@impeccable/reviews 0.1.5 → 0.1.7

package/dist/focus.js

@@ -1,17 +1,18 @@
 /**
  * The setup covers one situation: a web front end previewed by the host that
  * already deploys its pull requests or by Impeccable itself, with at most the
- * app's own sign-in. These trim what the setup API says to that situation
+ * app's own sign-in, and the live app's address as the before of every review
+ * where one is known. These trim what the setup API says to that situation
  * before the model reads it, so the setup page's other cards never reach the run.
  */
-/** The state items and checkup checks this setup works on. */
-const ITEMS = new Set(['scan', 'preview', 'signin']);
+/** The state items and checkup checks this setup works on; `before` is the live app's address, which the run sets from what the host or the repository says (the live-app-address case). */
+const ITEMS = new Set(['scan', 'preview', 'before', 'signin']);
 /** The locks in front of the previews this setup gets past, Vercel's login, Netlify's password and Cloudflare Access, by the host the state's item, card and check name. Where the lock is one of theirs they are part of the setup; for any other they are left alone. */
 const LOCK = { item: 'preview-protection', card: 'protection', hosts: ['Vercel', 'Netlify', 'Cloudflare Access'] };
 /** The apps question, as the state's item and card and the write name it: part of the setup only on a repository whose scan proposed several apps, which is where the state has the item (the monorepo case). */
 const APPS = { item: 'apps', card: 'apps', write: 'apps' };
 /** The setup page's cards this setup covers, by their key in the state's `steps`: every other card is not part of it. */
-const CARDS = new Set(['installed', 'preview', 'signin', 'done']);
+const CARDS = new Set(['installed', 'preview', 'before', 'signin', 'done']);
 /** The writes this setup makes, by their key in the instructions' `endpoints` and `writes`; `previewUrlPattern` saves the address of a host's previews that the host does not report to GitHub. */
 const WRITES = new Set(['preview', 'testAccounts', 'connectionCheck', 'latestPullCheck', 'previewUrlPattern']);
 /** What the model reads of the instructions; `steps`, `rules`, `endpoints` and `writes` are trimmed further. */

package/dist/host-previews.js

@@ -0,0 +1,107 @@
+import { readSiteCall } from './netlify-password.js';
+/**
+ * Whether a host builds previews of the repository's pull requests at all, as
+ * its project settings say, read beside the evidence of the previews it built,
+ * and the one change that turns them on as the person through the host's CLI
+ * (Netlify: `netlify api updateSite` with `build_settings.skip_prs` false;
+ * Cloudflare Pages: `cf pages edit` with `preview_deployment_setting` all, or
+ * the test drive's branch among the custom includes). Only the pull-request
+ * setting is ever changed: a project whose builds are stopped altogether
+ * (Netlify `stop_builds`, Cloudflare `deployments_enabled` false) is reported
+ * and left as it is. Vercel builds every branch once Git is connected, so its
+ * fact is read from vercel.json and the project (vercel.ts) and never written.
+ */
+/** The branch the test drive pushes, whose build is the preview the setting must allow. */
+export const TEST_DRIVE_BRANCH = 'impeccable/test-drive';
+const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+const name = (value) => (typeof value === 'string' && /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value) ? value : undefined);
+const rules = (value) => (Array.isArray(value) ? value.filter((v) => typeof v === 'string') : []);
+/**
+ * A branch rule as the hosts write them: Cloudflare's `*` stands for any run of characters, so `impeccable/*` and `*`
+ * both name the test drive's branch; Vercel's rules are minimatch (`minimatch`), where `*` stops at a slash, `**`
+ * does not, and a double star before a slash stands for any number of leading folders, none included.
+ */
+export function matchesBranch(rule, branch, minimatch = false) {
+    const escaped = (part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const stars = (span) => span.split('*').map(escaped).join('[^/]*');
+    const pattern = minimatch
+        ? rule.split('**/').map((piece) => piece.split('**').map(stars).join('.*')).join('(?:.*/)?')
+        : rule.split('*').map(escaped).join('.*');
+    return new RegExp(`^${pattern}$`).test(branch);
+}
+/** What a Pages project's source config says of pull-request previews: Cloudflare's preview branch control, excludes before includes, and the switch for every automatic deployment. */
+export function cloudflarePreviewsFact(project) {
+    const config = record(record(project.source)?.config);
+    const fact = { project: name(project.name) ?? '', enabled: true, ...(typeof config?.production_branch === 'string' ? { productionBranch: config.production_branch } : {}) };
+    if (!config)
+        return { ...fact, enabled: false, cause: 'source', reason: 'The project is not connected to a Git repository, so no push builds.' };
+    if (config.deployments_enabled === false)
+        return { ...fact, enabled: false, cause: 'deployments', reason: 'Automatic deployments are off for the project, production and previews alike (Settings → Builds & deployments).' };
+    const setting = config.preview_deployment_setting;
+    if (setting === 'none')
+        return { ...fact, enabled: false, cause: 'previews', reason: 'Preview branch control is set to None: no branch but production builds.' };
+    if (setting === 'custom') {
+        const excluded = rules(config.preview_branch_excludes).find((rule) => matchesBranch(rule, TEST_DRIVE_BRANCH));
+        if (excluded)
+            return { ...fact, enabled: false, cause: 'previews', reason: `Preview branch control is set to Custom branches, and its exclude rule "${excluded}" leaves ${TEST_DRIVE_BRANCH} out.` };
+        if (!rules(config.preview_branch_includes).some((rule) => matchesBranch(rule, TEST_DRIVE_BRANCH)))
+            return { ...fact, enabled: false, cause: 'previews', reason: `Preview branch control is set to Custom branches, and no include rule names ${TEST_DRIVE_BRANCH}.` };
+    }
+    return fact;
+}
+/** What a Netlify site's build settings say of Deploy Previews: `skip_prs` turns them off, and `stop_builds` stops every build. */
+export function netlifyPreviewsFact(site) {
+    const siteName = name(site.name);
+    if (!siteName)
+        return undefined;
+    const settings = record(site.build_settings);
+    const fact = { project: siteName, enabled: true, ...(typeof settings?.repo_branch === 'string' ? { productionBranch: settings.repo_branch } : {}) };
+    if (!settings || typeof settings.repo_path !== 'string')
+        return { ...fact, enabled: false, cause: 'source', reason: 'The site is not connected to a Git repository, so no pull request builds.' };
+    if (settings.stop_builds === true)
+        return { ...fact, enabled: false, cause: 'deployments', reason: "Builds are stopped for the site, production and Deploy Previews alike (Build settings → Build status)." };
+    if (settings.skip_prs === true)
+        return { ...fact, enabled: false, cause: 'previews', reason: 'Deploy Previews are off for the site (Branches and deploy contexts).' };
+    return fact;
+}
+/** The one fact of several sites' built from the repository: a pull request gets a preview once any site builds it, so the one whose previews are on, else the first. */
+export function pickPreviewsFact(facts) {
+    return facts.find((fact) => fact.enabled === true) ?? facts[0];
+}
+/** Netlify's page where Deploy Previews are turned on, as the wait for a build names it too. */
+export const netlifyPreviewsPage = (site) => `https://app.netlify.com/projects/${encodeURIComponent(site)}/configuration/deploys#deploy-previews`;
+/** Cloudflare's page where a Pages project's preview branch control is set. */
+export const cloudflarePreviewsPage = (account, project) => `https://dash.cloudflare.com/${account}/pages/view/${encodeURIComponent(project)}/settings/builds`;
+/** The CLI's change of a site's Deploy Previews to on. */
+export const netlifyPreviewsCall = (id) => ['api', 'updateSite', '--data', JSON.stringify({ site_id: id, body: { build_settings: { skip_prs: false } } })];
+/** The site's Deploy Previews as the CLI reads them by the site's name; null when it could not say. */
+export async function readNetlifyPreviews(run, site) {
+    try {
+        const read = record(JSON.parse(await run(readSiteCall(site))));
+        const fact = read && netlifyPreviewsFact(read);
+        return fact && typeof read.id === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(read.id) ? { id: read.id, fact } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Turns a site's Deploy Previews on through the Netlify CLI signed in as the person, where that is the one setting in the way, and reads the site back. */
+export async function enableNetlifyPreviews(run, site) {
+    const page = netlifyPreviewsPage(site);
+    const unread = { project: site, enabled: 'unknown', reason: "The Netlify CLI could not read the site: it is signed out, or the site is in no team of the person's." };
+    const read = await readNetlifyPreviews(run, site);
+    if (!read)
+        return { fact: unread, page, changed: false, reason: unread.reason };
+    if (read.fact.enabled !== false)
+        return { fact: read.fact, page, changed: false };
+    if (read.fact.cause !== 'previews')
+        return { fact: read.fact, page, changed: false, reason: `The run changes the Deploy Previews setting alone. ${read.fact.reason}` };
+    try {
+        await run(netlifyPreviewsCall(read.id));
+    }
+    catch {
+        return { fact: read.fact, page, changed: false, reason: 'Netlify refused the change: the role may not allow it.' };
+    }
+    const after = await readNetlifyPreviews(run, site);
+    return { fact: after?.fact ?? read.fact, page, changed: after?.fact.enabled === true };
+}

package/dist/host-questions.js

@@ -19,6 +19,32 @@ export const HOST_QUESTIONS = {
     },
     'netlify-team': { kind: 'single', title: 'Netlify team', prompt: 'Which Netlify team should own the new site?' },
 };
+/** A host's GitHub app that cannot see the repository: the one screen opening the app's installation page on GitHub, and the retry once the person gave it access there. */
+const appAccess = (id, name) => ({
+    [`${id}-access`]: {
+        id: `${id}-access`,
+        kind: 'confirm',
+        title: `${name} needs access on GitHub`,
+        hint: `${name}'s GitHub app can't see this repository yet. Give it access on the GitHub page that opens. The run carries on by itself once it can.`,
+        prompt: `Open GitHub to give ${name} access?`,
+        confirmLabel: 'Open GitHub',
+        skipLabel: 'Skip',
+    },
+    [`${id}-access-retry`]: { id: `${id}-access-retry`, kind: 'confirm', title: `${name} needs access on GitHub`, prompt: `${name} still can't see the repository.`, confirmLabel: 'Try again', skipLabel: 'Skip' },
+});
+/** The same screens when the host's CLI on this machine is signed in already: no login to run, so the yes is to the setup as that account, and it is still asked. */
+export const HOST_SIGNED_IN = {
+    'vercel-setup': {
+        hint: 'Impeccable reviews each pull request on a preview. Vercel can host those previews: the run sets it up with the Vercel CLI on this machine, which is signed in already; what is live stays as it is.',
+        prompt: 'Set Vercel up with that sign-in?',
+        confirmLabel: 'Set up',
+    },
+    'netlify-setup': {
+        hint: 'Impeccable reviews each pull request on a preview. Netlify can host those previews: the run sets it up with the Netlify CLI on this machine, which is signed in already; what is live stays as it is.',
+        prompt: 'Set Netlify up with that sign-in?',
+        confirmLabel: 'Set up',
+    },
+};
 /** Where a person reads or changes a site's password in Netlify, as Netlify's docs name the page on every plan. */
 export const NETLIFY_PASSWORD_WHERE = 'Project configuration → General → Visitor access';
 /** The wait for a host's build that ran out: the page where the host's builds of pull requests are turned on, and the wait again. */
@@ -34,30 +60,35 @@ const buildWait = (id, name, where) => ({
     },
     [`${id}-build-retry`]: { id: `${id}-build-retry`, kind: 'confirm', title: `Waiting for ${name}`, prompt: `Still no preview from ${name}.`, confirmLabel: 'Keep waiting', skipLabel: 'Skip' },
 });
-/** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one, and to making a site behind Netlify's team login public. */
-export const HOST_SCREENS = {
-    'netlify-signin-retry': { id: 'netlify-signin-retry', kind: 'confirm', title: 'Sign in to Netlify', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
-    'netlify-access': {
-        id: 'netlify-access',
+/** A host that builds the repository but not its pull requests: the one consent to turning pull-request previews on as the person (the tool names the project in the prompt), and the retry once they changed it on the host's page where the run could not. */
+const previewsOff = (id, name, where) => ({
+    [`${id}-previews`]: {
+        id: `${id}-previews`,
         kind: 'confirm',
-        title: 'Netlify needs access on GitHub',
-        hint: "Netlify's GitHub app can't see this repository yet. Give it access on the GitHub page that opens. The run carries on by itself once it can.",
-        prompt: 'Open GitHub to give Netlify access?',
-        confirmLabel: 'Open GitHub',
+        title: `${name}, but no pull-request previews`,
+        hint: `Impeccable reviews pull requests on their previews, and ${name} isn't building previews for this repository's pull requests. The run turns them on as you; what is live stays as it is.`,
+        prompt: 'Turn on pull-request previews?',
+        confirmLabel: 'Turn on',
         skipLabel: 'Skip',
     },
-    'netlify-access-retry': { id: 'netlify-access-retry', kind: 'confirm', title: 'Netlify needs access on GitHub', prompt: "Netlify still can't see the repository.", confirmLabel: 'Try again', skipLabel: 'Skip' },
-    'vercel-signin-retry': { id: 'vercel-signin-retry', kind: 'confirm', title: 'Sign in to Vercel', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
-    'vercel-access': {
-        id: 'vercel-access',
+    [`${id}-previews-retry`]: {
+        id: `${id}-previews-retry`,
         kind: 'confirm',
-        title: 'Vercel needs access on GitHub',
-        hint: "Vercel's GitHub app can't see this repository yet. Give it access on the GitHub page that opens. The run carries on by itself once it can.",
-        prompt: 'Open GitHub to give Vercel access?',
-        confirmLabel: 'Open GitHub',
+        title: `${name}, but no pull-request previews`,
+        hint: `${name} still builds no previews for pull requests. On the page that opened, ${where}.`,
+        prompt: 'Changed it?',
+        confirmLabel: 'Try again',
         skipLabel: 'Skip',
     },
-    'vercel-access-retry': { id: 'vercel-access-retry', kind: 'confirm', title: 'Vercel needs access on GitHub', prompt: "Vercel still can't see the repository.", confirmLabel: 'Try again', skipLabel: 'Skip' },
+});
+/** The screens a tool shows on its own: a sign-in's retry, the one-time access the host's GitHub app needs, the consent to turning a host's pull-request previews on, and the consent to a key for a host's lock (a bypass secret for Vercel's login, the site password for Netlify's, a service token for Cloudflare Access), with the paste where the run does not get one, and to making a site behind Netlify's team login public. */
+export const HOST_SCREENS = {
+    'netlify-signin-retry': { id: 'netlify-signin-retry', kind: 'confirm', title: 'Sign in to Netlify', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
+    ...appAccess('netlify', 'Netlify'),
+    'vercel-signin-retry': { id: 'vercel-signin-retry', kind: 'confirm', title: 'Sign in to Vercel', prompt: 'The sign-in did not complete.', confirmLabel: 'Try again', skipLabel: 'Skip' },
+    ...appAccess('vercel', 'Vercel'),
+    // Cloudflare's GitHub app covers only the repositories its installation names: a connected Pages project with previews on, and no build of a pushed branch, is one it cannot see.
+    ...appAccess('cloudflare-app', 'Cloudflare'),
     // Vercel refused the run's lock on a new project: the person turns it on, since the test drive's push is the project's first deployment.
     'vercel-lock': {
         id: 'vercel-lock',
@@ -72,6 +103,36 @@ export const HOST_SCREENS = {
     ...buildWait('vercel', 'Vercel', 'connect the repository in Settings → Git'),
     ...buildWait('netlify', 'Netlify', 'turn Deploy Previews on'),
     ...buildWait('cloudflare', 'Cloudflare', 'connect the repository to the Pages project'),
+    ...previewsOff('netlify', 'Netlify', 'turn Deploy Previews on under Branches and deploy contexts → Configure'),
+    ...previewsOff('cloudflare', 'Cloudflare', 'set Preview branch control to All non-Production branches under Builds & deployments'),
+    // No Pages project builds the repository's pull requests: the one consent to connecting the repository to the project the checkout names, or to creating one for it where Cloudflare builds a Worker instead (the tool names the project in the prompt), and the sign-in cf needs for either.
+    'cloudflare-setup': {
+        id: 'cloudflare-setup',
+        kind: 'confirm',
+        title: 'Cloudflare, but no pull-request previews',
+        hint: 'Setting up Cloudflare Pages takes your Cloudflare sign-in. What is live stays as it is.',
+        prompt: 'Sign in to Cloudflare in your browser?',
+        confirmLabel: 'Sign in',
+        skipLabel: 'Skip',
+    },
+    'cloudflare-connect': {
+        id: 'cloudflare-connect',
+        kind: 'confirm',
+        title: 'Cloudflare, but no pull-request previews',
+        hint: "Impeccable reviews pull requests on their previews, and the Pages project isn't connected to this repository, so nothing builds. The run connects it as you: every branch but the default one gets a preview.",
+        prompt: 'Connect the repository to the Pages project?',
+        confirmLabel: 'Connect',
+        skipLabel: 'Skip',
+    },
+    'cloudflare-create': {
+        id: 'cloudflare-create',
+        kind: 'confirm',
+        title: 'Cloudflare, but no pull-request previews',
+        hint: 'Impeccable reviews pull requests on their previews, and Cloudflare builds this repository as a Worker, which gives them none. The run creates a Pages project connected to it as you; the Worker stays as it is.',
+        prompt: 'Create the Pages project?',
+        confirmLabel: 'Create',
+        skipLabel: 'Skip',
+    },
     // Vercel's login in front of the previews: the one consent to a bypass secret the run creates as the person, and the paste when the CLI cannot.
     'vercel-bypass': {
         id: 'vercel-bypass',
@@ -87,7 +148,7 @@ export const HOST_SCREENS = {
         kind: 'text',
         sensitive: true,
         title: 'Your Vercel previews are protected',
-        prompt: 'Vercel keeps your previews behind a login, and the Vercel CLI here could not make a bypass secret for them: that takes your Vercel sign-in, this folder linked to the project, and the Member role. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
+        prompt: 'Vercel keeps your previews behind a login, and the Vercel CLI here could not make a bypass secret for them: that takes the Member role, or Project Administrator. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
         hint: 'Paste the secret',
     },
     // Netlify's site password in front of the previews: the one consent to storing the password the run reads from the site as the person, and the paste when it cannot read it.
@@ -105,7 +166,7 @@ export const HOST_SCREENS = {
         kind: 'text',
         sensitive: true,
         title: 'Your Netlify previews are protected',
-        prompt: `Netlify keeps your previews behind the site password, and the run could not read it: the Netlify CLI here is signed out, the site is in none of your teams, or Netlify does not give the password back. Find it, or set a new one, in ${NETLIFY_PASSWORD_WHERE}. It is stored encrypted and used only to open previews.`,
+        prompt: `Netlify keeps your previews behind the site password, and Netlify does not give it back to the run. Find it, or set a new one, in ${NETLIFY_PASSWORD_WHERE}. It is stored encrypted and used only to open previews.`,
         hint: 'Paste the password',
     },
     // Netlify's team login in front of the previews: the one consent to making the site public as the person, and the retry once they changed it on Netlify's page where Netlify refused.
@@ -154,6 +215,15 @@ export const HOST_SCREENS = {
         prompt: 'Cloudflare Access keeps your previews behind a login. Paste a service token for Impeccable, or make one: Zero Trust → Access controls → Service credentials → Service Tokens → Create Service Token, named "Impeccable reviews", then allow it in your Access application with a Service Auth policy. It is stored encrypted and used only to open previews.',
     },
 };
+/**
+ * A key's screen naming the one address the key goes to: the consent to a bypass secret, a site password or a service
+ * token is to that address, which the key opens before anything saves it. A confirm says so in its supporting text; a
+ * text or account screen, under its prompt.
+ */
+export function sentTo(screen, url) {
+    const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
+    return screen.kind === 'confirm' ? { ...screen, hint: `${screen.hint} ${line}` } : { ...screen, prompt: `${screen.prompt} ${line}` };
+}
 /** The ids whose screens the tool puts up itself, when it needs the person, and takes down: the web page follows those, not the model's call. */
 export const TOOL_SHOWN = new Set(['netlify-setup', 'vercel-setup']);
 /** A question as the person reads it: the fixed words for a host's id, else the model's own. */

package/dist/hosted.js

@@ -85,30 +85,66 @@ const HOSTS = {
     netlify: { name: 'Netlify', gate: 'netlify-protection', login: /(^|\.)netlify\.com$/ },
     cloudflare: { name: 'Cloudflare Pages', gate: 'cloudflare-access', login: /(^|\.)cloudflareaccess\.com$/ },
 };
-const NETLIFY = /^(?=[^.]{1,63}\.netlify\.app$)deploy-preview-[1-9]\d{0,6}--([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.netlify\.app$/;
+const LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const NETLIFY = new RegExp(`^(?=[^.]{1,63}\\.netlify\\.app$)deploy-preview-[1-9]\\d{0,6}--(${LABEL})\\.netlify\\.app$`);
 /** A Pages preview: one label (the deployment's id, or the branch's alias), then the project, under pages.dev. The project's own address, with no label, is its production. */
-const PAGES = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.pages\.dev$/;
+const PAGES = new RegExp(`^${LABEL}\\.(${LABEL})\\.pages\\.dev$`);
+/** A live app's own address on its host: a Vercel alias (one name under vercel.app, the shape its deployments have too), a Netlify site's netlify.app address (a deploy or branch subdomain carries `--`), a Pages project's pages.dev address. */
+const LIVE = { vercel: new RegExp(`^${LABEL}\\.vercel\\.app$`), netlify: new RegExp(`^(?!.*--)(${LABEL})\\.netlify\\.app$`), cloudflare: new RegExp(`^(${LABEL})\\.pages\\.dev$`) };
+/** https on one name, with no credentials, port, query or fragment. */
+const plainHttps = (url) => url.protocol === 'https:' && !url.username && !url.password && !url.port && !url.search && !url.hash;
 /** A deployment's own address: https on one name, and nothing else. Vercel's is one name under vercel.app, Netlify's a pull request's deploy preview, Cloudflare's a Pages preview. */
 const hostOf = (url) => {
-    if (url.protocol !== 'https:' || url.username || url.password || url.port || url.search || url.hash)
+    if (!plainHttps(url))
         return null;
-    return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.vercel\.app$/.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : PAGES.test(url.hostname) ? 'cloudflare' : null;
+    return LIVE.vercel.test(url.hostname) ? 'vercel' : NETLIFY.test(url.hostname) ? 'netlify' : PAGES.test(url.hostname) ? 'cloudflare' : null;
 };
+/** The host a live app's address is on, by its domain, so its lock is known; `other` for any other https address, whose lock no key opens. */
+const liveHostOf = (url) => {
+    if (!plainHttps(url))
+        return null;
+    return LIVE.vercel.test(url.hostname) ? 'vercel' : /(^|\.)netlify\.app$/.test(url.hostname) ? 'netlify' : /(^|\.)pages\.dev$/.test(url.hostname) ? 'cloudflare' : 'other';
+};
+/**
+ * Whether an address a file of the checkout names is a live app's on one of the hosts, and not a preview's: the site's
+ * or project's own address under vercel.app, netlify.app or pages.dev (a Netlify deploy preview, a Pages deployment or
+ * branch alias, and a Vercel branch alias, `<project>-git-<branch>-<team>`, are previews whatever file links them). Any
+ * other address a file names is not opened: a file is anyone's to write, and a name there could reach a service on the
+ * person's own network, which only the host tools' facts may name.
+ */
+export function liveShaped(url) {
+    if (!URL.canParse(url))
+        return false;
+    const parsed = new URL(url);
+    const host = liveHostOf(parsed);
+    if (host === 'vercel')
+        return !/-git-/.test(parsed.hostname);
+    if (host === 'netlify')
+        return LIVE.netlify.test(parsed.hostname);
+    if (host === 'cloudflare')
+        return LIVE.cloudflare.test(parsed.hostname);
+    return false;
+}
 /** The host a preview address belongs to, by name; null for an address of none. */
 export function previewHostName(url) {
     const host = URL.canParse(url) ? hostOf(new URL(url)) : null;
     return host ? HOSTS[host].name : null;
 }
-/** The Netlify site a deploy preview address belongs to, by name; null for any other address. */
+/** The Netlify site a deploy preview address, or the site's own netlify.app address, belongs to, by name; null for any other address. */
 export function netlifySiteOf(url) {
-    return URL.canParse(url) && hostOf(new URL(url)) === 'netlify' ? NETLIFY.exec(new URL(url).hostname)[1] : null;
+    if (!URL.canParse(url) || !plainHttps(new URL(url)))
+        return null;
+    const { hostname } = new URL(url);
+    return NETLIFY.exec(hostname)?.[1] ?? LIVE.netlify.exec(hostname)?.[1] ?? null;
 }
-/** The address pattern a proven preview stands for, where the host reports none to GitHub: Netlify's by pull request, Cloudflare's by the branch's alias. */
-function patternOf(host, hostname) {
-    if (host === 'netlify')
-        return { pattern: `https://deploy-preview-{pr}--${NETLIFY.exec(hostname)[1]}.netlify.app` };
-    if (host === 'cloudflare')
-        return { pattern: `https://{branch}.${PAGES.exec(hostname)[1]}.pages.dev` };
+/** The address pattern a proven preview stands for, where the host reports none to GitHub: Netlify's by pull request, Cloudflare's by the branch's alias. A live address stands for none. */
+function patternOf(hostname) {
+    const site = NETLIFY.exec(hostname)?.[1];
+    if (site)
+        return { pattern: `https://deploy-preview-{pr}--${site}.netlify.app` };
+    const project = PAGES.exec(hostname)?.[1];
+    if (project)
+        return { pattern: `https://{branch}.${project}.pages.dev` };
     return {};
 }
 const ENTITIES = {
@@ -123,7 +159,7 @@ function plain(text) {
     }).replace(/\s+/g, ' ').trim().toLowerCase();
 }
 /** Whether a file the checkout tracks holds the words; .env files are never read. */
-async function inCheckout(root, words) {
+async function checkoutHolds(root, words) {
     try {
         await execFileAsync('git', ['grep', '--quiet', '--fixed-strings', '--ignore-case', '-e', words, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
         return true;
@@ -132,6 +168,17 @@ async function inCheckout(root, words) {
         return false;
     }
 }
+/** Whether a file the checkout tracks names the address's origin as such, whole (a full stop after it is the sentence's): not as the tail of a longer host name, such as a deploy preview's of the same site. */
+export async function checkoutNames(root, origin) {
+    const escaped = origin.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+    try {
+        await execFileAsync('git', ['grep', '--quiet', '--ignore-case', '--extended-regexp', '-e', `(^|[^A-Za-z0-9.-])${escaped}([^A-Za-z0-9.-]|\\.([^A-Za-z0-9]|$)|$)`, '--', '.', ':(exclude,glob)**/.env*'], { cwd: root, timeout: 30_000, env: gitEnvironment() });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** What a visitor never sees of a page: comments, scripts, styles and templates. */
 const UNSEEN = /<!--[\s\S]*?-->|<(script|style|noscript|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
 /** The words a visitor sees: the title and the text, without comments, scripts, styles, tags or attributes. */
@@ -206,18 +253,22 @@ async function formOpens(target, password, phrase, open, signal) {
  * header, the one way reviews can send it, and with `form` posted to Netlify's form too where the header did not get past
  * the lock (only for a site whose settings show a password: an app's own password form looks the same); with `access`, a
  * Cloudflare Access service token, a Pages address is opened with it in the two headers Access reads it from. None goes
- * to another host.
+ * to another host. With `live`, the address is a live app's rather than a preview's: any https address is opened, a
+ * host's lock is told by its domain, or by the host named in `live` for a custom domain the host tool answered as the
+ * project's or site's, and no pattern is answered.
  */
 export async function provePreview(url, words, root, deps = {}) {
     const unproven = (reason, status = null) => ({ proven: false, status, reason });
-    const host = URL.canParse(url) ? hostOf(new URL(url)) : null;
+    const parsed = URL.canParse(url) ? new URL(url) : null;
+    const host = !parsed ? null : !deps.live ? hostOf(parsed) : !plainHttps(parsed) ? null : typeof deps.live === 'string' ? deps.live : liveHostOf(parsed);
     if (!host)
-        return unproven('Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, or a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, with no query, is opened.');
-    const { name, gate, login } = HOSTS[host];
+        return unproven(deps.live ? 'Only an https address with no query is opened.' : 'Only a Vercel preview address, https://<name>.vercel.app, a Netlify deploy preview, https://deploy-preview-<n>--<name>.netlify.app, or a Cloudflare Pages preview, https://<id or branch>.<project>.pages.dev, with no query, is opened.');
+    // Another host's live address has a lock no key opens, so none is looked for: its login is another site, and its 401 the app's own sign-in.
+    const { name, gate, login } = host === 'other' ? { name: 'the app', gate: undefined, login: /$^/ } : HOSTS[host];
     const phrase = words.trim();
     if (phrase.length < 3 || phrase.length > 120 || /[\r\n]/.test(phrase))
         return unproven('The words are 3 to 120 characters on one line.');
-    if (!(await inCheckout(root, phrase)))
+    if (!(await checkoutHolds(root, phrase)))
         return unproven("No file of this checkout holds those words: give words the app's pages show, from its source.");
     const signal = AbortSignal.any([AbortSignal.timeout(15_000), ...(deps.signal ? [deps.signal] : [])]);
     const open = deps.fetch ?? fetch;
@@ -240,7 +291,7 @@ export async function provePreview(url, words, root, deps = {}) {
                 await res.body?.cancel().catch(() => { });
                 const location = res.headers.get('location') ?? '';
                 const next = URL.canParse(location, target.href) ? new URL(location, target) : null;
-                if (next && login.test(next.hostname))
+                if (gate && next && login.test(next.hostname))
                     return { ...unproven(`The address sent the browser to ${name}'s login${still}.`, res.status), gate };
                 if (next?.origin !== target.origin)
                     return unproven('The address sent the browser to another site.', res.status);
@@ -253,7 +304,7 @@ export async function provePreview(url, words, root, deps = {}) {
                 // Cloudflare Access names itself on the 401 or 403 it answers a request it will not let in (a service token it does not admit), where a browser gets its login.
                 const page = await pageText(res, 64_000);
                 const named = (host === 'netlify' && netlifyLock(res.headers.get('www-authenticate'), page)) || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
-                if (!named)
+                if (!gate || !named)
                     return unproven(res.status === 401 ? "The address asked for the app's own sign-in: try a page a visitor opens without signing in." : `The address answered ${res.status}.`, res.status);
                 // A password the header did not get past: Netlify's own form says whether it is the site's password at all.
                 if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
@@ -266,7 +317,7 @@ export async function provePreview(url, words, root, deps = {}) {
                 return unproven(`The address answered ${res.status}.`, res.status);
             }
             return visible(await pageText(res)).includes(plain(phrase))
-                ? { proven: true, status: res.status, ...patternOf(host, new URL(url).hostname) }
+                ? { proven: true, status: res.status, ...(deps.live ? {} : patternOf(parsed.hostname)) }
                 : unproven('The page does not show those words: it is another app, or another page.', res.status);
         }
         return unproven('The address redirected too many times.');

package/dist/http.js

@@ -11,6 +11,8 @@ export async function requestJson(url, init, log) {
                 ...(init.token ? { authorization: `Bearer ${init.token}` } : {}),
             },
             body: init.body === undefined ? undefined : JSON.stringify(init.body),
+            // A 307 or 308 would send the body (a sign-in code, a bypass secret, a password) on to wherever it points.
+            redirect: 'error',
             signal: AbortSignal.timeout(init.timeoutMs ?? 60_000),
         });
         const text = await res.text();

package/dist/log.js

@@ -1,4 +1,4 @@
-import { appendFileSync } from 'node:fs';
+import { appendFileSync, chmodSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { redactShapes } from './scan.js';
@@ -32,6 +32,7 @@ export function createLog(debug, dir = tmpdir()) {
     if (!debug)
         return { secret, write: () => { } };
     const path = join(dir, `impeccable-reviews-${new Date().toISOString().replace(/[:.]/g, '-')}.log`);
+    let tightened = false;
     return {
         path,
         secret,
@@ -39,6 +40,11 @@ export function createLog(debug, dir = tmpdir()) {
             const detail = data === undefined ? '' : ` ${typeof data === 'string' ? data : JSON.stringify(data)}`;
             try {
                 appendFileSync(path, `${scrub(`${new Date().toISOString()} ${message}${detail}`, secrets)}\n`, { mode: 0o600 });
+                // mode only applies to a new file; one that was there keeps its own until told.
+                if (!tightened) {
+                    tightened = true;
+                    chmodSync(path, 0o600);
+                }
             }
             catch {
                 // A debug log that cannot be written is not worth stopping the run for.

package/dist/login.js

@@ -1,8 +1,10 @@
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
+import { win32 } from 'node:path';
 import { requestJson } from './http.js';
 import { UserError } from './log.js';
+import { LOOPBACK } from './preflight.js';
 import { askPerson } from './ui/bridge.js';
 /** The callback ports, in the order the contract lists them; the Worker accepts no other. */
 export const CALLBACK_PORTS = [8239, 8238, 8240, 8237, 8236, 8235];
@@ -40,7 +42,8 @@ function page(res, status, message, more = '') {
 /**
  * The page the tab shows once the code has come: it asks the command every
  * half second where to go next, and goes there (the progress page), or says
- * what went wrong; without scripts, a link does the asking.
+ * what went wrong; without scripts, a link does the asking. It hears the
+ * answer once.
  */
 function waitingPage(res, state) {
     const script = `<script>(function(){var said=document.getElementById('said'),next='/next?state='+encodeURIComponent(new URLSearchParams(location.search).get('state')||'');function ask(){fetch(next,{cache:'no-store'}).then(function(r){return r.json()}).then(function(a){if(a.page&&/^https?:/.test(a.page))location.replace(a.page);else if(a.error)said.textContent=a.error;else setTimeout(ask,500)},function(){said.textContent='Back to your terminal.'})}ask()})()</script>`;
@@ -53,8 +56,11 @@ function waitingPage(res, state) {
  * the callback. A wrong state gets a 400 and the wait goes on; the right one
  * hands over the code and answers at once with a page that asks `/next` where
  * to go, which says "not yet" until `land` knows (a JSON `wait`), then the
- * page or what went wrong. `/go` is the same for a tab without scripts: a
- * redirect, or the waiting page again.
+ * page or what went wrong, once. `/go` is the same for a tab without scripts:
+ * a redirect, or the waiting page again. Only the first callback with the
+ * right state counts: a later one gets a 400 and changes nothing, unless it
+ * is the same tab reloading, which waits again. `/next` and `/go` answer only
+ * once that callback has brought a code, since the state is all they check.
  */
 export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
     let resolve;
@@ -65,7 +71,11 @@ export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
     });
     /** A tab brought the code, and waits to hear where to go. */
     let visited = false;
+    /** What the one callback that counts brought: its code, or '' when it said the sign-in did not finish. */
+    let brought;
     let landing;
+    /** The tab has heard where to go, so nothing more is said. */
+    let said = false;
     let heard = () => { };
     const told = new Promise((r) => (heard = r)).finally(() => untold.delete(told));
     const answer = (req, res) => {
@@ -75,9 +85,15 @@ export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
             return void res.writeHead(404, { connection: 'close' }).end();
         if (url.searchParams.get('state') !== state)
             return page(res, 400, 'This sign-in is not the one your terminal started. Run impeccable-reviews again.');
-        // Heard once the answer that says where to go has left for the tab.
-        if (route !== '/callback' && landing)
-            res.once('finish', heard);
+        if (route !== '/callback') {
+            if (!visited || said)
+                return page(res, 400, 'Back to your terminal.');
+            // Heard once the answer that says where to go has left for the tab.
+            if (landing) {
+                said = true;
+                res.once('finish', heard);
+            }
+        }
         if (route === '/next')
             return void res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', connection: 'close' }).end(JSON.stringify(landing ?? { wait: true }));
         if (route === '/go') {
@@ -87,12 +103,14 @@ export async function startCallbackServer(state, ports = CALLBACK_PORTS) {
         }
         const got = url.searchParams.get('code');
         const error = url.searchParams.get('error');
+        if (brought !== undefined)
+            return got && !error && got === brought && !said ? waitingPage(res, state) : page(res, 400, 'This sign-in already had its answer. Back to your terminal.');
+        brought = !got || error ? '' : got;
         if (!got || error) {
             page(res, 400, 'Sign-in did not finish. Back to your terminal.');
             return reject(new UserError(`Sign-in did not finish${error ? ` (${error})` : ''}. Run impeccable-reviews again.`));
         }
-        if (!visited)
-            untold.add(told);
+        untold.add(told);
         visited = true;
         resolve(got);
         waitingPage(res, state);
@@ -178,15 +196,29 @@ export function parsePasted(text, state) {
     }
     return /^[A-Za-z0-9._~-]{8,}$/.test(trimmed) ? trimmed : null;
 }
+/**
+ * The platform's command that opens `url` in the default browser, with no shell between. Null for anything but an https
+ * address, or plain http to this machine (localhost, 127.0.0.1, [::1] or a .localhost name), free of quotes, spaces,
+ * control characters and what a shell would read (^ | < >): Windows' opener runs a local file or any other protocol it is
+ * handed, and the address may come from the model or the setup API.
+ */
+export function browserCommand(url, platform = process.platform) {
+    const parsed = URL.canParse(url) ? new URL(url) : null;
+    const web = parsed?.protocol === 'https:' || (parsed?.protocol === 'http:' && (LOOPBACK.has(parsed.hostname) || /^(?:[a-z0-9-]+\.)+localhost$/.test(parsed.hostname)));
+    if (!web || /["^|<>\s\x00-\x1f\x7f]/.test(url))
+        return null;
+    // rundll32 by its full path: the run's folder is the checkout, which Windows would otherwise look in first.
+    return platform === 'darwin' ? ['open', [url]]
+        : platform === 'win32' ? [win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'rundll32.exe'), ['url.dll,FileProtocolHandler', url]]
+            : ['xdg-open', [url]];
+}
 /** Opens the address in the default browser; a failure is fine because the address is printed too. BROWSER=none skips it. */
 export function openBrowser(url) {
-    if (process.env.BROWSER === 'none')
+    const opener = browserCommand(url);
+    if (process.env.BROWSER === 'none' || !opener)
         return;
-    const [command, args, verbatim] = process.platform === 'darwin' ? ['open', [url], false]
-        : process.platform === 'win32' ? ['cmd', ['/c', 'start', '""', `"${url}"`], true]
-            : ['xdg-open', [url], false];
     try {
-        const child = spawn(command, args, { stdio: 'ignore', detached: true, windowsVerbatimArguments: verbatim });
+        const child = spawn(opener[0], opener[1], { stdio: 'ignore', detached: true });
         child.on('error', () => { });
         child.unref();
     }