735,8 +1767,8 @@ export function reservePreviewCommand(state, command, root, scratch) {
             if (!driveCreated || parsed.branch !== drive)
                 return deny('mark ready the test drive this run opened');
         }
-        if (words[0] === 'gh' && words[1] === 'pr' && words[2] === 'view') {
-            const parsed = ghView(words.slice(3));
+        if (words[0] === 'gh' && words[1] === 'pr' && (words[2] === 'view' || words[2] === 'checks')) {
+            const parsed = ghView(words.slice(3), words[2] === 'checks' ? '--required' : '--comments');
             if (!parsed)
                 return deny("view only this run's pull requests, by number or branch name");
             // Without --repo, gh picks a repository from the checkout's remotes, which may name another one.

package/dist/host-questions.js

@@ -81,6 +81,10 @@ const previewsOff = (id, name, where) => ({
         skipLabel: 'Skip',
     },
 });
+/** The consent to a Vercel bypass secret, saying whose previews Vercel's login keeps and where the secret is revoked. */
+const bypassHint = (whose, where) => `Impeccable reviews each pull request on its preview,\nand Vercel keeps ${whose} behind a login.\n\nVercel's way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time in ${where} Settings → Deployment Protection.`;
+/** The consent to a Cloudflare service token, saying which Access application keeps whose previews, and whose policy allows the token. */
+const accessHint = (keeps, policy) => `Impeccable reviews each pull request on its preview, and ${keeps} behind a login.\n\nCloudflare's way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in ${policy} policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.`;
 /** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, the consent to turning a host's pull-request previews on, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one, and to making a site behind Netlify's team login public. */
 export const HOST_SCREENS = {
     'netlify-signin-retry': { id: 'netlify-signin-retry', kind: 'confirm', title: 'Sign in to Netlify', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
@@ -138,7 +142,7 @@ export const HOST_SCREENS = {
         id: 'vercel-bypass',
         kind: 'confirm',
         title: 'Your Vercel previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview,\nand Vercel keeps yours behind a login.\n\nVercel\'s way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time.',
+        hint: bypassHint('yours', "the project's"),
         prompt: 'Create the secret for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -193,7 +197,7 @@ export const HOST_SCREENS = {
         id: 'cloudflare-access',
         kind: 'confirm',
         title: 'Your Cloudflare previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login.\n\nCloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        hint: accessHint('Cloudflare Access keeps yours', "your Access application's"),
         prompt: 'Create the token for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -224,6 +228,17 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
+/** The consent to a Vercel bypass secret, naming the project that holds it and, on a repository with several apps, the app whose previews it opens (#358). */
+export function vercelBypassConsent(project, app) {
+    const screen = HOST_SCREENS['vercel-bypass'];
+    if (!project)
+        return screen;
+    return { ...screen, hint: bypassHint(app ? `${app}'s previews, built by the Vercel project ${project},` : `the previews of the Vercel project ${project}`, `${project}'s`) };
+}
+/** The consent to a service token, asked once the Access application in front of the preview was found (#357): that application, its Cloudflare account, and whose previews at which host it keeps. */
+export function cloudflareAccessConsent(found, host, app) {
+    return { ...HOST_SCREENS['cloudflare-access'], hint: accessHint(`the Access application "${found.application}", in the Cloudflare account ${found.account}, keeps ${app ? `${app}'s previews` : 'yours'} (${host})`, `"${found.application}"'s`) };
+}
 /** The one consent to making the Access application's own policies reusable, which the run's way through cf needs to add the token's policy (#327): the application named. */
 export function cloudflareAccessReusable(application) {
     return {

package/dist/hosted.js

@@ -80,10 +80,11 @@ export async function readHostedPreviews(owner, repo, deps = {}) {
         return unread;
     }
 }
+/** Each host's name, its lock's gate, the login's domain, and whose login that is: Cloudflare's is Access's, not Pages'. */
 const HOSTS = {
-    vercel: { name: 'Vercel', gate: 'vercel-protection', login: /(^|\.)vercel\.com$/ },
-    netlify: { name: 'Netlify', gate: 'netlify-protection', login: /(^|\.)netlify\.com$/ },
-    cloudflare: { name: 'Cloudflare Pages', gate: 'cloudflare-access', login: /(^|\.)cloudflareaccess\.com$/ },
+    vercel: { name: 'Vercel', gate: 'vercel-protection', login: /(^|\.)vercel\.com$/, lock: 'Vercel' },
+    netlify: { name: 'Netlify', gate: 'netlify-protection', login: /(^|\.)netlify\.com$/, lock: 'Netlify' },
+    cloudflare: { name: 'Cloudflare Pages', gate: 'cloudflare-access', login: /(^|\.)cloudflareaccess\.com$/, lock: 'Cloudflare Access' },
 };
 const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
 const NETLIFY = new RegExp(`^(?=[^.]{1,63}\\.netlify\\.app$)deploy-preview-[1-9]\\d{0,6}--(${LABEL})\\.netlify\\.app$`);
@@ -137,6 +138,24 @@ export function netlifySiteOf(url) {
     const { hostname } = new URL(url);
     return NETLIFY.exec(hostname)?.[1] ?? LIVE.netlify.exec(hostname)?.[1] ?? null;
 }
+/**
+ * The project and team a Vercel deployment's own address names, `<project>-<hash>-<team>.vercel.app` (Vercel's generated
+ * address, its hash nine letters and digits), for the last screen (#360): only where one split fits, and that split's
+ * project is `project` where a host tool named it; null otherwise, a project's own address included, and any address
+ * with `-git-` in it, which a branch's alias `<project>-git-<branch>-<team>` has, so a branch's word is never a hash.
+ */
+export function vercelDeploymentOf(url, project) {
+    if (!URL.canParse(url))
+        return null;
+    const parsed = new URL(url);
+    if (!plainHttps(parsed) || !LIVE.vercel.test(parsed.hostname) || parsed.hostname.includes('-git-'))
+        return null;
+    const parts = parsed.hostname.slice(0, -'.vercel.app'.length).split('-');
+    const splits = parts
+        .flatMap((part, i) => (i > 0 && i < parts.length - 1 && /^[a-z0-9]{9}$/.test(part) ? [{ project: parts.slice(0, i).join('-'), team: parts.slice(i + 1).join('-') }] : []))
+        .filter((split) => project === undefined || split.project === project.toLowerCase());
+    return splits.length === 1 ? splits[0] : null;
+}
 /** The address pattern a proven preview stands for, where the host reports none to GitHub: Netlify's by pull request, Cloudflare's by the branch's alias. A live address stands for none. */
 function patternOf(hostname) {
     const site = NETLIFY.exec(hostname)?.[1];
@@ -168,17 +187,56 @@ async function checkoutHolds(root, words) {
         return false;
     }
 }
-/** Whether a file the checkout tracks (in `folder`, one app's, when given) names the address's origin as such, whole (a full stop after it is the sentence's): not as the tail of a longer host name, such as a deploy preview's of the same site. */
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+/** The address's origin as such, whole (a full stop after it is the sentence's): not as the tail of a longer host name, such as a deploy preview's of the same site. */
+const wholeOrigin = (origin) => `(^|[^A-Za-z0-9.-])${escapeRegExp(origin)}([^A-Za-z0-9.-]|\\.([^A-Za-z0-9]|$)|$)`;
+/** Whether a file the checkout tracks (in `folder`, one app's, when given) names the address's origin, whole. */
 export async function checkoutNames(root, origin, folder = '') {
-    const escaped = origin.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
     try {
-        await execFileAsync('git', ['grep', '--quiet', '--ignore-case', '--extended-regexp', '-e', `(^|[^A-Za-z0-9.-])${escaped}([^A-Za-z0-9.-]|\\.([^A-Za-z0-9]|$)|$)`, '--', `:(literal)${folder || '.'}`, ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
+        await execFileAsync('git', ['grep', '--quiet', '--ignore-case', '--extended-regexp', '-e', wholeOrigin(origin), '--', `:(literal)${folder || '.'}`, ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
         return true;
     }
     catch {
         return false;
     }
 }
+/** Whether a line names an app's name or folder whole, not inside a longer name, a host name or a path, such as `apps/web` in `archived/apps/web`. */
+const namesWhole = (line, words) => new RegExp(`(^|[^\\p{L}\\p{N}_./-])${escapeRegExp(words)}(?![\\p{L}\\p{N}_-]|[./][\\p{L}\\p{N}])`, 'iu').test(line);
+/**
+ * Whether a line of the checkout's root README names the address's origin, whole, beside one app, by its name or its
+ * folder, and no other app: a row of a table of the apps' live addresses, or an item of such a list (#367). The
+ * addresses on the line are left out of the match, so a host name made of an app's name names no app.
+ */
+export async function readmeNamesApp(root, origin, app, others) {
+    let lines;
+    try {
+        lines = (await execFileAsync('git', ['grep', '-h', '--ignore-case', '--extended-regexp', '-e', wholeOrigin(origin), '--', ':(glob,icase)README*'], { cwd: root, timeout: 30_000, env: gitEnvironment() })).stdout;
+    }
+    catch {
+        return false;
+    }
+    // Each name or folder with every app it belongs to, so a name two apps share names both; the longest first, each taken
+    // out once found, so "Web" inside "Web admin" is not that app named.
+    const names = new Map();
+    for (const each of [app, ...others])
+        for (const words of [each.name, each.folder])
+            if (words)
+                names.set(words.toLowerCase(), [...(names.get(words.toLowerCase()) ?? []), each]);
+    const longestFirst = [...names].sort(([x], [y]) => y.length - x.length);
+    return lines.split('\n').some((line) => {
+        // The addresses end where a table cell or a tag does; a path's parentheses, and a link's closing one, go with them.
+        let text = line.replace(/https?:\/\/[^\s|<>[\]"'`]+/gi, ' ');
+        const named = new Set();
+        for (const [words, apps] of longestFirst) {
+            if (!namesWhole(text, words))
+                continue;
+            for (const each of apps)
+                named.add(each);
+            text = text.replace(new RegExp(escapeRegExp(words), 'giu'), ' ');
+        }
+        return named.size === 1 && named.has(app);
+    });
+}
 /** What a visitor never sees of a page: comments, scripts, styles and templates. */
 const UNSEEN = /<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 /** The words a visitor sees: the title and the text, without comments, scripts, styles, tags or attributes. */
@@ -264,7 +322,7 @@ export async function provePreview(url, words, root, deps = {}) {
     if (!host)
         return unproven(deps.live ? 'Only an https address with no query is opened.' : 'Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, or a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, with no query, is opened.');
     // Another host's live address has a lock no key opens, so none is looked for: its login is another site, and its 401 the app's own sign-in.
-    const { name, gate, login } = host === 'other' ? { name: 'the app', gate: undefined, login: /$^/ } : HOSTS[host];
+    const { gate, login, lock } = host === 'other' ? { gate: undefined, login: /$^/, lock: 'the app' } : HOSTS[host];
     const phrase = words.trim();
     if (phrase.length < 3 || phrase.length > 120 || /[\r\n]/.test(phrase))
         return unproven('The words are 3 to 120 characters on one line.');
@@ -292,7 +350,7 @@ export async function provePreview(url, words, root, deps = {}) {
                 const location = res.headers.get('location') ?? '';
                 const next = URL.canParse(location, target.href) ? new URL(location, target) : null;
                 if (gate && next && login.test(next.hostname))
-                    return { ...unproven(`The address sent the browser to ${name}'s login${still}.`, res.status), gate };
+                    return { ...unproven(`The address sent the browser to ${lock}'s login${still}.`, res.status), gate };
                 if (next?.origin !== target.origin)
                     return unproven('The address sent the browser to another site.', res.status);
                 target = next;
@@ -310,7 +368,7 @@ export async function provePreview(url, words, root, deps = {}) {
                 if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
                     return { ...unproven("The password opens the address on Netlify's own form, but not in the Authorization header, the one way reviews can send it.", res.status), gate, formOpened: true };
                 }
-                return { ...unproven(`The address asked for ${name}'s login or password${still}.`, res.status), gate, ...(host === 'netlify' && NETLIFY_TEAM_LOGIN.test(page) ? { teamLogin: true } : {}) };
+                return { ...unproven(`The address asked for ${lock}'s login or password${still}.`, res.status), gate, ...(host === 'netlify' && NETLIFY_TEAM_LOGIN.test(page) ? { teamLogin: true } : {}) };
             }
             if (res.status < 200 || res.status >= 300) {
                 await res.body?.cancel().catch(() => { });