@impeccable/reviews 0.1.17 → 0.1.18

package/dist/playbook/cases/vercel-previews.md

@@ -2,7 +2,7 @@
 
 Vercel deploys previews of the pull requests: impeccable_hosted_previews lists a successful Preview deployment that Vercel made (`vercel: true`) of a pull request, with its address. The checkout often shows it too (`vercel.json`, `.vercel/project.json`, a `vercel` dependency), but GitHub's record decides. Vercel builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
-It applies as well **before the first pull request**: Vercel deploys the repository already (impeccable_hosted_previews lists deployments Vercel made, production ones or of pushes, and none of a pull request; on a repository with several apps, those of the project that builds the app, named in `project`), so its previews start with the test drive's push. Then there is nothing to prove in step 1 yet: impeccable_ask with `vercel-setup` is refused, since there is no sign-in, project or connection to make; go on to pull-requests' step 4, which pushes the test drive, waits for Vercel's deployment of the pushed branch (impeccable_hosted_previews with `branch`, and the app's `appKey`), proves the test drive's page there, past Vercel's login as preview-protection says, and then step 2 saves the method.
+It applies as well **before the first pull request**: Vercel deploys the repository already (impeccable_hosted_previews lists deployments Vercel made, production ones or of pushes, and none of a pull request; on a repository with several apps, those of the project that builds the app, named in `project`), so its previews start with the test drive's push. Then there is nothing to prove in step 1 yet: impeccable_ask with `vercel-setup` is refused, since there is no sign-in, project or connection to make; go on to pull-requests' step 4, which asks for Vercel's bypass secret where the project's previews are protected, pushes the test drive, waits for Vercel's deployment of the pushed branch (impeccable_hosted_previews with `branch`, and the app's `appKey`), proves the test drive's page there, past Vercel's login as preview-protection says, and then step 2 saves the method.
 
 ### Steps
 
@@ -14,8 +14,8 @@ It applies as well **before the first pull request**: Vercel deploys the reposit
 - **The live app**: with the checkout linked to the project (`.vercel/project.json`) and a production deployment of it on GitHub's record, the evidence answers the project's own domain as `production`; live-app-address says how it becomes the before, in step 2's write. Unlinked, GitHub's record names no address of it that is open.
 - **The aim** holds here: the CLI does the work, and the person is asked only what the playbook's aim allows.
 - **Behind Vercel's login** (`gate: "vercel-protection"`): Deployment Protection stands in front of the previews. Get past it as preview-protection says, which proves the preview, and go on with step 2; when nothing got past it, that case says how the run ends.
-- **`pullRequestPreviews` in impeccable_hosted_previews' answer**: what vercel.json and the linked project say of the test drive's branch, read with the evidence and never changed by the run, since the setting is the repository's own or has no command (impeccable_enable_previews takes no Vercel). `enabled: false` (`git.deploymentEnabled` in vercel.json turns the branch off, or Vercel records no deployments on GitHub, where Impeccable finds its previews): push no test drive on Vercel. Set the preview up as server-previews or static-site says, and say in one line under "What was skipped, and why" that Vercel builds no preview of the pull requests, with the `reason`, and the exact change for the person: the vercel.json rule to lift, or Vercel GitHub deployments under the project's Settings → Git. `enabled: 'unknown'` (an Ignored Build Step decides commit by commit, or the CLI could not read the project): go on, and say so in one line under "What is not verified".
-- **Another app, or no answer from any of the three**: Vercel's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Vercel address answered.
+- **`pullRequestPreviews` in impeccable_hosted_previews' answer**: what vercel.json and the linked project say of the test drive's branch, read with the evidence and never changed by the run, since the setting is the repository's own or has no command (impeccable_enable_previews takes no Vercel). `enabled: false` (`git.deploymentEnabled` in vercel.json turns the branch off, or Vercel records no deployments on GitHub, where Impeccable finds its previews): push no test drive on Vercel. Set the preview up as server-previews says, and say in one line under "What was skipped, and why" that Vercel builds no preview of the pull requests, with the `reason`, and the exact change for the person: the vercel.json rule to lift, or Vercel GitHub deployments under the project's Settings → Git. `enabled: 'unknown'` (an Ignored Build Step decides commit by commit, or the CLI could not read the project): go on, and say so in one line under "What is not verified".
+- **Another app, or no answer from any of the three**: Vercel's previews do not show this app. Set the preview up as server-previews says instead, and say under "What is not verified" what the Vercel address answered.
 - **The pull requests**: no setup pull request; the test drive branches from the default branch, and Vercel builds its preview from the push, which pull-requests' step 4 waits for and proves the test drive's page on before the pull request opens. In place of pull-requests' step 3, build the test drive branch once with the install and build Vercel runs (`vercel.json`'s `installCommand` and `buildCommand`, else the package's), as plain commands (`pnpm install`, then `pnpm run build`) and not with impeccable_verify_preview, which is for a preview Impeccable starts itself, so a page that does not build is never pushed.
 - The evidence is GitHub's: link, deploy and change nothing on Vercel, and save no address pattern, since Vercel reports each preview's address to GitHub itself.
 - The report names the address that answered with this app under "What we found", and puts the test drive's own preview under "What is not verified".

package/dist/playbook/cases/vercel-setup.md

@@ -8,7 +8,7 @@ The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `ver
    - **`cli: "missing"`**: install the CLI with `npm install -g vercel@62.7.0`, exactly so: the run installs it with npm alone, pinned to that version, and refuses another package manager, version or tag; then ask again: the screen shows no second time.
    - **`teams` in the answer instead of `team`** (several teams, none current): ask once which owns the project, `kind: "single"`, `id: "vercel-team"`, `options` the teams as given (the tool words the rest). The pick is the team.
    - **Neither `team` nor `teams`**: the account has no team, and `vercel link --yes` without `--team` links in the person's own scope.
-   - **Skip**: set the preview up as server-previews or static-site says, and say under "What was skipped, and why" that Vercel was found and the sign-in was skipped. The steps below do not apply.
+   - **Skip**: set the preview up as server-previews says, and say under "What was skipped, and why" that Vercel was found and the sign-in was skipped. The steps below do not apply.
 2. **Create the project, then link it** (run each Vercel command plain, on its own: its answer is short, a pipe to `tail` is refused, and a command chained after it leaves the project unrecorded): `vercel project add <the folder's name> --team <the team>` creates the project in that team, under the name `vercel link` gives a project (the checkout folder's name, lowercase); then `vercel link --yes --team <the team>`, in the checkout's root (never with `--cwd` or after a `cd`), links the folder to the project of that name, which is now the run's. The CLI names no team on its own without a terminal, so the option is given whenever there is a team. Done when the link prints the linked project.
    - **`vercel project add` fails** (the name is in use: the project is the person's, not this run's): run no link; the Vercel setup ends there, and with the checkout linked to no project its CLI stops and the hold on pushes goes. Go on as "A step fails before the test drive is pushed" says, naming the project under "What was skipped, and why". When `.vercel/project.json` was in the checkout before the run, that link is not this run's, and the hold on pushes stays, by design: no test drive, as "No preview for the pushed test drive" says, and the report says under "What was skipped, and why" that the person removes `.vercel/project.json` or links the project themselves and runs the setup again.
 3. **Connect the repository, and lock the project before its first deployment**, with impeccable_vercel_connect: it runs the connection on the linked project, when that project is the one step 2 created or one connected to this repository already, asks the person for Vercel's GitHub app's access when the app cannot reach the repository, and then, on a project with no production deployment, puts Vercel's login in front of every address of the project, its own included. Vercel makes a new project's first deployment Production whatever branch it builds and serves it at the project's own address, and the test drive's push is that first deployment. When Vercel refuses the lock, the tool asks the person on one screen to turn it on in the project's settings and waits for it. Done when it answered `connected: true` with `production: "exists"` or `locked: true`; a project connected by the link already is, and it says so.
@@ -19,7 +19,7 @@ The checkout is set up for Vercel (`vercel.json`, `.vercel/project.json`, a `ver
 
 - **The live app**: a project created here has none yet, which the report says; one that deploys production already (`production: "exists"`) answers its address as `productionUrl`, and live-app-address says how it becomes the before.
 - **The aim** holds here: the CLI does the work, and the person is asked only what the playbook's aim allows.
-- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the team skipped, the project not created, the repository not connected, or step 3 answering that the linked project is not this run's: `vercel link` linked one of the person's projects, named like the folder, which is left as it is): the Vercel setup ends there. Set the preview up as server-previews or static-site says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Vercel's GitHub app access to the repository", with the `access` page in the report.
+- **A step fails before the test drive is pushed** (the sign-in skipped or not completed, the team skipped, the project not created, the repository not connected, or step 3 answering that the linked project is not this run's: `vercel link` linked one of the person's projects, named like the folder, which is left as it is): the Vercel setup ends there. Set the preview up as server-previews says, say under "What was skipped, and why" what stopped it, and put the person's step in `left` when there is one, such as "Give Vercel's GitHub app access to the repository", with the `access` page in the report.
 - **`pullRequestPreviews` in impeccable_hosted_previews' answer**: what vercel.json and the linked project say of the test drive's branch, read with the evidence and never changed by the run, since the setting is the repository's own or has no command (impeccable_enable_previews takes no Vercel). `enabled: false` (`git.deploymentEnabled` in vercel.json turns the branch off, or Vercel records no deployments on GitHub, where Impeccable finds its previews): the Vercel setup ends before step 4, as "A step fails before the test drive is pushed" says, and say in one line under "What was skipped, and why" that Vercel builds no preview of the pull requests, with the `reason`, and the exact change for the person: the vercel.json rule to lift, or Vercel GitHub deployments under the project's Settings → Git. `enabled: 'unknown'` (an Ignored Build Step decides commit by commit, or the CLI could not read the project): go on, and say so in one line under "What is not verified".
 - **A push before step 3** is refused, since a connected project builds every push: run impeccable_vercel_connect first.
 - **On a repository with several apps**, the project step 2 creates builds the repository's root: impeccable_vercel_connect connects and locks it only where an app this run sets up is the root's, and otherwise answers so, and the Vercel setup ends there for that app, as "A step fails before the test drive is pushed" says.

package/dist/playbook.js

@@ -12,7 +12,7 @@ export function loadCases(directory = new URL('./playbook/cases/', import.meta.u
 }
 /** The system prompt: the setup, its steps, then the reference and the cases. The instructions JSON carries every write shape and the fence decides what runs; this restates neither. */
 export function playbook(repo) {
-    return `You are Impeccable's setup agent, in a checkout of ${repo.owner}/${repo.name} on the person's own machine. This setup covers one situation: Impeccable previews the repository's web front end, taking the previews its host deploys for pull requests (vercel-previews, netlify-previews, cloudflare-previews, or vercel-setup and netlify-setup, which turn them on) or, for a static site, building it itself through the workflow the setup state generates (\`static-upload\`), and signs in with the app's own username-or-email-and-password accounts when it has a sign-in. You read files and run commands here, save Impeccable's settings with the impeccable_* tools, and open pull requests as the person. The person watches this terminal, and a web page mirrors your tasks and the report.
+    return `You are Impeccable's setup agent, in a checkout of ${repo.owner}/${repo.name} on the person's own machine. This setup covers one situation: Impeccable previews the repository's web front end, taking the previews its host deploys for pull requests (vercel-previews, netlify-previews, cloudflare-previews, or vercel-setup and netlify-setup, which turn them on) and signs in with the app's own username-or-email-and-password accounts when it has a sign-in. You read files and run commands here, save Impeccable's settings with the impeccable_* tools, and open pull requests as the person. The person watches this terminal, and a web page mirrors your tasks and the report.
 
 # The aim
 Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's, Cloudflare's, signed in as the person), through the commands the fence runs and the impeccable_* tools, and find your own way past a roadblock instead of handing it to the person. Ask the fewest questions possible: a sign-in where a CLI is signed out, and a yes before anything in their account changes (*"Make your previews public, so reviews can open them?"*). Set the live app's address as the before yourself where the host or the README names it (live-app-address): the host's own address of the connected project changes nothing of theirs, so it takes no question. **A step for the person is the last resort**, only where no command the fence runs and no tool can do it; a refusal is final, as Commands says.
@@ -21,7 +21,7 @@ Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's,
 
 1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\` and \`workflowStanding\`, whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
-3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says when the pages need a server, and as the static-site case says when they do not; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
+3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
 4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.
@@ -62,7 +62,7 @@ Keep secrets out of files, settings and messages: the workflow names a repositor
 ## Voice
 The person reads your [STATUS] lines, task titles and questions, here and on the web page: calm, specific, one line each.
 - **[STATUS] lines**: start each step's message with one, a present-tense verb phrase of at most 70 characters saying what is happening (*"Running the build"*, *"Opening the test drive"*), or a short finding (*"Next.js 16, pnpm, Prisma on SQLite. No hosting found."*). impeccable_progress refuses a line that narrates like an assistant: write *"Reading the deploy workflows"*, not *"I'm trying to work out how the app deploys."* Detail belongs in the report.
-- **Tasks**: after each task, call impeccable_progress with the whole list. Titles are short noun phrases the person recognizes, the same every run where they fit: Read the repository, Apps (on a repository with several apps), Install and build, Preview method, Preview workflow, Sign-in, Test drive, Setup pull request. The list carries only what this run does: add a task when its case starts, never before, and leave off a task no case of this run takes, such as Preview workflow and Setup pull request where a host builds the previews (impeccable_progress refuses them once its previews are the method). Mark a task completed only once its result is saved, and a task completed stays so: Preview method once a method is saved, so where the test drive's preview is what proves the method (a host's previews with no pull request yet), it waits as pending while Test drive is in progress and is completed with the save. Mark a task skipped only when the person skipped it, and failed only when it was tried and failed. One task is in progress at a time, and every status line is the detail of that task (*"Installing with pnpm"* while Install and build is in progress); impeccable_progress refuses a status line about another task.
+- **Tasks**: after each task, call impeccable_progress with the whole list. Titles are short noun phrases the person recognizes, the same every run where they fit: Read the repository, Set up monorepo apps (on a repository with several apps), Install and build, Preview method, Preview workflow, Sign-in, Test drive, Setup pull request. The list carries only what this run does: add a task when its case starts, never before, and leave off a task no case of this run takes, such as Preview workflow and Setup pull request where a host builds the previews (impeccable_progress refuses them once its previews are the method). Mark a task completed only once its result is saved, and a task completed stays so: Preview method once a method is saved, so where the test drive's preview is what proves the method (a host's previews with no pull request yet), it waits as pending while Test drive is in progress and is completed with the save. Mark a task skipped only when the person skipped it, and failed only when it was tried and failed. One task is in progress at a time, and every status line is the detail of that task (*"Installing with pnpm"* while Install and build is in progress); impeccable_progress refuses a status line about another task.
 - **Questions**: one sentence, at most one hint line, and a title that names the subject.
 
 ## The report
@@ -74,7 +74,7 @@ impeccable_report ends the run: no tool or model call works after it, so call it
 ## What was skipped, and why
 [ends with the "Not part of this setup" line]
 ## What is not verified
-[everything you did not see working]
+[each part of the setup you did not see working: a preview, a proof, a check, a sign-in, a secret. Not what a page shows, such as a README's manual check of a page's content or data: the review renders the page]
 ## Before you merge
 \`\`\`
 

package/dist/sandbox.js

@@ -617,10 +617,9 @@ export async function startSandbox(o) {
             }
         },
     };
-    const proven = "the preview job on the pull request proves a static site's build instead";
     return {
         warning: off && `${off[0].toUpperCase()}${off.slice(1)}, so the setup's commands run without a sandbox, with all your access.`,
-        noPreview: off ? `The local preview check, which needs a sandbox of its own, does not run either; ${proven}.` : platform === 'linux' ? `On Linux bubblewrap keeps the app from the local preview check, so the check does not run here; ${proven}.` : undefined,
+        noPreview: off ? `The local preview check, which needs a sandbox of its own, does not run either.` : platform === 'linux' ? `On Linux bubblewrap keeps the app from the local preview check, so the check does not run here.` : undefined,
         shell,
         finish: () => watched.settle(),
         preview(folder) {

package/dist/tools.js

@@ -10,9 +10,9 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
-import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, vercelDeploymentOf } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
@@ -167,6 +167,22 @@ export function ending(report) {
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
 export const nothingToMerge = (host) => `Nothing to merge: ${host} hosts your previews, so the repository needed no change.`;
+/** The last screen's line for each host, in the order first met: "Cloudflare: Acme's Account · project crewline", "Netlify: team Acme · site crewline", "Vercel: team acme · project crewline" (#360). */
+export function hostLines(used) {
+    const byHost = new Map();
+    for (const u of used) {
+        const entry = byHost.get(u.host) ?? { accounts: new Set(), projects: new Set() };
+        if (u.account)
+            entry.accounts.add(u.account);
+        entry.projects.add(u.project);
+        byHost.set(u.host, entry);
+    }
+    return [...byHost].map(([host, { accounts, projects }]) => {
+        const what = host === 'Netlify' ? 'site' : 'project';
+        const account = accounts.size ? `${host === 'Cloudflare' ? '' : 'team '}${[...accounts].join(', ')} · ` : '';
+        return `${host}: ${account}${projects.size > 1 ? `${what}s` : what} ${[...projects].join(', ')}`;
+    });
+}
 const PROGRESS = {
     type: 'object',
     additionalProperties: false,
@@ -229,6 +245,14 @@ const TEST_PR = {
 const APP_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 /** The app a host tool reads for, on a repository with several apps: its previews are those of the project or site that builds the app's folder. */
 const APP_KEY = { type: 'string', minLength: 1, description: 'On a repository with several apps, the key of the app this is for, one the apps question picked: only the previews of the host project that builds that app\'s folder are read.' };
+const VERCEL_BYPASS = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        appKey: APP_KEY,
+        beforePush: { type: 'boolean', description: "True before the test drive's push on Vercel, where no preview met Vercel's login yet: reads whether the project's previews are protected and asks the consent now, before anything is pushed." },
+    },
+};
 const HOSTED_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
@@ -1584,6 +1608,27 @@ export function createTools(ctx) {
     /** Whether any preview write with a method was taken this run, and the host's lock the last gated proof met: the last screen names it when no preview ever opened (#321), and Preview method is completed only once a method is saved (#322). */
     let methodSaved = false;
     let lastLock;
+    /** The host preview addresses a proof or a host's key opened, and the Cloudflare account and Netlify team of each project or site the host tools read, by host and project: the last screen names them (#360), and no tool's answer does. */
+    const usedPreviews = new Set();
+    const accountOf = new Map();
+    /** The Vercel project the bypass tool read for each address its secret opened, and its team where that is not the CLI's current scope. */
+    const vercelNamed = new Map();
+    /** What the last screen says the run used on each host, from the previews it opened. */
+    const hostsUsed = () => [...usedPreviews].flatMap((url) => {
+        const origin = new URL(url).origin;
+        const label = pagesProject(origin);
+        if (label)
+            return [{ host: 'Cloudflare', project: label, ...(accountOf.has(`cloudflare ${label}`) ? { account: accountOf.get(`cloudflare ${label}`) } : {}) }];
+        const site = netlifySiteOf(url);
+        if (site)
+            return [{ host: 'Netlify', project: site, ...(accountOf.has(`netlify ${site}`) ? { account: accountOf.get(`netlify ${site}`) } : {}) }];
+        const read = vercelNamed.get(origin);
+        const named = read?.project ?? listedApps.get(origin)?.name;
+        const vercel = vercelDeploymentOf(url, named);
+        const team = vercel?.team ?? read?.team;
+        const project = vercel?.project ?? named;
+        return project ? [{ host: 'Vercel', project, ...(team ? { account: team } : {}) }] : [];
+    });
     /**
      * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
      * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
@@ -1641,6 +1686,8 @@ export function createTools(ctx) {
     const bypassOrigins = new Map();
     /** What impeccable_vercel_bypass answered for a store, less the secret: a skip is asked once, so that answer stands. */
     const bypassOutcomes = new Map();
+    /** The stores whose consent was given before the test drive's push, each with the project it named (`<store>/<projectId>`): the call once the gate is met asks no second time for that project alone. */
+    const bypassConsented = new Set();
     /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
     let sitePassword;
     const passwordSites = new Set();
@@ -1659,6 +1706,8 @@ export function createTools(ctx) {
     let accessStored = false;
     /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
     let accessOutcome;
+    /** The Access applications, by id, the person said yes to a token for. */
+    const accessConsented = new Set();
     /** What each host's settings last said of its pull-request previews, as the evidence tools read them: the one fact impeccable_enable_previews acts on. */
     const previewFacts = new Map();
     /** What impeccable_enable_previews answered for a host: asked once, so that answer stands. */
@@ -2349,13 +2398,16 @@ export function createTools(ctx) {
             if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
                 return "Refused: beforeUrl is the live app's address that impeccable_prove_preview opened with this app in this run (the production address a host tool answered, or the one the README names), or a page on it; an address no key opens is not set, and a saved one is never cleared from here. Nothing was saved.";
             }
-            // One app's before is its own: the production address its own project or site answered, or one a file in its own folder names.
+            // One app's before is its own: the production address its own project or site answered, or one a file in its own folder names, or a line of the root README that names that app and no other (#367).
             if (appsRepo && target.url.endsWith('/preview') && saved && typeof saved.beforeUrl === 'string') {
                 const origin = new URL(saved.beforeUrl).origin;
                 const owner = liveApps.get(origin);
                 const folder = await appFolder(pi, String(saved.appKey));
-                if (owner !== undefined ? owner !== saved.appKey : folder === undefined || !(await checkoutNames(pi.cwd, origin, folder))) {
-                    return `Refused: ${origin} is not the live address of ${String(saved.appKey)}: it is another app's, or no file in that app's folder names it. Nothing was saved.`;
+                const app = knownApps?.find((a) => a.key === saved.appKey);
+                const named = async () => folder !== undefined && ((await checkoutNames(pi.cwd, origin, folder))
+                    || (app !== undefined && (await readmeNamesApp(pi.cwd, origin, app, (knownApps ?? []).filter((a) => a.key !== app.key)))));
+                if (owner !== undefined ? owner !== saved.appKey : !(await named())) {
+                    return `Refused: ${origin} is not the live address of ${String(saved.appKey)}: it is another app's, or neither a file in that app's folder nor a line of the root README that names that app (and no other) names it. Nothing was saved.`;
                 }
             }
             const testAccounts = target.url.endsWith('/test-accounts');
@@ -2389,8 +2441,6 @@ export function createTools(ctx) {
                 confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
                 const keys = object(object(response.data)?.keys);
-                if (keys?.intendedMethod === 'stored' && object(p.body)?.intendedMethod === 'static-upload')
-                    retry.requireHistory = true;
                 if (object(p.body)?.intendedMethod === 'preview-deploy')
                     savedHost = provenHost;
                 if (saved?.appKey !== undefined)
@@ -2615,7 +2665,8 @@ export function createTools(ctx) {
                 return `Error: the report was refused (${res.status}: ${res.error}). Fix what it says and call impeccable_report again.`;
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock } : {}) });
+            const hosts = hostLines(hostsUsed());
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock } : {}), ...(hosts.length ? { hosts } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -2625,6 +2676,9 @@ export function createTools(ctx) {
             const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
                 return refused;
+            // The bypass secret skipped: Vercel's login keeps the test drive's preview from the review, so there is none to wait for (#356).
+            if (branch !== undefined && bypassOutcomes.get(appsRepo ? p.appKey : '')?.status === 'skipped')
+                return "Refused: the person skipped the bypass secret, and Vercel's login stands in front of the previews, so the test drive's preview could not be reviewed: push and open no test drive, as preview-protection's step 3 says. Nothing was read.";
             // The fact, the live app and an app's project read the same projects: each `vercel api` call is made once.
             const reads = new Map();
             const vercel = (args) => {
@@ -2734,7 +2788,9 @@ export function createTools(ctx) {
             const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
             if (appKey !== undefined && directory === undefined)
                 return JSON.stringify({ appKey, sites: [], previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
-            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, ...(directory !== undefined ? { directory } : {}) });
+            // Each site's team is for the last screen alone.
+            const onTeams = (teams) => Object.entries(teams).forEach(([name, team]) => accountOf.set(`netlify ${name}`, team));
+            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, onTeams, ...(directory !== undefined ? { directory } : {}) });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
@@ -2785,7 +2841,9 @@ export function createTools(ctx) {
             const appProject = appKey !== undefined ? cloudflareApps.get(appKey) : undefined;
             if (appKey !== undefined && (pull !== undefined || branch !== undefined) && !appProject)
                 return `Refused: read impeccable_cloudflare_previews with appKey ${appKey} and no pull or branch first: it tells which Pages project builds that app.`;
-            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
+            // The name of the account the project was found in is for the last screen alone.
+            let accountName;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
             const read = async () => {
                 const evidence = await readAll();
                 return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
@@ -2800,6 +2858,10 @@ export function createTools(ctx) {
             const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false } : undefined;
             const waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
             const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
+            // By the label the project's addresses carry.
+            const label = (evidence.production && pagesProject(evidence.production)) || evidence.project;
+            if (accountName && label && !evidence.unmatched)
+                accountOf.set(`cloudflare ${label}`, accountName);
             if (!subject)
                 cloudflareEvidence = evidence;
             if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project) {
@@ -2857,6 +2919,8 @@ export function createTools(ctx) {
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
+            if (proof.proven)
+                usedPreviews.add(url);
             if (proof.proven && app)
                 proveApp(app.appKey, url);
             if (proof.proven && app)
@@ -2867,8 +2931,16 @@ export function createTools(ctx) {
                 lockPending.set(app.appKey, proof.gate);
                 provenApps.delete(app.appKey);
             }
-            if (proof.gate && Object.hasOwn(LOCKS, proof.gate))
+            if (proof.gate && Object.hasOwn(LOCKS, proof.gate)) {
                 lastLock = proof.gate;
+                // Pristine learns the lock from the session, proven past or not, for a preview it may never meet itself (#365): an app's on its summary, a repository of one app's beside them.
+                const met = { gate: lastLock, preview_host: new URL(url).hostname };
+                // The app is proven again only once something opens it, as `provenApps` has it.
+                if (app)
+                    noteApp(app.appKey, { ...met, preview_proven: false });
+                else if (!appsRepo)
+                    ctx.sync.update({ preview_gate: met });
+            }
             if (proof.proven)
                 provePattern(proof.pattern, app?.appKey);
             if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
@@ -2956,7 +3028,7 @@ export function createTools(ctx) {
                 return `Refused: the Pages project ${fact.project} is connected to the repository, and its settings turn pull-request previews off: impeccable_enable_previews turns them on.`;
             const create = !fact;
             if (create && !evidence.worker && !evidence.project)
-                return 'Refused: nothing says the repository is set up for Cloudflare: no Pages project is built from it, the checkout names none, and no Worker is built from it. Set the preview up as the server-previews or static-site case says.';
+                return 'Refused: nothing says the repository is set up for Cloudflare: no Pages project is built from it, the checkout names none, and no Worker is built from it. Set the preview up as the server-previews case says.';
             const project = fact?.project || evidence.project || pagesProjectName(ctx.repo);
             const answer = (status, more) => {
                 connectOutcome = { status, project, created: create, ...more };
@@ -3014,23 +3086,40 @@ export function createTools(ctx) {
             noteProduction(answer.productionUrl, 'vercel', undefined, connectedApp);
             return JSON.stringify(answer);
         }),
-        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts), or, with no such file, the one Vercel lists as connected to this repository, so no vercel link is needed (where the CLI is signed out, the consent screen comes first and its yes signs it in, in the browser), and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
-            if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
-                return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
-            const at = gated;
-            if (at.app)
+        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts), or, with no such file, the one Vercel lists as connected to this repository, so no vercel link is needed (where the CLI is signed out, the consent screen comes first and its yes signs it in, in the browser), and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back. With beforePush (and the app\'s appKey on a repository with several apps), before the test drive\'s push, where no preview met Vercel\'s login yet (#356): it reads the project the same way, and where its settings show Deployment Protection in front of the previews and it holds no secret labelled "Impeccable reviews", shows the consent screen now, naming the project and the app, so the person answers before anything is pushed; the secret is made on the yes once the test drive\'s preview meets the login, with no second question. Answers {"protected": false} (no lock: push), {"protected": true, "consent": "given" or "not-needed"} (push, and call this again without beforePush once the proof meets the gate), {"protected": "unknown", "reason": …} (the project could not be read: push, and the consent comes when the gate is met) or {"status": "skipped", …} (push no test drive; reason says why).', VERCEL_BYPASS, async (p, pi, signal) => {
+            const before = p.beforePush === true;
+            if (before) {
+                const refused = appRefusal(p.appKey, 'asked');
+                if (refused)
+                    return refused;
+            }
+            else if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
+                return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first, or call it with beforePush before the test drive\'s push.';
+            const at = before ? undefined : gated;
+            if (at?.app)
                 lockPending.delete(at.app.appKey);
-            const { origin, host } = new URL(at.url);
+            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+            // Before the push, the app's project as impeccable_hosted_previews reads it: the one that builds the app's folder (#281).
+            let app = at?.app;
+            if (before && appsRepo) {
+                const read = await vercelApp(pi, p.appKey, vercel);
+                if ('reason' in read)
+                    return JSON.stringify({ appKey: p.appKey, protected: 'unknown', reason: read.reason });
+                app = { appKey: p.appKey, link: read.link, name: read.name };
+            }
             // Where the setup API keeps the secret: the app's own on a repository with several apps, else the repository's.
-            const store = at.app?.appKey ?? '';
+            const store = app?.appKey ?? '';
             const asked = bypassOutcomes.get(store);
             if (asked?.status === 'skipped')
                 return JSON.stringify(asked);
+            /** What stops the tool before the project is vouched for: the address got nothing, or, before the push, the lock is not known yet and the gate's call asks. */
+            const nothing = (why) => (at ? `Refused: nothing was sent to ${at.url}. ${why}` : JSON.stringify({ ...(app ? { appKey: app.appKey } : {}), protected: 'unknown', reason: why }));
+            /** The consent screen, naming the project and the app once they are known (#358). */
+            const consentScreen = (project) => vercelBypassConsent(project ?? app?.name, app && appName(app.appKey));
             // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project has to have
             // made the deployment before any secret of it goes there. That project is the app's own on a repository with several apps (#281), else the one the link file names,
             // else the one Vercel lists as connected to this repository (#310).
-            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
-            const fileLink = at.app ? null : await readLink(pi.cwd);
+            const fileLink = app ? null : await readLink(pi.cwd);
             /** The consent screen's yes, given before Vercel's sign-in, stands for the secret: it is not asked again. */
             let consented = false;
             /**
@@ -3044,7 +3133,7 @@ export function createTools(ctx) {
                     bypassOutcomes.set(store, outcome);
                     return JSON.stringify(outcome);
                 };
-                if ((await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped)
+                if ((await ask(consentScreen())).skipped)
                     return skip('The person skipped creating a bypass secret.');
                 consented = true;
                 const agreed = hostSetupAgreed(ctx.log, 'vercel');
@@ -3067,23 +3156,23 @@ export function createTools(ctx) {
             // A folder Vercel deploys from GitHub has no link file unless vercel link ran in it (the file is gitignored), so the project is found on Vercel by this repository,
             // with the CLI signed in as the person.
             let found;
-            if (!at.app && !fileLink) {
+            if (!app && !fileLink) {
                 const cli = (await vercelStatus(vercel)).cli;
                 const stop = cli === 'signed-out' ? await signIn() : null;
                 if (stop)
                     return stop;
                 const listed = cli === 'missing' ? { reason: 'The Vercel CLI is not installed here.' } : await vercelRepoProject(vercel, repository);
                 if ('reason' in listed)
-                    return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and Vercel named none for this repository: ${listed.reason} A bypass secret goes only to a preview the repository's project serves.`;
+                    return nothing(`This folder is linked to no Vercel project (.vercel/project.json), and Vercel named none for this repository: ${listed.reason} A bypass secret goes only to a preview the repository's project serves.`);
                 found = listed;
             }
-            const link = at.app?.link ?? fileLink ?? found.link;
+            const link = app?.link ?? fileLink ?? found.link;
             // Once this run's own vercel link wrote the file, only that link counts, as impeccable_vercel_connect holds it: rewritten since, it would name another project of the person's. A project the person linked before the run has no such record, and the reads below vouch for it.
             // An app's project, and one found with no link file, are read from Vercel's list of this repository's projects, never from the file.
             const links = linkedByRun(ctx.log);
             const own = links.get(link.projectId);
             if (fileLink && [...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
-                return `Refused: nothing was sent to ${at.url}. This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.`;
+                return nothing("This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.");
             let project = await readOwnProject(vercel, link, repository);
             // A linked project, or an app's, read nothing because the CLI is signed out: the same sign-in, then the read again.
             if ('reason' in project && !consented && (await vercelStatus(vercel)).cli === 'signed-out') {
@@ -3092,9 +3181,27 @@ export function createTools(ctx) {
                     return stop;
                 project = await readOwnProject(vercel, link, repository);
             }
-            const which = at.app ? 'The Vercel project that builds this app' : found ? 'The Vercel project connected to this repository' : 'The Vercel project this folder is linked to';
+            const which = app ? 'The Vercel project that builds this app' : found ? 'The Vercel project connected to this repository' : 'The Vercel project this folder is linked to';
             if ('reason' in project)
-                return `Refused: nothing was sent to ${at.url}. ${project.reason} A bypass secret goes only to a preview the linked project serves.`;
+                return nothing(`${project.reason} A bypass secret goes only to a preview the linked project serves.`);
+            if (!at) {
+                // Before the push: the project's settings say whether Vercel's login will stand in front of the test drive's preview, and the consent is asked now (#356).
+                const of = { ...(app ? { appKey: app.appKey } : {}), ...(project.name ? { project: project.name } : {}) };
+                if (!project.previewsProtected)
+                    return JSON.stringify({ ...of, protected: false });
+                // A secret this run saved for the same store and project, or one labelled for Impeccable, opens the test drive's preview with no question; a yes given already stands.
+                const held = bypassHeld.get(store);
+                if (project.bypassLabelled || held?.projectId === link.projectId)
+                    return JSON.stringify({ ...of, protected: true, consent: 'not-needed' });
+                if (consented || bypassConsented.has(`${store}/${link.projectId}`) || !(await ask(consentScreen(project.name))).skipped) {
+                    bypassConsented.add(`${store}/${link.projectId}`);
+                    return JSON.stringify({ ...of, protected: true, consent: 'given' });
+                }
+                const outcome = { status: 'skipped', ...of, protected: true, reason: `The person skipped creating a bypass secret before the test drive's push. Vercel's login stands in front of the previews of ${project.name ? `the Vercel project ${project.name}` : 'the Vercel project'}, so a test drive pushed now could not be reviewed. A secret made in the project's Settings → Deployment Protection → Protection Bypass for Automation, named "Impeccable reviews", and saved on the setup page lets reviews in.` };
+                bypassOutcomes.set(store, outcome);
+                return JSON.stringify(outcome);
+            }
+            const { origin, host } = new URL(at.url);
             // The page at the address is the deployment's to word, whatever host it is on, so the lock is told from the project's settings, read as the person: with none, no login of Vercel's stood in front.
             if (!project.previewsProtected && lastLock === 'vercel-protection')
                 lastLock = undefined;
@@ -3107,6 +3214,8 @@ export function createTools(ctx) {
                 bypassOrigins.set(origin, store);
                 hostedPreviewProven = true;
                 provenHost = 'Vercel';
+                usedPreviews.add(at.url);
+                vercelNamed.set(origin, { ...(project.name ? { project: project.name } : {}), ...(found?.scope ? { team: found.scope } : {}) });
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
             };
@@ -3123,7 +3232,8 @@ export function createTools(ctx) {
                 link: async () => link,
                 // A project the folder is not linked to is named on the CLI's reads and makes, in its own team; the reads are held to its id all the same.
                 ...(at.app?.name ? { project: at.app.name } : found ? { project: found.name, ...(found.scope ? { scope: found.scope } : {}) } : {}),
-                consent: async () => consented || !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
+                // A yes before the push stands for this secret: the gate's call asks no second time (#356).
+                consent: async () => consented || bypassConsented.has(`${store}/${link.projectId}`) || !(await ask(consentScreen(project.name))).skipped,
                 paste: async (stopped) => {
                     // This project's own settings page, under its own team (the one its ids name, as the CLI lists the person's teams): never another project of the account's.
                     (ctx.openBrowser ?? openBrowser)(await vercelPageFor(vercel, link, 'settings/deployment-protection', project.name));
@@ -3243,6 +3353,7 @@ export function createTools(ctx) {
                 // The site is public now: its previews open with nothing sent.
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 provePattern(pattern, at.app?.appKey);
@@ -3254,6 +3365,7 @@ export function createTools(ctx) {
                 passwordSites.add(site);
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 provePattern(pattern, at.app?.appKey);
@@ -3267,7 +3379,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(passwordOutcome);
         }),
-        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview (an application whose policies are its own gets one screen asking to make them reusable first, and on its skip the paste screen says how to make the token by hand); one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, naming the Access application in front of the preview and its Cloudflare account once cf, signed in here, found it (none found: refused, and nothing asked), Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview (an application whose policies are its own gets one screen asking to make them reusable first, and on its skip the paste screen says how to make the token by hand); one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
             const at = accessGated;
@@ -3305,7 +3417,15 @@ export function createTools(ctx) {
             else {
                 answer = await passCloudflareAccess({
                     url: at.url,
-                    consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
+                    // Named once the Access application was found (#357), and asked once per application: a yes stands for another app's previews it covers.
+                    consent: async (found) => {
+                        if (found && accessConsented.has(found.id))
+                            return true;
+                        const yes = !(await ask(sentTo(found ? cloudflareAccessConsent(found, new URL(at.url).host, at.app && appName(at.app.appKey)) : HOST_SCREENS['cloudflare-access'], at.url))).skipped;
+                        if (yes && found)
+                            accessConsented.add(found.id);
+                        return yes;
+                    },
                     cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
                     login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
@@ -3342,6 +3462,7 @@ export function createTools(ctx) {
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
                 provenHost = 'Cloudflare Pages';
+                usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 provePattern(pattern, at.app?.appKey);

package/dist/ui/look.js

@@ -113,6 +113,8 @@ const pullAction = (url, copied, inner, st) => [
     copied ? center(st.soft('Copied to clipboard!'), inner) : copyWay(inner, st),
 ];
 /** What waits on the person, under the supporting text: two lines at most, the rest counted. */
+/** The hosts the run used, a line each under the result. */
+const usedLines = (outro, inner, st) => (outro.used ?? []).flatMap((line) => said(line, inner, st));
 function leftLines(todo, inner, st) {
     const shown = todo.length > 2 ? [todo[0], `${todo.length - 1} more in the report`] : todo;
     return shown.map((line) => center(st.soft(`→ ${line}`), inner));
@@ -255,12 +257,10 @@ function runPage(scene, f, inner, st) {
         const waiting = row(`waiting for ${scene.wait.host ? `${scene.wait.host}'s preview` : 'the preview'} · ${scene.wait.timer}`);
         return ink(visibleWidth(waiting) <= inner ? waiting : row(scene.wait.timer));
     });
-    const counted = scene.tasks.filter((t) => t.status !== 'skipped');
-    const skipped = scene.tasks.length - counted.length;
     const widest = Math.max(...lines.map((line) => visibleWidth(line)));
+    // No count over the list: the list shows each task's state itself.
     return {
         heading: 'Setting up',
-        text: said(`${counted.filter((t) => t.status === 'completed').length} of ${counted.length} done${skipped ? ` · ${skipped} skipped` : ''}`, inner, st),
         rule: divider(inner, st),
         action: block(lines, inner, widest),
         at: running >= 0 ? running : Math.max(0, scene.tasks.findIndex((t) => t.status === 'pending')),
@@ -273,7 +273,7 @@ function outroPage(scene, inner, st) {
         return {
             heading: outro.title,
             // A warning is read whole: wrapped, where centered on one line it would be cut.
-            text: [...said(outro.result, inner, st), ...leftLines(outro.todo, inner, st), ...outro.warnings.flatMap((line) => said(`! ${line}`, inner, st))],
+            text: [...said(outro.result, inner, st), ...usedLines(outro, inner, st), ...leftLines(outro.todo, inner, st), ...outro.warnings.flatMap((line) => said(`! ${line}`, inner, st))],
             rule: divider(inner, st),
             action: pullAction(outro.link, scene.copied, inner, st),
             ways: scene.leaving ? undefined : [['Close', 'Enter']],
@@ -285,7 +285,7 @@ function outroPage(scene, inner, st) {
     const links = outro.links.flatMap((l) => linkLines(l.label, l.url, inner, st));
     return {
         heading: outro.title,
-        text: said(outro.result, inner, st),
+        text: [...said(outro.result, inner, st), ...usedLines(outro, inner, st)],
         rule: divider(inner, st),
         action: [...block(notes, inner), ...(notes.length && links.length ? [''] : []), ...links, ...(outro.links.length === 1 ? [scene.copied ? center(st.soft('Copied to clipboard!'), inner) : copyWay(inner, st)] : [])],
         ways: scene.leaving ? undefined : [['Close', 'Enter']],

package/dist/ui/run-state.js

@@ -83,9 +83,4 @@ export class RunState {
             return { previous: this.current, current: `Still working… ${elapsed(silence)}` };
         return { previous: this.previous, current: this.current };
     }
-    /** Completed tasks out of all but the skipped ones. */
-    progress() {
-        const counted = this.tasks.filter((t) => t.status !== 'skipped');
-        return { completed: counted.filter((t) => t.status === 'completed').length, total: counted.length };
-    }
 }