@impeccable/reviews 0.1.27 → 0.1.29

package/dist/tools.js

@@ -10,9 +10,10 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToCliInstall, agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endAppSetup, endHostSetup, HOST_CLI_VERSIONS, hostCliInstallArgs, hostCliInstallCommand, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, cliInstallScreen, cliManualScreen, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifyPasswordReplace, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cliInstallScreen, cliManualScreen, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifyPasswordReplace, renderConfirm, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
-import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, vercelDeploymentOf } from './hosted.js';
+import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, renderSiteOf, vercelDeploymentOf } from './hosted.js';
+import { enableRenderPreviews, parseRenderDeployment, readRenderService, RENDER_DASHBOARD, renderSitesNamed } from './render.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
@@ -27,6 +28,7 @@ import { openBrowser } from './login.js';
 import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
 import { askPerson, reportDone, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
 import { SEE_THE_REVIEW } from './ui/look.js';
+import { TaskOrder } from './ui/run-state.js';
 import { noteSensitiveAnswer, plainText } from './ui/sensitive.js';
 export { STATUS_MAX, statusVoiceError } from './sync.js';
 /** The first way `value` breaks `schema`, or null when it fits. */
@@ -128,6 +130,8 @@ export const SETUP_ENDS = {
 };
 /** How many times a preview check the setup API turned away for its rate (one a repository every 30 seconds) is tried again (#338). */
 const CHECK_RETRIES = 3;
+/** The setup API signs a repository's saved accounts in once a minute: a save sooner is stored but not tried (#249). */
+const SIGN_IN_CHECK_MS = 60_000;
 /** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
 export function appsSummary(apps) {
     const picked = apps.filter((a) => a.state !== 'unpicked');
@@ -160,10 +164,12 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
+    // The run's own words for why no method was saved, where it gave them (REN-1108).
+    const why = report.reason && !report.methodSaved ? ` Why: ${report.reason.replace(/[.\s]+$/, '')}.` : '';
     if (report.ended)
-        return SETUP_ENDS[report.ended].line;
+        return `${SETUP_ENDS[report.ended].line}${why}`;
     const lead = report.walled ? `Impeccable's own check of the preview met a wall (${report.walled}), so the test drive's review can't see its pages yet. The report, printed here when this screen closes, says what the run found.`
-        : !report.testPr ? `${report.unhonoured ?? noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+        : !report.testPr ? `${report.unhonoured ?? noTestDrive(report)}${why} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     // --signed-in-test-drive left an app without a test drive: said beside another app's drive or a wall too (#410).
     const said = report.unhonoured && (report.walled || report.testPr) ? `${lead} ${report.unhonoured}` : lead;
     return report.setupPr || !report.hostedBy ? said : `${said} ${nothingToMerge(report.hostedBy)}`;
@@ -197,7 +203,13 @@ export function ending(report) {
     return { outcome, title, todo, code: 1 };
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
-export const nothingToMerge = (host) => `Nothing to merge: ${host} hosts your previews, so the repository needed no change.`;
+export const nothingToMerge = (host) => `Nothing to merge: ${host} ${host.includes(' and ') ? 'host' : 'hosts'} your previews, so the repository needed no change.`;
+/** The agent's words for why an app was not set up, kept only as plain words of at most 200 characters, with no address (a scheme, or a host with a path or query) and nothing shaped like a secret. */
+function plainReason(text) {
+    const plain = text.trim();
+    const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
+    return plain && plain.length <= 200 && plainText(plain) === plain && !address && !scan('output', plain).length ? plain : undefined;
+}
 /** Names as a reader lists them: "a", "a and b", "a, b and c". */
 const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
 /** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
@@ -219,7 +231,7 @@ export function signedInLine(saved, app) {
     const signed = accounts.filter((a) => a.outcome === 'signed-in' && typeof a.role === 'string').map(role);
     const not = accounts.filter((a) => a.outcome !== 'signed-in' && typeof a.role === 'string').map(role);
     if (!signed.length)
-        return undefined;
+        return not.length ? `${app ? `${app}: ` : ''}${andList(not)} did not sign in` : undefined;
     return `${app ? `${app}: signed` : 'Signed'} in as ${andList(signed)}${not.length ? `; ${andList(not)} did not` : ''}`;
 }
 /** The last screen's line for each host, in the order first met: "Cloudflare: Acme's Account · project crewline", "Netlify: team Acme · site crewline", "Vercel: team acme · project crewline" (#360). */
@@ -233,7 +245,7 @@ export function hostLines(used) {
         byHost.set(u.host, entry);
     }
     return [...byHost].map(([host, { accounts, projects }]) => {
-        const what = host === 'Netlify' ? 'site' : 'project';
+        const what = host === 'Netlify' || host === 'Render' ? 'site' : 'project';
         const account = accounts.size ? `${host === 'Cloudflare' ? '' : 'team '}${[...accounts].join(', ')} · ` : '';
         return `${host}: ${account}${projects.size > 1 ? `${what}s` : what} ${[...projects].join(', ')}`;
     });
@@ -267,9 +279,10 @@ const REPORT = {
             description: `What waits on the person besides merging the setup pull request and closing the test drive: one line each, at most ${STATUS_MAX} characters, such as "Add the admin test account on the setup page". The terminal counts them. Leave it out when nothing does.`,
             items: { type: 'string', minLength: 1 },
         },
+        reason: { type: 'string', minLength: 1, description: 'On a repository of one app where no preview method was saved: why, in plain words of at most 200 characters, such as "Render\'s pull request previews are off, and the person skipped turning them on". The last screen shows it. Names only, never an address or a key.' },
         apps: {
             type: 'array',
-            description: 'On a repository with several apps: for each picked app whose preview was not proven or keyed, why, in plain words of at most 200 characters, such as "not checked: the person stopped after the first app". Names only, never an address or a key.',
+            description: 'On a repository with several apps: for each picked app whose preview was not proven or keyed, why, in plain words of at most 200 characters, such as "not checked: the person stopped after the first app". The last screen shows it on that app\'s line. Names only, never an address or a key.',
             items: { type: 'object', additionalProperties: false, required: ['appKey', 'reason'], properties: { appKey: { type: 'string', minLength: 1 }, reason: { type: 'string', minLength: 1 } } },
         },
     },
@@ -328,6 +341,14 @@ const NETLIFY_PREVIEWS = {
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
     },
 };
+const RENDER_PREVIEWS = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        appKey: APP_KEY,
+        pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, a draft included, once pushed: reads its Render preview only, and waits up to five minutes for it to finish building.' },
+    },
+};
 const CLOUDFLARE_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
@@ -342,7 +363,7 @@ const PROVE_PREVIEW = {
     additionalProperties: false,
     required: ['url', 'expect'],
     properties: {
-        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or the live app\'s address one of them answered as production or a file of this checkout names, or a page on it.' },
+        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed, or the live app\'s address one of them answered as production or a file of this checkout names, or a page on it.' },
         expect: { type: 'string', minLength: 1, description: 'Words the page shows that a file of this checkout holds, such as the app\'s name in its title.' },
     },
 };
@@ -410,6 +431,8 @@ const NETLIFY_CONNECT = {
         publish: { type: 'string', minLength: 1, description: 'The folder the build writes the pages to, relative to the checkout, only where no netlify.toml sets one.' },
     },
 };
+/** A question that asks for an address: a URL, a domain, or the site's, the live app's or a preview's address or link. */
+const ASKS_ADDRESS = /\b(urls?|domains?|(web|site|live|production|preview|app's) (address|link)(es|s)?)\b|https?:\/\//i;
 /** What schemaError cannot say about a question: options belong to single and multi, at least two, each value once, and each other field to its kinds. */
 function askError(q) {
     const values = (q.options ?? []).map((o) => o.value);
@@ -1621,6 +1644,8 @@ export function createTools(ctx) {
     const budget = () => ({ used: retry.used, pushReservations: retry.pushReservations, remaining: Math.max(0, 3 - retry.used), historyKnown: retry.historyKnown });
     const attemptTasks = () => attempts().map((a, i) => ({ id: `preview-attempt-${a.runId}-${a.attempt}`,
         title: `Preview job attempt ${i + 1}`, status: a.status === 'success' ? 'completed' : a.status === 'running' ? 'in_progress' : 'failed' }));
+    /** The task list's order, the terminal's and the web page's alike (REN-1119). */
+    const taskOrder = new TaskOrder();
     const withAttempts = (tasks) => [...tasks.filter((t) => !t.id.startsWith('preview-attempt-')), ...attemptTasks()];
     async function observe(signal) {
         const pr = retry.pr;
@@ -1652,6 +1677,10 @@ export function createTools(ctx) {
     /** The origins of Production deployments Vercel made of a pushed branch that no locked project of this folder's made: served at a project's own address without a login, so no proof opens them. */
     const publicProduction = new Set();
     const cloudflareListed = new Set();
+    /** The address pattern of each Worker preview's origin Cloudflare's evidence listed, which the address alone cannot tell (#265), and of the Worker's own address it answered as production, the token scope they share: kept past a later read, for the last screen. */
+    const workerPatterns = new Map();
+    /** The origins of the successful Render previews impeccable_render_previews listed, of the app's own site. */
+    const renderListed = new Set();
     let hostedPreviewProven = false;
     /**
      * The address pattern each proof answered, by the app it was proven for, and the last one under '' for a repository
@@ -1692,9 +1721,15 @@ export function createTools(ctx) {
         const label = pagesProject(origin);
         if (label)
             return [{ host: 'Cloudflare', project: label, ...(accountOf.has(`cloudflare ${label}`) ? { account: accountOf.get(`cloudflare ${label}`) } : {}) }];
+        const worker = /^https:\/\/\{branch\}-([^.]+)\./.exec(workerPatterns.get(origin) ?? '')?.[1];
+        if (worker)
+            return [{ host: 'Cloudflare', project: worker }];
         const site = netlifySiteOf(url);
         if (site)
             return [{ host: 'Netlify', project: site, ...(accountOf.has(`netlify ${site}`) ? { account: accountOf.get(`netlify ${site}`) } : {}) }];
+        const render = renderSiteOf(url);
+        if (render)
+            return [{ host: 'Render', project: render.site }];
         const read = vercelNamed.get(origin);
         const named = read?.project ?? listedApps.get(origin)?.name;
         const vercel = vercelDeploymentOf(url, named);
@@ -1796,6 +1831,9 @@ export function createTools(ctx) {
     const cloudflareApps = new Map();
     /** What impeccable_cloudflare_connect answered: asked once, so that answer stands. */
     let connectOutcome;
+    /** Each app's Render site, by key ('' for a repository of one app), as impeccable_render_previews read it, and the service's page; and what the person answered on its Render screen, asked once. */
+    const renderApps = new Map();
+    const renderAnswers = new Map();
     // Keep ownership of files for this one run; never recreate it per call.
     const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer({ status: (line) => said(line) });
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
@@ -1856,6 +1894,29 @@ export function createTools(ctx) {
         ctx.sync.update({ phase: 'running', question: null });
         return answer;
     };
+    /**
+     * After the person's yes to turning a host's pull-request previews on: the host's CLI changes that one setting and reads
+     * it back (`turnOn`); where the host kept it, the person changes it on the host's page and the run reads again, twice at most.
+     */
+    const turnOnPreviews = async (host, turnOn, signal) => {
+        said(`Turning on pull-request previews on ${{ netlify: 'Netlify', cloudflare: 'Cloudflare Pages', render: 'Render' }[host]}`);
+        for (let tries = 0;; tries++) {
+            const outcome = await turnOn();
+            if (outcome.fact.enabled === true) {
+                previewFacts.set(host, outcome.fact);
+                return { status: 'enabled', by: outcome.changed ? 'run' : 'person' };
+            }
+            const why = outcome.reason ?? outcome.fact.reason;
+            if (tries === 2 || signal?.aborted)
+                return { status: 'refused', reason: why, page: outcome.page };
+            const retry = HOST_SCREENS[`${host}-previews-retry`];
+            // The host's page opens once, before the first retry screen, which speaks of it; the browser may not have opened (BROWSER=none, no opener), so the address is on the screen as well.
+            if (tries === 0)
+                (ctx.openBrowser ?? openBrowser)(outcome.page);
+            if ((await ask({ ...retry, hint: `${retry.hint} If it did not open, open this link: ${outcome.page}` })).skipped)
+                return { status: 'skipped', reason: why, page: outcome.page };
+        }
+    };
     /** Each host's sign-in this run: confirmed on its screen, so the screen shows once; skipped, so nothing more is asked for that host. */
     const hostSignIns = new Map();
     /** The teams a host's sign-in offered, each by name and slug: the choices a `<host>-team` question shows, whatever the model lists, so the pick the fence takes is a slug. */
@@ -2329,8 +2390,22 @@ export function createTools(ctx) {
         return proof;
     };
     /** A proof opened the app's preview at `url`, so its method may be saved. */
+    /** On a repository with several apps, a Preview method task done while a picked app has no method saved names whose it is, so its tick does not read as every app's (REN-1108). */
+    const labelled = (tasks) => {
+        if (!appsRepo)
+            return tasks;
+        const saved = [...(pickedApps ?? [])].filter((key) => appMethods.has(key));
+        const some = saved.length > 0 && saved.length < pickedApps.size;
+        // A label of an earlier list goes once every picked app has its method.
+        return tasks.map((t) => (t.status !== 'completed' || !stagesOf(t.title).includes('Preview method') ? t : { ...t, title: some ? `Preview method: ${andList(saved.map(appName))} only` : t.title.replace(/^Preview method: .* only$/, 'Preview method') }));
+    };
+    /** On a repository with several apps, the host whose preview a proof opened for each app: the last screen names them all, or none where an app is not set up (REN-1108). */
+    const appHosts = new Map();
     const proveApp = (key, url) => {
         provenApps.add(key);
+        const host = previewHostName(url);
+        if (host)
+            appHosts.set(key, host);
         noteApp(key, { preview_proven: true, preview_host: new URL(url).hostname });
     };
     /** Each app's folder, by key, as the state names it: what its host project or site must build. */
@@ -2629,7 +2704,7 @@ export function createTools(ctx) {
             }
             if (recordedChanges)
                 previews.changes.clear();
-            const tasks = withAttempts(ctx.sync.payload.tasks);
+            const tasks = taskOrder.sort(withAttempts(ctx.sync.payload.tasks));
             ctx.sync.update({ tasks });
             reportTasks(tasks);
             return JSON.stringify({ ...observation, attempts: attempts(), budget: budget() });
@@ -2657,7 +2732,7 @@ export function createTools(ctx) {
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPatterns.get(appsRepo ? String(saved.appKey) : ''))) {
-                return `Refused: the only address pattern saved is the one impeccable_prove_preview answered for ${appsRepo ? `this app's (${String(saved.appKey)})` : 'a'} Netlify or Cloudflare Pages preview. Nothing was saved.`;
+                return `Refused: the only address pattern saved is the one impeccable_prove_preview answered for ${appsRepo ? `this app's (${String(saved.appKey)})` : 'a'} Netlify, Cloudflare or Render preview. Nothing was saved.`;
             }
             // The before is the live app's address, and only one a proof opened with this app: an address no key opens is not set, and one the person saved is never cleared from here.
             if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
@@ -2692,14 +2767,48 @@ export function createTools(ctx) {
             let response = await call(pi, target.url, { method: target.method, body });
             // The setup API checks a repository's preview once per 30 seconds, whichever app asks: the next app's check waits its turn here, a bounded wait in place of the sleep the fence refuses (#338).
             const check = /\/(connection-check|latest-pull-check)$/.test(target.url);
+            const pause = ctx.checkWait ?? ((ms, stop) => sleep(ms, undefined, { signal: stop }));
             for (let tries = 0; check && response.status === 429 && tries < CHECK_RETRIES && !signal?.aborted; tries++) {
                 const seconds = Math.min(Math.max(Math.ceil(response.retryAfter ?? 30), 1), 60);
                 said(`Waiting ${seconds} s for the next preview check`);
-                await (ctx.checkWait ?? ((ms, stop) => sleep(ms, undefined, { signal: stop })))(seconds * 1000, signal).catch(() => undefined);
+                await pause(seconds * 1000, signal).catch(() => undefined);
                 if (signal?.aborted)
                     break;
                 response = await call(pi, target.url, { method: target.method, body });
             }
+            // A password the save's sign-in turned away is asked for once more, on the same account screen, and the list saved again once the setup API can sign in again (#249).
+            const tried = object(object(response.data)?.signInCheck)?.accounts;
+            const turnedAway = new Set(testAccounts && response.ok && Array.isArray(tried) ? tried.filter((a) => object(a)?.outcome === 'wrong-credentials').map((a) => String(object(a)?.role)) : []);
+            if (turnedAway.size) {
+                const checkedAt = Date.now();
+                let retyped = false;
+                for (const account of object(body)?.accounts) {
+                    const role = String(account.role ?? 'default');
+                    if (!turnedAway.has(role))
+                        continue;
+                    const answer = await ask({ id: `${role}-account`, kind: 'account', title: role === 'default' ? 'Test account' : `${role.charAt(0).toUpperCase()}${role.slice(1)} account`, prompt: `Add the ${role === 'default' ? '' : `${role} `}test account.`, hint: `That password did not sign in${typeof account.loginPage === 'string' ? ` at ${account.loginPage}` : ''}. Type it again, or skip.`, prefill: String(account.username ?? '') });
+                    // A stop closes the screen: no other account is asked for, and nothing is saved again.
+                    if (answer.closed || signal?.aborted) {
+                        retyped = false;
+                        break;
+                    }
+                    if (answer.skipped)
+                        continue;
+                    // Kept with what the person typed, so the answer never carries it back to the model.
+                    typed.set(`secret:${randomBytes(6).toString('hex')}`, answer.password ?? '');
+                    Object.assign(account, { username: answer.username, password: answer.password });
+                    retyped = true;
+                }
+                const wait = SIGN_IN_CHECK_MS - (Date.now() - checkedAt);
+                if (retyped && wait > 0) {
+                    said(`Waiting ${Math.ceil(wait / 1000)} s for the next sign-in check`);
+                    await pause(wait, signal).catch(() => undefined);
+                }
+                // A second save that fails leaves the first one's answer: those accounts are saved.
+                const again = retyped && !signal?.aborted ? await call(pi, target.url, { method: target.method, body }) : undefined;
+                if (again?.ok)
+                    response = again;
+            }
             if (testAccounts && response.ok)
                 retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
             // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
@@ -2809,6 +2918,9 @@ export function createTools(ctx) {
                 return `Invalid input: ${error}.`;
             if (hidden)
                 ctx.log.write('ask hidden (names a credential)', q.id);
+            // An address is the host tools' to find, never the person's to type (REN-1104): a preview's and the live app's alike.
+            if (q.kind === 'text' && !q.sensitive && ASKS_ADDRESS.test(`${q.title ?? ''} ${q.prompt} ${q.hint ?? ''}`))
+                return "Refused: the person is never asked to type an address. The host tools find the previews and the live app (impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews, impeccable_render_previews); where none does, the preview goes as server-previews says, and the report says what was not found.";
             if (q.kind === 'text' && !q.sensitive)
                 q.caution = NEVER_A_CREDENTIAL;
             // The apps question's screen is the tool's to show (TOOL_SHOWN), so the web page hears of it here; it has no Skip (#405).
@@ -2843,7 +2955,6 @@ export function createTools(ctx) {
         }),
         tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, a status line about another task than the one in progress, a task once completed that is no longer, Preview method completed before a method is saved, and a Preview workflow or Setup pull request task once a host\'s previews are the method.', PROGRESS, async (p) => {
             const status = p.status.trim();
-            const tasks = withAttempts(p.tasks);
             const own = p.tasks.filter((t) => !t.id.startsWith('preview-attempt-'));
             const voice = statusVoiceError(status) ?? stageError(status, own);
             if (voice)
@@ -2858,6 +2969,8 @@ export function createTools(ctx) {
             const unneeded = hostMethod && !perApp && !ctx.sync.payload.setup_pr ? own.filter((t) => /\bsetup pull request\b/i.test(t.title) || stagesOf(t.title).includes('Preview workflow')) : [];
             if (unneeded.length)
                 return `Refused: ${savedHost ?? 'the host'} builds this run's previews, so the repository needs no workflow and no setup pull request. Leave ${unneeded.map((t) => `"${t.title}"`).join(' and ')} off the list: a task the run never does is not shown, not even as skipped. Nothing was saved: call impeccable_progress again.`;
+            // Ordered only once taken, so a refused list leaves the order as it was.
+            const tasks = taskOrder.sort(labelled(withAttempts(p.tasks)));
             ctx.sync.update({ phase: 'running', status, tasks });
             reportStatus(status);
             reportTasks(tasks);
@@ -3007,13 +3120,24 @@ export function createTools(ctx) {
                 if (a.ended)
                     noteApp(a.key, { reason: `The setup ended for it: the person said no to ${SETUP_ENDS[a.ended].said}.` });
             for (const { appKey, reason } of p.apps ?? []) {
-                const plain = reason.trim();
-                const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
-                if (plain.length <= 200 && plainText(plain) === plain && !address && !scan('output', plain).length)
-                    noteApp(appKey, { reason: plain });
+                const plain = plainReason(reason);
+                if (!plain)
+                    continue;
+                noteApp(appKey, { reason: plain });
+                // The last screen says why on the app's own line, rather than sending the person to the report (REN-1108).
+                const app = apps?.find((a) => a.key === appKey && a.state === 'unset' && !a.ended);
+                if (app)
+                    app.left = `${app.name}: ${plain.replace(/[.\s]+$/, '')}.`;
             }
+            const reason = !appsRepo && typeof p.reason === 'string' ? plainReason(p.reason) : undefined;
+            // The hosts build every preview only where every picked app is set up with a host's previews: on a repository where one app is not, no host speaks for it (REN-1108).
+            const hostsOf = picked?.every((a) => a.state === 'ready' && appMethods.get(a.key) === 'preview-deploy' && appHosts.has(a.key)) ? [...new Set(picked.map((a) => appHosts.get(a.key)))] : [];
+            const hostedBy = apps ? (hostsOf.length ? andList(hostsOf) : undefined) : savedHost;
             // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
-            ctx.sync.update({ phase: 'completed', status: ended ? SETUP_ENDS[ended].title : 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
+            // The list as the run left the apps: a Preview method done for some apps only says whose (REN-1108).
+            const tasks = taskOrder.sort(labelled(ctx.sync.payload.tasks));
+            reportTasks(tasks);
+            ctx.sync.update({ tasks, phase: 'completed', status: ended ? SETUP_ENDS[ended].title : 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
@@ -3028,7 +3152,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(unhonoured ? { unhonoured } : {}), ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}), ...(ended ? { ended } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(unhonoured ? { unhonoured } : {}), ...(hostedBy ? { hostedBy } : {}), ...(reason ? { reason } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}), ...(ended ? { ended } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -3189,7 +3313,7 @@ export function createTools(ctx) {
                 noteApp(appKey, { host_project: site });
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds); where its branch builds make previews, they are listed too, on workers.dev (the alias https://<branch>-<worker>.<subdomain>.workers.dev, with the pattern it stands for), and with no Pages project production is the Worker's own address; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -3207,7 +3331,9 @@ export function createTools(ctx) {
                 return `Refused: read impeccable_cloudflare_previews with appKey ${appKey} and no pull or branch first: it tells which Pages project builds that app.`;
             // The name of the account the project was found in is for the last screen alone.
             let accountName;
-            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
+            // A Worker Preview's build names no address: its alias is made from the pattern the plain read's Worker preview stood for.
+            const pattern = cloudflareEvidence?.previews.find((preview) => preview.pattern)?.pattern;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}), ...(pattern ? { pattern } : {}) });
             const read = async () => {
                 const evidence = await readAll();
                 return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
@@ -3220,7 +3346,7 @@ export function createTools(ctx) {
             // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
             const app = cloudflareEvidence?.githubApp;
             const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false, ...(typeof p.appKey === 'string' ? { app: p.appKey } : {}) } : undefined;
-            let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare ${pattern ? 'Workers' : 'Pages'} to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
             // cf not on this machine (#396): its install is asked before anything installs it, and the evidence read again with it.
             if (!subject && waited.cli === 'missing') {
                 await installCf(pi, signal);
@@ -3247,10 +3373,16 @@ export function createTools(ctx) {
                     continue;
                 for (const address of [preview.url, ...(preview.alias ? [preview.alias] : [])]) {
                     cloudflareListed.add(new URL(address).origin);
+                    if (preview.pattern)
+                        workerPatterns.set(new URL(address).origin, preview.pattern);
                     if (appKey !== undefined)
                         listedApps.set(new URL(address).origin, { appKey });
                 }
             }
+            // The Worker's own address, the live app with no Pages project, is in its previews' scope: Access's token goes there as it goes to a Pages project's own address.
+            const workerPattern = evidence.previews.find((preview) => preview.pattern)?.pattern;
+            if (workerPattern && !evidence.project && evidence.production)
+                workerPatterns.set(new URL(evidence.production).origin, workerPattern);
             if (evidence.pullRequestPreviews)
                 previewFacts.set('cloudflare', evidence.pullRequestPreviews);
             const named = evidence.pullRequestPreviews?.project || evidence.project;
@@ -3259,29 +3391,44 @@ export function createTools(ctx) {
             noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, a Pages build that succeeded, or a Render preview), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify, Cloudflare (Pages, or a Worker\'s previews) and Render it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
             const origin = URL.canParse(url) ? new URL(url).origin : null;
             if (origin && publicProduction.has(origin))
                 return "Refused: Vercel called this deployment Production, as it calls a project's first whatever branch it builds, and no project of this folder's that is locked at every address made it, so it is served at a project's own address without a login: it is no preview, and nothing was opened. No test drive, as the vercel-setup case says.";
-            const listed = origin !== null && (listedPreviews.has(origin) || netlifyListed.has(origin) || cloudflareListed.has(origin));
+            const listed = origin !== null && (listedPreviews.has(origin) || netlifyListed.has(origin) || cloudflareListed.has(origin) || renderListed.has(origin));
             // The live app's address, for the before: one a host tool answered as production, or one a file the checkout tracks names, such as the README's live-site line, when it is the site's or project's own address on one of the hosts: a deploy preview or branch alias a file links stays a preview, listed or not, and an address elsewhere, which could be on the person's own network, is only a host tool's to name.
             const known = origin !== null ? productionListed.get(origin) : undefined;
             const live = origin !== null && !listed && (known !== undefined || (liveShaped(url) && (await checkoutNames(pi.cwd, origin))));
             if (!origin || (!listed && !live))
-                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
+                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
             // The Netlify site, by the address's shape or, for the site's custom domain, as its tool named it: its password goes to the site's own addresses.
             const site = netlifySiteOf(url) ?? known?.site;
-            // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
-            const project = pagesProject(origin);
+            // A saved service token opens its Pages project's previews, or its Worker's: Access admits it wherever the application's policy covers.
+            const project = pagesProject(origin) ?? workerPatterns.get(origin);
             const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
-            const proof = await provePreview(url, p.expect, pi.cwd, {
+            const prove = () => provePreview(url, p.expect, pi.cwd, {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
                 ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
                 ...(site && sitePasswords.has(site) ? { password: sitePasswords.get(site).value } : {}),
                 ...(token ? { access: token } : {}),
             });
+            let proved = await prove();
+            // Render reports a preview's deploy successful before its edge serves that build (REN-1117): a page the push added answers 404 for a while, so it is asked for again here, within a bounded wait, the way a command's sleep would but the fence refuses.
+            if (!live && renderListed.has(origin) && proved.status === 404) {
+                const wait = ctx.hostWait?.serve ?? { totalMs: 90_000, everyMs: 5_000 };
+                said('Waiting for Render to serve the new page');
+                for (const end = Date.now() + wait.totalMs; proved.status === 404 && Date.now() < end && !signal?.aborted;) {
+                    await sleep(wait.everyMs, undefined, { signal }).catch(() => undefined);
+                    if (!signal?.aborted)
+                        proved = await prove();
+                }
+                if (proved.status === 404 && !signal?.aborted)
+                    proved = { ...proved, reason: `The address still answered 404 ${Math.round(wait.totalMs / 1000)} s after Render reported the preview built: the page is not in the preview's build.` };
+            }
+            // A Worker's preview proven answers the pattern its evidence listed.
+            const proof = proved.proven && !live && workerPatterns.has(origin) ? { ...proved, pattern: workerPatterns.get(origin) } : proved;
             // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
             if (live) {
                 if (proof.proven)
@@ -3334,6 +3481,109 @@ export function createTools(ctx) {
                 return JSON.stringify({ ...proof, appKey: app.appKey });
             return JSON.stringify(proof);
         }),
+        tool('impeccable_render_previews', 'Render previews', "Read whether Render builds this repository's pull requests, on a repository with several apps for the app's own folder (appKey): the Render site, from the render CLI signed in on this machine (the service built from this repository, in the app's folder by its Root Directory), else the one site Render's deployments on GitHub and the checkout's files name (on a repository with several apps, a file in the app's own folder, or a line of the root README naming that app and no other); its previews as GitHub records them, each with its pull request, its address and its state (a closed pull request's address too, read from its earlier successful status, though Render took that preview down); production, the site's own address, for the before; pattern, the address every pull request's preview has; and pullRequestPreviews (enabled false, with the cause, where the service's previews are off or manual; 'unknown' without the CLI's answer). cli says whether the render CLI answered (signed-in), is missing, could not list the services (unread, with the reason), or lists none of this repository's (none). Once a site is found, it shows the person one screen naming Render, with the site's address to click, asked once for each app: confirmed true, or false when the person skipped it, which is a no that ends the setup for that app. Where the CLI says the previews are off, that screen is also the consent to turning them on, and on the yes the CLI turns them on and reads them back, with a retry screen on Render's page where it could not: turnedOn in the answer says how that ended (enabled, by run or person; skipped; refused, with the reason and the page). With pull (a pull request of this run, a draft included: Render builds the preview as soon as a pull request opens), only that pull request's preview of the site the plain read found, waiting up to five minutes for it to finish building, under a status line with its timer, and again on the person's yes when the time ran out. Never asks for an address.", RENDER_PREVIEWS, async (p, pi, signal) => {
+            const pull = p.pull;
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            const appKey = appsRepo ? p.appKey : undefined;
+            const key = appKey ?? '';
+            const forApp = appKey !== undefined ? { appKey } : {};
+            const folder = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && folder === undefined)
+                return JSON.stringify({ appKey, previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
+            const known = renderApps.get(key);
+            if (pull !== undefined && !known)
+                return `Refused: read impeccable_render_previews${appKey !== undefined ? ` with appKey ${appKey}` : ''} and no pull first: it tells which Render site builds ${appKey !== undefined ? 'that app' : 'this repository'}.`;
+            // GitHub's record of the repository's deployments (with `branch`, its head's), and of those Render's previews of `site`, of `pull` alone where it is given.
+            const readEvidence = (branch) => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, ...(branch !== undefined ? { branch } : {}) });
+            const previewsOf = (evidence, site) => evidence.deployments.flatMap((d) => {
+                const preview = parseRenderDeployment(d.environment, d.url);
+                return preview && preview.site === site && (pull === undefined || preview.pull === pull) ? [{ pull: preview.pull, url: d.url, state: d.state }] : [];
+            });
+            // The successful previews are the ones a proof may open, each the app's.
+            const list = (previews) => {
+                for (const origin of renderListed)
+                    listedApps.delete(origin);
+                renderListed.clear();
+                for (const preview of previews) {
+                    if (preview.state !== 'success')
+                        continue;
+                    renderListed.add(new URL(preview.url).origin);
+                    if (appKey !== undefined)
+                        listedApps.set(new URL(preview.url).origin, { appKey });
+                }
+            };
+            if (pull !== undefined) {
+                const found = await ctx.viewPullRequest(pull);
+                if (!('headRefName' in found))
+                    return `Refused: #${pull} could not be read: ${found.error}`;
+                const read = async () => {
+                    const evidence = await readEvidence(found.headRefName);
+                    return { previews: previewsOf(evidence, known.site), ...(evidence.error ? { error: evidence.error } : {}) };
+                };
+                const final = (e) => Boolean(e.error) || e.previews.some((preview) => preview.state === 'success' || preview.state === 'failure' || preview.state === 'error');
+                const waited = await awaitBuild('Render', `Waiting for Render to build ${await subjectOf(pull)}`, read, final, () => known.page, signal);
+                list(waited.previews);
+                return JSON.stringify({ ...forApp, site: known.site, ...waited });
+            }
+            const render = (ctx.hostRunner ?? commandRunner)('render', pi.cwd, { signal });
+            const read = await readRenderService(render, repository, folder);
+            const service = 'service' in read ? read.service : undefined;
+            const evidence = await readEvidence();
+            let site = service?.site;
+            // Without the CLI's answer, the site the repository names: on a repository of one app, the one Render site its deployments and files name; on one of several, the one a file in the app's own folder names, else the one a line of the root README names beside that app and no other.
+            if (!site) {
+                const recorded = evidence.deployments.flatMap((d) => parseRenderDeployment(d.environment, d.url)?.site ?? []);
+                if (appKey === undefined) {
+                    const sites = new Set([...recorded, ...(await renderSitesNamed(pi.cwd))]);
+                    site = sites.size === 1 ? [...sites][0] : undefined;
+                }
+                else {
+                    const inFolder = await renderSitesNamed(pi.cwd, folder);
+                    const app = knownApps?.find((a) => a.key === appKey);
+                    const others = (knownApps ?? []).filter((a) => a.key !== appKey);
+                    const beside = app ? await Promise.all([...new Set([...recorded, ...(await renderSitesNamed(pi.cwd))])].map(async (s) => ((await readmeNamesApp(pi.cwd, `https://${s}.onrender.com`, app, others)) ? s : null))) : [];
+                    const named = inFolder.length ? inFolder : beside.filter((s) => s !== null);
+                    site = named.length === 1 ? named[0] : undefined;
+                }
+            }
+            const cli = 'service' in read ? 'signed-in' : read.cli;
+            const unread = 'reason' in read ? { unread: read.reason } : {};
+            if (!site)
+                return JSON.stringify({ ...forApp, previews: [], cli, ...unread, ...(evidence.error ? { error: evidence.error } : {}) });
+            const previews = previewsOf(evidence, site);
+            list(previews);
+            const production = service?.production ?? `https://${site}.onrender.com`;
+            noteProduction(production, 'render', undefined, appKey);
+            let fact = service?.fact ?? { project: site, enabled: 'unknown', reason: 'reason' in read ? read.reason : undefined };
+            noteApp(appKey, { host_project: site });
+            renderApps.set(key, { site, page: service?.page ?? RENDER_DASHBOARD });
+            // The one screen, asked once for each app: the site's address to click, and the consent to turning its previews on where the CLI says they are off. Its skip is a no that ends the app's setup.
+            let answered = renderAnswers.get(key);
+            if (answered?.confirmed === false)
+                decline('no-previews', appKey);
+            if (!answered) {
+                const off = service !== undefined && fact.enabled === false && fact.cause === 'previews';
+                if ((await ask(renderConfirm({ site, address: production, previewsOff: off, ...(appKey !== undefined ? { app: appName(appKey) } : {}) }))).skipped) {
+                    answered = { confirmed: false, reason: 'The person skipped the Render screen.' };
+                    decline('no-previews', appKey);
+                }
+                else if (off && service) {
+                    const turned = await turnOnPreviews('render', () => enableRenderPreviews(render, repository, service.id), signal);
+                    if (turned.status === 'skipped')
+                        decline('no-previews', appKey);
+                    if (turned.status === 'enabled')
+                        fact = previewFacts.get('render') ?? fact;
+                    answered = { confirmed: true, turnedOn: turned };
+                }
+                else {
+                    answered = { confirmed: true };
+                }
+                renderAnswers.set(key, answered);
+            }
+            return JSON.stringify({ ...forApp, site, ...(service ? { service: service.id } : {}), production, pattern: `https://${site}-pr-{pr}.onrender.com`, previews, pullRequestPreviews: fact, cli, ...unread, ...(evidence.error ? { error: evidence.error } : {}), ...answered });
+        }),
         tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. With the folder linked to no site, the one site built from this repository already stands for it, with appKey the one whose base directory is that app's folder: no netlify link needed. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
             const command = p.command;
             const publish = p.publish;
@@ -3367,7 +3617,6 @@ export function createTools(ctx) {
                 return `Refused: this is for a host whose pullRequestPreviews said enabled false in this run. Read ${host === 'netlify' ? 'impeccable_netlify_previews or impeccable_netlify_connect' : 'impeccable_cloudflare_previews'} first.`;
             if (host === 'cloudflare' && fact.cause === 'source')
                 return `Refused: the Pages project ${fact.project} is connected to no repository, so there is no setting to turn on. impeccable_cloudflare_connect connects it.`;
-            const name = host === 'netlify' ? 'Netlify' : 'Cloudflare Pages';
             const answer = (status, more) => {
                 const told = { status, project: fact.project, ...more };
                 enableOutcomes.set(host, told);
@@ -3378,31 +3627,14 @@ export function createTools(ctx) {
             const screen = HOST_SCREENS[`${host}-previews`];
             if ((await ask({ ...screen, prompt: `Turn on pull-request previews for ${fact.project}?` })).skipped)
                 return answer('skipped', { reason: 'The person skipped turning pull-request previews on.' });
-            said(`Turning on pull-request previews on ${name}`);
             // cf is installed here: the fact this acts on is one a read through cf found.
-            const turnOn = async () => {
+            const { status, ...more } = await turnOnPreviews(host, async () => {
                 if (host === 'netlify')
                     return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
                 const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
                 return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
-            };
-            // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
-            for (let tries = 0;; tries++) {
-                const outcome = await turnOn();
-                if (outcome.fact.enabled === true) {
-                    previewFacts.set(host, outcome.fact);
-                    return answer('enabled', { by: outcome.changed ? 'run' : 'person' });
-                }
-                const why = outcome.reason ?? outcome.fact.reason;
-                if (tries === 2 || signal?.aborted)
-                    return answer('refused', { reason: why, page: outcome.page });
-                const retry = HOST_SCREENS[`${host}-previews-retry`];
-                // The host's page opens once, before the first retry screen, which speaks of it; the browser may not have opened (BROWSER=none, no opener), so the address is on the screen as well.
-                if (tries === 0)
-                    (ctx.openBrowser ?? openBrowser)(outcome.page);
-                if ((await ask({ ...retry, hint: `${retry.hint} If it did not open, open this link: ${outcome.page}` })).skipped)
-                    return answer('skipped', { reason: why, page: outcome.page });
-            }
+            }, signal);
+            return answer(status, more);
         }),
         tool('impeccable_cloudflare_connect', 'Connect the repository to Cloudflare Pages', "Connect this repository to a Cloudflare Pages project, so that Cloudflare builds every pull request as a preview, where impeccable_cloudflare_previews found no Pages project building them: the project the checkout names when it exists with no Git source (pullRequestPreviews with cause source), else a new one named after the repository where Cloudflare builds a Worker from it (worker in the answer) or the checkout is set up for a Pages project that does not exist yet. It does the rest as the person: one screen asking to connect or to create (Cloudflare's sign-in in the browser first, with a retry, where cf is not signed in here with pages:write), then cf creates the project with the build the checkout runs (command and outputDir, for a new project) and connects the repository as GitHub identifies it, every branch but the default a preview, and reads it back. Answers {\"status\": …}: connected (project names the Pages project, created whether the run made it, subdomain its own address under pages.dev, productionBranch the branch Cloudflare builds as production; pullRequestPreviews is on now), skipped (the person skipped a screen; reason says which) or refused (cf could not, or Cloudflare refused; reason says why). Cloudflare's GitHub app then has to see the repository for a push to build: the wait for the test drive's build asks for its access when none comes.", CLOUDFLARE_CONNECT, async (p, pi, signal) => {
             // The answer stands for the run, as before; its no ends the setup only of an app on the project it was for.
@@ -3882,7 +4114,7 @@ export function createTools(ctx) {
                 return null;
             };
             let answer;
-            const project = pagesProject(new URL(at.url).origin);
+            const project = pagesProject(new URL(at.url).origin) ?? workerPatterns.get(new URL(at.url).origin);
             // The token in hand goes only to a project it opened already, as the proofs send it: any other address is read for an application of the person's first.
             if (accessToken && project && accessProjects.has(project) && (await prove(accessToken)).proven) {
                 // The token in hand opens this address too: stored already, or stored now.
@@ -3935,14 +4167,14 @@ export function createTools(ctx) {
                 if (project)
                     accessProjects.add(project);
             }
-            const pattern = told.status === 'saved' ? proof?.pattern : undefined;
+            const pattern = told.status === 'saved' ? (proof?.pattern ?? workerPatterns.get(new URL(at.url).origin)) : undefined;
             accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };
             // The person's no to the service token leaves the previews behind Cloudflare Access: the setup ends there for the app (#413).
             if (told.status === 'skipped')
                 decline('no-access', at.app?.appKey);
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
-                provenHost = 'Cloudflare Pages';
+                provenHost = previewHostName(at.url) ?? 'Cloudflare Pages';
                 usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);