@impeccable/reviews 0.1.29 → 0.1.31

package/dist/cloudflare.js

@@ -66,6 +66,42 @@ function workerPreview(script, url, alias, name) {
 }
 /** What a check run's conclusion, or the words the app's table says, tell of the build. */
 const stateOf = (value) => (typeof value !== 'string' ? 'building' : /succe/i.test(value) ? 'success' : /fail|timed_out|error/i.test(value) ? 'failure' : /cancel/i.test(value) ? 'canceled' : 'building');
+/** When GitHub says a record last changed, as a number to sort by; 0 where it does not say. */
+const when = (value) => (typeof value === 'string' && Number.isFinite(Date.parse(value)) ? Date.parse(value) : 0);
+/**
+ * GitHub's record, read from the setup state's hosting record (hosting.ts) instead of GitHub: Cloudflare's check runs
+ * and its bot's comments as Impeccable's copy holds them, a Workers Builds check's Worker among them; null where the
+ * record lists none for the app and is not `read` (hosting.ts `hostingRead`), so GitHub is read here.
+ */
+export function cloudflareFromHosting(app, read = false) {
+    const previews = [];
+    const heads = [];
+    let worker;
+    for (const p of app.previews) {
+        if (p.source !== 'check-run' && p.source !== 'comment')
+            continue;
+        const from = p.source === 'check-run' ? 'check run' : 'bot comment';
+        const state = p.state === 'ready' || p.state === 'success' ? 'success' : p.state === 'failed' || p.state === 'failure' ? 'failure' : p.state === 'canceled' ? 'canceled' : 'building';
+        const at = when(p.at);
+        const head = { ...(p.pull !== null ? { pullRequest: p.pull } : {}), sha: p.sha };
+        if (p.site && (p.alias ?? p.url)?.endsWith('.workers.dev')) {
+            // A Worker's: the record's Worker and alias stand for the pattern, as a check run's summary does.
+            if (!worker || at > worker.at)
+                worker = { script: p.site, build: state, at };
+            const preview = workerPreview(p.site, p.url ?? undefined, p.alias ?? p.url ?? undefined);
+            if (preview)
+                previews.push({ ...head, ...preview, state, from, at });
+        }
+        else if (p.url && PAGES_ADDRESS.test(p.url)) {
+            previews.push({ ...head, url: p.url, ...(p.alias && PAGES_ADDRESS.test(p.alias) ? { alias: p.alias } : {}), state, from, at });
+        }
+        else
+            continue;
+        if (!heads.some((h) => h.sha === p.sha))
+            heads.push({ ...(p.pull !== null ? { number: p.pull } : {}), sha: p.sha, at });
+    }
+    return previews.length || read ? { previews, heads, failed: false, ...(worker ? { worker: { script: worker.script, build: worker.build } } : {}) } : null;
+}
 /**
  * GitHub's record: the Cloudflare check run on each head (or, with `only`, that pull request's; with `branch`, the
  * pushed branch's head alone, before its pull request exists), and the app's comment on each pull request when it
@@ -77,7 +113,6 @@ async function fromGitHub(owner, repo, gh, only, branch, pattern) {
     const get = async (route) => JSON.parse(await gh(['api', '--hostname', 'github.com', '--method', 'GET', route]));
     let failed = false;
     const read = async (what, none) => what.catch(() => ((failed = true), none));
-    const when = (value) => (typeof value === 'string' && Number.isFinite(Date.parse(value)) ? Date.parse(value) : 0);
     const heads = [];
     if (branch !== undefined) {
         const ref = record(await read(get(`${base}/branches/${encodeURIComponent(branch)}`), null));
@@ -471,7 +506,7 @@ export async function readCloudflarePreviews(owner, repo, cwd, deps = {}) {
         return unread();
     const gh = deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal });
     const plain = deps.pull === undefined && deps.branch === undefined;
-    const github = await fromGitHub(owner, repo, gh, deps.pull, deps.branch, deps.pattern);
+    const github = deps.github && plain ? { ...deps.github, previews: [...deps.github.previews] } : await fromGitHub(owner, repo, gh, deps.pull, deps.branch, deps.pattern);
     const config = await wranglerConfig(cwd);
     const readme = plain ? await readmeAddresses(cwd) : { pages: [] };
     // For one app's folder, an address or the root's config names no app's project: only the project's settings do.

package/dist/hosted.js

@@ -136,6 +136,13 @@ export function liveShaped(url) {
         return LIVE.render.test(parsed.hostname);
     return false;
 }
+/** The host a live app's address is on, where the address is a live app's on one of them (`liveShaped`); null otherwise. */
+export function liveHost(url) {
+    if (!liveShaped(url))
+        return null;
+    const host = liveHostOf(new URL(url));
+    return host === 'other' ? null : host;
+}
 /** The host a preview address belongs to, by name; null for an address of none. */
 export function previewHostName(url) {
     const host = URL.canParse(url) ? hostOf(new URL(url)) : null;

package/dist/hosting.js

@@ -0,0 +1,92 @@
+import { liveHost, renderSiteOf } from './hosted.js';
+import { parseRenderDeployment } from './render.js';
+const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+const text = (value) => (typeof value === 'string' && value.length > 0 && value.length <= 300 ? value : null);
+/** An https address, as the record's origin and path, with no slash after it; null for anything else. */
+const address = (value) => {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/.test(value) || !URL.canParse(value))
+        return null;
+    const url = new URL(value);
+    return `${url.origin}${url.pathname}`.replace(/\/$/, '');
+};
+const SOURCES = new Set(['deployment', 'commit-status', 'check-run', 'comment']);
+/** The record the state carries for `repo`, as far as it is well formed; null where the state has none (an older setup API). */
+export function hostingOf(state, repo) {
+    const repos = record(state)?.repos;
+    const own = Array.isArray(repos) ? repos.map(record).find((r) => r?.name === repo) : undefined;
+    const hosting = record(record(record(own?.items)?.preview)?.hosting);
+    if (!hosting || !Array.isArray(hosting.apps))
+        return null;
+    const apps = hosting.apps.map(record).flatMap((a) => {
+        const key = text(a?.key);
+        if (!a || !key)
+            return [];
+        const previews = (Array.isArray(a.previews) ? a.previews : []).map(record).flatMap((p) => {
+            const sha = typeof p?.sha === 'string' && /^[0-9a-f]{40}$/.test(p.sha) ? p.sha : null;
+            const source = typeof p?.source === 'string' && SOURCES.has(p.source) ? p.source : null;
+            if (!p || !sha || !source)
+                return [];
+            const pull = typeof p.pull === 'number' && Number.isSafeInteger(p.pull) && p.pull > 0 ? p.pull : null;
+            const pullState = p.pullState === 'open' || p.pullState === 'closed' ? p.pullState : null;
+            return [{ pull, sha, url: address(p.url), alias: address(p.alias), state: text(p.state), at: text(p.at), source, environment: text(p.environment), site: text(p.site), pullState }];
+        });
+        return [{ key, liveUrl: address(a.liveUrl), previews }];
+    });
+    const unread = Array.isArray(hosting.unread) ? hosting.unread.flatMap((u) => text(u) ?? []) : [];
+    return { apps, readAt: text(hosting.readAt), unread };
+}
+/** The reports each host's previews are read from, besides the deployments every read takes. */
+const REPORTS = { netlify: ['statuses', 'comments'], cloudflare: ['check-runs', 'comments'], render: [] };
+/**
+ * Whether the record is the whole of GitHub's record of the host's earlier previews, an empty list included: Impeccable
+ * read the repository's copy (`readAt`), and took every report the host's previews are read from. Else a host tool
+ * reads GitHub itself where the record lists none.
+ */
+export function hostingRead(hosting, host) {
+    if (!hosting?.readAt)
+        return false;
+    return !REPORTS[host].some((report) => hosting.unread.includes(report));
+}
+/** The pull requests whose previews the app's record lists as closed: on Render, evidence of the site and the pattern, never a preview to prove. */
+export const closedPulls = (app) => new Set(app?.previews.flatMap((p) => (p.pullState === 'closed' && p.pull !== null ? [p.pull] : [])) ?? []);
+/** The record's entry for an app: the one named, or, on a repository of one app, its only one. */
+export function hostingApp(hosting, appKey) {
+    if (!hosting)
+        return undefined;
+    return appKey !== undefined ? hosting.apps.find((a) => a.key === appKey) : hosting.apps.length === 1 ? hosting.apps[0] : undefined;
+}
+const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
+/** A Worker's own address on workers.dev, or a preview's alias: one label joined to the Worker's name, then the account's subdomain. The shape tells them apart no better than the record's previews do. */
+const WORKERS_ADDRESS = /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.workers\.dev$/;
+/**
+ * The host the record's live address is on, where the proof may open it as the live app: by its domain (hosted.ts
+ * `liveHost`), or a Worker's own address on workers.dev where none of the record's previews is at that address, since
+ * a preview's alias has the same shape; null for an address elsewhere, or none.
+ */
+export function liveHostOf(app) {
+    if (!app.liveUrl)
+        return null;
+    const host = liveHost(app.liveUrl);
+    if (host)
+        return host;
+    return WORKERS_ADDRESS.test(app.liveUrl) && !app.previews.some((p) => p.url === app.liveUrl || p.alias === app.liveUrl) ? 'cloudflare' : null;
+}
+/** The deployments GitHub recorded for the app, in the shape impeccable_hosted_previews reads, for Render's read (Vercel's keeps GitHub's own read, which covers more than the record: production deployments, older pull requests): so none is Vercel's here. */
+export function deploymentsOf(app) {
+    return app.previews.filter((p) => p.source === 'deployment').map((p) => ({
+        sha: p.sha,
+        environment: p.environment,
+        state: STATES.find((s) => s === p.state) ?? null,
+        url: p.url,
+        vercel: false,
+        pullRequests: p.pull !== null ? [p.pull] : [],
+    }));
+}
+/** The Render sites the record names for the app: its deployments' (environment and address naming the same site, as parseRenderDeployment checks) and its live address's. */
+export function renderSitesOf(app) {
+    const sites = deploymentsOf(app).flatMap((d) => parseRenderDeployment(d.environment, d.url)?.site ?? []);
+    const live = app.liveUrl ? renderSiteOf(app.liveUrl) : null;
+    if (live && live.pull === undefined)
+        sites.push(live.site);
+    return [...new Set(sites)];
+}

package/dist/log.js

@@ -26,6 +26,30 @@ export function redact(text, secrets = []) {
 export function scrub(text, secrets = [], field) {
     return redactShapes(redact(text, secrets), field);
 }
+/** Flags whose next argument is a value of no interest to the log: gh's host, cf's profile. */
+const VALUED = new Set(['--hostname', '--profile']);
+/**
+ * A host CLI's call as one debug-log line, for counting the reads a run made: the command, its subcommand words, gh
+ * api's method and an API route without its query. It stops at the first argument that is none of those, so no flag's
+ * value (a `--data` body, a password, a token) is ever written.
+ */
+export function commandLine(name, args) {
+    const parts = [name];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--method' && /^[A-Z]{3,7}$/.test(args[i + 1] ?? ''))
+            parts.push(args[++i]);
+        else if (VALUED.has(arg))
+            i++;
+        else if (/^[A-Za-z][A-Za-z:-]{0,39}$/.test(arg))
+            parts.push(arg);
+        else if (/^\/[\w./%~-]*(?:\?.*)?$/.test(arg))
+            parts.push(arg.split('?')[0]);
+        else
+            break;
+    }
+    return parts.join(' ');
+}
 export function createLog(debug, dir = tmpdir()) {
     const secrets = new Set();
     const secret = (value) => void secrets.add(value);

package/dist/main.js

@@ -7,6 +7,7 @@ import { runAgent } from './agent.js';
 import { runSkillCommand } from './skill.js';
 import { fenceExtension, guardedFileOperations, hostsAgreed, placeOf, previewRetryState } from './fence.js';
 import { accountsSaved, focusInstructions, focusState, severalApps, signInItem } from './focus.js';
+import { hostingOf } from './hosting.js';
 import { requestJson } from './http.js';
 import { copyText, letTabsHear, openBrowser, progressPage, screenPrompt, setupAuth, signIn } from './login.js';
 import { checkoutJournal } from './leftovers.js';
@@ -394,6 +395,7 @@ export async function main(argv) {
                 sandbox,
                 pushAccess: push.outcome,
                 severalApps: severalApps(state.data),
+                hosting: hostingOf(state.data, token.repository.name),
                 ...(flags.app ? { app: flags.app } : {}),
                 start: checkout.start,
                 ...(flags.signedInTestDrive ? { signedInTestDrive: { accountsSaved: accountsSaved(state.data, token.repository.name) } } : {}),

package/dist/netlify.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { promisify } from 'node:util';
 import { folderOf, netlifyPreviewsFact, pickPreviewsFact } from './host-previews.js';
+import { netlifySiteOf } from './hosted.js';
 import { gitEnvironment } from './sandbox.js';
 /**
  * Netlify: the deploy previews this repository's pull requests get (from
@@ -123,6 +124,25 @@ async function fromGitHub(owner, repo, gh, only) {
     }
     return { previews: found, heads: new Map(heads.map((head) => [head.number, head.sha])), failed };
 }
+/** What GitHub records, read from the setup state's hosting record (hosting.ts) instead of GitHub: Netlify's commit statuses and its bot's comments as Impeccable's copy holds them; null where the record lists none for the app and is not `read` (hosting.ts `hostingRead`), so GitHub is read here. */
+export function netlifyFromHosting(app, read = false) {
+    const previews = [];
+    const heads = new Map();
+    // A commit status names the head and carries the build's state; a comment proves nothing of the current build, so it stands only where no status says (as from GitHub's record).
+    const ranked = [...app.previews.filter((p) => p.source === 'commit-status'), ...app.previews.filter((p) => p.source === 'comment')];
+    for (const p of ranked) {
+        if (p.pull === null || !p.site || !p.url || netlifySiteOf(p.url) !== p.site)
+            continue;
+        heads.set(p.pull, p.sha);
+        // The address is built from the pull request and the site, as from GitHub's record: never the record's own.
+        const url = previewAddress(p.pull, p.site);
+        if (!url || previews.some((q) => q.pullRequest === p.pull && q.site === p.site))
+            continue;
+        // A bot's comment posts once the preview is ready, as from GitHub's record; a status carries its own state.
+        previews.push(p.source === 'comment' ? { pullRequest: p.pull, site: p.site, url, state: 'ready', from: 'bot comment', at: when(p.at) } : { pullRequest: p.pull, site: p.site, url, state: STATES.find((s) => s === p.state) ?? null, from: 'commit status', at: when(p.at) });
+    }
+    return previews.length || read ? { previews, heads, failed: false } : null;
+}
 /** A page of the person's site list, and how many pages are read at most: what `netlify sites:list` reads. */
 const SITES_PER_PAGE = 100;
 const SITE_PAGES = 10;
@@ -198,7 +218,7 @@ export async function readNetlifyPreviews(owner, repo, cwd, deps = {}) {
     if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
         return { sites: [], previews: [], cli: 'missing', error: "Netlify's previews could not be read." };
     }
-    const [read, cli] = await Promise.all([fromGitHub(owner, repo, deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal }), deps.pull), fromCli(owner, repo, deps.netlify ?? commandRunner('netlify', cwd, { signal: deps.signal }), deps.pull, deps.directory)]);
+    const [read, cli] = await Promise.all([deps.github && deps.pull === undefined ? deps.github : fromGitHub(owner, repo, deps.gh ?? commandRunner('gh', cwd, { signal: deps.signal }), deps.pull), fromCli(owner, repo, deps.netlify ?? commandRunner('netlify', cwd, { signal: deps.signal }), deps.pull, deps.directory)]);
     // For one app's folder, GitHub's record counts only for the site the CLI read as building it: a site's name says nothing of its folder.
     const where = deps.directory ? `the folder ${deps.directory}` : "the repository's root";
     const unmatched = deps.directory === undefined ? undefined

package/dist/playbook/cases/cloudflare-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Cloudflare Pages deploys previews of the pull requests, or a Worker Cloudflare builds (Workers Builds) does where its branch builds make previews: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias (a Worker's, on workers.dev, with the `pattern` it stands for). Ask it only where the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` or `.workers.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and cf, Cloudflare's CLI, lists the project's deployments when it is signed in here. It applies as well where the checkout is set up for Cloudflare and no pull request got a preview: the answer then says why (`pullRequestPreviews`, `worker`, `githubApp`), and "No pull-request previews" below says what the run does about each cause, in that order, before any other preview is set up. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
+Cloudflare Pages deploys previews of the pull requests, or a Worker Cloudflare builds (Workers Builds) does where its branch builds make previews: impeccable_cloudflare_previews lists a built preview of a pull request (`state` success), with its address and the branch's alias (a Worker's, on workers.dev, with the `pattern` it stands for). Ask it only where the state's `hosting` names Cloudflare for the app, or the repository is set up for Cloudflare (`wrangler.toml`, `wrangler.json` or `wrangler.jsonc`, a `wrangler` or `@cloudflare/*` package, a `.pages.dev` or `.workers.dev` address in the README or the workflows), but its record decides, not the checkout: Cloudflare's GitHub app posts a check run on each commit it built and a comment on the pull request, and cf, Cloudflare's CLI, lists the project's deployments when it is signed in here. It applies as well where the checkout is set up for Cloudflare and no pull request got a preview: the answer then says why (`pullRequestPreviews`, `worker`, `githubApp`), and "No pull-request previews" below says what the run does about each cause, in that order, before any other preview is set up. Cloudflare builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
 ### Steps
 

package/dist/playbook/cases/live-app-address.md

@@ -4,7 +4,7 @@ Every run that saves a preview method, for the state's `before` item: the addres
 
 ### Steps
 
-1. **Find the address**: the `production` address a host tool answered (impeccable_netlify_previews, the Netlify site's own; impeccable_cloudflare_previews, the Pages project's, `https://<project>.pages.dev`, or with no Pages project a Worker's own, `https://<worker>.<subdomain>.workers.dev`; impeccable_render_previews, the Render site's, `https://<site>.onrender.com`; impeccable_hosted_previews, the linked Vercel project's own domain where GitHub records a production deployment of it; impeccable_vercel_connect's `productionUrl` where production exists), else the live-site line the item's `proposal` read in the README, checked against the file, when it is the site's or project's own address on one of the hosts (an address elsewhere is only the host tools' to name). A project or site created in this run has no live app yet. Done when you have one address, or know there is none.
+1. **Find the address**: the `production` address a host tool answered (impeccable_netlify_previews, the Netlify site's own; impeccable_cloudflare_previews, the Pages project's, `https://<project>.pages.dev`, or with no Pages project a Worker's own, `https://<worker>.<subdomain>.workers.dev`; impeccable_render_previews, the Render site's, `https://<site>.onrender.com`; impeccable_hosted_previews, the linked Vercel project's own domain where GitHub records a production deployment of it; impeccable_vercel_connect's `productionUrl` where production exists), else the `liveUrl` the state's `hosting` names for the app (the saved before, or the address Impeccable read in the repository), else the live-site line the item's `proposal` read in the README, checked against the file, when it is the site's or project's own address on one of the hosts (an address elsewhere is only the host tools' to name). A project or site created in this run has no live app yet. Done when you have one address, or know there is none.
 2. **Prove it** with impeccable_prove_preview, under the status line *"Opening the live app"*: that address, or a page on it a visitor opens without signing in, and words the page shows that the checkout holds. A key the run already got in place (Vercel's bypass secret, Netlify's site password, Cloudflare's service token) goes with it where the lock is the same project's or site's. Done when it answers `proven: true`. **An address no key opens is not set**: a `gate`, the app's own sign-in on every page, or no answer leaves the item as it is, and the report says what the address answered.
 3. **Save it** with impeccable_write to `preview`: `beforeUrl` the proven address's root, `https://<host>` with no path, whatever page the proof opened (a login page is one role's, and the review signs in as another; impeccable_write saves the root either way), in the same write as the method where the proof came before it (`{"intendedMethod": "preview-deploy", "beforeUrl": "https://…"}`), else in a write of its own; `appKey` the app's on a repository of several apps, one address per app. Done when the answer carries `beforeUrl`; its `beforeCheck.access` says how Impeccable's own check opened it: `ok`; `auth-wall`, the app's sign-in, which the saved test accounts get past; anything else goes under "What is not verified".
 

package/dist/playbook/cases/netlify-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Netlify deploys previews of the pull requests: impeccable_netlify_previews lists a built preview of a pull request (`state` success or ready), with its address. Ask it only where the repository is set up for Netlify (`netlify.toml`, `.netlify/`, `netlify-cli` or an `@netlify/*` package), but its record decides, not the checkout. Netlify builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
+Netlify deploys previews of the pull requests: impeccable_netlify_previews lists a built preview of a pull request (`state` success or ready), with its address. Ask it only where the state's `hosting` names Netlify for the app, or the repository is set up for Netlify (`netlify.toml`, `.netlify/`, `netlify-cli` or an `@netlify/*` package), but its record decides, not the checkout. Netlify builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
 It applies as well **before the first pull request**: a site built from this repository has Deploy Previews on (impeccable_netlify_previews lists none, and its `pullRequestPreviews` says `enabled: true`; on a repository with several apps, read with the app's `appKey`), so its deploy previews start with the test drive's draft, the site's first. Then there is nothing to prove in step 1 yet: impeccable_ask with `netlify-setup` is refused, since there is no sign-in, site or connection to make. Run impeccable_netlify_connect (with the app's `appKey`) first: it changes nothing on that site, and checks that Netlify's GitHub app still reads the repository, asking the person once for its access on GitHub when it does not (a connection left undone ends as netlify-setup's "A step fails before the test drive is pushed" says). Then go on to pull-requests' step 4, which opens the test drive as a draft, waits for its deploy preview (impeccable_netlify_previews with `pull`), proves the test drive's page there, past Netlify's lock as preview-protection says, and then step 2 saves the method.
 

package/dist/playbook/cases/render-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Render deploys the app: impeccable_render_previews (with the app's `appKey` on a repository with several apps) answers a `site`. Read it wherever the checkout names an `onrender.com` address or a `render.yaml`, impeccable_hosted_previews lists a deployment at an `onrender.com` address, or no other host's tool showed this app, before server-previews. Render builds and serves every preview, a site of its own for each pull request (`https://<site>-pr-<n>.onrender.com`), so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request. The tool finds the site from the render CLI, Render's deployments on GitHub and the checkout's files, and shows the person its one screen itself: **the person never types an address**, and impeccable_ask refuses a question asking for one.
+Render deploys the app: impeccable_render_previews (with the app's `appKey` on a repository with several apps) answers a `site`. Read it wherever the state's `hosting` names Render for the app, the checkout names an `onrender.com` address or a `render.yaml`, impeccable_hosted_previews lists a deployment at an `onrender.com` address, or no other host's tool showed this app, before server-previews. Render builds and serves every preview, a site of its own for each pull request (`https://<site>-pr-<n>.onrender.com`), so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request. The tool finds the site from the render CLI, the state's `hosting`, Render's deployments on GitHub and the checkout's files, and shows the person its one screen itself: **the person never types an address**, and impeccable_ask refuses a question asking for one.
 
 ### Steps
 
@@ -8,7 +8,7 @@ Render deploys the app: impeccable_render_previews (with the app's `appKey` on a
    - **`confirmed: false`**: the person skipped the Render screen, a no that ends the setup for the app, as the playbook says.
    - **`turnedOn`** says how turning the service's previews on ended, where the CLI said they were off and the screen was the consent: `enabled`, go on; `skipped` or `refused`, push no test drive (pull-requests' "No preview, no test drive"), and say under "What was skipped, and why" that Render's pull request previews are off for the site, with the `reason`, and name the `page`; `left` stays empty, since the person was asked in this run.
    - **No `site`**: Render's previews do not show this app. Go on as server-previews says, with `unread` under "What is not verified" where the CLI did not answer.
-2. **Prove the newest preview** with impeccable_prove_preview: the address of the newest listed preview whose state is `success` (or a page on it a visitor opens without signing in), and words the page shows that the checkout holds. Done when it answers `proven: true`; when an address no longer answers (Render takes a closed pull request's preview down), try the next newest, three at most. With none listed, or none that answers, the test drive's own preview is the proof: go on to pull-requests' step 4.
+2. **Prove the newest preview** with impeccable_prove_preview: the address of the newest listed preview whose state is `success` (or a page on it a visitor opens without signing in), and words the page shows that the checkout holds; a closed pull request's preview, `pullState: "closed"`, names the site and the pattern only, and counts as none listed, since Render takes it down. Done when it answers `proven: true`; when an address no longer answers, try the next newest, three at most. With none listed, or none that answers, the test drive's own preview is the proof: go on to pull-requests' step 4.
 3. **Save the method** with impeccable_write to `preview`: `{"previewUrlPattern": "<the proof's pattern>", "intendedMethod": "preview-deploy"}`, with the app's `appKey` in a monorepo, since each app's site has a pattern of its own. Done when the answer's `keys` show both stored or unchanged.
 
 ### Reference

package/dist/playbook/cases/vercel-previews.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-Vercel deploys previews of the pull requests: impeccable_hosted_previews lists a successful Preview deployment that Vercel made (`vercel: true`) of a pull request, with its address. The checkout often shows it too (`vercel.json`, `.vercel/project.json`, a `vercel` dependency), but GitHub's record decides. Vercel builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
+Vercel deploys previews of the pull requests: impeccable_hosted_previews lists a successful Preview deployment that Vercel made (`vercel: true`) of a pull request, with its address. The state's `hosting` naming Vercel for the app, and the checkout (`vercel.json`, `.vercel/project.json`, a `vercel` dependency), say to read it; GitHub's record decides. Vercel builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
 It applies as well **before the first pull request**: Vercel deploys the repository already (impeccable_hosted_previews lists deployments Vercel made, production ones or of pushes, and none of a pull request; on a repository with several apps, those of the project that builds the app, named in `project`), so its previews start with the test drive's push. Then there is nothing to prove in step 1 yet: impeccable_ask with `vercel-setup` is refused, since there is no sign-in, project or connection to make; go on to pull-requests' step 4, which asks for Vercel's bypass secret where the project's previews are protected, pushes the test drive, waits for Vercel's deployment of the pushed branch (impeccable_hosted_previews with `branch`, and the app's `appKey`), proves the test drive's page there, past Vercel's login as preview-protection says, and then step 2 saves the method.
 

package/dist/playbook.js

@@ -31,9 +31,9 @@ Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's,
 
 # Steps
 
-1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\` and \`workflowStanding\`, whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
+1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\`, \`workflowStanding\` and \`hosting\` (each app's host, live address and the previews GitHub recorded, as Impeccable already holds them: a start, which the host tools take and the proofs still prove; absent from an older setup API), whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
-3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare's (a Pages project's, or a Worker's), as the render-previews case says when impeccable_render_previews answers a Render site, as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
+3. **Set up the preview**, starting with the host \`hosting\` names for the app (its case and its tool first; GitHub's record decides, so a named host whose tool lists nothing sends you on to the next): as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare's (a Pages project's, or a Worker's), as the render-previews case says when impeccable_render_previews answers a Render site, as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
 4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.

package/dist/tools.js

@@ -13,15 +13,16 @@ import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps }
 import { APPS_QUESTION, cliInstallScreen, cliManualScreen, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifyPasswordReplace, renderConfirm, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, renderSiteOf, vercelDeploymentOf } from './hosted.js';
+import { closedPulls, deploymentsOf, hostingApp, hostingRead, liveHostOf, renderSitesOf } from './hosting.js';
 import { enableRenderPreviews, parseRenderDeployment, readRenderService, RENDER_DASHBOARD, renderSitesNamed } from './render.js';
-import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
+import { cloudflareFromHosting, cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
-import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
+import { netlifyFromHosting, commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { netlifyToken, passNetlifyLock, setSitePassword } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf, workStarted } from './stages.js';
-import { redact } from './log.js';
+import { commandLine, redact } from './log.js';
 import { scan } from './scan.js';
 import { gitEnvironment, installEnvironment, ownFolder } from './sandbox.js';
 import { openBrowser } from './login.js';
@@ -1625,6 +1626,24 @@ export function createWorkflowSynchronizer(opts = {}) {
 }
 export function createTools(ctx) {
     const text = (t, terminate = false) => ({ content: [{ type: 'text', text: t }], details: undefined, ...(terminate ? { terminate } : {}) });
+    /** A host CLI (gh, render, netlify, cf, vercel, npm) as the host tools run it: each call one line in the debug log, its command and route alone (log.ts `commandLine`), so a run's reads can be counted. */
+    const hostRunner = (name, cwd, opts) => {
+        // Made on its first call: a reader handed one it never calls runs nothing.
+        let run;
+        return async (args) => {
+            const line = `host call: ${commandLine(name, args)}`;
+            try {
+                run ??= (ctx.hostRunner ?? commandRunner)(name, cwd, opts);
+                const out = await run(args);
+                ctx.log.write(line);
+                return out;
+            }
+            catch (err) {
+                ctx.log.write(`${line} (failed)`);
+                throw err;
+            }
+        };
+    };
     const retry = previewRetryState(ctx.log);
     retry.repository ??= `${ctx.owner}/${ctx.repo}`;
     // Once the list is up: the agent's first call sets it, with the reading in progress.
@@ -1681,6 +1700,8 @@ export function createTools(ctx) {
     const workerPatterns = new Map();
     /** The origins of the successful Render previews impeccable_render_previews listed, of the app's own site. */
     const renderListed = new Set();
+    /** Of those, the ones built in this run, which its wait with `pull` listed: the only ones whose 404 is asked for again, since Render may not serve their build yet. */
+    const renderBuilt = new Set();
     let hostedPreviewProven = false;
     /**
      * The address pattern each proof answered, by the app it was proven for, and the last one under '' for a repository
@@ -1981,7 +2002,7 @@ export function createTools(ctx) {
             liveApps.set(new URL(production).origin, appKey);
     };
     const hostCli = (host, pi, signal) => {
-        const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
+        const runner = (browser = false) => hostRunner(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
         const cli = runner();
         if (host === 'vercel') {
             return {
@@ -2081,7 +2102,7 @@ export function createTools(ctx) {
     /** The run's own install of a host CLI's package, for installHostCli: npm's pinned global install, from the command's own folder and npm cache, as the agent's install of one runs; whether it completed. */
     const npmInstall = (pkg, signal) => async () => {
         try {
-            await (ctx.hostRunner ?? commandRunner)('npm', ownFolder(), { signal, timeoutMs: 600_000, env: installEnvironment() })(hostCliInstallArgs(pkg));
+            await hostRunner('npm', ownFolder(), { signal, timeoutMs: 600_000, env: installEnvironment() })(hostCliInstallArgs(pkg));
             return true;
         }
         catch {
@@ -2089,7 +2110,7 @@ export function createTools(ctx) {
         }
     };
     /** cf, Cloudflare's CLI, which only the tools run: where it is missing here, its install is asked first (#396). */
-    const cfPresent = async (pi, signal) => (await cfStatus(cfRunner({ checkout: pi.cwd }, ctx.hostRunner), signal)).cli !== 'missing';
+    const cfPresent = async (pi, signal) => (await cfStatus(cfRunner({ checkout: pi.cwd }, hostRunner), signal)).cli !== 'missing';
     const installCf = (pi, signal) => installHostCli('cloudflare', () => cfPresent(pi, signal), npmInstall('cf', signal), signal);
     /**
      * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: the setup screen once, worded for a CLI signed in
@@ -2193,8 +2214,8 @@ export function createTools(ctx) {
         // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI. A site built from this repository with Deploy Previews on needs no setup (#311): the connection changes nothing on it, and only checks that Netlify's GitHub app still reads the repository, asking for its access when it does not.
         if (!hostSetupAgreed(ctx.log, 'netlify') && !previewing)
             return { connected: false, reason: 'The Netlify sign-in comes first: impeccable_ask with the id netlify-setup.' };
-        const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
-        const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
+        const netlify = hostRunner('netlify', pi.cwd, { signal });
+        const gh = hostRunner('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
         const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}), ...(directory !== undefined ? { directory } : {}), ...(previewing ? { ownSite: true } : {}) });
         netlifySite = result.site?.name ?? netlifySite;
@@ -2220,7 +2241,7 @@ export function createTools(ctx) {
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
-        const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+        const vercel = hostRunner('vercel', pi.cwd, { signal });
         const link = await readLink(pi.cwd);
         if (!link)
             return { connected: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
@@ -2454,6 +2475,14 @@ export function createTools(ctx) {
     };
     /** An app's folder, read from the state the first time it is asked for. */
     const appFolder = async (pi, key) => (appFolders.has(key) ? appFolders.get(key) : (await stateApps(pi), appFolders.get(key)));
+    /** The setup state's record of an app's hosting (hosting.ts), as the state read at the start carried it; none from an older setup API, and every host tool then reads GitHub itself. */
+    const hostingFor = (appKey) => hostingApp(ctx.hosting, appKey);
+    // The live address the record names is a candidate for the before, proven as a host tool's production address is, on the host its domain says.
+    for (const a of ctx.hosting?.apps ?? []) {
+        const host = liveHostOf(a);
+        if (host)
+            noteProduction(a.liveUrl, host, undefined, appsRepo ? a.key : undefined);
+    }
     /**
      * On a repository with several apps, why a step for `appKey` may not run yet: the apps question comes first, and only
      * a picked app is set up. Null where it may: one app, or a picked one.
@@ -3170,7 +3199,7 @@ export function createTools(ctx) {
             const vercel = (args) => {
                 const key = JSON.stringify(args);
                 if (!reads.has(key))
-                    reads.set(key, (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal })(args));
+                    reads.set(key, hostRunner('vercel', pi.cwd, { signal })(args));
                 return reads.get(key);
             };
             for (const origin of listedPreviews)
@@ -3183,7 +3212,7 @@ export function createTools(ctx) {
             const app = appKey !== undefined ? await vercelApp(pi, appKey, vercel) : undefined;
             if (app && 'reason' in app)
                 return JSON.stringify({ appKey, deployments: [], unmatched: app.reason });
-            const raw = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
+            const raw = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch, runGh: hostRunner('gh', pi.cwd, { signal }) });
             // Vercel names each project's deployments on GitHub "Preview – <project>"; one without a name is told by the project's own record of it.
             const owned = async (d) => {
                 if (!app)
@@ -3264,7 +3293,7 @@ export function createTools(ctx) {
                 noteApp(appKey, { host_project: app.name });
             return JSON.stringify({ ...(appKey !== undefined ? { appKey, project: app.name } : {}), ...evidence, ...(production ? { production } : {}) });
         }),
-        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request (from the setup state's hosting record where it lists them or carries readAt, else read from GitHub here), or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
@@ -3276,7 +3305,10 @@ export function createTools(ctx) {
                 return JSON.stringify({ appKey, sites: [], previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
             // Each site's team is for the last screen alone.
             const onTeams = (teams) => Object.entries(teams).forEach(([name, team]) => accountOf.set(`netlify ${name}`, team));
-            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, onTeams, ...(directory !== undefined ? { directory } : {}) });
+            // GitHub's record as the setup state holds it, where it lists Netlify's previews of this app, or none on a record Impeccable read; a wait on a pull request reads GitHub, since its preview is newer than the record.
+            const known = pull === undefined ? hostingFor(appKey) : undefined;
+            const github = known ? netlifyFromHosting(known, hostingRead(ctx.hosting, 'netlify')) : null;
+            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, onTeams, gh: hostRunner('gh', pi.cwd, { signal }), netlify: hostRunner('netlify', pi.cwd, { signal }), ...(directory !== undefined ? { directory } : {}), ...(github ? { github } : {}) });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
@@ -3313,7 +3345,7 @@ export function createTools(ctx) {
                 noteApp(appKey, { host_project: site });
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds); where its branch builds make previews, they are listed too, on workers.dev (the alias https://<branch>-<worker>.<subdomain>.workers.dev, with the pattern it stands for), and with no Pages project production is the Worker's own address; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts (from the setup state's hosting record where it lists them or carries readAt, else read from GitHub here), or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in; where cf is not installed here, the person is asked to install it first, on its own screen). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds); where its branch builds make previews, they are listed too, on workers.dev (the alias https://<branch>-<worker>.<subdomain>.workers.dev, with the pattern it stands for), and with no Pages project production is the Worker's own address; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -3333,7 +3365,10 @@ export function createTools(ctx) {
             let accountName;
             // A Worker Preview's build names no address: its alias is made from the pattern the plain read's Worker preview stood for.
             const pattern = cloudflareEvidence?.previews.find((preview) => preview.pattern)?.pattern;
-            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}), ...(pattern ? { pattern } : {}) });
+            // GitHub's record as the setup state holds it, where it lists Cloudflare's previews of this app, or none on a record Impeccable read; a wait on a pull request or a pushed branch reads GitHub, since its build is newer than the record.
+            const known = pull === undefined && branch === undefined ? hostingFor(appKey) : undefined;
+            const github = known ? cloudflareFromHosting(known, hostingRead(ctx.hosting, 'cloudflare')) : null;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, gh: hostRunner('gh', pi.cwd, { signal }), run: hostRunner, onAccountName: (name) => (accountName = name), ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}), ...(pattern ? { pattern } : {}), ...(github ? { github } : {}) });
             const read = async () => {
                 const evidence = await readAll();
                 return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
@@ -3391,7 +3426,7 @@ export function createTools(ctx) {
             noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, a Pages build that succeeded, or a Render preview), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify, Cloudflare (Pages, or a Worker\'s previews) and Render it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, a Pages build that succeeded, or a Render preview), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify, Cloudflare (Pages, or a Worker\'s previews) and Render it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered, the one the setup state\'s hosting record names for the app (liveUrl) or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
             const origin = URL.canParse(url) ? new URL(url).origin : null;
             if (origin && publicProduction.has(origin))
@@ -3401,7 +3436,7 @@ export function createTools(ctx) {
             const known = origin !== null ? productionListed.get(origin) : undefined;
             const live = origin !== null && !listed && (known !== undefined || (liveShaped(url) && (await checkoutNames(pi.cwd, origin))));
             if (!origin || (!listed && !live))
-                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
+                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews, impeccable_cloudflare_previews or impeccable_render_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, the one the setup state's hosting record names for the app, or the site's or project's own address on one of the hosts that a file of this checkout names.";
             // The Netlify site, by the address's shape or, for the site's custom domain, as its tool named it: its password goes to the site's own addresses.
             const site = netlifySiteOf(url) ?? known?.site;
             // A saved service token opens its Pages project's previews, or its Worker's: Access admits it wherever the application's policy covers.
@@ -3415,8 +3450,8 @@ export function createTools(ctx) {
                 ...(token ? { access: token } : {}),
             });
             let proved = await prove();
-            // Render reports a preview's deploy successful before its edge serves that build (REN-1117): a page the push added answers 404 for a while, so it is asked for again here, within a bounded wait, the way a command's sleep would but the fence refuses.
-            if (!live && renderListed.has(origin) && proved.status === 404) {
+            // Render reports a preview's deploy successful before its edge serves that build (REN-1117): a page the push added answers 404 for a while, so it is asked for again here, within a bounded wait, the way a command's sleep would but the fence refuses. Only a build of this run's: an earlier preview's 404 is a preview Render took down.
+            if (!live && renderListed.has(origin) && renderBuilt.has(origin) && proved.status === 404) {
                 const wait = ctx.hostWait?.serve ?? { totalMs: 90_000, everyMs: 5_000 };
                 said('Waiting for Render to serve the new page');
                 for (const end = Date.now() + wait.totalMs; proved.status === 404 && Date.now() < end && !signal?.aborted;) {
@@ -3481,7 +3516,7 @@ export function createTools(ctx) {
                 return JSON.stringify({ ...proof, appKey: app.appKey });
             return JSON.stringify(proof);
         }),
-        tool('impeccable_render_previews', 'Render previews', "Read whether Render builds this repository's pull requests, on a repository with several apps for the app's own folder (appKey): the Render site, from the render CLI signed in on this machine (the service built from this repository, in the app's folder by its Root Directory), else the one site Render's deployments on GitHub and the checkout's files name (on a repository with several apps, a file in the app's own folder, or a line of the root README naming that app and no other); its previews as GitHub records them, each with its pull request, its address and its state (a closed pull request's address too, read from its earlier successful status, though Render took that preview down); production, the site's own address, for the before; pattern, the address every pull request's preview has; and pullRequestPreviews (enabled false, with the cause, where the service's previews are off or manual; 'unknown' without the CLI's answer). cli says whether the render CLI answered (signed-in), is missing, could not list the services (unread, with the reason), or lists none of this repository's (none). Once a site is found, it shows the person one screen naming Render, with the site's address to click, asked once for each app: confirmed true, or false when the person skipped it, which is a no that ends the setup for that app. Where the CLI says the previews are off, that screen is also the consent to turning them on, and on the yes the CLI turns them on and reads them back, with a retry screen on Render's page where it could not: turnedOn in the answer says how that ended (enabled, by run or person; skipped; refused, with the reason and the page). With pull (a pull request of this run, a draft included: Render builds the preview as soon as a pull request opens), only that pull request's preview of the site the plain read found, waiting up to five minutes for it to finish building, under a status line with its timer, and again on the person's yes when the time ran out. Never asks for an address.", RENDER_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_render_previews', 'Render previews', "Read whether Render builds this repository's pull requests, on a repository with several apps for the app's own folder (appKey): the Render site, from the render CLI signed in on this machine (the service built from this repository, in the app's folder by its Root Directory), else the one site the setup state's hosting record names for the app (Render's deployments, its live address), else the one Render's deployments on GitHub and the checkout's files name (on a repository with several apps, a file in the app's own folder, or a line of the root README naming that app and no other); its previews as GitHub records them (from the state's record where it lists them or carries readAt, else read from GitHub here), each with its pull request, its address and its state (a closed pull request's address too, read from its earlier successful status, though Render took that preview down; pullState closed marks one the record knows is closed, and impeccable_prove_preview refuses it); production, the site's own address, for the before; pattern, the address every pull request's preview has; and pullRequestPreviews (enabled false, with the cause, where the service's previews are off or manual; 'unknown' without the CLI's answer). cli says whether the render CLI answered (signed-in), is missing, could not list the services (unread, with the reason), or lists none of this repository's (none). Once a site is found, it shows the person one screen naming Render, with the site's address to click, asked once for each app: confirmed true, or false when the person skipped it, which is a no that ends the setup for that app. Where the CLI says the previews are off, that screen is also the consent to turning them on, and on the yes the CLI turns them on and reads them back, with a retry screen on Render's page where it could not: turnedOn in the answer says how that ended (enabled, by run or person; skipped; refused, with the reason and the page). With pull (a pull request of this run, a draft included: Render builds the preview as soon as a pull request opens), only that pull request's preview of the site the plain read found, waiting up to five minutes for it to finish building, under a status line with its timer, and again on the person's yes when the time ran out. Never asks for an address.", RENDER_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
@@ -3496,18 +3531,19 @@ export function createTools(ctx) {
             if (pull !== undefined && !known)
                 return `Refused: read impeccable_render_previews${appKey !== undefined ? ` with appKey ${appKey}` : ''} and no pull first: it tells which Render site builds ${appKey !== undefined ? 'that app' : 'this repository'}.`;
             // GitHub's record of the repository's deployments (with `branch`, its head's), and of those Render's previews of `site`, of `pull` alone where it is given.
-            const readEvidence = (branch) => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, ...(branch !== undefined ? { branch } : {}) });
+            const readEvidence = (branch) => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, runGh: hostRunner('gh', pi.cwd, { signal }), ...(branch !== undefined ? { branch } : {}) });
             const previewsOf = (evidence, site) => evidence.deployments.flatMap((d) => {
                 const preview = parseRenderDeployment(d.environment, d.url);
                 return preview && preview.site === site && (pull === undefined || preview.pull === pull) ? [{ pull: preview.pull, url: d.url, state: d.state }] : [];
             });
-            // The successful previews are the ones a proof may open, each the app's.
+            // The successful previews are the ones a proof may open, each the app's, except a closed pull request's (hosting.ts `closedPulls`): Render takes it down when the pull request closes, so it is evidence of the site and the pattern alone, marked `pullState: "closed"`.
+            const closed = closedPulls(hostingFor(appKey));
             const list = (previews) => {
                 for (const origin of renderListed)
                     listedApps.delete(origin);
                 renderListed.clear();
                 for (const preview of previews) {
-                    if (preview.state !== 'success')
+                    if (preview.state !== 'success' || closed.has(preview.pull))
                         continue;
                     renderListed.add(new URL(preview.url).origin);
                     if (appKey !== undefined)
@@ -3525,14 +3561,23 @@ export function createTools(ctx) {
                 const final = (e) => Boolean(e.error) || e.previews.some((preview) => preview.state === 'success' || preview.state === 'failure' || preview.state === 'error');
                 const waited = await awaitBuild('Render', `Waiting for Render to build ${await subjectOf(pull)}`, read, final, () => known.page, signal);
                 list(waited.previews);
+                for (const origin of renderListed)
+                    renderBuilt.add(origin);
                 return JSON.stringify({ ...forApp, site: known.site, ...waited });
             }
-            const render = (ctx.hostRunner ?? commandRunner)('render', pi.cwd, { signal });
+            const render = hostRunner('render', pi.cwd, { signal });
             const read = await readRenderService(render, repository, folder);
             const service = 'service' in read ? read.service : undefined;
-            const evidence = await readEvidence();
+            // GitHub's record as the setup state holds it, where it lists Render's deployments of this app, or none on a record Impeccable read; else read here.
+            const record = hostingFor(appKey);
+            const recorded = record ? deploymentsOf(record).filter((d) => parseRenderDeployment(d.environment, d.url)) : [];
+            const evidence = recorded.length || (record && hostingRead(ctx.hosting, 'render')) ? { deployments: recorded } : await readEvidence();
             let site = service?.site;
-            // Without the CLI's answer, the site the repository names: on a repository of one app, the one Render site its deployments and files name; on one of several, the one a file in the app's own folder names, else the one a line of the root README names beside that app and no other.
+            // Without the CLI's answer, the one site the setup state's record names for the app (its deployments, its live address); else the one the repository names: on a repository of one app, the one Render site its deployments and files name; on one of several, the one a file in the app's own folder names, else the one a line of the root README names beside that app and no other.
+            if (!site && record) {
+                const named = renderSitesOf(record);
+                site = named.length === 1 ? named[0] : undefined;
+            }
             if (!site) {
                 const recorded = evidence.deployments.flatMap((d) => parseRenderDeployment(d.environment, d.url)?.site ?? []);
                 if (appKey === undefined) {
@@ -3552,7 +3597,7 @@ export function createTools(ctx) {
             const unread = 'reason' in read ? { unread: read.reason } : {};
             if (!site)
                 return JSON.stringify({ ...forApp, previews: [], cli, ...unread, ...(evidence.error ? { error: evidence.error } : {}) });
-            const previews = previewsOf(evidence, site);
+            const previews = previewsOf(evidence, site).map((p) => (closed.has(p.pull) ? { ...p, pullState: 'closed' } : p));
             list(previews);
             const production = service?.production ?? `https://${site}.onrender.com`;
             noteProduction(production, 'render', undefined, appKey);
@@ -3630,8 +3675,8 @@ export function createTools(ctx) {
             // cf is installed here: the fact this acts on is one a read through cf found.
             const { status, ...more } = await turnOnPreviews(host, async () => {
                 if (host === 'netlify')
-                    return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
-                const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
+                    return enableNetlifyPreviews(hostRunner('netlify', pi.cwd, { signal }), fact.project);
+                const cf = cfRunner({ checkout: pi.cwd }, hostRunner);
                 return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
             }, signal);
             return answer(status, more);
@@ -3665,8 +3710,8 @@ export function createTools(ctx) {
             if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
                 return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
             // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
-            const cf = cfRunner({ checkout: pi.cwd }, ctx.hostRunner);
-            const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner);
+            const cf = cfRunner({ checkout: pi.cwd }, hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, hostRunner);
             const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
             let status = await cfStatus(cf, signal);
             // cf not on this machine (#396): its install is asked first.
@@ -3696,7 +3741,7 @@ export function createTools(ctx) {
                 }
             }
             said(create ? `Creating the Pages project ${project}` : `Connecting the repository to ${project}`);
-            const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
+            const gh = hostRunner('gh', pi.cwd, { signal });
             const outcome = await connectCloudflareProject(cf, gh, status, { owner: ctx.owner, repo: ctx.repo }, { project, ...(evidence.account ? { account: evidence.account } : {}), ...(create ? { create: { command: p.command, outputDir: p.outputDir } } : {}) }, signal);
             if (outcome.status !== 'connected')
                 return answer('refused', { reason: outcome.reason });
@@ -3735,7 +3780,7 @@ export function createTools(ctx) {
                 said("Getting past Vercel's login");
             if (at?.app)
                 lockPending.delete(at.app.appKey);
-            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+            const vercel = hostRunner('vercel', pi.cwd, { signal });
             // Before the push, the app's project as impeccable_hosted_previews reads it: the one that builds the app's folder (#281).
             let app = at?.app;
             if (before && appsRepo) {
@@ -3970,7 +4015,7 @@ export function createTools(ctx) {
             /** Netlify took a new password the run set in this call: the end screen says so, saved or not, and on a cancel too. */
             let replaced = false;
             let answer;
-            const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
+            const netlify = hostRunner('netlify', pi.cwd, { signal });
             // The Netlify CLI not on this machine (#396): its install is asked first, the run's own since no agent's turn comes in between, and the command runs again.
             const run = async (args) => {
                 try {
@@ -4135,8 +4180,8 @@ export function createTools(ctx) {
                             accessConsented.add(found.id);
                         return yes;
                     },
-                    cf: cfRunner({ checkout: pi.cwd }, ctx.hostRunner),
-                    login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, ctx.hostRunner),
+                    cf: cfRunner({ checkout: pi.cwd }, hostRunner),
+                    login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
                     install: async () => void (await installCf(pi, signal)),
                     status: said,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,