@impeccable/reviews 0.1.28 → 0.1.29

package/README.md

@@ -66,7 +66,7 @@ The command stops when the sandbox does not start: on macOS inside another tool'
 
 The fence stays the layer inside the sandbox: it keeps the setup to its own steps and out of `.env` files, and the agent's commands get your environment without the tokens, keys and passwords in it, whether their names say so or their values are shaped like a secret (a GitHub token, a private key, a service account's key, a password in a URL), and what runs as you (`git commit` and `push`, `gh`, the host CLIs) gets it without `GH_REPO` and `GH_HOST`, so `gh` works on this checkout's repository on github.com, whatever repository or host they name. The agent's own file tools (read, write, edit, grep, find and ls) open files in the command's process, as you, so for them the fence judges the path pi opens, not the string the agent typed: spelled the way pi spells it (a curly apostrophe for a straight one, among others) and with its symlinks followed, and a path that starts with `@` or `~` or a URL scheme, which pi would open elsewhere, is refused outright; read, write, edit, grep and ls judge each file once more as they open it (ls each entry too, so a symlink out of the checkout is not listed), find judges the folder it searches before fd walks it and every path fd reports after, and a symlinked folder out of the checkout is neither followed nor listed; the names of `.env` files are listed, as `ls -a` shows them, and only a read of one is refused; a grep glob that names `.env` files is refused, and no line of a `.env` file is in what grep reports, whatever glob it was given. It also reads what goes past it: text shaped like a secret (a cloud, GitHub, Google or SendGrid key, a private key, a token, a Slack webhook's address, a password in an address or on a curl command line) in a file the agent writes, a setting, a commit, a pull request or a message to you is refused, read as written and as the screen would show it once an escape sequence is taken out, a command that names a credential file (`~/.ssh`, `.aws/credentials`, `.netrc`, `.env`) is refused, and what the agent reads gets a line saying it is data when it carries text shaped like instructions; the debug log and `--scan-report` list each match. A commit message, a template and a pull request body come inline (`-m`, `--body`), never from a file: the file the fence read is not surely the file git or gh, outside the sandbox, read later, since a command still running in the sandbox can swap it in between. For the same reason the messages of the commits a push carries are read again as the push runs, all of them (past what the remote has: its branch of that name, the default branch, and one the pushed branch is stacked on, such as an earlier run's setup branch under a new test drive), and so is every line they add to a `.env` file's example, which a command may have written, with the same check as a file the agent writes; a push whose commits cannot be read whole is refused, as is one whose remote cannot be reached, since what it carries cannot be checked then (the push can be tried again once the network is back; the remote is asked with no prompt for a password or a passphrase, which would hold it), and one in the same command as the `git commit` or `git checkout -b` that makes what it carries, which is not there yet when it is read: the push runs as a command of its own, after the commit. A commit carries only files the agent wrote, or named in a `git add`: a file a script staged on its own is refused by name, and `git restore --staged` takes it out; a push whose new commits carry such a file (a script can commit on its own, past the index) is refused the same way. Once `impeccable_sync_workflow` wrote the preview workflow, or removed the retired one, a commit carries that file only as the tool left it: the setup state's bytes, or no file. A status line the agent starts a message with shows in the terminal and on the web page only when its progress tool would take it: in the product voice, short, and holding nothing shaped like a secret.
 
-Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `git branch` and `git remote` in their listing forms, `git ls-remote origin` (in the sandbox, over https, and never held on a prompt for a sign-in), `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
+Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `git branch` and `git remote` in their listing forms, `git ls-remote origin` (in the sandbox, over https, and never held on a prompt for a sign-in), `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`), `gh pr list` for this repository's pull requests, named with `--repo` (with `--state`, `--limit`, at most 100, and `--json`, never `--web` or a search) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
 
 `vercel whoami` and `vercel --version`. Once you said yes to the Vercel setup: `vercel link --yes` in the checkout's root alone (never in a folder of it, whose name would pick one of your projects), `vercel project add` and `vercel deploy` for a preview, on the project named after the folder and in the one team the sign-in settled on (the CLI's current scope, your only team, or the one you pick when it asks): no other `--scope`, `--team` or `--project`, never `vercel project ls`, which names your projects, and a global install of the Vercel CLI itself when it is missing, with npm and pinned to the version this release names (`npm install -g vercel@<version>`; another package manager, version or tag is refused). The sign-in (`vercel login`) and the repository's connection (`vercel git connect`, for a project the run created or one connected to the repository already) are the run's own tools, never the agent's commands. Never a production deploy, a project's removal, its environment variables or protection settings (`vercel project protection`, `api` and `curl` print a project's bypass secrets, so the agent's shell never runs them; the lock before a new project's first deployment and the bypass secret are the run's own tools), or a token on the command line.
 

package/dist/cloudflare.js

@@ -14,8 +14,11 @@ import { ownFolder } from './sandbox.js';
  * check run on each commit it built and a comment on the pull request, both
  * naming the deployment's address (https://<id>.<project>.pages.dev) and the
  * branch's alias (https://<branch>.<project>.pages.dev), which follows the
- * branch's latest build. Nothing here reads a token, and nothing comes back
- * beyond the fields below.
+ * branch's latest build. A Worker that Workers Builds builds from the repository
+ * gets previews of its branches where its branch builds make them, on workers.dev
+ * (https://<version or branch>-<worker>.<subdomain>.workers.dev): its check run
+ * names both addresses, or, for a Worker Preview, its comment names the preview's.
+ * Nothing here reads a token, and nothing comes back beyond the fields below.
  */
 /** How many pull requests, the most recently updated, the evidence reads. */
 const NEWEST = 10;
@@ -23,6 +26,8 @@ const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
 /** A Pages deployment's address, or a branch's alias: one label, then the project, under pages.dev. */
 export const PAGES_ADDRESS = new RegExp(`^https://(${LABEL})\\.(${LABEL})\\.pages\\.dev$`);
 const LINKS = new RegExp(`https://${LABEL}\\.${LABEL}\\.pages\\.dev`, 'g');
+/** A Worker's preview address: one label, the version's id or the branch's alias joined to the Worker's name, then the account's subdomain, under workers.dev. */
+export const WORKERS_ADDRESS = new RegExp(`^https://(${LABEL})\\.(${LABEL})\\.workers\\.dev$`);
 /** Cloudflare's GitHub app, by the slug its check runs carry and the login its comments carry; the earlier Pages-only app posted the same. */
 const APPS = new Set(['cloudflare-workers-and-pages', 'cloudflare-pages']);
 const isApp = (login) => typeof login === 'string' && APPS.has(login.replace(/\[bot\]$/, ''));
@@ -47,14 +52,27 @@ function addresses(html) {
     const links = [...new Set(html.match(LINKS) ?? [])];
     return { url: fits(row('Preview URL')) ?? links[0], alias: fits(row('Branch Preview URL')) ?? (links[1] !== links[0] ? links[1] : undefined) };
 }
+/**
+ * A preview of the Worker `script` by its alias on workers.dev, `<name>-<script>.<subdomain>` (`name` the preview's where
+ * Cloudflare names it, else any branch's), with the pattern that alias stands for, and the version's address,
+ * `<version id>-<script>.<subdomain>`, where it is the same Worker's on the same subdomain; none for an alias of another Worker, or none.
+ */
+function workerPreview(script, url, alias, name) {
+    const [, label, subdomain] = (alias && WORKERS_ADDRESS.exec(alias)) || [];
+    if (!alias || !(name !== undefined ? label === `${name}-${script}` : label?.endsWith(`-${script}`)))
+        return undefined;
+    const [, version, on] = (url && WORKERS_ADDRESS.exec(url)) || [];
+    return { url: url && version?.slice(9) === script && /^[0-9a-f]{8}-/.test(version) && on === subdomain ? url : alias, alias, pattern: `https://{branch}-${script}.${subdomain}.workers.dev` };
+}
 /** What a check run's conclusion, or the words the app's table says, tell of the build. */
 const stateOf = (value) => (typeof value !== 'string' ? 'building' : /succe/i.test(value) ? 'success' : /fail|timed_out|error/i.test(value) ? 'failure' : /cancel/i.test(value) ? 'canceled' : 'building');
 /**
  * GitHub's record: the Cloudflare check run on each head (or, with `only`, that pull request's; with `branch`, the
  * pushed branch's head alone, before its pull request exists), and the app's comment on each pull request when it
- * describes the head. `failed` when a read did not answer.
+ * describes the head. A Worker Preview's check run names no address, so its alias is made from `pattern`, the one an
+ * earlier read's Worker preview stood for. `failed` when a read did not answer.
  */
-async function fromGitHub(owner, repo, gh, only, branch) {
+async function fromGitHub(owner, repo, gh, only, branch, pattern) {
     const base = `/repos/${owner}/${repo}`;
     const get = async (route) => JSON.parse(await gh(['api', '--hostname', 'github.com', '--method', 'GET', route]));
     let failed = false;
@@ -87,8 +105,16 @@ async function fromGitHub(owner, repo, gh, only, branch) {
                 continue;
             const script = typeof run.name === 'string' ? /^Workers Builds: (\S+)$/.exec(run.name)?.[1] : undefined;
             if (script) {
+                const build = run.status === 'completed' ? stateOf(run.conclusion) : 'building';
                 if (!worker || head.at > worker.at)
-                    worker = { script, build: run.status === 'completed' ? stateOf(run.conclusion) : 'building', at: head.at };
+                    worker = { script, build, at: head.at };
+                // A branch build's preview: its summary names the version's address and the branch's alias; a Worker Preview's names neither, and its build page's address names the preview.
+                const said = Object.fromEntries([...String(record(run.output)?.summary ?? '').matchAll(/^Preview (URL|Alias URL): (\S+)$/gm)].map((m) => [m[1], m[2]]));
+                const name = typeof run.details_url === 'string' ? new RegExp(`/previews/(${LABEL})/builds/`).exec(run.details_url)?.[1] : undefined;
+                // An earlier read's pattern makes the alias only where it is this Worker's own, never another Worker's whose name ends in this one's.
+                const preview = workerPreview(script, said.URL, said['Alias URL'] ?? (name && pattern?.startsWith(`https://{branch}-${script}.`) ? pattern.replace('{branch}', name) : undefined));
+                if (preview)
+                    found.push({ ...(head.number ? { pullRequest: head.number } : {}), ...(head.branch ? { branch: head.branch } : {}), sha: head.sha, ...preview, state: build, from: 'check run', at: when(run.completed_at) || head.at });
                 continue;
             }
             const { url, alias } = addresses(String(record(run.output)?.summary ?? ''));
@@ -105,6 +131,15 @@ async function fromGitHub(owner, repo, gh, only, branch) {
             const head = heads.find((h) => h.number === issue);
             if (!head || !isApp(record(comment.user)?.login) || typeof comment.body !== 'string')
                 continue;
+            // A Worker Preview's comment names the preview's address and the commit it last deployed, `### Preview URL: <address> (commit <sha>)`, and its dashboard link names the Worker.
+            const latest = /^### Preview URL: (\S+) \(commit ([0-9a-f]{7,40})\)$/m.exec(comment.body);
+            const [, script, name] = new RegExp(`/workers/services/view/(${LABEL})/production/previews/(${LABEL})`).exec(comment.body) ?? [];
+            if (latest && script) {
+                const preview = head.sha.startsWith(latest[2]) ? workerPreview(script, undefined, latest[1], name) : undefined;
+                if (preview)
+                    found.push({ pullRequest: issue, ...(head.branch ? { branch: head.branch } : {}), sha: head.sha, ...preview, state: 'success', from: 'bot comment', at: when(comment.updated_at) || head.at });
+                continue;
+            }
             // The app edits its one comment as the pull request moves on: it describes the head when the commit it names is the head's.
             const commit = /Latest commit:<\/strong>[\s\S]{0,80}?<code>([0-9a-f]{7,40})<\/code>/.exec(comment.body)?.[1];
             if (!commit || !head.sha.startsWith(commit))
@@ -424,7 +459,8 @@ async function listCloudflareProjects(cf, accounts, signal) {
 }
 /**
  * Whether this repository's pull requests get Cloudflare Pages previews: the newest, as GitHub and cf have them;
- * with `pull`, that pull request's only; with `branch`, the pushed branch's head's only, before its pull request exists.
+ * with `pull`, that pull request's only; with `branch`, the pushed branch's head's only, before its pull request exists;
+ * with `pattern`, the one an earlier read's Worker preview stood for, a Worker Preview's build listed too.
  */
 export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     // cf is not asked here, so whether it is installed is unknown.
@@ -435,7 +471,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         return unread();
     const gh = deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal });
     const plain = deps.pull === undefined && deps.branch === undefined;
-    const github = await fromGitHub(owner, repo, gh, deps.pull, deps.branch);
+    const github = await fromGitHub(owner, repo, gh, deps.pull, deps.branch, deps.pattern);
     const config = await wranglerConfig(cwd);
     const readme = plain ? await readmeAddresses(cwd) : { pages: [] };
     // For one app's folder, an address or the root's config names no app's project: only the project's settings do.
@@ -458,6 +494,9 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     else if (app)
         github.previews = github.previews.filter((p) => pagesProject(p.url) === (cf.subdomain ? pagesProject(`https://${cf.subdomain}`) : cf.project));
     const project = cf.project ?? named;
+    // Where a Pages project builds the repository, its previews stay the method, and a Worker's beside it are left out.
+    if (project)
+        github.previews = github.previews.filter((p) => !p.pattern);
     // A Worker built from the repository: its check runs, the config or the README say so, and the check runs say how its newest build went.
     const script = github.worker?.script ?? (config?.kind === 'worker' ? config.name : undefined);
     const worker = github.worker || config?.kind === 'worker' || readme.workers
@@ -487,8 +526,10 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
     }
     // The most recently updated pull request's first; a branch with no pull request among them last, as cf lists it.
     previews.sort((a, b) => (b.pullRequest ? 1 : 0) - (a.pullRequest ? 1 : 0) || b.at - a.at);
+    // No Pages project, and a Worker's previews listed: the Worker's own address, on the subdomain they name, is the live app.
+    const live = previews.find((p) => p.pattern)?.pattern?.replace('{branch}-', '');
     return {
-        ...(project ? { project, production: `https://${cf.subdomain ?? `${project}.pages.dev`}` } : {}),
+        ...(project ? { project, production: `https://${cf.subdomain ?? `${project}.pages.dev`}` } : live ? { production: live } : {}),
         previews: previews.slice(0, deps.branch !== undefined ? previews.length : NEWEST).map(({ at, ...preview }) => preview),
         cli: cf.cli,
         ...(github.failed || cf.failed

package/dist/fence.js

@@ -918,6 +918,9 @@ function simpleCommand(seg, where, opts) {
                 return ghView(args.slice(2)) ? allow() : deny("gh pr view takes a pull request's number or this run's branch, --repo for this repository, --json and --comments");
             if (args[0] === 'pr' && args[1] === 'checks')
                 return ghView(args.slice(2), '--required') ? allow() : deny("gh pr checks takes a pull request's number or this run's branch, --repo for this repository, --json and --required");
+            // The repository's own pull requests, listed: the earlier ones whose previews are its host's evidence (REN-1108).
+            if (args[0] === 'pr' && args[1] === 'list')
+                return ghList(args.slice(2)) ? allow() : deny('gh pr list takes --repo for this repository, --state, --limit (100 at most) and --json');
             // The test drive opens as a draft where its preview needs the pull request first, and is marked ready once that preview is proven: the test drive's branch by name, nothing else.
             if (args[0] === 'pr' && args[1] === 'ready')
                 return ghReady(args.slice(2)) !== null ? allow() : deny('gh pr ready takes the test drive branch by name, and --repo');
@@ -1705,6 +1708,28 @@ function ghView(args, flag = '--comments') {
     const repository = seen.get('--repo');
     return repository === undefined ? {} : REPOSITORY.test(repository) ? { repository } : null;
 }
+/** `gh pr list [--repo <owner>/<name>] [--state open|closed|merged|all] [--limit <n>] [--json <fields>]`, each once and nothing else (no --web, no search): the repository named, or null. */
+function ghList(args) {
+    const seen = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const at = arg.startsWith('--') ? arg.indexOf('=') : -1;
+        const given = at < 0 ? arg : arg.slice(0, at);
+        const name = { '-R': '--repo', '-s': '--state', '-L': '--limit' }[given] ?? given;
+        if (!['--repo', '--state', '--limit', '--json'].includes(name) || seen.has(name))
+            return null;
+        const value = (at < 0 ? args[++i] : arg.slice(at + 1)) ?? '';
+        if (!value || value.startsWith('-'))
+            return null;
+        if (name === '--state' && !['open', 'closed', 'merged', 'all'].includes(value))
+            return null;
+        if (name === '--limit' && !(/^[1-9]\d{0,2}$/.test(value) && Number(value) <= 100))
+            return null;
+        seen.set(name, value);
+    }
+    const repository = seen.get('--repo');
+    return repository === undefined ? {} : REPOSITORY.test(repository) ? { repository } : null;
+}
 /** The branch of `push -u origin <branch>`, git's words from its command on, when `literal` takes it. */
 const pushBranch = (args, literal = setupBranch) => args.length === 4 && args[0] === 'push'
     && ['-u', '--set-upstream'].includes(args[1]) && args[2] === 'origin' && literal(args[3]) ? args[3] : undefined;
@@ -1835,8 +1860,8 @@ export function reservePreviewCommand(state, command, root, scratch) {
             if (!drives.get(parsed.branch)?.created)
                 return deny('mark ready the test drive this run opened');
         }
-        if (words[0] === 'gh' && words[1] === 'pr' && (words[2] === 'view' || words[2] === 'checks')) {
-            const parsed = ghView(words.slice(3), words[2] === 'checks' ? '--required' : '--comments');
+        if (words[0] === 'gh' && words[1] === 'pr' && (words[2] === 'view' || words[2] === 'checks' || words[2] === 'list')) {
+            const parsed = words[2] === 'list' ? ghList(words.slice(3)) : ghView(words.slice(3), words[2] === 'checks' ? '--required' : '--comments');
             if (!parsed)
                 return deny("view only this run's pull requests, by number or branch name");
             // Without --repo, gh picks a repository from the checkout's remotes, which may name another one.

package/dist/hosted.js

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { promisify } from 'node:util';
 import { ACCESS_ID_HEADER, ACCESS_SECRET_HEADER } from './cloudflare-access.js';
 import { gitEnvironment } from './sandbox.js';
@@ -94,15 +95,17 @@ const NETLIFY = new RegExp(`^(?=[^.]{1,63}\\.netlify\\.app$)deploy-preview-[1-9]
 const PAGES = new RegExp(`^${LABEL}\\.(${LABEL})\\.pages\\.dev$`);
 /** A Render pull request's preview: a site of its own, the service's name and the pull request's number, under onrender.com. */
 const RENDER = new RegExp(`^(${LABEL})-pr-([1-9]\\d{0,6})\\.onrender\\.com$`);
+/** A Worker's preview: one label (the version's id, or the branch's alias, joined to the Worker's name), then the account's subdomain, under workers.dev. */
+const WORKERS = new RegExp(`^${LABEL}\\.${LABEL}\\.workers\\.dev$`);
 /** A live app's own address on its host: a Vercel alias (one name under vercel.app, the shape its deployments have too), a Netlify site's netlify.app address (a deploy or branch subdomain carries `--`), a Pages project's pages.dev address, a Render service's onrender.com address (a pull request's preview ends in `-pr-<n>`). */
 const LIVE = { vercel: new RegExp(`^${LABEL}\\.vercel\\.app$`), netlify: new RegExp(`^(?!.*--)(${LABEL})\\.netlify\\.app$`), cloudflare: new RegExp(`^(${LABEL})\\.pages\\.dev$`), render: new RegExp(`^(?!.*-pr-[1-9]\\d{0,6}\\.)(${LABEL})\\.onrender\\.com$`) };
 /** https on one name, with no credentials, port, query or fragment. */
 const plainHttps = (url) => url.protocol === 'https:' && !url.username && !url.password && !url.port && !url.search && !url.hash;
-/** A deployment's own address: https on one name, and nothing else. Vercel's is one name under vercel.app, Netlify's a pull request's deploy preview, Cloudflare's a Pages preview, Render's a pull request's preview site. */
+/** A deployment's own address: https on one name, and nothing else. Vercel's is one name under vercel.app, Netlify's a pull request's deploy preview, Cloudflare's a Pages preview or a Worker's, Render's a pull request's preview site. */
 const hostOf = (url) => {
     if (!plainHttps(url))
         return null;
-    return LIVE.vercel.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : PAGES.test(url.hostname) ? 'cloudflare' : RENDER.test(url.hostname) ? 'render' : null;
+    return LIVE.vercel.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : PAGES.test(url.hostname) || WORKERS.test(url.hostname) ? 'cloudflare' : RENDER.test(url.hostname) ? 'render' : null;
 };
 /** The host a live app's address is on, by its domain, so its lock is known; `other` for any other https address, whose lock no key opens. */
 const liveHostOf = (url) => {
@@ -136,7 +139,7 @@ export function liveShaped(url) {
 /** The host a preview address belongs to, by name; null for an address of none. */
 export function previewHostName(url) {
     const host = URL.canParse(url) ? hostOf(new URL(url)) : null;
-    return host ? HOSTS[host].name : null;
+    return host === 'cloudflare' && WORKERS.test(new URL(url).hostname) ? 'Cloudflare Workers' : host ? HOSTS[host].name : null;
 }
 /** The Netlify site a deploy preview address, or the site's own netlify.app address, belongs to, by name; null for any other address. */
 export function netlifySiteOf(url) {
@@ -348,7 +351,7 @@ export async function provePreview(url, words, root, deps = {}) {
     const parsed = URL.canParse(url) ? new URL(url) : null;
     const host = !parsed ? null : !deps.live ? hostOf(parsed) : !plainHttps(parsed) ? null : typeof deps.live === 'string' ? deps.live : liveHostOf(parsed);
     if (!host)
-        return unproven(deps.live ? 'Only an https address with no query is opened.' : 'Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, or a Render preview, https://<site>-pr-<n>.onrender.com, with no query, is opened.');
+        return unproven(deps.live ? 'Only an https address with no query is opened.' : 'Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, a Worker\'s, https://<id or branch>-<worker>.<subdomain>.workers.dev, or a Render preview, https://<site>-pr-<n>.onrender.com, with no query, is opened.');
     // Another host's live address has a lock no key opens, so none is looked for: its login is another site, and its 401 the app's own sign-in.
     const { gate, login, lock } = host === 'other' ? { gate: undefined, login: /$^/, lock: 'the app' } : HOSTS[host];
     const phrase = words.trim();
@@ -372,9 +375,17 @@ export async function provePreview(url, words, root, deps = {}) {
     // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it.
     const still = opened ? ' even with the bypass secret' : withPassword ? ' even with the password' : withToken ? ' even with the service token' : '';
     let target = new URL(url);
+    // Render's edge keeps a page it served for five minutes (`s-maxage=300`), and after a deploy goes on serving the old one for a while (REN-1117): each request carries a query value of its own beside any a redirect gave, which the edge caches apart, so the proof reads the build Render serves now. A request's `Cache-Control: no-cache` the edge ignores.
+    const fresh = (at) => {
+        if (host !== 'render')
+            return at;
+        const asked = new URL(at);
+        asked.searchParams.set('impeccable', randomUUID());
+        return asked;
+    };
     try {
         for (let hop = 0; hop < 4; hop++) {
-            const res = await open(target, { redirect: 'manual', headers, credentials: 'omit', signal });
+            const res = await open(fresh(target), { redirect: 'manual', headers, credentials: 'omit', signal });
             if (res.status >= 300 && res.status < 400) {
                 await res.body?.cancel().catch(() => { });
                 const location = res.headers.get('location') ?? '';

package/dist/log.js

@@ -31,7 +31,8 @@ export function createLog(debug, dir = tmpdir()) {
     const secret = (value) => void secrets.add(value);
     if (!debug)
         return { secret, write: () => { } };
-    const path = join(dir, `impeccable-reviews-${new Date().toISOString().replace(/[:.]/g, '-')}.log`);
+    // The process id keeps two runs started in the same millisecond out of one file.
+    const path = join(dir, `impeccable-reviews-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}.log`);
     let tightened = false;
     return {
         path,

package/dist/playbook/cases/cloudflare-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias. Ask it only where the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` or `.workers.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and cf, Cloudflare's CLI, lists the project's deployments when it is signed in here. It applies as well where the checkout is set up for Cloudflare and no pull request got a preview: the answer then says why (`pullRequestPreviews`, `worker`, `githubApp`), and "No pull-request previews" below says what the run does about each cause, in that order, before any other preview is set up. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
+Cloudflare Pages deploys previews of the pull requests, or a Worker Cloudflare builds (Workers Builds) does where its branch builds make previews: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias (a Worker's, on workers.dev, with the `pattern` it stands for). Ask it only where the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` or `.workers.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and cf, Cloudflare's CLI, lists the project's deployments when it is signed in here. It applies as well where the checkout is set up for Cloudflare and no pull request got a preview: the answer then says why (`pullRequestPreviews`, `worker`, `githubApp`), and "No pull-request previews" below says what the run does about each cause, in that order, before any other preview is set up. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
 ### Steps
 
@@ -9,13 +9,13 @@ Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_pr
 
 ### Reference
 
-- **The live app**: `production` in the evidence is the project's own address, `https://<project>.pages.dev`; live-app-address says how it becomes the before, in step 2's write.
+- **The live app**: `production` in the evidence is the project's own address, `https://<project>.pages.dev`, or, with no Pages project and a Worker's previews listed, the Worker's own, `https://<worker>.<subdomain>.workers.dev`; live-app-address says how it becomes the before, in step 2's write. A workers.dev address the README names is not the before on its own: its shape cannot tell the Worker's own address from a preview's.
 - **Behind Cloudflare Access** (`gate: "cloudflare-access"`): Cloudflare's login stands in front of the previews. Get past it as preview-protection says, which proves the preview, and go on with step 2; when nothing got past it, that case says how the run ends.
 - **Another app, or no answer from any of the three**: Cloudflare's previews do not show this app. Set the preview up as server-previews says instead, and say under "What is not verified" what the Cloudflare address answered.
 - **No pull-request previews**: the checkout is set up for Cloudflare and nothing is listed, or a project's settings build none. The aim holds: find out why from the answer, in this order, and for each cause ask once with the tool that fixes it, before anything is pushed and never a second time; with a preview listed, after step 1's proof and preview-protection's steps, so the person sees the lock's question and this one back to back, at most one each. Each tool shows its one screen and does the change as the person, or opens the page where it cannot. After `enabled` or `connected`, nothing is listed yet, so the test drive's build is the first preview: take pull-requests' step 4 the Cloudflare way and save the method on its alias as step 2 says, no setup pull request.
   1. **Previews off** (`pullRequestPreviews` with `enabled: false` and `cause` `previews` or `deployments`, with its `reason`): cf, signed in, found the Pages project built from this repository, and its settings build no previews of pull requests. impeccable_enable_previews (`host: "cloudflare"`) turns the preview branch control on; deployments off altogether is the person's change, on the page it opens.
   2. **Not connected** (`cause: "source"`): the Pages project the checkout names (its wrangler config, or the README's pages.dev address) exists with no Git repository connected, so no push builds. impeccable_cloudflare_connect connects it to this repository.
-  3. **A Worker, not a Pages project** (`worker` in the answer, and no `pullRequestPreviews`): Cloudflare builds the repository as a Worker (Workers Builds: its check runs name the script, or the wrangler config or the README's workers.dev address does), which gives pull requests no preview, and a Worker with static assets no branch build at all. impeccable_cloudflare_connect, with the build command and output folder the checkout runs, creates a Pages project for the repository and connects it; the Worker stays as it is. The same tool creates the project where the config names a Pages project cf finds nowhere.
+  3. **A Worker, not a Pages project** (`worker` in the answer, no `pullRequestPreviews`, and no Worker preview listed): Cloudflare builds the repository as a Worker (Workers Builds: its check runs name the script, or the wrangler config or the README's workers.dev address does), whose branch builds made no preview on record, and a Worker with static assets no branch build at all. impeccable_cloudflare_connect, with the build command and output folder the checkout runs, creates a Pages project for the repository and connects it; the Worker stays as it is. The same tool creates the project where the config names a Pages project cf finds nowhere.
   4. **Cloudflare's GitHub app cannot see the repository** (`githubApp` in the answer: the app's installation covers selected repositories, or `installed: false`): a project connected with previews on still gets no build, since the app builds only the repositories its installation names. Nothing in the account shows it, so the wait for the test drive's build tells: when none comes, the wait's own screen opens the installation page (`githubApp.page`) and waits again on the person's yes. Its `reason` says when they skipped it or no build came after the retries.
 - **`skipped` or `refused` from any of these**: push no test drive on Cloudflare (pull-requests' "No preview, no test drive" where a preview was proven; else set the preview up as server-previews says, never without saying so) and say under "What was skipped, and why" which cause stopped it, with the `reason`, and name the `page` where there is one; the person was asked in this run, so `left` stays empty. `skipped`, or the GitHub app's access skipped on the wait's screen, with no method saved, is a no that ends the setup, as the playbook says: no other preview is set up.
 - **No `pullRequestPreviews`, no `worker`** (`cli` signed out or unknown, or no Pages project built from this repository among the accounts cf reaches): the check could not be made. Say so in one line under "What is not verified", naming why, and go on as the aim says: nothing listed, as "Nothing listed" says; a preview listed, as the steps say, where the wait for the test drive's build then tells.

package/dist/playbook/cases/live-app-address.md

@@ -4,7 +4,7 @@ Every run that saves a preview method, for the state's `before` item: the addres
 
 ### Steps
 
-1. **Find the address**: the `production` address a host tool answered (impeccable_netlify_previews, the Netlify site's own; impeccable_cloudflare_previews, the Pages project's, `https://<project>.pages.dev`; impeccable_render_previews, the Render site's, `https://<site>.onrender.com`; impeccable_hosted_previews, the linked Vercel project's own domain where GitHub records a production deployment of it; impeccable_vercel_connect's `productionUrl` where production exists), else the live-site line the item's `proposal` read in the README, checked against the file, when it is the site's or project's own address on one of the hosts (an address elsewhere is only the host tools' to name). A project or site created in this run has no live app yet. Done when you have one address, or know there is none.
+1. **Find the address**: the `production` address a host tool answered (impeccable_netlify_previews, the Netlify site's own; impeccable_cloudflare_previews, the Pages project's, `https://<project>.pages.dev`, or with no Pages project a Worker's own, `https://<worker>.<subdomain>.workers.dev`; impeccable_render_previews, the Render site's, `https://<site>.onrender.com`; impeccable_hosted_previews, the linked Vercel project's own domain where GitHub records a production deployment of it; impeccable_vercel_connect's `productionUrl` where production exists), else the live-site line the item's `proposal` read in the README, checked against the file, when it is the site's or project's own address on one of the hosts (an address elsewhere is only the host tools' to name). A project or site created in this run has no live app yet. Done when you have one address, or know there is none.
 2. **Prove it** with impeccable_prove_preview, under the status line *"Opening the live app"*: that address, or a page on it a visitor opens without signing in, and words the page shows that the checkout holds. A key the run already got in place (Vercel's bypass secret, Netlify's site password, Cloudflare's service token) goes with it where the lock is the same project's or site's. Done when it answers `proven: true`. **An address no key opens is not set**: a `gate`, the app's own sign-in on every page, or no answer leaves the item as it is, and the report says what the address answered.
 3. **Save it** with impeccable_write to `preview`: `beforeUrl` the proven address's root, `https://<host>` with no path, whatever page the proof opened (a login page is one role's, and the review signs in as another; impeccable_write saves the root either way), in the same write as the method where the proof came before it (`{"intendedMethod": "preview-deploy", "beforeUrl": "https://…"}`), else in a write of its own; `appKey` the app's on a repository of several apps, one address per app. Done when the answer carries `beforeUrl`; its `beforeCheck.access` says how Impeccable's own check opened it: `ok`; `auth-wall`, the app's sign-in, which the saved test accounts get past; anything else goes under "What is not verified".
 

package/dist/playbook/cases/pull-requests.md

@@ -5,11 +5,11 @@ Every run, once the settings are saved. The person merges the setup pull request
 ### Steps
 
 1. **The setup commit**, when the repository needs a change to keep previews working: the workflow and any fix the build needed, nothing else. With the workflow current on the default branch and no fix, there is none. Check access as workflow-as-person says, branch `impeccable/setup` from `origin/<defaultBranch>`, and bring in the workflow and commit as that case says. Push it in step 7, after the test drive. Done when that case's steps are done.
-2. **The test drive page**, always. The test drive shows the person a whole review: pages to capture, a finding for each measure, and a new page, which is what starts the review's visitor sessions. Branch `impeccable/test-drive` from the setup commit, so it carries the same workflow and its preview runs from its own head (from the default branch when there is no setup commit). Add one small, self-contained page in the repository's own framework, such as `/impeccable-test-drive`: a file where the routing finds pages, its styles in the page's own `<style>` element or imported the way the framework imports them, never a stylesheet linked by a relative path (a host may serve the page at its address without the trailing slash, where `./page.css` misses and the review sees it unstyled), with a heading, a paragraph and a few elements in the app's own words (so the review judges it as one of the app's pages), and the flaws below. Every word a visitor sees, the page's title, heading and copy and the link to it, reads as a plausible real page of the site, such as a short feature or about page in the product's voice: none says it is a test, a demo or a test drive, names Impeccable or a review, or calls its content placeholder or not real, since a visitor who reads that marks the page down. The flaws' comments stay in the code, never on the page. Link it from a page **a visitor opens without signing in**, the landing page when it is one, and keep the new page open without signing in too: no guard, on the server or in the browser, sends it to the sign-in. Done when the new page carries every flaw below with its comment, and the page you picked links to it.
+2. **The test drive page**, always. The test drive shows the person a whole review: pages to capture, a finding for each measure, and a new page, which is what starts the review's visitor sessions. Branch `impeccable/test-drive` from the setup commit, so it carries the same workflow and its preview runs from its own head (from the default branch when there is no setup commit). Add one small, self-contained page in the repository's own framework, such as `/impeccable-test-drive`: a file where the routing finds pages, its styles in the page's own `<style>` element or imported the way the framework imports them, never a stylesheet linked by a relative path (a host may serve the page at its address without the trailing slash, where `./page.css` misses and the review sees it unstyled), with a heading, a paragraph and a few elements in the app's own words (so the review judges it as one of the app's pages), and the flaws below. Every element holds real content, a table its rows, a card its figures, a list its items: no empty container and no note standing in for data, which the review marks down ahead of the flaws. Every word a visitor sees, the page's title, heading and copy and the link to it, reads as a plausible real page of the site, such as a short feature or about page in the product's voice: none says it is a test, a demo or a test drive, names Impeccable or a review, or calls its content placeholder or not real, since a visitor who reads that marks the page down. The flaws' comments stay in the code, never on the page. Link it from a page **a visitor opens without signing in**, the landing page when it is one, and keep the new page open without signing in too: no guard, on the server or in the browser, sends it to the sign-in. Done when the new page carries every flaw below with its comment, and the page you picked links to it.
 3. **Build the test drive branch here**, as the host's case says in place of this step (vercel-previews, netlify-previews, cloudflare-previews, render-previews), so a page that does not build is never pushed; its preview is proven on the host's own build in step 4. Done when the build passed.
 4. **Push the test drive and prove its preview**: a host whose evidence said `pullRequestPreviews.enabled: false` is asked first, once, as its case says (impeccable_enable_previews; skipped or refused, push nothing: "No preview, no test drive" below); on Vercel, impeccable_vercel_bypass with `beforePush: true` (and each app's `appKey`, one call per app) asks for the bypass secret first where Vercel's login will stand in front of the preview, as preview-protection's "Before the test drive's push" says (`skipped`, push nothing); then commit the new page **and** the page that links to it, each staged by name, `git push -u origin impeccable/test-drive`, then the way its preview comes:
    - **Vercel** (vercel-previews, vercel-setup) builds every push: impeccable_hosted_previews with `branch: "impeccable/test-drive"` waits up to five minutes for its deployment of the pushed head, under a status line with its timer. Prove the test drive's page on that address with impeccable_prove_preview (past Vercel's login as preview-protection says), and save the method as the case says. Then step 5.
-   - **Netlify** (netlify-previews, netlify-setup) and **Render** (render-previews) build a preview only for a pull request: open the test drive now as a **draft**, step 5's `gh pr create` with `--draft`, which Impeccable leaves unreviewed. impeccable_netlify_previews (on Render, impeccable_render_previews) with `pull` the number it printed waits up to five minutes for the deploy preview, under a status line with its timer. Prove the test drive's page on it, save the method as the case says, then `gh pr ready impeccable/test-drive --repo <owner>/<repo>` marks it ready, which starts the review. Then step 5's recording.
+   - **Netlify** (netlify-previews, netlify-setup) and **Render** (render-previews) build a preview only for a pull request: open the test drive now as a **draft**, step 5's `gh pr create` with `--draft`, which Impeccable leaves unreviewed. impeccable_netlify_previews (on Render, impeccable_render_previews) with `pull` the number it printed waits up to five minutes for the deploy preview, under a status line with its timer. Prove the test drive's page on it (on Render, a 404 is render-previews' to handle, never a guessed push), save the method as the case says, then `gh pr ready impeccable/test-drive --repo <owner>/<repo>` marks it ready, which starts the review. Then step 5's recording.
 
    A host's wait that ran out shows its own screen, which opens the host's page where its builds are turned on and waits again on the person's yes. Done when the test drive's page is proven on its preview, and a host's method saved; when nothing proved it, the reference below says how the run goes on.
 5. **Open the test drive and record it**: `gh pr create --repo <owner>/<repo> --head impeccable/test-drive --base <defaultBranch>` with the title "Impeccable test drive (safe to close)" and a body that starts "This pull request only shows Impeccable reviewing a change. Close it when you are done; nothing here needs to be merged." and then names the pages its diff holds, no more, and lists the flaws planted for the review to find, one line each (a Netlify draft opened this way in step 4, and was marked ready there). Record it right away with impeccable_test_pr, so the web page follows its review; it refuses a draft, and a branch that changes no existing page. Done when impeccable_test_pr answered "Recorded".

package/dist/playbook/cases/render-previews.md

@@ -15,6 +15,7 @@ Render deploys the app: impeccable_render_previews (with the app's `appKey` on a
 
 - **The live app**: `production` is the site's own address; live-app-address says how it becomes the before, in step 3's write.
 - **The pull requests**: no setup pull request; the test drive branches from the default branch. Render builds a preview only for a pull request, at once for a draft, so the test drive opens as a draft, impeccable_render_previews with `pull` waits for its preview, the test drive's page is proven on it, the method saved, and then the draft is marked ready: pull-requests' step 4. In place of pull-requests' step 3, build the test drive branch once with the build the service runs (`render.yaml`'s `buildCommand`, else the package's `build` script), so a page that does not build is never pushed.
+- **A 404 on the test drive's page**: Render reports the deploy before its edge serves it, so impeccable_prove_preview asks again itself, for up to 90 seconds. Never push a guessed change to the test drive (a link, an address, a route) to explain a 404, and never wait with a command. Where the proof still answers 404, the page is not in the preview's build: pull-requests' "No preview, no test drive".
 - `pullRequestPreviews` with `enabled: 'unknown'` (no answer from the CLI): say so in one line under "What is not verified" and go on; the wait for the test drive's preview opens Render's page when none comes.
 - The evidence is read only: change nothing on Render beyond what impeccable_render_previews does on the person's yes. Save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found", and the pattern saved under "What was configured, and by whom". The test drive's own preview, which Render builds after the run, goes under "What is not verified".

package/dist/playbook.js

@@ -33,7 +33,7 @@ Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's,
 
 1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\` and \`workflowStanding\`, whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
-3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the render-previews case says when impeccable_render_previews answers a Render site, as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
+3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare's (a Pages project's, or a Worker's), as the render-previews case says when impeccable_render_previews answers a Render site, as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
 4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.
@@ -82,7 +82,7 @@ The person reads your [STATUS] lines, task titles and questions, here and on the
 - **Questions**: one sentence, at most one hint line, and a title that names the subject.
 
 ## The report
-impeccable_report ends the run: no tool or model call works after it, so call it once, alone, last. Open the report with the pull requests, one line each with its link: the test drive (each app's, named, on a repository with several apps), which Impeccable is reviewing (its review had not posted when the run ended; the web page shows it) and which the person closes when done, or, when none opened, what stopped it in a few words; then the setup pull request, when there is one, which they merge to keep previews working, or, when a host builds the previews and the repository needed no change, this one line with the host's name: *Nothing to merge: Vercel hosts your previews, so the repository needed no change.* Then these sections:
+impeccable_report ends the run: no tool or model call works after it, so call it once, alone, last. Open the report with the pull requests, one line each with its link: the test drive (each app's, named, on a repository with several apps), which Impeccable is reviewing (its review had not posted when the run ended; the web page shows it) and which the person closes when done, or, when none opened, what stopped it in a few words; then the setup pull request, when there is one, which they merge to keep previews working, or, when a host builds the previews and the repository needed no change, this one line with the host's name: *Nothing to merge: Vercel hosts your previews, so the repository needed no change.* (on a repository with several apps, only when every chosen app is set up on a host's previews, naming each host). Where no preview method was saved for an app, the report says what stopped it and what the person can do, and never that a later pull request will be reviewed: nothing reviews it until a method is saved. impeccable_report's \`reason\` (on a repository with several apps, each such app's in \`apps\`) says that in one line, which the last screen shows. Then these sections:
 
 \`\`\`markdown
 ## What we found

package/dist/tools.js

@@ -28,6 +28,7 @@ import { openBrowser } from './login.js';
 import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
 import { askPerson, reportDone, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
 import { SEE_THE_REVIEW } from './ui/look.js';
+import { TaskOrder } from './ui/run-state.js';
 import { noteSensitiveAnswer, plainText } from './ui/sensitive.js';
 export { STATUS_MAX, statusVoiceError } from './sync.js';
 /** The first way `value` breaks `schema`, or null when it fits. */
@@ -129,6 +130,8 @@ export const SETUP_ENDS = {
 };
 /** How many times a preview check the setup API turned away for its rate (one a repository every 30 seconds) is tried again (#338). */
 const CHECK_RETRIES = 3;
+/** The setup API signs a repository's saved accounts in once a minute: a save sooner is stored but not tried (#249). */
+const SIGN_IN_CHECK_MS = 60_000;
 /** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
 export function appsSummary(apps) {
     const picked = apps.filter((a) => a.state !== 'unpicked');
@@ -161,10 +164,12 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
+    // The run's own words for why no method was saved, where it gave them (REN-1108).
+    const why = report.reason && !report.methodSaved ? ` Why: ${report.reason.replace(/[.\s]+$/, '')}.` : '';
     if (report.ended)
-        return SETUP_ENDS[report.ended].line;
+        return `${SETUP_ENDS[report.ended].line}${why}`;
     const lead = report.walled ? `Impeccable's own check of the preview met a wall (${report.walled}), so the test drive's review can't see its pages yet. The report, printed here when this screen closes, says what the run found.`
-        : !report.testPr ? `${report.unhonoured ?? noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+        : !report.testPr ? `${report.unhonoured ?? noTestDrive(report)}${why} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     // --signed-in-test-drive left an app without a test drive: said beside another app's drive or a wall too (#410).
     const said = report.unhonoured && (report.walled || report.testPr) ? `${lead} ${report.unhonoured}` : lead;
     return report.setupPr || !report.hostedBy ? said : `${said} ${nothingToMerge(report.hostedBy)}`;
@@ -198,7 +203,13 @@ export function ending(report) {
     return { outcome, title, todo, code: 1 };
 }
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
-export const nothingToMerge = (host) => `Nothing to merge: ${host} hosts your previews, so the repository needed no change.`;
+export const nothingToMerge = (host) => `Nothing to merge: ${host} ${host.includes(' and ') ? 'host' : 'hosts'} your previews, so the repository needed no change.`;
+/** The agent's words for why an app was not set up, kept only as plain words of at most 200 characters, with no address (a scheme, or a host with a path or query) and nothing shaped like a secret. */
+function plainReason(text) {
+    const plain = text.trim();
+    const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
+    return plain && plain.length <= 200 && plainText(plain) === plain && !address && !scan('output', plain).length ? plain : undefined;
+}
 /** Names as a reader lists them: "a", "a and b", "a, b and c". */
 const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
 /** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
@@ -220,7 +231,7 @@ export function signedInLine(saved, app) {
     const signed = accounts.filter((a) => a.outcome === 'signed-in' && typeof a.role === 'string').map(role);
     const not = accounts.filter((a) => a.outcome !== 'signed-in' && typeof a.role === 'string').map(role);
     if (!signed.length)
-        return undefined;
+        return not.length ? `${app ? `${app}: ` : ''}${andList(not)} did not sign in` : undefined;
     return `${app ? `${app}: signed` : 'Signed'} in as ${andList(signed)}${not.length ? `; ${andList(not)} did not` : ''}`;
 }
 /** The last screen's line for each host, in the order first met: "Cloudflare: Acme's Account · project crewline", "Netlify: team Acme · site crewline", "Vercel: team acme · project crewline" (#360). */
@@ -268,9 +279,10 @@ const REPORT = {
             description: `What waits on the person besides merging the setup pull request and closing the test drive: one line each, at most ${STATUS_MAX} characters, such as "Add the admin test account on the setup page". The terminal counts them. Leave it out when nothing does.`,
             items: { type: 'string', minLength: 1 },
         },
+        reason: { type: 'string', minLength: 1, description: 'On a repository of one app where no preview method was saved: why, in plain words of at most 200 characters, such as "Render\'s pull request previews are off, and the person skipped turning them on". The last screen shows it. Names only, never an address or a key.' },
         apps: {
             type: 'array',
-            description: 'On a repository with several apps: for each picked app whose preview was not proven or keyed, why, in plain words of at most 200 characters, such as "not checked: the person stopped after the first app". Names only, never an address or a key.',
+            description: 'On a repository with several apps: for each picked app whose preview was not proven or keyed, why, in plain words of at most 200 characters, such as "not checked: the person stopped after the first app". The last screen shows it on that app\'s line. Names only, never an address or a key.',
             items: { type: 'object', additionalProperties: false, required: ['appKey', 'reason'], properties: { appKey: { type: 'string', minLength: 1 }, reason: { type: 'string', minLength: 1 } } },
         },
     },
@@ -1632,6 +1644,8 @@ export function createTools(ctx) {
     const budget = () => ({ used: retry.used, pushReservations: retry.pushReservations, remaining: Math.max(0, 3 - retry.used), historyKnown: retry.historyKnown });
     const attemptTasks = () => attempts().map((a, i) => ({ id: `preview-attempt-${a.runId}-${a.attempt}`,
         title: `Preview job attempt ${i + 1}`, status: a.status === 'success' ? 'completed' : a.status === 'running' ? 'in_progress' : 'failed' }));
+    /** The task list's order, the terminal's and the web page's alike (REN-1119). */
+    const taskOrder = new TaskOrder();
     const withAttempts = (tasks) => [...tasks.filter((t) => !t.id.startsWith('preview-attempt-')), ...attemptTasks()];
     async function observe(signal) {
         const pr = retry.pr;
@@ -1663,6 +1677,8 @@ export function createTools(ctx) {
     /** The origins of Production deployments Vercel made of a pushed branch that no locked project of this folder's made: served at a project's own address without a login, so no proof opens them. */
     const publicProduction = new Set();
     const cloudflareListed = new Set();
+    /** The address pattern of each Worker preview's origin Cloudflare's evidence listed, which the address alone cannot tell (#265), and of the Worker's own address it answered as production, the token scope they share: kept past a later read, for the last screen. */
+    const workerPatterns = new Map();
     /** The origins of the successful Render previews impeccable_render_previews listed, of the app's own site. */
     const renderListed = new Set();
     let hostedPreviewProven = false;
@@ -1705,6 +1721,9 @@ export function createTools(ctx) {
         const label = pagesProject(origin);
         if (label)
             return [{ host: 'Cloudflare', project: label, ...(accountOf.has(`cloudflare ${label}`) ? { account: accountOf.get(`cloudflare ${label}`) } : {}) }];
+        const worker = /^https:\/\/\{branch\}-([^.]+)\./.exec(workerPatterns.get(origin) ?? '')?.[1];
+        if (worker)
+            return [{ host: 'Cloudflare', project: worker }];
         const site = netlifySiteOf(url);
         if (site)
             return [{ host: 'Netlify', project: site, ...(accountOf.has(`netlify ${site}`) ? { account: accountOf.get(`netlify ${site}`) } : {}) }];
@@ -2371,8 +2390,22 @@ export function createTools(ctx) {
         return proof;
     };
     /** A proof opened the app's preview at `url`, so its method may be saved. */
+    /** On a repository with several apps, a Preview method task done while a picked app has no method saved names whose it is, so its tick does not read as every app's (REN-1108). */
+    const labelled = (tasks) => {
+        if (!appsRepo)
+            return tasks;
+        const saved = [...(pickedApps ?? [])].filter((key) => appMethods.has(key));
+        const some = saved.length > 0 && saved.length < pickedApps.size;
+        // A label of an earlier list goes once every picked app has its method.
+        return tasks.map((t) => (t.status !== 'completed' || !stagesOf(t.title).includes('Preview method') ? t : { ...t, title: some ? `Preview method: ${andList(saved.map(appName))} only` : t.title.replace(/^Preview method: .* only$/, 'Preview method') }));
+    };
+    /** On a repository with several apps, the host whose preview a proof opened for each app: the last screen names them all, or none where an app is not set up (REN-1108). */
+    const appHosts = new Map();
     const proveApp = (key, url) => {
         provenApps.add(key);
+        const host = previewHostName(url);
+        if (host)
+            appHosts.set(key, host);
         noteApp(key, { preview_proven: true, preview_host: new URL(url).hostname });
     };
     /** Each app's folder, by key, as the state names it: what its host project or site must build. */
@@ -2671,7 +2704,7 @@ export function createTools(ctx) {
             }
             if (recordedChanges)
                 previews.changes.clear();
-            const tasks = withAttempts(ctx.sync.payload.tasks);
+            const tasks = taskOrder.sort(withAttempts(ctx.sync.payload.tasks));
             ctx.sync.update({ tasks });
             reportTasks(tasks);
             return JSON.stringify({ ...observation, attempts: attempts(), budget: budget() });
@@ -2699,7 +2732,7 @@ export function createTools(ctx) {
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPatterns.get(appsRepo ? String(saved.appKey) : ''))) {
-                return `Refused: the only address pattern saved is the one impeccable_prove_preview answered for ${appsRepo ? `this app's (${String(saved.appKey)})` : 'a'} Netlify, Cloudflare Pages or Render preview. Nothing was saved.`;
+                return `Refused: the only address pattern saved is the one impeccable_prove_preview answered for ${appsRepo ? `this app's (${String(saved.appKey)})` : 'a'} Netlify, Cloudflare or Render preview. Nothing was saved.`;
             }
             // The before is the live app's address, and only one a proof opened with this app: an address no key opens is not set, and one the person saved is never cleared from here.
             if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
@@ -2734,14 +2767,48 @@ export function createTools(ctx) {
             let response = await call(pi, target.url, { method: target.method, body });
             // The setup API checks a repository's preview once per 30 seconds, whichever app asks: the next app's check waits its turn here, a bounded wait in place of the sleep the fence refuses (#338).
             const check = /\/(connection-check|latest-pull-check)$/.test(target.url);
+            const pause = ctx.checkWait ?? ((ms, stop) => sleep(ms, undefined, { signal: stop }));
             for (let tries = 0; check && response.status === 429 && tries < CHECK_RETRIES && !signal?.aborted; tries++) {
                 const seconds = Math.min(Math.max(Math.ceil(response.retryAfter ?? 30), 1), 60);
                 said(`Waiting ${seconds} s for the next preview check`);
-                await (ctx.checkWait ?? ((ms, stop) => sleep(ms, undefined, { signal: stop })))(seconds * 1000, signal).catch(() => undefined);
+                await pause(seconds * 1000, signal).catch(() => undefined);
                 if (signal?.aborted)
                     break;
                 response = await call(pi, target.url, { method: target.method, body });
             }
+            // A password the save's sign-in turned away is asked for once more, on the same account screen, and the list saved again once the setup API can sign in again (#249).
+            const tried = object(object(response.data)?.signInCheck)?.accounts;
+            const turnedAway = new Set(testAccounts && response.ok && Array.isArray(tried) ? tried.filter((a) => object(a)?.outcome === 'wrong-credentials').map((a) => String(object(a)?.role)) : []);
+            if (turnedAway.size) {
+                const checkedAt = Date.now();
+                let retyped = false;
+                for (const account of object(body)?.accounts) {
+                    const role = String(account.role ?? 'default');
+                    if (!turnedAway.has(role))
+                        continue;
+                    const answer = await ask({ id: `${role}-account`, kind: 'account', title: role === 'default' ? 'Test account' : `${role.charAt(0).toUpperCase()}${role.slice(1)} account`, prompt: `Add the ${role === 'default' ? '' : `${role} `}test account.`, hint: `That password did not sign in${typeof account.loginPage === 'string' ? ` at ${account.loginPage}` : ''}. Type it again, or skip.`, prefill: String(account.username ?? '') });
+                    // A stop closes the screen: no other account is asked for, and nothing is saved again.
+                    if (answer.closed || signal?.aborted) {
+                        retyped = false;
+                        break;
+                    }
+                    if (answer.skipped)
+                        continue;
+                    // Kept with what the person typed, so the answer never carries it back to the model.
+                    typed.set(`secret:${randomBytes(6).toString('hex')}`, answer.password ?? '');
+                    Object.assign(account, { username: answer.username, password: answer.password });
+                    retyped = true;
+                }
+                const wait = SIGN_IN_CHECK_MS - (Date.now() - checkedAt);
+                if (retyped && wait > 0) {
+                    said(`Waiting ${Math.ceil(wait / 1000)} s for the next sign-in check`);
+                    await pause(wait, signal).catch(() => undefined);
+                }
+                // A second save that fails leaves the first one's answer: those accounts are saved.
+                const again = retyped && !signal?.aborted ? await call(pi, target.url, { method: target.method, body }) : undefined;
+                if (again?.ok)
+                    response = again;
+            }
             if (testAccounts && response.ok)
                 retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
             // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
@@ -2888,7 +2955,6 @@ export function createTools(ctx) {
         }),
         tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, a status line about another task than the one in progress, a task once completed that is no longer, Preview method completed before a method is saved, and a Preview workflow or Setup pull request task once a host\'s previews are the method.', PROGRESS, async (p) => {
             const status = p.status.trim();
-            const tasks = withAttempts(p.tasks);
             const own = p.tasks.filter((t) => !t.id.startsWith('preview-attempt-'));
             const voice = statusVoiceError(status) ?? stageError(status, own);
             if (voice)
@@ -2903,6 +2969,8 @@ export function createTools(ctx) {
             const unneeded = hostMethod && !perApp && !ctx.sync.payload.setup_pr ? own.filter((t) => /\bsetup pull request\b/i.test(t.title) || stagesOf(t.title).includes('Preview workflow')) : [];
             if (unneeded.length)
                 return `Refused: ${savedHost ?? 'the host'} builds this run's previews, so the repository needs no workflow and no setup pull request. Leave ${unneeded.map((t) => `"${t.title}"`).join(' and ')} off the list: a task the run never does is not shown, not even as skipped. Nothing was saved: call impeccable_progress again.`;
+            // Ordered only once taken, so a refused list leaves the order as it was.
+            const tasks = taskOrder.sort(labelled(withAttempts(p.tasks)));
             ctx.sync.update({ phase: 'running', status, tasks });
             reportStatus(status);
             reportTasks(tasks);
@@ -3052,13 +3120,24 @@ export function createTools(ctx) {
                 if (a.ended)
                     noteApp(a.key, { reason: `The setup ended for it: the person said no to ${SETUP_ENDS[a.ended].said}.` });
             for (const { appKey, reason } of p.apps ?? []) {
-                const plain = reason.trim();
-                const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
-                if (plain.length <= 200 && plainText(plain) === plain && !address && !scan('output', plain).length)
-                    noteApp(appKey, { reason: plain });
+                const plain = plainReason(reason);
+                if (!plain)
+                    continue;
+                noteApp(appKey, { reason: plain });
+                // The last screen says why on the app's own line, rather than sending the person to the report (REN-1108).
+                const app = apps?.find((a) => a.key === appKey && a.state === 'unset' && !a.ended);
+                if (app)
+                    app.left = `${app.name}: ${plain.replace(/[.\s]+$/, '')}.`;
             }
+            const reason = !appsRepo && typeof p.reason === 'string' ? plainReason(p.reason) : undefined;
+            // The hosts build every preview only where every picked app is set up with a host's previews: on a repository where one app is not, no host speaks for it (REN-1108).
+            const hostsOf = picked?.every((a) => a.state === 'ready' && appMethods.get(a.key) === 'preview-deploy' && appHosts.has(a.key)) ? [...new Set(picked.map((a) => appHosts.get(a.key)))] : [];
+            const hostedBy = apps ? (hostsOf.length ? andList(hostsOf) : undefined) : savedHost;
             // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
-            ctx.sync.update({ phase: 'completed', status: ended ? SETUP_ENDS[ended].title : 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
+            // The list as the run left the apps: a Preview method done for some apps only says whose (REN-1108).
+            const tasks = taskOrder.sort(labelled(ctx.sync.payload.tasks));
+            reportTasks(tasks);
+            ctx.sync.update({ tasks, phase: 'completed', status: ended ? SETUP_ENDS[ended].title : 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, ...(several ? { test_prs: Object.fromEntries(kept) } : {}), left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
@@ -3073,7 +3152,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(unhonoured ? { unhonoured } : {}), ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}), ...(ended ? { ended } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, ...(several ? { testPrs: kept.map(([key, pr]) => ({ appKey: key, name: appName(key), ...pr })) } : {}), setupPr: ctx.sync.payload.setup_pr, ...(unhonoured ? { unhonoured } : {}), ...(hostedBy ? { hostedBy } : {}), ...(reason ? { reason } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}), ...(ended ? { ended } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -3234,7 +3313,7 @@ export function createTools(ctx) {
                 noteApp(appKey, { host_project: site });
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds); where its branch builds make previews, they are listed too, on workers.dev (the alias https://<branch>-<worker>.<subdomain>.workers.dev, with the pattern it stands for), and with no Pages project production is the Worker's own address; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -3252,7 +3331,9 @@ export function createTools(ctx) {
                 return `Refused: read impeccable_cloudflare_previews with appKey ${appKey} and no pull or branch first: it tells which Pages project builds that app.`;
             // The name of the account the project was found in is for the last screen alone.
             let accountName;
-            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
+            // A Worker Preview's build names no address: its alias is made from the pattern the plain read's Worker preview stood for.
+            const pattern = cloudflareEvidence?.previews.find((preview) => preview.pattern)?.pattern;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}), ...(pattern ? { pattern } : {}) });
             const read = async () => {
                 const evidence = await readAll();
                 return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
@@ -3265,7 +3346,7 @@ export function createTools(ctx) {
             // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
             const app = cloudflareEvidence?.githubApp;
             const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false, ...(typeof p.appKey === 'string' ? { app: p.appKey } : {}) } : undefined;
-            let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            let waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare ${pattern ? 'Workers' : 'Pages'} to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
             // cf not on this machine (#396): its install is asked before anything installs it, and the evidence read again with it.
             if (!subject && waited.cli === 'missing') {
                 await installCf(pi, signal);
@@ -3292,10 +3373,16 @@ export function createTools(ctx) {
                     continue;
                 for (const address of [preview.url, ...(preview.alias ? [preview.alias] : [])]) {
                     cloudflareListed.add(new URL(address).origin);
+                    if (preview.pattern)
+                        workerPatterns.set(new URL(address).origin, preview.pattern);
                     if (appKey !== undefined)
                         listedApps.set(new URL(address).origin, { appKey });
                 }
             }
+            // The Worker's own address, the live app with no Pages project, is in its previews' scope: Access's token goes there as it goes to a Pages project's own address.
+            const workerPattern = evidence.previews.find((preview) => preview.pattern)?.pattern;
+            if (workerPattern && !evidence.project && evidence.production)
+                workerPatterns.set(new URL(evidence.production).origin, workerPattern);
             if (evidence.pullRequestPreviews)
                 previewFacts.set('cloudflare', evidence.pullRequestPreviews);
             const named = evidence.pullRequestPreviews?.project || evidence.project;
@@ -3304,7 +3391,7 @@ export function createTools(ctx) {
             noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, a Pages build that succeeded, or a Render preview), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify, Cloudflare Pages and Render it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, a Pages build that succeeded, or a Render preview), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify, Cloudflare (Pages, or a Worker\'s previews) and Render it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
             const origin = URL.canParse(url) ? new URL(url).origin : null;
             if (origin && publicProduction.has(origin))
@@ -3317,16 +3404,31 @@ export function createTools(ctx) {
                 return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
             // The Netlify site, by the address's shape or, for the site's custom domain, as its tool named it: its password goes to the site's own addresses.
             const site = netlifySiteOf(url) ?? known?.site;
-            // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
-            const project = pagesProject(origin);
+            // A saved service token opens its Pages project's previews, or its Worker's: Access admits it wherever the application's policy covers.
+            const project = pagesProject(origin) ?? workerPatterns.get(origin);
             const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
-            const proof = await provePreview(url, p.expect, pi.cwd, {
+            const prove = () => provePreview(url, p.expect, pi.cwd, {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
                 ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
                 ...(site && sitePasswords.has(site) ? { password: sitePasswords.get(site).value } : {}),
                 ...(token ? { access: token } : {}),
             });
+            let proved = await prove();
+            // Render reports a preview's deploy successful before its edge serves that build (REN-1117): a page the push added answers 404 for a while, so it is asked for again here, within a bounded wait, the way a command's sleep would but the fence refuses.
+            if (!live && renderListed.has(origin) && proved.status === 404) {
+                const wait = ctx.hostWait?.serve ?? { totalMs: 90_000, everyMs: 5_000 };
+                said('Waiting for Render to serve the new page');
+                for (const end = Date.now() + wait.totalMs; proved.status === 404 && Date.now() < end && !signal?.aborted;) {
+                    await sleep(wait.everyMs, undefined, { signal }).catch(() => undefined);
+                    if (!signal?.aborted)
+                        proved = await prove();
+                }
+                if (proved.status === 404 && !signal?.aborted)
+                    proved = { ...proved, reason: `The address still answered 404 ${Math.round(wait.totalMs / 1000)} s after Render reported the preview built: the page is not in the preview's build.` };
+            }
+            // A Worker's preview proven answers the pattern its evidence listed.
+            const proof = proved.proven && !live && workerPatterns.has(origin) ? { ...proved, pattern: workerPatterns.get(origin) } : proved;
             // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
             if (live) {
                 if (proof.proven)
@@ -4012,7 +4114,7 @@ export function createTools(ctx) {
                 return null;
             };
             let answer;
-            const project = pagesProject(new URL(at.url).origin);
+            const project = pagesProject(new URL(at.url).origin) ?? workerPatterns.get(new URL(at.url).origin);
             // The token in hand goes only to a project it opened already, as the proofs send it: any other address is read for an application of the person's first.
             if (accessToken && project && accessProjects.has(project) && (await prove(accessToken)).proven) {
                 // The token in hand opens this address too: stored already, or stored now.
@@ -4065,14 +4167,14 @@ export function createTools(ctx) {
                 if (project)
                     accessProjects.add(project);
             }
-            const pattern = told.status === 'saved' ? proof?.pattern : undefined;
+            const pattern = told.status === 'saved' ? (proof?.pattern ?? workerPatterns.get(new URL(at.url).origin)) : undefined;
             accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };
             // The person's no to the service token leaves the previews behind Cloudflare Access: the setup ends there for the app (#413).
             if (told.status === 'skipped')
                 decline('no-access', at.app?.appKey);
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
-                provenHost = 'Cloudflare Pages';
+                provenHost = previewHostName(at.url) ?? 'Cloudflare Pages';
                 usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);

package/dist/ui/run-state.js

@@ -3,6 +3,22 @@ import { statusLine } from '../sync.js';
 export function statusFromEvent(event) {
     return event.type === 'message_end' ? statusLine(event.message) : null;
 }
+/**
+ * The order a task list reads in, in the terminal and on the web page alike (REN-1119): the tasks that left pending
+ * (skipped too), in the order they first did, then those still waiting, each group in the order given. A task that
+ * waits under the task in progress (Preview method while Test drive runs) never shows above it unticked (#419).
+ */
+export class TaskOrder {
+    moved = new Set();
+    sort(tasks) {
+        for (const t of tasks)
+            if (t.status !== 'pending')
+                this.moved.add(t.id);
+        const order = [...this.moved];
+        const rank = (t) => (this.moved.has(t.id) ? order.indexOf(t.id) : order.length);
+        return tasks.map((t, i) => ({ t, i })).sort((a, b) => rank(a.t) - rank(b.t) || a.i - b.i).map(({ t }) => t);
+    }
+}
 /** After this long with nothing new on screen, the status band says the run is still working. */
 const SILENCE_MS = 60_000;
 /** How long something has taken, the way the screen says it: "45 s", "2 min", "1 h 5 min". */
@@ -30,8 +46,8 @@ export class RunState {
     waiting;
     /** The tasks that have been in progress, done or failed in this run. */
     started = new Set();
-    /** The tasks that have left pending in this run (skipped too), in the order they first did: the list shows them in that order. */
-    moved = new Set();
+    /** The order the list shows the tasks in. */
+    order = new TaskOrder();
     /** When something last changed on screen: a status, the task list, an answered question. */
     changedAt;
     constructor(now = Date.now, first) {
@@ -68,15 +84,9 @@ export class RunState {
         for (const t of tasks)
             if (t.status === 'in_progress' || t.status === 'completed' || t.status === 'failed')
                 this.started.add(t.id);
-        for (const t of tasks)
-            if (t.status !== 'pending')
-                this.moved.add(t.id);
         // A task that has started never reads as not started again (#390).
         const shown = tasks.map((t) => ({ ...t, ...(t.status === 'pending' && this.started.has(t.id) ? { started: true } : {}) }));
-        // The tasks that moved on, in the order they did, then those still waiting: one that waits under the task in progress never shows above it unticked (#419).
-        const order = [...this.moved];
-        const rank = (t) => (this.moved.has(t.id) ? order.indexOf(t.id) : order.length);
-        this.tasks = shown.map((t, i) => ({ t, i })).sort((a, b) => rank(a.t) - rank(b.t) || a.i - b.i).map(({ t }) => t);
+        this.tasks = this.order.sort(shown);
         this.touch();
     }
     /** Something happened that the person saw, so the silence starts again. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,