@impeccable/reviews 0.1.23 → 0.1.25

package/dist/tools.js

@@ -7,7 +7,7 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToCliInstall, agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, HOST_CLI_VERSIONS, hostCliInstallArgs, hostCliInstallCommand, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
+import { agreeToCliInstall, agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endAppSetup, endHostSetup, HOST_CLI_VERSIONS, hostCliInstallArgs, hostCliInstallCommand, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
 import { APPS_QUESTION, cliInstallScreen, cliManualScreen, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifyPasswordReplace, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
@@ -25,7 +25,7 @@ import { scan } from './scan.js';
 import { gitEnvironment, installEnvironment, ownFolder } from './sandbox.js';
 import { openBrowser } from './login.js';
 import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
-import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
+import { askPerson, reportDone, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
 import { SEE_THE_REVIEW } from './ui/look.js';
 import { noteSensitiveAnswer, plainText } from './ui/sensitive.js';
 export { STATUS_MAX, statusVoiceError } from './sync.js';
@@ -108,6 +108,24 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     }
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
+/**
+ * A "no" that leaves an app with no preview Impeccable can open ends the setup for it (#413): no-previews, to setting
+ * previews up (a host's sign-in, connecting the repository, turning pull-request previews on, creating the project, the
+ * host question); no-access, to giving access to protected ones (a host's key). The last screen's heading and line,
+ * when no app is left, and an app's own line where other apps carried on.
+ */
+export const SETUP_ENDS = {
+    'no-previews': {
+        title: 'Impeccable needs previews',
+        line: "Impeccable reviews each pull request by opening its preview. Apps without previews aren't supported for now. Run the setup again when you're ready to set previews up.",
+        said: 'setting previews up',
+    },
+    'no-access': {
+        title: 'Impeccable needs to open your previews',
+        line: "Your previews are behind a login, and Impeccable reviews each pull request by opening its preview. Previews it can't open aren't supported for now. Run the setup again when you're ready to give access.",
+        said: 'giving access to protected previews',
+    },
+};
 /** How many times a preview check the setup API turned away for its rate (one a repository every 30 seconds) is tried again (#338). */
 const CHECK_RETRIES = 3;
 /** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
@@ -142,9 +160,13 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
+    if (report.ended)
+        return SETUP_ENDS[report.ended].line;
     const lead = report.walled ? `Impeccable's own check of the preview met a wall (${report.walled}), so the test drive's review can't see its pages yet. The report, printed here when this screen closes, says what the run found.`
-        : !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
-    return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
+        : !report.testPr ? `${report.unhonoured ?? noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    // --signed-in-test-drive left an app without a test drive: said beside another app's drive or a wall too (#410).
+    const said = report.unhonoured && (report.walled || report.testPr) ? `${lead} ${report.unhonoured}` : lead;
+    return report.setupPr || !report.hostedBy ? said : `${said} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Why a run opened no test drive, as far as what it saved and met tells. */
 const noTestDrive = ({ methodSaved, lock }) => methodSaved ? 'A preview method is saved, but no test drive opened, so nothing shows Impeccable reviewing yet.'
@@ -162,6 +184,9 @@ export function ending(report) {
     const todo = [...new Set([...step, ...apps.todo, ...report.left])];
     if (report.testPr && !apps.notReady.length && !report.walled)
         return { outcome: 'done', title: "You're all set up", todo, code: 0 };
+    // The person's no left no app with a preview Impeccable can open: the setup ended, and the screen says why alone (#413).
+    if (report.ended)
+        return { outcome: 'stopped', title: SETUP_ENDS[report.ended].title, todo: [], code: 1 };
     const outcome = report.methodSaved ? 'partial' : 'stopped';
     // Impeccable's own check said it can't get in: whatever the run saved, reviews will meet the same wall (#383).
     if (report.walled)
@@ -173,6 +198,30 @@ export function ending(report) {
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
 export const nothingToMerge = (host) => `Nothing to merge: ${host} hosts your previews, so the repository needed no change.`;
+/** Names as a reader lists them: "a", "a and b", "a, b and c". */
+const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
+/** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
+const PASSWORD_NOTES = {
+    set: (sites) => sites.length === 1
+        ? `Impeccable set a new Netlify site password on ${sites[0]} as you and saved it for reviews, so its previews stay password-protected. It replaced the one before, which no longer opens them: set one people know in Netlify (${NETLIFY_PASSWORD_WHERE}) any time, and put it in the app's Settings too, under "A way past your host's lock", or reviews stop.`
+        : `Impeccable set a new Netlify site password on each of ${andList(sites)} as you and saved them for reviews, so their previews stay password-protected. They replaced the ones before, which no longer open them: set ones people know in Netlify (${NETLIFY_PASSWORD_WHERE}) any time, and put each in its app's Settings too, under "A way past your host's lock", or reviews stop.`,
+    unsaved: (sites) => sites.length === 1
+        ? `Impeccable set a new Netlify site password on ${sites[0]} as you, which replaced the one before, but it was not saved for reviews. Set a password people know in Netlify (${NETLIFY_PASSWORD_WHERE}), and put it in the app's Settings too, under "A way past your host's lock".`
+        : `Impeccable set a new Netlify site password on each of ${andList(sites)} as you, which replaced the ones before, but they were not saved for reviews. Set passwords people know in Netlify (${NETLIFY_PASSWORD_WHERE}), and put each in its app's Settings too, under "A way past your host's lock".`,
+    stored: (sites) => sites.length === 1
+        ? `Impeccable saved the Netlify site password of ${sites[0]} for reviews, so its previews stay password-protected. A new password set in Netlify (${NETLIFY_PASSWORD_WHERE}) goes in the app's Settings too, under "A way past your host's lock", or reviews stop.`
+        : `Impeccable saved the Netlify site passwords of ${andList(sites)} for reviews, so their previews stay password-protected. A new password set in Netlify (${NETLIFY_PASSWORD_WHERE}) goes in its app's Settings too, under "A way past your host's lock", or reviews stop.`,
+};
+/** What the save's sign-in check confirms on screen: "Signed in as Admin and Manager", the roles that did not after it; none when no account signed in (#417). */
+export function signedInLine(saved, app) {
+    const accounts = saved?.signInCheck?.accounts ?? [];
+    const role = (a) => String(a.role).charAt(0).toUpperCase() + String(a.role).slice(1);
+    const signed = accounts.filter((a) => a.outcome === 'signed-in' && typeof a.role === 'string').map(role);
+    const not = accounts.filter((a) => a.outcome !== 'signed-in' && typeof a.role === 'string').map(role);
+    if (!signed.length)
+        return undefined;
+    return `${app ? `${app}: signed` : 'Signed'} in as ${andList(signed)}${not.length ? `; ${andList(not)} did not` : ''}`;
+}
 /** The last screen's line for each host, in the order first met: "Cloudflare: Acme's Account · project crewline", "Netlify: team Acme · site crewline", "Vercel: team acme · project crewline" (#360). */
 export function hostLines(used) {
     const byHost = new Map();
@@ -302,10 +351,11 @@ const ASK = {
     additionalProperties: false,
     required: ['id', 'prompt', 'kind'],
     properties: {
+        appKey: { type: 'string', minLength: 1, description: 'On a repository with several apps, the app the question is for: the host question (id "preview-host") names it always, and a host\'s sign-in or team question names the app being set up, so a skip ends the setup for that app alone.' },
         id: { type: 'string', minLength: 1, description: 'A short id, such as "admin-password".' },
-        title: { type: 'string', minLength: 1, description: 'The dialog\'s title: the subject in a few words, such as "Admin account". A confirm\'s heading.' },
-        prompt: { type: 'string', minLength: 1, description: 'The question. A confirm\'s action line; an account\'s line under its title, such as "Reviews sign in with this account as admin."' },
-        hint: { type: 'string', minLength: 1, description: 'One line under the question that helps answer it. A confirm\'s text under its title, two or three short lines.' },
+        title: { type: 'string', minLength: 1, description: 'The dialog\'s title: the subject in a few words, such as "Admin account  ·  1 of 3". A confirm\'s heading.' },
+        prompt: { type: 'string', minLength: 1, description: 'The question. A confirm\'s action line; a test account\'s line on the web page while it waits, which its screen leaves out, such as "Add the admin test account."' },
+        hint: { type: 'string', minLength: 1, description: 'One line under the question that helps answer it. A confirm\'s text under its title, two or three short lines; an account\'s line over its fields, such as "Signs in at /admin. Email found in supabase/seed.sql."' },
         kind: {
             type: 'string',
             enum: ['text', 'single', 'multi', 'confirm', 'account'],
@@ -334,16 +384,19 @@ const namesCredential = (q) => {
 };
 /** Under the field of every text question typed in the open, where the model reads the answer. */
 const NEVER_A_CREDENTIAL = 'Never enter a password, a token or a key here.';
+/** The app a screen is for, on a repository with several apps: the person's no on it ends the setup for that app alone (#413). */
+const FOR_APP = { type: 'string', minLength: 1, description: 'On a repository with several apps, the key of the app this is for: a skip ends the setup for that app alone.' };
 const ENABLE_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     required: ['host'],
-    properties: { host: { type: 'string', enum: ['netlify', 'cloudflare'], description: "The host whose pullRequestPreviews said enabled false in this run." } },
+    properties: { host: { type: 'string', enum: ['netlify', 'cloudflare'], description: "The host whose pullRequestPreviews said enabled false in this run." }, appKey: FOR_APP },
 };
 const CLOUDFLARE_CONNECT = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: FOR_APP,
         command: { type: 'string', minLength: 1, description: "The build command Cloudflare runs for a project the run creates: the package's build script; none for plain HTML." },
         outputDir: { type: 'string', minLength: 1, description: 'The folder the build writes the pages to, relative to the checkout, for a project the run creates; "." for plain HTML at the root.' },
     },
@@ -1551,6 +1604,8 @@ export function createTools(ctx) {
     const text = (t, terminate = false) => ({ content: [{ type: 'text', text: t }], details: undefined, ...(terminate ? { terminate } : {}) });
     const retry = previewRetryState(ctx.log);
     retry.repository ??= `${ctx.owner}/${ctx.repo}`;
+    // Once the list is up: the agent's first call sets it, with the reading in progress.
+    retry.reading = () => ctx.sync.payload.tasks.length > 0 && !workStarted(ctx.sync.payload.tasks);
     /** The branches of the recorded test drives (by app key on a repository with several apps, '' on one) and setup pull request, as GitHub named them. */
     let recordedBranches;
     /** On a repository with several apps, each app's recorded test drive, in the order they were recorded (impeccable-reviews#397). */
@@ -1622,6 +1677,10 @@ export function createTools(ctx) {
     let lastLock;
     /** Netlify's gate, as last met, was its team login rather than the site password: the last screen names that one. */
     let lastTeamLogin = false;
+    /** The person's no to setting previews up or to giving access to protected ones, by the app it was for ('' where the screen named none: a host's sign-in, connection or setting, the host question, or a repository of one app) (#413). */
+    const declined = new Map();
+    /** The hosts whose sign-in or team the person said no to: asked again for the next app, the answer is the same no. */
+    const hostsDeclined = new Set();
     /** The host preview addresses a proof or a host's key opened, and the Cloudflare account and Netlify team of each project or site the host tools read, by host and project: the last screen names them (#360), and no tool's answer does. */
     const usedPreviews = new Set();
     const accountOf = new Map();
@@ -1670,6 +1729,7 @@ export function createTools(ctx) {
         if (access) {
             return onHostPage(`${host.toLowerCase()}-app-access`, () => access.page, (e) => !built(e), access.now ? first : await waited(first), async () => waited(await read()), {
                 skipped: `The person skipped giving ${host}'s GitHub app access to the repository.`,
+                declines: { app: access.app },
                 still: `${host}'s GitHub app still cannot see the repository: no build came.`,
                 stopped: `The run stopped while ${host}'s build was waited for.`,
             }, signal);
@@ -1726,6 +1786,8 @@ export function createTools(ctx) {
     const accessConsented = new Set();
     /** What each host's settings last said of its pull-request previews, as the evidence tools read them: the one fact impeccable_enable_previews acts on. */
     const previewFacts = new Map();
+    /** On a repository with several apps, the project or site each app's own read named (`<host>/<appKey>`): a no on that project ends the setup of the apps on it alone (#413). */
+    const appProjects = new Map();
     /** What impeccable_enable_previews answered for a host: asked once, so that answer stands. */
     const enableOutcomes = new Map();
     /** Cloudflare's plain evidence as last read: the project, the Worker and the GitHub app facts impeccable_cloudflare_connect and the wait for a build act on. */
@@ -2035,8 +2097,12 @@ export function createTools(ctx) {
      */
     async function onHostPage(screen, page, pending, result, again, words, signal) {
         for (let retries = 0; pending(result) && !signal?.aborted; retries++) {
-            if ((await ask(HOST_SCREENS[retries ? `${screen}-retry` : screen])).skipped)
+            if ((await ask(HOST_SCREENS[retries ? `${screen}-retry` : screen])).skipped) {
+                // A no to the host's GitHub app or to the lock before the first push leaves no preview: the setup ends there (#413).
+                if (words.declines)
+                    decline('no-previews', words.declines.app);
                 return { ...result, reason: words.skipped };
+            }
             const at = page(result);
             if (at)
                 (ctx.openBrowser ?? openBrowser)(at);
@@ -2051,17 +2117,18 @@ export function createTools(ctx) {
         return result;
     }
     /** The one-time access a host's GitHub app needs when it cannot reach the repository, given on the app's page on GitHub while `reaches` tries again. */
-    function hostAccess(host, result, reaches, signal) {
+    function hostAccess(host, result, reaches, signal, app) {
         const name = HOST_NAMES[host];
         return onHostPage(`${host}-access`, (r) => r.access, (r) => Boolean(r.access), result, reaches, {
             waiting: `Waiting for ${name} to reach the repository`,
             skipped: `The person skipped giving ${name}'s GitHub app access to the repository.`,
+            declines: { app },
             still: `${name}'s GitHub app still cannot reach the repository.`,
             stopped: `The run stopped while ${name} was waited for.`,
         }, signal);
     }
     /** The connection of the linked Netlify site with this repository, through Netlify's site settings and its GitHub app, with the app's access asked when it cannot read the repository. */
-    async function netlifyConnect(pi, settings, signal, directory, previewing = false) {
+    async function netlifyConnect(pi, settings, signal, directory, previewing = false, app) {
         // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI. A site built from this repository with Deploy Previews on needs no setup (#311): the connection changes nothing on it, and only checks that Netlify's GitHub app still reads the repository, asking for its access when it does not.
         if (!hostSetupAgreed(ctx.log, 'netlify') && !previewing)
             return { connected: false, reason: 'The Netlify sign-in comes first: impeccable_ask with the id netlify-setup.' };
@@ -2072,9 +2139,11 @@ export function createTools(ctx) {
         netlifySite = result.site?.name ?? netlifySite;
         if (result.pullRequestPreviews)
             previewFacts.set('netlify', result.pullRequestPreviews);
+        if (app !== undefined && result.pullRequestPreviews)
+            appProjects.set(`netlify/${app}`, result.pullRequestPreviews.project);
         // A build every 30 s until one reads the repository: the person is giving the app access meanwhile.
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
-            ? { connected: true, site: result.site, how: 'github-app', ...(result.pullRequestPreviews ? { pullRequestPreviews: result.pullRequestPreviews } : {}) } : result), signal);
+            ? { connected: true, site: result.site, how: 'github-app', ...(result.pullRequestPreviews ? { pullRequestPreviews: result.pullRequestPreviews } : {}) } : result), signal, app);
     }
     /**
      * The connection of the linked Vercel project with this repository, `vercel git connect`, for a project this run's own
@@ -2128,7 +2197,7 @@ export function createTools(ctx) {
             }
         }
         // Tried again every 20 s until the app reaches the repository: the person is giving it access meanwhile.
-        const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
+        const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal, connectedApp);
         // The fence holds pushes and deploys from the sign-in until the linked project's first deployment is settled: Vercel's app cannot reach the repository (a push builds nothing), production is deployed already, or the project is locked at every address.
         if (!result.connected) {
             if (result.access !== undefined)
@@ -2143,6 +2212,7 @@ export function createTools(ctx) {
             first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, repository, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
                 waiting: "Waiting for Vercel's login on the project",
                 skipped: 'The person skipped locking the Vercel project.',
+                declines: { app: connectedApp },
                 still: "Vercel's login is still not in front of the project's addresses.",
                 stopped: 'The run stopped while the lock was waited for.',
             }, signal);
@@ -2216,6 +2286,9 @@ export function createTools(ctx) {
     let renewedForApps = false;
     /** Whether the repository has several apps (the state's apps item), as the first state or a later read showed it. */
     let appsRepo = ctx.severalApps === true;
+    // --signed-in-test-drive: the fence pushes and opens a test drive only for an app with a test account saved (#410).
+    if (ctx.signedInTestDrive)
+        retry.signedIn ??= { apps: appsRepo, saved: new Set(ctx.signedInTestDrive.accountsSaved) };
     /**
      * The apps this run sets up, as the apps question answered: undefined until it was answered.
      * On a repository with several apps every run asks it, however the setup page answered before (#280), and every write
@@ -2233,6 +2306,9 @@ export function createTools(ctx) {
         pickedApps = keys;
         // Each app this run sets up gets a test drive of its own (impeccable-reviews#397).
         retry.drivesAllowed = Math.max(1, keys.size);
+        // The fence reads the app from its test drive's branch, impeccable/test-drive-<key> or, for a run that sets up one app, impeccable/test-drive (#410).
+        if (retry.signedIn)
+            retry.signedIn.picked = [...keys];
         const before = new Map(appSummaries);
         appSummaries.clear();
         for (const key of keys)
@@ -2277,6 +2353,8 @@ export function createTools(ctx) {
         }
         if (res.ok && severalApps(res.data))
             appsRepo = true;
+        if (retry.signedIn)
+            retry.signedIn.apps = appsRepo;
         if (res.ok && ctx.allInstructions !== undefined && severalApps(res.data))
             instructions = focusInstructions(ctx.allInstructions, { apps: true });
         return answerText(res.ok ? { ...res, data: focus(res.data) } : res);
@@ -2328,10 +2406,43 @@ export function createTools(ctx) {
         }
         return null;
     };
+    /** Why the setup ended for an app with no method saved: the person's no on a screen for it (#413). Undefined while it may go on. */
+    const endedFor = (key) => ((appsRepo ? appMethods.has(key) : methodSaved) ? undefined : declined.get(key));
+    /** The person's no for an app: '' on a repository of one app; on several, the app the screen was for, and none where no app was named. Once its setup ended, the fence pushes nothing of it. */
+    const decline = (kind, appKey) => {
+        const key = appsRepo ? (typeof appKey === 'string' ? appKey : undefined) : '';
+        if (key === undefined)
+            return;
+        declined.set(key, kind);
+        if (endedFor(key))
+            endAppSetup(ctx.log, key);
+    };
+    /** Whether the app asking is on the project a host's answer was for, as its own read named it: on a repository of one app, always. */
+    const onProject = (host, appKey, project) => !appsRepo || (typeof appKey === 'string' && appProjects.get(`${host}/${appKey}`) === project);
+    /** Why a step for `appKey` may not run: the setup ended for that app on the person's no, so nothing more is saved or asked for it (#413). Null where it may. */
+    const endRefusal = (appKey, what) => {
+        const key = appsRepo ? appKey : '';
+        const why = typeof key === 'string' ? endedFor(key) : undefined;
+        if (!why)
+            return null;
+        const app = appsRepo ? appName(key) : undefined;
+        return `Refused: the person said no to ${SETUP_ENDS[why].said}${app ? ` for ${app}` : ''}, which leaves ${app ?? 'the app'} with no preview Impeccable can open, so the setup ended there${app ? ` for ${app}: go on with the other apps, as the monorepo case says` : ": nothing more is asked or saved. Call impeccable_progress with every task's final status, then impeccable_report"}. Nothing was ${what}.`;
+    };
     /**
      * Why a host's lock tool may not run yet: the list still shows the repository being read, so its consent and the push
      * after it would go by on "Understanding your app" (#390). Null once that task is done.
      */
+    /** What the end screen says of each Netlify site's password, by site: one line for every site that shares what was done (#419). */
+    const passwordNotes = new Map();
+    /** Notes what was done with a site's password: the line for that, and for what it was before, now name every site they hold; a line with none left is taken off. */
+    const notePassword = (site, kind) => {
+        const was = passwordNotes.get(site);
+        passwordNotes.set(site, kind);
+        for (const k of new Set([kind, ...(was ? [was] : [])])) {
+            const sites = [...passwordNotes].filter(([, v]) => v === k).map(([name]) => name);
+            ctx.onKeyCreated?.(sites.length ? PASSWORD_NOTES[k](sites) : '', `netlify-password:${k}`);
+        }
+    };
     const readingRefusal = (tool) => workStarted(ctx.sync.payload.tasks) ? null : `Refused: the task list shows no work past reading the repository yet, so the screen still says "Understanding your app". Call impeccable_progress first with Read the repository completed and Preview method in progress, then ${tool} again. Nothing was asked or sent.`;
     /** How this run left each app the state lists (#286), for the report and the last screen. */
     const appOutcomes = async (pi, stale = new Set()) => {
@@ -2354,9 +2465,14 @@ export function createTools(ctx) {
                     ? { key, name, folder, state: 'ready', unchecked: true, left: `${name}: Impeccable's check of its preview did not run here; the test drive's review shows whether it reaches it.` }
                     : { key, name, folder, state: 'ready' };
             }
+            const state = gate && !proven ? 'locked' : 'unset';
+            // The person's no left it with no preview Impeccable can open: the setup ended for it, and its line says so (#413).
+            const ended = endedFor(key);
+            if (ended)
+                return { key, name, folder, state, ended, left: `${name}: the setup ended for it, as you said no to ${SETUP_ENDS[ended].said}.` };
             if (gate && !proven)
-                return { key, name, folder, state: 'locked', left: `${name}: its previews are behind ${LOCKS[gate].lock}, and no key was saved. ${LOCKS[gate].left}.` };
-            return { key, name, folder, state: 'unset', left: `${name}: no preview method was saved; the report says why.` };
+                return { key, name, folder, state, left: `${name}: its previews are behind ${LOCKS[gate].lock}, and no key was saved. ${LOCKS[gate].left}.` };
+            return { key, name, folder, state, left: `${name}: no preview method was saved; the report says why.` };
         });
     };
     /** The report's section on the apps, one line each, from what this run saved and proved rather than from the model's words. */
@@ -2365,6 +2481,8 @@ export function createTools(ctx) {
         const lock = lockMet.has(a.key) ? LOCKS[lockMet.get(a.key)].lock : undefined;
         if (a.state === 'ready')
             return `- ${where}: set up. Method: ${appMethods.get(a.key)}${provenApps.has(a.key) ? `, its preview proven${lock ? ` past ${lock}` : ''}` : ''}.${a.unchecked ? " Impeccable's check of its preview did not run." : ''}`;
+        if (a.ended)
+            return `- ${where}: not set up. The setup ended for it: the person said no to ${SETUP_ENDS[a.ended].said}.`;
         if (a.state === 'locked')
             return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
         if (a.state === 'unset')
@@ -2525,7 +2643,7 @@ export function createTools(ctx) {
             // On a repository with several apps, nothing but the apps write goes before the apps question, and an app's setting or check names a picked app.
             const forApp = /\/(preview|test-accounts|connection-check|latest-pull-check)$/.test(target.url);
             if (!target.url.endsWith('/apps')) {
-                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp) ?? (target.url.endsWith('/preview') ? lockRefusal(object(p.body)?.appKey, 'saved') : null);
+                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp) ?? (forApp ? endRefusal(object(p.body)?.appKey, 'saved') : null) ?? (target.url.endsWith('/preview') ? lockRefusal(object(p.body)?.appKey, 'saved') : null);
                 if (refused)
                     return refused;
             }
@@ -2581,6 +2699,12 @@ export function createTools(ctx) {
                     break;
                 response = await call(pi, target.url, { method: target.method, body });
             }
+            if (testAccounts && response.ok)
+                retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
+            // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
+            const signedIn = testAccounts && response.ok ? signedInLine(response.data, appsRepo ? appName(String(object(p.body)?.appKey)) : undefined) : undefined;
+            if (signedIn)
+                reportDone(signedIn);
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
@@ -2634,9 +2758,19 @@ export function createTools(ctx) {
         }),
         tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. So is the apps question on a repository with several apps (id "apps", kind "multi"), which lists the state\'s apps itself, has no Skip, and answers {"values": […]} (at least one app) or {"values": [key], "named": true} when the command was started for that app (it shows one confirm screen naming the app instead of the list, and the list when the person asks for other apps there); where no answer comes, nothing is written and the run ends. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
             // A skip never stops the run, so every question offers one, but the apps question, which needs at least one app (#405).
-            const asked = p;
+            const { appKey: forApp, ...asked } = p;
             if (asked.id === APPS_QUESTION.id && appsRepo)
                 return appsQuestion(pi, signal);
+            // On several apps, the host question is one app's, so its skip ends that app's setup alone (#413).
+            if (asked.id === 'preview-host' && appsRepo) {
+                const refused = appRefusal(forApp, 'asked');
+                if (refused)
+                    return refused;
+            }
+            // On a repository of one app, the person's no ended the setup: nothing more is asked, the test accounts neither (#413).
+            const ended = appsRepo ? null : endRefusal('', 'asked');
+            if (ended)
+                return ended;
             const host = /^(netlify|vercel)-(setup|team)$/.exec(asked.id);
             // The Vercel setup is for a repository Vercel has never deployed: one it deploys already (every app this run sets up, on a repository with several), as impeccable_hosted_previews read it, gets its previews from the first pull request on (#286). An app with no project of its own still gets the screen, and a setup under way (asked again once the CLI was installed) is not stopped here.
             const deployed = appsRepo ? pickedApps !== undefined && pickedApps.size > 0 && [...pickedApps].every((key) => vercelDeployed.has(key)) : vercelDeployed.has('');
@@ -2649,8 +2783,16 @@ export function createTools(ctx) {
             if (asked.id === 'netlify-setup' && previewing && !hostSignIns.has('netlify')) {
                 return `Refused: Netlify builds this repository already (${[...new Set(netlifyPreviewing.values())].join(', ')}), with Deploy Previews on, so its deploy previews start with the first pull request, and there is no Netlify sign-in, site or connection to make. Go on as netlify-previews says before the first pull request: impeccable_netlify_connect${appsRepo ? ' with the app\'s appKey' : ''} first, which changes nothing on the site and checks that Netlify's GitHub app still reads the repository (asking the person for its access when it does not), then build the test drive once with the build Netlify runs, push it and open it as a draft as pull-requests' step 4 says, wait for its deploy preview with impeccable_netlify_previews and pull, prove the test drive's page there, save the method, and mark the draft ready.`;
             }
-            if (host?.[2] === 'setup')
-                return JSON.stringify(await hostSignIn(host[1], pi, signal));
+            if (host?.[2] === 'setup') {
+                const was = hostSignIns.get(host[1]);
+                const signedIn = await hostSignIn(host[1], pi, signal);
+                // A skipped sign-in leaves the host's previews unset: the setup ends there for the app it was for, and for the next app asked it again (#413). A sign-in that did not complete is not a no.
+                if (signedIn.skipped && !signedIn.reason && (was !== 'skipped' || hostsDeclined.has(host[1]))) {
+                    hostsDeclined.add(host[1]);
+                    decline('no-previews', forApp);
+                }
+                return JSON.stringify(signedIn);
+            }
             if (host && (teamChoices.get(host[1])?.length ?? 0) < 2)
                 return `Invalid input: ${asked.id} is asked only when the ${HOST_NAMES[host[1]]} sign-in answered teams to choose from.`;
             const fixed = Object.hasOwn(HOST_QUESTIONS, asked.id) ? HOST_QUESTIONS[asked.id] : undefined;
@@ -2676,6 +2818,11 @@ export function createTools(ctx) {
                 // Without a terminal the Vercel CLI names no team on its own, so a skipped team ends the Vercel setup.
                 if (host?.[1] === 'vercel')
                     endSetup('vercel');
+                // No to the Vercel team, or to every host on the host question, leaves no preview: the setup ends there (#413).
+                if (host?.[1] === 'vercel')
+                    hostsDeclined.add('vercel');
+                if (host?.[1] === 'vercel' || q.id === 'preview-host')
+                    decline('no-previews', forApp);
                 return JSON.stringify({ skipped: true });
             }
             if (q.kind === 'multi')
@@ -2735,6 +2882,11 @@ export function createTools(ctx) {
                     return `Refused: #${drive.number} is ${appName(other[0])}'s test drive. Each app gets a test drive of its own, as the monorepo case says. Nothing was recorded.`;
             }
             const key = typeof appKey === 'string' ? appKey : '';
+            const ended = endRefusal(key, 'recorded');
+            if (ended)
+                return ended;
+            if (retry.signedIn && !retry.signedIn.saved.has(key))
+                return `Refused: the run was started with --signed-in-test-drive, and no test account is saved${appsRepo ? ` for ${appName(key)}` : ''}, so its test drive cannot change a page behind the sign-in. Nothing was recorded: close #${drive.number}, and say in the report that --signed-in-test-drive could not be honoured, and why.`;
             const found = await runPullRequest(ctx, drive, 'impeccable/test-drive', signal);
             if ('problem' in found)
                 return `Refused: ${found.problem}.`;
@@ -2800,6 +2952,11 @@ export function createTools(ctx) {
             if (open.length)
                 return `Refused: the task list still shows ${open.map((t) => `"${t.title}" as ${t.status.replace('_', ' ')}`).join(', ')}. Call impeccable_progress with every task's final status (completed, skipped or failed), then impeccable_report again. Nothing was saved.`;
             let markdown = p.markdown;
+            // --signed-in-test-drive: an app with no test account saved got no test drive, and the report and the last screen say why (#410).
+            const unsigned = retry.signedIn ? (appsRepo ? [...(pickedApps ?? [])] : ['']).filter((key) => !retry.signedIn.saved.has(key)) : [];
+            const unhonoured = unsigned.length ? `--signed-in-test-drive could not be honoured${appsRepo ? ` for ${unsigned.map(appName).join(' and ')}` : ''}: no test account is saved, so no test drive opened behind the sign-in.` : undefined;
+            if (unhonoured)
+                markdown = `**${unhonoured}**\n\n${markdown}`;
             // The files the setup pull request carries, so one the setup never meant to change stands out: a sandboxed script writes in the checkout too.
             if (recordedBranches?.setup) {
                 const changes = recordedBranches.setupBase ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, recordedBranches.setupBase, recordedBranches.setup) : null;
@@ -2826,6 +2983,12 @@ export function createTools(ctx) {
             const apps = appsRepo && pickedApps ? await appOutcomes(pi, new Set([...appDrives.keys()].filter((key) => !kept.some(([k]) => k === key)))) : undefined;
             if (apps)
                 markdown += appsSection(apps);
+            // The person's no left no app this run set up with a preview Impeccable can open: the setup ended, and the report and the web page open with why (#413).
+            const picked = apps?.filter((a) => a.state !== 'unpicked');
+            const endedBy = picked ? (picked.length && picked.every((a) => a.ended) ? picked.map((a) => a.ended) : []) : drive ? [] : [endedFor('')].filter((why) => why !== undefined);
+            const ended = endedBy.length ? (endedBy.includes('no-previews') ? 'no-previews' : 'no-access') : undefined;
+            if (ended)
+                markdown = `**${SETUP_ENDS[ended].title}.** ${SETUP_ENDS[ended].line}\n\n${markdown}`;
             if (previews.active && retry.pr) {
                 await observe(signal);
                 const lines = attempts().map((a, i) => `${i + 1}. [Attempt ${i + 1}](${a.url}) (run attempt ${a.attempt}): ${a.status}. ${a.diagnostics.map((d) => `${d.appKey}: step ${d.stage ?? 'unverified'}. ${d.reason}`).join(' ')}${a.changes.length ? ` Changed settings: ${a.changes.join(', ')}.` : ''}`);
@@ -2838,6 +3001,10 @@ export function createTools(ctx) {
             const { phase, status, question, report_markdown, test_pr, test_prs, left: leftBefore } = ctx.sync.payload;
             // Why an app was not proven or keyed goes with its summary only as plain words, with no address (a scheme, or a host with a path or query) and nothing shaped like a secret; anything else is dropped.
             const appsBefore = new Map(appSummaries);
+            // Each app whose setup ended on the person's no says so on the web page, unless the report gives its own words below.
+            for (const a of apps ?? [])
+                if (a.ended)
+                    noteApp(a.key, { reason: `The setup ended for it: the person said no to ${SETUP_ENDS[a.ended].said}.` });
             for (const { appKey, reason } of p.apps ?? []) {
                 const plain = reason.trim();
                 const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
@@ -2845,7 +3012,7 @@ export function createTools(ctx) {
                     noteApp(appKey, { reason: plain });
             }
             // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
-            ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
+            ctx.sync.update({ phase: 'completed', status: ended ? SETUP_ENDS[ended].title : 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
@@ -2860,7 +3027,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(unhonoured ? { unhonoured } : {}), ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}), ...(ended ? { ended } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -3006,6 +3173,8 @@ export function createTools(ctx) {
             }
             if (evidence.pullRequestPreviews)
                 previewFacts.set('netlify', evidence.pullRequestPreviews);
+            if (appKey !== undefined && evidence.pullRequestPreviews)
+                appProjects.set(`netlify/${appKey}`, evidence.pullRequestPreviews.project);
             // A site built from this repository (this app's, read by its folder) with Deploy Previews on previews the next pull request, listed or not (#311).
             if (pull === undefined) {
                 if (!evidence.unmatched && evidence.pullRequestPreviews?.enabled === true)
@@ -3049,7 +3218,7 @@ export function createTools(ctx) {
             // A pushed branch of a project connected with previews on that gets no build: Cloudflare's GitHub app cannot see the repository (its installation covers selected ones, or none),
             // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
             const app = cloudflareEvidence?.githubApp;
-            const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false } : undefined;
+            const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false, ...(typeof p.appKey === 'string' ? { app: p.appKey } : {}) } : undefined;
             let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
             // cf not on this machine (#396): its install is asked before anything installs it, and the evidence read again with it.
             if (!subject && waited.cli === 'missing') {
@@ -3083,6 +3252,9 @@ export function createTools(ctx) {
             }
             if (evidence.pullRequestPreviews)
                 previewFacts.set('cloudflare', evidence.pullRequestPreviews);
+            const named = evidence.pullRequestPreviews?.project || evidence.project;
+            if (appKey !== undefined && named)
+                appProjects.set(`cloudflare/${appKey}`, named);
             noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
@@ -3176,7 +3348,7 @@ export function createTools(ctx) {
             const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
             if (appKey !== undefined && directory === undefined)
                 return JSON.stringify({ appKey, connected: false, reason: `The setup state names no folder for the app ${appKey}.` });
-            const result = await netlifyConnect(pi, { command, publish }, signal, directory, netlifyPreviewing.has(appKey ?? ''));
+            const result = await netlifyConnect(pi, { command, publish }, signal, directory, netlifyPreviewing.has(appKey ?? ''), appKey);
             if (result.how && result.site)
                 noteApp(appKey, { host_project: result.site.name });
             return JSON.stringify(appKey !== undefined ? { appKey, ...result } : result);
@@ -3184,6 +3356,9 @@ export function createTools(ctx) {
         tool('impeccable_enable_previews', 'Pull-request previews', "Turn on previews of pull requests on the host that builds this repository but not its pull requests, as pullRequestPreviews in the answer of impeccable_netlify_previews, impeccable_netlify_connect or impeccable_cloudflare_previews said (enabled false). It does the rest as the person: one screen asking to turn them on, then the host's CLI changes that one setting (Netlify: Deploy Previews on; Cloudflare Pages: preview branch control set to every non-production branch, or the test drive's branch added to the custom includes) and reads it back; where the CLI cannot (the role, a cf sign-in without pages:write, builds stopped altogether), it opens the host's settings page and asks the person to try again once they changed it there. Answers {\"status\": …}: enabled (pull-request previews are on now; by says whether the run or the person turned them on, and project which project or site), skipped (the person skipped a screen; reason says what came before) or refused (still off after the retries; reason says why, and page where it is changed). Vercel builds every branch once Git is connected, so its fact is reported and never changed here.", ENABLE_PREVIEWS, async (p, pi, signal) => {
             const host = p.host;
             const standing = enableOutcomes.get(host);
+            // The answer stands for the run, as before; its no ends the setup only of an app on the project it was for.
+            if (standing?.status === 'skipped' && onProject(host, p.appKey, standing.project))
+                decline('no-previews', p.appKey);
             if (standing)
                 return JSON.stringify(standing);
             const fact = previewFacts.get(host);
@@ -3195,6 +3370,8 @@ export function createTools(ctx) {
             const answer = (status, more) => {
                 const told = { status, project: fact.project, ...more };
                 enableOutcomes.set(host, told);
+                if (status === 'skipped')
+                    decline('no-previews', p.appKey);
                 return JSON.stringify(told);
             };
             const screen = HOST_SCREENS[`${host}-previews`];
@@ -3227,6 +3404,9 @@ export function createTools(ctx) {
             }
         }),
         tool('impeccable_cloudflare_connect', 'Connect the repository to Cloudflare Pages', "Connect this repository to a Cloudflare Pages project, so that Cloudflare builds every pull request as a preview, where impeccable_cloudflare_previews found no Pages project building them: the project the checkout names when it exists with no Git source (pullRequestPreviews with cause source), else a new one named after the repository where Cloudflare builds a Worker from it (worker in the answer) or the checkout is set up for a Pages project that does not exist yet. It does the rest as the person: one screen asking to connect or to create (Cloudflare's sign-in in the browser first, with a retry, where cf is not signed in here with pages:write), then cf creates the project with the build the checkout runs (command and outputDir, for a new project) and connects the repository as GitHub identifies it, every branch but the default a preview, and reads it back. Answers {\"status\": …}: connected (project names the Pages project, created whether the run made it, subdomain its own address under pages.dev, productionBranch the branch Cloudflare builds as production; pullRequestPreviews is on now), skipped (the person skipped a screen; reason says which) or refused (cf could not, or Cloudflare refused; reason says why). Cloudflare's GitHub app then has to see the repository for a push to build: the wait for the test drive's build asks for its access when none comes.", CLOUDFLARE_CONNECT, async (p, pi, signal) => {
+            // The answer stands for the run, as before; its no ends the setup only of an app on the project it was for.
+            if (connectOutcome?.status === 'skipped' && onProject('cloudflare', p.appKey, connectOutcome.project))
+                decline('no-previews', p.appKey);
             if (connectOutcome)
                 return JSON.stringify(connectOutcome);
             const evidence = cloudflareEvidence;
@@ -3243,6 +3423,8 @@ export function createTools(ctx) {
             const project = fact?.project || evidence.project || pagesProjectName(ctx.repo);
             const answer = (status, more) => {
                 connectOutcome = { status, project, created: create, ...more };
+                if (status === 'skipped')
+                    decline('no-previews', p.appKey);
                 return JSON.stringify(connectOutcome);
             };
             // The one screen: the connection of the project named, or the new project for the repository.
@@ -3334,6 +3516,12 @@ export function createTools(ctx) {
             const asked = bypassOutcomes.get(store);
             if (asked?.status === 'skipped')
                 return JSON.stringify(asked);
+            /** The person's no to the secret leaves the previews behind Vercel's login: the setup ends there for the app (#413). */
+            const noAccess = (outcome) => {
+                if (outcome.status === 'skipped')
+                    decline('no-access', store);
+                return outcome;
+            };
             /** What stops the tool before the project is vouched for: the address got nothing, or, before the push, the lock is not known yet and the gate's call asks. */
             const nothing = (why) => (at ? `Refused: nothing was sent to ${at.url}. ${why}` : JSON.stringify({ ...(app ? { appKey: app.appKey } : {}), protected: 'unknown', reason: why }));
             /** The consent screen, naming the project and the app once they are known (#358). */
@@ -3350,9 +3538,9 @@ export function createTools(ctx) {
              */
             const signIn = async () => {
                 /** A skip, of the consent or of the sign-in, stands for the run: it is asked once, as the consent alone is. */
-                const skip = (reason) => {
+                const skip = (reason, declines = true) => {
                     const outcome = { status: 'skipped', reason };
-                    bypassOutcomes.set(store, outcome);
+                    bypassOutcomes.set(store, declines ? noAccess(outcome) : outcome);
                     return JSON.stringify(outcome);
                 };
                 if ((await ask(consentScreen())).skipped)
@@ -3373,7 +3561,8 @@ export function createTools(ctx) {
                     hostSignIns.delete('vercel');
                 if (signedIn.signedIn === true)
                     return null;
-                return skip(typeof signedIn.reason === 'string' ? signedIn.reason : "The person skipped Vercel's sign-in, which the bypass secret needs.");
+                // A sign-in that did not complete is not a no.
+                return skip(typeof signedIn.reason === 'string' ? signedIn.reason : "The person skipped Vercel's sign-in, which the bypass secret needs.", typeof signedIn.reason !== 'string');
             };
             // A folder Vercel deploys from GitHub has no link file unless vercel link ran in it (the file is gitignored), so the project is found on Vercel by this repository,
             // with the CLI signed in as the person.
@@ -3419,7 +3608,7 @@ export function createTools(ctx) {
                     bypassConsented.add(`${store}/${link.projectId}`);
                     return JSON.stringify({ ...of, protected: true, consent: 'given' });
                 }
-                const outcome = { status: 'skipped', ...of, protected: true, reason: `The person skipped creating a bypass secret before the test drive's push. Vercel's login stands in front of the previews of ${project.name ? `the Vercel project ${project.name}` : 'the Vercel project'}, so a test drive pushed now could not be reviewed. A secret made in the project's Settings → Deployment Protection → Protection Bypass for Automation, named "Impeccable reviews", and saved on the setup page lets reviews in.` };
+                const outcome = noAccess({ status: 'skipped', ...of, protected: true, reason: `The person skipped creating a bypass secret before the test drive's push. Vercel's login stands in front of the previews of ${project.name ? `the Vercel project ${project.name}` : 'the Vercel project'}, so a test drive pushed now could not be reviewed. A secret made in the project's Settings → Deployment Protection → Protection Bypass for Automation, named "Impeccable reviews", and saved on the setup page lets reviews in.` });
                 bypassOutcomes.set(store, outcome);
                 return JSON.stringify(outcome);
             }
@@ -3474,7 +3663,7 @@ export function createTools(ctx) {
                 // A secret the run made stays in the person's Vercel project, whatever comes after: the end screen says so, and where it is revoked (#335).
                 made: (held, name) => ctx.onKeyCreated?.(`Impeccable created a Vercel bypass secret${held === 'labelled' ? ', "Impeccable reviews",' : ' without a label'}${name ? ` on the ${name} project` : ''}. Revoke it under the project's Settings → Deployment Protection → Protection Bypass for Automation; reviews stop until a new one is saved.`),
             });
-            const outcome = { ...told, ...(at.app ? { appKey: at.app.appKey } : {}), ...(told.status === 'saved' ? { proven: true } : {}) };
+            const outcome = noAccess({ ...told, ...(at.app ? { appKey: at.app.appKey } : {}), ...(told.status === 'saved' ? { proven: true } : {}) });
             bypassOutcomes.set(store, outcome);
             if (value) {
                 // What is in hand follows the store: a new secret is the one saved now, and the origins the last one opened no longer stand.
@@ -3523,8 +3712,11 @@ export function createTools(ctx) {
                 }
                 passwordStands.delete(site);
             }
-            else if (stands)
+            else if (stands) {
+                if (stands.status === 'skipped')
+                    decline('no-access', at.app?.appKey);
                 return JSON.stringify(stands);
+            }
             // A password in hand already: another deploy preview of the same site opens with it, and another app built from the same site gets it saved as its own. Another site's lock is read for that site.
             const held = sitePasswords.get(site);
             if (held && (await prove(held.value)).proven) {
@@ -3608,11 +3800,8 @@ export function createTools(ctx) {
                 });
             }
             finally {
-                if (replaced) {
-                    ctx.onKeyCreated?.(answer?.status === 'saved'
-                        ? `Impeccable set a new Netlify site password on ${site} as you and saved it for reviews, so its previews stay password-protected. It replaced the one before, which no longer opens them: set one people know in Netlify (${NETLIFY_PASSWORD_WHERE}) any time, and put it in the app's Settings too, under "A way past your host's lock", or reviews stop.`
-                        : `Impeccable set a new Netlify site password on ${site} as you, which replaced the one before, but it was not saved for reviews. Set a password people know in Netlify (${NETLIFY_PASSWORD_WHERE}), and put it in the app's Settings too, under "A way past your host's lock".`, `netlify-password:${site}`);
-                }
+                if (replaced)
+                    notePassword(site, answer?.status === 'saved' ? 'set' : 'unsaved');
             }
             const { value, ...told } = answer;
             const passwordOutcome = { ...told, ...(told.status === 'saved' || told.status === 'opened' ? { proven: true } : {}) };
@@ -3623,6 +3812,9 @@ export function createTools(ctx) {
                 lastTeamLogin = told.protection === 'team-login';
             if (told.status === 'skipped' || told.status === 'login' || told.status === 'opened')
                 passwordStands.set(site, passwordOutcome);
+            // The person's no to the password, its replacement or a public site leaves the previews behind Netlify's lock: the setup ends there for the app (#413).
+            if (told.status === 'skipped')
+                decline('no-access', at.app?.appKey);
             if (told.status === 'opened') {
                 // The site is public now: its previews open with nothing sent.
                 hostedPreviewProven = true;
@@ -3635,9 +3827,11 @@ export function createTools(ctx) {
             if (value) {
                 // Said once it opened the preview and was saved, so the screen does not go straight back to the tasks (#390); the end screen names it and where it changes.
                 said(`Password works: saved for ${at.app ? appName(at.app.appKey) : site}`);
+                // The tasks screen shows no status line, so the confirmation goes under the list (#416).
+                reportDone(told.password === 'set' ? `Netlify password set on ${site}` : `Netlify password saved for ${site}`);
                 // A password the run set is named on the end screen as it was set, above. Either line takes the place of an earlier one for the site, such as a replaced password not saved.
                 if (told.password !== 'set')
-                    ctx.onKeyCreated?.(`Impeccable saved the Netlify site password of ${site} for reviews, so its previews stay password-protected. A new password set in Netlify (${NETLIFY_PASSWORD_WHERE}) goes in the app's Settings too, under "A way past your host's lock", or reviews stop.`, `netlify-password:${site}`);
+                    notePassword(site, 'stored');
                 // What is in hand follows the store: the password saved now is this site's, beside every other site's.
                 sitePasswords.set(site, { value, saved: passwordOutcome, apps: new Set([at.app?.appKey ?? '']) });
                 hostedPreviewProven = true;
@@ -3664,8 +3858,10 @@ export function createTools(ctx) {
             // The call for this app is made, whatever it answers: the skip asked once stands for the next app's lock too.
             if (at.app)
                 lockPending.delete(at.app.appKey);
-            if (accessOutcome?.status === 'skipped')
+            if (accessOutcome?.status === 'skipped') {
+                decline('no-access', at.app?.appKey);
                 return JSON.stringify(accessOutcome);
+            }
             let proof;
             const prove = async (token) => (proof = sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token })));
             const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
@@ -3740,6 +3936,9 @@ export function createTools(ctx) {
             }
             const pattern = told.status === 'saved' ? proof?.pattern : undefined;
             accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };
+            // The person's no to the service token leaves the previews behind Cloudflare Access: the setup ends there for the app (#413).
+            if (told.status === 'skipped')
+                decline('no-access', at.app?.appKey);
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
                 provenHost = 'Cloudflare Pages';