@impeccable/reviews 0.1.20 → 0.1.22

package/dist/tools.js

@@ -7,22 +7,22 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
+import { agreeToCliInstall, agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, HOST_CLI_VERSIONS, hostCliInstallArgs, hostCliInstallCommand, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifySamePassword, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cliInstallScreen, cliManualScreen, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifyPasswordReplace, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, vercelDeploymentOf } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
-import { passNetlifyLock } from './netlify-password.js';
+import { netlifyToken, passNetlifyLock, setSitePassword } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
-import { fitsTask, stagesOf } from './stages.js';
+import { fitsTask, stagesOf, workStarted } from './stages.js';
 import { redact } from './log.js';
 import { scan } from './scan.js';
-import { gitEnvironment } from './sandbox.js';
+import { gitEnvironment, installEnvironment, ownFolder } from './sandbox.js';
 import { openBrowser } from './login.js';
 import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
 import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
@@ -245,7 +245,11 @@ const PULL_REQUEST = {
 };
 const TEST_PR = {
     ...PULL_REQUEST,
-    properties: { ...PULL_REQUEST.properties, setup_pr: { ...PULL_REQUEST, description: 'The setup pull request, when there is one: this run\'s, or on a rerun the earlier run\'s.' } },
+    properties: {
+        ...PULL_REQUEST.properties,
+        appKey: { type: 'string', minLength: 1, description: 'On a repository with several apps, the key of the app whose own test drive this is.' },
+        setup_pr: { ...PULL_REQUEST, description: 'The setup pull request, when there is one: this run\'s, or on a rerun the earlier run\'s.' },
+    },
 };
 /** An app's key as the setup state gives it. */
 const APP_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
@@ -1547,8 +1551,10 @@ export function createTools(ctx) {
     const text = (t, terminate = false) => ({ content: [{ type: 'text', text: t }], details: undefined, ...(terminate ? { terminate } : {}) });
     const retry = previewRetryState(ctx.log);
     retry.repository ??= `${ctx.owner}/${ctx.repo}`;
-    /** The branches of the recorded test drive and setup pull request, as GitHub named them. */
+    /** The branches of the recorded test drives (by app key on a repository with several apps, '' on one) and setup pull request, as GitHub named them. */
     let recordedBranches;
+    /** On a repository with several apps, each app's recorded test drive, in the order they were recorded (impeccable-reviews#397). */
+    const appDrives = new Map();
     retry.recordedPr ??= ctx.sync.payload.setup_pr;
     let memory = previewMemories.get(ctx.log);
     if (!memory) {
@@ -1699,15 +1705,14 @@ export function createTools(ctx) {
     /**
      * The Netlify site passwords saved in this run, by site, for the proof of that site's addresses to send; never for the
      * model. Each is one site's, so it goes only to that site's deploy previews, and a monorepo's sites keep theirs side by
-     * side (#384): with what the tool answered, whether the person typed it, and the apps it is saved for.
+     * side (#384): with what the tool answered, and the apps it is saved for.
      */
     const sitePasswords = new Map();
     /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, the team login kept after the retries stays, and a site made public stays public. Another site of the repository is read on its own. */
     const passwordStands = new Map();
-    /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
+    /** The sites whose password the person said yes to storing, and those whose password they said yes to replacing, each its own: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
     const passwordConsented = new Set();
-    /** The sites whose last typed password did not open the preview: the paste screen, asked again, says so first (#375). */
-    const passwordRefused = new Set();
+    const passwordReplaceConsented = new Set();
     /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
     let accessGated;
     /** The service token that opened a preview in this run, what the tool said of it, the Pages projects it opened and whether the store holds it: once it does, the proofs of those projects' previews send it; never the model. */
@@ -1799,7 +1804,7 @@ export function createTools(ctx) {
         teamChoices.delete(host);
         endHostSetup(ctx.log, host);
     };
-    const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
+    const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel', cloudflare: 'Cloudflare' };
     /** The Vercel project and the Netlify site this run set up, by name, for the pages of theirs a screen opens. */
     let vercelProject;
     /** The repository a Vercel project the link file names must be connected to before the run changes it or sends its secret anywhere. */
@@ -1876,6 +1881,93 @@ export function createTools(ctx) {
             team: async () => ({ choices: teams.length > 1 ? await netlifyTeams(cli) : [] }),
         };
     };
+    /** Each host's CLI by its npm package, as its install screens name it (#396). */
+    const CLI_PACKAGES = { vercel: 'vercel', netlify: 'netlify-cli', cloudflare: 'cf' };
+    /** What the person chose on a host's CLI install screen, by host: the run's install, or their own. */
+    const cliInstalls = new Map();
+    /**
+     * A host's CLI that is not on this machine (#396): one screen naming the package, the pinned version and the global
+     * install with npm, before anything installs it. On Install, `install` runs it and answers whether it completed (cf,
+     * which only the tools run), or, where the install is the agent's (Vercel's and Netlify's, through the fence's pinned
+     * rule), this opens that install and answers `agent`. On the person's own install, the command to run in another
+     * terminal, the CLI looked for on their yes, and the steps again, saying so, while it is still missing; an install that
+     * did not complete, the run's or the agent's, shows those steps too. Answers `installed` once `present` finds the CLI;
+     * a stopped run throws.
+     */
+    async function installHostCli(host, present, install, signal) {
+        const pkg = CLI_PACKAGES[host];
+        const cli = { name: HOST_NAMES[host], pkg, version: HOST_CLI_VERSIONS[pkg], command: hostCliInstallCommand(pkg) };
+        const FAILED = "The install didn't complete.";
+        const MISSING = `The ${cli.name} CLI still isn't on this machine.`;
+        const runInstall = async () => {
+            cliInstalls.set(host, 'run');
+            if (install === 'agent') {
+                agreeToCliInstall(ctx.log, host);
+                return 'agent';
+            }
+            said(`Installing ${pkg} ${cli.version}`);
+            const done = (await install()) && (await present());
+            signal?.throwIfAborted();
+            return done ? 'installed' : undefined;
+        };
+        // No answer at all (the input ended, or the run stopped) is neither way on: nothing is installed, and nothing more asked.
+        const answered = (answer) => {
+            signal?.throwIfAborted();
+            if (answer.closed)
+                throw new Error(`No answer came on the ${cli.name} CLI's screen, so nothing was installed.`);
+            return answer;
+        };
+        let note;
+        const chose = cliInstalls.get(host);
+        if (!chose) {
+            const answer = answered(await ask(cliInstallScreen(host, cli)));
+            if (answer.skipped)
+                cliInstalls.set(host, 'person');
+            else {
+                const done = await runInstall();
+                if (done)
+                    return done;
+                note = FAILED;
+            }
+        }
+        else
+            note = chose === 'run' ? FAILED : MISSING;
+        const wait = ctx.hostWait?.cli ?? { totalMs: 30_000, everyMs: 2_000 };
+        for (;;) {
+            const answer = answered(await ask(cliManualScreen(host, cli, note)));
+            if (answer.skipped) {
+                const done = await runInstall();
+                if (done)
+                    return done;
+                note = FAILED;
+                continue;
+            }
+            // Looked for at once, then every so often for a while: an install in the other terminal may still be finishing.
+            said(`Looking for the ${cli.name} CLI`);
+            for (const end = Date.now() + wait.totalMs;; await sleep(wait.everyMs, undefined, { signal }).catch(() => undefined)) {
+                signal?.throwIfAborted();
+                if (await present())
+                    return 'installed';
+                if (Date.now() >= end)
+                    break;
+            }
+            cliInstalls.set(host, 'person');
+            note = MISSING;
+        }
+    }
+    /** The run's own install of a host CLI's package, for installHostCli: npm's pinned global install, from the command's own folder and npm cache, as the agent's install of one runs; whether it completed. */
+    const npmInstall = (pkg, signal) => async () => {
+        try {
+            await (ctx.hostRunner ?? commandRunner)('npm', ownFolder(), { signal, timeoutMs: 600_000, env: installEnvironment() })(hostCliInstallArgs(pkg));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    /** cf, Cloudflare's CLI, which only the tools run: where it is missing here, its install is asked first (#396). */
+    const cfPresent = async (pi, signal) => (await cfStatus(cfRunner({ checkout: pi.cwd }, ctx.hostRunner), signal)).cli !== 'missing';
+    const installCf = (pi, signal) => installHostCli('cloudflare', () => cfPresent(pi, signal), npmInstall('cf', signal), signal);
     /**
      * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: the setup screen once, worded for a CLI signed in
      * already (the yes opens the setup with that sign-in, and no login runs) or for one signed out, and on its yes the
@@ -1906,10 +1998,14 @@ export function createTools(ctx) {
         }
         if (status.cli === 'signed-in')
             return signedIn();
-        // The CLI is installed through the fence's package-manager rule, which this yes opens; then this is asked again.
+        // The CLI's own screen first (#396). On Install the agent installs it through the fence's pinned rule, which that yes opens, and this is asked again; the person's own install, once found, goes on to the sign-in.
         if (status.cli === 'missing') {
             agreeToHostSetup(ctx.log, `${host}-setup`);
-            return { confirmed: true, cli: 'missing' };
+            if ((await installHostCli(host, async () => (await cli.status()).cli !== 'missing', 'agent', signal)) === 'agent')
+                return { confirmed: true, cli: 'missing' };
+            status = await cli.status();
+            if (status.cli === 'signed-in')
+                return signedIn();
         }
         for (let attempt = 0;; attempt++) {
             said(`Opening the browser for ${HOST_NAMES[host]}'s login`);
@@ -2131,8 +2227,12 @@ export function createTools(ctx) {
     /** What the run did for each picked app, as its own tool calls found it, sent with the session whenever it changes (#2307). */
     const appSummaries = new Map();
     const sendApps = () => ctx.sync.update({ apps: [...appSummaries.values()].slice(0, 50) });
+    /** Whether this run gives each app a test drive of its own: it sets up more than one app of a repository with several (impeccable-reviews#397). */
+    const perAppDrives = () => appsRepo && (pickedApps?.size ?? 0) > 1;
     const pick = (keys) => {
         pickedApps = keys;
+        // Each app this run sets up gets a test drive of its own (impeccable-reviews#397).
+        retry.drivesAllowed = Math.max(1, keys.size);
         const before = new Map(appSummaries);
         appSummaries.clear();
         for (const key of keys)
@@ -2228,8 +2328,13 @@ export function createTools(ctx) {
         }
         return null;
     };
+    /**
+     * Why a host's lock tool may not run yet: the list still shows the repository being read, so its consent and the push
+     * after it would go by on "Understanding your app" (#390). Null once that task is done.
+     */
+    const readingRefusal = (tool) => workStarted(ctx.sync.payload.tasks) ? null : `Refused: the task list shows no work past reading the repository yet, so the screen still says "Understanding your app". Call impeccable_progress first with Read the repository completed and Preview method in progress, then ${tool} again. Nothing was asked or sent.`;
     /** How this run left each app the state lists (#286), for the report and the last screen. */
-    const appOutcomes = async (pi) => {
+    const appOutcomes = async (pi, stale = new Set()) => {
         const apps = knownApps ?? (await stateApps(pi)) ?? [];
         return apps.map(({ key, name, folder }) => {
             const method = appMethods.get(key);
@@ -2240,9 +2345,12 @@ export function createTools(ctx) {
             // Impeccable's own last check of its preview met a wall: its reviews will meet it too (#383).
             if (method !== undefined && checkWalls.has(key))
                 return { key, name, folder, state: 'walled', left: `${name}: Impeccable's check of its preview met ${checkWalls.get(key)}; open its Settings.` };
+            // Its test drive ran on the setup branch before its last change, so it shows nothing of what is merged (#397).
+            if (method !== undefined && stale.has(key))
+                return { key, name, folder, state: 'stale', left: `${name}: its test drive predates the setup pull request's last change; run impeccable-reviews again.` };
             if (method !== undefined && (method !== 'preview-deploy' || proven)) {
-                // With a test drive open, each app's preview is checked once (pull-requests' step 6): one the setup API never answered is named (#338).
-                return ctx.sync.payload.test_pr && !checkedApps.has(key)
+                // With its test drive open, each app's preview is checked once (pull-requests' step 6): one the setup API never answered is named (#338).
+                return appDrives.has(key) && !checkedApps.has(key)
                     ? { key, name, folder, state: 'ready', unchecked: true, left: `${name}: Impeccable's check of its preview did not run here; the test drive's review shows whether it reaches it.` }
                     : { key, name, folder, state: 'ready' };
             }
@@ -2261,6 +2369,8 @@ export function createTools(ctx) {
             return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
         if (a.state === 'unset')
             return `- ${where}: not set up. No preview method was saved for it.`;
+        if (a.state === 'stale')
+            return `- ${where}: not set up. Method: ${appMethods.get(a.key)}, but its test drive was branched before the setup branch's last change, so it was left out.`;
         if (a.state === 'walled')
             return `- ${where}: not set up. Method: ${appMethods.get(a.key)}, but Impeccable's own check of its preview met ${checkWalls.get(a.key)}.`;
         return `- ${where}: not set up this run.`;
@@ -2585,28 +2695,49 @@ export function createTools(ctx) {
             reportTasks(tasks);
             return 'Saved.';
         }),
-        tool('impeccable_test_pr', 'Record the pull requests', 'Record the test drive as soon as it is open, so the web page follows its review, and again with setup_pr once the setup pull request is open. Each must be an open pull request from this repository\'s own impeccable/ branch, the test drive\'s also changing the existing page that links to it; the setup pull request, once recorded, cannot change.', TEST_PR, async (p, pi, signal) => {
+        tool('impeccable_test_pr', 'Record the pull requests', 'Record the test drive as soon as it is open, so the web page follows its review, and again with setup_pr once the setup pull request is open; on a repository with several apps, each app\'s own test drive with its appKey, as it opens. Each must be an open pull request from this repository\'s own impeccable/ branch, the test drive\'s also changing the existing page that links to it; the setup pull request, once recorded, cannot change.', TEST_PR, async (p, pi, signal) => {
             const drive = { number: p.number, url: p.url.trim() };
             const given = p.setup_pr;
             const setup = given && { number: given.number, url: given.url.trim() };
             if (setup?.number === drive.number)
                 return `Refused: #${drive.number} cannot be both the test drive and the setup pull request.`;
+            // A run that sets up several apps of a repository gives each a test drive of its own (impeccable-reviews#397); one that sets up one app, its one test drive.
+            const several = perAppDrives();
+            const sole = appsRepo && pickedApps?.size === 1 ? [...pickedApps][0] : undefined;
+            const appKey = several || p.appKey !== undefined ? p.appKey : sole;
+            if (appsRepo) {
+                // The apps question comes first; then the app named, which only a run that sets up one app may leave out.
+                const refused = appRefusal(appKey, 'recorded');
+                if (refused)
+                    return refused;
+                const other = [...appDrives].find(([key, pr]) => key !== appKey && pr.number === drive.number);
+                if (other)
+                    return `Refused: #${drive.number} is ${appName(other[0])}'s test drive. Each app gets a test drive of its own, as the monorepo case says. Nothing was recorded.`;
+            }
+            const key = typeof appKey === 'string' ? appKey : '';
             const found = await runPullRequest(ctx, drive, 'impeccable/test-drive', signal);
             if ('problem' in found)
                 return `Refused: ${found.problem}.`;
             drive.url = found.url;
+            if (several && [...(recordedBranches?.drives ?? [])].some(([other, branch]) => other !== key && branch === found.branch)) {
+                return `Refused: ${found.branch} is another app's test drive. Each app's test drive comes from a branch of its own (impeccable/test-drive-<appKey>), as the monorepo case says. Nothing was recorded.`;
+            }
             // The page that links to the test drive is an existing file the branch changes; files under dot folders (.github, .netlify) and dotfiles never link to it (#241).
-            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch, true) : null;
+            const changes = recordedBranches?.drives.get(key) !== found.branch && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch, true) : null;
             const files = (changes ?? []).filter(({ path }) => !path.split('/').some((part) => part.startsWith('.')));
             if (files.length && files.every(({ status }) => status === 'A')) {
                 return `Refused: ${found.branch} only adds ${files.map(({ path }) => path).join(', ')} and changes no existing page, so nothing links to the test drive. Commit the page that links to it and push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
             }
-            // On a repository with several apps, the test drive's page goes into a picked app's own folder, and no other app is touched (#286): a file it adds anywhere else is refused, whatever its name. The setup branch's own files (a build fix at the root) are not in `files`, as pushedChanges leaves them out.
+            // On a repository with several apps, an app's test drive adds its page to that app's own folder, and no other app is touched (#286, #397): a file it adds anywhere else, or changes in another app's (a root app's included), is refused, whatever its name. A file belongs to the app whose folder holds it most closely; one no app's folder holds (a shared root file) is no app's. The setup branch's own files (a build fix at the root) are not in `files`, as pushedChanges leaves them out.
             if (appsRepo && pickedApps) {
-                const folders = (await Promise.all([...pickedApps].map((key) => appFolder(pi, key)))).filter((folder) => folder !== undefined);
-                const outside = files.filter(({ status, path }) => status === 'A' && !folders.some((folder) => !folder || path.startsWith(`${folder}/`))).map(({ path }) => path);
+                const apps = knownApps ?? (await stateApps(pi)) ?? [];
+                const ownerOf = (path) => apps.filter((a) => !a.folder || path.startsWith(`${a.folder}/`)).sort((a, b) => b.folder.length - a.folder.length)[0];
+                const outside = files.filter(({ status, path }) => {
+                    const owner = ownerOf(path);
+                    return status === 'A' ? owner?.key !== key : owner !== undefined && owner.key !== key;
+                }).map(({ path }) => path);
                 if (outside.length)
-                    return `Refused: ${found.branch} adds ${outside.join(', ')}, outside the folders of the apps this run sets up (${folders.map((folder) => folder || '/').join(', ')}). The test drive's page goes into each picked app's own folder, as the monorepo case says, and no other app is touched: move it, push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
+                    return `Refused: ${found.branch} changes ${outside.join(', ')}, outside the folder of ${appName(key)} (${(await appFolder(pi, key)) || '/'}). Each app's test drive adds its page to its own app and touches no other, as the monorepo case says: move it, push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
             }
             let setupBranch = recordedBranches?.setup, setupBase = recordedBranches?.setupBase;
             if (setup) {
@@ -2621,10 +2752,14 @@ export function createTools(ctx) {
                 setupBranch = head.branch;
                 setupBase = head.base;
             }
-            ctx.sync.update({ test_pr: drive, ...(setup ? { setup_pr: setup } : {}) });
-            recordedBranches = { drive: found.branch, setup: setupBranch, setupBase };
+            if (appsRepo)
+                appDrives.set(key, drive);
+            // The first app's test drive stays the one the web page's status follows; each app's goes beside it, by its key.
+            const first = several ? appDrives.values().next().value : drive;
+            ctx.sync.update({ test_pr: first, ...(several ? { test_prs: Object.fromEntries(appDrives) } : {}), ...(setup ? { setup_pr: setup } : {}) });
+            recordedBranches = { drives: new Map(recordedBranches?.drives).set(key, found.branch), setup: setupBranch, setupBase };
             const res = await ctx.sync.flush();
-            const what = `the test drive #${drive.number}${setup ? ` and the setup pull request #${setup.number}` : ''}`;
+            const what = `${several ? `${appName(key)}'s test drive` : 'the test drive'} #${drive.number}${setup ? ` and the setup pull request #${setup.number}` : ''}`;
             return res?.ok
                 ? `Recorded ${what}. The web page follows the test drive's review from now on.`
                 : `Recorded ${what} here, but the web page did not take it yet (${res?.error ?? 'no answer'}). The report links them too.`;
@@ -2653,8 +2788,22 @@ export function createTools(ctx) {
                 const shown = (path) => path.replace(/[\\`*_[\]<>|~]/g, '\\$&').replace(/[\x00-\x1f\x7f]/g, (c) => JSON.stringify(c).slice(1, -1));
                 markdown += `\n\n## What the setup pull request changes\n\n${changes ? changes.map(({ status, path }) => `- ${shown(path)} (${verbs[status] ?? status})`).join('\n') || 'Nothing: it carries no file.' : 'This checkout could not list its files: read them on the pull request before merging.'}`;
             }
-            // On a repository with several apps, how this run left each app, from what it saved and proved (#286).
-            const apps = appsRepo && pickedApps ? await appOutcomes(pi) : undefined;
+            // A test drive branched before the setup branch was corrected ran on the old head: it shows nothing about this one. On a repository with several apps, each app's is judged on its own.
+            const covers = async (key) => {
+                const branch = recordedBranches?.drives.get(key);
+                // An app whose host builds its previews needs nothing of the setup branch: its test drive (from the default branch, in its host's setup case) stands (#397).
+                if (appsRepo && appMethods.get(key) === 'preview-deploy')
+                    return true;
+                return !recordedBranches?.setup || !branch || (await (ctx.driveCoversSetup ?? driveCoversSetup)(pi.cwd, recordedBranches.setup, branch)) !== false;
+            };
+            const kept = [];
+            for (const [key, pr] of appDrives)
+                if (await covers(key))
+                    kept.push([key, pr]);
+            const several = perAppDrives();
+            const drive = several ? kept[0]?.[1] : ctx.sync.payload.test_pr && (await covers(appsRepo ? [...appDrives.keys()][0] ?? '' : '')) ? ctx.sync.payload.test_pr : undefined;
+            // On a repository with several apps, how this run left each app, from what it saved and proved (#286); one whose test drive was left out is not set up (#397).
+            const apps = appsRepo && pickedApps ? await appOutcomes(pi, new Set([...appDrives.keys()].filter((key) => !kept.some(([k]) => k === key)))) : undefined;
             if (apps)
                 markdown += appsSection(apps);
             if (previews.active && retry.pr) {
@@ -2666,11 +2815,7 @@ export function createTools(ctx) {
                 if (!left.includes('Watch the review on the test drive'))
                     left.push('Watch the review on the test drive');
             }
-            const { phase, status, question, report_markdown, test_pr, left: leftBefore } = ctx.sync.payload;
-            // A test drive branched before the setup branch was corrected ran on the old head: it shows nothing about this one.
-            const covered = test_pr && recordedBranches?.setup
-                ? await (ctx.driveCoversSetup ?? driveCoversSetup)(pi.cwd, recordedBranches.setup, recordedBranches.drive) : null;
-            const drive = covered === false ? undefined : test_pr;
+            const { phase, status, question, report_markdown, test_pr, test_prs, left: leftBefore } = ctx.sync.payload;
             // Why an app was not proven or keyed goes with its summary only as plain words, with no address (a scheme, or a host with a path or query) and nothing shaped like a secret; anything else is dropped.
             const appsBefore = new Map(appSummaries);
             for (const { appKey, reason } of p.apps ?? []) {
@@ -2680,11 +2825,11 @@ export function createTools(ctx) {
                     noteApp(appKey, { reason: plain });
             }
             // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
-            ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, left: left.slice(0, 20) });
+            ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
-                ctx.sync.update({ phase, status, question, report_markdown, test_pr, left: leftBefore });
+                ctx.sync.update({ phase, status, question, report_markdown, test_pr, test_prs, left: leftBefore });
                 // Its reasons go with it: the report sent again gives its own.
                 if (appsBefore.size) {
                     for (const [key, was] of appsBefore)
@@ -2695,7 +2840,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -2854,7 +2999,7 @@ export function createTools(ctx) {
                 noteApp(appKey, { host_project: site });
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -2885,12 +3030,19 @@ export function createTools(ctx) {
             // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
             const app = cloudflareEvidence?.githubApp;
             const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false } : undefined;
-            const waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            // cf not on this machine (#396): its install is asked before anything installs it, and the evidence read again with it.
+            if (!subject && waited.cli === 'missing') {
+                await installCf(pi, signal);
+                waited = await read();
+            }
             const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
             // By the label the project's addresses carry.
             const label = (evidence.production && pagesProject(evidence.production)) || evidence.project;
             if (accountName && label && !evidence.unmatched)
                 accountOf.set(`cloudflare ${label}`, accountName);
+            if (accountName && evidence.account)
+                accountOf.set(`cloudflare account ${evidence.account}`, accountName);
             if (!subject)
                 cloudflareEvidence = evidence;
             if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project) {
@@ -3029,6 +3181,7 @@ export function createTools(ctx) {
             if ((await ask({ ...screen, prompt: `Turn on pull-request previews for ${fact.project}?` })).skipped)
                 return answer('skipped', { reason: 'The person skipped turning pull-request previews on.' });
             said(`Turning on pull-request previews on ${name}`);
+            // cf is installed here: the fact this acts on is one a read through cf found.
             const turnOn = async () => {
                 if (host === 'netlify')
                     return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
@@ -3081,6 +3234,11 @@ export function createTools(ctx) {
             const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner);
             const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
             let status = await cfStatus(cf, signal);
+            // cf not on this machine (#396): its install is asked first.
+            if (status.cli === 'missing') {
+                await installCf(pi, signal);
+                status = await cfStatus(cf, signal);
+            }
             if (!writes(status)) {
                 if (status.cli === 'missing' || status.cli === 'unknown')
                     return answer('refused', { reason: "Cloudflare's CLI did not run here." });
@@ -3126,6 +3284,9 @@ export function createTools(ctx) {
         }),
         tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts), or, with no such file, the one Vercel lists as connected to this repository, so no vercel link is needed (where the CLI is signed out, the consent screen comes first and its yes signs it in, in the browser), and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back. With beforePush (and the app\'s appKey on a repository with several apps), before the test drive\'s push, where no preview met Vercel\'s login yet (#356): it reads the project the same way, and where its settings show Deployment Protection in front of the previews and it holds no secret labelled "Impeccable reviews", shows the consent screen now, naming the project and the app, so the person answers before anything is pushed; the secret is made on the yes once the test drive\'s preview meets the login, with no second question. Answers {"protected": false} (no lock: push), {"protected": true, "consent": "given" or "not-needed"} (push, and call this again without beforePush once the proof meets the gate), {"protected": "unknown", "reason": …} (the project could not be read: push, and the consent comes when the gate is met) or {"status": "skipped", …} (push no test drive; reason says why).', VERCEL_BYPASS, async (p, pi, signal) => {
             const before = p.beforePush === true;
+            const reading = readingRefusal('impeccable_vercel_bypass');
+            if (reading)
+                return reading;
             if (before) {
                 const refused = appRefusal(p.appKey, 'asked');
                 if (refused)
@@ -3134,6 +3295,9 @@ export function createTools(ctx) {
             else if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first, or call it with beforePush before the test drive\'s push.';
             const at = before ? undefined : gated;
+            // The work after the 302 takes a while (the project's read, the secret, its proof): the screen says what it is (#390).
+            if (at)
+                said("Getting past Vercel's login");
             if (at?.app)
                 lockPending.delete(at.app.appKey);
             const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
@@ -3309,11 +3473,15 @@ export function createTools(ctx) {
             }
             return JSON.stringify(outcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, signed in with Netlify\'s site password on Netlify\'s own form, as reviews sign in (no request header carries it). It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one (after one offering the password the person typed for another site of this run, where there is one); opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, signed in with Netlify\'s site password on Netlify\'s own form, as reviews sign in (no request header carries it). It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen asking to set a new one, which replaces the site\'s current password, and on that yes sets a long random one on the site as the person with the Netlify CLI\'s sign-in (it never comes back, and nothing is pasted); opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was the site\'s existing one or a new one the run set, and site which Netlify site it is; replaced, on any answer, says the run set a new site password, which replaced the one before, saved or not), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
+            const reading = readingRefusal('impeccable_netlify_password');
+            if (reading)
+                return reading;
             const at = gated;
+            said("Getting past Netlify's password");
             if (at.app)
                 lockPending.delete(at.app.appKey);
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
@@ -3354,62 +3522,85 @@ export function createTools(ctx) {
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
-            /** The person typed a password on the paste screen in this call. */
-            let typed = false;
-            const { value, ...told } = await passNetlifyLock({
-                run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
-                site,
-                consent: async () => {
-                    if (passwordConsented.has(site) || !(await ask(sentTo(HOST_SCREENS['netlify-password'], at.url))).skipped)
-                        return passwordConsented.add(site), true;
-                    return false;
-                },
-                makePublic: async () => !(await ask(HOST_SCREENS['netlify-visibility'])).skipped,
-                ...(at.teamLogin ? { teamLogin: true } : {}),
-                // The yes to making the site public stands for the sign-in it needs: no second question before Netlify's login opens in the browser.
-                signIn: async () => {
-                    if (!hostSignIns.has('netlify'))
-                        hostSignIns.set('netlify', 'confirmed');
-                    return (await hostSignIn('netlify', pi, signal)).signedIn === true;
-                },
-                retry: async (page, first) => {
-                    if (first)
-                        (ctx.openBrowser ?? openBrowser)(page);
-                    // The browser may not have opened (BROWSER=none, no opener): the address is on the screen as well.
-                    const screen = HOST_SCREENS['netlify-visibility-retry'];
-                    return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
-                },
-                paste: async () => {
-                    // One password for several sites is common: the one typed for another site of this run is offered first, once, never after it was refused here (#384).
-                    const other = passwordRefused.has(site) ? undefined : [...sitePasswords].find(([name, h]) => name !== site && h.typed);
-                    if (other && !(await ask(netlifySamePassword(site, other[0]))).skipped) {
-                        typed = true;
-                        return other[1].value;
-                    }
-                    const screen = sentTo(HOST_SCREENS['netlify-password-key'], at.url);
-                    const answer = await ask(passwordRefused.has(site) ? { ...screen, prompt: `The password typed last didn't open the preview on Netlify's form, so nothing was saved. Check it and type it again. ${screen.prompt}` } : screen);
-                    typed = !answer.skipped;
-                    return answer.skipped ? undefined : answer.value?.trim();
-                },
-                prove,
-                save: async (password) => {
-                    // Bound to the site the CLI read as the person's: reviews send it to no other site's addresses.
-                    const saved = await saveLock(pi, 'password', { method: 'password', site }, password, at.app?.appKey);
-                    stored = saved.stored;
-                    return saved.failed;
-                },
-                remember: noteSensitiveAnswer,
-            });
+            /** Netlify took a new password the run set in this call: the end screen says so, saved or not, and on a cancel too. */
+            let replaced = false;
+            let answer;
+            const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
+            // The Netlify CLI not on this machine (#396): its install is asked first, the run's own since no agent's turn comes in between, and the command runs again.
+            const run = async (args) => {
+                try {
+                    return await netlify(args);
+                }
+                catch (err) {
+                    if (!err.missing)
+                        throw err;
+                    await installHostCli('netlify', async () => (await netlifyStatus(netlify)).cli !== 'missing', npmInstall('netlify-cli', signal), signal);
+                    return netlify(args);
+                }
+            };
+            try {
+                answer = await passNetlifyLock({
+                    run,
+                    site,
+                    consent: async () => {
+                        if (passwordConsented.has(site) || !(await ask(sentTo(HOST_SCREENS['netlify-password'], at.url))).skipped)
+                            return passwordConsented.add(site), true;
+                        return false;
+                    },
+                    makePublic: async () => !(await ask(HOST_SCREENS['netlify-visibility'])).skipped,
+                    ...(at.teamLogin ? { teamLogin: true } : {}),
+                    // The yes to making the site public stands for the sign-in it needs: no second question before Netlify's login opens in the browser.
+                    signIn: async () => {
+                        if (!hostSignIns.has('netlify'))
+                            hostSignIns.set('netlify', 'confirmed');
+                        return (await hostSignIn('netlify', pi, signal)).signedIn === true;
+                    },
+                    retry: async (page, first) => {
+                        if (first)
+                            (ctx.openBrowser ?? openBrowser)(page);
+                        // The browser may not have opened (BROWSER=none, no opener): the address is on the screen as well.
+                        const screen = HOST_SCREENS['netlify-visibility-retry'];
+                        return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
+                    },
+                    replace: async (live) => {
+                        if (passwordReplaceConsented.has(site) || !(await ask(netlifyPasswordReplace(site, { ...(at.app ? { app: appName(at.app.appKey) } : {}), live }))).skipped)
+                            return passwordReplaceConsented.add(site), true;
+                        return false;
+                    },
+                    // Netlify's API, called from this process with the token the CLI signed in with: the password never goes on a command line (#395).
+                    setPassword: (id, password) => {
+                        const token = (ctx.netlifyToken ?? netlifyToken)();
+                        if (token)
+                            noteSensitiveAnswer(token);
+                        return setSitePassword(id, password, { token, fetch: ctx.netlifyFetch ?? fetch, signal });
+                    },
+                    changed: () => void (replaced = true),
+                    ...(ctx.hostWait?.password ? { wait: ctx.hostWait.password } : {}),
+                    signal,
+                    prove,
+                    save: async (password) => {
+                        // Bound to the site the CLI read as the person's: reviews send it to no other site's addresses.
+                        const saved = await saveLock(pi, 'password', { method: 'password', site }, password, at.app?.appKey);
+                        stored = saved.stored;
+                        return saved.failed;
+                    },
+                    remember: noteSensitiveAnswer,
+                });
+            }
+            finally {
+                if (replaced) {
+                    ctx.onKeyCreated?.(answer?.status === 'saved'
+                        ? `Impeccable set a new Netlify site password on ${site} as you and saved it for reviews, so its previews stay password-protected. It replaced the one before, which no longer opens them: set one people know in Netlify (${NETLIFY_PASSWORD_WHERE}) any time, and put it in the app's Settings too, under "A way past your host's lock", or reviews stop.`
+                        : `Impeccable set a new Netlify site password on ${site} as you, which replaced the one before, but it was not saved for reviews. Set a password people know in Netlify (${NETLIFY_PASSWORD_WHERE}), and put it in the app's Settings too, under "A way past your host's lock".`, `netlify-password:${site}`);
+                }
+            }
+            const { value, ...told } = answer;
             const passwordOutcome = { ...told, ...(told.status === 'saved' || told.status === 'opened' ? { proven: true } : {}) };
             // Netlify's settings show no lock on the site (none, or none left once it was made public): the last screen blames none (#321). Else they say which lock it is.
             if (told.protection === 'none' && lastLock === 'netlify-protection')
                 lastLock = undefined;
             if (told.protection === 'password' || told.protection === 'team-login')
                 lastTeamLogin = told.protection === 'team-login';
-            if (told.status === 'refused' && typed)
-                passwordRefused.add(site);
-            else if (told.status === 'saved')
-                passwordRefused.delete(site);
             if (told.status === 'skipped' || told.status === 'login' || told.status === 'opened')
                 passwordStands.set(site, passwordOutcome);
             if (told.status === 'opened') {
@@ -3422,8 +3613,13 @@ export function createTools(ctx) {
                 provePattern(pattern, at.app?.appKey);
             }
             if (value) {
+                // Said once it opened the preview and was saved, so the screen does not go straight back to the tasks (#390); the end screen names it and where it changes.
+                said(`Password works: saved for ${at.app ? appName(at.app.appKey) : site}`);
+                // A password the run set is named on the end screen as it was set, above. Either line takes the place of an earlier one for the site, such as a replaced password not saved.
+                if (told.password !== 'set')
+                    ctx.onKeyCreated?.(`Impeccable saved the Netlify site password of ${site} for reviews, so its previews stay password-protected. A new password set in Netlify (${NETLIFY_PASSWORD_WHERE}) goes in the app's Settings too, under "A way past your host's lock", or reviews stop.`, `netlify-password:${site}`);
                 // What is in hand follows the store: the password saved now is this site's, beside every other site's.
-                sitePasswords.set(site, { value, saved: passwordOutcome, typed: told.password === 'typed', apps: new Set([at.app?.appKey ?? '']) });
+                sitePasswords.set(site, { value, saved: passwordOutcome, apps: new Set([at.app?.appKey ?? '']) });
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
                 usedPreviews.add(at.url);
@@ -3440,7 +3636,11 @@ export function createTools(ctx) {
         tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, naming the Access application in front of the preview and its Cloudflare account once cf, signed in here, found it (none found: refused, and nothing asked), Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview (an application whose policies are its own gets one screen asking to make them reusable first, and on its skip the paste screen says how to make the token by hand); one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
+            const reading = readingRefusal('impeccable_cloudflare_access');
+            if (reading)
+                return reading;
             const at = accessGated;
+            said('Getting past Cloudflare Access');
             // The call for this app is made, whatever it answers: the skip asked once stands for the next app's lock too.
             if (at.app)
                 lockPending.delete(at.app.appKey);
@@ -3479,7 +3679,9 @@ export function createTools(ctx) {
                     consent: async (found) => {
                         if (found && accessConsented.has(found.id))
                             return true;
-                        const yes = !(await ask(sentTo(found ? cloudflareAccessConsent(found, new URL(at.url).host, at.app && appName(at.app.appKey)) : HOST_SCREENS['cloudflare-access'], at.url))).skipped;
+                        // The account by the name the last screen gives it, where a read found it; else its id (#390).
+                        const named = found && { ...found, account: accountOf.get(`cloudflare account ${found.account}`) ?? found.account };
+                        const yes = !(await ask(sentTo(named ? cloudflareAccessConsent(named, new URL(at.url).host, at.app && appName(at.app.appKey)) : HOST_SCREENS['cloudflare-access'], at.url))).skipped;
                         if (yes && found)
                             accessConsented.add(found.id);
                         return yes;
@@ -3487,6 +3689,7 @@ export function createTools(ctx) {
                     cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
                     login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
+                    install: async () => void (await installCf(pi, signal)),
                     status: said,
                     apiToken: async () => {
                         const typed = await ask(HOST_SCREENS['cloudflare-access-api']);