@impeccable/reviews 0.1.17 → 0.1.19

package/README.md

@@ -15,7 +15,7 @@ npx @impeccable/reviews
 
 `npm install -g @impeccable/reviews` puts the `impeccable-reviews` command on your PATH instead.
 
-Your browser opens Impeccable's consent page; after Approve it goes on to the run's web page. Keep that tab open: it shows the task list, a question waiting for you, the pull requests and, at the end, the report and the review. The terminal takes over its window while it works, one screen at a time in the same frame (the start; the sign-in, its link copied to the clipboard when you press C; understanding your app; a question when it needs you; the tasks; the test drive, then the setup pull request, each opened in your browser and copied to the clipboard as its screen appears), and gives it back with a short summary: the outcome, the test drive, the setup pull request, the web page and what is left for you. What the agent writes there (its status lines, the tasks, its questions, what is left and the report) shows as plain text: an escape sequence that would have the terminal write the clipboard, retitle the window, link words to another address or clear the screen is taken out, and the agent's status line or line of what is left that holds one is refused.
+Your browser opens Impeccable's consent page; after Approve it goes on to the run's web page. Keep that tab open: it shows the task list, a question waiting for you, the pull requests and, at the end, the report and the review. The terminal takes over its window while it works, one screen at a time in the same frame (the start; the sign-in, its link copied to the clipboard when you press C; understanding your app; a question when it needs you; the tasks; the test drive, then the setup pull request, each opened in your browser and copied to the clipboard as its screen appears), and gives it back with a short summary: the outcome, the account or team and the project or site it used on each host whose preview it opened, the test drive, the setup pull request, the web page and what is left for you. What the agent writes there (its status lines, the tasks, its questions, what is left and the report) shows as plain text: an escape sequence that would have the terminal write the clipboard, retitle the window, link words to another address or clear the screen is taken out, and the agent's status line or line of what is left that holds one is refused.
 
 Keys: Enter goes on, Esc cancels the intro or the sign-in and skips a question (every question can be skipped); on the run screen, Esc twice (or Ctrl+C) stops the run. A screen taller than the terminal scrolls with ↑↓ and PgUp PgDn (↑↓ still move among a question's choices). The screens are black and white, with emphasis by intensity: greys on a terminal that takes true colour and reports its background, bold and dim elsewhere, and under `NO_COLOR`. The mark at the top is the logo's own image in a terminal that shows images (iTerm2, kitty, Ghostty, WezTerm; never under tmux), a square with its slash beside the letter-spaced wordmark elsewhere, and plain text on a dumb terminal.
 

package/dist/cloudflare-access.js

@@ -104,9 +104,9 @@ const granted = (s) => s.cli === 'signed-in' && (!s.scopes || ACCESS_SCOPES.ever
  * a retry, and two failed retries end it. The new sign-in asks for the scopes it held as well, so whatever else the
  * person uses cf for goes on working.
  */
-async function reach(deps) {
+async function reach(deps, read) {
     const through = (s) => ({ way: throughCf(deps.cf, s.accounts, deps.signal) });
-    let status = await cfStatus(deps.cf, deps.signal);
+    let status = read;
     if (granted(status))
         return through(status);
     if (status.cli === 'missing' || status.cli === 'unknown')
@@ -196,6 +196,8 @@ async function covering(way, url) {
         return unread ? stop(way, unread, '') : { reason: `No Access application ${way.who} reaches covers ${url.host}.` };
     return { apps };
 }
+/** Why no token is made where several applications cover the address. */
+const unclear = (count, host) => `${count} Access applications cover ${host}, so which one's policy should allow the token is not clear.`;
 /**
  * As the person, the way they reach Cloudflare's API: on the one application in front of the address, the service
  * token, then a Service Auth policy that allows it. An application on reusable policies (every one the dashboard makes
@@ -208,7 +210,7 @@ async function create(way, deps, found) {
     const api = way.call;
     const url = new URL(deps.url);
     if (found.length > 1)
-        return { reason: `${found.length} Access applications cover ${url.host}, so which one's policy should allow the token is not clear.` };
+        return { reason: unclear(found.length, url.host) };
     const { account, app } = found[0];
     const base = `/accounts/${account}/access`;
     let links = list(app.policies).flatMap((p, i) => (uid(p.id) ? [{ id: p.id, precedence: typeof p.precedence === 'number' ? p.precedence : i + 1 }] : []));
@@ -313,10 +315,6 @@ export async function passCloudflareAccess(deps) {
         covered ||= 'apps' in found;
         return found;
     };
-    const build = async (way) => {
-        const found = await find(way);
-        return 'apps' in found ? create(way, deps, found.apps) : found;
-    };
     /** A token that opened the address, saved for reviews. */
     const keep = async (token, how, made = {}) => {
         const failed = await deps.save(token);
@@ -325,16 +323,37 @@ export async function passCloudflareAccess(deps) {
     /** Why the run's own way ended without a token that opens the address, for the paste screen's skip, and how to make one by hand there. */
     let stopped;
     let manual;
-    if (!(await deps.consent())) {
-        stopped = 'The person skipped creating a service token.';
-        // cf signed in here, with whatever scopes, says whether an application of the person's covers the address, since reading takes no write; a skip opens no sign-in for it.
-        const status = await cfStatus(deps.cf, deps.signal);
-        if (status.cli === 'signed-in')
-            await find(throughCf(deps.cf, status.accounts, deps.signal));
-    }
+    // cf signed in here, with whatever scopes, reads the Access application in front of the address before anything is asked, since reading takes no write
+    // (#357): none covering it asks nothing, and the consent names the one that does. Signed out, or refused the read, the consent comes first, as its yes opens
+    // the sign-in or the API token screen that finding it takes.
+    const status = await cfStatus(deps.cf, deps.signal);
+    const reads = status.cli === 'signed-in' && (!status.scopes || status.scopes.some((scope) => /^access\.(read|write)$/.test(scope)));
+    const early = reads ? await find(throughCf(deps.cf, status.accounts, deps.signal)) : undefined;
+    const apps = early && 'apps' in early ? early.apps : undefined;
+    const named = apps?.length === 1 ? apps[0] : undefined;
+    /** An application as the consent names it. */
+    const described = ({ account, app }) => ({ id: String(app.id), application: typeof app.name === 'string' && app.name ? app.name : url.host, account });
+    const SKIPPED = 'The person skipped creating a service token.';
+    if (early && 'reason' in early)
+        stopped = early.reason;
+    else if (apps && apps.length > 1)
+        stopped = unclear(apps.length, url.host);
+    else if (!(await deps.consent(named && described(named))))
+        stopped = SKIPPED;
     else {
-        const reached = await reach(deps);
-        let made = 'way' in reached ? await build(reached.way) : 'stopped' in reached ? { reason: reached.stopped } : reached;
+        /** Read anew, by a new sign-in or the API token: an application other than the one the yes named is asked about before anything is made on it. */
+        const rebuild = async (way) => {
+            const found = await find(way);
+            if (!('apps' in found))
+                return found;
+            const target = found.apps.length === 1 ? found.apps[0] : undefined;
+            if (named && target && (String(target.app.id) !== String(named.app.id) || target.account !== named.account) && !(await deps.consent(described(target))))
+                return { reason: SKIPPED };
+            return create(way, deps, found.apps);
+        };
+        const reached = await reach(deps, status);
+        // The sign-in that read the applications makes the token on the one it found, or answers the same refusal, without reading them again; a new sign-in reads its accounts.
+        let made = 'way' in reached ? (early && granted(status) ? ('apps' in early ? await create(reached.way, deps, early.apps) : early) : await rebuild(reached.way)) : 'stopped' in reached ? { reason: reached.stopped } : reached;
         let apiToken = false;
         if ('fallback' in made) {
             // Where cf's sign-in cannot make the token, an API token the person makes for the run can.
@@ -344,7 +363,7 @@ export async function passCloudflareAccess(deps) {
             else {
                 deps.remember(key);
                 apiToken = true;
-                made = await build(withApiToken(key, deps));
+                made = await rebuild(withApiToken(key, deps));
             }
         }
         if (!('token' in made)) {

package/dist/cloudflare.js

@@ -306,8 +306,9 @@ export async function cfStatus(cf, signal) {
     if (status?.authenticated !== true)
         return { cli: 'unknown', accounts: [] };
     const scopes = Array.isArray(status.scopes) ? status.scopes.filter((s) => typeof s === 'string') : undefined;
-    const accounts = list(status.accounts).map((a) => a.id).filter((id) => typeof id === 'string' && /^[0-9a-f]{32}$/.test(id));
-    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts };
+    const listed = list(status.accounts).filter((a) => typeof a.id === 'string' && /^[0-9a-f]{32}$/.test(a.id));
+    const names = Object.fromEntries(listed.flatMap((a) => (typeof a.name === 'string' && a.name && a.name.length <= 100 ? [[a.id, a.name]] : [])));
+    return { cli: 'signed-in', ...(scopes ? { scopes } : {}), accounts: listed.map((a) => a.id), ...(Object.keys(names).length ? { names } : {}) };
 }
 /** What a Pages deployment's latest stage says of its build: success once it deployed, and building until a stage failed or it was cancelled or skipped. */
 const stageState = (stage) => stage?.status === 'failure' ? 'failure' : stage?.status === 'canceled' || stage?.status === 'skipped' ? 'canceled' : stage?.status === 'success' && stage.name === 'deploy' ? 'success' : 'building';
@@ -322,7 +323,7 @@ const PAGES = 4;
  * built from another repository is not this one's.
  */
 async function fromCf(named, cf, repository, settings, signal) {
-    const { cli, scopes, accounts } = await cfStatus(cf, signal);
+    const { cli, scopes, accounts, names } = await cfStatus(cf, signal);
     const pages = !scopes || scopes.includes('pages:read') || scopes.includes('pages:write');
     if (cli !== 'signed-in' || !pages)
         return { cli, rows: [], failed: cli === 'unknown' };
@@ -361,7 +362,8 @@ async function fromCf(named, cf, repository, settings, signal) {
             subdomain = typeof ours.project.subdomain === 'string' && new RegExp(`^${LABEL}\\.pages\\.dev$`).test(ours.project.subdomain) ? ours.project.subdomain : undefined;
         }
     }
-    const settled = { ...(pullRequestPreviews ? { pullRequestPreviews } : {}), ...(account ? { account } : {}), ...(subdomain ? { subdomain } : {}) };
+    const accountName = account ? names?.[account] : undefined;
+    const settled = { ...(pullRequestPreviews ? { pullRequestPreviews } : {}), ...(account ? { account } : {}), ...(accountName ? { accountName } : {}), ...(subdomain ? { subdomain } : {}) };
     if (!project)
         return { cli, rows: [], failed: false, ...settled };
     const ours = (d) => {
@@ -450,6 +452,9 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         : cf.cli !== 'signed-in' ? `Which Cloudflare Pages project builds ${where} cannot be told: cf here is not signed in with Pages access, and only a project's settings name the folder it builds (its root directory).`
             : (cf.matching?.length ?? 0) > 1 ? `Several Cloudflare Pages projects build ${where} (${cf.matching.join(', ')}), so which one is this app's cannot be told.`
                 : !cf.project ? `No Cloudflare Pages project of this repository builds ${where} (its root directory), as far as cf here can see.` : undefined;
+    // The name of the account the project was found in goes to the last screen alone, never into the evidence (#360).
+    if (cf.accountName && !unmatched)
+        deps.onAccountName?.(cf.accountName);
     if (unmatched)
         github.previews = [];
     // A preview's address names the project's own host, which a taken name suffixes (crewline-x1y.pages.dev), not always its name.

package/dist/host-questions.js

@@ -81,6 +81,10 @@ const previewsOff = (id, name, where) => ({
         skipLabel: 'Skip',
     },
 });
+/** The consent to a Vercel bypass secret, saying whose previews Vercel's login keeps and where the secret is revoked. */
+const bypassHint = (whose, where) => `Impeccable reviews each pull request on its preview,\nand Vercel keeps ${whose} behind a login.\n\nVercel's way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time in ${where} Settings → Deployment Protection.`;
+/** The consent to a Cloudflare service token, saying which Access application keeps whose previews, and whose policy allows the token. */
+const accessHint = (keeps, policy) => `Impeccable reviews each pull request on its preview, and ${keeps} behind a login.\n\nCloudflare's way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in ${policy} policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.`;
 /** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, the consent to turning a host's pull-request previews on, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one, and to making a site behind Netlify's team login public. */
 export const HOST_SCREENS = {
     'netlify-signin-retry': { id: 'netlify-signin-retry', kind: 'confirm', title: 'Sign in to Netlify', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
@@ -138,7 +142,7 @@ export const HOST_SCREENS = {
         id: 'vercel-bypass',
         kind: 'confirm',
         title: 'Your Vercel previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview,\nand Vercel keeps yours behind a login.\n\nVercel\'s way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time in the project\'s Settings → Deployment Protection.',
+        hint: bypassHint('yours', "the project's"),
         prompt: 'Create the secret for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -193,7 +197,7 @@ export const HOST_SCREENS = {
         id: 'cloudflare-access',
         kind: 'confirm',
         title: 'Your Cloudflare previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login.\n\nCloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        hint: accessHint('Cloudflare Access keeps yours', "your Access application's"),
         prompt: 'Create the token for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -224,6 +228,17 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
+/** The consent to a Vercel bypass secret, naming the project that holds it and, on a repository with several apps, the app whose previews it opens (#358). */
+export function vercelBypassConsent(project, app) {
+    const screen = HOST_SCREENS['vercel-bypass'];
+    if (!project)
+        return screen;
+    return { ...screen, hint: bypassHint(app ? `${app}'s previews, built by the Vercel project ${project},` : `the previews of the Vercel project ${project}`, `${project}'s`) };
+}
+/** The consent to a service token, asked once the Access application in front of the preview was found (#357): that application, its Cloudflare account, and whose previews at which host it keeps. */
+export function cloudflareAccessConsent(found, host, app) {
+    return { ...HOST_SCREENS['cloudflare-access'], hint: accessHint(`the Access application "${found.application}", in the Cloudflare account ${found.account}, keeps ${app ? `${app}'s previews` : 'yours'} (${host})`, `"${found.application}"'s`) };
+}
 /** The one consent to making the Access application's own policies reusable, which the run's way through cf needs to add the token's policy (#327): the application named. */
 export function cloudflareAccessReusable(application) {
     return {

package/dist/hosted.js

@@ -1,7 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { ACCESS_ID_HEADER, ACCESS_SECRET_HEADER } from './cloudflare-access.js';
-import { basicCredentials } from './netlify-password.js';
 import { gitEnvironment } from './sandbox.js';
 import { BYPASS_HEADER } from './vercel-bypass.js';
 /**
@@ -138,6 +137,24 @@ export function netlifySiteOf(url) {
     const { hostname } = new URL(url);
     return NETLIFY.exec(hostname)?.[1] ?? LIVE.netlify.exec(hostname)?.[1] ?? null;
 }
+/**
+ * The project and team a Vercel deployment's own address names, `<project>-<hash>-<team>.vercel.app` (Vercel's generated
+ * address, its hash nine letters and digits), for the last screen (#360): only where one split fits, and that split's
+ * project is `project` where a host tool named it; null otherwise, a project's own address included, and any address
+ * with `-git-` in it, which a branch's alias `<project>-git-<branch>-<team>` has, so a branch's word is never a hash.
+ */
+export function vercelDeploymentOf(url, project) {
+    if (!URL.canParse(url))
+        return null;
+    const parsed = new URL(url);
+    if (!plainHttps(parsed) || !LIVE.vercel.test(parsed.hostname) || parsed.hostname.includes('-git-'))
+        return null;
+    const parts = parsed.hostname.slice(0, -'.vercel.app'.length).split('-');
+    const splits = parts
+        .flatMap((part, i) => (i > 0 && i < parts.length - 1 && /^[a-z0-9]{9}$/.test(part) ? [{ project: parts.slice(0, i).join('-'), team: parts.slice(i + 1).join('-') }] : []))
+        .filter((split) => project === undefined || split.project === project.toLowerCase());
+    return splits.length === 1 ? splits[0] : null;
+}
 /** The address pattern a proven preview stands for, where the host reports none to GitHub: Netlify's by pull request, Cloudflare's by the branch's alias. A live address stands for none. */
 function patternOf(hostname) {
     const site = NETLIFY.exec(hostname)?.[1];
@@ -169,17 +186,56 @@ async function checkoutHolds(root, words) {
         return false;
     }
 }
-/** Whether a file the checkout tracks (in `folder`, one app's, when given) names the address's origin as such, whole (a full stop after it is the sentence's): not as the tail of a longer host name, such as a deploy preview's of the same site. */
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+/** The address's origin as such, whole (a full stop after it is the sentence's): not as the tail of a longer host name, such as a deploy preview's of the same site. */
+const wholeOrigin = (origin) => `(^|[^A-Za-z0-9.-])${escapeRegExp(origin)}([^A-Za-z0-9.-]|\\.([^A-Za-z0-9]|$)|$)`;
+/** Whether a file the checkout tracks (in `folder`, one app's, when given) names the address's origin, whole. */
 export async function checkoutNames(root, origin, folder = '') {
-    const escaped = origin.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
     try {
-        await execFileAsync('git', ['grep', '--quiet', '--ignore-case', '--extended-regexp', '-e', `(^|[^A-Za-z0-9.-])${escaped}([^A-Za-z0-9.-]|\\.([^A-Za-z0-9]|$)|$)`, '--', `:(literal)${folder || '.'}`, ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
+        await execFileAsync('git', ['grep', '--quiet', '--ignore-case', '--extended-regexp', '-e', wholeOrigin(origin), '--', `:(literal)${folder || '.'}`, ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
         return true;
     }
     catch {
         return false;
     }
 }
+/** Whether a line names an app's name or folder whole, not inside a longer name, a host name or a path, such as `apps/web` in `archived/apps/web`. */
+const namesWhole = (line, words) => new RegExp(`(^|[^\\p{L}\\p{N}_./-])${escapeRegExp(words)}(?![\\p{L}\\p{N}_-]|[./][\\p{L}\\p{N}])`, 'iu').test(line);
+/**
+ * Whether a line of the checkout's root README names the address's origin, whole, beside one app, by its name or its
+ * folder, and no other app: a row of a table of the apps' live addresses, or an item of such a list (#367). The
+ * addresses on the line are left out of the match, so a host name made of an app's name names no app.
+ */
+export async function readmeNamesApp(root, origin, app, others) {
+    let lines;
+    try {
+        lines = (await execFileAsync('git', ['grep', '-h', '--ignore-case', '--extended-regexp', '-e', wholeOrigin(origin), '--', ':(glob,icase)README*'], { cwd: root, timeout: 30_000, env: gitEnvironment() })).stdout;
+    }
+    catch {
+        return false;
+    }
+    // Each name or folder with every app it belongs to, so a name two apps share names both; the longest first, each taken
+    // out once found, so "Web" inside "Web admin" is not that app named.
+    const names = new Map();
+    for (const each of [app, ...others])
+        for (const words of [each.name, each.folder])
+            if (words)
+                names.set(words.toLowerCase(), [...(names.get(words.toLowerCase()) ?? []), each]);
+    const longestFirst = [...names].sort(([x], [y]) => y.length - x.length);
+    return lines.split('\n').some((line) => {
+        // The addresses end where a table cell or a tag does; a path's parentheses, and a link's closing one, go with them.
+        let text = line.replace(/https?:\/\/[^\s|<>[\]"'`]+/gi, ' ');
+        const named = new Set();
+        for (const [words, apps] of longestFirst) {
+            if (!namesWhole(text, words))
+                continue;
+            for (const each of apps)
+                named.add(each);
+            text = text.replace(new RegExp(escapeRegExp(words), 'giu'), ' ');
+        }
+        return named.size === 1 && named.has(app);
+    });
+}
 /** What a visitor never sees of a page: comments, scripts, styles and templates. */
 const UNSEEN = /<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 /** The words a visitor sees: the title and the text, without comments, scripts, styles, tags or attributes. */
@@ -223,36 +279,43 @@ async function pageText(res, max = 1_000_000) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+/** Whether a page is a password form and nothing else: one form whose only field a person fills is a password, as Netlify's lock is. */
+function passwordForm(html) {
+    const seen = html.replace(UNSEEN, ' ');
+    const fields = [...seen.matchAll(/<input\b[^>]*>/gi)].map(([tag]) => /\stype\s*=\s*["']?([\w-]+)/i.exec(tag)?.[1]?.toLowerCase() ?? 'text').filter((type) => !['hidden', 'submit', 'button', 'reset', 'image'].includes(type));
+    return (seen.match(/<form\b/gi) ?? []).length === 1 && fields.join() === 'password';
+}
 /**
- * Whether Netlify's own password form opens the address: the password posted as that form posts it (a `password` field
- * to the address itself), then the page read with the session cookie Netlify set. Says whether a password is right
- * where the header did not open the address; a review cannot fill a form, so this proves nothing for one.
+ * Signs in with Netlify's site password the way its form does, and the way reviews do (pristine's site-password.ts):
+ * a stranger's knock on the address's own origin, then, only where the answer is the lock's password form, the
+ * password posted there as its one field. Netlify answers a redirect back with a cookie for that host alone, which
+ * opens every page of it; a wrong password gets the form again and no cookie. The session's cookies, as a request
+ * sends them; empty where nothing stood in front or the form did not take the password.
  */
-async function formOpens(target, password, phrase, open, signal) {
+async function siteSession(target, password, open, signal) {
+    const front = new URL('/', target.origin);
     try {
-        const posted = await open(target, { method: 'POST', redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ password }).toString() });
-        await posted.body?.cancel().catch(() => { });
-        const cookies = posted.headers.getSetCookie().map((cookie) => cookie.split(';')[0]).filter((pair) => pair.includes('='));
-        if (posted.status >= 400 || !cookies.length)
-            return false;
-        const res = await open(target, { redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', cookie: cookies.join('; ') } });
-        if (res.status < 200 || res.status >= 300) {
-            await res.body?.cancel().catch(() => { });
-            return false;
+        const knock = await open(front, { redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html' } });
+        if ((knock.status !== 401 && knock.status !== 403) || !passwordForm(await pageText(knock, 64_000))) {
+            await knock.body?.cancel().catch(() => { });
+            return '';
         }
-        return visible(await pageText(res)).includes(plain(phrase));
+        const posted = await open(front, { method: 'POST', redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ password }).toString() });
+        await posted.body?.cancel().catch(() => { });
+        if (posted.status >= 400)
+            return '';
+        return posted.headers.getSetCookie().map((cookie) => cookie.split(';')[0].trim()).filter((pair) => /^[^\s;,=]+=[^\s;,]*$/.test(pair)).join('; ');
     }
     catch {
-        return false;
+        return '';
     }
 }
 /**
  * Opens a preview address the way a visitor does, signed in nowhere, and proves it: it answers, and its page shows
  * `words` that a file of the checkout at `root` holds, so the page is this app's and not another site's. With `bypass`, a
  * Vercel bypass secret, a Vercel address is opened with it in the header Vercel reads it from, as reviews do; with
- * `password`, a Netlify site password, a Netlify address is opened with it as basic credentials in the Authorization
- * header, the one way reviews can send it, and with `form` posted to Netlify's form too where the header did not get past
- * the lock (only for a site whose settings show a password: an app's own password form looks the same); with `access`, a
+ * `password`, a Netlify site password, a Netlify address is opened signed in with it on Netlify's own form, as reviews
+ * sign in, the password posted only where the address's origin answers with that form; with `access`, a
  * Cloudflare Access service token, a Pages address is opened with it in the two headers Access reads it from. None goes
  * to another host. With `live`, the address is a live app's rather than a preview's: any https address is opened, a
  * host's lock is told by its domain, or by the host named in `live` for a custom domain the host tool answered as the
@@ -276,10 +339,12 @@ export async function provePreview(url, words, root, deps = {}) {
     const opened = deps.bypass && host === 'vercel';
     const withPassword = deps.password !== undefined && host === 'netlify';
     const withToken = deps.access !== undefined && host === 'cloudflare';
+    // Behind Netlify's site password: the session its form gives, carried on every hop of the address's own origin.
+    const session = withPassword ? await siteSession(new URL(url), deps.password, open, signal) : '';
     const headers = {
         accept: 'text/html',
         ...(opened ? { [BYPASS_HEADER]: deps.bypass } : {}),
-        ...(withPassword ? { authorization: basicCredentials(deps.password) } : {}),
+        ...(session ? { cookie: session } : {}),
         ...(withToken ? { [ACCESS_ID_HEADER]: deps.access.id, [ACCESS_SECRET_HEADER]: deps.access.secret } : {}),
     };
     // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it.
@@ -307,10 +372,6 @@ export async function provePreview(url, words, root, deps = {}) {
                 const named = (host === 'netlify' && netlifyLock(res.headers.get('www-authenticate'), page)) || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
                 if (!gate || !named)
                     return unproven(res.status === 401 ? "The address asked for the app's own sign-in: try a page a visitor opens without signing in." : `The address answered ${res.status}.`, res.status);
-                // A password the header did not get past: Netlify's own form says whether it is the site's password at all.
-                if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
-                    return { ...unproven("The password opens the address on Netlify's own form, but not in the Authorization header, the one way reviews can send it.", res.status), gate, formOpened: true };
-                }
                 return { ...unproven(`The address asked for ${lock}'s login or password${still}.`, res.status), gate, ...(host === 'netlify' && NETLIFY_TEAM_LOGIN.test(page) ? { teamLogin: true } : {}) };
             }
             if (res.status < 200 || res.status >= 300) {

package/dist/main.js

@@ -290,6 +290,7 @@ export async function main(argv) {
                         { label: 'Web page', url: page },
                     ],
                     todo: end.todo,
+                    ...(report.hosts?.length ? { used: report.hosts } : {}),
                     warnings: [...removed, ...left, ...(await unopened(Boolean(testPr))), ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
                 // The web page has the report; when it missed it, or the run fell short of all set up, whose why it holds, the report stays here as well.

package/dist/netlify-password.js

@@ -1,7 +1,8 @@
 /**
  * Getting past Netlify's site password (Password Protection on Pro and Enterprise plans; "Project visibility: Password"
- * on credit-based Pro) the one way a request can carry a password: as basic credentials in the Authorization header.
- * Netlify's password page asks for a password alone, no username, so the credentials carry an empty name. The Netlify
+ * on credit-based Pro) the way Netlify takes it: on its own form, which answers a session cookie for the preview's host
+ * (impeccable-reviews#374); no request header carries it. Reviews sign in the same way, before a preview's first page,
+ * with the password saved as the lock's key (pristine's `protection: { method: "password" }`). The Netlify
  * CLI on this machine, signed in as the person, reads the site's settings in the command's own process: what
  * `netlify api` prints is those settings, the password among them, so the agent's shell never runs it (fence.ts), and
  * no password goes back to the model. The person consents once, on the tool's screen, before the password is stored;
@@ -10,10 +11,6 @@
  * Netlify's team login (a private site) has no way in for tools, so on the person's yes the run makes the site public
  * through the CLI; where Netlify refuses, the person changes Visitor access on Netlify's page and the run tries again.
  */
-/** The header reviews send the password in. */
-export const PASSWORD_HEADER = 'Authorization';
-/** The password as the header carries it: basic credentials with an empty username, since Netlify asks for none. */
-export const basicCredentials = (password) => `Basic ${Buffer.from(`:${password}`).toString('base64')}`;
 /** The CLI's read of a site by the address every deploy preview of it carries (`site_id` takes the site's default domain), an authenticated call of Netlify's API. */
 export const readSiteCall = (site) => ['api', 'getSite', '--data', JSON.stringify({ site_id: `${site}.netlify.app` })];
 /**
@@ -27,7 +24,7 @@ const record = (value) => (value !== null && typeof value === 'object' && !Array
 /** A site's name and id as Netlify makes them. */
 const NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const ID = /^[A-Za-z0-9-]{1,64}$/;
-/** A password as the header can carry it: one line, of a length a person would type. */
+/** A password as the form takes it: one line, of a length a person would type. */
 const password = (value) => (typeof value === 'string' && value.length > 0 && value.length <= 200 && !/[\r\n\0]/.test(value) ? value : null);
 /** The site's protection, read through the CLI, which is what makes the site the person's; null when it could not say: signed out, no site of that name in a team of the person's, or a site read back under another name. */
 export async function readSite(run, site) {
@@ -63,12 +60,11 @@ export async function passNetlifyLock(deps) {
     const from = site ? { site: site.name } : {};
     const finish = async (password, how) => {
         deps.remember(password);
-        deps.remember(basicCredentials(password));
-        // Netlify's form, which an app's own password form looks like, gets the password only on a site whose settings show one.
-        const proof = await deps.prove(password, site !== null);
-        // locked: Netlify's lock stood all the same, and its form did not take the password either. Any other failure is the proof's to say: the form took it and the header did not, or the page past the lock is another, or did not answer.
+        // Netlify's form, which an app's own password form looks like, gets the password only on a site whose settings show one: the CLI read this one as the person's.
+        const proof = await deps.prove(password);
+        // locked: Netlify's lock stood all the same, so its form did not take the password. Any other failure is the proof's to say: the page past the lock is another, or did not answer.
         if (!proof.proven)
-            return { reason: proof.reason ?? 'The address did not open with the password.', locked: proof.gate !== undefined && !proof.formOpened };
+            return { reason: proof.reason ?? 'The address did not open with the password.', locked: proof.gate !== undefined };
         const failed = await deps.save(password);
         return failed ? { status: 'save-failed', reason: failed, protection: 'password', ...from } : { status: 'saved', password: how, protection: 'password', ...from, value: password };
     };
@@ -88,7 +84,7 @@ export async function passNetlifyLock(deps) {
                 return done;
             // The site's own password, as Netlify gives it: nothing typed would be righter. Where the lock stood all the same, the page asks for the app's own sign-in past it,
             // which a page a visitor opens gets past, or Netlify did not answer its form; else the proof's reason says what stood in the way.
-            return { status: 'refused', reason: done.locked ? "Netlify's own site password opened the address neither in the header nor on Netlify's form: the page asks for the app's own sign-in past the lock, or Netlify did not answer. Prove a page a visitor opens without signing in, and call this tool again." : done.reason, protection: 'password', ...from };
+            return { status: 'refused', reason: done.locked ? "Netlify's own site password did not open the address on Netlify's form: the page asks for the app's own sign-in past the lock, or Netlify did not answer. Prove a page a visitor opens without signing in, and call this tool again." : done.reason, protection: 'password', ...from };
         }
     }
     else {
@@ -133,7 +129,7 @@ async function openToVisitors(deps, site) {
             return read;
         // A site read as public, or one the CLI cannot read once the person changed it on Netlify's page: the preview says.
         if (read ? !read.teamLogin : tries > 0) {
-            const proof = await deps.prove(undefined, false);
+            const proof = await deps.prove(undefined);
             if (proof.proven)
                 return { status: 'opened', madePublic: ranPublic ? 'run' : 'person', ...from };
             // Past the login, a page that is not the app's: the proof says why.

package/dist/netlify.js

@@ -145,6 +145,7 @@ async function netlifySites(netlify) {
 async function fromCli(owner, repo, netlify, only, directory) {
     const { cli } = await netlifyStatus(netlify);
     const addresses = new Map();
+    const teams = {};
     if (cli !== 'signed-in')
         return { cli, sites: [], addresses, previews: [], failed: cli === 'unknown' };
     const slug = `${owner}/${repo}`.toLowerCase();
@@ -162,6 +163,8 @@ async function fromCli(owner, repo, netlify, only, directory) {
             if (directory !== undefined && folderOf(record(site.build_settings)?.base) !== directory)
                 continue;
             sites.push(site.name);
+            if (typeof site.account_name === 'string' && site.account_name && site.account_name.length <= 100)
+                teams[site.name] = site.account_name;
             const fact = netlifyPreviewsFact(site);
             if (fact)
                 facts.push(fact);
@@ -186,7 +189,7 @@ async function fromCli(owner, repo, netlify, only, directory) {
         failed = true;
     }
     const pullRequestPreviews = pickPreviewsFact(facts);
-    return { cli: 'signed-in', sites, addresses, previews, failed, ...(pullRequestPreviews ? { pullRequestPreviews } : {}) };
+    return { cli: 'signed-in', sites, addresses, ...(Object.keys(teams).length ? { teams } : {}), previews, failed, ...(pullRequestPreviews ? { pullRequestPreviews } : {}) };
 }
 /** The site whose address `production` is: the newest preview's, else the first the evidence names. */
 export const liveSite = (evidence) => evidence.previews[0]?.site ?? evidence.sites[0];
@@ -204,7 +207,10 @@ export async function readNetlifyPreviews(owner, repo, cwd, deps = {}) {
                 : !cli.sites.length && !cli.failed ? `No Netlify site of this repository builds ${where} (its base directory), as far as the Netlify CLI here can see.` : undefined;
     const github = deps.directory === undefined ? read : { ...read, previews: unmatched ? [] : read.previews.filter((p) => cli.sites.includes(p.site)) };
     if (unmatched)
-        Object.assign(cli, { sites: [], previews: [], addresses: new Map(), pullRequestPreviews: undefined });
+        Object.assign(cli, { sites: [], previews: [], addresses: new Map(), teams: undefined, pullRequestPreviews: undefined });
+    // Each site's team goes to the last screen alone, never into the evidence (#360).
+    if (cli.teams)
+        deps.onTeams?.(cli.teams);
     // A deploy of an older commit than its pull request's head says nothing of the head's own preview: a commit status, which names the head, outranks it, and a wait for that pull request's preview ignores it.
     const older = (p) => p.from === 'netlify cli' && Boolean(p.sha) && github.heads.has(p.pullRequest) && github.heads.get(p.pullRequest) !== p.sha;
     // Of a pull request's status and the CLI's deploy of the same commit the later change is the truer, a status winning a tie; an older commit's deploy comes next, a bot's comment, which names no commit and changes no state, last.

package/dist/playbook/cases/cloudflare-previews.md

@@ -11,15 +11,15 @@ Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_pr
 
 - **The live app**: `production` in the evidence is the project's own address, `https://<project>.pages.dev`; live-app-address says how it becomes the before, in step 2's write.
 - **Behind Cloudflare Access** (`gate: "cloudflare-access"`): Cloudflare's login stands in front of the previews. Get past it as preview-protection says, which proves the preview, and go on with step 2; when nothing got past it, that case says how the run ends.
-- **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Cloudflare address answered.
+- **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as server-previews says instead, and say under "What is not verified" what the Cloudflare address answered.
 - **No pull-request previews**: the checkout is set up for Cloudflare and nothing is listed, or a project's settings build none. The aim holds: find out why from the answer, in this order, and for each cause ask once with the tool that fixes it, before anything is pushed and never a second time; with a preview listed, after step 1's proof and preview-protection's steps, so the person sees the lock's question and this one back to back, at most one each. Each tool shows its one screen and does the change as the person, or opens the page where it cannot. After `enabled` or `connected`, nothing is listed yet, so the test drive's build is the first preview: take pull-requests' step 4 the Cloudflare way and save the method on its alias as step 2 says, no setup pull request.
   1. **Previews off** (`pullRequestPreviews` with `enabled: false` and `cause` `previews` or `deployments`, with its `reason`): cf, signed in, found the Pages project built from this repository, and its settings build no previews of pull requests. impeccable_enable_previews (`host: "cloudflare"`) turns the preview branch control on; deployments off altogether is the person's change, on the page it opens.
   2. **Not connected** (`cause: "source"`): the Pages project the checkout names (its wrangler config, or the README's pages.dev address) exists with no Git repository connected, so no push builds. impeccable_cloudflare_connect connects it to this repository.
   3. **A Worker, not a Pages project** (`worker` in the answer, and no `pullRequestPreviews`): Cloudflare builds the repository as a Worker (Workers Builds: its check runs name the script, or the wrangler config or the README's workers.dev address does), which gives pull requests no preview, and a Worker with static assets no branch build at all. impeccable_cloudflare_connect, with the build command and output folder the checkout runs, creates a Pages project for the repository and connects it; the Worker stays as it is. The same tool creates the project where the config names a Pages project cf finds nowhere.
   4. **Cloudflare's GitHub app cannot see the repository** (`githubApp` in the answer: the app's installation covers selected repositories, or `installed: false`): a project connected with previews on still gets no build, since the app builds only the repositories its installation names. Nothing in the account shows it, so the wait for the test drive's build tells: when none comes, the wait's own screen opens the installation page (`githubApp.page`) and waits again on the person's yes. Its `reason` says when they skipped it or no build came after the retries.
-- **`skipped` or `refused` from any of these**: push no test drive on Cloudflare (pull-requests' "No preview, no test drive" where a preview was proven; else set the preview up as server-previews or static-site says, never without saying so) and say under "What was skipped, and why" which cause stopped it, with the `reason`, and name the `page` where there is one; the person was asked in this run, so `left` stays empty.
+- **`skipped` or `refused` from any of these**: push no test drive on Cloudflare (pull-requests' "No preview, no test drive" where a preview was proven; else set the preview up as server-previews says, never without saying so) and say under "What was skipped, and why" which cause stopped it, with the `reason`, and name the `page` where there is one; the person was asked in this run, so `left` stays empty.
 - **No `pullRequestPreviews`, no `worker`** (`cli` signed out or unknown, or no Pages project built from this repository among the accounts cf reaches): the check could not be made. Say so in one line under "What is not verified", naming why, and go on as the aim says: nothing listed, as "Nothing listed" says; a preview listed, as the steps say, where the wait for the test drive's build then tells.
-- **Nothing listed**, and neither `pullRequestPreviews` nor `worker` nor a project the checkout names: Cloudflare's previews are not on record, so set the preview up as server-previews or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
+- **Nothing listed**, and neither `pullRequestPreviews` nor `worker` nor a project the checkout names: Cloudflare's previews are not on record, so set the preview up as server-previews says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
 - **The pull requests**: no setup pull request; the test drive branches from the default branch, and Cloudflare builds every pushed branch, so pull-requests' step 4 goes the Vercel way with impeccable_cloudflare_previews in place of impeccable_hosted_previews: with `branch: "impeccable/test-drive"` it waits up to five minutes for the check run on the pushed head, under a status line with its timer, and the test drive's page is proven on the alias it lists before the pull request opens. In place of pull-requests' step 3, build the test drive branch once with the build Cloudflare runs (the Pages project's build command, which the checkout's `package.json` `build` script usually is), so a page that does not build is never pushed.
 - The evidence is read only: link, deploy and change nothing on Cloudflare beyond what impeccable_enable_previews and impeccable_cloudflare_connect do on the person's yes. The Cloudflare sign-ins are those tools' own, on the person's yes. Cloudflare does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern, the branch's alias: save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found" (and the Worker, where Cloudflare builds one), and the pattern saved under "What was configured, and by whom", with the pull-request previews turned on when they were (`by` says whether the run or the person did), the Pages project created or connected (`created` says which; name its `subdomain` address) and the access given to Cloudflare's GitHub app, since the account changed. The test drive's own preview, which Cloudflare builds after the run, goes under "What is not verified".

package/dist/playbook/cases/first-preview-failure.md

@@ -22,7 +22,6 @@ A rerun: the setup pull request an earlier run opened has a preview job that fai
 | setup | `runtime` in the state; correct `runtimeVersion`. Nothing was installed yet. |
 | install | The lockfile and the package manager's pinned version. |
 | prepare, build | The script's name, the package runner and the app's folder. |
-| upload | The real build output and its entry page; correct `outputDir`. |
 | seed | The migration or seed command and the throwaway database. |
 | start | `startCommand`, `port`, `env` and readiness. |
 | tunnel | A repository already on Impeccable's tunnel: the app refusing the forwarded Host, allowed in the framework's host check for previews only (Rails `config.hosts`, Django `ALLOWED_HOSTS`, Vite `preview.allowedHosts`), not Impeccable's own access gate: a 403 on the bare link alone is not a broken preview. |

package/dist/playbook/cases/live-app-address.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Every run that saves a preview method, for the state's `before` item: the address of the live app, which every review then shows beside the change. The item reads `optional` until an address is saved, so the checkup never waits on it; the run sets it all the same, from what the host or the repository already says, and asks nobody: the host's own address of the connected project changes nothing of the person's. Where Impeccable builds the previews itself (static-site), its build of the default branch is the before and the item reads done on its own: set nothing.
+Every run that saves a preview method, for the state's `before` item: the address of the live app, which every review then shows beside the change. The item reads `optional` until an address is saved, so the checkup never waits on it; the run sets it all the same, from what the host or the repository already says, and asks nobody: the host's own address of the connected project changes nothing of the person's.
 
 ### Steps