@impeccable/reviews 0.1.6 → 0.1.8

package/dist/fence.js

@@ -1,8 +1,14 @@
 import { execFileSync } from 'node:child_process';
-import { readFileSync, realpathSync, statSync } from 'node:fs';
-import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { constants, existsSync, lstatSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { access, mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { createFindToolDefinition, createGrepToolDefinition, detectSupportedImageMimeTypeFromFile } from '@earendil-works/pi-coding-agent';
+import { linkedNetlifySite } from './netlify.js';
+import { resolveReadPath, resolveToCwd } from './pi-paths.js';
 import { gitEnvironment } from './sandbox.js';
 import { DATA_NOTE, scan, scanRecorder } from './scan.js';
+import { plainText } from './ui/sensitive.js';
 const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
 const deny = (reason) => ({ verdict: 'deny', reason });
 const never = (reason) => ({ verdict: 'never', reason });
@@ -36,7 +42,7 @@ export function parseCommand(command) {
         if (redirect)
             return false;
         if (words.length || redirects.length) {
-            out.push({ words, redirects, certain: (before === '' || before === ';') && after !== '|' });
+            out.push({ words, redirects, certain: (before === '' || before === ';') && after !== '|', before });
             before = after;
         }
         words = [];
@@ -182,13 +188,27 @@ function pathsOf(args) {
     return args.flatMap((a) => (a.startsWith('--') && a.includes('=') ? [a.slice(a.indexOf('=') + 1)] : a.startsWith('-') ? [] : [a]));
 }
 const inside = (args, where) => !pathsOf(args).some((a) => outside(a, where));
+const EXAMPLE_ENDINGS = ['example', 'sample', 'template', 'dist'];
 /** Files named as examples, whose secrets are placeholders. */
-const EXAMPLE = /\.(example|sample|template|dist)$/;
+const EXAMPLE = new RegExp(`\\.(${EXAMPLE_ENDINGS.join('|')})$`);
+/** The .env files' examples, as git's pathspecs, wherever they are in the checkout. */
+const ENV_EXAMPLES = EXAMPLE_ENDINGS.map((end) => `:(top,glob)**/.env*.${end}`);
+/** What a .env file's example is made of, its placeholders: a secret-like name set to a random value, an address's password. A key or a token of a known shape in one is still a live one. */
+const PLACEHOLDER_SHAPES = new Set(['secret-assignment', 'url-password']);
 /** A .env file, or a pattern that can name one, holds live secrets; the examples next to it do not. */
 export function isSecretFile(path) {
     const name = basename(path);
     return name.startsWith('.env') && !EXAMPLE.test(name);
 }
+/** A .env file, or a folder named like one, on a resolved path below the checkout or the scratch folder. */
+function secretOnPath(real, where) {
+    const from = where.scratch && within(real, where.scratch) ? where.scratch : where.root;
+    return relative(from, real).split(/[\\/]/).some(isSecretFile);
+}
+/** A read of a .env file by any name: the name typed, or what it stands for once its symlinks are resolved. */
+function readsSecret(path, where) {
+    return isSecretFile(path) || secretOnPath(realPath(resolve(where.cwd, path)), where);
+}
 function rmRecursiveForce(words) {
     const at = words.indexOf('rm');
     if (at < 0)
@@ -249,41 +269,119 @@ function envProblem(assignment, where) {
 export const EXCLUDE_ENV = ':(exclude,glob)**/.env*';
 /** `git add -A` or `-u`, which stage every change in the checkout, wherever they run, or paths read from a file, which the fence does not see; git takes any start of a long option's name (--al is --all). */
 const addsAll = (args) => (args.includes('--') ? args.slice(0, args.indexOf('--')) : args).some((a) => /^-[^-]*[Au]/.test(a) || (a.length > 2 && a.startsWith('--') && ['all', 'update', 'no-ignore-removal', 'pathspec-from-file'].some((o) => o.startsWith(a.slice(2).split('=')[0]))));
-/** The values of git commit's options that read a file (a message, a template, pathspecs) or a commit, which may name a file (`HEAD:.env`). */
-function commitReads(args) {
-    const values = [];
+/** git commit's options, read as git does: the values that name a file (a message, a template, a pathspec list) and the commits whose message it takes (which may name a file, `HEAD:.env`), whether -a commits every tracked change, and the paths it names. */
+function commitOptions(args) {
+    const files = [], commits = [], paths = [];
+    let all = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
-        if (a === '--')
+        if (a === '--') {
+            paths.push(...args.slice(i + 1));
             break;
+        }
         if (a.startsWith('--')) {
             const eq = a.indexOf('=');
             const name = a.slice(2, eq < 0 ? undefined : eq);
-            if (name === 'message' && eq < 0)
+            const value = () => (eq < 0 ? args[++i] ?? '' : a.slice(eq + 1));
+            if (name && ['file', 'template', 'pathspec-from-file'].some((o) => o.startsWith(name)))
+                files.push(value());
+            else if (name && ['reuse-message', 'reedit-message'].some((o) => o.startsWith(name)))
+                commits.push(value());
+            else if (name === 'all')
+                all = true;
+            // The other options with a value (--message, --author, --date, --fixup…): their value is neither a file nor a path.
+            else if (name && eq < 0 && ['message', 'author', 'date', 'fixup', 'squash', 'trailer', 'cleanup'].some((o) => o.startsWith(name)))
                 i++;
-            else if (name && ['file', 'template', 'reuse-message', 'reedit-message', 'pathspec-from-file'].some((o) => o.startsWith(name)))
-                values.push(eq < 0 ? args[++i] ?? '' : a.slice(eq + 1));
         }
-        else if (a.startsWith('-')) {
+        else if (a.startsWith('-') && a.length > 1) {
             // Short options run together (-qm, -aF file); one that takes a value takes the rest of the word, or the next word.
             for (let j = 1; j < a.length; j++) {
-                if ('uS'.includes(a[j]))
+                const option = a[j];
+                if (option === 'a')
+                    all = true;
+                if ('uS'.includes(option))
                     break;
-                if (!'mFtcC'.includes(a[j]))
+                if (!'mFtcC'.includes(option))
                     continue;
                 const value = a.slice(j + 1) || (args[++i] ?? '');
-                if (a[j] !== 'm')
-                    values.push(value);
+                if (option === 'F' || option === 't')
+                    files.push(value);
+                else if (option !== 'm')
+                    commits.push(value);
                 break;
             }
         }
+        else {
+            paths.push(a);
+        }
+    }
+    return { files, commits, all, paths };
+}
+/** git's words after `git`, from its command on: a leading `--no-pager` dropped; null when another option comes first (`-c`, `-C`, `--git-dir`…), which changes what git runs or where. */
+function gitArgs(args) {
+    const from = args[0] === '--no-pager' ? args.slice(1) : args;
+    return from[0]?.startsWith('-') ? null : from;
+}
+/** Options that print file contents, or pick commits by them (-S, -G, -L), in git diff, log and show. */
+const PATCH = /^-(?!-)[^\d]*[pucmUWLSG]|^--(?:patch|unified|word-diff|color-words|cc$|dd$|remerge-diff|diff-merges|binary|function-context|find-object|pickaxe)/;
+/** Options that print names and counts in place of the patch git diff and show print by default. */
+const NO_PATCH = new Set(['-s', '--no-patch', '--stat', '--numstat', '--shortstat', '--name-only', '--name-status', '--summary', '--dirstat', '--compact-summary', '--raw', '--quiet']);
+/** Whether git diff, log or show prints file contents: diff and show by default (show's `<rev>:<path>` prints that file, checked by name), log with -p and its kin. */
+function printsPatch(sub, args) {
+    const options = args.includes('--') ? args.slice(0, args.indexOf('--')) : args;
+    if (options.some((a) => PATCH.test(a)))
+        return true;
+    if (sub === 'log' || options.some((a) => NO_PATCH.has(a.split('=')[0])))
+        return false;
+    const revisions = options.filter((a) => !a.startsWith('-'));
+    return !(sub === 'show' && revisions.length && revisions.every((a) => a.includes(':')));
+}
+/** The branch a push's refspec updates on the remote: its destination, else its source, without `+` and `refs/heads/` (or `heads/`, which git reads the same). */
+const pushedBranch = (refspec) => refspec.replace(/^\+/, '').split(':').pop().replace(/^(?:refs\/)?heads\//, '');
+const isFile = (path) => {
+    try {
+        return statSync(path).isFile();
     }
-    return values;
+    catch {
+        return false;
+    }
+};
+/** git diff's options that take the next word as their value. */
+const DIFF_VALUE_OPTIONS = new Set([
+    '--src-prefix', '--dst-prefix', '--line-prefix', '-O', '--output-indicator-new', '--output-indicator-old', '--output-indicator-context',
+    '--diff-filter', '--anchored', '--ws-error-highlight', '--color-moved-ws', '--word-diff-regex', '-I', '--ignore-matching-lines',
+    '--inter-hunk-context', '--diff-algorithm', '--rotate-to', '--skip-to', '-l', '--stat-width', '--stat-name-width', '--stat-graph-width',
+    '--stat-count', '-S', '-G', '--find-object',
+]);
+/** The paths a git diff of the working tree against the index names after its `--`, read as git reads its words; null when it names a commit or reads one (`--cached`), or may (a word before `--` that is not an option). */
+function workingTreeFiles(args) {
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--')
+            return args.slice(i + 1);
+        if (!a.startsWith('-') || ['--end-of-options', '--cached', '--staged', '--merge-base'].includes(a))
+            return null;
+        if (DIFF_VALUE_OPTIONS.has(a))
+            i++;
+    }
+    return [];
+}
+/** Whether every path names a file, in the working tree and in the index, which may still hold a folder of that name with a .env in it; false when git cannot say. */
+function namesTrackedFiles(paths, cwd) {
+    if (!paths.length || !paths.every((a) => isFile(realPath(resolve(cwd, a)))))
+        return false;
+    const tracked = gitRead(['ls-files', '-z', '--', ...paths], cwd);
+    const named = new Set(paths.map((a) => resolve(cwd, a)));
+    return tracked !== null && tracked.split('\0').filter(Boolean).every((a) => named.has(resolve(cwd, a)));
 }
 function git(args, where, protectedBranches, held = false) {
-    const [sub, ...rest] = args[0] === '--no-pager' ? args.slice(1) : args;
+    const words = gitArgs(args);
+    if (!words)
+        return deny('a git option before the command: run git with the command first');
+    const [sub, ...rest] = words;
     if (sub === 'status' || sub === 'diff' || sub === 'log' || sub === 'show' || sub === 'add') {
-        const excluded = sub === 'add' && rest.includes(EXCLUDE_ENV);
+        // A diff, log or show takes the exclusion as a pathspec only after `--`; before it, an option such as --line-prefix may take it as its value.
+        const excluded = (sub === 'add' ? rest : rest.includes('--') ? rest.slice(rest.indexOf('--') + 1) : []).includes(EXCLUDE_ENV);
         const named = excluded ? rest.filter((a) => a !== EXCLUDE_ENV) : rest;
         // After `--` every word is a path, a dash in front too.
         const end = named.indexOf('--');
@@ -297,19 +395,54 @@ function git(args, where, protectedBranches, held = false) {
             return deny(`a git add of every change or of a folder stages .env files too: name the files, or add '${EXCLUDE_ENV}' to the command`);
         }
         // The pathspec leaves out the .env files under the folder the command runs in, and -A reaches past it.
-        if (excluded && addsAll(named) && realPath(where.cwd) !== where.root)
+        if (sub === 'add' && excluded && addsAll(named) && realPath(where.cwd) !== where.root)
             return deny('a git add -A or -u from a folder below the top of the checkout: run it from the top');
+        const files = end < 0 ? [] : named.slice(end + 1);
+        // The exclusion reaches only the .env files below the folder the command runs in, and with no path named git reaches past that folder.
+        const positive = sub === 'add' ? paths : files;
+        if (excluded && realPath(where.cwd) !== where.root && (!positive.length || positive.some((a) => !within(realPath(resolve(where.cwd, a)), realPath(where.cwd))))) {
+            return deny(`below the top of the checkout, '${EXCLUDE_ENV}' leaves out only the .env files in that folder: name paths in it, or run the command from the top`);
+        }
+        // A patch shows a .env file the repository tracks, or the local values in one it tracks as a placeholder, unless it leaves them out.
+        if (sub !== 'add' && sub !== 'status' && !excluded && printsPatch(sub, named)) {
+            // A path that is a file today may have been a folder holding a .env in a commit, so only a diff of the working tree against the index may name files instead.
+            const worktree = sub === 'diff' ? workingTreeFiles(named) : null;
+            if (!worktree) {
+                return deny(`a git ${sub} that prints changes from a commit shows .env files too, under a path that is a file today as well: end the command with -- . '${EXCLUDE_ENV}'${sub === 'diff' ? ', or diff the working tree, with no commit, and name the files after --' : ''}`);
+            }
+            if (!namesTrackedFiles(worktree, where.cwd))
+                return deny(`a git diff that prints changes shows .env files too: name files the working tree and the index both hold as files after --, or end the command with -- . '${EXCLUDE_ENV}'`);
+        }
         return allow();
     }
     if (sub === 'commit') {
-        const read = commitReads(rest).find((v) => /[*?[]/.test(v) || isSecretFile(v.slice(v.lastIndexOf(':') + 1)) || isSecretFile(realPath(resolve(where.cwd, v))) || (outside(v, where) && !inScratch(v, where)));
-        return read === undefined ? allow() : deny('a commit that reads a file outside the checkout or the scratch folder, or a .env file');
+        const { files, commits, all, paths } = commitOptions(rest);
+        // The fence reads a file when it judges the command, and git, outside the sandbox, reads it again later: a command still running in the sandbox can swap it in between.
+        if (files.length)
+            return deny('a commit that reads its message, template or paths from a file, which a command in the sandbox can swap before git reads it: give the message with -m, and name the paths');
+        if (all)
+            return deny('a commit -a, which carries every change to a tracked file, a script\'s too: stage the files by name with git add');
+        if (paths.some((a) => /^:[(!^]|[*?[]/.test(a) || outside(a, where)))
+            return deny('a commit that names a pattern, or a path outside the checkout');
+        const read = commits.find((v) => /[*?[]/.test(v) || isSecretFile(v.slice(v.lastIndexOf(':') + 1)) || isSecretFile(realPath(resolve(where.cwd, v))) || (outside(v, where) && !inScratch(v, where)));
+        return read === undefined ? allow() : deny('a commit that reuses the message of a .env file, or of a commit named from outside the checkout');
+    }
+    if (sub === 'restore') {
+        // The way out of the index for what a refused commit would carry; the working tree stays as it is.
+        const end = rest.indexOf('--');
+        const options = (end < 0 ? rest : rest.slice(0, end)).filter((a) => a.startsWith('-'));
+        const paths = end < 0 ? rest.filter((a) => !a.startsWith('-')) : [...rest.slice(0, end).filter((a) => !a.startsWith('-')), ...rest.slice(end + 1)];
+        if (!options.length || !paths.length || options.some((a) => a !== '--staged' && a !== '-S'))
+            return deny('git restore takes --staged and the paths to take out of the index, nothing else');
+        if (paths.some((a) => /^:[(!^]|[*?[]/.test(a) || outside(a, where)))
+            return deny('a path outside the checkout, or a pattern');
+        return allow();
     }
     if (sub === 'checkout' && rest[0] === '-b' && rest.length >= 2 && rest.length <= 3)
         return allow();
     if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
         const branch = rest[2];
-        if (branch.includes(':') || branch === 'HEAD' || protectedBranches.includes(branch))
+        if (branch.includes(':') || ['HEAD', '@'].includes(pushedBranch(branch)) || protectedBranches.includes(pushedBranch(branch)))
             return deny('a push to the default branch');
         // A connected Vercel project builds every push, and calls a new project's first deployment Production, public at the project's own address.
         return held ? deny("a push before impeccable_vercel_connect settled the linked Vercel project's first deployment: run it first") : allow();
@@ -416,6 +549,11 @@ function reader(cmd, args, where) {
         // A recursive grep reads files nobody named, .env ones too, unless it leaves them out.
         if (recursive && !args.includes('--exclude=.env*'))
             return deny('a recursive grep reads .env files unless it has --exclude=.env*');
+        // grep takes the last of --include and --exclude that matches a file, so an --include (--inc too) after the exclude lets .env in again.
+        if (recursive && args.some((a) => /^--(?:inc|exclude-f)/.test(a)))
+            return deny('a recursive grep with --include or --exclude-from, which can let .env files in again: name the folders to search instead');
+        // An exclude's pattern, wherever it stands, is neither the search pattern nor a path.
+        paths = pathsOf(args.filter((a) => !/^--exclude(?:-dir)?=/.test(a)));
         if (!args.some((a) => a === '-e' || a === '-f' || a.startsWith('--regexp') || a.startsWith('--file')))
             paths = paths.slice(1);
     }
@@ -423,23 +561,27 @@ function reader(cmd, args, where) {
     if (paths.some((p) => outside(p, where) && !inScratch(p, where)))
         return deny('reads outside the checkout');
     // The shell expands `.e*` to .env too.
-    if (cmd !== 'ls' && paths.some((p) => isSecretFile(p) || /^\.[^/]*[*?[]/.test(basename(p))))
+    if (cmd !== 'ls' && paths.some((p) => readsSecret(p, where) || /^\.[^/]*[*?[]/.test(basename(p))))
         return deny('reads a .env file, or a pattern that can match one');
     return allow();
 }
 /** A host's CLI package, by host: the one global install that runs, and only once the person said yes to setting that host up. */
 const HOST_CLIS = { netlify: 'netlify-cli', vercel: 'vercel' };
+/** The version of each the run installs, raised with a release of this command: never the registry's latest of the day. */
+export const HOST_CLI_VERSIONS = { 'netlify-cli': '27.11.2', vercel: '62.7.0' };
+/** The one form of a host CLI's install that runs: npm's, global, of the pinned version. */
+export const hostCliInstallCommand = (pkg) => `npm install -g ${pkg}@${HOST_CLI_VERSIONS[pkg]}`;
 /** git commit and push, gh and the host CLIs: what uses the person's GitHub, Vercel, Netlify or Cloudflare sign-in, keys or keychain. */
 function asPerson(words) {
     const [cmd = '', ...args] = words;
     if (cmd === 'git')
-        return ['commit', 'push'].includes((args[0] === '--no-pager' ? args[1] : args[0]) ?? '');
+        return ['commit', 'push'].includes(gitArgs(args)?.[0] ?? '');
     return cmd === 'gh' || cmd === 'vercel' || cmd === 'netlify' || cmd === 'cf';
 }
 /** Where the command runs; null when it joins what runs as the person to what runs in the sandbox, which the fence refuses. cd and git's other commands, which need no sign-in, run on either side. */
 export function placeOf(command) {
     const commands = (parseCommand(command) ?? []).map(({ words }) => words.slice(envCount(words)));
-    const installs = commands.filter(([pm = '', ...args]) => PACKAGE_MANAGERS.has(pm) && installsHostCli(pm, args, new Set(Object.keys(HOST_CLIS)))).length;
+    const installs = commands.filter(([pm = '', ...args]) => installsHostCli(pm, args)).length;
     if (installs)
         return installs === commands.length ? 'install' : null;
     const person = commands.filter(asPerson).length;
@@ -448,30 +590,41 @@ export function placeOf(command) {
     const either = commands.filter((words) => !asPerson(words) && (words[0] === 'cd' || words[0] === 'git')).length;
     return person + either === commands.length ? 'person' : null;
 }
-/** Whether this is a global install of a host's CLI and nothing else, the person having said yes to setting that host up. */
-function installsHostCli(pm, args, hosts) {
+/** A package manager's global add of a host's CLI and nothing else, in any form: which host's, and the version or tag after its name when there is one. */
+function hostCliAdd(pm, args) {
     const rest = args.filter((a) => !['-g', '--global', '--location=global'].includes(a));
     const global = pm === 'yarn' ? rest[0] === 'global' : rest.length < args.length;
     const [verb = '', name = '', ...more] = pm === 'yarn' ? rest.slice(1) : rest;
     const verbs = { npm: ['install', 'i', 'add'], pnpm: ['add'], yarn: ['add'], bun: ['add', 'install', 'i'] };
-    const cli = name.replace(/@(latest|\d[\w.-]*)$/, '');
-    return global && (verbs[pm] ?? []).includes(verb) && !more.length && Object.entries(HOST_CLIS).some(([host, pkg]) => pkg === cli && hosts.has(host));
+    if (!global || !(verbs[pm] ?? []).includes(verb) || more.length)
+        return null;
+    const at = name.indexOf('@', 1);
+    const pkg = at < 0 ? name : name.slice(0, at);
+    const host = Object.keys(HOST_CLIS).find((h) => HOST_CLIS[h] === pkg);
+    return host ? { host, pkg, ...(at < 0 ? {} : { spec: name.slice(at + 1) }) } : null;
+}
+/** Whether the add is the one form that runs: npm's, of the pinned version, so neither the registry's latest nor another package manager's store chooses what runs as the person. */
+const pinned = (pm, add) => pm === 'npm' && add.spec !== undefined && add.spec === HOST_CLI_VERSIONS[add.pkg];
+/** Whether this is the pinned npm install of a host's CLI and nothing else. */
+function installsHostCli(pm, args) {
+    const add = PACKAGE_MANAGERS.has(pm) ? hostCliAdd(pm, args) : null;
+    return add !== null && pinned(pm, add);
 }
-/** The Netlify CLI's options that take a value, of those the rules below allow, so the value is not read as a command. */
+/** The Netlify CLI's options that take a value, of those the rules below read, so the value is not read as a command. */
 const NETLIFY_VALUES = new Set(['--name', '--git-remote-url', '--git-remote-name', '--id', '--account-slug']);
-/** What each of those values may be: a project's name or id, a GitHub repository, a remote's name, a team's slug. */
+/** What each of those values may be: a project's name, a GitHub repository, a team's slug. */
 const NETLIFY_VALID = {
     '--name': /^[A-Za-z0-9-]{1,63}$/,
-    '--id': /^[0-9a-f-]{8,64}$/i,
     '--git-remote-url': /^(?:https:\/\/github\.com\/)?[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}?(?:\.git)?$/,
-    '--git-remote-name': /^[A-Za-z0-9._-]{1,50}$/,
     '--account-slug': /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/,
 };
-/** The Vercel project the folder is linked to, as `vercel link` wrote it in `.vercel/project.json`; null with none. */
+/** The repository a `--git-remote-url` names, as owner/name, lowercased: `https://github.com/Acme/Crewline.git` is acme/crewline. */
+const remoteRepository = (url) => url.replace(/^https:\/\/github\.com\//, '').replace(/\.git$/, '').toLowerCase();
+/** The Vercel project the folder is linked to, and its team, as `vercel link` wrote them in `.vercel/project.json`; null with none. */
 function linkedVercelProject(dir) {
     try {
-        const id = JSON.parse(readFileSync(join(dir, '.vercel', 'project.json'), 'utf8')).projectId;
-        return typeof id === 'string' ? id : null;
+        const { projectId, orgId } = JSON.parse(readFileSync(join(dir, '.vercel', 'project.json'), 'utf8'));
+        return typeof projectId === 'string' && typeof orgId === 'string' ? { projectId, orgId } : null;
     }
     catch {
         return null;
@@ -479,13 +632,16 @@ function linkedVercelProject(dir) {
 }
 /**
  * The Netlify CLI: `--version` and `status` at any time; once the person signed in to Netlify for the setup, the
- * project's link and creation, in the person's own current team or the one team they chose (`team`). The sign-in and
- * the repository's connection are the tools' (a `netlify login` outside the sign-in screen, and a `netlify init` that
- * asks its questions in a terminal, never run). Never a deploy, which builds the repository with the Netlify sign-in,
- * production or a project's removal, and nothing of its environment variables, its API (which reaches them, and prints
- * a site's password: impeccable_netlify_password runs it in the command's own process) or a token on the command line.
+ * project's creation, in the person's own current team or the one team they chose (`team`), and its link by
+ * `--git-remote-url` naming this repository (`repository`), which finds a site built from it: never a site by name or
+ * id, which would point one of the person's other sites at this repository. The sign-in and the repository's
+ * connection are the tools' (a `netlify login` outside the sign-in screen, and a `netlify init` that asks its questions
+ * in a terminal, never run). Never a deploy, which builds the repository with the Netlify sign-in, production or a
+ * project's removal, and nothing of its environment variables, its API (which reaches them, and prints a site's
+ * password: impeccable_netlify_password runs it in the command's own process) or a token on the command line.
  */
-function netlify(args, agreed, team) {
+/** The Netlify CLI's arguments as its words, the subcommand first wherever its options stand, and its options, each with the value it takes. */
+function netlifyArgs(args) {
     const words = [];
     const options = new Map();
     for (let i = 0; i < args.length; i++) {
@@ -500,6 +656,10 @@ function netlify(args, agreed, team) {
         const value = at > 0 ? arg.slice(at + 1) : NETLIFY_VALUES.has(name) && args[i + 1] !== undefined && !args[i + 1].startsWith('-') ? args[++i] : true;
         options.set(name, value);
     }
+    return { words, options };
+}
+function netlify(args, agreed, team, repository) {
+    const { words, options } = netlifyArgs(args);
     const [sub = '', ...rest] = words;
     if (options.has('--auth'))
         return deny('puts a Netlify token on the command line');
@@ -524,8 +684,14 @@ function netlify(args, agreed, team) {
     if (options.has('--account-slug') && options.get('--account-slug') !== team)
         return deny('names a Netlify team the person did not choose');
     switch (sub) {
-        case 'link':
-            return !rest.length && options.size >= 1 && only('--name', '--id', '--git-remote-url', '--git-remote-name') ? allow() : deny('a netlify link off the allowlist');
+        case 'link': {
+            if (options.has('--name') || options.has('--id'))
+                return deny('a netlify link by name or id, which would point one of the person\'s sites at this repository: netlify link --git-remote-url finds a site built from it, and netlify sites:create makes one');
+            const remote = options.get('--git-remote-url');
+            if (!rest.length && options.size === 1 && only('--git-remote-url') && repository !== undefined && remoteRepository(remote) === repository.toLowerCase())
+                return allow();
+            return deny('a netlify link off the allowlist: --git-remote-url with this repository, and nothing else');
+        }
         case 'sites:create':
             return !rest.length && only('--name', '--json', '--account-slug') ? allow() : deny('a netlify sites:create off the allowlist');
         case 'deploy':
@@ -559,12 +725,14 @@ function vercelArgs(args) {
 }
 /**
  * The Vercel CLI: `whoami` and its version at any time; once the person signed in to Vercel for the setup, the
- * project's link and Git connection, and a preview deploy, on the project named after the folder and in the one team
- * the sign-in settled on (`team`): no other `--scope`, `--team` or `--project`. The sign-in is the tool's (a
- * `vercel login` outside the sign-in screen never runs). Never production or a project's removal, and nothing of its
- * environment variables, its protection settings (their bypass secrets print: impeccable_vercel_bypass runs those in the
- * command's own process, so no secret reaches the model, and `api` and `curl` reach them too) or a token on the command
- * line.
+ * project's link, in the checkout's root alone (a folder named after one of the person's projects would link that
+ * project), its creation by name, and a preview deploy, in the one team the sign-in settled on (`team`): no other
+ * `--scope`, `--team` or `--project`, and no `project ls`, which names the person's projects. The sign-in and the Git
+ * connection are the tools' (a `vercel login` outside the sign-in screen never runs; impeccable_vercel_connect connects
+ * only a project this run created, or one connected to this repository already). Never production or a project's
+ * removal, and nothing of its environment variables, its protection settings (their bypass secrets print:
+ * impeccable_vercel_bypass runs those in the command's own process, so no secret reaches the model, and `api` and
+ * `curl` reach them too) or a token on the command line.
  */
 function vercel(args, where, agreed, team, settlement = null) {
     const { words, options } = vercelArgs(args);
@@ -590,18 +758,21 @@ function vercel(args, where, agreed, team, settlement = null) {
     const only = (...names) => [...options.keys()].every((n) => [...names, '--cwd', '--non-interactive'].includes(n));
     switch (sub) {
         case 'link':
+            // The link names the project after the folder it runs in, and links an existing project of that name: only the checkout's root, whose name is the repository's.
+            if (cwd !== undefined || realPath(where.cwd) !== where.root)
+                return deny('a vercel link in a folder of the checkout, which would link a project named after that folder: the link runs in the checkout\'s root');
             return !rest.length && only('--yes', '-y', ...VERCEL_TEAM) ? allow() : deny('a vercel link off the allowlist');
         case 'project':
-            return ['add', 'ls', 'list'].includes(rest[0] ?? '') && rest.length <= 2 && only(...VERCEL_TEAM) ? allow() : deny('a vercel project command off the allowlist');
+            if (['ls', 'list'].includes(rest[0] ?? ''))
+                return deny("a vercel project ls, which names the person's projects");
+            return rest[0] === 'add' && rest.length <= 2 && only(...VERCEL_TEAM) ? allow() : deny('a vercel project command off the allowlist');
         case 'git':
-            // Vercel could not reach the repository, which released the push as it built nothing: a connection now would let it build the project's first deployment, served publicly, so the tool that locks the project makes it.
-            if (settlement?.how === 'connection')
-                return deny('a vercel git connect after Vercel could not reach the repository: impeccable_vercel_connect connects it and locks a new project before anything is pushed');
-            return rest.join(' ') === 'connect' && only(...VERCEL_TEAM) ? allow() : deny('a vercel git command other than connect');
+            // A connection makes the project build the repository: the tool makes it, for a project this run created or one connected to this repository already, and locks a new project before anything is pushed.
+            return deny('a vercel git connect from the shell: impeccable_vercel_connect connects the repository, to a project this run created alone, and locks a new project before anything is pushed');
         case 'deploy': {
             // A deploy builds the project the folder it runs in is linked to: the one --cwd names, else this one.
             const folder = resolve(where.cwd, typeof cwd === 'string' ? cwd : '.');
-            if (!(settlement?.how === 'project' && settlement.projectId === linkedVercelProject(folder)))
+            if (!(settlement?.how === 'project' && settlement.projectId === (linkedVercelProject(folder)?.projectId ?? null)))
                 return deny("a deploy before impeccable_vercel_connect settled the first deployment of the project this folder is linked to: a deploy from here builds it whether or not Vercel reaches the repository");
             return rest.length <= 1 && inside(rest, where) && only('--yes', '-y', '--target', ...VERCEL_TEAM) ? allow() : deny('a vercel deploy off the preview allowlist');
         }
@@ -642,7 +813,7 @@ function simpleCommand(seg, where, opts) {
     if (redirects.some((r) => outside(r.target, where) && !scratch(r)))
         return deny('reads outside the checkout');
     // Input from a file is a read like a named path, so a .env file stays closed that way too, in the checkout or the scratch folder.
-    if (redirects.some((r) => r.op.includes('<') && isSecretFile(r.target)))
+    if (redirects.some((r) => r.op.includes('<') && readsSecret(r.target, where)))
         return deny('reads a .env file');
     if (!cmd)
         return deny(env.length ? 'sets environment variables and runs nothing' : 'a redirection on its own');
@@ -662,10 +833,14 @@ function simpleCommand(seg, where, opts) {
                 return deny('a cd that runs only sometimes: put it first, or after ;');
             return isFolder(realPath(resolve(where.cwd, args[0]))) ? allow() : deny('a cd into a folder that is not there');
         case 'git':
-            return git(args, where, opts.protectedBranches, opts.hosts.has('vercel') && !(opts.vercelSettled && opts.vercelSettled.projectId === linkedVercelProject(where.root)));
+            return git(args, where, opts.protectedBranches, opts.hosts.has('vercel') && !(opts.vercelSettled && opts.vercelSettled.projectId === (linkedVercelProject(where.root)?.projectId ?? null)));
         case 'gh':
-            if (args[0] === 'pr' && (args[1] === 'create' || args[1] === 'view'))
-                return allow();
+            // gh reads the file outside the sandbox, after the fence read it: a command still running in the sandbox can swap it in between.
+            if (args[0] === 'pr' && args[1] === 'create')
+                return args.some((a) => /^-[a-zA-Z]*[FT]|^--(?:body-file|template)(?:=|$)/.test(a)) ? deny('a pull request body read from a file, which a command in the sandbox can swap before gh reads it: give it with --body') : allow();
+            // gh runs as the person, who can read other repositories' pull requests: this run's own, by number or branch, in this repository.
+            if (args[0] === 'pr' && args[1] === 'view')
+                return ghView(args.slice(2)) ? allow() : deny("gh pr view takes a pull request's number or this run's branch, --repo for this repository, --json and --comments");
             // The test drive opens as a draft where its preview needs the pull request first, and is marked ready once that preview is proven: the test drive's branch by name, nothing else.
             if (args[0] === 'pr' && args[1] === 'ready')
                 return ghReady(args.slice(2)) !== null ? allow() : deny('gh pr ready takes the test drive branch by name, and --repo');
@@ -685,15 +860,19 @@ function simpleCommand(seg, where, opts) {
         case 'find':
             return reader(cmd, args, where);
         case 'netlify':
-            return netlify(args, opts.hosts.has('netlify'), opts.teams.get('netlify'));
+            return netlify(args, opts.hosts.has('netlify'), opts.teams.get('netlify'), opts.repository);
         case 'vercel':
             return vercel(args, where, opts.hosts.has('vercel'), opts.teams.get('vercel'), opts.vercelSettled);
         case 'cf':
             return cloudflareCli(args);
-        default:
-            if (PACKAGE_MANAGERS.has(cmd) && installsHostCli(cmd, args, opts.hosts))
-                return allow('installs the CLI of the host the person said yes to');
-            return PACKAGE_MANAGERS.has(cmd) ? packageManager(cmd, args, where, opts.scriptsChanged) : deny(`${cmd} is not on the allowlist`);
+        default: {
+            if (!PACKAGE_MANAGERS.has(cmd))
+                return deny(`${cmd} is not on the allowlist`);
+            const add = hostCliAdd(cmd, args);
+            if (add && opts.hosts.has(add.host))
+                return pinned(cmd, add) ? allow('installs the CLI of the host the person said yes to') : deny(`the run installs ${add.pkg} with npm, pinned to the version it knows: ${hostCliInstallCommand(add.pkg)}`);
+            return packageManager(cmd, args, where, opts.scriptsChanged);
+        }
     }
 }
 /** A refusal by a content check: a command naming a file that holds credentials, or text shaped like a secret where `sink` would take it off the machine. */
@@ -702,31 +881,74 @@ const found = (pattern, sink) => ({
     reason: pattern.context === 'command' ? `names ${pattern.description}, which holds credentials (${pattern.name})` : `${sink} holds text shaped like ${pattern.description} (${pattern.name})`,
     hit: { pattern, sink },
 });
-/** A file's text, when the command may read it (in the checkout or the scratch folder, and no .env file); null otherwise, or when it cannot be read. */
-function readable(path, where) {
-    if (path.startsWith('~') || /[$*?[]/.test(path) || isSecretFile(path) || (outside(path, where) && !inScratch(path, where)))
-        return null;
+/** What git prints for `args`, run outside the sandbox and pointed at this checkout's own git folders; null when it cannot. */
+function gitRead(args, cwd, { timeout = 10_000, settings = {}, input } = {}) {
     try {
-        return readFileSync(resolve(where.cwd, path), 'utf8').slice(0, 1_000_000);
+        return execFileSync('git', args, { cwd, encoding: 'utf8', input, stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'ignore'], timeout, maxBuffer: 16 * 1024 * 1024, env: gitEnvironment({ ...process.env, ...settings }) });
     }
     catch {
         return null;
     }
 }
-/** The messages of the commits `revisions` name, as git log gives them; null when git cannot read them. */
-function commitMessages(revisions, cwd) {
-    try {
-        // The closing -- reads each as a commit even where a file of the same name is there.
-        return execFileSync('git', ['log', '--format=%B', ...revisions, '--'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000, maxBuffer: 16 * 1024 * 1024, env: gitEnvironment() });
-    }
-    catch {
+/** The messages of the commits `revisions` name, with more on git's input, as git log gives them; null when git cannot read them. */
+function commitMessages(revisions, cwd, input) {
+    // The closing -- reads each as a commit even where a file of the same name is there.
+    return gitRead(['log', '--format=%B', ...revisions, '--'], cwd, { input });
+}
+/** git log's revisions for the commits `head` has that none of `bases` has (the whole branch when there are none): the bases go on its input, however many the remote has. */
+const pastBases = (head, bases) => ({ revisions: ['--stdin', '--end-of-options', head], input: bases.map((base) => `^${base}\n`).join('') });
+/** The messages of every commit `head` has that none of `bases` has: what --fill takes a pull request's title and body from, and what a push carries. Null when git cannot read them, never a part of them. */
+function newMessages(head, bases, cwd) {
+    const { revisions, input } = pastBases(head, bases);
+    return commitMessages(revisions, cwd, input);
+}
+/**
+ * What the reads of the remote run with: nothing that asks for a password, a passphrase or a host's key, on the terminal, in a
+ * window or in Git Credential Manager's, which would hold the push until its minute ran out; a credential helper that answers on
+ * its own still does. SSH runs in batch mode unless the person set a command of their own for it, which is left as it is.
+ */
+function unprompted(cwd) {
+    const ownSsh = process.env.GIT_SSH_COMMAND || process.env.GIT_SSH || gitRead(['config', '--get', 'core.sshCommand'], cwd);
+    return { GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', GIT_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never', ...(ownSsh ? {} : { GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }) };
+}
+/**
+ * What a `push -u origin <branch>` adds to, asked of the remote itself: the commits it has on that branch and on the default
+ * branch, as `origin/<branch>` would say, but that ref sits in the checkout's git folder, where a command in the sandbox can
+ * move it. Those two are fetched, so the range past them can be read here, and must be. Every other branch of the remote's
+ * whose commit is here counts too, since the remote has it and all before it: a test drive stacked on an earlier run's setup
+ * branch carries none of that branch's commits, also once the setup branch moved on. Null when the remote cannot be asked:
+ * what the push carries cannot be checked then, and it is refused. The reads go over the network, so they get the minute a
+ * push gets.
+ */
+function pushBases(branch, defaultBranch, cwd) {
+    const settings = unprompted(cwd);
+    const read = gitRead(['ls-remote', '--heads', 'origin'], cwd, { timeout: 60_000, settings });
+    if (read === null)
         return null;
-    }
+    const heads = new Map(read.split('\n').filter(Boolean).map((line) => line.split('\t').reverse()));
+    const found = [`refs/heads/${pushedBranch(branch)}`, ...(defaultBranch ? [`refs/heads/${defaultBranch}`] : [])].filter((ref) => heads.has(ref));
+    if (!found.length)
+        return [];
+    // Fetched by ref, with no ref written here: a daemon moving one would change nothing of what is read.
+    gitRead(['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...found], cwd, { timeout: 60_000, settings });
+    const bases = found.map((ref) => heads.get(ref));
+    const others = [...new Set(heads.values())].filter((sha) => !bases.includes(sha));
+    const known = others.length ? gitRead(['cat-file', '--batch-check=%(objectname) %(objecttype)'], cwd, { input: others.map((sha) => `${sha}\n`).join('') }) : '';
+    return [...bases, ...(known ?? '').split('\n').filter((line) => line.endsWith(' commit')).map((line) => line.split(' ')[0])];
+}
+const UNREAD_PUSH = 'the commits the push would carry past what the remote has could not be read here';
+const UNMADE_PUSH = 'a push in the same command as the git commit or git checkout -b that makes what it carries, which is not there yet when the fence reads what the push would carry: run git push as a command of its own, after the commit';
+const UNREACHED_PUSH = 'the remote could not be reached, so what the push would carry could not be checked: try the push again once the network is back';
+/** The paths every commit `head` has that none of `bases` has touches, from the checkout's top: a file a later commit removes again is still in what the push sends, and a merge's own changes too. Null when git cannot read them. */
+function newPaths(head, bases, cwd) {
+    const { revisions, input } = pastBases(head, bases);
+    const read = gitRead(['log', '--format=', '--name-only', '-m', '-z', '--no-renames', ...revisions, '--'], cwd, { input });
+    return read === null ? null : [...new Set(read.split('\0').filter(Boolean))];
 }
 /** The words of a git commit or a gh pr create that are its message, title or body: text, not paths. */
 function textWords(words) {
     const text = new Set();
-    const commit = words[0] === 'git' && (words[1] === 'commit' || (words[1] === '--no-pager' && words[2] === 'commit'));
+    const commit = words[0] === 'git' && gitArgs(words.slice(1))?.[0] === 'commit';
     if (!commit && !(words[0] === 'gh' && words[1] === 'pr' && words[2] === 'create'))
         return text;
     words.forEach((w, i) => {
@@ -739,10 +961,10 @@ function textWords(words) {
 }
 /**
  * The content checks on a command the fence allows: a file that holds credentials, named anywhere in it but its message; and
- * text shaped like a secret in what it sends off the machine: a commit's message, or the file or commit it takes one from, and
- * a pull request's title, body, body file, or the commit messages --fill takes them from.
+ * text shaped like a secret in what it sends off the machine: a commit's message, or the commit it takes one from, the messages
+ * of the commits a push carries, and a pull request's title, body, or the commit messages --fill takes them from.
  */
-function contentCheck(seg, where, defaultBranch) {
+function contentCheck(seg, where, defaultBranch, basesOf) {
     const text = textWords(seg.words);
     for (const [i, word] of [...seg.words, ...seg.redirects.map((r) => r.target)].entries()) {
         if (text.has(i))
@@ -753,25 +975,45 @@ function contentCheck(seg, where, defaultBranch) {
             return found(hit, 'the command');
     }
     const [cmd, ...rest] = seg.words;
-    const args = cmd === 'git' && rest[0] === '--no-pager' ? rest.slice(1) : rest;
+    const args = cmd === 'git' ? gitArgs(rest) ?? [] : rest;
     const texts = [];
     if (cmd === 'git' && args[0] === 'commit') {
         texts.push(['the commit message', args.slice(1).join('\n')]);
-        // -F reads a file, and -c and -C take another commit's message: a value may name both, a file and a commit, so both are read.
-        for (const v of commitReads(args.slice(1)))
-            texts.push(['the commit message file', readable(v, where)], ['the commit message it reuses', commitMessages(['-1', '--end-of-options', v], where.cwd)]);
+        for (const v of commitOptions(args.slice(1)).commits)
+            texts.push(['the commit message it reuses', commitMessages(['-1', '--end-of-options', v], where.cwd)]);
+    }
+    else if (cmd === 'git' && args[0] === 'push') {
+        // What the push carries: the commits the remote's branch does not have yet, or the default branch's when the remote has no such branch; a message was read when its commit was made, and is read again here, since a command in the sandbox can write commits of its own. A remote that cannot be asked refuses this attempt, and a later one asks again.
+        const bases = basesOf(args[3]);
+        if (bases === null)
+            return deny(UNREACHED_PUSH);
+        const carried = newMessages(args[3], bases, where.cwd);
+        if (carried === null)
+            return deny(UNREAD_PUSH);
+        texts.push(['the commit messages the push carries', carried]);
+        // A .env file's example a command wrote, which no write of pi's showed the fence: every line the push's commits add to one, read as a write of it is.
+        const { revisions, input } = pastBases(args[3], bases);
+        const examples = gitRead(['log', '--format=', '-p', '-m', '--no-renames', '--text', '--no-textconv', '--no-ext-diff', '--no-color', ...revisions, '--', ...ENV_EXAMPLES], where.cwd, { input });
+        if (examples === null)
+            return deny(UNREAD_PUSH);
+        const added = examples.split('\n').filter((line) => line.startsWith('+')).join('\n');
+        // As a write of one is read: as written, and as the screen would show it once an escape sequence is taken out.
+        const read = (text) => scan('output', text).find((p) => !PLACEHOLDER_SHAPES.has(p.name));
+        const plain = plainText(added);
+        const hit = read(added) ?? (plain === added ? undefined : read(plain));
+        if (hit)
+            return found(hit, 'a .env example the push carries');
     }
     else if (cmd === 'gh' && args[0] === 'pr' && args[1] === 'create') {
         const parsed = createArguments(args.slice(2));
         texts.push(["the pull request's title or body", args.slice(2).join('\n')]);
-        if (parsed?.bodyFile)
-            texts.push(["the pull request's body file", readable(parsed.bodyFile, where)]);
         if (parsed?.filled) {
-            // What gh fills the title and body from: the commits on the head that the base does not have, or the newest hundred when git cannot tell which.
+            // What gh fills the title and body from: the commits on the head that the base does not have. A head git has whose commits cannot be read here is refused: gh, reading the same refs, could not fill from it either.
             const base = parsed.base ?? defaultBranch, head = parsed.head ?? 'HEAD';
-            const ranges = [...(base ? [`origin/${base}..${head}`, `${base}..${head}`].map((range) => ['--end-of-options', range]) : []), ['-n', '100', '--end-of-options', head]];
-            const messages = ranges.reduce((read, range) => read ?? commitMessages(range, where.cwd), null);
-            texts.push(["the commit messages --fill takes the pull request's title and body from", messages]);
+            const filled = base ? newMessages(head, [`origin/${base}`], where.cwd) ?? newMessages(head, [base], where.cwd) : newMessages(head, [], where.cwd);
+            if (filled === null && gitRead(['rev-parse', '--verify', '--quiet', '--end-of-options', `${head}^{commit}`], where.cwd) !== null)
+                return deny("the commit messages --fill takes the pull request's title and body from could not be read here");
+            texts.push(["the commit messages --fill takes the pull request's title and body from", filled]);
         }
     }
     for (const [sink, text] of texts) {
@@ -781,20 +1023,163 @@ function contentCheck(seg, where, defaultBranch) {
     }
     return null;
 }
+/** A path as git names it, from the checkout's top: as written (the folders on the way resolved, the file itself not, since git tracks a link by its name) and with every symlink resolved, when that differs. */
+function fromTop(at, where) {
+    const forms = [resolve(realPath(dirname(at)), basename(at)), realPath(at)].filter((form) => within(form, where.root)).map((form) => relative(where.root, form).split(sep).join('/'));
+    return [...new Set(forms)];
+}
+/** The path pi's write or edit tool wrote for the model's string, as git names it from the checkout's top. */
+function writtenPaths(path, root) {
+    return fromTop(resolveToCwd(path, root), { root: realPath(root), cwd: root });
+}
+/** What a git add or commit names, from the checkout's top: the files, and the folders (`.` for -A and -u) whose every change it sweeps in. */
+function namesOf(words, where) {
+    const [sub = '', ...rest] = gitArgs(words.slice(1)) ?? [];
+    let given;
+    if (sub === 'add') {
+        const named = rest.filter((a) => a !== EXCLUDE_ENV);
+        const end = named.indexOf('--');
+        given = end < 0 ? pathsOf(named) : [...pathsOf(named.slice(0, end)), ...named.slice(end + 1)];
+        if (addsAll(named))
+            given.push('.');
+    }
+    else if (sub === 'commit') {
+        given = commitOptions(rest).paths;
+    }
+    else {
+        return { files: [], folders: [] };
+    }
+    const files = [], folders = [];
+    for (const path of given) {
+        const at = resolve(where.cwd, path);
+        (isFolder(realPath(at)) ? folders : files).push(...fromTop(at, where));
+    }
+    return { files, folders };
+}
+/** The files a command the fence allowed names in its git adds and commits, from the checkout's top, each cd followed: the run's own from then on. */
+function namedPaths(command, root) {
+    const where = { root: realPath(root), cwd: root };
+    const files = [];
+    for (const { words } of parseCommand(command) ?? []) {
+        if (words[0] === 'cd')
+            where.cwd = resolve(where.cwd, words[1] ?? '.');
+        else if (words[0] === 'git')
+            files.push(...namesOf(words, where).files);
+    }
+    return files;
+}
+/**
+ * The paths a commit would carry besides the files the command names: staged against HEAD already, and swept in by the
+ * folders the command adds first. Null when git cannot read the index.
+ */
+function carriedPaths(where, named) {
+    const staged = gitRead(['diff', '--cached', '--name-only', '-z'], where.root);
+    if (staged === null)
+        return null;
+    const carried = new Set(staged.split('\0').filter(Boolean));
+    for (const folder of named.folders) {
+        const swept = gitRead(['status', '--porcelain', '-z', '--untracked-files=all', '--no-renames', '--', ...(folder ? [folder] : [])], where.root);
+        if (swept === null)
+            return null;
+        // The add's exclusion leaves the .env files out.
+        for (const entry of swept.split('\0'))
+            if (entry.length > 3 && !isSecretFile(entry.slice(3)))
+                carried.add(entry.slice(3));
+    }
+    return carried;
+}
+/**
+ * What a commit takes at `path`, from the working tree or from the index: the sha256 of a plain file's bytes, null when there
+ * is none, and `other` for anything else (a symlink, which git commits as the name it points to, or an index entry git cannot read).
+ */
+function committedAt(path, where, staged) {
+    const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+    if (!staged) {
+        try {
+            return lstatSync(join(where.root, path)).isFile() ? digest(readFileSync(join(where.root, path))) : 'other';
+        }
+        catch (error) {
+            return error.code === 'ENOENT' ? null : 'other';
+        }
+    }
+    const entry = gitRead(['ls-files', '--stage', '-z', '--', path], where.root);
+    if (entry === '')
+        return null;
+    const blob = /^100(?:644|755) ([0-9a-f]+) 0\t/.exec(entry ?? '')?.[1];
+    try {
+        return blob ? digest(execFileSync('git', ['cat-file', 'blob', blob], { cwd: where.root, stdio: ['ignore', 'pipe', 'ignore'], timeout: 10_000, maxBuffer: 16 * 1024 * 1024, env: gitEnvironment() })) : 'other';
+    }
+    catch {
+        return 'other';
+    }
+}
+/**
+ * The workflow files impeccable_sync_workflow wrote or removed that a commit would leave otherwise than it did: what an add in
+ * the command takes, from the working tree, else what is staged. One the commit does not carry is not read.
+ */
+function unsyncedWorkflows(where, named, carried, synced) {
+    return [...synced].filter(([path, sha256]) => {
+        const added = named.files.has(path) || named.folders.some((folder) => !folder || path.startsWith(`${folder}/`));
+        return (added || carried.has(path)) && committedAt(path, where, !added) !== sha256;
+    }).map(([path]) => path);
+}
 /** The fence's answer for one shell command run from the checkout's top folder. */
 export function classifyCommand(command, root, options = {}) {
-    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null };
+    const opts = { protectedBranches: options.protectedBranches ?? ['main', 'master'], scriptsChanged: options.scriptsChanged ?? false, hosts: options.hosts ?? new Set(), teams: options.teams ?? new Map(), vercelSettled: options.vercelSettled ?? null, repository: options.repository };
     const segments = parseCommand(command);
     if (!segments)
         return deny('uses shell syntax the fence does not read');
     if (!segments.length)
         return deny('an empty command');
     const where = { root: realPath(root), cwd: root, scratch: options.scratch && realPath(options.scratch) };
+    const named = { files: new Set(), folders: [] };
+    // A push's messages and paths are read against the same answer of the remote, asked once.
+    const remote = new Map();
+    const basesOf = (branch) => {
+        if (!remote.has(branch))
+            remote.set(branch, pushBases(branch, opts.protectedBranches[0], where.cwd));
+        return remote.get(branch);
+    };
     let result = allow();
+    /** A git commit or checkout -b earlier in the command, whose commits or branch are not there yet when a push after it is judged. */
+    let unmade = false;
     for (const seg of segments) {
         let decision = simpleCommand(seg, where, opts);
+        const gitSub = seg.words[0] === 'git' ? gitArgs(seg.words.slice(1))?.[0] : undefined;
+        if (decision.verdict === 'allow' && gitSub === 'push' && unmade)
+            decision = deny(UNMADE_PUSH);
+        if (gitSub === 'commit' || gitSub === 'checkout')
+            unmade = true;
         if (decision.verdict === 'allow')
-            decision = contentCheck(seg, where, opts.protectedBranches[0]) ?? decision;
+            decision = contentCheck(seg, where, opts.protectedBranches[0], basesOf) ?? decision;
+        if (decision.verdict === 'allow' && options.touched && seg.words[0] === 'git') {
+            const names = namesOf(seg.words, where);
+            names.files.forEach((file) => named.files.add(file));
+            named.folders.push(...names.folders);
+            const list = (paths) => `${paths.slice(0, 3).join(', ')}${paths.length > 3 ? ` and ${paths.length - 3} more` : ''}`;
+            if (gitSub === 'commit') {
+                const carried = carriedPaths(where, named);
+                const unnamed = carried && [...carried].filter((path) => !options.touched.has(path) && !named.files.has(path));
+                const unsynced = carried && options.synced ? unsyncedWorkflows(where, named, carried, options.synced) : [];
+                if (unnamed === null)
+                    decision = deny('the paths the commit would carry could not be read');
+                else if (unnamed.length)
+                    decision = deny(`a commit that carries ${list(unnamed)}, which this run never wrote or added by name: git restore --staged <path> takes a file out of the commit, and git add <path> puts in one the run meant to change`);
+                else if (unsynced.length)
+                    decision = deny(`a commit that carries ${list(unsynced)} otherwise than impeccable_sync_workflow left it, though only that tool writes the workflow: call it again, then stage the file by name`);
+            }
+            else if (gitSub === 'push') {
+                // A command in the sandbox can commit on the branch itself, past the index: what the push adds is read against what the remote has, as its messages are, and what the remote has must be readable here.
+                const branch = seg.words.at(-1);
+                const bases = basesOf(branch);
+                const carried = bases && newPaths(branch, bases, where.cwd);
+                const unnamed = carried?.filter((path) => !options.touched.has(path));
+                if (!unnamed)
+                    decision = deny(bases ? UNREAD_PUSH : UNREACHED_PUSH);
+                else if (unnamed?.length)
+                    decision = deny(`a push that carries ${list(unnamed)}, which this run never wrote or added by name: a script in the sandbox committed it`);
+            }
+        }
         if (decision.verdict === 'never')
             return decision;
         if (decision.verdict === 'deny' && result.verdict === 'allow')
@@ -899,23 +1284,257 @@ export function classifyPreviewCommand(command, root, options = {}) {
     }
     return allow('inside the disposable preview verifier');
 }
-/** The fence's answer for pi's file tools: writes stay in the checkout and out of every .git, the checkout's and any other a file could make; reads stay in it or in the run's scratch folder, and off .env files. */
-export function classifyFileTool(tool, path, root, scratch) {
+/** A path pi spells into another before opening it: `@` (its file-mention prefix) comes off, `~` is the home folder, and a URL is a path. */
+const SPELLED = /^[@~]|^[a-z][a-z0-9+.-]*:\/\//i;
+/** The names .env files take. ripgrep's `*` matches a leading dot, unlike the shell's, so the grep tool's glob is held against these, not read for a dot. */
+const ENV_NAMES = ['.env', '.env.local', '.env.development', '.env.development.local', '.env.production', '.env.production.local', '.env.test', '.env.test.local', '.env.staging'];
+/**
+ * A glob's alternatives with its braces expanded, `{a,b}c` being `ac` and `bc`, a brace in a class (`[{]`) or escaped (`\{`) being
+ * the character; null for an unclosed brace or more than 64 alternatives, which counts as naming .env files. One group is opened
+ * per pass over a loop, never a call, so nesting costs no stack.
+ */
+function expandBraces(glob) {
+    const done = [];
+    const pending = [glob];
+    while (pending.length) {
+        const s = pending.pop();
+        const parts = [];
+        let depth = 0, open = 0, from = 0, expanded = false;
+        for (let i = 0; i < s.length && !expanded; i++) {
+            const c = s[i];
+            if (c === '\\')
+                i++;
+            else if (c === '[') {
+                const end = s.indexOf(']', i + 1);
+                i = end < 0 ? s.length : end;
+            }
+            else if (c === '{') {
+                if (depth++ === 0)
+                    (open = i, from = i + 1);
+            }
+            else if (c === '}' && depth) {
+                if (--depth === 0) {
+                    parts.push(s.slice(from, i));
+                    for (const part of parts)
+                        pending.push(s.slice(0, open) + part + s.slice(i + 1));
+                    expanded = true;
+                }
+            }
+            else if (c === ',' && depth === 1)
+                (parts.push(s.slice(from, i)), from = i + 1);
+        }
+        if (!expanded) {
+            if (depth)
+                return null;
+            done.push(s);
+        }
+        if (done.length + pending.length > 64)
+            return null;
+    }
+    return done;
+}
+/** Whether a brace-free glob matches a name: `*` any run, `?` one character, `[...]` a class, `\` the next character itself. Two pointers, so the work is bounded by the lengths however many wildcards there are. */
+function globMatches(glob, name) {
+    let g = 0, n = 0, star = -1, mark = 0;
+    while (n < name.length) {
+        if (g < glob.length) {
+            const c = glob[g];
+            if (c === '*') {
+                star = g++;
+                mark = n;
+                continue;
+            }
+            let next = g + 1;
+            let ok;
+            if (c === '?')
+                ok = true;
+            else if (c === '[') {
+                const end = glob.indexOf(']', g + 1);
+                if (end < 0)
+                    return true;
+                ok = new RegExp(`^[${glob.slice(g + 1, end).replace(/^!/, '^')}]$`).test(name[n]);
+                next = end + 1;
+            }
+            else if (c === '\\') {
+                ok = glob[g + 1] === name[n];
+                next = g + 2;
+            }
+            else
+                ok = c === name[n];
+            if (ok) {
+                g = next;
+                n++;
+                continue;
+            }
+        }
+        if (star < 0)
+            return false;
+        g = star + 1;
+        n = ++mark;
+    }
+    while (glob[g] === '*')
+        g++;
+    return g === glob.length;
+}
+/** Whether a ripgrep glob names .env files, by its last segment (`*`, `**`, `?`, `[...]`, `{a,b}` and `\` as ripgrep reads them); `*` and `**` alone take every file, a folder search, whose report is read instead. */
+function globMatchesEnv(glob) {
+    const segment = glob.replace(/\/+$/, '').split('/').pop() ?? '';
+    if (segment === '*' || segment === '**')
+        return false;
+    // A segment past a kilobyte names no file; with the length bounded, so is every pass below.
+    if (segment.length > 1024)
+        return true;
+    const alternatives = expandBraces(segment);
+    try {
+        return !alternatives || alternatives.some((alternative) => ENV_NAMES.some((name) => globMatches(alternative, name)));
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * The fence's answer for pi's file tools, which open files in the command's own process, as the person: writes stay in the
+ * checkout and out of every .git, the checkout's and any other a file could make; reads stay in it or in the run's scratch
+ * folder, and off .env files. The name typed is judged, then the path pi resolves it to, the way pi does, symlinks followed.
+ */
+export function classifyFileTool(tool, path, root, scratch, glob) {
     const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
     const p = typeof path === 'string' && path ? path : '.';
-    if (tool === 'write' || tool === 'edit') {
+    const writes = tool === 'write' || tool === 'edit';
+    if (SPELLED.test(p))
+        return (writes ? never : deny)('a path with @, ~ or a URL scheme in front, which pi opens as another file: name the file by its path');
+    const opened = tool === 'read' ? resolveReadPath(p, root) : resolveToCwd(p, root);
+    if (writes) {
         if (outside(p, where))
             return never('writes outside the checkout');
-        // A .git file or folder below the top would be where git takes its settings and hooks from there.
-        const inGit = [p, relative(where.root, realPath(resolve(root, p)))].some((q) => q.split(/[\\/]/).includes('.git'));
-        return inGit ? never('writes into .git, where hooks run') : allow();
+        if (p.split(/[\\/]/).includes('.git'))
+            return never('writes into .git, where hooks run');
+        return classifyOpened(tool, opened, where);
     }
     if (outside(p, where) && !inScratch(p, where))
         return deny('reads outside the checkout');
-    if ((tool === 'read' || tool === 'grep') && isSecretFile(p))
+    if ((tool === 'read' || tool === 'grep') && readsSecret(p, where))
+        return deny('reads a .env file');
+    if (tool === 'grep' && typeof glob === 'string' && globMatchesEnv(glob))
+        return deny('a grep glob that names .env files: search the folder by its path instead');
+    return classifyOpened(tool, opened, where);
+}
+/** A symlink to a file that is not there: a write through it makes the target, wherever it points. */
+const dangling = (path) => {
+    try {
+        return lstatSync(path).isSymbolicLink() && !existsSync(path);
+    }
+    catch {
+        return false;
+    }
+};
+/** The fence's answer for the path a file tool resolved and opens, the same rules on what it stands for. */
+function classifyOpened(tool, opened, where) {
+    const real = realPath(opened);
+    if (tool === 'write' || tool === 'edit') {
+        if (!within(real, where.root))
+            return never('writes outside the checkout');
+        if (dangling(opened))
+            return never('writes through a symlink to a file that is not there');
+        // A .git file or folder below the top would be where git takes its settings and hooks from there.
+        return relative(where.root, real).split(/[\\/]/).includes('.git') ? never('writes into .git, where hooks run') : allow();
+    }
+    if (!within(real, where.root) && !(where.scratch && within(real, where.scratch)))
+        return deny('reads outside the checkout');
+    if ((tool === 'read' || tool === 'grep') && secretOnPath(real, where))
         return deny('reads a .env file');
     return allow();
 }
+/**
+ * What pi's read, write, edit, grep, ls and find tools open files with: each path, as pi resolved it, is judged once more at the file
+ * itself, so what the tool opens is never past what the fence allowed, whatever spelling the model's string took. grep's are the folder
+ * it searches and the files it reads context lines from; the matches themselves ripgrep reads, and guardedGrepTool takes those out.
+ * ls's are the folder and each entry in it, so an entry that is a symlink out of the checkout is skipped, not listed.
+ */
+export function guardedFileOperations(root, scratch) {
+    const where = { root: realPath(root), cwd: root, scratch: scratch && realPath(scratch) };
+    // Every operation judges its own path: the order pi calls them in is not relied on.
+    const judged = (tool, path) => {
+        const decision = classifyOpened(tool, path, where);
+        if (decision.verdict !== 'allow')
+            throw new Error(`Refused: ${decision.reason}`);
+        return path;
+    };
+    return {
+        read: {
+            readFile: async (path) => readFile(judged('read', path)),
+            access: async (path) => access(judged('read', path), constants.R_OK),
+            detectImageMimeType: async (path) => detectSupportedImageMimeTypeFromFile(judged('read', path)),
+        },
+        write: {
+            writeFile: async (path, content) => writeFile(judged('write', path), content, 'utf-8'),
+            mkdir: async (dir) => void (await mkdir(judged('write', dir), { recursive: true })),
+        },
+        edit: {
+            readFile: async (path) => readFile(judged('edit', path)),
+            writeFile: async (path, content) => writeFile(judged('edit', path), content, 'utf-8'),
+            access: async (path) => access(judged('edit', path), constants.R_OK | constants.W_OK),
+        },
+        grep: {
+            isDirectory: async (path) => (await stat(judged('grep', path))).isDirectory(),
+            readFile: async (path) => readFile(judged('grep', path), 'utf-8'),
+        },
+        ls: {
+            exists: async (path) => existsSync(judged('ls', path)),
+            stat: async (path) => stat(judged('ls', path)),
+            readdir: async (path) => readdir(judged('ls', path)),
+        },
+        find: (path) => classifyOpened('find', path, where),
+    };
+}
+/**
+ * A grep report without the lines of .env files: ripgrep reads the files itself, and a glob the model gives brings a file back past
+ * any ignore rule, so what it reported is read instead. Each line starts with the file's path, then `:<line>: ` or `-<line>- `;
+ * every split that reads so is tried, so a folder named to look like one hides nothing, and a line of another file that reads like
+ * a .env file's goes too.
+ */
+export function withoutEnvLines(report) {
+    const kept = report.split('\n').filter((line) => ![...line.matchAll(/[:-]\d+[:-] /g)].some((m) => isSecretFile(line.slice(0, m.index))));
+    return kept.length ? kept.join('\n') : 'No matches found';
+}
+/**
+ * pi's find tool, with the folder it searches judged before fd walks it and every path fd reports judged after: find's operations
+ * can only replace fd (and with it the .gitignore rules it keeps), so this is where its containment lives. fd does not follow a
+ * symlink it meets, only one it starts from, which the first check refuses; the second takes out a symlink that points outside,
+ * and holds should fd ever follow one. The names of .env files stay, as `ls -a` in the sandbox shows them: only reads are refused.
+ */
+export function guardedFindTool(cwd, judge) {
+    const find = createFindToolDefinition(cwd);
+    return {
+        ...find,
+        execute: async (id, params, signal, onUpdate, ctx) => {
+            const searchPath = resolveToCwd(params.path || '.', ctx?.cwd || cwd);
+            const root = judge(searchPath);
+            if (root.verdict !== 'allow')
+                throw new Error(`Refused: ${root.reason}`);
+            const result = await find.execute(id, params, signal, onUpdate, ctx);
+            // One path under searchPath a line, no line empty, then a blank line and the notices; "No files found" names nothing, so it stays.
+            const contained = (text) => {
+                const [list, notices] = text.split('\n\n');
+                const kept = list.split('\n').filter((line) => judge(join(searchPath, line)).verdict === 'allow');
+                // The limit notice stays even when every path went: what fd stopped at may hide matches a higher limit would reach.
+                return [kept.length ? kept.join('\n') : 'No files found matching pattern', notices].filter(Boolean).join('\n\n');
+            };
+            return { ...result, content: result.content.map((c) => (c.type === 'text' ? { ...c, text: contained(c.text) } : c)) };
+        },
+    };
+}
+/** pi's grep tool, opening files through `operations` and reporting no line of a .env file. */
+export function guardedGrepTool(cwd, operations) {
+    const grep = createGrepToolDefinition(cwd, { operations });
+    return {
+        ...grep,
+        execute: async (...args) => {
+            const result = await grep.execute(...args);
+            return { ...result, content: result.content.map((c) => (c.type === 'text' ? { ...c, text: withoutEnvLines(c.text) } : c)) };
+        },
+    };
+}
 const previewRetries = new WeakMap();
 export function previewRetryState(log) {
     let state = previewRetries.get(log);
@@ -927,6 +1546,8 @@ export function previewRetryState(log) {
 }
 const setupBranch = (branch) => /^impeccable\/setup(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
 const driveBranch = (branch) => /^impeccable\/test-drive(?:-(?:[2-9]|[1-9][0-9]+))?$/.test(branch);
+/** A GitHub repository as `<owner>/<name>`. */
+const REPOSITORY = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/;
 /** `gh pr ready <the test drive's branch> [--repo <owner>/<name>]`, and nothing else (never `--undo`, a number or another branch): the branch and the repository named, or null. */
 function ghReady(args) {
     const [branch, ...rest] = args;
@@ -936,15 +1557,42 @@ function ghReady(args) {
         return { branch };
     const inline = rest[0]?.startsWith('--repo=') ? rest[0].slice('--repo='.length) : undefined;
     const repository = inline ?? (rest[0] === '--repo' || rest[0] === '-R' ? rest[1] : undefined);
-    return rest.length === (inline !== undefined ? 1 : 2) && typeof repository === 'string' && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?\/[A-Za-z0-9_.-]{1,100}$/.test(repository) ? { branch, repository } : null;
+    return rest.length === (inline !== undefined ? 1 : 2) && typeof repository === 'string' && REPOSITORY.test(repository) ? { branch, repository } : null;
 }
-const pushBranch = (words, literal = setupBranch) => words.length === 5 && words[0] === 'git' && words[1] === 'push'
-    && ['-u', '--set-upstream'].includes(words[2]) && words[3] === 'origin' && literal(words[4]) ? words[4] : undefined;
+/** `gh pr view [<number> | this run's branch] [--repo <owner>/<name>] [--json <fields>] [--comments]`, each once: the repository named, or null. */
+function ghView(args) {
+    const seen = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const at = arg.startsWith('--') ? arg.indexOf('=') : -1;
+        const flag = at < 0 ? arg : arg.slice(0, at);
+        const name = flag === '-R' ? '--repo' : flag === '-c' ? '--comments' : flag;
+        let value = '';
+        if (name === '--repo' || name === '--json') {
+            value = (at < 0 ? args[++i] : arg.slice(at + 1)) ?? '';
+            if (!value || value.startsWith('-'))
+                return null;
+        }
+        else if (name !== '--comments' || at >= 0) {
+            if (arg.startsWith('-') || !(/^[1-9]\d*$/.test(arg) || setupBranch(arg) || driveBranch(arg)))
+                return null;
+        }
+        const key = arg.startsWith('-') ? name : 'selector';
+        if (seen.has(key))
+            return null;
+        seen.set(key, value);
+    }
+    const repository = seen.get('--repo');
+    return repository === undefined ? {} : REPOSITORY.test(repository) ? { repository } : null;
+}
+/** The branch of `push -u origin <branch>`, git's words from its command on, when `literal` takes it. */
+const pushBranch = (args, literal = setupBranch) => args.length === 4 && args[0] === 'push'
+    && ['-u', '--set-upstream'].includes(args[1]) && args[2] === 'origin' && literal(args[3]) ? args[3] : undefined;
 function createArguments(args) {
     const values = new Map();
     const names = {
         '-H': 'head', '--head': 'head', '-R': 'repo', '--repo': 'repo', '-B': 'base', '--base': 'base',
-        '-t': 'title', '--title': 'title', '-b': 'body', '--body': 'body', '-F': 'body-file', '--body-file': 'body-file',
+        '-t': 'title', '--title': 'title', '-b': 'body', '--body': 'body',
         '-a': 'assignee', '--assignee': 'assignee', '-r': 'reviewer', '--reviewer': 'reviewer',
         '-l': 'label', '--label': 'label', '-m': 'milestone', '--milestone': 'milestone', '-p': 'project', '--project': 'project',
     };
@@ -966,16 +1614,12 @@ function createArguments(args) {
             return;
         values.set(name, value);
     }
-    const head = values.get('head'), bodyFile = values.get('body-file');
+    const head = values.get('head');
     if (head !== undefined && !setupBranch(head) && !driveBranch(head))
         return;
-    if (!filled && (!values.get('title')?.trim() || (!values.has('body') && !values.has('body-file'))))
-        return;
-    if (values.has('body') && values.has('body-file'))
-        return;
-    if (values.has('body-file') && (!bodyFile || bodyFile === '-'))
+    if (!filled && (!values.get('title')?.trim() || !values.has('body')))
         return;
-    return { head, repository: values.get('repo'), bodyFile, base: values.get('base'), filled };
+    return { head, repository: values.get('repo'), base: values.get('base'), filled };
 }
 /** Called synchronously only after the ordinary fence allows the entire command. */
 export function reservePreviewCommand(state, command, root, scratch) {
@@ -990,8 +1634,11 @@ export function reservePreviewCommand(state, command, root, scratch) {
             where.cwd = resolve(where.cwd, words[1]);
             continue;
         }
+        const gitWords = words[0] === 'git' ? gitArgs(words.slice(1)) : [];
+        if (!gitWords)
+            return deny('a git option before the command');
         // The test drive is the run's other pull request: one branch, one pull request, a few pushes, none of the setup pull request's attempts.
-        const drivePush = pushBranch(words, driveBranch);
+        const drivePush = pushBranch(gitWords, driveBranch);
         if (drivePush) {
             if (drive && drivePush !== drive)
                 return deny('keep the test drive on one branch');
@@ -1000,8 +1647,8 @@ export function reservePreviewCommand(state, command, root, scratch) {
             drive = drivePush;
             continue;
         }
-        if (words[0] === 'git' && words[1] === 'push') {
-            const branch = pushBranch(words), locked = state.pr?.branch ?? create;
+        if (gitWords[0] === 'push') {
+            const branch = pushBranch(gitWords), locked = state.pr?.branch ?? create;
             if (!branch)
                 return deny('push only a literal setup branch');
             if (locked && branch !== locked)
@@ -1020,10 +1667,6 @@ export function reservePreviewCommand(state, command, root, scratch) {
             const parsed = createArguments(words.slice(3));
             if (!parsed)
                 return deny('create each pull request with a title and a body, or --fill');
-            const body = parsed.bodyFile;
-            if (body && (body.startsWith('~') || /[$*?[]/.test(body) || isSecretFile(body) || isSecretFile(realPath(resolve(where.cwd, body)))
-                || (outside(body, where) && !inScratch(body, where))))
-                return deny('use a non-secret body file inside the checkout or run scratch');
             if (state.requireHistory && (!parsed.head || !parsed.repository))
                 return deny('name the repository and literal head explicitly for self-hosted previews');
             if (!state.repository || (parsed.repository !== undefined && parsed.repository.toLowerCase() !== state.repository.toLowerCase())
@@ -1056,6 +1699,14 @@ export function reservePreviewCommand(state, command, root, scratch) {
             if (!driveCreated || parsed.branch !== drive)
                 return deny('mark ready the test drive this run opened');
         }
+        if (words[0] === 'gh' && words[1] === 'pr' && words[2] === 'view') {
+            const parsed = ghView(words.slice(3));
+            if (!parsed)
+                return deny("view only this run's pull requests, by number or branch name");
+            // Without --repo, gh picks a repository from the checkout's remotes, which may name another one.
+            if (!state.repository || parsed.repository?.toLowerCase() !== state.repository.toLowerCase())
+                return deny('view pull requests of this repository only, named with --repo');
+        }
     }
     // Every segment passes before any reservation becomes visible to the next tool call.
     if (pushes !== state.pushReservations && state.pr)
@@ -1146,8 +1797,9 @@ export function endHostSetup(log, host) {
 }
 /**
  * What the `vercel link`s of a command that ran left, each in the folder it ran in (the one `--cwd` names, else the
- * shell's, after its `cd`), whatever the command's exit: a folder linked to a project keeps the hold; links that left
- * their folders linked to none failed, and end the Vercel setup.
+ * shell's, after its `cd`), whatever the command's exit: a folder with a project file of any shape keeps the hold (the
+ * agent may have trimmed one that names a project); links that left their folders with none failed, and end the Vercel
+ * setup.
  */
 function noteVercelLinks(log, root, command) {
     let cwd = root;
@@ -1164,11 +1816,64 @@ function noteVercelLinks(log, root, command) {
     }
     if (!folders.length)
         return;
-    if (folders.some((folder) => linkedVercelProject(folder) !== null))
+    if (folders.some((folder) => existsSync(join(folder, '.vercel', 'project.json'))))
         linkedVercel.add(log);
     else
         endHostSetup(log, 'vercel');
 }
+/** What the run's own host commands made and linked, by the run's log: the Vercel projects `vercel project add` made, by team and name, and the projects and sites a `vercel link` or `netlify sites:create` left a folder linked to, by id. */
+const runProjects = new WeakMap();
+function hostProjects(log) {
+    let projects = runProjects.get(log);
+    if (!projects)
+        runProjects.set(log, (projects = { added: new Set(), linked: new Map() }));
+    return projects;
+}
+/** The Vercel projects a `vercel project add` of this run made, as `<team>/<name>`, the name lowercased: a name the team's project held already fails the command, so one here is the run's, in that team. */
+export const vercelProjectsAdded = (log) => hostProjects(log).added;
+/** The Vercel projects and Netlify sites a `vercel link` or `netlify sites:create` of this run left its folder linked to, by id: the ones the connection tools may connect. */
+export const linkedByRun = (log) => hostProjects(log).linked;
+/**
+ * What a `vercel project add`, `vercel link` or `netlify sites:create` that ran on its own (after a `cd` at most) and
+ * succeeded made: the name the add took, in the team the command named or the run had chosen, and what the link or
+ * create left its folder linked to (the CLI wrote the link file last, so its id, and the team id beside it, are the
+ * CLI's), the link in that team too. A link file the agent writes, a command that failed, one that runs anything after
+ * the host's command, or one the shell may have skipped (after `||`, or in a pipe) proves nothing and records nothing.
+ * An add that failed (its name is in use: the project is the person's) ends the Vercel setup, as a failed link does, so
+ * the hold on pushes goes, unless the checkout holds a project file of any shape (the agent may have trimmed one that
+ * names a project), which may build a push and holds it.
+ */
+function noteHostProjects(log, root, command, failed) {
+    const segments = parseCommand(command) ?? [];
+    const last = segments.at(-1);
+    if (!last || last.before === '||' || last.before === '|' || !segments.slice(0, -1).every((seg) => seg.words[0] === 'cd'))
+        return;
+    // The words as the fence reads them, the subcommand first wherever the options stand.
+    const [cli, ...args] = last.words;
+    const { words: [sub, ...rest], options } = cli === 'vercel' ? vercelArgs(args) : cli === 'netlify' ? netlifyArgs(args) : { words: [], options: new Map() };
+    const named = VERCEL_TEAM.map((name) => options.get(name)).find((value) => typeof value === 'string');
+    const team = typeof named === 'string' ? named : teamsChosen(log).get('vercel') ?? '';
+    if (cli === 'vercel' && sub === 'project' && rest[0] === 'add' && rest[1]) {
+        if (!failed)
+            hostProjects(log).added.add(`${team}/${rest[1].toLowerCase()}`);
+        else if (!existsSync(join(root, '.vercel', 'project.json')))
+            endHostSetup(log, 'vercel');
+        return;
+    }
+    if (failed)
+        return;
+    const cwd = segments.slice(0, -1).reduce((folder, seg) => resolve(folder, seg.words[1] ?? '.'), root);
+    if (cli === 'vercel' && sub === 'link') {
+        const link = linkedVercelProject(cwd);
+        if (link)
+            hostProjects(log).linked.set(link.projectId, { team, orgId: link.orgId });
+    }
+    else if (cli === 'netlify' && sub === 'sites:create') {
+        const id = linkedNetlifySite(cwd);
+        if (id)
+            hostProjects(log).linked.set(id, { team: '' });
+    }
+}
 /** The team the person picked for each host's CLI in this run, by the run's log. */
 const chosenTeams = new WeakMap();
 function teamsChosen(log) {
@@ -1200,15 +1905,17 @@ export const MAX_TOOL_CALLS = 400;
 /** What still runs past the cap, so the run can say where it got to and end. */
 const FINISHING = new Set(['impeccable_progress', 'impeccable_report']);
 /** Names shaped like a credential, which the agent's shell does not inherit: the scripts it runs are the repository's code, run as the person. */
-const CREDENTIAL = /TOKEN|SECRET|PASSW(?:OR)?D|PASSPHRASE|CREDENTIAL|PRIVATE|(?:^|_)(?:API_?)?KEY(?:_|$)|APIKEY|AUTH(?!OR)|COOKIE|_PWD$|DATABASE_URL$|^(?:AWS|AZURE|ANTHROPIC|OPENAI|OP_SESSION)_/i;
+const CREDENTIAL = /TOKEN|SECRET|PASSW(?:OR)?D|PASSPHRASE|CREDENTIAL|PRIVATE|(?:^|_)(?:API_?)?KEY(?:_|$)|APIKEY|AUTH(?!OR)|COOKIE|(?:^|_)PAT(?:_|$)|WEBHOOK|JWT|SESSION|(?:^|_)PASS$|SERVICE_ACCOUNT|KEYFILE|SERVICE_ROLE|_PWD$|DATABASE_URL$|^(?:AWS|AZURE|ANTHROPIC|OPENAI|OP_SESSION)_/i;
 /**
- * The environment for the agent's shell: the person's, without credentials, whether by name or as a URL's password (a database's
- * connection string), a proxy's too. A folder, a socket or AWS's region setting is a place, not a secret, whatever its name looks like, so
+ * The environment for the agent's shell: the person's, without credentials, whether by name, as a URL's password (a database's
+ * connection string, a proxy's too), as a service account's key, or as a value the output scan finds a secret in (GITHUB_PAT's ghp_…
+ * under any name). A folder, a socket or AWS's region setting is a place, not a secret, whatever its name looks like, so
  * VERCEL_AUTH_CONFIG_DIR, SSH_AUTH_SOCK and AWS_REGION stay; gh and git sign in from their own config and keychain.
  */
 const PLACE = /_(?:DIR|HOME|SOCK)$|^AWS_(?:DEFAULT_)?REGION$/;
+const SECRET_VALUE = /:\/\/[^/@\s:]*:[^/@\s]+@|"private_key"/;
 export function shellEnvironment(env) {
-    return Object.fromEntries(Object.entries(env).filter(([name, value]) => (PLACE.test(name) || !CREDENTIAL.test(name)) && !/:\/\/[^/@\s:]*:[^/@\s]+@/.test(value ?? '')));
+    return Object.fromEntries(Object.entries(env).filter(([name, value = '']) => (PLACE.test(name) || !CREDENTIAL.test(name)) && !SECRET_VALUE.test(value) && !scan('output', value).length));
 }
 /** The impeccable_* tools whose input is saved, sent to the web page or shown to the person. */
 const OUTPUT_TOOLS = new Set(['impeccable_write', 'impeccable_report', 'impeccable_progress', 'impeccable_ask']);
@@ -1224,15 +1931,14 @@ function strings(value, at = '') {
 }
 /**
  * Text shaped like a secret in what a tool call writes, saves or shows: the new text of a write or an edit (never what it
- * replaces, and nothing in a .env file's example such as .env.example), and every string the impeccable_* tools take.
- * Each string is read with its field's name in front, so a secret-like name set to a random value is seen too.
+ * replaces), and every string the impeccable_* tools take. Each string is read with its field's name in front, so a secret-like
+ * name set to a random value is seen too, except in a .env file's example such as .env.example, whose placeholders are just that.
  */
 function outputCheck(tool, input) {
     let fields;
+    // Another file named as an example (config.ts.example) is checked like any file.
+    const placeholders = (tool === 'write' || tool === 'edit') && basename(String(input.path ?? '')).startsWith('.env') && EXAMPLE.test(String(input.path ?? ''));
     if (tool === 'write' || tool === 'edit') {
-        // A .env file's example holds placeholders; another file named as an example (config.ts.example) is checked like any file.
-        if (basename(String(input.path ?? '')).startsWith('.env') && EXAMPLE.test(String(input.path ?? '')))
-            return null;
         fields = tool === 'write' ? [['content', input.content]] : [['newText', input.newText], ...strings(input.edits, 'edits').filter(([at]) => at.endsWith('.newText'))];
     }
     else {
@@ -1240,15 +1946,52 @@ function outputCheck(tool, input) {
     }
     // The one reference impeccable_write swaps for what the person typed: a test account's password.
     const swapped = (at, text) => tool === 'impeccable_write' && /(?:^|\/)test-accounts$/.test(String(input.path)) && /^body\.accounts\[\d+\]\.password$/.test(at) && /^secret:[0-9a-f]{12}$/.test(text);
+    const read = (name, text) => scan('output', `${name}: ${text}`).find((p) => !placeholders || !PLACEHOLDER_SHAPES.has(p.name));
     for (const [at, text] of fields) {
         if (typeof text !== 'string' || swapped(at, text))
             continue;
-        const hit = scan('output', `${at.replace(/\[\d+\]/g, '').split('.').pop()}: ${text}`)[0];
+        const name = at.replace(/\[\d+\]/g, '').split('.').pop();
+        // plainText joins what an escape sequence splits (ghp_abc␛[0mdef…) on the way to the screen and the web page, so that is read too.
+        // The text as written is read as well: taking a sequence out can also hide a secret, a random value that then runs into `.ts`.
+        const plain = plainText(text);
+        const hit = read(name, text) ?? (plain === text ? undefined : read(name, plain));
         if (hit)
             return found(hit, at);
     }
     return null;
 }
+/** The files impeccable_sync_workflow writes or removes, which no write of pi's shows the fence: the run's own once that tool answered that it wrote or removed one. */
+const WORKFLOW_FILES = ['.github/workflows/impeccable-preview.yml', '.github/workflows/pristine-preview.yml'];
+/** Whether a command runs the repository's code: a package manager's install, script or tool, which may rewrite what the scripts and tools load. */
+const runsScripts = (command) => (parseCommand(command) ?? []).some(({ words }) => {
+    const cmd = words[envCount(words)] ?? '';
+    return PACKAGE_MANAGERS.has(cmd) || cmd === 'npx' || cmd === 'bunx';
+});
+/** What an install writes by design, and the options next build writes into tsconfig.json: a change there says nothing about who wrote it. */
+const COMMAND_WRITES = /(?:^|\/)(?:node_modules\/|tsconfig[^/]*\.json$)/i;
+const hashOf = (path) => {
+    try {
+        return createHash('sha256').update(readFileSync(path)).digest('hex');
+    }
+    catch {
+        return '';
+    }
+};
+/**
+ * The files the fence trusts that a command could rewrite, each by its hash: the package.json whose scripts run, the Vercel
+ * project the folder is linked to, and every file the checkout tracks or does not ignore that the scripts and tools load,
+ * whatever git says of its state, since a command can commit what it rewrote. Read before a command that runs the
+ * repository's code and again after it; a hash that differs is a file that command changed.
+ */
+function trustedFiles(root) {
+    const paths = new Set(['package.json', '.vercel/project.json']);
+    // A checkout git cannot read still has the two files at the top.
+    for (const path of (gitRead(['ls-files', '-z', '--cached', '--others', '--exclude-standard'], root) ?? '').split('\0')) {
+        if (path && LOADED.test(path) && !COMMAND_WRITES.test(path))
+            paths.add(path);
+    }
+    return new Map([...paths].map((path) => [path, hashOf(join(root, path))]));
+}
 /** What the model reads after an output check refused a call: why, and the way a setup carries a secret instead. */
 const SECRET_RULE = 'A secret never goes into a file, a setting, a commit, a pull request or a message, so nothing was done: take it out. Where the setup needs one, name it as a repository secret, ${{ secrets.NAME }}, and put "Add the NAME repository secret" in the report\'s left.';
 /** `scans` takes every content check's match: the debug log's, and --scan-report's file when there is one. */
@@ -1258,6 +2001,18 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
         /** The first file the agent changed that the scripts and tools load, and the first of those but vite.config, which also stops the local preview check. */
         let changed;
         let previewChanged;
+        /** The scripts and tools stop once `path`, which they load, changed, and the local preview check too unless every name of the file is a vite.config. */
+        const stop = (path, names) => {
+            changed ??= path;
+            if (!names.every((p) => VITE_CONFIG.test(p)))
+                previewChanged ??= path;
+        };
+        /** The paths this run wrote or named, as git names them: what a commit may carry. */
+        const touched = new Set();
+        /** What impeccable_sync_workflow last left at each workflow file it wrote (the sha256 of the bytes) or removed (null). */
+        const synced = new Map();
+        /** The trusted files as they were before each command that runs the repository's code, by its call. */
+        const watched = new Map();
         let calls = 0;
         pi.on('tool_call', (event) => {
             if (++calls > MAX_TOOL_CALLS && !FINISHING.has(event.toolName)) {
@@ -1270,9 +2025,15 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
             let shown;
             if (event.toolName === 'bash') {
                 shown = String(input.command ?? '');
-                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log), vercelSettled: vercelFirstDeploymentSettled(log) });
+                decision = classifyCommand(shown, root, { protectedBranches, scriptsChanged, scratch, hosts: hostsAgreed(log), teams: teamsChosen(log), vercelSettled: vercelFirstDeploymentSettled(log), touched, synced, repository: retry.repository });
                 if (decision.verdict === 'allow')
                     decision = reservePreviewCommand(retry, shown, root, scratch);
+                if (decision.verdict === 'allow') {
+                    for (const path of namedPaths(shown, root))
+                        touched.add(path);
+                    if (placeOf(shown) === 'sandbox' && runsScripts(shown))
+                        watched.set(event.toolCallId, trustedFiles(root));
+                }
             }
             else if (event.toolName === 'impeccable_verify_preview' && previewChanged) {
                 shown = `local preview after an edit of ${previewChanged}`;
@@ -1280,15 +2041,16 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
             }
             else if (['read', 'write', 'edit', 'grep', 'find', 'ls'].includes(event.toolName)) {
                 shown = `${event.toolName} ${String(input.path ?? '.')}`;
-                decision = classifyFileTool(event.toolName, input.path, root, scratch);
+                decision = classifyFileTool(event.toolName, input.path, root, scratch, input.glob);
                 if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow')
                     decision = outputCheck(event.toolName, input) ?? decision;
-                // The name written to and the file it resolves to: through a symlink, a vite.config may be another config.
-                const loaded = [String(input.path), realPath(resolve(root, String(input.path)))].filter((p) => LOADED.test(p));
-                if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow' && loaded.length) {
-                    changed ??= String(input.path);
-                    if (!loaded.every((p) => VITE_CONFIG.test(p)))
-                        previewChanged ??= String(input.path);
+                if ((event.toolName === 'write' || event.toolName === 'edit') && decision.verdict === 'allow') {
+                    for (const path of writtenPaths(String(input.path), root))
+                        touched.add(path);
+                    // The name written to and the file it resolves to: through a symlink, a vite.config may be another config.
+                    const loaded = [String(input.path), realPath(resolve(root, String(input.path)))].filter((p) => LOADED.test(p));
+                    if (loaded.length)
+                        stop(String(input.path), loaded);
                 }
             }
             else if (OUTPUT_TOOLS.has(event.toolName)) {
@@ -1321,13 +2083,47 @@ export function fenceExtension(root, log, protectedBranches, scratch, scans = sc
         });
         // What the agent reads is data: text in it shaped like instructions gets a line saying so, and the result is otherwise as it was.
         pi.on('tool_result', (event) => {
+            const text = () => event.content.map((c) => (c.type === 'text' ? c.text : '')).join('\n');
+            if (event.toolName === 'impeccable_sync_workflow') {
+                try {
+                    const answer = JSON.parse(text());
+                    for (const action of answer.ok === true && Array.isArray(answer.actions) ? answer.actions : []) {
+                        if (typeof action.path !== 'string' || !WORKFLOW_FILES.includes(action.path))
+                            continue;
+                        if (action.action === 'written' && typeof action.sha256 === 'string')
+                            synced.set(action.path, action.sha256);
+                        else if (action.action === 'removed')
+                            synced.set(action.path, null);
+                        else
+                            continue;
+                        touched.add(action.path);
+                    }
+                }
+                catch {
+                    // A refusal that is not JSON wrote nothing.
+                }
+                return undefined;
+            }
             if (!['read', 'grep', 'bash'].includes(event.toolName))
                 return undefined;
             const input = event.input;
-            if (event.toolName === 'bash')
+            if (event.toolName === 'bash') {
                 noteVercelLinks(log, root, String(input.command ?? ''));
+                noteHostProjects(log, root, String(input.command ?? ''), event.isError);
+            }
+            const before = watched.get(event.toolCallId);
+            if (before) {
+                watched.delete(event.toolCallId);
+                const after = trustedFiles(root);
+                // Every file the command changed counts, a removed one too (gone from the list, its old hash stands for it): a vite.config among them leaves the local preview check to the others.
+                const rewritten = [...new Set([...before.keys(), ...after.keys()])].filter((path) => before.get(path) !== after.get(path));
+                if (rewritten.length)
+                    log.write('a command changed files the scripts and tools load', rewritten.join(', '));
+                for (const path of rewritten)
+                    stop(path, [path]);
+            }
             const sources = event.toolName === 'bash' ? (parseCommand(String(input.command ?? ''))?.flatMap((seg) => seg.words) ?? []) : [input.path, input.glob].filter((s) => typeof s === 'string');
-            const hits = scan('input', event.content.map((c) => (c.type === 'text' ? c.text : '')).join('\n'), sources);
+            const hits = scan('input', text(), sources);
             if (!hits.length)
                 return undefined;
             for (const hit of hits)