@impeccable/reviews 0.1.20 → 0.1.22

package/dist/cloudflare-access.js

@@ -107,6 +107,10 @@ const granted = (s) => s.cli === 'signed-in' && (!s.scopes || ACCESS_SCOPES.ever
 async function reach(deps, read) {
     const through = (s) => ({ way: throughCf(deps.cf, s.accounts, deps.signal) });
     let status = read;
+    if (status.cli === 'missing' && deps.install) {
+        await deps.install();
+        status = await cfStatus(deps.cf, deps.signal);
+    }
     if (granted(status))
         return through(status);
     if (status.cli === 'missing' || status.cli === 'unknown')

package/dist/cloudflare.js

@@ -3,7 +3,7 @@ import { readFile } from 'node:fs/promises';
 import { join, resolve, sep } from 'node:path';
 import { cloudflarePreviewsFact, cloudflarePreviewsPage, folderOf } from './host-previews.js';
 import { commandRunner } from './netlify.js';
-import { ownFolder, ownNpmCache } from './sandbox.js';
+import { ownFolder } from './sandbox.js';
 /**
  * Cloudflare Pages: the preview deployments this repository's pull requests
  * get, from GitHub's record and from cf, Cloudflare's CLI, on this machine
@@ -234,30 +234,26 @@ export function plainJson(text) {
     }
     return out.replace(/,(\s*[}\]])/g, '$1');
 }
-/** cf, Cloudflare's CLI, at the version this command is built against, run through npx, which installs it on first use. */
-export const CF_PACKAGE = 'cf@1.0.0-beta.13';
 /**
- * cf here: its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to pick
- * when they have several. `browser` lets its sign-in open one. npx runs it from a folder of the command's own, never the
- * checkout, whose node_modules and .npmrc would choose which cf runs as the person, outside the sandbox, and from where cf
- * itself would read the checkout's .env into its token and account and evaluate its cloudflare.config.ts: every cf
- * command names its project or its account, so none needs the checkout. Only the sign-in cf picks by folder does: with
- * `checkout`, each command runs as the profile cf binds to it (`cf auth activate`), which cf names from its own folder
- * too, so the account is the one the person's cf uses there; where reading the bindings failed, the command fails as well,
- * never falling back to another sign-in. It fetches cf through a cache of the command's own, never ~/.npm, where a
- * sandboxed install could have planted a cf under the registry's live ETag; the registry is asked afresh, and no install
- * script of cf's runs, which it does without.
+ * cf here, Cloudflare's CLI as npm installs it globally (`cf`, at the version fence.ts pins for an install the person said
+ * yes to, #396): its JSON uncoloured, and an account's command given its account, which cf otherwise asks the person to
+ * pick when they have several. `browser` lets its sign-in open one. It runs from a folder of the command's own, never the
+ * checkout, from where cf would read the checkout's .env into its token and account and evaluate its
+ * cloudflare.config.ts: every cf command names its project or its account, so none needs the checkout. Only the sign-in
+ * cf picks by folder does: with `checkout`, each command runs as the profile cf binds to it (`cf auth activate`), which
+ * cf names from its own folder too, so the account is the one the person's cf uses there; where reading the bindings
+ * failed, the command fails as well, never falling back to another sign-in. Not installed, a command fails `missing`.
  */
 export function cfRunner(opts = {}, runner = commandRunner) {
     const { checkout, ...run } = opts;
-    const npx = (args, signal, env = {}) => runner('npx', ownFolder(), { timeoutMs: 120_000, ...run, signal, env: { NO_COLOR: '1', ...env } })(['--yes', '--cache', ownNpmCache(), '--prefer-online', '--ignore-scripts', CF_PACKAGE, ...args]);
+    const exec = (args, signal, env = {}) => runner('cf', ownFolder(), { timeoutMs: 120_000, ...run, signal, env: { NO_COLOR: '1', ...env } })(args);
     let profile;
     return async (args, { account, signal } = {}) => {
         // Read once a runner; a failed read is read again by the next command.
         if (checkout && !profile)
-            profile = npx(['auth', 'list'], signal).then((listed) => boundProfile(listed, checkout)).catch((err) => { profile = undefined; throw err; });
+            profile = exec(['auth', 'list'], signal).then((listed) => boundProfile(listed, checkout)).catch((err) => { profile = undefined; throw err; });
         const bound = await profile;
-        return npx([...(bound ? ['--profile', bound] : []), ...args], signal, account ? { CLOUDFLARE_ACCOUNT_ID: account } : {});
+        return exec([...(bound ? ['--profile', bound] : []), ...args], signal, account ? { CLOUDFLARE_ACCOUNT_ID: account } : {});
     };
 }
 /** The profile `cf auth list` binds to `checkout`, found as cf finds it from there: the longest bound folder that is the checkout's real path or holds it; none where no folder does. A list that is not cf's throws. */
@@ -431,7 +427,8 @@ async function listCloudflareProjects(cf, accounts, signal) {
  * with `pull`, that pull request's only; with `branch`, the pushed branch's head's only, before its pull request exists.
  */
 export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
-    const unread = () => ({ previews: [], cli: 'missing', error: "Cloudflare's previews could not be read.", unread: ['GitHub'] });
+    // cf is not asked here, so whether it is installed is unknown.
+    const unread = () => ({ previews: [], cli: 'unknown', error: "Cloudflare's previews could not be read.", unread: ['GitHub'] });
     if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..')
         return unread();
     if (deps.branch !== undefined && !branchName(deps.branch))
@@ -445,7 +442,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     const app = deps.directory !== undefined && plain;
     // `project`, one app's told by an earlier read, is the one read: never the project the first check run names, which may be another app's.
     const named = app ? undefined : deps.project ?? github.previews.map((p) => pagesProject(p.url)).find(Boolean) ?? (config?.kind === 'pages' ? config.name : undefined);
-    // cf installs itself through npx on a machine without it, which takes a while the first time. The project's settings are read with the plain evidence, not while a build is waited for.
+    // The project's settings are read with the plain evidence, not while a build is waited for. cf missing here reads as `cli: missing`: nothing installs it (#396).
     const cf = await fromCf(named, deps.cf ?? cfRunner({ checkout: cwd }, deps.run), { owner, repo, heads: github.heads.map((h) => h.sha), readme: readme.pages, ...(app ? { directory: deps.directory } : {}) }, plain, deps.signal);
     const where = deps.directory ? `the folder ${deps.directory}` : "the repository's root";
     const unmatched = !app ? undefined

package/dist/fence.js

@@ -365,6 +365,15 @@ function listsOrigin(args) {
     const words = args.filter((a) => !a.startsWith('-'));
     return options.every((a) => LS_REMOTE_FLAGS.test(a) || LS_REMOTE_LONG.has(a) || a.startsWith('--sort=')) && words[0] === 'origin';
 }
+/** git ls-files's options that pick which tracked or untracked files it names, and how it prints them; never --ignored, --stage, --format or one that reads a file (--exclude-from). */
+const LS_FILES_OPTIONS = new Set(['-c', '--cached', '-o', '--others', '-m', '--modified', '-d', '--deleted', '--exclude-standard', '-z', '--full-name', '--directory', '--no-empty-directory']);
+/** Whether `git ls-files` with these words only names the checkout's files: the options above, and paths inside the checkout (#390). */
+function listsFiles(args, where) {
+    const end = args.indexOf('--');
+    const options = (end < 0 ? args : args.slice(0, end)).filter((a) => a.startsWith('-'));
+    const paths = end < 0 ? args.filter((a) => !a.startsWith('-')) : [...args.slice(0, end).filter((a) => !a.startsWith('-')), ...args.slice(end + 1)];
+    return options.every((a) => LS_FILES_OPTIONS.has(a)) && !paths.some((a) => outside(a, where));
+}
 /** The branch a push's refspec updates on the remote: its destination, else its source, without `+` and `refs/heads/` (or `heads/`, which git reads the same). */
 const pushedBranch = (refspec) => refspec.replace(/^\+/, '').split(':').pop().replace(/^(?:refs\/)?heads\//, '');
 const isFile = (path) => {
@@ -483,6 +492,8 @@ function git(args, where, protectedBranches, held = false) {
         return listsBranches(rest) ? allow() : deny('git branch lists only: -a, -r, -v, --show-current, --list <pattern>, and --contains, --merged, --points-at, --sort and --format with their value after =; git checkout -b or git switch -c makes a branch');
     if (sub === 'remote')
         return listsRemotes(rest) ? allow() : deny('git remote lists only: on its own, -v, or get-url <name>; nothing that adds, removes, renames, points or prunes a remote, and no show, which asks the remote');
+    if (sub === 'ls-files')
+        return listsFiles(rest, where) ? allow() : deny('git ls-files names files only: -c, -o, -m, -d, --exclude-standard, -z, --full-name, --directory and paths inside the checkout');
     if (sub === 'ls-remote')
         return listsOrigin(rest) ? allow() : deny('git ls-remote asks origin only, named: git ls-remote --heads origin, with --tags, --refs, --symref, --get-url and patterns after origin; no other remote, no URL, no --upload-pack, and not without origin, which asks the current branch\'s own remote');
     if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
@@ -617,12 +628,14 @@ function reader(cmd, args, where) {
         return deny('reads a .env file, or a pattern that can match one');
     return allow();
 }
-/** A host's CLI package, by host: the one global install that runs, and only once the person said yes to setting that host up. */
+/** A host's CLI package, by host: the one global install the agent runs, and only once the person said Install on that CLI's screen (#396). */
 const HOST_CLIS = { netlify: 'netlify-cli', vercel: 'vercel' };
-/** The version of each the run installs, raised with a release of this command: never the registry's latest of the day. */
-export const HOST_CLI_VERSIONS = { 'netlify-cli': '27.11.2', vercel: '62.7.0' };
-/** The one form of a host CLI's install that runs: npm's, global, of the pinned version. */
-export const hostCliInstallCommand = (pkg) => `npm install -g ${pkg}@${HOST_CLI_VERSIONS[pkg]}`;
+/** The version of each the run installs, raised with a release of this command: never the registry's latest of the day. cf, Cloudflare's, the run installs itself, since only the tools run it. */
+export const HOST_CLI_VERSIONS = { 'netlify-cli': '27.11.2', vercel: '62.7.0', cf: '1.0.0-beta.13' };
+/** npm's arguments for the one form of a host CLI's install that runs: global, of the pinned version; cf's with no install script, as npx ran it before (it needs none). */
+export const hostCliInstallArgs = (pkg) => ['install', '-g', ...(pkg === 'cf' ? ['--ignore-scripts'] : []), `${pkg}@${HOST_CLI_VERSIONS[pkg]}`];
+/** That install as the person types it, in another terminal or the agent's shell. */
+export const hostCliInstallCommand = (pkg) => `npm ${hostCliInstallArgs(pkg).join(' ')}`;
 /** git commit and push, gh and the host CLIs: what uses the person's GitHub, Vercel, Netlify or Cloudflare sign-in, keys or keychain. */
 function asPerson(words) {
     const [cmd = '', ...args] = words;
@@ -933,8 +946,8 @@ function simpleCommand(seg, where, opts) {
             if (!PACKAGE_MANAGERS.has(cmd))
                 return deny(`${cmd} is not on the allowlist`);
             const add = hostCliAdd(cmd, args);
-            if (add && opts.hosts.has(add.host))
-                return pinned(cmd, add) ? allow('installs the CLI of the host the person said yes to') : deny(`the run installs ${add.pkg} with npm, pinned to the version it knows: ${hostCliInstallCommand(add.pkg)}`);
+            if (add && opts.installs.has(add.host))
+                return pinned(cmd, add) ? allow('installs the CLI the person said Install to') : deny(`the run installs ${add.pkg} with npm, pinned to the version it knows: ${hostCliInstallCommand(add.pkg)}`);
             return packageManager(cmd, args, where, opts.scriptsChanged);
         }
     }
@@ -1189,7 +1202,7 @@ function unsyncedWorkflows(where, named, carried, synced) {
 }
 /** The fence's answer for one shell command run from the checkout's top folder. */
 export function classifyCommand(command, root, options = {}) {
-    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null, repository: options.repository };
+    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), installs: options.installs ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null, repository: options.repository };
     const segments = parseCommand(command);
     if (!segments) {
         // A here-document is how a file or a message gets written in one command: the write tool, -m and --body do that.
@@ -1607,13 +1620,14 @@ const previewRetries = new WeakMap();
 export function previewRetryState(log) {
     let state = previewRetries.get(log);
     if (!state) {
-        state = { used: 0, pushReservations: 0, creationReserved: false, drivePushes: 0, driveCreated: false, requireHistory: false, historyKnown: false, observed: new Map() };
+        state = { used: 0, pushReservations: 0, creationReserved: false, drives: new Map(), drivesAllowed: 1, requireHistory: false, historyKnown: false, observed: new Map() };
         previewRetries.set(log, state);
     }
     return state;
 }
 const setupBranch = (branch) => /^impeccable\/setup(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
-const driveBranch = (branch) => /^impeccable\/test-drive(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
+/** The test drive's branch: impeccable/test-drive, an app's impeccable/test-drive-<app key> on a repository with several, each with -2, -3 where an earlier run took it. */
+const driveBranch = (branch) => /^impeccable\/test-drive(?:-[A-Za-z0-9][A-Za-z0-9._-]*)?$/.test(branch) && !branch.includes('..') && !branch.endsWith('.') && !branch.endsWith('.lock');
 /** A GitHub repository as `<owner>/<name>`. */
 const REPOSITORY = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/;
 /** `gh pr ready <the test drive's branch> [--repo <owner>/<name>]`, and nothing else (never `--undo`, a number or another branch): the branch and the repository named, or null. */
@@ -1696,7 +1710,13 @@ export function reservePreviewCommand(state, command, root, scratch) {
         return deny('unsupported command syntax');
     const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
     let used = state.used, pushes = state.pushReservations, create = state.createBranch, reserved = state.creationReserved;
-    let drive = state.driveBranch, drivePushes = state.drivePushes, driveCreated = state.driveCreated;
+    const drives = new Map([...state.drives].map(([branch, d]) => [branch, { ...d }]));
+    // A branch the run has not used for a test drive yet, while it may open another.
+    const driveOf = (branch) => {
+        if (!drives.has(branch) && drives.size < state.drivesAllowed)
+            drives.set(branch, { pushes: 0, created: false });
+        return drives.get(branch);
+    };
     for (const { words } of segments) {
         if (words[0] === 'cd') {
             where.cwd = resolve(where.cwd, words[1]);
@@ -1705,14 +1725,14 @@ export function reservePreviewCommand(state, command, root, scratch) {
         const gitWords = words[0] === 'git' ? gitArgs(words.slice(1)) : [];
         if (!gitWords)
             return deny('a git option before the command');
-        // The test drive is the run's other pull request: one branch, one pull request, a few pushes, none of the setup pull request's attempts.
+        // The test drive is the run's other pull request (one an app on a repository with several): one branch, one pull request, a few pushes, none of the setup pull request's attempts.
         const drivePush = pushBranch(gitWords, driveBranch);
         if (drivePush) {
-            if (drive && drivePush !== drive)
-                return deny('keep the test drive on one branch');
-            if (++drivePushes > 3)
+            const drive = driveOf(drivePush);
+            if (!drive)
+                return deny(state.drivesAllowed > 1 ? `one test drive for each of the ${state.drivesAllowed} apps this run sets up, each on one branch` : 'keep the test drive on one branch');
+            if (++drive.pushes > 3)
                 return deny('the test drive has been pushed three times already');
-            drive = drivePush;
             continue;
         }
         if (gitWords[0] === 'push') {
@@ -1741,12 +1761,12 @@ export function reservePreviewCommand(state, command, root, scratch) {
                 || (!parsed.repository && realPath(where.cwd) !== where.root))
                 return deny('name this repository explicitly when creating a pull request');
             if (parsed.head && driveBranch(parsed.head)) {
-                if (driveCreated)
+                const drive = driveOf(parsed.head);
+                if (!drive)
+                    return deny(state.drivesAllowed > 1 ? `one test drive for each of the ${state.drivesAllowed} apps this run sets up, each opened from the branch that was pushed` : 'open the test drive from the branch that was pushed');
+                if (drive.created)
                     return deny('the test drive is already open');
-                if (drive && parsed.head !== drive)
-                    return deny('open the test drive from the branch that was pushed');
-                drive = parsed.head;
-                driveCreated = true;
+                drive.created = true;
                 continue;
             }
             if (state.recordedPr || state.pr || reserved)
@@ -1764,7 +1784,7 @@ export function reservePreviewCommand(state, command, root, scratch) {
             if (!state.repository || (parsed.repository !== undefined && parsed.repository.toLowerCase() !== state.repository.toLowerCase())
                 || (!parsed.repository && realPath(where.cwd) !== where.root))
                 return deny('name this repository explicitly when marking the test drive ready');
-            if (!driveCreated || parsed.branch !== drive)
+            if (!drives.get(parsed.branch)?.created)
                 return deny('mark ready the test drive this run opened');
         }
         if (words[0] === 'gh' && words[1] === 'pr' && (words[2] === 'view' || words[2] === 'checks')) {
@@ -1783,9 +1803,7 @@ export function reservePreviewCommand(state, command, root, scratch) {
     state.pushReservations = pushes;
     state.createBranch = create;
     state.creationReserved = reserved;
-    state.driveBranch = drive;
-    state.drivePushes = drivePushes;
-    state.driveCreated = driveCreated;
+    state.drives = drives;
     return allow();
 }
 function canonicalPreviewPr(state, pr) {
@@ -1848,6 +1866,19 @@ export function agreeToHostSetup(log, questionId) {
     if (host && Object.hasOwn(HOST_CLIS, host))
         hostsAgreed(log).add(host);
 }
+/** The hosts whose missing CLI the person said Install to in this run, by the run's log: the agent's pinned install of it runs. */
+const agreedInstalls = new WeakMap();
+function installsAgreed(log) {
+    let hosts = agreedInstalls.get(log);
+    if (!hosts)
+        agreedInstalls.set(log, (hosts = new Set()));
+    return hosts;
+}
+/** Install on a host's CLI screen (#396), for a host whose CLI the agent installs: its pinned install runs for the rest of the setup. */
+export function agreeToCliInstall(log, host) {
+    if (Object.hasOwn(HOST_CLIS, host))
+        installsAgreed(log).add(host);
+}
 /** Whether the person opened this host's setup in this run: the tools that change something on the host ask this, as the fence does for the CLI. */
 export function hostSetupAgreed(log, host) {
     return hostsAgreed(log).has(host);
@@ -1860,6 +1891,7 @@ const linkedVercel = new WeakSet();
  * Vercel project linked in this run keeps its hold until it is settled.
  */
 export function endHostSetup(log, host) {
+    installsAgreed(log).delete(host);
     if (host !== 'vercel' || !linkedVercel.has(log))
         hostsAgreed(log).delete(host);
 }
@@ -2093,7 +2125,7 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
             let shown;
             if (event.toolName === 'bash') {
                 shown = String(input.command ?? '');
-                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log), vercelSettled: vercelFirstDeploymentSettled(log), touched, synced, repository: retry.repository });
+                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), installs: installsAgreed(log), teams: teamsChosen(log), vercelSettled: vercelFirstDeploymentSettled(log), touched, synced, repository: retry.repository });
                 if (decision.verdict === 'allow')
                     decision = reservePreviewCommand(retry, shown, root, scratch);
                 if (decision.verdict === 'allow') {

package/dist/host-questions.js

@@ -45,6 +45,33 @@ export const HOST_SIGNED_IN = {
         confirmLabel: 'Set up',
     },
 };
+/**
+ * A host's CLI that is not on this machine (#396), asked before anything installs it: the package, the version and the
+ * global install with npm. There is no Skip, since the host's setup cannot go on without its CLI: Esc is the person's own install.
+ */
+export function cliInstallScreen(id, cli) {
+    return {
+        id: `${id}-cli-install`,
+        kind: 'confirm',
+        title: `The ${cli.name} CLI isn't installed`,
+        hint: `Setting ${cli.name} up runs its CLI, which isn't on this machine.\n\nThe run installs it for you globally, with npm: the package ${cli.pkg}, version ${cli.version}.`,
+        prompt: `Install ${cli.pkg} ${cli.version}?`,
+        confirmLabel: 'Install',
+        skipLabel: "I'll install it myself",
+    };
+}
+/** The person's own install of a host's CLI: the command to run in another terminal, and the check for the CLI on their yes; `note` says what came before, when the CLI is still missing. */
+export function cliManualScreen(id, cli, note) {
+    return {
+        id: `${id}-cli-manual`,
+        kind: 'confirm',
+        title: `The ${cli.name} CLI isn't installed`,
+        hint: `${note ? `${note}\n\n` : ''}Run this in another terminal:\n\n${cli.command}\n\nThen come back here: the run checks for the ${cli.name} CLI and carries on.`,
+        prompt: 'Installed it?',
+        confirmLabel: note ? 'Check again' : 'Done',
+        skipLabel: 'Install it for me',
+    };
+}
 /** Where a person reads or changes a site's password in Netlify, as Netlify's docs name the page on every plan. */
 export const NETLIFY_PASSWORD_WHERE = 'Project configuration → General → Visitor access';
 /** The wait for a host's build that ran out: the page where the host's builds of pull requests are turned on, and the wait again. */
@@ -82,7 +109,7 @@ const previewsOff = (id, name, where) => ({
     },
 });
 /** The consent to a Vercel bypass secret, saying whose previews Vercel's login keeps and where the secret is revoked. */
-const bypassHint = (whose, where) => `Impeccable reviews each pull request on its preview,\nand Vercel keeps ${whose} behind a login.\n\nVercel's way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time in ${where} Settings → Deployment Protection.`;
+const bypassHint = (whose, where) => `Impeccable reviews each pull request on its preview,\nand Vercel keeps ${whose} behind a login.\n\nVercel's way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time in ${where} Settings → Deployment Protection. Vercel also hands it to the project's builds, as VERCEL_AUTOMATION_BYPASS_SECRET.`;
 /** The consent to a Cloudflare service token, saying which Access application keeps whose previews, and whose policy allows the token. */
 const accessHint = (keeps, policy) => `Impeccable reviews each pull request on its preview, and ${keeps} behind a login.\n\nCloudflare's way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in ${policy} policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.`;
 /** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, the consent to turning a host's pull-request previews on, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one, and to making a site behind Netlify's team login public. */
@@ -155,7 +182,7 @@ export const HOST_SCREENS = {
         prompt: 'Vercel keeps your previews behind a login, and the run did not get a bypass secret in place for them. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
         hint: 'Paste the secret',
     },
-    // Netlify's site password in front of the previews: the one consent to storing the password the run reads from the site as the person, and the paste when it cannot read it.
+    // Netlify's site password in front of the previews: the one consent to storing the password the run reads from the site as the person (netlifyPasswordReplace where it cannot read it).
     'netlify-password': {
         id: 'netlify-password',
         kind: 'confirm',
@@ -165,14 +192,6 @@ export const HOST_SCREENS = {
         confirmLabel: 'Store',
         skipLabel: 'Skip',
     },
-    'netlify-password-key': {
-        id: 'netlify-password-key',
-        kind: 'text',
-        sensitive: true,
-        title: 'Your Netlify previews are protected',
-        prompt: `Netlify keeps your previews behind the site password, and Netlify does not give it back to the run. Find it, or set a new one, in ${NETLIFY_PASSWORD_WHERE}. It is stored encrypted and used only to open previews.`,
-        hint: 'Paste the password',
-    },
     // Netlify's team login in front of the previews: the one consent to making the site public as the person, and the retry once they changed it on Netlify's page where Netlify refused.
     'netlify-visibility': {
         id: 'netlify-visibility',
@@ -228,16 +247,21 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
-/** On a second Netlify site behind a password, the offer to use the one the person typed for another site of this run (#384); on Skip, the paste screen. */
-export function netlifySamePassword(site, other) {
+/**
+ * The consent to a new site password where Netlify does not give the current one back (#395): the run sets it as the
+ * person with the Netlify CLI's sign-in, and it replaces the current one, which the screen says before the yes. It
+ * names the site, after its app on a repository with several (#390), and the live site where the password guards it too.
+ */
+export function netlifyPasswordReplace(site, opts = {}) {
+    const whose = opts.app ? `${opts.app}'s previews, built by the Netlify site ${site},` : `the previews of the Netlify site ${site}`;
     return {
-        id: 'netlify-password-same',
+        id: 'netlify-password-set',
         kind: 'confirm',
         title: 'Your Netlify previews are protected',
-        hint: `The previews of the Netlify site ${site} are behind its site password too. The run tries the password you typed for ${other} on ${site}'s preview first, and saves it for ${site} only if it opens.`,
-        prompt: `Use the same password for ${site}?`,
-        confirmLabel: 'Use it',
-        skipLabel: 'Type another',
+        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps ${whose} behind the site password, which Netlify doesn't give back to tools.\n\nWith the Netlify CLI's sign-in on this machine, the run sets a new site password as you: a long random one, stored encrypted and used only to open previews. It replaces the current password${opts.live ? ', which the live site asks for too' : ''}, so anyone who uses that one will need a new one. You can set your own any time in ${NETLIFY_PASSWORD_WHERE}; put it in the app's Settings too, or reviews stop.`,
+        prompt: `Set a new password on ${site}?`,
+        confirmLabel: 'Set password',
+        skipLabel: 'Skip',
     };
 }
 /** The consent to a Vercel bypass secret, naming the project that holds it and, on a repository with several apps, the app whose previews it opens (#358). */

package/dist/main.js

@@ -79,7 +79,8 @@ export async function main(argv) {
     /** Takes the checkout back to the branch the run started on, once the run has begun; the line the person reads when it cannot. */
     let backToStart;
     /** The keys the run created in the person's host accounts, each as the line the end screen shows, or an error's. */
-    const keysCreated = new Set();
+    /** The end screen's line for each key the run created, by what it is about: a later line about the same thing takes the earlier one's place. */
+    const keysCreated = new Map();
     // Nothing is reported until the flags say where to and whether to.
     let reporter = createReporter({ host: '', off: true });
     // The tab the person approved in goes on to the web page once the run is minted, so the page has a run to show; a stop before then is what it says instead.
@@ -261,37 +262,45 @@ export async function main(argv) {
             const branch = backToStart();
             if (branch)
                 log.write('checkout left on the run\'s branch', branch);
-            // The test drive pushed with no pull request opened from it stays on GitHub, where the host built it (#324).
+            // A test drive pushed with no pull request opened from it stays on GitHub, where the host built it (#324): one, or an app's of several.
             const retry = previewRetryState(log);
-            const pushed = retry.driveBranch && onOrigin(checkout.root, retry.driveBranch) ? retry.driveBranch : undefined;
-            const left = [...keysCreated, ...(branch ? [branch] : [])];
-            // Said only where gh confirms no pull request is open from it, a draft counted: a recorded test drive, or gh unable to say, says nothing.
-            const unopened = async (recorded) => (pushed && !recorded && (await openFrom(slug, pushed)) === false ? [`${pushed} is on GitHub with no pull request: delete the branch there, or open a pull request from it.`] : []);
+            const pushed = [...retry.drives.keys()].filter((drive) => onOrigin(checkout.root, drive));
+            const left = [...keysCreated.values(), ...(branch ? [branch] : [])];
+            // Said only where gh confirms no pull request is open from it, a draft counted: with every pushed one recorded, or gh unable to say, nothing is.
+            const unopened = async (recorded) => (pushed.length > recorded
+                ? (await Promise.all(pushed.map(async (drive) => ((await openFrom(slug, drive)) === false ? [`${drive} is on GitHub with no pull request: delete the branch there, or open a pull request from it.`] : [])))).flat()
+                : []);
             if (report) {
                 const saved = await settle(liveSync.flush(), 5000);
                 const { testPr } = report;
+                // A run that set up several apps: each app's own test drive, named, however many opened (impeccable-reviews#397).
+                const drives = report.testPrs?.length ? report.testPrs : undefined;
                 const setupPr = shownSetupPr(report.setupPr);
                 // On a repository with several apps, "You're all set up" means every app this run picked is: one left unproven is named, with its one step (#286). A run short of that says what is not, and exits 1 (#321).
                 const apps = appsSummary(report.apps ?? []);
                 const end = ending(report);
-                // One pull request a screen, each opened in the browser and put on the clipboard as its screen appears: the test drive, then the setup pull request.
+                // One pull request a screen, each opened in the browser and put on the clipboard as its screen appears: the test drive (each app's, on a repository with several), then the setup pull request.
                 const hand = { open: openBrowser, copy: copyText };
-                if (testPr && setupPr)
+                if (drives)
+                    for (const drive of drives)
+                        await showPullRequest(drive.url, hand, drive.name);
+                else if (testPr && setupPr)
                     await showPullRequest(testPr.url, hand);
                 await showOutro({
                     outcome: end.outcome,
                     title: end.title,
                     result: [resultLine({ ...report, setupPr }), apps.line].filter(Boolean).join(' '),
-                    link: (setupPr ?? testPr)?.url,
+                    // Each app's test drive had its own screen: the last one holds the setup pull request, or lists them all.
+                    link: (setupPr ?? (drives ? undefined : testPr))?.url,
                     links: [
-                        ...(testPr ? [{ label: 'Test drive, watch the review there', url: testPr.url }] : []),
+                        ...(drives ? drives.map((drive) => ({ label: `${drive.name}'s test drive, watch the review there`, url: drive.url })) : testPr ? [{ label: 'Test drive, watch the review there', url: testPr.url }] : []),
                         // Without a current test drive the setup pull request is not ready to merge; the report says why.
                         ...(setupPr ? [{ label: testPr ? 'Setup pull request, merge this' : 'Setup pull request', url: setupPr.url }] : []),
                         { label: 'Web page', url: page },
                     ],
                     todo: end.todo,
                     ...(report.hosts?.length ? { used: report.hosts } : {}),
-                    warnings: [...removed, ...left, ...(await unopened(Boolean(testPr))), ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
+                    warnings: [...removed, ...left, ...(await unopened(drives ? drives.length : testPr ? 1 : 0)), ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
                 // The web page has the report; when it missed it, or the run fell short of all set up, whose why it holds, the report stays here as well.
                 if (!saved?.ok || end.code)
@@ -310,13 +319,15 @@ export async function main(argv) {
                 reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });
             const missed = saved?.ok ? [] : [`The web page missed this (${saved?.error ?? 'no answer'}), so it may still show the run as going.`];
             const drive = liveSync.payload.test_pr, setup = shownSetupPr(liveSync.payload.setup_pr);
+            const drives = Object.entries(liveSync.payload.test_prs ?? {});
+            const driveLinks = drives.length ? drives.map(([key, pr]) => ({ label: `Test drive of ${key}`, url: pr.url })) : drive ? [{ label: 'Test drive', url: drive.url }] : [];
             await showOutro({
                 outcome: 'stopped',
                 title: cancelled && !fatal ? 'Setup cancelled' : 'Setup failed',
                 result: why,
-                links: [...(drive ? [{ label: 'Test drive', url: drive.url }] : []), ...(setup ? [{ label: 'Setup pull request', url: setup.url }] : []), { label: 'Web page', url: page }],
+                links: [...driveLinks, ...(setup ? [{ label: 'Setup pull request', url: setup.url }] : []), { label: 'Web page', url: page }],
                 todo: ['Run impeccable-reviews again to carry on. What was saved stays saved; the web page has the details.'],
-                warnings: [...removed, ...left, ...(await unopened(Boolean(drive))), ...missed],
+                warnings: [...removed, ...left, ...(await unopened(drives.length || (drive ? 1 : 0))), ...missed],
             });
             await reporter.done();
             process.exit(1);
@@ -341,7 +352,7 @@ export async function main(argv) {
                 sync: liveSync,
                 viewPullRequest: (n) => viewPullRequest(`${token.repository.owner}/${token.repository.name}`, n),
                 onReport: (r) => void (report = r),
-                onKeyCreated: (line) => void keysCreated.add(line),
+                onKeyCreated: (line, about) => void keysCreated.set(about ?? line, line),
                 log,
                 previewWait: previewWait(),
                 sandbox,
@@ -385,7 +396,7 @@ export async function main(argv) {
         console.error(message);
         // A run that stopped on an error goes back to its starting branch too, or says where the checkout is.
         const branch = backToStart?.();
-        for (const line of [...keysCreated, ...(branch ? [branch] : [])])
+        for (const line of [...keysCreated.values(), ...(branch ? [branch] : [])])
             console.error(line);
         await Promise.all([letTabsHear(), reporter.done()]);
         process.exit(1);