@impeccable/reviews 0.1.6 → 0.1.8

package/dist/tools.js

@@ -7,25 +7,27 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
-import { netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
-import { cfRunner, pagesProject, readCloudflarePreviews } from './cloudflare.js';
+import { APPS_QUESTION, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, sentTo, startedIn } from './host-questions.js';
+import { enableNetlifyPreviews, folderOf } from './host-previews.js';
+import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
+import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
-import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
+import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
 import { gitEnvironment } from './sandbox.js';
 import { openBrowser } from './login.js';
-import { TASK_STATUSES } from './sync.js';
+import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
 import { askPerson, reportStatus, reportTasks, reportWait } from './ui/bridge.js';
 import { SEE_THE_REVIEW } from './ui/look.js';
-import { noteSensitiveAnswer } from './ui/sensitive.js';
+import { noteSensitiveAnswer, plainText } from './ui/sensitive.js';
+export { STATUS_MAX, statusVoiceError } from './sync.js';
 /** The first way `value` breaks `schema`, or null when it fits. */
 export function schemaError(schema, value, at = 'input') {
     const types = schema.type === undefined ? [] : [schema.type].flat();
@@ -106,15 +108,6 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
 const NO_INPUT = { type: 'object', properties: {}, additionalProperties: false };
-/** The most a status line holds; longer text belongs in the report. */
-export const STATUS_MAX = 70;
-const STATUS_RULE = `Status lines are in the product voice: a present-tense verb phrase of at most ${STATUS_MAX} characters that says what is happening, such as "Running the build" or "Opening the setup pull request". No "I'm", "I am", "Let me", "I'll" or "trying to"; detail goes in the report. Nothing was saved: call impeccable_progress again with the status rephrased.`;
-/** Why a status line breaks the voice, with the rule to rephrase it by; null when it keeps it. The line is never rewritten here. */
-export function statusVoiceError(line) {
-    const text = line.trim();
-    const why = /^(i['’]m|i am|let me|i['’]ll)\b/i.test(text) || /\btrying to\b/i.test(text) ? 'it narrates like an assistant' : text.length > STATUS_MAX ? `it is ${text.length} characters long` : null;
-    return why ? `Refused: "${text}" does not fit the status line, because ${why}. ${STATUS_RULE}` : null;
-}
 /** Why the status line and the task list say different things, one task in progress at a time and the status its detail; null when they agree. */
 function stageError(status, tasks) {
     const running = tasks.filter((t) => t.status === 'in_progress');
@@ -186,10 +179,15 @@ const TEST_PR = {
     ...PULL_REQUEST,
     properties: { ...PULL_REQUEST.properties, setup_pr: { ...PULL_REQUEST, description: 'The setup pull request, when there is one: this run\'s, or on a rerun the earlier run\'s.' } },
 };
+/** An app's key as the setup state gives it. */
+const APP_KEY_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
+/** The app a host tool reads for, on a repository with several apps: its previews are those of the project or site that builds the app's folder. */
+const APP_KEY = { type: 'string', minLength: 1, description: 'On a repository with several apps, the key of the app this is for, one the apps question picked: only the previews of the host project that builds that app\'s folder are read.' };
 const HOSTED_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the deployments of its head only, and waits up to five minutes for one to finish building.' },
     },
 };
@@ -197,6 +195,7 @@ const NETLIFY_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
     },
 };
@@ -204,6 +203,7 @@ const CLOUDFLARE_PREVIEWS = {
     type: 'object',
     additionalProperties: false,
     properties: {
+        appKey: APP_KEY,
         pull: { type: 'integer', minimum: 1, description: 'A pull request of this run, once pushed: reads its previews only, and waits up to five minutes for one to finish building.' },
         branch: { type: 'string', minLength: 1, description: 'A branch of this run, once pushed and before its pull request exists, such as impeccable/test-drive: reads the build of its head only, and waits up to five minutes for it to finish.' },
     },
@@ -213,7 +213,7 @@ const PROVE_PREVIEW = {
     additionalProperties: false,
     required: ['url', 'expect'],
     properties: {
-        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or a page on it.' },
+        url: { type: 'string', minLength: 1, description: 'An address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed, or the live app\'s address one of them answered as production or a file of this checkout names, or a page on it.' },
         expect: { type: 'string', minLength: 1, description: 'Words the page shows that a file of this checkout holds, such as the app\'s name in its title.' },
     },
 };
@@ -254,6 +254,20 @@ const namesCredential = (q) => {
 };
 /** Under the field of every text question typed in the open, where the model reads the answer. */
 const NEVER_A_CREDENTIAL = 'Never enter a password, a token or a key here.';
+const ENABLE_PREVIEWS = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['host'],
+    properties: { host: { type: 'string', enum: ['netlify', 'cloudflare'], description: "The host whose pullRequestPreviews said enabled false in this run." } },
+};
+const CLOUDFLARE_CONNECT = {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+        command: { type: 'string', minLength: 1, description: "The build command Cloudflare runs for a project the run creates: the package's build script; none for plain HTML." },
+        outputDir: { type: 'string', minLength: 1, description: 'The folder the build writes the pages to, relative to the checkout, for a project the run creates; "." for plain HTML at the root.' },
+    },
+};
 const NETLIFY_CONNECT = {
     type: 'object',
     additionalProperties: false,
@@ -279,17 +293,28 @@ function askError(q) {
         return 'input.options[].selected is for multi only';
     return new Set(values).size === values.length ? null : 'input.options has a value twice';
 }
-/** Why `url` is not pull request `number` of owner/repo on GitHub; null when it is. */
-function pullRequestError(url, number, owner, repo) {
-    const m = URL.canParse(url) ? /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/.exec(new URL(url).pathname) : null;
-    const ok = m && new URL(url).origin === 'https://github.com' && m[1].toLowerCase() === owner.toLowerCase() && m[2].toLowerCase() === repo.toLowerCase() && Number(m[3]) === number;
-    return ok ? null : `${url} is not pull request #${number} of ${owner}/${repo} on GitHub`;
+/**
+ * Pull request `number` of owner/repo on GitHub, when `url` is it: its address rebuilt from those validated parts, so no
+ * query, fragment or other character the model wrote reaches the browser or the clipboard. Null when `url` is not it.
+ */
+function canonicalPullRequest(url, number, owner, repo) {
+    const parsed = URL.canParse(url) ? new URL(url) : null;
+    const m = parsed && /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/.exec(parsed.pathname);
+    const ok = m && parsed.origin === 'https://github.com' && !parsed.username && !parsed.password
+        && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(owner) && /^[A-Za-z0-9._-]{1,100}$/.test(repo)
+        && m[1].toLowerCase() === owner.toLowerCase() && m[2].toLowerCase() === repo.toLowerCase() && Number.isSafeInteger(number) && number > 0 && Number(m[3]) === number;
+    return ok ? `https://github.com/${owner}/${repo}/pull/${number}` : null;
+}
+/** `pr` with its address rebuilt as pull request `number` of owner/repo on GitHub, or undefined when it is not that. */
+export function ownPullRequest(pr, owner, repo) {
+    const url = pr && canonicalPullRequest(pr.url, pr.number, owner, repo);
+    return url ? { number: pr.number, url } : undefined;
 }
 /** This run's open pull request from `branch`, its head in this repository rather than a fork, with that head's name; or why it is not. */
 async function runPullRequest(ctx, pr, branch, signal) {
-    const error = pullRequestError(pr.url, pr.number, ctx.owner, ctx.repo);
-    if (error)
-        return { problem: error };
+    const url = canonicalPullRequest(pr.url, pr.number, ctx.owner, ctx.repo);
+    if (!url)
+        return { problem: `${pr.url} is not pull request #${pr.number} of ${ctx.owner}/${ctx.repo} on GitHub` };
     const found = await ctx.viewPullRequest(pr.number);
     if ('error' in found)
         return { problem: `gh pr view ${pr.number} did not find it (${found.error})` };
@@ -303,7 +328,7 @@ async function runPullRequest(ctx, pr, branch, signal) {
     if (!await (ctx.setupPullHeadReader ?? readSetupPullHead)(ctx.owner, ctx.repo, pr.number, found.headRefName, { signal })) {
         return { problem: `the branch of #${pr.number} could not be verified in this repository; a fork's branch cannot be recorded` };
     }
-    return { branch: found.headRefName, ...(found.baseRefName ? { base: found.baseRefName } : {}) };
+    return { url, branch: found.headRefName, ...(found.baseRefName ? { base: found.baseRefName } : {}) };
 }
 const PREVIEW_COMMAND = { type: 'object', additionalProperties: false, required: ['command'], properties: {
         command: { type: 'string', minLength: 1, description: 'A command of the repository\'s own scripts or tools, without cd.' },
@@ -518,10 +543,13 @@ export async function verifyLocalPreview(input, root, signal, sandbox) {
         scratch = await realpath(await mkdtemp(join('/tmp', 'impeccable-preview-')));
         const snapshot = join(scratch, 'checkout'), home = join(scratch, 'home'), temp = join(scratch, 'tmp');
         await Promise.all([snapshot, home, temp].map((p) => mkdir(p, { mode: 0o700 })));
-        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it.
+        // The app's own commands run in a sandbox of their own, writing only in this folder; the check's git and Docker run outside it. Without one they would run the repository's code with all the person's access, so the check refuses; only the tests, which hand over no sandbox, run them plain.
         const inSandbox = sandbox?.preview(scratch);
+        if (sandbox && !inSandbox)
+            return fail('environment', 'Local preview verification needs a sandbox of its own, and this machine has none for it (Linux, or --no-sandbox): save the build the repository names, leave its proof to the preview job on the pull request, and say so under what is not verified.');
         const confined = (command, processEnv) => inSandbox?.(command, processEnv) ?? { file: '/bin/sh', args: ['-c', command], env: processEnv };
-        env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
+        // Built afresh rather than from process.env, so it carries Windows' guard against a git.exe in the checkout itself (IMP-23), after what the model supplied.
+        env = { ...env, ...supplied, ...(serverInput ? { PORT: String(serverInput.port) } : {}), NoDefaultCurrentDirectoryInExePath: '1', HOME: home, TMPDIR: temp, TMP: temp, TEMP: temp, XDG_CONFIG_HOME: join(home, '.config'), npm_config_cache: join(scratch, 'npm'), npm_config_userconfig: join(home, '.npmrc'), npm_config_globalconfig: join(scratch, 'global-npmrc'), PIP_CONFIG_FILE: '/dev/null', PIP_NO_INPUT: '1', PIP_DISABLE_PIP_VERSION_CHECK: '1', PIP_REQUIRE_VIRTUALENV: 'true', BUNDLE_PATH: join(scratch, 'bundle'), BUNDLE_APP_CONFIG: join(scratch, 'bundle-config') };
         const listing = await run('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], root, true, 120_000, signal ?? null, gitEnvironment(env));
         if (!listing.ok)
             return fail(stage, 'Could not list checkout files.');
@@ -777,7 +805,14 @@ export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
  */
 export async function pushedChanges(cwd, base, head) {
     try {
-        const { stdout } = await execFileAsync('git', ['diff', '-z', '--name-status', '--no-renames', `refs/remotes/origin/${base}...refs/remotes/origin/${head}`], { cwd, timeout: 10_000, env: gitEnvironment() });
+        // The two branches as the remote has them, fetched so the diff can be read here: refs/remotes/origin/* sit in the checkout's git folder, where a command in the sandbox can move them.
+        const refs = [`refs/heads/${base}`, `refs/heads/${head}`];
+        const { stdout: heads } = await execFileAsync('git', ['ls-remote', '--heads', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const sha = new Map(heads.split('\n').filter(Boolean).map((line) => line.split('\t').reverse()));
+        if (!refs.every((ref) => sha.has(ref)))
+            return null;
+        await execFileAsync('git', ['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const { stdout } = await execFileAsync('git', ['diff', '-z', '--name-status', '--no-renames', `${sha.get(refs[0])}...${sha.get(refs[1])}`], { cwd, timeout: 10_000, env: gitEnvironment() });
         const fields = stdout.split('\0');
         return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
     }
@@ -1451,7 +1486,7 @@ export function createTools(ctx) {
      * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
      * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
      */
-    async function awaitBuild(host, status, read, built, page, signal) {
+    async function awaitBuild(host, status, read, built, page, signal, access) {
         const first = await read();
         if (built(first))
             return first;
@@ -1469,7 +1504,15 @@ export function createTools(ctx) {
             }
             return evidence;
         };
-        // No build in the time: the host's page where a build is turned on, and the wait again on the person's yes.
+        // No build in the time: the host's page where a build is turned on, and the wait again on the person's yes. Where the host's settings build every
+        // branch and still none came, its GitHub app cannot see the repository: the app's installation page instead, at once when the app is not installed at all.
+        if (access) {
+            return onHostPage(`${host.toLowerCase()}-app-access`, () => access.page, (e) => !built(e), access.now ? first : await waited(first), async () => waited(await read()), {
+                skipped: `The person skipped giving ${host}'s GitHub app access to the repository.`,
+                still: `${host}'s GitHub app still cannot see the repository: no build came.`,
+                stopped: `The run stopped while ${host}'s build was waited for.`,
+            }, signal);
+        }
         return onHostPage(`${host.toLowerCase()}-build`, page, (e) => !built(e), await waited(first), async () => waited(await read()), {
             skipped: `The person stopped waiting for ${host}'s build.`,
             still: `${host} built no preview in the time.`,
@@ -1483,14 +1526,19 @@ export function createTools(ctx) {
     };
     /** Of the origins listed, those of deployments Vercel's own bot made: the only addresses a bypass secret is ever sent to, since a deployment anyone with write access can record names any address. */
     const vercelMade = new Set();
-    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, and whose lock it was. */
+    /** On a repository with several apps, the app each listed origin was read for, with its own host project (#281): a key for that address goes to that project and is saved for that app. */
+    const listedApps = new Map();
+    /** The address impeccable_prove_preview met a host's lock at, the words it looked for there, whose lock it was, and the app it was listed for. */
     let gated;
-    /** The bypass secret saved in this run, for the proof of a Vercel address to send; never for the model. It is one project's, so it goes only to the origins impeccable_vercel_bypass proved it on, never to another project's deployment of this repository. */
-    let bypassSecret;
-    const bypassOrigins = new Set();
-    /** What impeccable_vercel_bypass answered, less the secret: a skip is asked once, so that answer stands; the saved one is what an address the secret opens later gets. */
-    let bypassOutcome;
-    let bypassSaved;
+    /**
+     * The bypass secret saved in this run, by where the setup API keeps it (the app's key, or '' for the repository's), with
+     * the project it is of and what the tool answered; never for the model. A secret is one project's, so it goes only to
+     * the origins impeccable_vercel_bypass proved it on (each by that same store), never to another project's deployment.
+     */
+    const bypassHeld = new Map();
+    const bypassOrigins = new Map();
+    /** What impeccable_vercel_bypass answered for a store, less the secret: a skip is asked once, so that answer stands. */
+    const bypassOutcomes = new Map();
     /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
     let sitePassword;
     const passwordSites = new Set();
@@ -1509,6 +1557,16 @@ export function createTools(ctx) {
     let accessStored = false;
     /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
     let accessOutcome;
+    /** What each host's settings last said of its pull-request previews, as the evidence tools read them: the one fact impeccable_enable_previews acts on. */
+    const previewFacts = new Map();
+    /** What impeccable_enable_previews answered for a host: asked once, so that answer stands. */
+    const enableOutcomes = new Map();
+    /** Cloudflare's plain evidence as last read: the project, the Worker and the GitHub app facts impeccable_cloudflare_connect and the wait for a build act on. */
+    let cloudflareEvidence;
+    /** Each app's Pages project, by key, as a plain read with its appKey told it: its name, and the label its addresses carry (its own host's, which a taken name suffixes). */
+    const cloudflareApps = new Map();
+    /** What impeccable_cloudflare_connect answered: asked once, so that answer stands. */
+    let connectOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
     const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer();
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
@@ -1568,7 +1626,7 @@ export function createTools(ctx) {
         ctx.sync.update({ phase: 'running', question: null });
         return answer;
     };
-    /** Each host's sign-in this run: confirmed on its screen, or found signed in already, so the screen shows once; skipped, so nothing more is asked for that host. */
+    /** Each host's sign-in this run: confirmed on its screen, so the screen shows once; skipped, so nothing more is asked for that host. */
     const hostSignIns = new Map();
     /** The teams a host's sign-in offered, each by name and slug: the choices a `<host>-team` question shows, whatever the model lists, so the pick the fence takes is a slug. */
     const teamChoices = new Map();
@@ -1581,7 +1639,33 @@ export function createTools(ctx) {
     const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
     /** The Vercel project and the Netlify site this run set up, by name, for the pages of theirs a screen opens. */
     let vercelProject;
+    /** The repository a Vercel project the link file names must be connected to before the run changes it or sends its secret anywhere. */
+    const repository = `${ctx.owner}/${ctx.repo}`;
     let netlifySite;
+    /** The live app's addresses, by origin: those the host tools answered as `production`, each with its host and, on Netlify, its site, so a custom domain's lock is known and the site's key goes with it; and those a proof opened with this app, the only ones impeccable_write saves as the before. */
+    const productionListed = new Map();
+    const provenLive = new Set();
+    /** On a repository with several apps: the app each production address a host tool answered is the live app of, read for that app's own project or site, and the apps whose host preview a proof opened. */
+    const liveApps = new Map();
+    const provenApps = new Set();
+    /** Each Vercel project's production address, read from Vercel, by origin, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
+    const vercelProductions = new Map();
+    /** The bypass secret a proof sends to `origin`: the one proved there, or, for a live address, the one of the project whose production it is. */
+    const bypassFor = (origin, live) => {
+        const store = bypassOrigins.get(origin);
+        if (store !== undefined)
+            return bypassHeld.get(store)?.secret;
+        const project = live ? vercelProductions.get(origin) : undefined;
+        return project ? [...bypassHeld.values()].find((held) => held.projectId === project)?.secret : undefined;
+    };
+    /** A host tool answered the live app's address: the proof may open it as the before, with the host's key where the lock is the same site's or project's. */
+    const noteProduction = (production, host, site, appKey) => {
+        if (!production || !URL.canParse(production))
+            return;
+        productionListed.set(new URL(production).origin, { host, ...(site ? { site } : {}) });
+        if (appKey !== undefined)
+            liveApps.set(new URL(production).origin, appKey);
+    };
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
         const cli = runner();
@@ -1606,16 +1690,16 @@ export function createTools(ctx) {
         };
     };
     /**
-     * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: a CLI signed in already opens the setup with no
-     * screen; else the sign-in screen once, and on its yes the CLI's login in the browser, checked with the CLI, a retry
-     * screen when it did not complete, and after two failed retries a skip. The fence opens on the sign-in found or
-     * completed (and on the yes for the CLI's install alone): never on anything the model writes.
+     * A host's sign-in, on `impeccable_ask` with the id `<host>-setup`: the setup screen once, worded for a CLI signed in
+     * already (the yes opens the setup with that sign-in, and no login runs) or for one signed out, and on its yes the
+     * CLI's login in the browser, checked with the CLI, a retry screen when it did not complete, and after two failed
+     * retries a skip. The fence opens on the yes, once the sign-in is found or completed (and on the yes for the CLI's
+     * install alone): never on anything the model writes, and never on a sign-in alone.
      */
     async function hostSignIn(host, pi, signal) {
         const cli = hostCli(host, pi, signal);
         const signedIn = async () => {
             agreeToHostSetup(ctx.log, `${host}-setup`);
-            hostSignIns.set(host, 'confirmed');
             const { team, choices } = await cli.team();
             if (team)
                 chooseHostTeam(ctx.log, `${host}-team`, team);
@@ -1625,16 +1709,16 @@ export function createTools(ctx) {
         if (hostSignIns.get(host) === 'skipped')
             return { skipped: true };
         let status = await cli.status();
-        if (status.cli === 'signed-in')
-            return signedIn();
         if (!hostSignIns.has(host)) {
-            const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`] });
+            const answer = await ask({ id: `${host}-setup`, ...HOST_QUESTIONS[`${host}-setup`], ...(status.cli === 'signed-in' ? HOST_SIGNED_IN[`${host}-setup`] : {}) });
             if (answer.skipped) {
                 endSetup(host);
                 return { skipped: true };
             }
             hostSignIns.set(host, 'confirmed');
         }
+        if (status.cli === 'signed-in')
+            return signedIn();
         // The CLI is installed through the fence's package-manager rule, which this yes opens; then this is asked again.
         if (status.cli === 'missing') {
             agreeToHostSetup(ctx.log, `${host}-setup`);
@@ -1701,44 +1785,84 @@ export function createTools(ctx) {
         const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
         const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
-        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, settings, signal, ...(clone ? { wait: clone } : {}) });
+        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}) });
         netlifySite = result.site?.name ?? netlifySite;
+        if (result.pullRequestPreviews)
+            previewFacts.set('netlify', result.pullRequestPreviews);
         // A build every 30 s until one reads the repository: the person is giving the app access meanwhile.
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
-            ? { connected: true, site: result.site, how: 'github-app' } : result), signal);
+            ? { connected: true, site: result.site, how: 'github-app', ...(result.pullRequestPreviews ? { pullRequestPreviews: result.pullRequestPreviews } : {}) } : result), signal);
     }
     /**
-     * The connection of the linked Vercel project with this repository, `vercel git connect`, with the app's access asked
-     * when Vercel's GitHub app cannot reach the repository; then, connected, the project locked behind Vercel's login at
-     * every address while it has no production deployment, before anything is pushed: Vercel makes a new project's first
-     * deployment Production whatever branch it builds, and serves it at the project's own address.
+     * The connection of the linked Vercel project with this repository, `vercel git connect`, for a project this run's own
+     * `vercel project add` made and `vercel link` linked (the link file alone, which the agent can write, proves nothing;
+     * the link alone links an existing project of the folder's name, which may be one of the person's: that one is left
+     * as it is), or one connected to this repository already, with the app's access asked when Vercel's GitHub app
+     * cannot reach the repository; then, connected, the project locked behind Vercel's login at every address while it
+     * has no production deployment, before anything is pushed: Vercel makes a new project's first deployment Production
+     * whatever branch it builds, and serves it at the project's own address.
      */
+    /** On a repository with several apps, the picked app whose folder the project impeccable_vercel_connect connects builds. */
+    let connectedApp;
     async function vercelConnect(pi, signal) {
         if (!hostSetupAgreed(ctx.log, 'vercel'))
             return { connected: false, reason: 'The Vercel sign-in comes first: impeccable_ask with the id vercel-setup.' };
         const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+        const link = await readLink(pi.cwd);
+        if (!link)
+            return { connected: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        // The link file is the agent's to write: only one the run's own vercel link wrote, project and team alike, says which project the reads below are of. Any other holds the push, since what it would build cannot be told.
+        const own = linkedByRun(ctx.log).get(link.projectId);
+        if (!own || own.orgId !== link.orgId)
+            return { connected: false, reason: "This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team): nothing was connected, and the push stays held. vercel link --yes, on its own, links the project of the folder's name again; else the Vercel setup ends here, and the person removes or relinks the file." };
+        // Read before the connection, which is what would change the project: whether it is this run's. The read after it is another, since the connection sets the production branch.
+        const project = await readLinkedProject(vercel, link);
+        // A project Vercel has no record of, or one the CLI cannot read, may still be one that builds a push: the hold stands, by design.
+        if (project === 'missing')
+            return { connected: false, reason: 'The project this folder is linked to no longer exists on Vercel, as far as the CLI can tell (.vercel/project.json is stale): nothing was connected, and the push stays held. vercel link --yes, on its own, links the project of the folder\'s name again; else the Vercel setup ends here, and the person removes or relinks the file.' };
+        if (!project)
+            return { connected: false, reason: 'The Vercel CLI could not read the linked project (vercel api), so whether this run created it is unknown: nothing was connected, and the push stays held.' };
+        // On a repository with several apps, a project builds one app's folder: one that builds no picked app's is connected and locked for none (#281).
+        if (appsRepo) {
+            const folders = new Map(await Promise.all([...(pickedApps ?? [])].map(async (key) => [await appFolder(pi, key), key])));
+            connectedApp = project.rootDirectory !== undefined ? folders.get(project.rootDirectory) : undefined;
+            if (connectedApp === undefined) {
+                // A project not connected to this repository builds no push of it, so the push goes; one connected already would build it, so it stays held.
+                if (project.repository !== repository.toLowerCase())
+                    settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
+                return { connected: false, reason: `The linked project${project.name ? ` ${project.name}` : ''} builds ${project.rootDirectory ? `the folder ${project.rootDirectory}` : "the repository's root"}, which is no app this run sets up: it stays as it is, and nothing was connected. The Vercel setup ends here.` };
+            }
+        }
+        // A project connected to this repository already is this repository's: the connection changes nothing on it, and the lock below is what it gets as the run's own project would.
+        if (project.repository !== repository.toLowerCase()) {
+            const foreign = !(project.name && vercelProjectsAdded(ctx.log).has(`${own.team}/${project.name.toLowerCase()}`)) ? `this run's vercel project add did not make it in ${own.team ? `the team ${own.team}` : 'the personal scope'}, so vercel link linked a project of that name that existed already` : null;
+            if (foreign) {
+                // Nothing builds a push to a repository the project is not connected to, so the push goes; a deploy from here still would build it, and the shell's git connect never runs.
+                settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
+                return { connected: false, reason: `The linked project${project.name ? ` ${project.name}` : ''} is not this run's: ${foreign}. It stays as it is, and nothing was connected. The Vercel setup ends here.` };
+            }
+        }
         // Tried again every 20 s until the app reaches the repository: the person is giving it access meanwhile.
         const result = await hostAccess('vercel', await connectVercelProject(vercel), () => waitForVercelAccess(vercel, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 20_000 }, signal }), signal);
         // The fence holds pushes and deploys from the sign-in until the linked project's first deployment is settled: Vercel's app cannot reach the repository (a push builds nothing), production is deployed already, or the project is locked at every address.
-        const link = await readLink(pi.cwd);
         if (!result.connected) {
             if (result.access !== undefined)
-                settleVercelFirstDeployment(ctx.log, { projectId: link?.projectId ?? null, how: 'connection' });
+                settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'connection' });
             return result;
         }
-        let first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        let first = await prepareFirstDeployment(vercel, link, repository);
         vercelProject = first.project ?? vercelProject;
         // Vercel refused the lock: the person turns it on in the project's settings, in this run, and the read sees it.
-        if (link && first.production === 'none' && !first.locked) {
+        if (first.production === 'none' && !first.locked) {
             const page = vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), vercelProject);
-            first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
+            first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, repository, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
                 waiting: "Waiting for Vercel's login on the project",
                 skipped: 'The person skipped locking the Vercel project.',
                 still: "Vercel's login is still not in front of the project's addresses.",
                 stopped: 'The run stopped while the lock was waited for.',
             }, signal);
         }
-        if (link && (first.production === 'exists' || first.locked === true))
+        if (first.production === 'exists' || first.locked === true)
             settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'project' });
         return { ...result, ...first };
     }
@@ -1788,11 +1912,13 @@ export function createTools(ctx) {
      * Saves a host's key for reviews: the key as Impeccable's credential for the lock, then the setting that sends it in
      * `header`, both through the setup API. `stored` says the first write took; `failed` what stopped it, else null.
      */
-    const saveLock = async (pi, what, header, value) => {
+    const saveLock = async (pi, what, header, value, appKey) => {
         const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
-        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value } })).ok)
+        // On a repository with several apps, the key is that app's own: each app's previews are its own project's or site's.
+        const app = appKey !== undefined ? { appKey } : {};
+        if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value, ...app } })).ok)
             return { stored: false, failed: `The setup API did not store the ${what}.` };
-        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header } })).ok)
+        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header, ...app } })).ok)
             return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
         return { stored: true, failed: null };
     };
@@ -1800,6 +1926,18 @@ export function createTools(ctx) {
     let instructions = ctx.instructions;
     /** Whether the run signed in again for apps the scan proposed after the sign-in. */
     let renewedForApps = false;
+    /** Whether the repository has several apps (the state's apps item), as the first state or a later read showed it. */
+    let appsRepo = ctx.severalApps === true;
+    /**
+     * The apps this run sets up, as the apps question answered (after a skip, the ones on): undefined until it was asked.
+     * On a repository with several apps every run asks it, however the setup page answered before (#280), and every write
+     * and host read for an app names one of these.
+     */
+    let pickedApps;
+    /** This run confirmed the scan's proposal, so nothing was answered before: the question opens with every app picked. */
+    let confirmedApps = false;
+    /** Each app's folder, by key, as the state names it: what its host project or site must build. */
+    const appFolders = new Map();
     /**
      * A read of the state or the checkup, trimmed to this setup before the model sees it. The setup token covers the apps
      * there were at sign-in, so an app the scan proposed later reads `not-selected`: the run signs in again, for a token
@@ -1812,10 +1950,89 @@ export function createTools(ctx) {
             renewedForApps = true;
             res = await call(pi, `${ctx.setupApi}${path}`);
         }
+        if (res.ok && severalApps(res.data))
+            appsRepo = true;
         if (res.ok && ctx.allInstructions !== undefined && severalApps(res.data))
             instructions = focusInstructions(ctx.allInstructions, { apps: true });
         return answerText(res.ok ? { ...res, data: focus(res.data) } : res);
     };
+    /** The repository's apps as the state lists them, each with its folder and whether it is on; null when the state could not be read. */
+    const stateApps = async (pi) => {
+        const res = await call(pi, `${ctx.setupApi}/state`);
+        const repos = object(res.data)?.repos;
+        const repo = res.ok && Array.isArray(repos) ? repos.map(object).find((r) => r?.name === ctx.repo) : undefined;
+        if (!repo || !Array.isArray(repo.apps))
+            return null;
+        const apps = repo.apps.map(object).flatMap((a) => {
+            const prefixes = Array.isArray(a?.pathPrefixes) ? a.pathPrefixes : [];
+            const folder = folderOf(prefixes.find((p) => typeof p === 'string' && p) ?? '');
+            return a && typeof a.key === 'string' && APP_KEY_SHAPE.test(a.key) && folder !== undefined
+                ? [{ key: a.key, name: typeof a.name === 'string' && a.name ? a.name : a.key, folder, enabled: a.enabled !== false }] : [];
+        });
+        for (const app of apps)
+            appFolders.set(app.key, app.folder);
+        return apps;
+    };
+    /** An app's folder, read from the state the first time it is asked for. */
+    const appFolder = async (pi, key) => (appFolders.has(key) ? appFolders.get(key) : (await stateApps(pi), appFolders.get(key)));
+    /**
+     * On a repository with several apps, why a step for `appKey` may not run yet: the apps question comes first, and only
+     * a picked app is set up. Null where it may: one app, or a picked one.
+     */
+    const appRefusal = (appKey, what, forApp = true) => {
+        if (!appsRepo)
+            return null;
+        if (!pickedApps)
+            return `Refused: this repository has several apps, so the apps question comes first, on every run: impeccable_ask with the id "apps", as the monorepo case says. Nothing was ${what}.`;
+        if (forApp && (typeof appKey !== 'string' || !pickedApps.has(appKey)))
+            return `Refused: give "appKey", the key of an app this run sets up (${[...pickedApps].join(', ')}). Nothing was ${what}.`;
+        return null;
+    };
+    /** Each app's Vercel project, found once a run (a failure is read again, the CLI may have signed in since). */
+    const vercelApps = new Map();
+    /** The app's Vercel project as this repository's, read now for its deployments: the one that builds the app's folder, or why none can be told. */
+    async function vercelApp(pi, appKey, vercel) {
+        let found = vercelApps.get(appKey);
+        if (!found) {
+            const folder = await appFolder(pi, appKey);
+            if (folder === undefined)
+                return { reason: `The setup state names no folder for the app ${appKey}.` };
+            const resolved = await vercelProjectFor(vercel, repository, folder, (await readLink(pi.cwd))?.orgId);
+            found = 'reason' in resolved ? resolved : { ...resolved, folder };
+            if (!('reason' in found))
+                vercelApps.set(appKey, found);
+        }
+        if ('reason' in found)
+            return found;
+        const project = await readOwnProject(vercel, found.link, repository);
+        return 'reason' in project ? project : { ...found, project };
+    }
+    /**
+     * The apps question (#280), worded here and listing the apps the state has, each picked as it is on (every one, where
+     * this run confirmed the scan's proposal); the command started for one app (--app) answers it without a screen. The
+     * answer is the apps this run sets up; after a skip, those that are on.
+     */
+    async function appsQuestion(pi) {
+        const apps = await stateApps(pi);
+        if (!apps || apps.length < 2)
+            return 'Refused: the setup state could not be read, or lists fewer than two apps: read it again with impeccable_state, then ask again.';
+        if (ctx.app !== undefined && apps.some((a) => a.key === ctx.app)) {
+            pickedApps = new Set([ctx.app]);
+            return JSON.stringify({ values: [ctx.app], named: true });
+        }
+        // Started below the top: the app whose folder holds that folder (the deepest, never the root's) is ticked too, and the hint says so.
+        const start = ctx.start ?? '';
+        const here = start ? apps.filter((a) => a.folder && (start === a.folder || start.startsWith(`${a.folder}/`))).sort((a, b) => b.folder.length - a.folder.length)[0] : undefined;
+        const hint = here ? startedIn(`${here.name}'s folder`) : start ? startedIn(start) : APPS_QUESTION.hint;
+        const answer = await ask({ ...APPS_QUESTION, hint, options: apps.map((a) => ({ label: `${a.name} · ${a.folder || '/'}`, value: a.key, selected: confirmedApps || a.enabled || a === here })) });
+        if (answer.skipped) {
+            pickedApps = new Set(apps.filter((a) => a.enabled).map((a) => a.key));
+            return JSON.stringify({ skipped: true, on: [...pickedApps] });
+        }
+        const values = (answer.values ?? []).filter((value) => apps.some((a) => a.key === value));
+        pickedApps = new Set(values);
+        return JSON.stringify({ values });
+    }
     return [
         tool('impeccable_workflow_access', 'Check workflow access', 'Check that the setup pull request can carry the workflow: reads the active GitHub CLI account and its scopes, the origin remote and the default branch, and refreshes origin/<defaultBranch>. Call it before branching. needsWorkflowScope true means the account lacks workflow access over HTTPS; base.status "refreshed" means origin/<defaultBranch> is current. push is whether git may push to origin, as a dry run at the start found it.', NO_INPUT, (_p, pi, signal) => workflowAccessTool(pi, signal)),
         tool('impeccable_sync_workflow', 'Update the preview workflow', 'Write the state\'s workflow to .github/workflows/impeccable-preview.yml byte for byte and remove the retired workflow the state names, after checking access as impeccable_workflow_access does. Call it once the settings are saved, and again after committing: stagedMatches and committedMatches true (and retiredRemoval staged and committed) prove the commit holds the exact bytes; null means nothing was compared. It refuses, changing nothing, when the file has the person\'s local edits. It never branches, stages, commits or pushes.', NO_INPUT, (_p, pi, signal) => syncWorkflowTool(pi, signal)),
@@ -1894,18 +2111,38 @@ export function createTools(ctx) {
             const target = resolveWrite(instructions, ctx.setupApi, ctx.repo, p.path);
             if ('error' in target)
                 return `Refused: ${target.error}`;
+            // On a repository with several apps, nothing but the apps write goes before the apps question, and an app's setting or check names a picked app.
+            const forApp = /\/(preview|test-accounts|connection-check|latest-pull-check)$/.test(target.url);
+            if (!target.url.endsWith('/apps')) {
+                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp);
+                if (refused)
+                    return refused;
+            }
             if (/\/(preview-auth\/[^/]+|preview-protection)$/.test(target.url))
                 return "Refused: a host's key is saved by impeccable_vercel_bypass (a Vercel bypass secret), impeccable_netlify_password (a Netlify site password) or impeccable_cloudflare_access (a Cloudflare Access service token), which opens the preview with it first, and never through this tool. Nothing was saved.";
             if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'ci-tunnel') {
                 return "Refused: Impeccable no longer runs a server in CI for a new setup, so ci-tunnel is never saved. Pages that need a server get their host's pull request previews, as the server-previews case says. Nothing was saved.";
             }
-            if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && !hostedPreviewProven) {
-                return "Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app. Nothing was saved.";
+            if (target.url.endsWith('/preview') && object(p.body)?.intendedMethod === 'preview-deploy' && (appsRepo ? !provenApps.has(String(object(p.body)?.appKey)) : !hostedPreviewProven)) {
+                return `Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app${appsRepo ? `, read for it with its appKey (${String(object(p.body)?.appKey)})` : ''}. Nothing was saved.`;
             }
             const saved = object(p.body);
             if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
                 return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify or Cloudflare Pages preview. Nothing was saved.';
             }
+            // The before is the live app's address, and only one a proof opened with this app: an address no key opens is not set, and one the person saved is never cleared from here.
+            if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
+                return "Refused: beforeUrl is the live app's address that impeccable_prove_preview opened with this app in this run (the production address a host tool answered, or the one the README names), or a page on it; an address no key opens is not set, and a saved one is never cleared from here. Nothing was saved.";
+            }
+            // One app's before is its own: the production address its own project or site answered, or one a file in its own folder names.
+            if (appsRepo && target.url.endsWith('/preview') && saved && typeof saved.beforeUrl === 'string') {
+                const origin = new URL(saved.beforeUrl).origin;
+                const owner = liveApps.get(origin);
+                const folder = await appFolder(pi, String(saved.appKey));
+                if (owner !== undefined ? owner !== saved.appKey : folder === undefined || !(await checkoutNames(pi.cwd, origin, folder))) {
+                    return `Refused: ${origin} is not the live address of ${String(saved.appKey)}: it is another app's, or no file in that app's folder names it. Nothing was saved.`;
+                }
+            }
             const testAccounts = target.url.endsWith('/test-accounts');
             let body = p.body;
             if (testAccounts) {
@@ -1920,6 +2157,8 @@ export function createTools(ctx) {
             }
             const checkedHead = previews.active && target.url.endsWith('/latest-pull-check') ? await observe(signal) : undefined;
             const response = await call(pi, target.url, { method: target.method, body });
+            if (target.url.endsWith('/apps') && response.ok && object(p.body)?.action === 'confirm')
+                confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
                 const keys = object(object(response.data)?.keys);
                 if (keys?.intendedMethod === 'stored' && object(p.body)?.intendedMethod === 'static-upload')
@@ -1952,9 +2191,11 @@ export function createTools(ctx) {
             // A test account never comes back to the model, even if the API echoed it.
             return testAccounts ? redact(answerText(response), typed.values()) : answerText(response);
         }),
-        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
+        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. So is the apps question on a repository with several apps (id "apps", kind "multi"), which lists the state\'s apps itself and answers {"values": […]}, {"values": [key], "named": true} when the command was started for that app, or {"skipped": true, "on": […]}. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
             // A skip never stops the run, so every question offers one.
             const asked = p;
+            if (asked.id === APPS_QUESTION.id && appsRepo)
+                return appsQuestion(pi);
             const host = /^(netlify|vercel)-(setup|team)$/.exec(asked.id);
             if (host?.[2] === 'setup')
                 return JSON.stringify(await hostSignIn(host[1], pi, signal));
@@ -1975,7 +2216,8 @@ export function createTools(ctx) {
                 ctx.log.write('ask hidden (names a credential)', q.id);
             if (q.kind === 'text' && !q.sensitive)
                 q.caution = NEVER_A_CREDENTIAL;
-            const answer = await askPerson(q);
+            // The apps question's screen is the tool's to show (TOOL_SHOWN), so the web page hears of it here.
+            const answer = q.id === APPS_QUESTION.id ? await ask(q) : await askPerson(q);
             if (answer.skipped) {
                 // Without a terminal the Vercel CLI names no team on its own, so a skipped team ends the Vercel setup.
                 if (host?.[1] === 'vercel')
@@ -2021,25 +2263,28 @@ export function createTools(ctx) {
             const found = await runPullRequest(ctx, drive, 'impeccable/test-drive', signal);
             if ('problem' in found)
                 return `Refused: ${found.problem}.`;
+            drive.url = found.url;
             // The page that links to the test drive is an existing file the branch changes; files under dot folders (.github, .netlify) and dotfiles never link to it (#241).
             const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch) : null;
             const files = (changes ?? []).filter(({ path }) => !path.split('/').some((part) => part.startsWith('.')));
             if (files.length && files.every(({ status }) => status === 'A')) {
                 return `Refused: ${found.branch} only adds ${files.map(({ path }) => path).join(', ')} and changes no existing page, so nothing links to the test drive. Commit the page that links to it and push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
             }
-            let setupBranch = recordedBranches?.setup;
+            let setupBranch = recordedBranches?.setup, setupBase = recordedBranches?.setupBase;
             if (setup) {
                 // The setup pull request carries the preview attempts, so its binding cannot change.
                 const head = await runPullRequest(ctx, setup, 'impeccable/setup', signal);
                 if ('problem' in head)
                     return `Refused: ${head.problem}.`;
+                setup.url = head.url;
                 const bound = bindPreviewPullRequest(retry, { ...setup, branch: head.branch });
                 if (bound.verdict !== 'allow')
                     return `Refused: ${bound.reason}.`;
                 setupBranch = head.branch;
+                setupBase = head.base;
             }
             ctx.sync.update({ test_pr: drive, ...(setup ? { setup_pr: setup } : {}) });
-            recordedBranches = { drive: found.branch, setup: setupBranch };
+            recordedBranches = { drive: found.branch, setup: setupBranch, setupBase };
             const res = await ctx.sync.flush();
             const what = `the test drive #${drive.number}${setup ? ` and the setup pull request #${setup.number}` : ''}`;
             return res?.ok
@@ -2051,11 +2296,22 @@ export function createTools(ctx) {
             const long = left.find((line) => line.length > STATUS_MAX);
             if (long)
                 return `Refused: "${long}" is longer than ${STATUS_MAX} characters. Each line of "left" is one short line the person can act on; the detail belongs in the report. Nothing was saved: call impeccable_report again.`;
+            const control = left.find((line) => plainText(line) !== line);
+            if (control)
+                return `Refused: "${control}" holds a control character or an escape sequence. Each line of "left" is plain text. Nothing was saved: call impeccable_report again.`;
             // The web page keeps the task list as the report leaves it, so no task may still read as waiting or running (#83).
             const open = ctx.sync.payload.tasks.filter((t) => !t.id.startsWith('preview-attempt-') && (t.status === 'pending' || t.status === 'in_progress'));
             if (open.length)
                 return `Refused: the task list still shows ${open.map((t) => `"${t.title}" as ${t.status.replace('_', ' ')}`).join(', ')}. Call impeccable_progress with every task's final status (completed, skipped or failed), then impeccable_report again. Nothing was saved.`;
             let markdown = p.markdown;
+            // The files the setup pull request carries, so one the setup never meant to change stands out: a sandboxed script writes in the checkout too.
+            if (recordedBranches?.setup) {
+                const changes = recordedBranches.setupBase ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, recordedBranches.setupBase, recordedBranches.setup) : null;
+                const verbs = { A: 'added', M: 'changed', D: 'removed' };
+                // A file name is git's to give: one with Markdown in it, or a line break, stays one plain entry.
+                const shown = (path) => path.replace(/[\\`*_[\]<>|~]/g, '\\$&').replace(/[\x00-\x1f\x7f]/g, (c) => JSON.stringify(c).slice(1, -1));
+                markdown += `\n\n## What the setup pull request changes\n\n${changes ? changes.map(({ status, path }) => `- ${shown(path)} (${verbs[status] ?? status})`).join('\n') || 'Nothing: it carries no file.' : 'This checkout could not list its files: read them on the pull request before merging.'}`;
+            }
             if (previews.active && retry.pr) {
                 await observe(signal);
                 const lines = attempts().map((a, i) => `${i + 1}. [Attempt ${i + 1}](${a.url}) (run attempt ${a.attempt}): ${a.status}. ${a.diagnostics.map((d) => `${d.appKey}: step ${d.stage ?? 'unverified'}. ${d.reason}`).join(' ')}${a.changes.length ? ` Changed settings: ${a.changes.join(', ')}.` : ''}`);
@@ -2084,19 +2340,55 @@ export function createTools(ctx) {
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
-        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. Without branch, where GitHub records a production deployment Vercel made and this folder is linked to the project (.vercel/project.json) the Vercel CLI reads as this repository\'s, production is the live app\'s address, the project\'s own domain, for the before. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
-            const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
+            const refused = appRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // The fact, the live app and an app's project read the same projects: each `vercel api` call is made once.
+            const reads = new Map();
+            const vercel = (args) => {
+                const key = JSON.stringify(args);
+                if (!reads.has(key))
+                    reads.set(key, (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal })(args));
+                return reads.get(key);
+            };
+            for (const origin of listedPreviews)
+                listedApps.delete(origin);
+            listedPreviews.clear();
+            vercelMade.clear();
+            publicProduction.clear();
+            // On a repository with several apps, the app's own project (#281): the one whose Root Directory is the app's folder, never the newest deployment's or the root link's.
+            const appKey = appsRepo ? p.appKey : undefined;
+            const app = appKey !== undefined ? await vercelApp(pi, appKey, vercel) : undefined;
+            if (app && 'reason' in app)
+                return JSON.stringify({ appKey, deployments: [], unmatched: app.reason });
+            const raw = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
+            // Vercel names each project's deployments on GitHub "Preview – <project>"; one without a name is told by the project's own record of it.
+            const owned = async (d) => {
+                if (!app)
+                    return true;
+                if (!d.vercel || !d.url)
+                    return false;
+                const named = /^(?:preview|production)\s[–-]\s(.+)$/i.exec(d.environment ?? '')?.[1];
+                return named !== undefined ? named === app.name : projectMadeDeployment(vercel, app.link, app.project, new URL(d.url).host);
+            };
+            const read = async () => {
+                const evidence = await raw();
+                if (!app)
+                    return evidence;
+                const kept = await Promise.all(evidence.deployments.map(owned));
+                return { ...evidence, deployments: evidence.deployments.filter((_, i) => kept[i]) };
+            };
             // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
             // project is its Production one, even from a branch. Another integration's deployment of the same commit says nothing about it. Without it a preview is a Preview.
             const isPreview = (d) => /preview/i.test(d.environment ?? '');
             const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
             // A head's build is still building until it has a final status.
             const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), vercelProject), signal) : await read();
-            listedPreviews.clear();
-            vercelMade.clear();
-            publicProduction.clear();
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), app?.name ?? vercelProject), signal) : await read();
+            /** The project the evidence is of: the app's, else the one this folder is linked to. */
+            const link = async () => (app ? app.link : readLink(pi.cwd));
             /** The hosts of the linked project's deployments while it is locked at every address, read from Vercel once a Production deployment turns up, and once per call. */
             let locked;
             for (const d of evidence.deployments) {
@@ -2106,8 +2398,8 @@ export function createTools(ctx) {
                 // A pushed branch's Production deployment is its preview only as the locked project's own: under Standard Protection a project's own address serves it to anyone, and another project of this repository may have made it.
                 if (branch !== undefined && !isPreview(d)) {
                     locked ??= await (async () => {
-                        const link = await readLink(pi.cwd);
-                        return link ? lockedDeploymentHosts((ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }), link) : new Set();
+                        const linked = await link();
+                        return linked ? lockedDeploymentHosts(vercel, linked, repository) : new Set();
                     })();
                     if (!locked.has(url.host)) {
                         publicProduction.add(url.origin);
@@ -2117,12 +2409,41 @@ export function createTools(ctx) {
                 listedPreviews.add(url.origin);
                 if (d.vercel)
                     vercelMade.add(url.origin);
+                if (app)
+                    listedApps.set(url.origin, { appKey: appKey, link: app.link, name: app.name });
+            }
+            // What vercel.json and the linked project (the app's, with its folder's vercel.json) say of the test drive's branch rides with the plain evidence, never with a wait: reported, never changed.
+            if (branch === undefined) {
+                const fact = await (ctx.vercelPreviewsReader ?? vercelPreviewsFact)(pi.cwd, `${ctx.owner}/${ctx.repo}`, () => vercel, app ? { directory: app.folder, link: app.link } : undefined);
+                if (fact) {
+                    previewFacts.set('vercel', fact);
+                    evidence.pullRequestPreviews = fact;
+                }
             }
-            return JSON.stringify(evidence);
+            // The live app, where GitHub's record shows a production deployment Vercel made: its own address there is behind Vercel's login under Standard Protection, so the
+            // project is read for its alias, the project's own domain, and only as this repository's project.
+            let production;
+            if (branch === undefined && evidence.deployments.some((d) => d.vercel && d.state === 'success' && !isPreview(d))) {
+                const linked = await link();
+                const project = linked ? await readOwnProject(vercel, linked, repository) : null;
+                production = project && !('reason' in project) ? project.productionUrl : undefined;
+                if (production && linked)
+                    vercelProductions.set(new URL(production).origin, linked.projectId);
+                noteProduction(production, 'vercel', undefined, appKey);
+            }
+            return JSON.stringify({ ...(appKey !== undefined ? { appKey, project: app.name } : {}), ...evidence, ...(production ? { production } : {}) });
         }),
-        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
-            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull });
+            const refused = appRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // On a repository with several apps, only the site that builds the app's folder (#281).
+            const appKey = appsRepo ? p.appKey : undefined;
+            const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && directory === undefined)
+                return JSON.stringify({ appKey, sites: [], previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
+            const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, ...(directory !== undefined ? { directory } : {}) });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
@@ -2132,61 +2453,120 @@ export function createTools(ctx) {
                 const site = e.previews.find((preview) => preview.pullRequest === pull)?.site ?? (known.size === 1 ? [...known][0] : undefined);
                 return site ? `https://app.netlify.com/projects/${encodeURIComponent(site)}/configuration/deploys#deploy-previews` : 'https://app.netlify.com/';
             }, signal) : await read();
+            for (const origin of netlifyListed)
+                listedApps.delete(origin);
             netlifyListed.clear();
-            for (const p of evidence.previews)
-                if (p.state === 'success' || p.state === 'ready')
-                    netlifyListed.add(new URL(p.url).origin);
-            return JSON.stringify(evidence);
+            for (const p of evidence.previews) {
+                if (p.state !== 'success' && p.state !== 'ready')
+                    continue;
+                netlifyListed.add(new URL(p.url).origin);
+                if (appKey !== undefined)
+                    listedApps.set(new URL(p.url).origin, { appKey });
+            }
+            if (evidence.pullRequestPreviews)
+                previewFacts.set('netlify', evidence.pullRequestPreviews);
+            noteProduction(evidence.production, 'netlify', liveSite(evidence), appKey);
+            return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
                 return 'Invalid input: give pull or branch, not both.';
-            const read = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch });
+            const refused = appRefusal(p.appKey, 'read');
+            if (refused)
+                return refused;
+            // On a repository with several apps, only the Pages project that builds the app's folder (#281): told by the plain read, which a wait for a build keeps to.
+            const appKey = appsRepo ? p.appKey : undefined;
+            const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
+            if (appKey !== undefined && directory === undefined)
+                return JSON.stringify({ appKey, previews: [], unmatched: `The setup state names no folder for the app ${appKey}.` });
+            const appProject = appKey !== undefined ? cloudflareApps.get(appKey) : undefined;
+            if (appKey !== undefined && (pull !== undefined || branch !== undefined) && !appProject)
+                return `Refused: read impeccable_cloudflare_previews with appKey ${appKey} and no pull or branch first: it tells which Pages project builds that app.`;
+            const readAll = () => (ctx.cloudflarePreviewReader ?? readCloudflarePreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull, branch, ...(directory !== undefined && pull === undefined && branch === undefined ? { directory } : {}), ...(appProject ? { project: appProject.project } : {}) });
+            const read = async () => {
+                const evidence = await readAll();
+                return appProject ? { ...evidence, previews: evidence.previews.filter((preview) => pagesProject(preview.url) === appProject.label) } : evidence;
+            };
             // Cloudflare posts its check run once the build ended: until then the head lists nothing, or cf's row says it is building.
             // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
             const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
             const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
-            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal) : await read();
+            // A pushed branch of a project connected with previews on that gets no build: Cloudflare's GitHub app cannot see the repository (its installation covers selected ones, or none),
+            // unless it covers them all, or Cloudflare built a preview of the repository already, which it could not without the app.
+            const app = cloudflareEvidence?.githubApp;
+            const access = branch !== undefined && previewFacts.get('cloudflare')?.enabled === true && app?.repositories !== 'all' && !cloudflareEvidence?.previews.length ? { page: app?.page ?? CLOUDFLARE_APP_PAGE, now: app?.installed === false } : undefined;
+            const waited = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal, access) : await read();
+            const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
+            if (!subject)
+                cloudflareEvidence = evidence;
+            if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project)
+                cloudflareApps.set(appKey, { project: evidence.project, label: (evidence.production && pagesProject(evidence.production)) || evidence.project });
+            for (const origin of cloudflareListed)
+                listedApps.delete(origin);
             cloudflareListed.clear();
             for (const preview of evidence.previews) {
                 if (preview.state !== 'success')
                     continue;
-                cloudflareListed.add(new URL(preview.url).origin);
-                if (preview.alias)
-                    cloudflareListed.add(new URL(preview.alias).origin);
+                for (const address of [preview.url, ...(preview.alias ? [preview.alias] : [])]) {
+                    cloudflareListed.add(new URL(address).origin);
+                    if (appKey !== undefined)
+                        listedApps.set(new URL(address).origin, { appKey });
+                }
             }
-            return JSON.stringify(evidence);
+            if (evidence.pullRequestPreviews)
+                previewFacts.set('cloudflare', evidence.pullRequestPreviews);
+            noteProduction(evidence.unmatched ? undefined : evidence.production, 'cloudflare', undefined, appKey);
+            return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
-        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
+        tool('impeccable_prove_preview', 'Check a hosted preview', 'Open a preview address impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch (a successful Preview deployment, a deploy preview that is ready, or a Pages build that succeeded), or a page on it, as a visitor signed in nowhere, and prove it: it answers, and the page shows words a file of this checkout holds. proven true lets impeccable_write save intendedMethod "preview-deploy"; for Netlify and Cloudflare Pages it answers the address pattern to save beside it. gate "vercel-protection", "netlify-protection" or "cloudflare-access" means the host\'s protection stands in front of it. Or open the live app\'s address, the production one of those tools answered or one a file of this checkout names (the README\'s live-site line), or a page on it, the same way: proven true lets impeccable_write save it as beforeUrl, and nothing else. A key the run got in place for the same project or site goes with it. Nothing of the page comes back.', PROVE_PREVIEW, async (p, pi, signal) => {
             const url = p.url;
-            if (URL.canParse(url) && publicProduction.has(new URL(url).origin))
+            const origin = URL.canParse(url) ? new URL(url).origin : null;
+            if (origin && publicProduction.has(origin))
                 return "Refused: Vercel called this deployment Production, as it calls a project's first whatever branch it builds, and no project of this folder's that is locked at every address made it, so it is served at a project's own address without a login: it is no preview, and nothing was opened. No test drive, as the vercel-setup case says.";
-            if (!URL.canParse(url) || !(listedPreviews.has(new URL(url).origin) || netlifyListed.has(new URL(url).origin) || cloudflareListed.has(new URL(url).origin)))
-                return 'Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it.';
-            const site = netlifySiteOf(url);
+            const listed = origin !== null && (listedPreviews.has(origin) || netlifyListed.has(origin) || cloudflareListed.has(origin));
+            // The live app's address, for the before: one a host tool answered as production, or one a file the checkout tracks names, such as the README's live-site line, when it is the site's or project's own address on one of the hosts: a deploy preview or branch alias a file links stays a preview, listed or not, and an address elsewhere, which could be on the person's own network, is only a host tool's to name.
+            const known = origin !== null ? productionListed.get(origin) : undefined;
+            const live = origin !== null && !listed && (known !== undefined || (liveShaped(url) && (await checkoutNames(pi.cwd, origin))));
+            if (!origin || (!listed && !live))
+                return "Refused: open the address of a preview that impeccable_hosted_previews, impeccable_netlify_previews or impeccable_cloudflare_previews listed for a pull request or a pushed branch, or a page on it; or, for the before, the live app's address one of them answered as production, or the site's or project's own address on one of the hosts that a file of this checkout names.";
+            // The Netlify site, by the address's shape or, for the site's custom domain, as its tool named it: its password goes to the site's own addresses.
+            const site = netlifySiteOf(url) ?? known?.site;
             // A saved service token opens its Pages project's previews: Access admits it wherever the application's policy covers.
-            const project = pagesProject(new URL(url).origin);
+            const project = pagesProject(origin);
             const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
             const proof = await provePreview(url, p.expect, pi.cwd, {
-                fetch: ctx.previewFetch, signal,
-                ...(bypassSecret && bypassOrigins.has(new URL(url).origin) ? { bypass: bypassSecret } : {}),
+                fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
+                // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
+                ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
                 ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
                 ...(token ? { access: token } : {}),
             });
+            // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
+            if (live) {
+                if (proof.proven)
+                    provenLive.add(origin);
+                return JSON.stringify(proof);
+            }
+            // On a repository with several apps, the app the address was listed for: its proof, its lock and its key are that app's alone (#281).
+            const app = listedApps.get(origin);
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
+            if (proof.proven && app)
+                provenApps.add(app.appKey);
             if (proof.proven && proof.pattern)
                 provenPattern = proof.pattern;
             if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
-                gated = { url, expect: p.expect, gate: proof.gate, ...(proof.teamLogin ? { teamLogin: proof.teamLogin } : {}) };
+                gated = { url, expect: p.expect, gate: proof.gate, ...(proof.teamLogin ? { teamLogin: proof.teamLogin } : {}), ...(app ? { app } : {}) };
             if (proof.gate === 'cloudflare-access' && cloudflareListed.has(new URL(url).origin))
-                accessGated = { url, expect: p.expect };
+                accessGated = { url, expect: p.expect, ...(app ? { app } : {}) };
+            if (app)
+                return JSON.stringify({ ...proof, appKey: app.appKey });
             return JSON.stringify(proof);
         }),
-        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
+        tool('impeccable_netlify_connect', 'Connect the repository to Netlify', "Connect the Netlify site this folder is linked to with this repository, through the site's settings and Netlify's GitHub app, so that pull requests build deploy previews: a site this run created with netlify sites:create, or one built from this repository already. A site built from another repository, or not created by this run, is left as it is, with the reason. The run does it; when Netlify's app cannot read the repository, this asks the person once for its access on GitHub and waits. connected true means Netlify read the repository; how \"already\" means the site was built from it before. A connection left undone answers why, and the GitHub page for the person in access.", NETLIFY_CONNECT, async (p, pi, signal) => {
             const command = p.command;
             const publish = p.publish;
             if (command !== undefined && (command.length > 200 || /[\r\n\0]/.test(command)))
@@ -2195,58 +2575,208 @@ export function createTools(ctx) {
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
             return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
         }),
-        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
-        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_enable_previews', 'Pull-request previews', "Turn on previews of pull requests on the host that builds this repository but not its pull requests, as pullRequestPreviews in the answer of impeccable_netlify_previews, impeccable_netlify_connect or impeccable_cloudflare_previews said (enabled false). It does the rest as the person: one screen asking to turn them on, then the host's CLI changes that one setting (Netlify: Deploy Previews on; Cloudflare Pages: preview branch control set to every non-production branch, or the test drive's branch added to the custom includes) and reads it back; where the CLI cannot (the role, a cf sign-in without pages:write, builds stopped altogether), it opens the host's settings page and asks the person to try again once they changed it there. Answers {\"status\": …}: enabled (pull-request previews are on now; by says whether the run or the person turned them on, and project which project or site), skipped (the person skipped a screen; reason says what came before) or refused (still off after the retries; reason says why, and page where it is changed). Vercel builds every branch once Git is connected, so its fact is reported and never changed here.", ENABLE_PREVIEWS, async (p, pi, signal) => {
+            const host = p.host;
+            const standing = enableOutcomes.get(host);
+            if (standing)
+                return JSON.stringify(standing);
+            const fact = previewFacts.get(host);
+            if (!fact || fact.enabled !== false)
+                return `Refused: this is for a host whose pullRequestPreviews said enabled false in this run. Read ${host === 'netlify' ? 'impeccable_netlify_previews or impeccable_netlify_connect' : 'impeccable_cloudflare_previews'} first.`;
+            if (host === 'cloudflare' && fact.cause === 'source')
+                return `Refused: the Pages project ${fact.project} is connected to no repository, so there is no setting to turn on. impeccable_cloudflare_connect connects it.`;
+            const name = host === 'netlify' ? 'Netlify' : 'Cloudflare Pages';
+            const answer = (status, more) => {
+                const told = { status, project: fact.project, ...more };
+                enableOutcomes.set(host, told);
+                return JSON.stringify(told);
+            };
+            const screen = HOST_SCREENS[`${host}-previews`];
+            if ((await ask({ ...screen, prompt: `Turn on pull-request previews for ${fact.project}?` })).skipped)
+                return answer('skipped', { reason: 'The person skipped turning pull-request previews on.' });
+            said(`Turning on pull-request previews on ${name}`);
+            const turnOn = async () => {
+                if (host === 'netlify')
+                    return enableNetlifyPreviews((ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }), fact.project);
+                const cf = cfRunner({}, ctx.hostRunner);
+                return enableCloudflarePreviews(cf, fact.project, await cfStatus(cf, signal), signal);
+            };
+            // The run's change, read back; where the host kept the setting, the person changes it on the host's page and the run reads again, twice at most.
+            for (let tries = 0;; tries++) {
+                const outcome = await turnOn();
+                if (outcome.fact.enabled === true) {
+                    previewFacts.set(host, outcome.fact);
+                    return answer('enabled', { by: outcome.changed ? 'run' : 'person' });
+                }
+                const why = outcome.reason ?? outcome.fact.reason;
+                if (tries === 2 || signal?.aborted)
+                    return answer('refused', { reason: why, page: outcome.page });
+                const retry = HOST_SCREENS[`${host}-previews-retry`];
+                // The host's page opens once, before the first retry screen, which speaks of it; the browser may not have opened (BROWSER=none, no opener), so the address is on the screen as well.
+                if (tries === 0)
+                    (ctx.openBrowser ?? openBrowser)(outcome.page);
+                if ((await ask({ ...retry, hint: `${retry.hint} If it did not open, open this link: ${outcome.page}` })).skipped)
+                    return answer('skipped', { reason: why, page: outcome.page });
+            }
+        }),
+        tool('impeccable_cloudflare_connect', 'Connect the repository to Cloudflare Pages', "Connect this repository to a Cloudflare Pages project, so that Cloudflare builds every pull request as a preview, where impeccable_cloudflare_previews found no Pages project building them: the project the checkout names when it exists with no Git source (pullRequestPreviews with cause source), else a new one named after the repository where Cloudflare builds a Worker from it (worker in the answer) or the checkout is set up for a Pages project that does not exist yet. It does the rest as the person: one screen asking to connect or to create (Cloudflare's sign-in in the browser first, with a retry, where cf is not signed in here with pages:write), then cf creates the project with the build the checkout runs (command and outputDir, for a new project) and connects the repository as GitHub identifies it, every branch but the default a preview, and reads it back. Answers {\"status\": …}: connected (project names the Pages project, created whether the run made it, subdomain its own address under pages.dev, productionBranch the branch Cloudflare builds as production; pullRequestPreviews is on now), skipped (the person skipped a screen; reason says which) or refused (cf could not, or Cloudflare refused; reason says why). Cloudflare's GitHub app then has to see the repository for a push to build: the wait for the test drive's build asks for its access when none comes.", CLOUDFLARE_CONNECT, async (p, pi, signal) => {
+            if (connectOutcome)
+                return JSON.stringify(connectOutcome);
+            const evidence = cloudflareEvidence;
+            if (!evidence)
+                return 'Refused: read impeccable_cloudflare_previews first: it says whether a Pages project builds this repository.';
+            const fact = evidence.pullRequestPreviews;
+            if (fact && fact.enabled !== false)
+                return `Refused: the Pages project ${fact.project} is connected to the repository already${fact.enabled === true ? ' and builds its pull requests' : ''}.`;
+            if (fact && fact.cause !== 'source')
+                return `Refused: the Pages project ${fact.project} is connected to the repository, and its settings turn pull-request previews off: impeccable_enable_previews turns them on.`;
+            const create = !fact;
+            if (create && !evidence.worker && !evidence.project)
+                return 'Refused: nothing says the repository is set up for Cloudflare: no Pages project is built from it, the checkout names none, and no Worker is built from it. Set the preview up as the server-previews or static-site case says.';
+            const project = fact?.project || evidence.project || pagesProjectName(ctx.repo);
+            const answer = (status, more) => {
+                connectOutcome = { status, project, created: create, ...more };
+                return JSON.stringify(connectOutcome);
+            };
+            // The one screen: the connection of the project named, or the new project for the repository.
+            const screen = HOST_SCREENS[create ? 'cloudflare-create' : 'cloudflare-connect'];
+            if ((await ask({ ...screen, prompt: create ? `Create the Pages project ${project} for ${ctx.owner}/${ctx.repo}?` : `Connect ${ctx.owner}/${ctx.repo} to the Pages project ${project}?` })).skipped)
+                return answer('skipped', { reason: `The person skipped ${create ? 'creating the Pages project' : 'connecting the repository to the Pages project'}.` });
+            // cf signed in with pages:write, as it is or after Cloudflare's sign-in in the browser, keeping the scopes it held; a sign-in that did not complete offers a retry, twice.
+            const cf = cfRunner({}, ctx.hostRunner);
+            const login = cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner);
+            const writes = (status) => status.cli === 'signed-in' && (!status.scopes || status.scopes.includes('pages:write'));
+            let status = await cfStatus(cf, signal);
+            if (!writes(status)) {
+                if (status.cli === 'missing' || status.cli === 'unknown')
+                    return answer('refused', { reason: "Cloudflare's CLI did not run here." });
+                if ((await ask(HOST_SCREENS['cloudflare-setup'])).skipped)
+                    return answer('skipped', { reason: 'The person skipped the Cloudflare sign-in.' });
+                for (let attempt = 0;; attempt++) {
+                    said("Opening the browser for Cloudflare's login");
+                    const scopes = [...new Set([...(status.scopes ?? []).filter((scope) => scope !== 'offline_access'), 'account:read', 'user:read', 'pages:write'])];
+                    await login(['auth', 'login', '--force', '--no-device', '--scopes', ...scopes], { signal }).catch(() => undefined);
+                    signal?.throwIfAborted();
+                    status = await cfStatus(cf, signal);
+                    if (writes(status))
+                        break;
+                    if (status.cli === 'signed-in')
+                        return answer('refused', { reason: 'The Cloudflare sign-in gave the run no pages:write.' });
+                    if (attempt === 2)
+                        return answer('refused', { reason: 'The Cloudflare sign-in did not complete.' });
+                    if ((await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped)
+                        return answer('skipped', { reason: 'The person skipped the Cloudflare sign-in.' });
+                }
+            }
+            said(create ? `Creating the Pages project ${project}` : `Connecting the repository to ${project}`);
+            const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
+            const outcome = await connectCloudflareProject(cf, gh, status, { owner: ctx.owner, repo: ctx.repo }, { project, ...(evidence.account ? { account: evidence.account } : {}), ...(create ? { create: { command: p.command, outputDir: p.outputDir } } : {}) }, signal);
+            if (outcome.status !== 'connected')
+                return answer('refused', { reason: outcome.reason });
+            if (outcome.fact)
+                previewFacts.set('cloudflare', outcome.fact);
+            cloudflareEvidence = { ...evidence, project, ...(outcome.fact ? { pullRequestPreviews: outcome.fact } : {}) };
+            return answer('connected', { created: outcome.created, ...(outcome.subdomain ? { subdomain: outcome.subdomain } : {}), ...(outcome.productionBranch ? { productionBranch: outcome.productionBranch } : {}) });
+        }),
+        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet. Only a project this run made with vercel project add and linked with vercel link, or one connected to this repository already, is connected: a project that existed before the run (vercel link links an existing project of the folder's name) is left as it is, with the reason, and the Vercel setup ends there. Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing; with production \"exists\", productionUrl is the live app's address, for the before. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => {
+            const refused = appRefusal(undefined, 'connected', false);
+            if (refused)
+                return refused;
+            const answer = await vercelConnect(pi, signal);
+            // A project that deploys production already names the live app's address, for the before.
+            const link = answer.productionUrl ? await readLink(pi.cwd) : null;
+            if (answer.productionUrl && link)
+                vercelProductions.set(new URL(answer.productionUrl).origin, link.projectId);
+            noteProduction(answer.productionUrl, 'vercel', undefined, connectedApp);
+            return JSON.stringify(answer);
+        }),
+        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts) and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
-            if (bypassOutcome?.status === 'skipped')
-                return JSON.stringify(bypassOutcome);
             const at = gated;
-            const origin = new URL(at.url).origin;
-            // A secret in hand already: an address of the same project opens with it, and no other project's does.
-            if (bypassSaved && bypassSecret && (await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: bypassSecret })).proven) {
-                bypassOrigins.add(origin);
-                return JSON.stringify(bypassSaved);
+            const { origin, host } = new URL(at.url);
+            // Where the setup API keeps the secret: the app's own on a repository with several apps, else the repository's.
+            const store = at.app?.appKey ?? '';
+            const asked = bypassOutcomes.get(store);
+            if (asked?.status === 'skipped')
+                return JSON.stringify(asked);
+            // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project has to have
+            // made the deployment before any secret of it goes there. That project is the app's own on a repository with several apps (#281), else the one the link file names.
+            const link = at.app?.link ?? (await readLink(pi.cwd));
+            if (!link)
+                return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and a bypass secret goes only to a preview the linked project serves.`;
+            // Once this run's own vercel link wrote the file, only that link counts, as impeccable_vercel_connect holds it: rewritten since, it would name another project of the person's. A project the person linked before the run has no such record, and the reads below vouch for it.
+            // An app's project is read from Vercel's list of this repository's projects, never from the file.
+            const links = linkedByRun(ctx.log);
+            const own = links.get(link.projectId);
+            if (!at.app && [...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
+                return `Refused: nothing was sent to ${at.url}. This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.`;
+            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+            const project = await readOwnProject(vercel, link, repository);
+            const which = at.app ? 'The Vercel project that builds this app' : 'The Vercel project this folder is linked to';
+            if ('reason' in project)
+                return `Refused: nothing was sent to ${at.url}. ${project.reason} A bypass secret goes only to a preview the linked project serves.`;
+            // The page at the address is the deployment's to word, whatever host it is on, so the lock is told from the project's settings, read as the person: with none, no login of Vercel's stood in front.
+            if (!project.previewsProtected)
+                return `Refused: nothing was sent to ${at.url}. Vercel's settings show no Deployment Protection on the project${project.name ? ` (${project.name})` : ''}, so what the address answered is the deployment's own page and the sign-in is the app's own: prove a page a visitor opens without signing in. A bypass secret goes only to a preview the linked project serves.`;
+            if (!(await projectMadeDeployment(vercel, link, project, host)))
+                return `Refused: nothing was sent to ${at.url}. ${which}${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview ${at.app ? 'that project' : 'the linked project'} serves.`;
+            /** The secret opened this address and is saved: proofs of it send that secret, and the app's preview is proven. */
+            const opened = () => {
+                bypassOrigins.set(origin, store);
+                hostedPreviewProven = true;
+                provenHost = 'Vercel';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
+            };
+            // A secret in hand already for the same store and project: another address of the project opens with it.
+            const held = bypassHeld.get(store);
+            if (held && held.projectId === link.projectId && (await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: held.secret })).proven) {
+                opened();
+                return JSON.stringify(held.saved);
             }
             /** The store took this attempt's secret: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
             const { value, ...told } = await passVercelLogin({
-                run: (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal }),
-                link: () => readLink(pi.cwd),
-                consent: async () => !(await ask(HOST_SCREENS['vercel-bypass'])).skipped,
+                run: vercel,
+                link: async () => link,
+                // A project the folder is not linked to is named on the CLI's reads and makes; the reads are held to its id all the same.
+                ...(at.app?.name ? { project: at.app.name } : {}),
+                consent: async () => !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
                 paste: async () => {
-                    // The locked preview may be another project's than the one this run connected, so the person picks the project.
-                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection'));
-                    const answer = await ask(HOST_SCREENS['vercel-bypass-key']);
+                    // The project's own settings page, in its team where the run knows it; else Vercel's picker.
+                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), project.name));
+                    const answer = await ask(sentTo(HOST_SCREENS['vercel-bypass-key'], at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
                 save: async (secret) => {
-                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret);
+                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret, at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
                 remember: noteSensitiveAnswer,
             });
-            bypassOutcome = { ...told, ...(told.status === 'saved' ? { proven: true } : {}) };
+            const outcome = { ...told, ...(at.app ? { appKey: at.app.appKey } : {}), ...(told.status === 'saved' ? { proven: true } : {}) };
+            bypassOutcomes.set(store, outcome);
             if (value) {
                 // What is in hand follows the store: a new secret is the one saved now, and the origins the last one opened no longer stand.
-                bypassSecret = value;
-                bypassOrigins.clear();
-                bypassOrigins.add(origin);
-                hostedPreviewProven = true;
-                provenHost = 'Vercel';
-                bypassSaved = bypassOutcome;
+                for (const [address, of] of bypassOrigins)
+                    if (of === store)
+                        bypassOrigins.delete(address);
+                bypassHeld.set(store, { secret: value, projectId: link.projectId, saved: outcome });
+                opened();
             }
             else if (told.status === 'save-failed' && stored) {
                 // The store holds the secret this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through. A store the attempt never changed keeps the earlier one good.
-                bypassSecret = undefined;
-                bypassOrigins.clear();
-                bypassSaved = undefined;
+                bypassHeld.delete(store);
+                for (const [address, of] of bypassOrigins)
+                    if (of === store)
+                        bypassOrigins.delete(address);
             }
-            return JSON.stringify(bypassOutcome);
+            return JSON.stringify(outcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
@@ -2264,6 +2794,8 @@ export function createTools(ctx) {
                 // A site made public stands while the address opens with nothing sent; behind the login again, it is read again.
                 if ((await prove(undefined)).proven) {
                     provenPattern = pattern ?? provenPattern;
+                    if (at.app)
+                        provenApps.add(at.app.appKey);
                     return JSON.stringify(stands);
                 }
                 passwordStands.delete(site);
@@ -2273,6 +2805,8 @@ export function createTools(ctx) {
             // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
             if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
                 provenPattern = pattern ?? provenPattern;
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 return JSON.stringify(passwordSaved);
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
@@ -2281,7 +2815,7 @@ export function createTools(ctx) {
                 run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
                 site,
                 consent: async () => {
-                    if (passwordConsented.has(site) || !(await ask(HOST_SCREENS['netlify-password'])).skipped)
+                    if (passwordConsented.has(site) || !(await ask(sentTo(HOST_SCREENS['netlify-password'], at.url))).skipped)
                         return passwordConsented.add(site), true;
                     return false;
                 },
@@ -2301,12 +2835,12 @@ export function createTools(ctx) {
                     return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
                 },
                 paste: async () => {
-                    const answer = await ask(HOST_SCREENS['netlify-password-key']);
+                    const answer = await ask(sentTo(HOST_SCREENS['netlify-password-key'], at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove,
                 save: async (password) => {
-                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password));
+                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password), at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
@@ -2319,6 +2853,8 @@ export function createTools(ctx) {
                 // The site is public now: its previews open with nothing sent.
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 provenPattern = pattern ?? provenPattern;
             }
             if (value) {
@@ -2328,6 +2864,8 @@ export function createTools(ctx) {
                 passwordSites.add(site);
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 provenPattern = pattern ?? provenPattern;
                 passwordSaved = passwordOutcome;
             }
@@ -2339,7 +2877,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(passwordOutcome);
         }),
-        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret. It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (the typed token did not open the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
             if (accessOutcome?.status === 'skipped')
@@ -2349,19 +2887,22 @@ export function createTools(ctx) {
             const prove = async (token) => (proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token }));
             const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
             const save = async (token) => {
-                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret } })).ok)
+                const app = at.app ? { appKey: at.app.appKey } : {};
+                if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret, ...app } })).ok)
                     return 'The setup API did not store the service token.';
                 // An app that signs in with Access sends this token already: the setting would make it a second credential, which the setup API refuses.
                 const repos = object((await call(pi, `${ctx.setupApi}/state`)).data)?.repos;
                 const lock = Array.isArray(repos) ? object(object(repos.map(object).find((r) => r?.name === ctx.repo)?.items)?.['preview-protection']) : undefined;
                 if (lock?.authMethod === 'access')
                     return null;
-                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access' } })).ok)
+                if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access', ...app } })).ok)
                     return 'The setup API stored the service token, but not the setting that sends it: it is turned on under Preview protection on the setup page.';
                 return null;
             };
             let answer;
-            if (accessToken && (await prove(accessToken)).proven) {
+            const project = pagesProject(new URL(at.url).origin);
+            // The token in hand goes only to a project it opened already, as the proofs send it: any other address is read for an application of the person's first.
+            if (accessToken && project && accessProjects.has(project) && (await prove(accessToken)).proven) {
                 // The token in hand opens this address too: stored already, or stored now.
                 const failed = accessStored ? null : await save(accessToken);
                 answer = { status: failed ? 'save-failed' : 'saved', ...accessMade, ...(failed ? { reason: failed } : {}), value: accessToken };
@@ -2369,7 +2910,7 @@ export function createTools(ctx) {
             else {
                 answer = await passCloudflareAccess({
                     url: at.url,
-                    consent: async () => !(await ask(HOST_SCREENS['cloudflare-access'])).skipped,
+                    consent: async () => !(await ask(sentTo(HOST_SCREENS['cloudflare-access'], at.url))).skipped,
                     cf: cfRunner({}, ctx.hostRunner),
                     login: cfRunner({ browser: true, timeoutMs: 300_000 }, ctx.hostRunner),
                     retry: async () => !(await ask(HOST_SCREENS['cloudflare-signin-retry'])).skipped,
@@ -2379,7 +2920,7 @@ export function createTools(ctx) {
                         return typed.skipped ? undefined : typed.value;
                     },
                     paste: async () => {
-                        const typed = await ask(HOST_SCREENS['cloudflare-access-key']);
+                        const typed = await ask(sentTo(HOST_SCREENS['cloudflare-access-key'], at.url));
                         return typed.skipped ? undefined : { id: typed.username, secret: typed.password };
                     },
                     prove,
@@ -2397,7 +2938,6 @@ export function createTools(ctx) {
                 accessToken = value;
                 accessStored = told.status === 'saved';
                 accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
-                const project = pagesProject(new URL(at.url).origin);
                 if (project)
                     accessProjects.add(project);
             }
@@ -2406,6 +2946,8 @@ export function createTools(ctx) {
             if (told.status === 'saved') {
                 hostedPreviewProven = true;
                 provenHost = 'Cloudflare Pages';
+                if (at.app)
+                    provenApps.add(at.app.appKey);
                 if (pattern)
                     provenPattern = pattern;
             }