@impeccable/reviews 0.1.8 → 0.1.10

package/dist/tools.js

@@ -10,17 +10,18 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, sentTo, startedIn } from './host-questions.js';
+import { APPS_QUESTION, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
+import { scan } from './scan.js';
 import { gitEnvironment } from './sandbox.js';
 import { openBrowser } from './login.js';
 import { STATUS_MAX, statusVoiceError, TASK_STATUSES } from './sync.js';
@@ -107,6 +108,21 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     }
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
+/** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
+export function appsSummary(apps) {
+    const picked = apps.filter((a) => a.state !== 'unpicked');
+    const ready = picked.filter((a) => a.state === 'ready');
+    const rest = picked.filter((a) => a.state !== 'ready');
+    const names = (list) => list.map((a) => a.name).join(', ');
+    const line = [...(ready.length ? [`Set up: ${names(ready)}.`] : []), ...(rest.length ? [`Not set up: ${names(rest)}.`] : [])].join(' ');
+    return { notReady: rest.map((a) => a.name), line, todo: rest.flatMap((a) => (a.left ? [a.left] : [])) };
+}
+/** A host's lock in front of a preview, as impeccable_prove_preview names it: how the person reads it, the tool that gets a key past it, and the step left where none was saved (preview-protection's step 3). */
+const LOCKS = {
+    'vercel-protection': { lock: "Vercel's login", tool: 'impeccable_vercel_bypass', left: 'Save the Vercel bypass secret on the setup page' },
+    'netlify-protection': { lock: "Netlify's password or team login", tool: 'impeccable_netlify_password', left: 'Save the Netlify site password on the setup page, or make the site public on its Visitor access page' },
+    'cloudflare-access': { lock: 'Cloudflare Access', tool: 'impeccable_cloudflare_access', left: 'Save the Cloudflare service token on the setup page' },
+};
 const NO_INPUT = { type: 'object', properties: {}, additionalProperties: false };
 /** Why the status line and the task list say different things, one task in progress at a time and the status its detail; null when they agree. */
 function stageError(status, tasks) {
@@ -155,6 +171,11 @@ const REPORT = {
             description: `What waits on the person besides merging the setup pull request and closing the test drive: one line each, at most ${STATUS_MAX} characters, such as "Add the admin test account on the setup page". The terminal counts them. Leave it out when nothing does.`,
             items: { type: 'string', minLength: 1 },
         },
+        apps: {
+            type: 'array',
+            description: 'On a repository with several apps: for each picked app whose preview was not proven or keyed, why, in plain words of at most 200 characters, such as "not checked: the person stopped after the first app". Names only, never an address or a key.',
+            items: { type: 'object', additionalProperties: false, required: ['appKey', 'reason'], properties: { appKey: { type: 'string', minLength: 1 }, reason: { type: 'string', minLength: 1 } } },
+        },
     },
 };
 const WRITE = {
@@ -803,18 +824,34 @@ export async function driveCoversSetup(cwd, setupBranch, driveBranch) {
  * What the pushed `head` changes against `base`, as their remote-tracking refs in this checkout show GitHub: each file's
  * `git diff --name-status` letter and its path as it is, never quoted; a rename as a removal and an addition. Null when either ref is missing or git fails.
  */
-export async function pushedChanges(cwd, base, head) {
+export async function pushedChanges(cwd, base, head, lessSetup = false) {
     try {
+        const git = (args, timeout = 10_000) => execFileAsync('git', args, { cwd, timeout, env: gitEnvironment() });
         // The two branches as the remote has them, fetched so the diff can be read here: refs/remotes/origin/* sit in the checkout's git folder, where a command in the sandbox can move them.
         const refs = [`refs/heads/${base}`, `refs/heads/${head}`];
-        const { stdout: heads } = await execFileAsync('git', ['ls-remote', '--heads', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
+        const { stdout: heads } = await git(['ls-remote', '--heads', 'origin', ...refs], 60_000);
         const sha = new Map(heads.split('\n').filter(Boolean).map((line) => line.split('\t').reverse()));
         if (!refs.every((ref) => sha.has(ref)))
             return null;
-        await execFileAsync('git', ['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], { cwd, timeout: 60_000, env: gitEnvironment() });
-        const { stdout } = await execFileAsync('git', ['diff', '-z', '--name-status', '--no-renames', `${sha.get(refs[0])}...${sha.get(refs[1])}`], { cwd, timeout: 10_000, env: gitEnvironment() });
-        const fields = stdout.split('\0');
-        return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
+        await git(['fetch', '--quiet', '--no-tags', '--no-write-fetch-head', 'origin', ...refs], 60_000);
+        // From where the two met (three dots), so a base that moved on since the branch left it adds nothing of its own.
+        const changed = async (from, to) => {
+            const { stdout } = await git(['diff', '-z', '--name-status', '--no-renames', `${from}...${to}`]);
+            const fields = stdout.split('\0');
+            return Array.from({ length: Math.floor(fields.length / 2) }, (_, i) => ({ status: fields[2 * i], path: fields[2 * i + 1] }));
+        };
+        const pushed = sha.get(refs[1]);
+        if (!lessSetup)
+            return changed(sha.get(refs[0]), pushed);
+        // The test drive branches from the setup commit, so a diff from the base carries the setup branch's files too (the workflow, a build fix). Read from the local setup branch under the pushed head instead (impeccable/setup, or its -N; of several, the nearest), the changes are the test drive's own: a file the setup branch changed and the test drive changed again is among them, one it left as the setup branch had it is not.
+        const { stdout: setups } = await git(['for-each-ref', '--format=%(refname)', 'refs/heads/impeccable/setup', 'refs/heads/impeccable/setup-*']);
+        const isAncestor = (of, to) => git(['merge-base', '--is-ancestor', of, to]).then(() => true, () => false);
+        let setup;
+        for (const ref of setups.split('\n').filter(Boolean)) {
+            if ((await isAncestor(ref, pushed)) && (setup === undefined || (await isAncestor(setup, ref))))
+                setup = ref;
+        }
+        return changed(setup ?? sha.get(refs[0]), pushed);
     }
     catch {
         return null;
@@ -1648,8 +1685,25 @@ export function createTools(ctx) {
     /** On a repository with several apps: the app each production address a host tool answered is the live app of, read for that app's own project or site, and the apps whose host preview a proof opened. */
     const liveApps = new Map();
     const provenApps = new Set();
+    /** On a repository with several apps (#286): the method each app's preview write saved; the host's lock a proof of each app's preview met; and the apps whose lock was met with no key tool called for them since, which holds every other app's steps until it is. */
+    const appMethods = new Map();
+    const lockMet = new Map();
+    const lockPending = new Map();
+    /** The projects whose deployments Vercel made of this repository, as impeccable_hosted_previews read them, by the app read for ('' for the repository): a repository Vercel deploys already needs no Vercel setup, since its previews start with the first pull request (#286). */
+    const vercelDeployed = new Map();
     /** Each Vercel project's production address, read from Vercel, by origin, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
     const vercelProductions = new Map();
+    /** The person's Vercel teams as the CLI listed them this run, once: a project's dashboard page is named by its own team, never the CLI's current scope or Vercel's picker, which open whatever project they like. */
+    let vercelTeamList;
+    /** A page of a Vercel project's dashboard, under the team the project's own ids name (the link file's or Vercel's list's); the team this run chose where the CLI cannot list the teams, and Vercel's picker last. */
+    const vercelPageFor = async (vercel, link, page, project) => {
+        let scope;
+        if (link && project) {
+            vercelTeamList ??= vercelTeams(vercel);
+            scope = await vercelDashboardScope(vercel, link, await vercelTeamList);
+        }
+        return vercelProjectPage(page, scope ?? chosenHostTeam(ctx.log, 'vercel'), project);
+    };
     /** The bypass secret a proof sends to `origin`: the one proved there, or, for a live address, the one of the project whose production it is. */
     const bypassFor = (origin, live) => {
         const store = bypassOrigins.get(origin);
@@ -1676,6 +1730,7 @@ export function createTools(ctx) {
                 // The CLI's current scope is the team; one team is the team; several with none current are the person's pick.
                 team: async () => {
                     const teams = await vercelTeams(cli);
+                    vercelTeamList = Promise.resolve(teams);
                     const one = teams.find((t) => t.current) ?? (teams.length === 1 ? teams[0] : undefined);
                     return one ? { team: one.value, choices: [] } : { choices: teams.map(({ label, value }) => ({ label, value })) };
                 },
@@ -1826,6 +1881,8 @@ export function createTools(ctx) {
         if (appsRepo) {
             const folders = new Map(await Promise.all([...(pickedApps ?? [])].map(async (key) => [await appFolder(pi, key), key])));
             connectedApp = project.rootDirectory !== undefined ? folders.get(project.rootDirectory) : undefined;
+            if (project.name)
+                noteApp(connectedApp, { host_project: project.name });
             if (connectedApp === undefined) {
                 // A project not connected to this repository builds no push of it, so the push goes; one connected already would build it, so it stays held.
                 if (project.repository !== repository.toLowerCase())
@@ -1854,7 +1911,7 @@ export function createTools(ctx) {
         vercelProject = first.project ?? vercelProject;
         // Vercel refused the lock: the person turns it on in the project's settings, in this run, and the read sees it.
         if (first.production === 'none' && !first.locked) {
-            const page = vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), vercelProject);
+            const page = await vercelPageFor(vercel, link, 'settings/deployment-protection', vercelProject);
             first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, repository, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
                 waiting: "Waiting for Vercel's login on the project",
                 skipped: 'The person skipped locking the Vercel project.',
@@ -1918,8 +1975,10 @@ export function createTools(ctx) {
         const app = appKey !== undefined ? { appKey } : {};
         if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value, ...app } })).ok)
             return { stored: false, failed: `The setup API did not store the ${what}.` };
+        noteApp(appKey, { key_placed: true });
         if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header, ...app } })).ok)
             return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
+        noteApp(appKey, { method_saved: true });
         return { stored: true, failed: null };
     };
     /** The instructions the writes are checked against: the first state may have come before the scan proposed the apps, so a later read that shows them brings the apps write in. */
@@ -1936,8 +1995,41 @@ export function createTools(ctx) {
     let pickedApps;
     /** This run confirmed the scan's proposal, so nothing was answered before: the question opens with every app picked. */
     let confirmedApps = false;
+    /** What the run did for each picked app, as its own tool calls found it, sent with the session whenever it changes (#2307). */
+    const appSummaries = new Map();
+    const sendApps = () => ctx.sync.update({ apps: [...appSummaries.values()].slice(0, 50) });
+    const pick = (keys) => {
+        pickedApps = keys;
+        const before = new Map(appSummaries);
+        appSummaries.clear();
+        for (const key of keys)
+            appSummaries.set(key, before.get(key) ?? { app_key: key, host_project: null, preview_proven: false, preview_host: null, key_placed: false, method_saved: false });
+        sendApps();
+    };
+    const noteApp = (key, patch) => {
+        const was = key !== undefined ? appSummaries.get(key) : undefined;
+        if (!was || Object.entries(patch).every(([field, value]) => was[field] === value))
+            return;
+        appSummaries.set(key, { ...was, ...patch });
+        sendApps();
+    };
+    /** The command saw the app's preview open at `url`, whether or not a key for it was saved after: only its hostname is kept. */
+    const sawApp = (key, url, proof) => {
+        if (proof.proven)
+            noteApp(key, { preview_proven: true, preview_host: new URL(url).hostname });
+        return proof;
+    };
+    /** A proof opened the app's preview at `url`, so its method may be saved. */
+    const proveApp = (key, url) => {
+        provenApps.add(key);
+        noteApp(key, { preview_proven: true, preview_host: new URL(url).hostname });
+    };
     /** Each app's folder, by key, as the state names it: what its host project or site must build. */
     const appFolders = new Map();
+    /** The apps as the state last listed them. */
+    let knownApps = null;
+    /** An app's name as the state gives it, or its key. */
+    const appName = (key) => knownApps?.find((a) => a.key === key)?.name ?? key;
     /**
      * A read of the state or the checkup, trimmed to this setup before the model sees it. The setup token covers the apps
      * there were at sign-in, so an app the scan proposed later reads `not-selected`: the run signs in again, for a token
@@ -1971,6 +2063,7 @@ export function createTools(ctx) {
         });
         for (const app of apps)
             appFolders.set(app.key, app.folder);
+        knownApps = apps;
         return apps;
     };
     /** An app's folder, read from the state the first time it is asked for. */
@@ -1988,6 +2081,48 @@ export function createTools(ctx) {
             return `Refused: give "appKey", the key of an app this run sets up (${[...pickedApps].join(', ')}). Nothing was ${what}.`;
         return null;
     };
+    /**
+     * On a repository with several apps, why a step for another app than `appKey` may not run yet: an app's proof met a
+     * host's lock, and the tool that gets a key past it was not called for that app since, so its key would never be put
+     * in place (#286). Null where it may: no lock met, or every one answered by its tool.
+     */
+    const lockRefusal = (appKey, what) => {
+        for (const [key, gate] of lockPending) {
+            if (key === appKey)
+                continue;
+            const { lock, tool } = LOCKS[gate];
+            return `Refused: ${appName(key)}'s preview is behind ${lock}, and ${tool} was not called for it: call it first, as preview-protection says, so each app gets its own key. Nothing was ${what}.`;
+        }
+        return null;
+    };
+    /** How this run left each app the state lists (#286), for the report and the last screen. */
+    const appOutcomes = async (pi) => {
+        const apps = knownApps ?? (await stateApps(pi)) ?? [];
+        return apps.map(({ key, name, folder }) => {
+            const method = appMethods.get(key);
+            const gate = lockMet.get(key);
+            const proven = provenApps.has(key);
+            if (!pickedApps?.has(key))
+                return { key, name, folder, state: 'unpicked' };
+            if (method !== undefined && (method !== 'preview-deploy' || proven))
+                return { key, name, folder, state: 'ready' };
+            if (gate && !proven)
+                return { key, name, folder, state: 'locked', left: `${name}: its previews are behind ${LOCKS[gate].lock}, and no key was saved. ${LOCKS[gate].left}.` };
+            return { key, name, folder, state: 'unset', left: `${name}: no preview method was saved; the report says why.` };
+        });
+    };
+    /** The report's section on the apps, one line each, from what this run saved and proved rather than from the model's words. */
+    const appsSection = (apps) => `\n\n## Each app, as this run left it\n\n${apps.map((a) => {
+        const where = `${a.name} (${a.folder || '/'})`;
+        const lock = lockMet.has(a.key) ? LOCKS[lockMet.get(a.key)].lock : undefined;
+        if (a.state === 'ready')
+            return `- ${where}: set up. Method: ${appMethods.get(a.key)}${provenApps.has(a.key) ? `, its preview proven${lock ? ` past ${lock}` : ''}` : ''}.`;
+        if (a.state === 'locked')
+            return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
+        if (a.state === 'unset')
+            return `- ${where}: not set up. No preview method was saved for it.`;
+        return `- ${where}: not set up this run.`;
+    }).join('\n')}`;
     /** Each app's Vercel project, found once a run (a failure is read again, the CLI may have signed in since). */
     const vercelApps = new Map();
     /** The app's Vercel project as this repository's, read now for its deployments: the one that builds the app's folder, or why none can be told. */
@@ -2016,21 +2151,23 @@ export function createTools(ctx) {
         const apps = await stateApps(pi);
         if (!apps || apps.length < 2)
             return 'Refused: the setup state could not be read, or lists fewer than two apps: read it again with impeccable_state, then ask again.';
-        if (ctx.app !== undefined && apps.some((a) => a.key === ctx.app)) {
-            pickedApps = new Set([ctx.app]);
-            return JSON.stringify({ values: [ctx.app], named: true });
+        // Started for one app (--app, from its card): one confirm screen naming it instead of the list, whose Skip opens the list for someone who wants another app (#286).
+        const named = ctx.app !== undefined ? apps.find((a) => a.key === ctx.app) : undefined;
+        if (named && !(await ask(namedAppQuestion(named))).skipped) {
+            pick(new Set([named.key]));
+            return JSON.stringify({ values: [named.key], named: true });
         }
         // Started below the top: the app whose folder holds that folder (the deepest, never the root's) is ticked too, and the hint says so.
         const start = ctx.start ?? '';
         const here = start ? apps.filter((a) => a.folder && (start === a.folder || start.startsWith(`${a.folder}/`))).sort((a, b) => b.folder.length - a.folder.length)[0] : undefined;
         const hint = here ? startedIn(`${here.name}'s folder`) : start ? startedIn(start) : APPS_QUESTION.hint;
-        const answer = await ask({ ...APPS_QUESTION, hint, options: apps.map((a) => ({ label: `${a.name} · ${a.folder || '/'}`, value: a.key, selected: confirmedApps || a.enabled || a === here })) });
+        const answer = await ask({ ...APPS_QUESTION, hint, options: apps.map((a) => ({ label: `${a.name} · ${a.folder || '/'}`, value: a.key, selected: confirmedApps || a.enabled || a === here || a === named })) });
         if (answer.skipped) {
-            pickedApps = new Set(apps.filter((a) => a.enabled).map((a) => a.key));
+            pick(new Set(apps.filter((a) => a.enabled).map((a) => a.key)));
             return JSON.stringify({ skipped: true, on: [...pickedApps] });
         }
         const values = (answer.values ?? []).filter((value) => apps.some((a) => a.key === value));
-        pickedApps = new Set(values);
+        pick(new Set(values));
         return JSON.stringify({ values });
     }
     return [
@@ -2114,7 +2251,7 @@ export function createTools(ctx) {
             // On a repository with several apps, nothing but the apps write goes before the apps question, and an app's setting or check names a picked app.
             const forApp = /\/(preview|test-accounts|connection-check|latest-pull-check)$/.test(target.url);
             if (!target.url.endsWith('/apps')) {
-                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp);
+                const refused = appRefusal(object(p.body)?.appKey, 'saved', forApp) ?? (target.url.endsWith('/preview') ? lockRefusal(object(p.body)?.appKey, 'saved') : null);
                 if (refused)
                     return refused;
             }
@@ -2167,6 +2304,10 @@ export function createTools(ctx) {
                     savedHost = provenHost;
                 if (saved?.appKey !== undefined)
                     perApp = true;
+                if (saved && 'intendedMethod' in saved && typeof saved.appKey === 'string')
+                    noteApp(saved.appKey, { method_saved: true });
+                if (saved?.appKey !== undefined && typeof saved.intendedMethod === 'string')
+                    appMethods.set(String(saved.appKey), saved.intendedMethod);
                 if (saved && 'intendedMethod' in saved)
                     hostMethod = saved.intendedMethod === 'preview-deploy';
                 for (const key of Object.keys(object(p.body) ?? {}))
@@ -2191,12 +2332,18 @@ export function createTools(ctx) {
             // A test account never comes back to the model, even if the API echoed it.
             return testAccounts ? redact(answerText(response), typed.values()) : answerText(response);
         }),
-        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. So is the apps question on a repository with several apps (id "apps", kind "multi"), which lists the state\'s apps itself and answers {"values": […]}, {"values": [key], "named": true} when the command was started for that app, or {"skipped": true, "on": […]}. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
+        tool('impeccable_ask', 'Ask the person', 'Ask the person one question in a dialog, and wait for the answer; the web page shows the run waiting meanwhile. Answers {"value": "…"} for text and single, {"values": […]} for multi, {"confirmed": true} for confirm, {"username": "…", "password": "secret:…"} for account, or {"skipped": true}. A host\'s setup question (id "vercel-setup", "vercel-team", "netlify-setup" or "netlify-team") is worded by this tool: give it that id and its kind. So is the apps question on a repository with several apps (id "apps", kind "multi"), which lists the state\'s apps itself and answers {"values": […]}, {"values": [key], "named": true} when the command was started for that app (it shows one confirm screen naming the app instead of the list, and the list when the person asks for other apps there), or {"skipped": true, "on": […]}. netlify-setup and vercel-setup are the host\'s sign-in: it shows its screen only when that CLI is signed out, signs the person in through the browser with a retry, and answers {"confirmed": true, "signedIn": true}, with "team" (the one the project goes into) or "teams" to choose from when the person has several, {"confirmed": true, "cli": "missing"} when the CLI is to be installed first and this asked again, or {"skipped": true}.', ASK, async (p, pi, signal) => {
             // A skip never stops the run, so every question offers one.
             const asked = p;
             if (asked.id === APPS_QUESTION.id && appsRepo)
                 return appsQuestion(pi);
             const host = /^(netlify|vercel)-(setup|team)$/.exec(asked.id);
+            // The Vercel setup is for a repository Vercel has never deployed: one it deploys already (every app this run sets up, on a repository with several), as impeccable_hosted_previews read it, gets its previews from the first pull request on (#286). An app with no project of its own still gets the screen, and a setup under way (asked again once the CLI was installed) is not stopped here.
+            const deployed = appsRepo ? pickedApps !== undefined && pickedApps.size > 0 && [...pickedApps].every((key) => vercelDeployed.has(key)) : vercelDeployed.has('');
+            if (asked.id === 'vercel-setup' && deployed && !hostSignIns.has('vercel')) {
+                const projects = [...vercelDeployed.values()].filter(Boolean);
+                return `Refused: Vercel deploys this repository already${projects.length ? ` (${projects.join(', ')})` : ''}: it made deployments of it, production included, so its previews start with the first pull request, and there is no Vercel sign-in, project or connection to make. Go on as vercel-previews says: build and push the test drive as pull-requests' step 4 says, wait for Vercel's deployment of the pushed branch with impeccable_hosted_previews and branch, prove the test drive's page there (past Vercel's login as preview-protection says), and save the method.`;
+            }
             if (host?.[2] === 'setup')
                 return JSON.stringify(await hostSignIn(host[1], pi, signal));
             if (host && (teamChoices.get(host[1])?.length ?? 0) < 2)
@@ -2265,11 +2412,18 @@ export function createTools(ctx) {
                 return `Refused: ${found.problem}.`;
             drive.url = found.url;
             // The page that links to the test drive is an existing file the branch changes; files under dot folders (.github, .netlify) and dotfiles never link to it (#241).
-            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch) : null;
+            const changes = !recordedBranches && found.base ? await (ctx.pushedChanges ?? pushedChanges)(pi.cwd, found.base, found.branch, true) : null;
             const files = (changes ?? []).filter(({ path }) => !path.split('/').some((part) => part.startsWith('.')));
             if (files.length && files.every(({ status }) => status === 'A')) {
                 return `Refused: ${found.branch} only adds ${files.map(({ path }) => path).join(', ')} and changes no existing page, so nothing links to the test drive. Commit the page that links to it and push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
             }
+            // On a repository with several apps, the test drive's page goes into a picked app's own folder, and no other app is touched (#286): a file it adds anywhere else is refused, whatever its name. The setup branch's own files (a build fix at the root) are not in `files`, as pushedChanges leaves them out.
+            if (appsRepo && pickedApps) {
+                const folders = (await Promise.all([...pickedApps].map((key) => appFolder(pi, key)))).filter((folder) => folder !== undefined);
+                const outside = files.filter(({ status, path }) => status === 'A' && !folders.some((folder) => !folder || path.startsWith(`${folder}/`))).map(({ path }) => path);
+                if (outside.length)
+                    return `Refused: ${found.branch} adds ${outside.join(', ')}, outside the folders of the apps this run sets up (${folders.map((folder) => folder || '/').join(', ')}). The test drive's page goes into each picked app's own folder, as the monorepo case says, and no other app is touched: move it, push, prove the new push's preview again as pull-requests' step 4 says, then record it again.`;
+            }
             let setupBranch = recordedBranches?.setup, setupBase = recordedBranches?.setupBase;
             if (setup) {
                 // The setup pull request carries the preview attempts, so its binding cannot change.
@@ -2299,6 +2453,9 @@ export function createTools(ctx) {
             const control = left.find((line) => plainText(line) !== line);
             if (control)
                 return `Refused: "${control}" holds a control character or an escape sequence. Each line of "left" is plain text. Nothing was saved: call impeccable_report again.`;
+            const pending = lockRefusal(undefined, 'saved');
+            if (pending)
+                return `${pending} Call impeccable_report again once it answered.`;
             // The web page keeps the task list as the report leaves it, so no task may still read as waiting or running (#83).
             const open = ctx.sync.payload.tasks.filter((t) => !t.id.startsWith('preview-attempt-') && (t.status === 'pending' || t.status === 'in_progress'));
             if (open.length)
@@ -2312,6 +2469,10 @@ export function createTools(ctx) {
                 const shown = (path) => path.replace(/[\\`*_[\]<>|~]/g, '\\$&').replace(/[\x00-\x1f\x7f]/g, (c) => JSON.stringify(c).slice(1, -1));
                 markdown += `\n\n## What the setup pull request changes\n\n${changes ? changes.map(({ status, path }) => `- ${shown(path)} (${verbs[status] ?? status})`).join('\n') || 'Nothing: it carries no file.' : 'This checkout could not list its files: read them on the pull request before merging.'}`;
             }
+            // On a repository with several apps, how this run left each app, from what it saved and proved (#286).
+            const apps = appsRepo && pickedApps ? await appOutcomes(pi) : undefined;
+            if (apps)
+                markdown += appsSection(apps);
             if (previews.active && retry.pr) {
                 await observe(signal);
                 const lines = attempts().map((a, i) => `${i + 1}. [Attempt ${i + 1}](${a.url}) (run attempt ${a.attempt}): ${a.status}. ${a.diagnostics.map((d) => `${d.appKey}: step ${d.stage ?? 'unverified'}. ${d.reason}`).join(' ')}${a.changes.length ? ` Changed settings: ${a.changes.join(', ')}.` : ''}`);
@@ -2326,23 +2487,37 @@ export function createTools(ctx) {
             const covered = test_pr && recordedBranches?.setup
                 ? await (ctx.driveCoversSetup ?? driveCoversSetup)(pi.cwd, recordedBranches.setup, recordedBranches.drive) : null;
             const drive = covered === false ? undefined : test_pr;
+            // Why an app was not proven or keyed goes with its summary only as plain words, with no address (a scheme, or a host with a path or query) and nothing shaped like a secret; anything else is dropped.
+            const appsBefore = new Map(appSummaries);
+            for (const { appKey, reason } of p.apps ?? []) {
+                const plain = reason.trim();
+                const address = /[a-z][a-z0-9+.-]*:\/\/|[a-z0-9-]+(?:\.[a-z0-9-]+)+[/?#]/i.test(plain);
+                if (plain.length <= 200 && plainText(plain) === plain && !address && !scan('output', plain).length)
+                    noteApp(appKey, { reason: plain });
+            }
             // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
             ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
                 ctx.sync.update({ phase, status, question, report_markdown, test_pr, left: leftBefore });
+                // Its reasons go with it: the report sent again gives its own.
+                if (appsBefore.size) {
+                    for (const [key, was] of appsBefore)
+                        appSummaries.set(key, was);
+                    sendApps();
+                }
                 return `Error: the report was refused (${res.status}: ${res.error}). Fix what it says and call impeccable_report again.`;
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
         tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. Without branch, where GitHub records a production deployment Vercel made and this folder is linked to the project (.vercel/project.json) the Vercel CLI reads as this repository\'s, production is the live app\'s address, the project\'s own domain, for the before. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
-            const refused = appRefusal(p.appKey, 'read');
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
                 return refused;
             // The fact, the live app and an app's project read the same projects: each `vercel api` call is made once.
@@ -2386,7 +2561,9 @@ export function createTools(ctx) {
             const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
             // A head's build is still building until it has a final status.
             const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), app?.name ?? vercelProject), signal) : await read();
+            // The project's Git settings, for the screen a build that never comes opens: the app's project's own page, else the linked project's.
+            const gitPage = branch !== undefined ? await vercelPageFor(vercel, app ? app.link : await readLink(pi.cwd), 'settings/git', app?.name ?? vercelProject) : '';
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => gitPage, signal) : await read();
             /** The project the evidence is of: the app's, else the one this folder is linked to. */
             const link = async () => (app ? app.link : readLink(pi.cwd));
             /** The hosts of the linked project's deployments while it is locked at every address, read from Vercel once a Production deployment turns up, and once per call. */
@@ -2412,6 +2589,13 @@ export function createTools(ctx) {
                 if (app)
                     listedApps.set(url.origin, { appKey: appKey, link: app.link, name: app.name });
             }
+            // Vercel deploys the repository (this app's project did) when it made a deployment of it, production included: then its previews start with the first pull request, and no Vercel setup is asked (#286).
+            if (branch === undefined) {
+                if (evidence.deployments.some((d) => d.vercel && d.state === 'success'))
+                    vercelDeployed.set(appKey ?? '', app?.name ?? '');
+                else
+                    vercelDeployed.delete(appKey ?? '');
+            }
             // What vercel.json and the linked project (the app's, with its folder's vercel.json) say of the test drive's branch rides with the plain evidence, never with a wait: reported, never changed.
             if (branch === undefined) {
                 const fact = await (ctx.vercelPreviewsReader ?? vercelPreviewsFact)(pi.cwd, `${ctx.owner}/${ctx.repo}`, () => vercel, app ? { directory: app.folder, link: app.link } : undefined);
@@ -2431,11 +2615,13 @@ export function createTools(ctx) {
                     vercelProductions.set(new URL(production).origin, linked.projectId);
                 noteProduction(production, 'vercel', undefined, appKey);
             }
+            if (app?.name)
+                noteApp(appKey, { host_project: app.name });
             return JSON.stringify({ ...(appKey !== undefined ? { appKey, project: app.name } : {}), ...evidence, ...(production ? { production } : {}) });
         }),
         tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). production is the live site's own address, for the before. cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
-            const refused = appRefusal(p.appKey, 'read');
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
                 return refused;
             // On a repository with several apps, only the site that builds the app's folder (#281).
@@ -2466,6 +2652,9 @@ export function createTools(ctx) {
             if (evidence.pullRequestPreviews)
                 previewFacts.set('netlify', evidence.pullRequestPreviews);
             noteProduction(evidence.production, 'netlify', liveSite(evidence), appKey);
+            const site = evidence.unmatched ? undefined : liveSite(evidence);
+            if (site)
+                noteApp(appKey, { host_project: site });
             return JSON.stringify(appKey !== undefined ? { appKey, ...evidence } : evidence);
         }),
         tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). production is the project's own address, https://<project>.pages.dev, the live app, for the before. cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. pullRequestPreviews says whether the Pages project built from this repository builds previews of pull requests at all (enabled false, with the cause: source, deployments or previews); worker says Cloudflare builds a Worker from the repository (Workers Builds), which gives pull requests no preview; githubApp says what gh reads of Cloudflare's GitHub app on the owner, and the page where it gets access. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out; where the project's settings build every branch and no build came, the wait's screen opens the GitHub page where Cloudflare's app gets access to the repository instead, and waits again. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
@@ -2473,7 +2662,7 @@ export function createTools(ctx) {
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
                 return 'Invalid input: give pull or branch, not both.';
-            const refused = appRefusal(p.appKey, 'read');
+            const refused = appRefusal(p.appKey, 'read') ?? lockRefusal(p.appKey, 'read');
             if (refused)
                 return refused;
             // On a repository with several apps, only the Pages project that builds the app's folder (#281): told by the plain read, which a wait for a build keeps to.
@@ -2501,8 +2690,10 @@ export function createTools(ctx) {
             const evidence = subject ? { ...waited, ...(app ? { githubApp: app } : {}) } : waited;
             if (!subject)
                 cloudflareEvidence = evidence;
-            if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project)
+            if (!subject && appKey !== undefined && !evidence.unmatched && evidence.project) {
                 cloudflareApps.set(appKey, { project: evidence.project, label: (evidence.production && pagesProject(evidence.production)) || evidence.project });
+                noteApp(appKey, { host_project: evidence.project });
+            }
             for (const origin of cloudflareListed)
                 listedApps.delete(origin);
             cloudflareListed.clear();
@@ -2555,7 +2746,15 @@ export function createTools(ctx) {
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
             if (proof.proven && app)
-                provenApps.add(app.appKey);
+                proveApp(app.appKey, url);
+            if (proof.proven && app)
+                lockPending.delete(app.appKey);
+            // The lock in front of an app's preview is that app's own: its key tool is the next call for it, and every other app's steps wait for that (#286). An earlier proof of the app (another preview, or one the key opened before) says nothing about this lock: the app is proven again only once something opens it.
+            if (app && proof.gate && Object.hasOwn(LOCKS, proof.gate)) {
+                lockMet.set(app.appKey, proof.gate);
+                lockPending.set(app.appKey, proof.gate);
+                provenApps.delete(app.appKey);
+            }
             if (proof.proven && proof.pattern)
                 provenPattern = proof.pattern;
             if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
@@ -2694,6 +2893,8 @@ export function createTools(ctx) {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
             const at = gated;
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             const { origin, host } = new URL(at.url);
             // Where the setup API keeps the secret: the app's own on a repository with several apps, else the repository's.
             const store = at.app?.appKey ?? '';
@@ -2727,7 +2928,7 @@ export function createTools(ctx) {
                 hostedPreviewProven = true;
                 provenHost = 'Vercel';
                 if (at.app)
-                    provenApps.add(at.app.appKey);
+                    proveApp(at.app.appKey, at.url);
             };
             // A secret in hand already for the same store and project: another address of the project opens with it.
             const held = bypassHeld.get(store);
@@ -2743,13 +2944,15 @@ export function createTools(ctx) {
                 // A project the folder is not linked to is named on the CLI's reads and makes; the reads are held to its id all the same.
                 ...(at.app?.name ? { project: at.app.name } : {}),
                 consent: async () => !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
-                paste: async () => {
-                    // The project's own settings page, in its team where the run knows it; else Vercel's picker.
-                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), project.name));
-                    const answer = await ask(sentTo(HOST_SCREENS['vercel-bypass-key'], at.url));
+                paste: async (stopped) => {
+                    // This project's own settings page, under its own team (the one its ids name, as the CLI lists the person's teams): never another project of the account's.
+                    (ctx.openBrowser ?? openBrowser)(await vercelPageFor(vercel, link, 'settings/deployment-protection', project.name));
+                    const answer = await ask(sentTo(vercelBypassPaste(stopped), at.url));
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
-                prove: (secret) => provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret }),
+                ...(ctx.hostWait?.bypass ? { wait: ctx.hostWait.bypass } : {}),
+                ...(signal ? { signal } : {}),
+                prove: async (secret) => sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret })),
                 save: async (secret) => {
                     const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret, at.app?.appKey);
                     stored = saved.stored;
@@ -2781,10 +2984,12 @@ export function createTools(ctx) {
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
             const at = gated;
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
             let pattern;
             const prove = async (password, form = false) => {
-                const proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password, form });
+                const proof = sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password, form }));
                 if (proof.proven && proof.pattern)
                     pattern = proof.pattern;
                 return proof;
@@ -2795,7 +3000,7 @@ export function createTools(ctx) {
                 if ((await prove(undefined)).proven) {
                     provenPattern = pattern ?? provenPattern;
                     if (at.app)
-                        provenApps.add(at.app.appKey);
+                        proveApp(at.app.appKey, at.url);
                     return JSON.stringify(stands);
                 }
                 passwordStands.delete(site);
@@ -2806,7 +3011,7 @@ export function createTools(ctx) {
             if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
                 provenPattern = pattern ?? provenPattern;
                 if (at.app)
-                    provenApps.add(at.app.appKey);
+                    proveApp(at.app.appKey, at.url);
                 return JSON.stringify(passwordSaved);
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
@@ -2854,7 +3059,7 @@ export function createTools(ctx) {
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
                 if (at.app)
-                    provenApps.add(at.app.appKey);
+                    proveApp(at.app.appKey, at.url);
                 provenPattern = pattern ?? provenPattern;
             }
             if (value) {
@@ -2865,7 +3070,7 @@ export function createTools(ctx) {
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
                 if (at.app)
-                    provenApps.add(at.app.appKey);
+                    proveApp(at.app.appKey, at.url);
                 provenPattern = pattern ?? provenPattern;
                 passwordSaved = passwordOutcome;
             }
@@ -2880,16 +3085,20 @@ export function createTools(ctx) {
         tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
+            const at = accessGated;
+            // The call for this app is made, whatever it answers: the skip asked once stands for the next app's lock too.
+            if (at.app)
+                lockPending.delete(at.app.appKey);
             if (accessOutcome?.status === 'skipped')
                 return JSON.stringify(accessOutcome);
-            const at = accessGated;
             let proof;
-            const prove = async (token) => (proof = await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token }));
+            const prove = async (token) => (proof = sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, access: token })));
             const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
             const save = async (token) => {
                 const app = at.app ? { appKey: at.app.appKey } : {};
                 if (!(await call(pi, `${base}/preview-auth/access`, { method: 'PUT', body: { clientId: token.id, clientSecret: token.secret, ...app } })).ok)
                     return 'The setup API did not store the service token.';
+                noteApp(at.app?.appKey, { key_placed: true });
                 // An app that signs in with Access sends this token already: the setting would make it a second credential, which the setup API refuses.
                 const repos = object((await call(pi, `${ctx.setupApi}/state`)).data)?.repos;
                 const lock = Array.isArray(repos) ? object(object(repos.map(object).find((r) => r?.name === ctx.repo)?.items)?.['preview-protection']) : undefined;
@@ -2897,6 +3106,7 @@ export function createTools(ctx) {
                     return null;
                 if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'access', ...app } })).ok)
                     return 'The setup API stored the service token, but not the setting that sends it: it is turned on under Preview protection on the setup page.';
+                noteApp(at.app?.appKey, { method_saved: true });
                 return null;
             };
             let answer;
@@ -2947,7 +3157,7 @@ export function createTools(ctx) {
                 hostedPreviewProven = true;
                 provenHost = 'Cloudflare Pages';
                 if (at.app)
-                    provenApps.add(at.app.appKey);
+                    proveApp(at.app.appKey, at.url);
                 if (pattern)
                     provenPattern = pattern;
             }