@impeccable/reviews 0.1.9 → 0.1.11

package/README.md

@@ -52,7 +52,7 @@ The sign-in's setup token lasts an hour. A run that goes longer asks you to sign
 
 The agent's commands run in an operating-system sandbox, macOS's seatbelt or Linux's bubblewrap, through Anthropic's sandbox runtime (`@anthropic-ai/sandbox-runtime`), which holds even when the repository talks the agent into something:
 
-- **Reads**: what your account reads, but your credential folders: `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.azure`, `~/.config/gcloud`, `~/.kube`, `~/.docker`, `~/.netrc`, `~/.git-credentials`, `~/.config/gh`, and your keychains on macOS; the Vercel, Netlify and Cloudflare CLIs' sign-ins (`~/Library/Application Support/com.vercel.cli`, `~/Library/Preferences/netlify` and `~/Library/Preferences/.wrangler` on macOS, `~/.local/share/com.vercel.cli`, `~/.config/netlify` and `~/.config/.wrangler` elsewhere, and `~/.vercel`, `~/.netlify` and `~/.wrangler`); the registries' and build tools' tokens (`~/.yarnrc.yml`, `~/.pypirc`, `~/.cargo/credentials`, `~/.gem/credentials`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`, `~/.terraform.d`); Codex's and Claude's (`~/.codex`, `~/.claude`); your git's global settings (`~/.gitconfig`, `~/.config/git/config` and every file they include, whether the include holds for this checkout or not) and `~/.config/git/credentials`; your shells' rc files (`~/.bashrc`, `~/.bash_profile`, `~/.profile`, `~/.zshenv`, `~/.zshrc`, `~/.zprofile` and the rest, and fish's `~/.config/fish`) and their histories; and your browsers' profiles (Chrome's, Chromium's, Brave's, Edge's and Firefox's, and `~/Library/Cookies` on macOS). Where your environment moves one of these, the sandbox denies the place it names instead: the folder `GH_CONFIG_DIR`, `VERCEL_AUTH_CONFIG_DIR`, `GNUPGHOME`, `DOCKER_CONFIG`, `CLOUDSDK_CONFIG`, `AZURE_CONFIG_DIR`, `CODEX_HOME` or `CLAUDE_CONFIG_DIR` names, the files `KUBECONFIG`, `GIT_CONFIG_GLOBAL` and `HISTFILE` name, cargo's credentials under `CARGO_HOME`, zsh's rc files under `ZDOTDIR`, and the same entries under `XDG_CONFIG_HOME` and `XDG_DATA_HOME` as under `~/.config` and `~/.local/share`; the variables themselves stay, since `gh`, the host CLIs and the package managers read them. Git in the sandbox reads a copy of your global settings instead of the file: your name and email, what shapes how git reads the checkout (line endings, case, excludes, attributes, LFS's content filter) and `safe.directory`, and none of http's headers, proxy, cookies and certificates, url rewrites, credential helpers, includes, aliases or programs; another content filter's command is left out, since it could carry a password, and when that filter is required, git in the sandbox refuses the file it would have changed rather than stage it unfiltered. Your `~/.npmrc` stays readable: the sandbox's hosts come from the registries it names, and npm needs its token to install from them.
+- **Reads**: what your account reads, but your credential folders: `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.azure`, `~/.config/gcloud`, `~/.kube`, `~/.docker`, `~/.netrc`, `~/.git-credentials`, `~/.config/gh`, and your keychains on macOS; the Vercel, Netlify and Cloudflare CLIs' sign-ins (`~/Library/Application Support/com.vercel.cli`, `~/Library/Preferences/netlify` and `~/Library/Preferences/.wrangler` on macOS, `~/.local/share/com.vercel.cli`, `~/.config/netlify` and `~/.config/.wrangler` elsewhere, and `~/.vercel`, `~/.netlify` and `~/.wrangler`); the registries' and build tools' tokens (`~/.yarnrc.yml`, `~/.pypirc`, `~/.cargo/credentials`, `~/.gem/credentials`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`, `~/.terraform.d`); Codex's and Claude's (`~/.codex`, `~/.claude`); your git's global settings (`~/.gitconfig`, `~/.config/git/config` and every file they include, whether the include holds for this checkout or not) and `~/.config/git/credentials`; your shells' rc files (`~/.bashrc`, `~/.bash_profile`, `~/.profile`, `~/.zshenv`, `~/.zshrc`, `~/.zprofile` and the rest, and fish's `~/.config/fish`) and their histories; and your browsers' profiles (Chrome's, Chromium's, Brave's, Edge's and Firefox's, and `~/Library/Cookies` on macOS). Where your environment moves one of these, the sandbox denies the place it names instead: the folder `GH_CONFIG_DIR`, `VERCEL_AUTH_CONFIG_DIR`, `GNUPGHOME`, `DOCKER_CONFIG`, `CLOUDSDK_CONFIG`, `AZURE_CONFIG_DIR`, `CODEX_HOME` or `CLAUDE_CONFIG_DIR` names, the files `KUBECONFIG`, `GIT_CONFIG_GLOBAL` and `HISTFILE` name, cargo's credentials under `CARGO_HOME`, zsh's rc files under `ZDOTDIR`, and the same entries under `XDG_CONFIG_HOME` and `XDG_DATA_HOME` as under `~/.config` and `~/.local/share`; the variables themselves stay, since `gh`, the host CLIs and the package managers read them. Git in the sandbox reads a copy of your global settings instead of the file: your name and email, what shapes how git reads the checkout (line endings, case, excludes, attributes, LFS's content filter) and `safe.directory`, and none of http's headers, proxy, cookies and certificates, url rewrites, credential helpers, includes, aliases or programs; another content filter's command is left out, since it could carry a password, and when that filter is required, git in the sandbox refuses the file it would have changed rather than stage it unfiltered. Git's system settings are scrubbed into the same copy and otherwise turned off for it (`GIT_CONFIG_NOSYSTEM`): on a Mac, Apple's git carries a config inside Xcode and the Command Line Tools that names the keychain's credential helper, and git in the sandbox is to have no credential helper at all, so that it asks for no sign-in rather than fail in one; the helper programs that config names (`git-credential-osxkeychain`, in Xcode and in the Command Line Tools) are denied too, so a script that puts the variable back cannot run them, and your keychain itself stays denied, to the helper and to `security` alike. Your `~/.npmrc` stays readable: the sandbox's hosts come from the registries it names, and npm needs its token to install from them.
 - **Writes**: the checkout and its git folder, but never where git takes settings or programs from (its config, hooks, `info`, a `commondir`, the submodules' and the other worktrees' git folders, a `.git` below the checkout's top; on Linux a `commondir` and a nested `.git` are removed at the end of the run instead, as the last paragraph of this section says); the run's scratch folder, where npm's cache and Corepack's package managers go for the run; and the package managers' own caches and stores (pnpm's store, Yarn's and Bun's caches, Prisma's engines), but never `~/.npm`, which your own npm and `npx` read from, nor pnpm's metadata cache, whose `dlx` folder your next `pnpm dlx` runs from (pnpm reads it and goes on without writing it), and of pnpm's home folder only its store, never the global commands it keeps on your PATH. Those stores and caches a sandboxed install could not make itself (pnpm's store on a machine where pnpm never ran, all of them on Linux) are made before the run starts, readable by you alone, and in pnpm's home nothing else is. A sandboxed pnpm is told to use that store, yours, so it never makes one of its own in the checkout, and to copy what it installs from it rather than hard-link it, so a write to an installed file changes only that copy. An install skips the browsers Cypress, Puppeteer and Playwright download, and husky's git hooks.
 - **Network**: only the hosts this setup needs: `--host`; GitHub's hosts an install fetches from (`github.com`, `api.github.com`, `codeload.github.com`, `*.githubusercontent.com`); the public registries your manifests and lockfiles install from (npm's, Yarn's, PyPI); the registries your own `~/.npmrc` names, never one only the repository names; Google's fonts for a Next.js app and Prisma's engines, when the app uses them; and Vercel's or Netlify's API once you said yes to setting that host up; never GitHub over SSH (port 22), which is refused with the reason, since what pushes runs outside the sandbox, as you. The debug log names each host it refused. The list limits where a command's traffic goes, not what it carries (a script can still send what it reads to GitHub or npm over HTTPS, which the sandbox's proxy passes through without reading), so what keeps your sign-ins yours is what the sandbox does not let it read.
 
@@ -62,7 +62,7 @@ The command stops when the sandbox does not start: on macOS inside another tool'
 
 The fence stays the layer inside the sandbox: it keeps the setup to its own steps and out of `.env` files, and the agent's commands get your environment without the tokens, keys and passwords in it, whether their names say so or their values are shaped like a secret (a GitHub token, a private key, a service account's key, a password in a URL), and what runs as you (`git commit` and `push`, `gh`, the host CLIs) gets it without `GH_REPO` and `GH_HOST`, so `gh` works on this checkout's repository on github.com, whatever repository or host they name. The agent's own file tools (read, write, edit, grep, find and ls) open files in the command's process, as you, so for them the fence judges the path pi opens, not the string the agent typed: spelled the way pi spells it (a curly apostrophe for a straight one, among others) and with its symlinks followed, and a path that starts with `@` or `~` or a URL scheme, which pi would open elsewhere, is refused outright; read, write, edit, grep and ls judge each file once more as they open it (ls each entry too, so a symlink out of the checkout is not listed), find judges the folder it searches before fd walks it and every path fd reports after, and a symlinked folder out of the checkout is neither followed nor listed; the names of `.env` files are listed, as `ls -a` shows them, and only a read of one is refused; a grep glob that names `.env` files is refused, and no line of a `.env` file is in what grep reports, whatever glob it was given. It also reads what goes past it: text shaped like a secret (a cloud, GitHub, Google or SendGrid key, a private key, a token, a Slack webhook's address, a password in an address or on a curl command line) in a file the agent writes, a setting, a commit, a pull request or a message to you is refused, read as written and as the screen would show it once an escape sequence is taken out, a command that names a credential file (`~/.ssh`, `.aws/credentials`, `.netrc`, `.env`) is refused, and what the agent reads gets a line saying it is data when it carries text shaped like instructions; the debug log and `--scan-report` list each match. A commit message, a template and a pull request body come inline (`-m`, `--body`), never from a file: the file the fence read is not surely the file git or gh, outside the sandbox, read later, since a command still running in the sandbox can swap it in between. For the same reason the messages of the commits a push carries are read again as the push runs, all of them (past what the remote has: its branch of that name, the default branch, and one the pushed branch is stacked on, such as an earlier run's setup branch under a new test drive), and so is every line they add to a `.env` file's example, which a command may have written, with the same check as a file the agent writes; a push whose commits cannot be read whole is refused, as is one whose remote cannot be reached, since what it carries cannot be checked then (the push can be tried again once the network is back; the remote is asked with no prompt for a password or a passphrase, which would hold it), and one in the same command as the `git commit` or `git checkout -b` that makes what it carries, which is not there yet when it is read: the push runs as a command of its own, after the commit. A commit carries only files the agent wrote, or named in a `git add`: a file a script staged on its own is refused by name, and `git restore --staged` takes it out; a push whose new commits carry such a file (a script can commit on its own, past the index) is refused the same way. Once `impeccable_sync_workflow` wrote the preview workflow, or removed the retired one, a commit carries that file only as the tool left it: the setup state's bytes, or no file. A status line the agent starts a message with shows in the terminal and on the web page only when its progress tool would take it: in the product voice, short, and holding nothing shaped like a secret.
 
-Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
+Without asking: `git status|diff|log|show|add|restore --staged|commit|checkout -b|push -u origin <branch>`, `git branch` and `git remote` in their listing forms, `git ls-remote origin` (in the sandbox, over https, and never held on a prompt for a sign-in), `gh pr create`, `gh pr view` for a pull request of this repository, named with `--repo`, by number or by this run's branch name (with `--json` or `--comments`, never `--web`) and `gh pr ready` for the test drive's branch by name (a Netlify draft, marked ready once its preview is proven), `npm|pnpm|yarn|bun install|ci`, the scripts of the package.json where the command runs (`npm run`, `pnpm run`, `bun run`, `yarn <script>`), `npx`, `pnpm exec`, `yarn` and `bunx` for `tsc`, `eslint`, `prettier`, `next`, `vite`, `astro`, `nuxt`, `prisma`, `playwright`, `drizzle-kit`, `sequelize` and `knex`, and `ls`, `cat`, `head`, `grep` and `find` inside the checkout (by relative or absolute path) and the run's scratch folder. A package manager or tool runner may have `KEY=value` settings in front; any of these may start with a `cd` into a folder of the checkout and be chained with `&&`, `||`, `;` or `|` to others on the list.
 
 `vercel whoami` and `vercel --version`. Once you said yes to the Vercel setup: `vercel link --yes` in the checkout's root alone (never in a folder of it, whose name would pick one of your projects), `vercel project add` and `vercel deploy` for a preview, on the project named after the folder and in the one team the sign-in settled on (the CLI's current scope, your only team, or the one you pick when it asks): no other `--scope`, `--team` or `--project`, never `vercel project ls`, which names your projects, and a global install of the Vercel CLI itself when it is missing, with npm and pinned to the version this release names (`npm install -g vercel@<version>`; another package manager, version or tag is refused). The sign-in (`vercel login`) and the repository's connection (`vercel git connect`, for a project the run created or one connected to the repository already) are the run's own tools, never the agent's commands. Never a production deploy, a project's removal, its environment variables or protection settings (`vercel project protection`, `api` and `curl` print a project's bypass secrets, so the agent's shell never runs them; the lock before a new project's first deployment and the bypass secret are the run's own tools), or a token on the command line.
 
@@ -88,7 +88,7 @@ A test account's password, typed hidden on the account's screen (after a screen
 
 What you type into any other question the agent asks, it reads. So a question whose title, prompt or hint names a token, a password, a secret, a key or a credential is typed hidden however the agent asked it, and the agent gets a reference, as for a test account's password. Every other question with a field says under it "Never enter a password, a token or a key here."
 
-Vercel's bypass secret, which lets reviews open previews behind Vercel's login, is handled the same way. The secret goes only to a preview the linked project serves: before anything is sent, the command reads the project this folder is linked to (`.vercel/project.json`, whose ids it takes only in Vercel's own form; once the run's own `vercel link` wrote that file, only what it wrote counts) through the Vercel CLI as you, and refuses, saying so, unless Vercel shows that project connected to this repository, with Deployment Protection in its settings, and the preview's deployment as the project's own (among its latest, or read on its own by its address), since a deployment GitHub lists can name any address and its page proves nothing about whose it is, or whether the login on it is Vercel's: a deployment can serve a page shaped like Vercel's login, and only your project's settings say whether Vercel's stands there. The same read decides which project the setup locks before its first deployment. When Vercel's login stands in front of a preview of that project, the command asks you once, on one screen that names the preview's address, whether to create a bypass secret for Impeccable, and on your yes creates it as you through the Vercel CLI, labelled "Impeccable reviews" (`vercel api` for Vercel's protection-bypass route; an older CLI's `vercel project protection enable --protection-bypass`), then reads it back from the project's settings. A project that already holds a secret with that label gives it without a question. When your role cannot read or make one, a screen names the settings page and the preview's address, and takes the secret you type, hidden; a folder that is not linked, or a CLI that is signed out, gets no such screen, since nothing then shows the preview to be yours. It opens the preview with the secret first and saves it, with the setting that sends it in the `x-vercel-protection-bypass` header, only once the page shows your app. The agent never holds it: the secret goes from the command's own process to Vercel and to Impeccable's setting, and the debug log and the transcript remove it. Vercel documents this as Protection Bypass for Automation, which every plan includes; you revoke it in the project's Settings, Deployment Protection.
+Vercel's bypass secret, which lets reviews open previews behind Vercel's login, is handled the same way. The secret goes only to a preview the linked project serves: before anything is sent, the command reads the project this folder is linked to (`.vercel/project.json`, whose ids it takes only in Vercel's own form; once the run's own `vercel link` wrote that file, only what it wrote counts) through the Vercel CLI as you, and refuses, saying so, unless Vercel shows that project connected to this repository, with Deployment Protection in its settings, and the preview's deployment as the project's own (among its latest, or read on its own by its address), since a deployment GitHub lists can name any address and its page proves nothing about whose it is, or whether the login on it is Vercel's: a deployment can serve a page shaped like Vercel's login, and only your project's settings say whether Vercel's stands there. The same read decides which project the setup locks before its first deployment. When Vercel's login stands in front of a preview of that project, the command asks you once, on one screen that names the preview's address, whether to create a bypass secret for Impeccable, and on your yes creates it as you through the Vercel CLI, labelled "Impeccable reviews" (`vercel api` for Vercel's protection-bypass route; an older CLI's `vercel project protection enable --protection-bypass`), then reads it back from the project's settings and opens the preview with it, trying again for up to 30 seconds while Vercel's edge still answers with its login, since a secret made moments ago can take a few seconds to be honoured. A project that already holds a secret with that label gives it without a question. When that does not end with a secret that opens the preview, a screen says what stopped it in Vercel's own words (the CLI could not read the project; Vercel refused the make, which takes the Member role or Project Administrator; the secret was made but not read back, or did not open the preview, in which case the screen says to copy it rather than make another), opens that project's own Deployment Protection settings in your browser, under the team the project belongs to, names the preview's address, and takes the secret you type, hidden; a folder that is not linked, or a CLI that is signed out, gets no such screen, since nothing then shows the preview to be yours. It opens the preview with the secret first and saves it, with the setting that sends it in the `x-vercel-protection-bypass` header, only once the page shows your app. The agent never holds it: the secret goes from the command's own process to Vercel and to Impeccable's setting, and the debug log and the transcript remove it. Vercel documents this as Protection Bypass for Automation, which every plan includes; you revoke it in the project's Settings, Deployment Protection.
 
 Netlify's site password (Password Protection on Pro and Enterprise plans; "Project visibility: Password" on a credit-based Pro plan) is handled the same way. When a Netlify deploy preview asks for it, the command reads the site's settings through the Netlify CLI, signed in as you, and that read is what shows the site to be yours: a site the CLI cannot read as you (it is signed out, or the site is in none of your teams) gets no password, and the command refuses, saying so, since the lock at a listed address may be anyone's. For a password Netlify gives back, it asks you once, on one screen that names the preview's address, whether to store the site password for Impeccable, and on your yes reads it from the site as you. When Netlify does not give the password back, a screen names the address and takes the password you type, hidden (the run never sets one itself: the Netlify CLI takes a new password only on its command line, where any process could read it). It opens the preview with the password first, as basic credentials in the `Authorization` header (Netlify's password page asks for a password alone, so the credentials carry no username), and saves it, with the setting that sends that header, only once the page shows your app; a password that opens the preview on Netlify's own form but not in the header is reported, not saved, since reviews can send only a header. A site behind Netlify's team login (a private site) has no way in for tools, so the command asks you once, on one screen, whether to make the site public, and on your yes makes it public as you through the Netlify CLI (`netlify api updateSite` with `sso_login` off); anyone with its address can then open it, the live site included, until you make it private again in Project configuration, General, Visitor access. Where Netlify refuses (your team's default keeps every project private, or your role cannot change it), the command opens that page in your browser and asks you to try again once you changed it there; a password you set there instead is stored as above. The agent never holds the password: it goes from the command's own process to Netlify and to Impeccable's setting, and the debug log and the transcript remove it.
 

package/dist/fence.js

@@ -6,7 +6,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { createFindToolDefinition, createGrepToolDefinition, detectSupportedImageMimeTypeFromFile } from '@earendil-works/pi-coding-agent';
 import { linkedNetlifySite } from './netlify.js';
 import { resolveReadPath, resolveToCwd } from './pi-paths.js';
-import { gitEnvironment } from './sandbox.js';
+import { gitEnvironment, NO_PROMPT } from './sandbox.js';
 import { DATA_NOTE, scan, scanRecorder } from './scan.js';
 import { plainText } from './ui/sensitive.js';
 const allow = (reason = 'on the allowlist') => ({ verdict: 'allow', reason });
@@ -336,6 +336,35 @@ function printsPatch(sub, args) {
     const revisions = options.filter((a) => !a.startsWith('-'));
     return !(sub === 'show' && revisions.length && revisions.every((a) => a.includes(':')));
 }
+/** git branch's listing flags, alone or in a cluster (-avv): -a, -r, -l, -v and -i. */
+const BRANCH_FLAGS = /^-[arlvi]+$/;
+const BRANCH_LONG_FLAGS = new Set(['--all', '--remotes', '--list', '--verbose', '--show-current', '--ignore-case', '--no-color', '--column', '--no-column', '--no-abbrev', '--omit-empty', '--contains', '--no-contains', '--merged', '--no-merged']);
+/** Its options that take a value, with it after `=`: a bare `--contains HEAD` reads HEAD as its value, but a bare `--format %(refname)` would make a branch named %(refname). */
+const BRANCH_VALUES = /^--(?:contains|no-contains|merged|no-merged|points-at|sort|format|color|abbrev)=/;
+/** Whether `git branch` with these words only lists branches: a word that is no option names a pattern, which only --list takes (without it git makes a branch of that name); -d, -m, -c, -u, --set-upstream-to and --edit-description, among others, are not listing. */
+function listsBranches(args) {
+    const options = args.filter((a) => a.startsWith('-'));
+    const patterns = args.length - options.length;
+    if (!options.every((a) => BRANCH_FLAGS.test(a) || BRANCH_LONG_FLAGS.has(a) || BRANCH_VALUES.test(a)))
+        return false;
+    return patterns === 0 || options.some((a) => a === '--list' || (BRANCH_FLAGS.test(a) && a.includes('l')));
+}
+/** Whether `git remote` with these words only lists: no words, -v, or get-url (with --push or --all) of one remote by name. Every other verb writes the config or fetches, and show without -n asks the remote. */
+function listsRemotes(args) {
+    if (!args.length || (args.length === 1 && (args[0] === '-v' || args[0] === '--verbose')))
+        return true;
+    const [verb, ...rest] = args;
+    return verb === 'get-url' && rest.filter((a) => a.startsWith('-')).every((a) => a === '--push' || a === '--all') && rest.filter((a) => !a.startsWith('-')).length === 1;
+}
+/** git ls-remote's listing options, alone or in a cluster (-ht). */
+const LS_REMOTE_FLAGS = /^-[hbtq]+$/;
+const LS_REMOTE_LONG = new Set(['--heads', '--branches', '--tags', '--refs', '--symref', '--quiet', '--exit-code', '--get-url']);
+/** Whether `git ls-remote` with these words asks origin, named, and only lists: the first word that is no option is the repository, so a pattern comes after `origin`, and with none git asks the current branch's own remote, whichever that is; a URL, another remote, --upload-pack (a program) and -o (sent to the server) are not listing. */
+function listsOrigin(args) {
+    const options = args.filter((a) => a.startsWith('-'));
+    const words = args.filter((a) => !a.startsWith('-'));
+    return options.every((a) => LS_REMOTE_FLAGS.test(a) || LS_REMOTE_LONG.has(a) || a.startsWith('--sort=')) && words[0] === 'origin';
+}
 /** The branch a push's refspec updates on the remote: its destination, else its source, without `+` and `refs/heads/` (or `heads/`, which git reads the same). */
 const pushedBranch = (refspec) => refspec.replace(/^\+/, '').split(':').pop().replace(/^(?:refs\/)?heads\//, '');
 const isFile = (path) => {
@@ -440,6 +469,12 @@ function git(args, where, protectedBranches, held = false) {
     }
     if (sub === 'checkout' && rest[0] === '-b' && rest.length >= 2 && rest.length <= 3)
         return allow();
+    if (sub === 'branch')
+        return listsBranches(rest) ? allow() : deny('git branch lists only: -a, -r, -v, --show-current, --list <pattern>, and --contains, --merged, --points-at, --sort and --format with their value after =; git checkout -b makes a branch');
+    if (sub === 'remote')
+        return listsRemotes(rest) ? allow() : deny('git remote lists only: on its own, -v, or get-url <name>; nothing that adds, removes, renames, points or prunes a remote, and no show, which asks the remote');
+    if (sub === 'ls-remote')
+        return listsOrigin(rest) ? allow() : deny('git ls-remote asks origin only, named: git ls-remote --heads origin, with --tags, --refs, --symref, --get-url and patterns after origin; no other remote, no URL, no --upload-pack, and not without origin, which asks the current branch\'s own remote');
     if (sub === 'push' && rest.length === 3 && (rest[0] === '-u' || rest[0] === '--set-upstream') && rest[1] === 'origin') {
         const branch = rest[2];
         if (branch.includes(':') || ['HEAD', '@'].includes(pushedBranch(branch)) || protectedBranches.includes(pushedBranch(branch)))
@@ -909,7 +944,7 @@ function newMessages(head, bases, cwd) {
  */
 function unprompted(cwd) {
     const ownSsh = process.env.GIT_SSH_COMMAND || process.env.GIT_SSH || gitRead(['config', '--get', 'core.sshCommand'], cwd);
-    return { GIT_TERMINAL_PROMPT: '0', GCM_INTERACTIVE: 'never', GIT_ASKPASS: '', SSH_ASKPASS_REQUIRE: 'never', ...(ownSsh ? {} : { GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }) };
+    return { ...NO_PROMPT, ...(ownSsh ? {} : { GIT_SSH_COMMAND: 'ssh -o BatchMode=yes' }) };
 }
 /**
  * What a `push -u origin <branch>` adds to, asked of the remote itself: the commits it has on that branch and on the default

package/dist/host-questions.js

@@ -138,7 +138,7 @@ export const HOST_SCREENS = {
         id: 'vercel-bypass',
         kind: 'confirm',
         title: 'Your Vercel previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Vercel keeps yours behind a login. Vercel\'s way in for tools is a bypass secret made for one tool: the run creates one in your project, named "Impeccable reviews". It is stored encrypted, used only to open previews, and you can revoke it any time in Settings → Deployment Protection.',
+        hint: 'Impeccable reviews each pull request on its preview,\nand Vercel keeps yours behind a login.\n\nVercel\'s way in for a tool like Impeccable is via a bypass secret. It is stored encrypted, used only to open previews and you can revoke it any time.',
         prompt: 'Create the secret for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -148,7 +148,7 @@ export const HOST_SCREENS = {
         kind: 'text',
         sensitive: true,
         title: 'Your Vercel previews are protected',
-        prompt: 'Vercel keeps your previews behind a login, and the Vercel CLI here could not make a bypass secret for them: that takes the Member role, or Project Administrator. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
+        prompt: 'Vercel keeps your previews behind a login, and the run did not get a bypass secret in place for them. Make one yourself: your project → Settings → Deployment Protection → Protection Bypass for Automation → Create, named "Impeccable reviews". It is stored encrypted and used only to open previews.',
         hint: 'Paste the secret',
     },
     // Netlify's site password in front of the previews: the one consent to storing the password the run reads from the site as the person, and the paste when it cannot read it.
@@ -156,7 +156,7 @@ export const HOST_SCREENS = {
         id: 'netlify-password',
         kind: 'confirm',
         title: 'Your Netlify previews are protected',
-        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps yours behind the site password. The run reads that password from your site as you and stores it encrypted, used only to open previews. Change it any time in ${NETLIFY_PASSWORD_WHERE}.`,
+        hint: `Impeccable reviews each pull request on its preview, and Netlify keeps yours behind the site password.\n\nThe run reads that password from your site as you and stores it encrypted, used only to open previews. Change it any time in ${NETLIFY_PASSWORD_WHERE}.`,
         prompt: 'Store the site password for Impeccable?',
         confirmLabel: 'Store',
         skipLabel: 'Skip',
@@ -193,7 +193,7 @@ export const HOST_SCREENS = {
         id: 'cloudflare-access',
         kind: 'confirm',
         title: 'Your Cloudflare previews are protected',
-        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login. Cloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
+        hint: 'Impeccable reviews each pull request on its preview, and Cloudflare Access keeps yours behind a login.\n\nCloudflare\'s way in for tools is a service token made for one tool: with your Cloudflare sign-in, the run creates one named "Impeccable reviews" and allows it in your Access application\'s policy. It is stored encrypted, used only to open previews, and you can revoke it any time in Zero Trust → Access controls → Service credentials.',
         prompt: 'Create the token for Impeccable?',
         confirmLabel: 'Create',
         skipLabel: 'Skip',
@@ -216,13 +216,27 @@ export const HOST_SCREENS = {
     },
 };
 /**
- * A key's screen naming the one address the key goes to: the consent to a bypass secret, a site password or a service
- * token is to that address, which the key opens before anything saves it. A confirm says so in its supporting text; a
- * text or account screen, under its prompt.
+ * A key's paste screen naming the one address the key goes to, which the key opens before anything saves it: a text
+ * or account screen says so under its prompt. A confirm screen's consent to a bypass secret, a site password or a
+ * service token no longer names the address, so it comes back as it is.
  */
 export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
-    return screen.kind === 'confirm' ? { ...screen, hint: `${screen.hint} ${line}` } : { ...screen, prompt: `${screen.prompt} ${line}` };
+    return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
+}
+/**
+ * The paste screen for Vercel's bypass secret, saying what actually stopped the run's own way (the CLI's read, Vercel's
+ * refusal in its own words, a secret made but not read back, or one that did not open the preview) rather than one fixed
+ * cause: a project that holds a secret labelled for Impeccable already is one to copy from, not to make another on.
+ */
+export function vercelBypassPaste(stopped) {
+    const where = 'your project → Settings → Deployment Protection → Protection Bypass for Automation';
+    const next = stopped.held === 'labelled'
+        ? `Copy the secret named "Impeccable reviews" from ${where} and paste it here, or create another one there with that name.`
+        : stopped.held === 'unlabelled'
+            ? `Copy the secret the run just made (the newest one there, with no note) from ${where} and paste it here, or create another one there, named "Impeccable reviews".`
+            : `Make one yourself: ${where} → Create, named "Impeccable reviews".`;
+    return { ...HOST_SCREENS['vercel-bypass-key'], prompt: `Vercel keeps your previews behind a login. ${stopped.reason} ${next} It is stored encrypted and used only to open previews.` };
 }
 /** The apps question on a repository with several apps, worded here: the tool lists the apps the state has, each picked as it is on, so every run asks it the same way. */
 export const APPS_QUESTION = {

package/dist/playbook/github-previews.js

@@ -0,0 +1,101 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const LIMIT = 20;
+const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
+const FAILURE = 'GitHub preview evidence could not be read completely.';
+const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function positiveInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+function sha(value) {
+    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
+}
+function previewUrl(value) {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
+export async function readHostedPreviews(owner, repo, dependencies = {}) {
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+    const runGh = dependencies.runGh ?? (async (args) => {
+        const { stdout } = await execFileAsync('gh', args, {
+            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
+        });
+        return stdout;
+    });
+    const base = `/repos/${owner}/${repo}`;
+    async function get(route) {
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
+        if (dependencies.signal?.aborted)
+            throw new Error(FAILURE);
+        const data = JSON.parse(stdout);
+        if (!Array.isArray(data))
+            throw new Error(FAILURE);
+        return data.slice(0, LIMIT);
+    }
+    try {
+        const [deployments, pulls] = await Promise.all([
+            get(`${base}/deployments?per_page=${LIMIT}`),
+            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
+        ]);
+        let incomplete = false;
+        const evidence = [];
+        for (const entry of deployments) {
+            if (dependencies.signal?.aborted) {
+                incomplete = true;
+                break;
+            }
+            const deployment = record(entry);
+            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
+                continue;
+            let latest;
+            try {
+                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
+            }
+            catch {
+                incomplete = true;
+                if (dependencies.signal?.aborted)
+                    break;
+            }
+            const status = STATES.find((state) => state === latest?.state) ?? null;
+            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
+                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
+            const pullRequests = [];
+            for (const item of pulls) {
+                const pull = record(item);
+                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
+                    && record(pull.head)?.sha === deployment.sha) {
+                    pullRequests.push({ number: pull.number, state: pull.state });
+                }
+            }
+            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
+                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
+        }
+        incomplete ||= dependencies.signal?.aborted ?? false;
+        return { coverage: COVERAGE, deployments: evidence,
+            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
+    }
+    catch {
+        return { coverage: COVERAGE, deployments: [], error: FAILURE };
+    }
+}

package/dist/playbook/netlify-pattern.js

@@ -0,0 +1,24 @@
+/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
+export function netlifyPatternError(body, observed) {
+    const pattern = body.previewUrlPattern;
+    if (typeof pattern !== 'string')
+        return null;
+    let netlify = /netlify\.app|<site>/i.test(pattern);
+    try {
+        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
+        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
+    }
+    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
+    if (!netlify)
+        return null;
+    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
+    if (!match || match[1].length > 63)
+        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
+    if (Object.hasOwn(body, 'appKey'))
+        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
+    if (body.intendedMethod !== 'preview-deploy')
+        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
+    if (!observed.has(pattern))
+        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
+    return null;
+}

package/dist/playbook/netlify-previews.js

@@ -0,0 +1,144 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const FAILURE = 'Netlify preview evidence could not be read completely.';
+const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
+const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
+const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
+const STATES = ['success', 'pending', 'failure', 'error'];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}
+function cleanUrl(value) {
+    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
+        return;
+    try {
+        const url = new URL(value);
+        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
+            return url;
+    }
+    catch { /* Discard unsafe evidence without returning it. */ }
+}
+function urls(pull, site) {
+    if (`deploy-preview-${pull.number}--${site}`.length > 63)
+        return;
+    return {
+        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
+        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
+    };
+}
+function validTarget(value, pull, site) {
+    if (value === null || value === undefined || value === '')
+        return true;
+    const target = cleanUrl(value);
+    if (!target)
+        return false;
+    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
+        return true;
+    return target.hostname === 'app.netlify.com'
+        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
+}
+/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
+export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
+    const previews = [];
+    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
+        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
+        return { coverage: COVERAGE, previews, error: FAILURE };
+    }
+    const runGh = dependencies.runGh ?? (async (args) => {
+        const { stdout } = await execFileAsync('gh', args, {
+            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
+        });
+        return stdout;
+    });
+    const base = `/repos/${owner}/${repo}`;
+    async function get(route, limit) {
+        if (dependencies.signal?.aborted)
+            throw new Error();
+        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
+        if (dependencies.signal?.aborted)
+            throw new Error();
+        const data = JSON.parse(raw);
+        if (!Array.isArray(data))
+            throw new Error();
+        return data.slice(0, limit);
+    }
+    const [pullRead, commentRead] = await Promise.allSettled([
+        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
+        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
+    ]);
+    if (pullRead.status === 'rejected')
+        return { coverage: COVERAGE, previews, error: FAILURE };
+    let incomplete = false;
+    const warnings = commentRead.status === 'rejected'
+        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
+    const pulls = new Map();
+    for (const item of pullRead.value) {
+        const pull = record(item);
+        const headSha = record(pull?.head)?.sha;
+        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
+            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
+            continue;
+        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
+        if (!pulls.has(issueUrl))
+            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
+    }
+    const seen = new Set();
+    const statusesBySha = new Map();
+    for (const pull of pulls.values()) {
+        if (dependencies.signal?.aborted) {
+            incomplete = true;
+            break;
+        }
+        try {
+            if (!statusesBySha.has(pull.headSha)) {
+                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
+            }
+            for (const item of await statusesBySha.get(pull.headSha)) {
+                const status = record(item);
+                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
+                if (!site || seen.has(`${pull.number}:${site}`))
+                    continue;
+                // GitHub returns newest first: even an invalid latest entry must hide older success.
+                seen.add(`${pull.number}:${site}`);
+                const state = STATES.find((state) => state === status?.state);
+                const canonical = urls(pull, site);
+                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
+                    continue;
+                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
+                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
+            }
+        }
+        catch {
+            incomplete = true;
+        }
+    }
+    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
+        for (const item of commentRead.value) {
+            const comment = record(item);
+            const author = record(comment?.user);
+            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
+            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
+                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
+                continue;
+            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
+                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
+                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
+                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
+                    continue;
+                const site = parts[2];
+                const canonical = urls(pull, site);
+                if (!canonical || seen.has(`${pull.number}:${site}`))
+                    continue;
+                seen.add(`${pull.number}:${site}`);
+                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
+                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
+            }
+        }
+    }
+    if (dependencies.signal?.aborted)
+        incomplete = true;
+    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
+}

package/dist/playbook/probe-preview.js

@@ -0,0 +1,67 @@
+function redirectGate(location, source) {
+    if (!location)
+        return 'redirected';
+    try {
+        const target = new URL(location, source);
+        if (target.protocol !== 'https:')
+            return 'redirected';
+        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
+            && target.searchParams.has('url'))
+            return 'vercel-protection';
+        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
+            && /^\/login(?:\/|$)/.test(target.pathname))
+            return 'vercel-protection';
+        if (target.hostname.endsWith('.cloudflareaccess.com'))
+            return 'cloudflare-access';
+        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
+            return 'app-sign-in';
+        }
+    }
+    catch {
+        // A malformed redirect reveals nothing about preview protection.
+    }
+    return 'redirected';
+}
+/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
+export async function probePreview(url, dependencies = {}) {
+    let target;
+    try {
+        target = new URL(url);
+        if (!isPlatformPreview(target)
+            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
+            throw new Error();
+    }
+    catch {
+        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 15_000);
+    const signal = dependencies.signal
+        ? AbortSignal.any([controller.signal, dependencies.signal])
+        : controller.signal;
+    try {
+        signal.throwIfAborted();
+        const response = dependencies.fetch ? await dependencies.fetch(target, {
+            method: 'GET',
+            headers: { accept: 'text/html' },
+            credentials: 'omit',
+            redirect: 'manual',
+            signal,
+        }) : await publicPreviewRequest(target, signal);
+        const status = response.status;
+        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
+            ? 'vercel-protection' : status >= 300 && status < 400
+            ? redirectGate(response.headers.get('location'), target)
+            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
+        // Bodies and redirect details may contain credentials; never read or return them.
+        await response.body?.cancel().catch(() => undefined);
+        return { status, gate };
+    }
+    catch {
+        return { status: null, gate: 'unavailable', error: 'request-failed' };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -0,0 +1,15 @@
+/** Register credential-shaped write fields before a message can be recorded.
+ * Do not trust the requested path: even a refused or malformed destination must
+ * keep its supplied credentials private. Values remain unchanged in memory.
+ */
+export function protectionWriteSecrets(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    const body = input.body;
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return [];
+    return ['value', 'clientId', 'clientSecret']
+        .map((key) => body[key])
+        .filter((value) => typeof value === 'string' && value.length > 0)
+        .sort((a, b) => b.length - a.length);
+}