@impeccable/reviews 0.1.5 → 0.1.7

package/dist/tools.js

@@ -7,25 +7,27 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
-import { netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
-import { cfRunner, pagesProject, readCloudflarePreviews } from './cloudflare.js';
+import { HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, sentTo } from './host-questions.js';
+import { enableNetlifyPreviews } from './host-previews.js';
+import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
-import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
+import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelPreviewsFact, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
 import { gitEnvironment } from './sandbox.js';
 import { openBrowser } from './login.js';
-import { TASK_STATUSES } from './sync.js';
+import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
 import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
 import { SEE_THE_REVIEW } from './ui/look.js';
-import { noteSensitiveAnswer } from './ui/sensitive.js';
+import { noteSensitiveAnswer, plainText } from './ui/sensitive.js';
+export { STATUS_MAX, statusVoiceError } from './sync.js';
 /** The first way `value` breaks `schema`, or null when it fits. */
 export function schemaError(schema, value, at = 'input') {
     const types = schema.type === undefined ? [] : [schema.type].flat();
@@ -106,15 +108,6 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
 const NO_INPUT = { type: 'object', properties: {}, additionalProperties: false };
-/** The most a status line holds; longer text belongs in the report. */
-export const STATUS_MAX = 70;
-const STATUS_RULE = `Status lines are in the product voice: a present-tense verb phrase of at most ${STATUS_MAX} characters that says what is happening, such as "Running the build" or "Opening the setup pull request". No "I'm", "I am", "Let me", "I'll" or "trying to"; detail goes in the report. Nothing was saved: call impeccable_progress again with the status rephrased.`;
-/** Why a status line breaks the voice, with the rule to rephrase it by; null when it keeps it. The line is never rewritten here. */
-export function statusVoiceError(line) {
-    const text = line.trim();
-    const why = /^(i['’]m|i am|let me|i['’]ll)\b/i.test(text) || /\btrying to\b/i.test(text) ? 'it narrates like an assistant' : text.length > STATUS_MAX ? `it is ${text.length} characters long` : null;
-    return why ? `Refused: "${text}" does not fit the status line, because ${why}. ${STATUS_RULE}` : null;
-}
 /** Why the status line and the task list say different things, one task in progress at a time and the status its detail; null when they agree. */
 function stageError(status, tasks) {
     const running = tasks.filter((t) => t.status === 'in_progress');
@@ -213,7 +206,7 @@ const PROVE_PREVIEW = {
     additionalProperties: false,
     required: ['url', 'expect'],
     properties: {
-        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or a page on it.' },
+        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or the live app\'s address one of them answered as production or a file of this checkout names, or a page on it.' },
         expect: { type: 'string', minLength: 1, description: 'Words the page shows that a file of this checkout holds, such as the app\'s name in its title.' },
     },
 };
@@ -254,6 +247,20 @@ const namesCredential = (q) => {
 };
 /** Under the field of every text question typed in the open, where the model reads the answer. */
 const NEVER_A_CREDENTIAL = 'Never enter a password, a token or a key here.';
+const ENABLE_PREVIEWS = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['host'],
+    properties: { host: { type: 'string', enum: ['netlify', 'cloudflare'], description: "The host whose pullRequestPreviews said enabled false in this run." } },
+};
+const CLOUDFLARE_CONNECT = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        command: { type: 'string', minLength: 1, description: "The build command Cloudflare runs for a project the run creates: the package's build script; none for plain HTML." },
+        outputDir: { type: 'string', minLength: 1, description: 'The folder the build writes the pages to, relative to the checkout, for a project the run creates; "." for plain HTML at the root.' },
+    },
+};
 const NETLIFY_CONNECT = {
     type: 'object',
     additionalProperties: false,
@@ -279,17 +286,28 @@ function askError(q) {
         return 'input.options[].selected is for multi only';
     return new Set(values).size === values.length ? null : 'input.options has a value twice';
 }
-/** Why `url` is not pull request `number` of owner/repo on GitHub; null when it is. */
-function pullRequestError(url, number, owner, repo) {
-    const m = URL.canParse(url) ? /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/.exec(new URL(url).pathname) : null;
-    const ok = m && new URL(url).origin === 'https://github.com' && m[1].toLowerCase() === owner.toLowerCase() && m[2].toLowerCase() === repo.toLowerCase() && Number(m[3]) === number;
-    return ok ? null : `${url} is not pull request #${number} of ${owner}/${repo} on GitHub`;
+/**
+ * Pull request `number` of owner/repo on GitHub, when `url` is it: its address rebuilt from those validated parts, so no
+ * query, fragment or other character the model wrote reaches the browser or the clipboard. Null when `url` is not it.
+ */
+function canonicalPullRequest(url, number, owner, repo) {
+    const parsed = URL.canParse(url) ? new URL(url) : null;
+    const m = parsed && /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/.exec(parsed.pathname);
+    const ok = m && parsed.origin === 'https://github.com' && !parsed.username && !parsed.password
+        && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(owner) && /^[A-Za-z0-9._-]{1,100}$/.test(repo)
+        && m[1].toLowerCase() === owner.toLowerCase() && m[2].toLowerCase() === repo.toLowerCase() && Number.isSafeInteger(number) && number > 0 && Number(m[3]) === number;
+    return ok ? `https://github.com/${owner}/${repo}/pull/${number}` : null;
+}
+/** `pr` with its address rebuilt as pull request `number` of owner/repo on GitHub, or undefined when it is not that. */
+export function ownPullRequest(pr, owner, repo) {
+    const url = pr && canonicalPullRequest(pr.url, pr.number, owner, repo);
+    return url ? { number: pr.number, url } : undefined;
 }
 /** This run's open pull request from `branch`, its head in this repository rather than a fork, with that head's name; or why it is not. */
 async function runPullRequest(ctx, pr, branch, signal) {
-    const error = pullRequestError(pr.url, pr.number, ctx.owner, ctx.repo);
-    if (error)
-        return { problem: error };
+    const url = canonicalPullRequest(pr.url, pr.number, ctx.owner, ctx.repo);
+    if (!url)
+        return { problem: `${pr.url} is not pull request #${pr.number} of ${ctx.owner}/${ctx.repo} on GitHub` };
     const found = await ctx.viewPullRequest(pr.number);
     if ('error' in found)
         return { problem: `gh pr view ${pr.number} did not find it (${found.error})` };
@@ -303,7 +321,7 @@ async function runPullRequest(ctx, pr, branch, signal) {
     if (!await (ctx.setupPullHeadReader ?? readSetupPullHead)(ctx.owner, ctx.repo, pr.number, found.headRefName, { signal })) {
         return { problem: `the branch of #${pr.number} could not be verified in this repository; a fork's branch cannot be recorded` };
     }
-    return { branch: found.headRefName };
+    return { url, branch: found.headRefName, ...(found.baseRefName ? { base: found.baseRefName } : {}) };
 }
 const PREVIEW_COMMAND = { type: 'object', additionalProperties: false, required: ['command'], properties: {
         command: { type: 'string', minLength: 1, description: 'A command of the repository\'s own scripts or tools, without cd.' },
@@ -518,10 +536,13 @@ export async function verifyLocalPreview(input, root, signal, sandbox) {
         scratch = await realpath(await mkdtemp(join('/tmp', 'impeccable-preview-')));
         const snapshot = join(scratch, 'checkout'), home = join(scratch, 'home'), temp = join(scratch, 'tmp');
         await Promise.all([snapshot, home, temp].map((p) => mkdir(p, { mode: 0o700 })));
-        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it.
+        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it. Without one they would run the repository's code with all the person's access, so the check refuses; only the tests, which hand over no sandbox, run them plain.
         const inSandbox = sandbox?.preview(scratch);
+        if (sandbox && !inSandbox)
+            return fail('environment', 'Local preview verification needs a sandbox of its own, and this machine has none for it (Linux, or --no-sandbox): save the build the repository names, leave its proof to the preview job on the pull request, and say so under what is not verified.');
         const confined = (command, processEnv) => inSandbox?.(command, processEnv) ?? { file: '/bin/sh', args: ['-c', command], env: processEnv };
-        env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
+        // Built afresh rather than from process.env, so it carries Windows' guard against a git.exe in the checkout itself (IMP-23), after what the model supplied.
+        env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), NoDefaultCurrentDirectoryInExePath: '1', HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
         const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true, 120_000, signal ?? null, gitEnvironment(env));
         if (!listing.ok)
             return fail(stage, 'Could not list checkout files.');
@@ -771,6 +792,27 @@ export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
         return err.code === 1 ? false : null;
     }
 }
+/**
+ * What the pushed `head` changes against `base`, as their remote-tracking refs in this checkout show GitHub: each file's
+ * `git diff --name-status` letter and its path as it is, never quoted; a rename as a removal and an addition. Null when either ref is missing or git fails.
+ */
+export async function pushedChanges(cwd, base, head) {
+    try {
+        // The two branches as the remote has them, fetched so the diff can be read here: refs/remotes/origin/* sit in the checkout's git folder, where a command in the sandbox can move them.
+        const refs = [`refs/heads/${base}`, `refs/heads/${head}`];
+        const { stdout: heads } = await execFileAsync('git', ['ls-remote', '--heads', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const sha = new Map(heads.split('\n').filter(Boolean).map((line) => line.split('\t').reverse()));
+        if (!refs.every((ref) => sha.has(ref)))
+            return null;
+        await execFileAsync('git', ['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const { stdout } = await execFileAsync('git', ['diff', '-z', '--name-status', '--no-renames', `${sha.get(refs[0])}...${sha.get(refs[1])}`], { cwd, timeout: 10_000, env: gitEnvironment() });
+        const fields = stdout.split('\0');
+        return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
+    }
+    catch {
+        return null;
+    }
+}
 const LIMIT = 20;
 const WORKFLOW = '.github/workflows/impeccable-preview.yml';
 const STATUSES = ['queued', 'requested', 'waiting', 'pending', 'in_progress', 'completed'];
@@ -1437,7 +1479,7 @@ export function createTools(ctx) {
      * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
      * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
      */
-    async function awaitBuild(host, status, read, built, page, signal) {
+    async function awaitBuild(host, status, read, built, page, signal, access) {
         const first = await read();
         if (built(first))
             return first;
@@ -1455,7 +1497,15 @@ export function createTools(ctx) {
             }
             return evidence;
         };
-        // No build in the time: the host's page where a build is turned on, and the wait again on the person's yes.
+        // No build in the time: the host's page where a build is turned on, and the wait again on the person's yes. Where the host's settings build every
+        // branch and still none came, its GitHub app cannot see the repository: the app's installation page instead, at once when the app is not installed at all.
+        if (access) {
+            return onHostPage(`${host.toLowerCase()}-app-access`, () => access.page, (e) => !built(e), access.now ? first : await waited(first), async () => waited(await read()), {
+                skipped: `The person skipped giving ${host}'s GitHub app access to the repository.`,
+                still: `${host}'s GitHub app still cannot see the repository: no build came.`,
+                stopped: `The run stopped while ${host}'s build was waited for.`,
+            }, signal);
+        }
         return onHostPage(`${host.toLowerCase()}-build`, page, (e) => !built(e), await waited(first), async () => waited(await read()), {
             skipped: `The person stopped waiting for ${host}'s build.`,
             still: `${host} built no preview in the time.`,
@@ -1495,6 +1545,14 @@ export function createTools(ctx) {
     let accessStored = false;
     /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
     let accessOutcome;
+    /** What each host's settings last said of its pull-request previews, as the evidence tools read them: the one fact impeccable_enable_previews acts on. */
+    const previewFacts = new Map();
+    /** What impeccable_enable_previews answered for a host: asked once, so that answer stands. */
+    const enableOutcomes = new Map();
+    /** Cloudflare's plain evidence as last read: the project, the Worker and the GitHub app facts impeccable_cloudflare_connect and the wait for a build act on. */
+    let cloudflareEvidence;
+    /** What impeccable_cloudflare_connect answered: asked once, so that answer stands. */
+    let connectOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
     const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer();
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
@@ -1554,7 +1612,7 @@ export function createTools(ctx) {
         ctx.sync.update({ phase: 'running', question: null });
         return answer;
     };
-    /** Each host's sign-in this run: confirmed on its screen, or found signed in already, so the screen shows once; skipped, so nothing more is asked for that host. */
+    /** Each host's sign-in this run: confirmed on its screen, so the screen shows once; skipped, so nothing more is asked for that host. */
     const hostSignIns = new Map();
     /** The teams a host's sign-in offered, each by name and slug: the choices a `<host>-team` question shows, whatever the model lists, so the pick the fence takes is a slug. */
     const teamChoices = new Map();
@@ -1567,7 +1625,21 @@ export function createTools(ctx) {
     const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
     /** The Vercel project and the Netlify site this run set up, by name, for the pages of theirs a screen opens. */
     let vercelProject;
+    /** The repository a Vercel project the link file names must be connected to before the run changes it or sends its secret anywhere. */
+    const repository = `${ctx.owner}/${ctx.repo}`;
     let netlifySite;
+    /** The live app's addresses, by origin: those the host tools answered as `production`, each with its host and, on Netlify, its site, so a custom domain's lock is known and the site's key goes with it; and those a proof opened with this app, the only ones impeccable_write saves as the before. */
+    const productionListed = new Map();
+    const provenLive = new Set();
+    /** The linked Vercel project's production address, read from Vercel, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
+    let vercelProduction;
+    /** The project whose bypass secret is in hand, by the link it was read or made on. */
+    let bypassProject;
+    /** A host tool answered the live app's address: the proof may open it as the before, with the host's key where the lock is the same site's or project's. */
+    const noteProduction = (production, host, site) => {
+        if (production && URL.canParse(production))
+            productionListed.set(new URL(production).origin, { host, ...(site ? { site } : {}) });
+    };
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
         const cli = runner();
@@ -1592,16 +1664,16 @@ export function createTools(ctx) {
         };
     };
     /**
-     * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: a CLI signed in already opens the setup with no
-     * screen; else the sign-in screen once, and on its yes the CLI's login in the browser, checked with the CLI, a retry
-     * screen when it did not complete, and after two failed retries a skip. The fence opens on the sign-in found or
-     * completed (and on the yes for the CLI's install alone): never on anything the model writes.
+     * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: the setup screen once, worded for a CLI signed in
+     * already (the yes opens the setup with that sign-in, and no login runs) or for one signed out, and on its yes the
+     * CLI's login in the browser, checked with the CLI, a retry screen when it did not complete, and after two failed
+     * retries a skip. The fence opens on the yes, once the sign-in is found or completed (and on the yes for the CLI's
+     * install alone): never on anything the model writes, and never on a sign-in alone.
      */
     async function hostSignIn(host, pi, signal) {
         const cli = hostCli(host, pi, signal);
         const signedIn = async () => {
             agreeToHostSetup(ctx.log, `${host}-setup`);
-            hostSignIns.set(host, 'confirmed');
             const { team, choices } = await cli.team();
             if (team)
                 chooseHostTeam(ctx.log, `${host}-team`, team);
@@ -1611,16 +1683,16 @@ export function createTools(ctx) {
         if (hostSignIns.get(host) === 'skipped')
             return { skipped: true };
         let status = await cli.status();
-        if (status.cli === 'signed-in')
-            return signedIn();
         if (!hostSignIns.has(host)) {
-            const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`] });
+            const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`], ...(status.cli === 'signed-in' ? HOST_SIGNED_IN[`${host}-setup`] : {}) });
             if (answer.skipped) {
                 endSetup(host);
                 return { skipped: true };
             }
             hostSignIns.set(host, 'confirmed');
         }
+        if (status.cli === 'signed-in')
+            return signedIn();
         // The CLI is installed through the fence's package-manager rule, which this yes opens; then this is asked again.
         if (status.cli === 'missing') {
             agreeToHostSetup(ctx.log, `${host}-setup`);
@@ -1687,44 +1759,71 @@ export function createTools(ctx) {
         const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
         const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
-        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, settings, signal, ...(clone ? { wait: clone } : {}) });
+        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}) });
         netlifySite = result.site?.name ?? netlifySite;
+        if (result.pullRequestPreviews)
+            previewFacts.set('netlify', result.pullRequestPreviews);
         // A build every 30 s until one reads the repository: the person is giving the app access meanwhile.
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
-            ? { connected: true, site: result.site, how: 'github-app' } : result), signal);
+            ? { connected: true, site: result.site, how: 'github-app', ...(result.pullRequestPreviews ? { pullRequestPreviews: result.pullRequestPreviews } : {}) } : result), signal);
     }
     /**
-     * The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked
-     * when Vercel's GitHub app cannot reach the repository; then, connected, the project locked behind Vercel's login at
-     * every address while it has no production deployment, before anything is pushed: Vercel makes a new project's first
-     * deployment Production whatever branch it builds, and serves it at the project's own address.
+     * The connection of the linked Vercel project with this repository, `vercel git connect`, for a project this run's own
+     * `vercel project add` made and `vercel link` linked (the link file alone, which the agent can write, proves nothing;
+     * the link alone links an existing project of the folder's name, which may be one of the person's: that one is left
+     * as it is), or one connected to this repository already, with the app's access asked when Vercel's GitHub app
+     * cannot reach the repository; then, connected, the project locked behind Vercel's login at every address while it
+     * has no production deployment, before anything is pushed: Vercel makes a new project's first deployment Production
+     * whatever branch it builds, and serves it at the project's own address.
      */
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
         const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+        const link = await readLink(pi.cwd);
+        if (!link)
+            return { connected: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        // The link file is the agent's to write: only one the run's own vercel link wrote, project and team alike, says which project the reads below are of. Any other holds the push, since what it would build cannot be told.
+        const own = linkedByRun(ctx.log).get(link.projectId);
+        if (!own || own.orgId !== link.orgId)
+            return { connected: false, reason: "This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team): nothing was connected, and the push stays held. vercel link --yes, on its own, links the project of the folder's name again; else the Vercel setup ends here, and the person removes or relinks the file." };
+        // Read before the connection, which is what would change the project: whether it is this run's. The read after it is another, since the connection sets the production branch.
+        const project = await readLinkedProject(vercel, link);
+        // A project Vercel has no record of, or one the CLI cannot read, may still be one that builds a push: the hold stands, by design.
+        if (project === 'missing')
+            return { connected: false, reason: 'The project this folder is linked to no longer exists on Vercel, as far as the CLI can tell (.vercel/project.json is stale): nothing was connected, and the push stays held. vercel link --yes, on its own, links the project of the folder\'s name again; else the Vercel setup ends here, and the person removes or relinks the file.' };
+        if (!project)
+            return { connected: false, reason: 'The Vercel CLI could not read the linked project (vercel api), so whether this run created it is unknown: nothing was connected, and the push stays held.' };
+        // A project connected to this repository already is this repository's: the connection changes nothing on it, and the lock below is what it gets as the run's own project would.
+        if (project.repository !== repository.toLowerCase()) {
+            const foreign = !(project.name && vercelProjectsAdded(ctx.log).has(`${own.team}/${project.name.toLowerCase()}`)) ? `this run's vercel project add did not make it in ${own.team ? `the team ${own.team}` : 'the personal scope'}, so vercel link linked a project of that name that existed already` : null;
+            if (foreign) {
+                // Nothing builds a push to a repository the project is not connected to, so the push goes; a deploy from here still would build it, and the shell's git connect never runs.
+                settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
+                return { connected: false, reason: `The linked project${project.name ? ` ${project.name}` : ''} is not this run's: ${foreign}. It stays as it is, and nothing was connected. The Vercel setup ends here.` };
+            }
+        }
         // Tried again every 20 s until the app reaches the repository: the person is giving it access meanwhile.
         const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
         // The fence holds pushes and deploys from the sign-in until the linked project's first deployment is settled: Vercel's app cannot reach the repository (a push builds nothing), production is deployed already, or the project is locked at every address.
-        const link = await readLink(pi.cwd);
         if (!result.connected) {
             if (result.access !== undefined)
-                settleVercelFirstDeployment(ctx.log, { projectId: link?.projectId ?? null, how: 'connection' });
+                settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
             return result;
         }
-        let first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        let first = await prepareFirstDeployment(vercel, link, repository);
         vercelProject = first.project ?? vercelProject;
         // Vercel refused the lock: the person turns it on in the project's settings, in this run, and the read sees it.
-        if (link && first.production === 'none' && !first.locked) {
+        if (first.production === 'none' && !first.locked) {
             const page = vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), vercelProject);
-            first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
+            first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, repository, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
                 waiting: "Waiting for Vercel's login on the project",
                 skipped: 'The person skipped locking the Vercel project.',
                 still: "Vercel's login is still not in front of the project's addresses.",
                 stopped: 'The run stopped while the lock was waited for.',
             }, signal);
         }
-        if (link && (first.production === 'exists' || first.locked === true))
+        if (first.production === 'exists' || first.locked === true)
             settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'project' });
         return { ...result, ...first };
     }
@@ -1892,6 +1991,10 @@ export function createTools(ctx) {
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
                 return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify or Cloudflare Pages preview. Nothing was saved.';
             }
+            // The before is the live app's address, and only one a proof opened with this app: an address no key opens is not set, and one the person saved is never cleared from here.
+            if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
+                return "Refused: beforeUrl is the live app's address that impeccable_prove_preview opened with this app in this run (the production address a host tool answered, or the one the README names), or a page on it; an address no key opens is not set, and a saved one is never cleared from here. Nothing was saved.";
+            }
             const testAccounts = target.url.endsWith('/test-accounts');
             let body = p.body;
             if (testAccounts) {
@@ -1998,7 +2101,7 @@ export function createTools(ctx) {
             reportTasks(tasks);
             return 'Saved.';
         }),
-        tool('impeccable_test_pr', 'Record the pull requests', 'Record the test drive as soon as it is open, so the web page follows its review, and again with setup_pr once the setup pull request is open. Each must be an open pull request from this repository\'s own impeccable/ branch; the setup pull request, once recorded, cannot change.', TEST_PR, async (p, _pi, signal) => {
+        tool('impeccable_test_pr', 'Record the pull requests', 'Record the test drive as soon as it is open, so the web page follows its review, and again with setup_pr once the setup pull request is open. Each must be an open pull request from this repository\'s own impeccable/ branch, the test drive\'s also changing the existing page that links to it; the setup pull request, once recorded, cannot change.', TEST_PR, async (p, pi, signal) => {
             const drive = { number: p.number, url: p.url.trim() };
             const given = p.setup_pr;
             const setup = given && { number: given.number, url: given.url.trim() };
@@ -2007,19 +2110,28 @@ export function createTools(ctx) {
             const found = await runPullRequest(ctx, drive, 'impeccable/test-drive', signal);
             if ('problem' in found)
                 return `Refused: ${found.problem}.`;
-            let setupBranch = recordedBranches?.setup;
+            drive.url = found.url;
+            // The page that links to the test drive is an existing file the branch changes; files under dot folders (.github, .netlify) and dotfiles never link to it (#241).
+            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch) : null;
+            const files = (changes ?? []).filter(({ path }) => !path.split('/').some((part) => part.startsWith('.')));
+            if (files.length && files.every(({ status }) => status === 'A')) {
+                return `Refused: ${found.branch} only adds ${files.map(({ path }) => path).join(', ')} and changes no existing page, so nothing links to the test drive. Commit the page that links to it and push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
+            }
+            let setupBranch = recordedBranches?.setup, setupBase = recordedBranches?.setupBase;
             if (setup) {
                 // The setup pull request carries the preview attempts, so its binding cannot change.
                 const head = await runPullRequest(ctx, setup, 'impeccable/setup', signal);
                 if ('problem' in head)
                     return `Refused: ${head.problem}.`;
+                setup.url = head.url;
                 const bound = bindPreviewPullRequest(retry, { ...setup, branch: head.branch });
                 if (bound.verdict !== 'allow')
                     return `Refused: ${bound.reason}.`;
                 setupBranch = head.branch;
+                setupBase = head.base;
             }
             ctx.sync.update({ test_pr: drive, ...(setup ? { setup_pr: setup } : {}) });
-            recordedBranches = { drive: found.branch, setup: setupBranch };
+            recordedBranches = { drive: found.branch, setup: setupBranch, setupBase };
             const res = await ctx.sync.flush();
             const what = `the test drive #${drive.number}${setup ? ` and the setup pull request #${setup.number}` : ''}`;
             return res?.ok
@@ -2031,11 +2143,22 @@ export function createTools(ctx) {
             const long = left.find((line) => line.length > STATUS_MAX);
             if (long)
                 return `Refused: "${long}" is longer than ${STATUS_MAX} characters. Each line of "left" is one short line the person can act on; the detail belongs in the report. Nothing was saved: call impeccable_report again.`;
+            const control = left.find((line) => plainText(line) !== line);
+            if (control)
+                return `Refused: "${control}" holds a control character or an escape sequence. Each line of "left" is plain text. Nothing was saved: call impeccable_report again.`;
             // The web page keeps the task list as the report leaves it, so no task may still read as waiting or running (#83).
             const open = ctx.sync.payload.tasks.filter((t) => !t.id.startsWith('preview-attempt-') && (t.status === 'pending' || t.status === 'in_progress'));
             if (open.length)
                 return `Refused: the task list still shows ${open.map((t) => `"${t.title}" as ${t.status.replace('_', ' ')}`).join(', ')}. Call impeccable_progress with every task's final status (completed, skipped or failed), then impeccable_report again. Nothing was saved.`;
             let markdown = p.markdown;
+            // The files the setup pull request carries, so one the setup never meant to change stands out: a sandboxed script writes in the checkout too.
+            if (recordedBranches?.setup) {
+                const changes = recordedBranches.setupBase ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, recordedBranches.setupBase, recordedBranches.setup) : null;
+                const verbs = { A: 'added', M: 'changed', D: 'removed' };
+                // A file name is git's to give: one with Markdown in it, or a line break, stays one plain entry.
+                const shown = (path) => path.replace(/[\\`*_[\]<>|~]/g, '\\$&').replace(/[\x00-\x1f\x7f]/g, (c) => JSON.stringify(c).slice(1, -1));
+                markdown += `\n\n## What the setup pull request changes\n\n${changes ? changes.map(({ status, path }) => `- ${shown(path)} (${verbs[status] ?? status})`).join('\n') || 'Nothing: it carries no file.' : 'This checkout could not list its files: read them on the pull request before merging.'}`;
+            }
             if (previews.active && retry.pr) {
                 await observe(signal);
                 const lines = attempts().map((a, i) => `${i + 1}. [Attempt ${i + 1}](${a.url}) (run attempt ${a.attempt}): ${a.status}. ${a.diagnostics.map((d) => `${d.appKey}: step ${d.stage ?? 'unverified'}. ${d.reason}`).join(' ')}${a.changes.length ? ` Changed settings: ${a.changes.join(', ')}.` : ''}`);
@@ -2064,7 +2187,7 @@ export function createTools(ctx) {
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
-        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. Without branch, where GitHub records a production deployment Vercel made and this folder is linked to the project (.vercel/project.json) the Vercel CLI reads as this repository\'s, production is the live app\'s address, the project\'s own domain, for the before. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
             const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
             // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
@@ -2087,7 +2210,7 @@ export function createTools(ctx) {
                 if (branch !== undefined && !isPreview(d)) {
                     locked ??= await (async () => {
                         const link = await readLink(pi.cwd);
-                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link) : new Set();
+                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link, repository) : new Set();
                     })();
                     if (!locked.has(url.host)) {
                         publicProduction.add(url.origin);
@@ -2098,9 +2221,36 @@ export function createTools(ctx) {
                 if (d.vercel)
                     vercelMade.add(url.origin);
             }
-            return JSON.stringify(evidence);
+            // What vercel.json and the linked project say of the test drive's branch rides with the plain evidence, never with a wait: reported, never changed.
+            // The fact and the live app read the same linked project: one `vercel api` call answers both.
+            const reads = new Map();
+            const vercel = (args) => {
+                const key = JSON.stringify(args);
+                if (!reads.has(key))
+                    reads.set(key, (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal })(args));
+                return reads.get(key);
+            };
+            if (branch === undefined) {
+                const fact = await (ctx.vercelPreviewsReader ?? vercelPreviewsFact)(pi.cwd, `${ctx.owner}/${ctx.repo}`, () => vercel);
+                if (fact) {
+                    previewFacts.set('vercel', fact);
+                    evidence.pullRequestPreviews = fact;
+                }
+            }
+            // The live app, where GitHub's record shows a production deployment Vercel made: its own address there is behind Vercel's login under Standard Protection, so the
+            // linked project is read for its alias, the project's own domain, and only as this repository's project.
+            let production;
+            if (branch === undefined && evidence.deployments.some((d) => d.vercel && d.state === 'success' && !isPreview(d))) {
+                const link = await readLink(pi.cwd);
+                const project = link ? await readOwnProject(vercel, link, repository) : null;
+                production = project && !('reason' in project) ? project.productionUrl : undefined;
+                if (production && link)
+                    vercelProduction = { origin: new URL(production).origin, projectId: link.projectId };
+                noteProduction(production, 'vercel');
+            }
+            return JSON.stringify({ ...evidence, ...(production ? { production } : {}) });
         }),
-        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
@@ -2116,9 +2266,12 @@ export function createTools(ctx) {
             for (const p of evidence.previews)
                 if (p.state === 'success' || p.state === 'ready')
                     netlifyListed.add(new URL(p.url).origin);
+            if (evidence.pullRequestPreviews)
+                previewFacts.set('netlify', evidence.pullRequestPreviews);
+            noteProduction(evidence.production, 'netlify', liveSite(evidence));
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -2128,7 +2281,14 @@ export function createTools(ctx) {
             // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
             const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
             const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
-            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal) : await read();
+            // A pushed branch of a project connected with previews on that gets no build: Cloudflare's GitHub app cannot see the repository (its installation covers selected ones, or none),
+            // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
+            const app = cloudflareEvidence?.githubApp;
+            const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false } : undefined;
+            const waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
+            if (!subject)
+                cloudflareEvidence = evidence;
             cloudflareListed.clear();
             for (const preview of evidence.previews) {
                 if (preview.state !== 'success')
@@ -2137,24 +2297,40 @@ export function createTools(ctx) {
                 if (preview.alias)
                     cloudflareListed.add(new URL(preview.alias).origin);
             }
+            if (evidence.pullRequestPreviews)
+                previewFacts.set('cloudflare', evidence.pullRequestPreviews);
+            noteProduction(evidence.production, 'cloudflare');
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
-            if (URL.canParse(url) && publicProduction.has(new URL(url).origin))
+            const origin = URL.canParse(url) ? new URL(url).origin : null;
+            if (origin && publicProduction.has(origin))
                 return "Refused: Vercel called this deployment Production, as it calls a project's first whatever branch it builds, and no project of this folder's that is locked at every address made it, so it is served at a project's own address without a login: it is no preview, and nothing was opened. No test drive, as the vercel-setup case says.";
-            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin) || cloudflareListed.has(new URL(url).origin)))
-                return 'Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it.';
-            const site = netlifySiteOf(url);
+            const listed = origin !== null && (listedPreviews.has(origin) || netlifyListed.has(origin) || cloudflareListed.has(origin));
+            // The live app's address, for the before: one a host tool answered as production, or one a file the checkout tracks names, such as the README's live-site line, when it is the site's or project's own address on one of the hosts: a deploy preview or branch alias a file links stays a preview, listed or not, and an address elsewhere, which could be on the person's own network, is only a host tool's to name.
+            const known = origin !== null ? productionListed.get(origin) : undefined;
+            const live = origin !== null && !listed && (known !== undefined || (liveShaped(url) && (await checkoutNames(pi.cwd, origin))));
+            if (!origin || (!listed && !live))
+                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
+            // The Netlify site, by the address's shape or, for the site's custom domain, as its tool named it: its password goes to the site's own addresses.
+            const site = netlifySiteOf(url) ?? known?.site;
             // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
-            const project = pagesProject(new URL(url).origin);
+            const project = pagesProject(origin);
             const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
             const proof = await provePreview(url, p.expect, pi.cwd, {
-                fetch: ctx.previewFetch, signal,
-                ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}),
+                fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
+                // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
+                ...(bypassSecret && (bypassOrigins.has(origin) || (live && origin === vercelProduction?.origin && vercelProduction.projectId === bypassProject)) ? { bypass: bypassSecret } : {}),
                 ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
                 ...(token ? { access: token } : {}),
             });
+            // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
+            if (live) {
+                if (proof.proven)
+                    provenLive.add(origin);
+                return JSON.stringify(proof);
+            }
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
@@ -2166,7 +2342,7 @@ export function createTools(ctx) {
                 accessGated = { url, expect: p.expect };
             return JSON.stringify(proof);
         }),
-        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
+        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
             const command = p.command;
             const publish = p.publish;
             if (command !== undefined && (command.length > 200 || /[\r\n\0]/.test(command)))
@@ -2175,15 +2351,145 @@ export function createTools(ctx) {
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
             return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
         }),
-        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
-        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_enable_previews', 'Pull-request previews', "Turn on previews of pull requests on the host that builds this repository but not its pull requests, as pullRequestPreviews in the answer of impeccable_netlify_previews, impeccable_netlify_connect or impeccable_cloudflare_previews said (enabled false). It does the rest as the person: one screen asking to turn them on, then the host's CLI changes that one setting (Netlify: Deploy Previews on; Cloudflare Pages: preview branch control set to every non-production branch, or the test drive's branch added to the custom includes) and reads it back; where the CLI cannot (the role, a cf sign-in without pages:write, builds stopped altogether), it opens the host's settings page and asks the person to try again once they changed it there. Answers {\"status\": …}: enabled (pull-request previews are on now; by says whether the run or the person turned them on, and project which project or site), skipped (the person skipped a screen; reason says what came before) or refused (still off after the retries; reason says why, and page where it is changed). Vercel builds every branch once Git is connected, so its fact is reported and never changed here.", ENABLE_PREVIEWS, async (p, pi, signal) => {
+            const host = p.host;
+            const standing = enableOutcomes.get(host);
+            if (standing)
+                return JSON.stringify(standing);
+            const fact = previewFacts.get(host);
+            if (!fact || fact.enabled !== false)
+                return `Refused: this is for a host whose pullRequestPreviews said enabled false in this run. Read ${host === 'netlify' ? 'impeccable_netlify_previews or impeccable_netlify_connect' : 'impeccable_cloudflare_previews'} first.`;
+            if (host === 'cloudflare' && fact.cause === 'source')
+                return `Refused: the Pages project ${fact.project} is connected to no repository, so there is no setting to turn on. impeccable_cloudflare_connect connects it.`;
+            const name = host === 'netlify' ? 'Netlify' : 'Cloudflare Pages';
+            const answer = (status, more) => {
+                const told = { status, project: fact.project, ...more };
+                enableOutcomes.set(host, told);
+                return JSON.stringify(told);
+            };
+            const screen = HOST_SCREENS[`${host}-previews`];
+            if ((await ask({ ...screen, prompt: `Turn on pull-request previews for ${fact.project}?` })).skipped)
+                return answer('skipped', { reason: 'The person skipped turning pull-request previews on.' });
+            said(`Turning on pull-request previews on ${name}`);
+            const turnOn = async () => {
+                if (host === 'netlify')
+                    return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
+                const cf = cfRunner({}, ctx.hostRunner);
+                return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
+            };
+            // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
+            for (let tries = 0;; tries++) {
+                const outcome = await turnOn();
+                if (outcome.fact.enabled === true) {
+                    previewFacts.set(host, outcome.fact);
+                    return answer('enabled', { by: outcome.changed ? 'run' : 'person' });
+                }
+                const why = outcome.reason ?? outcome.fact.reason;
+                if (tries === 2 || signal?.aborted)
+                    return answer('refused', { reason: why, page: outcome.page });
+                const retry = HOST_SCREENS[`${host}-previews-retry`];
+                // The host's page opens once, before the first retry screen, which speaks of it; the browser may not have opened (BROWSER=none, no opener), so the address is on the screen as well.
+                if (tries === 0)
+                    (ctx.openBrowser ?? openBrowser)(outcome.page);
+                if ((await ask({ ...retry, hint: `${retry.hint} If it did not open, open this link: ${outcome.page}` })).skipped)
+                    return answer('skipped', { reason: why, page: outcome.page });
+            }
+        }),
+        tool('impeccable_cloudflare_connect', 'Connect the repository to Cloudflare Pages', "Connect this repository to a Cloudflare Pages project, so that Cloudflare builds every pull request as a preview, where impeccable_cloudflare_previews found no Pages project building them: the project the checkout names when it exists with no Git source (pullRequestPreviews with cause source), else a new one named after the repository where Cloudflare builds a Worker from it (worker in the answer) or the checkout is set up for a Pages project that does not exist yet. It does the rest as the person: one screen asking to connect or to create (Cloudflare's sign-in in the browser first, with a retry, where cf is not signed in here with pages:write), then cf creates the project with the build the checkout runs (command and outputDir, for a new project) and connects the repository as GitHub identifies it, every branch but the default a preview, and reads it back. Answers {\"status\": …}: connected (project names the Pages project, created whether the run made it, subdomain its own address under pages.dev, productionBranch the branch Cloudflare builds as production; pullRequestPreviews is on now), skipped (the person skipped a screen; reason says which) or refused (cf could not, or Cloudflare refused; reason says why). Cloudflare's GitHub app then has to see the repository for a push to build: the wait for the test drive's build asks for its access when none comes.", CLOUDFLARE_CONNECT, async (p, pi, signal) => {
+            if (connectOutcome)
+                return JSON.stringify(connectOutcome);
+            const evidence = cloudflareEvidence;
+            if (!evidence)
+                return 'Refused: read impeccable_cloudflare_previews first: it says whether a Pages project builds this repository.';
+            const fact = evidence.pullRequestPreviews;
+            if (fact && fact.enabled !== false)
+                return `Refused: the Pages project ${fact.project} is connected to the repository already${fact.enabled === true ? ' and builds its pull requests' : ''}.`;
+            if (fact && fact.cause !== 'source')
+                return `Refused: the Pages project ${fact.project} is connected to the repository, and its settings turn pull-request previews off: impeccable_enable_previews turns them on.`;
+            const create = !fact;
+            if (create && !evidence.worker && !evidence.project)
+                return 'Refused: nothing says the repository is set up for Cloudflare: no Pages project is built from it, the checkout names none, and no Worker is built from it. Set the preview up as the server-previews or static-site case says.';
+            const project = fact?.project || evidence.project || pagesProjectName(ctx.repo);
+            const answer = (status, more) => {
+                connectOutcome = { status, project, created: create, ...more };
+                return JSON.stringify(connectOutcome);
+            };
+            // The one screen: the connection of the project named, or the new project for the repository.
+            const screen = HOST_SCREENS[create ? 'cloudflare-create' : 'cloudflare-connect'];
+            if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
+                return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
+            // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
+            const cf = cfRunner({}, ctx.hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner);
+            const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
+            let status = await cfStatus(cf, signal);
+            if (!writes(status)) {
+                if (status.cli === 'missing' || status.cli === 'unknown')
+                    return answer('refused', { reason: "Cloudflare's CLI did not run here." });
+                if ((await ask(HOST_SCREENS['cloudflare-setup'])).skipped)
+                    return answer('skipped', { reason: 'The person skipped the Cloudflare sign-in.' });
+                for (let attempt = 0;; attempt++) {
+                    said("Opening the browser for Cloudflare's login");
+                    const scopes = [...new Set([...(status.scopes ?? []).filter((scope) => scope !== 'offline_access'), 'account:read', 'user:read', 'pages:write'])];
+                    await login(['auth', 'login', '--force', '--no-device', '--scopes', ...scopes], { signal }).catch(() => undefined);
+                    signal?.throwIfAborted();
+                    status = await cfStatus(cf, signal);
+                    if (writes(status))
+                        break;
+                    if (status.cli === 'signed-in')
+                        return answer('refused', { reason: 'The Cloudflare sign-in gave the run no pages:write.' });
+                    if (attempt === 2)
+                        return answer('refused', { reason: 'The Cloudflare sign-in did not complete.' });
+                    if ((await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped)
+                        return answer('skipped', { reason: 'The person skipped the Cloudflare sign-in.' });
+                }
+            }
+            said(create ? `Creating the Pages project ${project}` : `Connecting the repository to ${project}`);
+            const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
+            const outcome = await connectCloudflareProject(cf, gh, status, { owner: ctx.owner, repo: ctx.repo }, { project, ...(evidence.account ? { account: evidence.account } : {}), ...(create ? { create: { command: p.command, outputDir: p.outputDir } } : {}) }, signal);
+            if (outcome.status !== 'connected')
+                return answer('refused', { reason: outcome.reason });
+            if (outcome.fact)
+                previewFacts.set('cloudflare', outcome.fact);
+            cloudflareEvidence = { ...evidence, project, ...(outcome.fact ? { pullRequestPreviews: outcome.fact } : {}) };
+            return answer('connected', { created: outcome.created, ...(outcome.subdomain ? { subdomain: outcome.subdomain } : {}), ...(outcome.productionBranch ? { productionBranch: outcome.productionBranch } : {}) });
+        }),
+        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet. Only a project this run made with vercel project add and linked with vercel link, or one connected to this repository already, is connected: a project that existed before the run (vercel link links an existing project of the folder's name) is left as it is, with the reason, and the Vercel setup ends there. Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing; with production \"exists\", productionUrl is the live app's address, for the before. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => {
+            const answer = await vercelConnect(pi, signal);
+            // A project that deploys production already names the live app's address, for the before.
+            const link = answer.productionUrl ? await readLink(pi.cwd) : null;
+            if (answer.productionUrl && link)
+                vercelProduction = { origin: new URL(answer.productionUrl).origin, projectId: link.projectId };
+            noteProduction(answer.productionUrl, 'vercel');
+            return JSON.stringify(answer);
+        }),
+        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts) and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
             if (bypassOutcome?.status === 'skipped')
                 return JSON.stringify(bypassOutcome);
             const at = gated;
-            const origin = new URL(at.url).origin;
-            // A secret in hand already: an address of the same project opens with it, and no other project's does.
+            const { origin, host } = new URL(at.url);
+            // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project the
+            // link file names, read as the person and connected to this repository, has to have made the deployment before any secret of it goes there.
+            const link = await readLink(pi.cwd);
+            if (!link)
+                return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and a bypass secret goes only to a preview the linked project serves.`;
+            // Once this run's own vercel link wrote the file, only that link counts, as impeccable_vercel_connect holds it: rewritten since, it would name another project of the person's. A project the person linked before the run has no such record, and the reads below vouch for it.
+            const links = linkedByRun(ctx.log);
+            const own = links.get(link.projectId);
+            if ([...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
+                return `Refused: nothing was sent to ${at.url}. This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.`;
+            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+            const project = await readOwnProject(vercel, link, repository);
+            if ('reason' in project)
+                return `Refused: nothing was sent to ${at.url}. ${project.reason} A bypass secret goes only to a preview the linked project serves.`;
+            // The page at the address is the deployment's to word, whatever host it is on, so the lock is told from the project's settings, read as the person: with none, no login of Vercel's stood in front.
+            if (!project.previewsProtected)
+                return `Refused: nothing was sent to ${at.url}. Vercel's settings show no Deployment Protection on the project${project.name ? ` (${project.name})` : ''}, so what the address answered is the deployment's own page and the sign-in is the app's own: prove a page a visitor opens without signing in. A bypass secret goes only to a preview the linked project serves.`;
+            if (!(await projectMadeDeployment(vercel, link, project, host)))
+                return `Refused: nothing was sent to ${at.url}. The Vercel project this folder is linked to${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview the linked project serves.`;
+            // A secret in hand already: another address of the same project opens with it.
             if (bypassSaved && bypassSecret && (await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: bypassSecret })).proven) {
                 bypassOrigins.add(origin);
                 return JSON.stringify(bypassSaved);
@@ -2191,13 +2497,13 @@ export function createTools(ctx) {
             /** The store took this attempt's secret: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
             const { value, ...told } = await passVercelLogin({
-                run: (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }),
-                link: () => readLink(pi.cwd),
-                consent: async () => !(await ask(HOST_SCREENS['vercel-bypass'])).skipped,
+                run: vercel,
+                link: async () => link,
+                consent: async () => !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
                 paste: async () => {
-                    // The locked preview may be another project's than the one this run connected, so the person picks the project.
-                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection'));
-                    const answer = await ask(HOST_SCREENS['vercel-bypass-key']);
+                    // The linked project's own settings page, in its team where the run knows it; else Vercel's picker.
+                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), project.name));
+                    const answer = await ask(sentTo(HOST_SCREENS['vercel-bypass-key'], at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
@@ -2212,6 +2518,7 @@ export function createTools(ctx) {
             if (value) {
                 // What is in hand follows the store: a new secret is the one saved now, and the origins the last one opened no longer stand.
                 bypassSecret = value;
+                bypassProject = link.projectId;
                 bypassOrigins.clear();
                 bypassOrigins.add(origin);
                 hostedPreviewProven = true;
@@ -2221,12 +2528,13 @@ export function createTools(ctx) {
             else if (told.status === 'save-failed' && stored) {
                 // The store holds the secret this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through. A store the attempt never changed keeps the earlier one good.
                 bypassSecret = undefined;
+                bypassProject = undefined;
                 bypassOrigins.clear();
                 bypassSaved = undefined;
             }
             return JSON.stringify(bypassOutcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
@@ -2261,7 +2569,7 @@ export function createTools(ctx) {
                 run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
                 site,
                 consent: async () => {
-                    if (passwordConsented.has(site) || !(await ask(HOST_SCREENS['netlify-password'])).skipped)
+                    if (passwordConsented.has(site) || !(await ask(sentTo(HOST_SCREENS['netlify-password'], at.url))).skipped)
                         return passwordConsented.add(site), true;
                     return false;
                 },
@@ -2281,7 +2589,7 @@ export function createTools(ctx) {
                     return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
                 },
                 paste: async () => {
-                    const answer = await ask(HOST_SCREENS['netlify-password-key']);
+                    const answer = await ask(sentTo(HOST_SCREENS['netlify-password-key'], at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove,
@@ -2319,7 +2627,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(passwordOutcome);
         }),
-        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
             if (accessOutcome?.status === 'skipped')
@@ -2341,7 +2649,9 @@ export function createTools(ctx) {
                 return null;
             };
             let answer;
-            if (accessToken && (await prove(accessToken)).proven) {
+            const project = pagesProject(new URL(at.url).origin);
+            // The token in hand goes only to a project it opened already, as the proofs send it: any other address is read for an application of the person's first.
+            if (accessToken && project && accessProjects.has(project) && (await prove(accessToken)).proven) {
                 // The token in hand opens this address too: stored already, or stored now.
                 const failed = accessStored ? null : await save(accessToken);
                 answer = { status: failed ? 'save-failed' : 'saved', ...accessMade, ...(failed ? { reason: failed } : {}), value: accessToken };
@@ -2349,7 +2659,7 @@ export function createTools(ctx) {
             else {
                 answer = await passCloudflareAccess({
                     url: at.url,
-                    consent: async () => !(await ask(HOST_SCREENS['cloudflare-access'])).skipped,
+                    consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
                     cf: cfRunner({}, ctx.hostRunner),
                     login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
@@ -2359,7 +2669,7 @@ export function createTools(ctx) {
                         return typed.skipped ? undefined : typed.value;
                     },
                     paste: async () => {
-                        const typed = await ask(HOST_SCREENS['cloudflare-access-key']);
+                        const typed = await ask(sentTo(HOST_SCREENS['cloudflare-access-key'], at.url));
                         return typed.skipped ? undefined : { id: typed.username, secret: typed.password };
                     },
                     prove,
@@ -2377,7 +2687,6 @@ export function createTools(ctx) {
                 accessToken = value;
                 accessStored = told.status === 'saved';
                 accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
-                const project = pagesProject(new URL(at.url).origin);
                 if (project)
                     accessProjects.add(project);
             }