toolaby 1.4.5 → 1.6.0

package/README.md

@@ -24,6 +24,8 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. Nothing is sent anywhere.
+
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 
 ## Where things live

package/bin.mjs

@@ -5,6 +5,9 @@
 //   toolaby wire <tool-id>            wire the extension in this folder to your tool — plain, WXT, CRXJS or Plasmo
 //   toolaby create <tool-id>          make a new, minimal extension for your tool in <tool-id>/
 //   toolaby tools                     your tools, with the ids the commands want
+//   toolaby pack [folder]             the zip for the Chrome Web Store: the built extension, its manifest's key left out
+//   toolaby check [--into <folder>]   whether the extension here is wired right; --browser loads it in Chromium too
+//   toolaby mcp                       the Wall for coding agents: an MCP server on stdio (lib/mcp.js)
 //   toolaby webhooks events           the six events, with an example of each
 //   toolaby webhooks trigger <event>  send an example delivery: to your registered endpoints, or with --to straight to a local server
 //   toolaby webhooks endpoints        the workspace's endpoints
@@ -27,14 +30,17 @@
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
 import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, chmodSync, unlinkSync } from 'node:fs';
-import { join, resolve, dirname } from 'node:path';
+import { join, resolve, dirname, relative, basename } from 'node:path';
+import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
 import { createHmac, randomBytes } from 'node:crypto';
-import { wireManifest, WORKER_LINES } from './lib/manifest.js';
-import { detectProject, CODE_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE } from './lib/project.js';
+import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
+import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
+import { runMcp } from './lib/mcp.js';
+import { runCheck } from './lib/check.js';
 
-const VERSION = '1.4.5';
+const VERSION = '1.6.0';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -167,14 +173,16 @@ function listTree(dir, depth, prefix = '', acc = new Set()) {
   return acc;
 }
 const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+/** Whether a background already starts the platform, outside its comments: then it needs no lines added. */
+const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readFileSync(path, 'utf8').replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
 const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
 
 /** The tool's files from the Wall, as the signed-in developer: a tool of theirs, or a clear no. */
-async function filesFor(slug, scaffold, manifestKey = null) {
+async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
   const token = await tokenOrLogin();
-  const q = new URLSearchParams(); if (scaffold) q.set('scaffold', '1'); if (manifestKey) q.set('manifestKey', manifestKey);
+  const q = new URLSearchParams(); if (scaffold) q.set('scaffold', '1'); if (manifestKey) q.set('manifestKey', manifestKey); if (surfaces) q.set('surfaces', surfaces);
   const res = await api(`/api/cli/wiring/${slug}${q.size ? `?${q}` : ''}`, { token });
-  if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold, manifestKey); }
+  if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold, manifestKey, surfaces); }
   if (res.status === 404) {
     // Say who the command is: the tool may well exist — in a workspace of another account of theirs.
     const me = await api('/api/cli/me', { token }).catch(() => null);
@@ -208,17 +216,25 @@ async function wire() {
   const oldConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
   const remembered = oldConfig.match(/appPopup:\s*'([^']*)'/)?.[1] || null;
   const rememberedSidePanel = oldConfig.match(/appSidePanel:\s*'([^']*)'/)?.[1] || null;
-  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered, rememberedSidePanel, manifestKey }) : null;
+  // An extension whose own pages draw the panel — what `create` makes, or "your popup first" — keeps them in front.
+  const ownInFront = drawsItself(manifest, oldConfig);
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered, rememberedSidePanel, manifestKey, ownInFront }) : null;
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
-  const targets = filesToWrite(project, appPopup, appSidePanel);
+  const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
   const present = targets.filter((f) => existsSync(join(dir, f)));
   if (present.length && !flag('--force')) fail(`${present.join(', ')} already in ${dir}; add --force to replace them.`);
   const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
   // A command older than the Wall asks for files the Wall no longer hands out: said, with the way to the current one, rather than a crash.
-  const missing = targets.map((p) => p.split('/').pop()).filter((name) => typeof plan.files[name] !== 'string');
+  // The agent files come from Walls that write them; one that does not is older, not newer, than this command.
+  const agentPaths = new Set(AGENT_FILES.map((f) => f.path));
+  const missing = targets.filter((p) => !agentPaths.has(p)).map((p) => p.split('/').pop()).filter((name) => typeof plan.files[name] !== 'string');
   if (missing.length) fail(`This command (${VERSION}) is older than the Wall at ${wall}: it expects ${missing.join(', ')}, which the Wall no longer hands out.\n  Update it: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz ${command} ${slug}`);
-  for (const path of targets) write(path, fillPages(plan.files[path.split('/').pop()], { appPopup, appSidePanel }));
+  const wrote = targets.filter((path) => typeof plan.files[path.split('/').pop()] === 'string');
+  for (const path of wrote) write(path, fillPages(plan.files[path.split('/').pop()], { appPopup, appSidePanel }));
+  // AGENTS.md and CLAUDE.md, for coding agents, only where the project has none: its own are never replaced.
+  for (const f of AGENT_ENTRY_FILES) if (!has(f) && typeof plan.files[f] === 'string') { write(f, plan.files[f]); wrote.push(f); }
+  const ownAgents = has('AGENTS.md') && !readFileSync(join(dir, 'AGENTS.md'), 'utf8').includes('TOOLABY.md');
   // What an earlier wiring wrote and this one does not, wherever it put them: taken away, so nothing stale is shipped.
   const removed = [];
   for (const at of new Set([project.codeDir, project.popupDir, 'public/', 'src/public/'])) for (const f of STALE_FILES) { const p = join(dir, `${at}${f}`); if (existsSync(p)) { unlinkSync(p); removed.push(`${at}${f}`); } }
@@ -228,17 +244,18 @@ async function wire() {
     if (wiring.writeWorker) write(wiring.writeWorker, WORKER_LINES);
     if (wiring.did.length) write('manifest.json', JSON.stringify(wiring.manifest, null, 2) + '\n');
     did.push(...wiring.did);
-    if (wiring.ownWorker) ownWorker = wiring.ownWorker;
+    if (wiring.ownWorker && !startsPlatform(join(dir, wiring.ownWorker.file))) ownWorker = wiring.ownWorker;
   } else if (project.createWorker) {
     write(project.createWorker.file, project.createWorker.content);
     did.push(`a background entry, ${project.createWorker.file} (it starts the platform)`);
-  } else if (project.worker && !project.extraFiles) {
+  } else if (project.worker && !project.extraFiles && !startsPlatform(join(dir, project.worker))) {
     // A framework with its own extension point (WXT's module) starts the platform in the background itself.
     ownWorker = { file: project.worker, classic: false };
   }
 
   out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
-  out(`  Written: ${targets.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
+  out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
+  if (ownAgents) out('  Your AGENTS.md is your own: add a line so coding agents find the Wall\'s guide — "Before changing anything paid, read TOOLABY.md."\n');
   if (removed.length) out(`  Removed: ${removed.join(', ')} — earlier files, now inside toolaby.js.\n`);
   for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
@@ -246,6 +263,7 @@ async function wire() {
   out(`  Next: ${project.kind === 'plain' && !project.built ? '' : 'build or start the dev server, then '}chrome://extensions → reload it. The tool's Set up page says "checked in" the moment it starts.`);
   if (project.note) out(`  ${project.note}\n`);
   else if (appPopup || appSidePanel) out(`  Your ${appPopup && appSidePanel ? 'popup and side panel open' : appSidePanel ? 'side panel opens' : 'popup opens'} as before; what the Free plan holds (Pricing, in the dashboard) decides when the Wall's panel takes its place.\n`);
+  else if (ownInFront && (wiring?.ownPopup || wiring?.ownSidePanel)) out(`  Your ${wiring.ownPopup && wiring.ownSidePanel ? 'popup and side panel stay' : wiring.ownSidePanel ? 'side panel stays' : 'popup stays'} in front and draw${wiring.ownPopup && wiring.ownSidePanel ? '' : 's'} the panel, as before; toolaby.showPaywall() opens the Wall's page beside it.\n`);
   else out(`  No popup or side panel to stand in front of: count a use where your feature runs — the Set up page shows the line.\n`);
 }
 
@@ -254,30 +272,36 @@ async function create() {
   if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
   if (existsSync(dir)) fail(`${dir} already exists`);
-  const plan = await filesFor(slug, true);
+  // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
+  const asked = opt('--surfaces');
+  if (asked && !SURFACES.includes(asked)) fail(`--surfaces takes ${SURFACES.join(', ')} — not "${asked}".`);
+  const surfaces = surfacesOf(asked);
+  const plan = await filesFor(slug, true, null, surfaces);
   const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
   // The scaffold's own files as the Wall names them (older Walls did not, hence the list): a Wall that adds one to the
   // minimal extension is written by this command too, instead of a manifest naming a file that never arrived.
   const scaffold = Array.isArray(plan.scaffold) && plan.scaffold.length ? plan.scaffold : ['manifest.json', 'background.js', 'popup.html', 'sidepanel.html', 'popup.css', 'popup.js', 'README.md'];
-  // Which surfaces this extension is made with: both (the default), one of them, or none at all for a tool that works
-  // from the background. Asked for once here, rather than written and then deleted by hand.
-  const asked = opt('--surfaces');
-  if (asked && !SURFACES.includes(asked)) fail(`--surfaces takes ${SURFACES.join(', ')} — not "${asked}".`);
-  const surfaces = surfacesOf(asked);
-  const wanted = [...CODE_FILES, ...scaffoldFilesFor(surfaces, scaffold)];
+  // Both surfaces (the default), one of them, or none at all for a tool that works from the background — and beside each,
+  // the Wall's page for it, which toolaby.showPaywall() opens when an action is refused (the extension's own pages stay in front).
+  const wanted = [...CODE_FILES, ...scaffoldFilesFor(surfaces, scaffold), ...(hasPopup(surfaces) ? POPUP_FILES : []), ...(hasSidePanel(surfaces) ? SIDE_PANEL_FILES : [])];
   const absent = wanted.filter((f) => typeof plan.files[f] !== 'string');
   if (absent.length) fail(`The Wall at ${wall} named ${absent.join(', ')} for a new extension but did not hand ${absent.length > 1 ? 'them' : 'it'} over.\n  Nothing was written. Update this command: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz create ${slug}`);
   // Both surfaces, and the panel drawn inside them: no page of the Wall's stands in front, so both names stay empty.
   for (const f of wanted) write(f, fillPages(plan.files[f]));
   // The manifest names the side panel only now that the page is beside it — an extension whose side_panel points at a
   // missing file does not load at all, so a Wall that stops serving the page must not leave the key behind either.
-  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces) }), null, 2) + '\n');
+  // The extension's identity too: every copy gets the id the tool key is bound to, wherever its folder is.
+  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
   for (const s of [16, 48, 128]) {
     const res = await fetch(`${wall}/boilerplate/icons/icon${s}.png`);
     write(join('icons', `icon${s}.png`), Buffer.from(await res.arrayBuffer()));
   }
+  // What a coding agent reads: the guide with this tool's features and plans, the skill, AGENTS.md and CLAUDE.md.
+  for (const f of AGENT_FILES) if (typeof plan.files[f.name] === 'string') write(f.path, plan.files[f.name]);
+  for (const f of AGENT_ENTRY_FILES) if (typeof plan.files[f] === 'string') write(f, plan.files[f]);
   const clicking = { both: 'Click the icon: the popup shows what the Free plan holds. Open side panel, in it, is the same page at the panel\'s width', popup: 'Click the icon: the popup shows what the Free plan holds', 'side-panel': 'Click the icon: the side panel opens — it has no popup, so the click is the panel\'s', none: 'No popup and no side panel: nothing opens on a click. Your code says when to sell — toolaby.openPaymentPage()' }[surfaces];
-  out(`\n  ${plan.name} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${plan.site}/tools/${slug}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${plan.site}/docs/surfaces\n`);
+  out(`\n  ${plan.name} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${plan.buyer ?? `${plan.site}/tools/${slug}`}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
+  if (typeof plan.files['TOOLABY.md'] === 'string') out(`  With a coding agent: AGENTS.md and TOOLABY.md tell it how this extension sells. For Claude Code, the Wall itself:\n    claude mcp add toolaby -- npx -y toolaby@latest mcp${live ? ' --live' : ''}\n`);
 }
 
 // ── webhooks: the catalogue, and a delivery on demand ───────────────────────────────────────────────────────────────
@@ -364,6 +388,122 @@ async function webhooks() {
   fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
 }
 
+// ── pack: the zip the Chrome Web Store takes ──────────────────────────────────────────────────────────────────────────
+// The built extension, zipped, with the manifest's `key` left out: the store refuses a key in a new item's first
+// package and any key but the item's own in an update, and it keeps the id it gave the item either way — the Wall
+// admits that id once the listing's address is on the tool. It refuses a build that would sell on Test (a tk_test_
+// or tk_dev_ key inside) or that points at this machine (localhost in the manifest), the two mistakes a store build
+// can ship with. Nothing is sent anywhere: it reads the folder and writes one file.
+const BUILD_DIRS = ['.', '.output/chrome-mv3', 'dist', 'build/chrome-mv3-prod', 'build'];
+const TOOL_KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/g;
+const LOCAL = /^(https?|wss?):\/\/(localhost|127\.0\.0\.1|\[::1\]|[^/]*\.localhost)(:\d+)?\//i;
+
+const CRC_TABLE = Array.from({ length: 256 }, (_, n) => { let c = n; for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1; return c >>> 0; });
+const crc32 = (buf) => { let c = 0xffffffff; for (const b of buf) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8); return (c ^ 0xffffffff) >>> 0; };
+
+/** A zip of [name, bytes] pairs: deflated where that is smaller, stored otherwise, every entry dated 1 Jan 1980 so the same build packs to the same bytes. */
+function zipOf(entries) {
+  const locals = []; const centrals = []; let offset = 0;
+  for (const [name, data] of entries) {
+    const nameBuf = Buffer.from(name, 'utf8');
+    const deflated = deflateRawSync(data, { level: 9 });
+    const method = deflated.length < data.length ? 8 : 0;
+    const body = method === 8 ? deflated : data;
+    const crc = crc32(data);
+    const head = Buffer.alloc(30);
+    head.writeUInt32LE(0x04034b50, 0); head.writeUInt16LE(20, 4); head.writeUInt16LE(0x0800, 6); head.writeUInt16LE(method, 8);
+    head.writeUInt16LE(0, 10); head.writeUInt16LE(0x21, 12); head.writeUInt32LE(crc, 14); head.writeUInt32LE(body.length, 18);
+    head.writeUInt32LE(data.length, 22); head.writeUInt16LE(nameBuf.length, 26); head.writeUInt16LE(0, 28);
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0); central.writeUInt16LE(20, 4); central.writeUInt16LE(20, 6); central.writeUInt16LE(0x0800, 8);
+    central.writeUInt16LE(method, 10); central.writeUInt16LE(0, 12); central.writeUInt16LE(0x21, 14); central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(body.length, 20); central.writeUInt32LE(data.length, 24); central.writeUInt16LE(nameBuf.length, 28);
+    central.writeUInt32LE(offset, 42);
+    locals.push(head, nameBuf, body); centrals.push(central, nameBuf);
+    offset += head.length + nameBuf.length + body.length;
+  }
+  const cd = Buffer.concat(centrals);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0); end.writeUInt16LE(entries.length, 8); end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(cd.length, 12); end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, cd, end]);
+}
+
+function filesIn(root) {
+  const found = [];
+  const walk = (dir) => {
+    for (const name of readdirSync(dir).sort()) {
+      if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
+      const p = join(dir, name);
+      if (statSync(p).isDirectory()) walk(p); else found.push(p);
+    }
+  };
+  walk(root);
+  return found;
+}
+
+function pack() {
+  const given = positional[0];
+  const folder = given ? resolve(given) : BUILD_DIRS.map((d) => resolve(d)).find((d) => existsSync(join(d, 'manifest.json')));
+  if (!folder || !existsSync(join(folder, 'manifest.json'))) fail(given ? `No manifest.json in ${given}.` : `No manifest.json here or in ${BUILD_DIRS.slice(1).join(', ')}. Build first, or name the folder: toolaby pack <folder>.`);
+  let manifest;
+  try { manifest = JSON.parse(readFileSync(join(folder, 'manifest.json'), 'utf8')); } catch (e) { fail(`manifest.json does not parse: ${e.message}`); }
+  if (!manifest.version) fail('manifest.json has no "version".');
+  const files = filesIn(folder);
+  const problems = [];
+
+  // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
+  const modes = new Set(); const sites = new Set();
+  for (const f of files) {
+    if (!/\.(m?js|html|json)$/.test(f)) continue;
+    for (const [k, mode] of readFileSync(f, 'utf8').matchAll(TOOL_KEY)) {
+      modes.add(mode);
+      try { const facts = JSON.parse(Buffer.from(k.split('_')[2], 'base64url').toString('utf8')); if (typeof facts.s === 'string') sites.add(facts.s.replace(/\/$/, '')); } catch { /* not a key after all */ }
+    }
+  }
+  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx toolaby wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
+  if (modes.size === 0) out('\n  No tool key found in the build: it is not wired to the Wall, or the key is somewhere this cannot read. Packing anyway.');
+
+  // Addresses of this machine have no place in a store build.
+  const local = [...(manifest.host_permissions ?? []), ...(manifest.externally_connectable?.matches ?? [])].filter((m) => typeof m === 'string' && LOCAL.test(m));
+  if (local.length && !flag('--allow-local')) problems.push(`The manifest points at this machine: ${local.join(', ')}. A store build has no localhost in host_permissions or externally_connectable. (--allow-local packs it anyway.)`);
+
+  // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
+  for (const site of sites) {
+    const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
+    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${site}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
+  }
+  if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
+
+  const hadKey = typeof manifest.key === 'string';
+  const { key: _key, ...forStore } = manifest;
+  const entries = files.map((f) => {
+    const name = relative(folder, f).split('\\').join('/');
+    return [name, name === 'manifest.json' ? Buffer.from(JSON.stringify(forStore, null, 2) + '\n') : readFileSync(f)];
+  });
+  // Named after the extension, or after its folder when the name is a __MSG_…__ placeholder.
+  const named = typeof manifest.name === 'string' && !manifest.name.startsWith('__MSG_') ? manifest.name : basename(folder);
+  const safe = named.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'extension';
+  const target = resolve(opt('--out') ?? `${safe}-${manifest.version}.zip`);
+  writeFileSync(target, zipOf(entries));
+  const kb = (statSync(target).size / 1024).toFixed(0);
+  out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
+  if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
+  out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
+}
+
+// ── mcp and check: the Wall for coding agents ──────────────────────────────────────────────────────────────────────
+function mcp() {
+  // Every word to stdout is a protocol message here: the session is the stored one, never a sign-in on the spot.
+  runMcp({ version: VERSION, side, wall, token: storedToken, api: (path, o = {}) => api(path, o) });
+  return new Promise(() => {}); // until stdin closes
+}
+
+async function check() {
+  const passed = await runCheck({ dir: opt('--into') ?? positional[0] ?? '.', out, api: (path, o = {}) => api(path, o), token: storedToken, detectProject, wireManifest, listTree, readJson, browser: flag('--browser') });
+  if (!passed) process.exit(1);
+}
+
 function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
@@ -375,6 +515,12 @@ function help() {
     toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
     toolaby tools                      your tools, with their ids
+    toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
+                                       refuses a Test key or localhost inside   --out <file.zip>
+    toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
+                                       --browser loads it in Chromium (needs Playwright in the project)
+    toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
+                                       claude mcp add toolaby -- npx -y toolaby@latest mcp
     toolaby webhooks events            the six events, with an example of each
     toolaby webhooks trigger <event>   an example delivery to your endpoints; --to <url> sends it to a local server instead
     toolaby webhooks endpoints         your endpoints; add <url> registers one (secret shown once), remove <id> removes one
@@ -385,7 +531,7 @@ function help() {
 `);
 }
 
-const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, upgrade: wire, create, webhooks, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
+const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, upgrade: wire, create, webhooks, pack, check, mcp, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
 const run = commands[command];
 if (!run) { console.error(`\n  Unknown command "${command}".`); help(); process.exit(1); }
 Promise.resolve().then(run).catch((e) => fail(e.message));

package/lib/check.js

@@ -0,0 +1,190 @@
+// `toolaby check`: whether the extension in a folder is wired right, in words an agent can act on. The files the Wall
+// writes, the tool key and the tool it names, the manifest against the platform's own wiring rules and its `key`, the
+// client's freshness, the feature keys the code gates on against the tool's, the paywall's page, whether a copy has
+// checked in and whether the key is current, and — with --browser, where Playwright is installed — the extension
+// loaded in Chromium, its background answering and its own pages opening without an error.
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/;
+const CODE = /\.(m?js|jsx|ts|tsx|html|vue|svelte)$/;
+const SKIP = new Set(['node_modules', '.git', 'dist', 'build', '.output', '.wxt', '.plasmo', '.next', 'coverage']);
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+
+function decodeKey(key) {
+  try {
+    const facts = JSON.parse(Buffer.from(key.split('_').slice(2).join('_'), 'base64url').toString('utf8'));
+    return typeof facts.s === 'string' && typeof facts.t === 'string' ? { site: facts.s.replace(/\/$/, ''), slug: facts.t, x: facts.k?.x, y: facts.k?.y } : null;
+  } catch { return null; }
+}
+
+/** The extension's own source files, not the Wall's and not a build's. */
+function sourceFiles(dir, acc = [], depth = 4) {
+  for (const name of readdirSync(dir)) {
+    if (SKIP.has(name) || name.startsWith('.')) continue;
+    const p = join(dir, name);
+    let st; try { st = statSync(p); } catch { continue; }
+    if (st.isDirectory()) { if (depth > 0) sourceFiles(p, acc, depth - 1); continue; }
+    if (CODE.test(name) && !name.startsWith('toolaby')) acc.push(p);
+  }
+  return acc;
+}
+
+/**
+ * The code without its comments: an example in a comment (the scaffold's background has one) is not a gate. Strings
+ * are kept whole, so a `//` inside one is not taken for a comment.
+ */
+export function withoutComments(text) {
+  return text.replace(/("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`)|\/\*[\s\S]*?\*\/|\/\/[^\n]*|<!--[\s\S]*?-->/g, (m, str) => (str ? m : ''));
+}
+
+/** Feature keys the code asks about: gate({ feature: 'x' }) and has('x'), outside comments. */
+export function featuresUsed(source) {
+  const text = withoutComments(source);
+  const keys = new Set();
+  for (const m of text.matchAll(/gate\(\s*\{[^}]*?feature\s*:\s*['"`]([a-z0-9][a-z0-9-]*)['"`]/g)) keys.add(m[1]);
+  for (const m of text.matchAll(/\.has\(\s*['"`]([a-z0-9][a-z0-9-]*)['"`]\s*\)/g)) keys.add(m[1]);
+  for (const m of text.matchAll(/showPaywall\(\s*\{[^}]*?feature\s*:\s*['"`]([a-z0-9][a-z0-9-]*)['"`]/g)) keys.add(m[1]);
+  return keys;
+}
+
+export async function runCheck({ dir: given, out, api, token, detectProject, wireManifest, listTree, readJson, browser }) {
+  const dir = resolve(given ?? '.');
+  const results = [];
+  const ok = (s) => { results.push('ok'); out(`  ✓ ${s}`); };
+  const warn = (s) => { results.push('warn'); out(`  ! ${s}`); };
+  const bad = (s) => { results.push('bad'); out(`  ✗ ${s}`); };
+  out(`\n  Checking ${dir}\n`);
+
+  // 1. What the folder is.
+  if (!existsSync(dir)) { bad(`${dir} does not exist.`); return false; }
+  const tree = listTree(dir, 3);
+  const has = (p) => tree.has(p.replace(/\/$/, ''));
+  const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
+  if (has('manifest.json') && !manifest) { bad('manifest.json is not valid JSON.'); return false; }
+  const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site: 'https://example.invalid', tree });
+  if (project.kind === 'unknown') { bad(`Not an extension project: no manifest.json at the top, and not WXT, CRXJS or Plasmo${project.foundManifest ? ` (there is a manifest at ${project.foundManifest}: run this with --into ${project.foundManifest.replace(/\/?manifest\.json$/, '') || '.'})` : ''}.`); return false; }
+  ok(project.kind === 'plain' ? 'A plain extension: manifest.json at the top.' : `A ${project.label} project.`);
+
+  // 2. The Wall's files.
+  const at = (f) => join(dir, `${project.codeDir}${f}`);
+  const missing = ['toolaby.js', 'toolaby.config.js'].filter((f) => !existsSync(at(f)));
+  if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx toolaby wire <tool-id>\` here.`); return false; }
+  ok(`The Wall's files are in ${project.codeDir || 'the top folder'}.`);
+
+  // 3. The tool key, and the tool it names.
+  const keyText = readFileSync(at('toolaby.config.js'), 'utf8').match(KEY)?.[0];
+  const key = keyText ? decodeKey(keyText) : null;
+  if (!key) { bad('toolaby.config.js holds no tool key. Run `npx toolaby upgrade <tool-id>` here.'); return false; }
+  const mode = keyText.split('_')[1];
+  ok(`The tool key names ${key.slug}, on ${mode === 'live' ? 'Live' : mode === 'test' ? 'Test' : 'a development Wall'} (${key.site}).`);
+  const pub = await fetch(`${key.site}/api/tools/${encodeURIComponent(key.slug)}`).then(async (r) => ({ status: r.status, json: await r.json().catch(() => null) })).catch((e) => ({ status: 0, json: null, error: e.message }));
+  const tool = pub.status === 200 ? pub.json : null;
+  if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx toolaby tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
+  else {
+    ok(`The Wall knows it: ${tool.name}.`);
+    const jwk = tool.publicKeyJwk ?? {};
+    if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx toolaby upgrade <tool-id>` writes it in.');
+  }
+
+  // 4. The manifest, against the platform's own wiring rules: what wiring it again would add.
+  const configText = readFileSync(at('toolaby.config.js'), 'utf8');
+  if (project.manifestFile && manifest) {
+    const again = wireManifest(manifest, { site: key.site, has, remembered: null, rememberedSidePanel: null, manifestKey: typeof manifest.key === 'string' ? manifest.key : null });
+    const needed = (again.did ?? []).filter((d) => !/popup|side panel/i.test(d));
+    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    else ok('The manifest has the permissions and host permissions the Wall needs.');
+    // The identity: without the `key`, each copy's id follows its folder, and the tool key opens for the first to connect only.
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and the tool key opens only for the first copy to connect. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+  } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
+
+  // 5. The client, as fresh as the Wall's.
+  const client = await fetch(`${key.site}/client/toolaby.js`).then((r) => (r.ok ? r.text() : null)).catch(() => null);
+  if (client === null) warn('The Wall\'s current client could not be read to compare.');
+  else if (sha(client) !== sha(readFileSync(at('toolaby.js'), 'utf8'))) warn(`toolaby.js is not the Wall's current client. \`npx toolaby upgrade ${key.slug}\` replaces it (your own files stay).`);
+  else ok('toolaby.js is the Wall\'s current client.');
+
+  // 6. The features the code gates on, against the tool's; and the page showPaywall() opens.
+  const sources = sourceFiles(dir).map((f) => readFileSync(f, 'utf8'));
+  if (project.manifestFile && manifest && sources.some((s) => /\bshowPaywall\s*\(/.test(withoutComments(s)))) {
+    const pages = [manifest.action?.default_popup ? 'toolaby-popup.html' : null, (manifest.side_panel?.default_path || manifest.sidebar_action?.default_panel) ? 'toolaby-sidepanel.html' : null].filter(Boolean);
+    const absent = pages.filter((p) => !existsSync(join(dir, `${project.popupDir}${p}`)));
+    if (absent.length) warn(`The code calls toolaby.showPaywall(), which opens ${absent.join(' and ')}, and the extension has no such page: the paywall opens the buyer page in a new tab instead. \`npx toolaby upgrade ${key.slug}\` writes ${absent.length > 1 ? 'them' : 'it'}; your pages stay in front.`);
+  }
+  if (tool) {
+    const used = new Set();
+    for (const s of sources) for (const k of featuresUsed(s)) used.add(k);
+    const known = new Set((tool.features ?? []).map((f) => f.key));
+    const unknown = [...used].filter((k) => !known.has(k));
+    if (unknown.length) bad(`The code gates on ${unknown.map((k) => `"${k}"`).join(', ')}, which ${unknown.length > 1 ? 'the tool does not have' : 'is not a feature of the tool'}: every buyer would be refused. Add ${unknown.length > 1 ? 'them' : 'it'} (the MCP tool toolaby_set_features, or the tool's Pricing page).`);
+    else if (used.size) ok(`The code gates on ${[...used].map((k) => `"${k}"`).join(', ')}: ${used.size > 1 ? 'all features' : 'a feature'} of the tool.`);
+    const unsold = [...used].filter((k) => known.has(k) && !(tool.plans ?? []).some((p) => (p.features ?? []).includes(k)) && !(tool.features ?? []).find((f) => f.key === k)?.free);
+    if (unsold.length) warn(`No plan unlocks ${unsold.map((k) => `"${k}"`).join(', ')} yet: buyers are offered nothing for ${unsold.length > 1 ? 'them' : 'it'}. Say which plans do (toolaby_set_features with plans, or the Pricing page).`);
+    if (tool.access !== 'open' && !(tool.plans ?? []).length) warn('The Free plan does not hold everything, and there is no plan to buy. Add one (toolaby_add_plan, or Pricing).');
+  }
+
+  // 7. A copy that checked in: what the dashboard's Set up page waits for.
+  if (tool && token()) {
+    const facts = await api(`/api/cli/tools/${encodeURIComponent(key.slug)}`).catch(() => null);
+    const seen = facts?.ok ? facts.json?.extension?.checkedInAt : undefined;
+    if (seen) ok(`A copy of the extension checked in (${new Date(seen).toISOString().slice(0, 16).replace('T', ' ')} UTC).`);
+    else if (facts?.ok) warn('No copy has checked in yet: load it at chrome://extensions and open it once.');
+    // The key carries what the Free plan holds and the kind of plan sold: a change since it was written leaves it behind.
+    const current = facts?.ok ? facts.json?.toolKey : null;
+    if (typeof current === 'string' && current.split('_')[1] === mode && current !== keyText) warn(`The tool key in toolaby.config.js is older than the Wall's: what the Free plan holds, the plans or the signing key changed since it was written. \`npx toolaby upgrade ${key.slug}\` writes the current one.`);
+  }
+
+  // 8. In a browser: the background answers.
+  if (browser) await browserCheck({ dir, project, manifest, ok, warn, bad });
+
+  const n = (k) => results.filter((r) => r === k).length;
+  out(`\n  ${n('bad') ? `${n('bad')} to fix` : 'Nothing to fix'}${n('warn') ? `, ${n('warn')} to look at` : ''}.\n`);
+  return n('bad') === 0;
+}
+
+async function browserCheck({ dir, project, manifest, ok, warn, bad }) {
+  let chromium;
+  // Playwright's entry is CommonJS: imported, its exports are the module's default.
+  try { const pw = await import(createRequire(join(dir, 'package.json')).resolve('playwright')); chromium = pw.chromium ?? pw.default?.chromium; if (!chromium) throw new Error('no chromium'); }
+  catch { warn(`--browser needs Playwright in this project: ${existsSync(join(dir, 'package.json')) ? '' : '`npm init -y` (there is no package.json), then '}\`npm i -D playwright && npx playwright install chromium\`.`); return; }
+  const built = project.kind === 'plain' ? dir : ['.output/chrome-mv3', 'dist', 'build/chrome-mv3-dev', 'build/chrome-mv3-prod', 'build'].map((d) => join(dir, d)).find((d) => existsSync(join(d, 'manifest.json')));
+  if (!built) { warn(`No built extension to load: build first (${project.label}).`); return; }
+  const shipped = readJsonSafe(join(built, 'manifest.json')) ?? manifest;
+  const ctx = await chromium.launchPersistentContext('', { channel: 'chromium', headless: true, args: [`--disable-extensions-except=${built}`, `--load-extension=${built}`] }).catch((e) => { bad(`Chromium did not start: ${e.message}`); return null; });
+  if (!ctx) return;
+  try {
+    const worker = ctx.serviceWorkers()[0] ?? (await ctx.waitForEvent('serviceworker', { timeout: 15_000 }).catch(() => null));
+    if (!worker) { bad('The extension\'s service worker did not start: its code threw while loading. Open chrome://extensions → Errors.'); return; }
+    const id = new URL(worker.url()).host;
+    ok(`Loaded in Chromium as ${id} (${relative(dir, built) || '.'}).`);
+    const pagePath = shipped?.action?.default_popup ?? shipped?.side_panel?.default_path ?? null;
+    const page = await ctx.newPage();
+    await page.goto(pagePath ? `chrome-extension://${id}/${pagePath}` : `chrome-extension://${id}/manifest.json`);
+    const answer = await page.evaluate(() => Promise.race([
+      chrome.runtime.sendMessage({ action: 'getLicenseStatus' }).then((r) => r ?? null),
+      new Promise((r) => setTimeout(() => r('timeout'), 8000)),
+    ])).catch((e) => `error: ${e.message}`);
+    if (answer && answer !== 'timeout' && !String(answer).startsWith('error')) ok('The background answers the Wall\'s client: its listeners registered.');
+    else bad(`The background did not answer (${answer ?? 'nothing'}): its module threw while loading, so none of its listeners registered.`);
+    await page.close().catch(() => {});
+    // The extension's own pages, each opened in a tab: one whose script throws is a popup that opens blank.
+    const own = [shipped?.action?.default_popup, shipped?.side_panel?.default_path].filter((p, i, all) => typeof p === 'string' && p && all.indexOf(p) === i);
+    for (const p of own) {
+      const tab = await ctx.newPage();
+      const errors = [];
+      tab.on('pageerror', (e) => errors.push(e.message));
+      await tab.goto(`chrome-extension://${id}/${p}`).catch((e) => errors.push(e.message));
+      await tab.waitForTimeout(1500);
+      await tab.close().catch(() => {});
+      if (errors.length) bad(`${p} threw when it opened: ${errors[0]}`);
+      else ok(`${p} opens without an error.`);
+    }
+  } finally {
+    await ctx.close().catch(() => {});
+  }
+}
+
+function readJsonSafe(p) { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } }

package/lib/manifest.js

@@ -12,11 +12,28 @@
  * that fixes its id, which the tool key is bound to (identity.ts) — unless
  * the manifest has one of its own, which is then the identity the platform
  * adopts. Pure: given the manifest and what is on disk, it says what to
- * write.
+ * write. An extension whose own pages draw the panel (drawsItself) keeps
+ * them in front: nothing of the Wall's is put there.
  */
 export const WALL_POPUP = 'toolaby-popup.html';
 export const WALL_SIDE_PANEL = 'toolaby-sidepanel.html';
 export const WORKER_LINES = "import { toolaby } from './toolaby.js';\n\ntoolaby.startBackground();\n";
+/**
+ * Whether an earlier wiring left the extension's own pages drawing the panel: a configuration that says '' for both
+ * pages while the manifest names none of the Wall's. That is what `create` makes, and the "your popup first" shape
+ * (docs/gating); a wiring keeps it rather than putting the Wall's page back in front. A first wiring (no configuration
+ * yet) puts the Wall's in front.
+ */
+export function drawsItself(manifest, oldConfig) {
+    if (!oldConfig)
+        return false;
+    const popup = oldConfig.match(/appPopup:\s*'([^']*)'/);
+    const side = oldConfig.match(/appSidePanel:\s*'([^']*)'/);
+    if (!popup || popup[1] !== '' || (side && side[1] !== ''))
+        return false;
+    const pages = [manifest?.action?.default_popup, manifest?.side_panel?.default_path, manifest?.sidebar_action?.default_panel];
+    return !pages.some((p) => p === WALL_POPUP || p === WALL_SIDE_PANEL);
+}
 export function wireManifest(input, o) {
     const manifest = JSON.parse(JSON.stringify(input));
     const did = [];
@@ -44,7 +61,8 @@ export function wireManifest(input, o) {
     }
     // The extension's own popup: the manifest's, or the one remembered when the manifest already names the Wall's.
     const declared = typeof manifest.action?.default_popup === 'string' ? manifest.action.default_popup : null;
-    const appPopup = declared && declared !== WALL_POPUP ? declared : declared === WALL_POPUP ? (o.remembered || null) : null;
+    const ownPopup = declared && declared !== WALL_POPUP ? declared : declared === WALL_POPUP ? (o.remembered || null) : null;
+    const appPopup = o.ownInFront ? null : ownPopup;
     if (appPopup && declared !== WALL_POPUP) {
         manifest.action = { ...manifest.action, default_popup: WALL_POPUP };
         did.push(`the Wall's popup in front of ${appPopup}: it opens on to yours while the device may, and shows the panel when it may not`);
@@ -55,15 +73,17 @@ export function wireManifest(input, o) {
     const declaredPanel = typeof manifest.side_panel?.default_path === 'string' ? manifest.side_panel.default_path : null;
     const declaredSidebar = typeof manifest.sidebar_action?.default_panel === 'string' ? manifest.sidebar_action.default_panel : null;
     const ours = declaredPanel === WALL_SIDE_PANEL || declaredSidebar === WALL_SIDE_PANEL;
-    const appSidePanel = theirs(declaredPanel) ?? theirs(declaredSidebar) ?? (ours ? o.rememberedSidePanel || null : null);
-    if (theirs(declaredPanel)) {
+    const ownSidePanel = theirs(declaredPanel) ?? theirs(declaredSidebar) ?? (ours ? o.rememberedSidePanel || null : null);
+    const appSidePanel = o.ownInFront ? null : ownSidePanel;
+    if (o.ownInFront) { /* the extension's own side panel stays in front, as its popup does */ }
+    else if (theirs(declaredPanel)) {
         manifest.side_panel = { ...manifest.side_panel, default_path: WALL_SIDE_PANEL };
         if (!(Array.isArray(manifest.permissions) && manifest.permissions.includes('sidePanel')))
             manifest.permissions = add(manifest.permissions, 'sidePanel');
         did.push(`the Wall's side panel in front of ${declaredPanel}: the same as the popup, at the panel's width`);
     }
     // Firefox's sidebar, when it names the same page — one that names another is left alone rather than pointed elsewhere.
-    if (theirs(declaredSidebar) && (!declaredPanel || declaredSidebar === declaredPanel)) {
+    if (!o.ownInFront && theirs(declaredSidebar) && (!declaredPanel || declaredSidebar === declaredPanel)) {
         manifest.sidebar_action = { ...manifest.sidebar_action, default_panel: WALL_SIDE_PANEL };
         did.push(`the Wall's side panel in front of ${declaredSidebar} in Firefox's sidebar_action too`);
     }
@@ -78,5 +98,5 @@ export function wireManifest(input, o) {
     else {
         ownWorker = { file: named, classic: manifest.background?.type !== 'module' };
     }
-    return { manifest, did, writeWorker, ownWorker, appPopup, appSidePanel, manifestKey };
+    return { manifest, did, writeWorker, ownWorker, appPopup, appSidePanel, manifestKey, ownPopup, ownSidePanel };
 }

package/lib/mcp.js

@@ -0,0 +1,236 @@
+// `toolaby mcp`: the Wall for coding agents, as a Model Context Protocol server on stdio.
+//
+// An agent (Claude Code, Cursor, Codex, any MCP client) starts it — `claude mcp add toolaby -- npx -y toolaby mcp` —
+// and gets tools to read and change the developer's tools on the Wall: what the Free plan holds, features, plans,
+// grants, and the docs. It acts with the session `toolaby login` stored, on Test unless started with --live, through
+// the same routes and the same checks as the dashboard.
+//
+// The protocol is the part of MCP a tools server needs, written here: newline-delimited JSON-RPC 2.0 on stdin and
+// stdout — initialize, ping, tools/list, tools/call. The official SDK brings seventeen packages (an HTTP server among
+// them) to a command line that has none and that the Wall also serves as one tarball; this is the stdio transport and
+// the tools capability exactly as the specification words them. Nothing but protocol messages goes to stdout.
+
+const PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'];
+
+/** The tools, with JSON Schema for their arguments, and what each calls on the Wall. */
+function toolsFor(side) {
+  const tool = { type: 'string', description: 'The tool id, as `toolaby_list_tools` gives it (like "acme--word-counter").' };
+  return [
+    {
+      name: 'toolaby_whoami',
+      title: 'Who is signed in',
+      description: `The developer signed in to the ${side} Wall, and their workspaces.`,
+      inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+      run: (_a, api) => api('/api/cli/me'),
+    },
+    {
+      name: 'toolaby_list_tools',
+      title: 'List tools',
+      description: `Every tool in the developer's workspaces on the ${side} Wall, with the id the other tools take.`,
+      inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+      run: (_a, api) => api('/api/cli/tools'),
+    },
+    {
+      name: 'toolaby_get_tool',
+      title: 'Read a tool',
+      description: `One tool on the ${side} Wall: what the Free plan holds (freePlan.holds, in a sentence), its features, its plans with what each unlocks, its tool key, and its extension: identityId is the id of every copy whose manifest has the tool's key (such a copy needs no binding, so boundId stays null), checkedInAt says whether one has checked in, inUse which builds. Then the addresses of its pages.`,
+      inputSchema: { type: 'object', properties: { tool }, required: ['tool'], additionalProperties: false },
+      run: (a, api) => api(`/api/cli/tools/${encodeURIComponent(a.tool)}`),
+    },
+    {
+      name: 'toolaby_create_tool',
+      title: 'Create a tool',
+      description: `A new tool on the ${side} Wall. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx toolaby create <id>\` for a new one, \`npx toolaby wire <id>\` for an existing one.`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          name: { type: 'string', description: 'What buyers see, like "Word Counter".' },
+          id: { type: 'string', description: 'Optional: the id to use within the workspace, lower-case letters, digits and hyphens. Default: from the name.' },
+          tagline: { type: 'string', description: 'Optional: one line under the name on the checkout page.' },
+          workspace: { type: 'string', description: 'The workspace slug, when the developer has more than one.' },
+        },
+        required: ['name'],
+        additionalProperties: false,
+      },
+      run: (a, api) => api('/api/cli/tools', { method: 'POST', body: a }),
+    },
+    {
+      name: 'toolaby_set_access',
+      title: 'Set what the Free plan holds',
+      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx toolaby upgrade <id>` then writes the new one.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          tool,
+          access: { type: 'string', enum: ['open', 'free_uses', 'paid'] },
+          freeUses: { type: 'integer', minimum: 1, maximum: 1000, description: 'With "free_uses": how many per device.' },
+          signInRequired: { type: 'boolean' },
+        },
+        required: ['tool', 'access'],
+        additionalProperties: false,
+      },
+      run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/access`, { method: 'POST', body: rest }),
+    },
+    {
+      name: 'toolaby_set_features',
+      title: 'Set features, and the plans that unlock them',
+      description: 'The tool\'s whole feature list (it replaces the current one: send the features it has too), and which plans unlock which. A feature\'s key is what the extension passes to gate({ feature }) and has(). A feature marked free is on the Free plan too; one that is not free and that no plan unlocks is refused to everyone. The plans must exist first (toolaby_add_plan); a plan not named in `plans` keeps what it unlocks.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          tool,
+          features: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                key: { type: 'string', description: 'Lower-case letters, digits and hyphens, like "export".' },
+                name: { type: 'string', description: 'What buyers see, like "Export to CSV".' },
+                blurb: { type: 'string', description: 'Optional: one sentence the paywall shows.' },
+                free: { type: 'boolean', description: 'On the Free plan too.' },
+              },
+              required: ['key', 'name'],
+              additionalProperties: false,
+            },
+          },
+          plans: {
+            type: 'array',
+            description: 'Optional: for each plan id (see toolaby_get_tool), the feature keys it unlocks.',
+            items: { type: 'object', properties: { id: { type: 'string' }, features: { type: 'array', items: { type: 'string' } } }, required: ['id', 'features'], additionalProperties: false },
+          },
+        },
+        required: ['tool', 'features'],
+        additionalProperties: false,
+      },
+      run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/features`, { method: 'POST', body: rest }),
+    },
+    {
+      name: 'toolaby_add_plan',
+      title: 'Add a plan',
+      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx toolaby upgrade <id>\` then writes the new one.`,
+      inputSchema: {
+        type: 'object',
+        properties: {
+          tool,
+          billing: { type: 'string', enum: ['one_time', 'subscription'] },
+          interval: { type: 'string', enum: ['month', 'year'], description: 'Subscriptions only.' },
+          amount: { type: 'number', minimum: 0.5, description: 'In the currency\'s main unit, like 9.99.' },
+          currency: { type: 'string', description: 'Three letters, like "usd" or "eur".' },
+          name: { type: 'string', description: 'Optional: the plan\'s name, like "Pro". Two plans with one name unlock the same features.' },
+          trialDays: { type: 'integer', minimum: 0, maximum: 365, description: 'Subscriptions only: a free trial.' },
+          devices: { type: 'integer', minimum: 1, maximum: 10, description: 'Optional: devices one buyer may use it on at once.' },
+          perSeat: { type: 'boolean', description: 'Optional: sold per seat, to teams.' },
+        },
+        required: ['tool', 'billing', 'amount', 'currency'],
+        additionalProperties: false,
+      },
+      run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/plans`, { method: 'POST', body: rest }),
+    },
+    {
+      name: 'toolaby_grant',
+      title: 'Grant access',
+      description: 'Access to the tool without paying: to test a paid feature on Test, or for a reviewer. An address with no account gets one; the grant applies once that person signs in to the extension with it (the link arrives by email), so testing a paid feature this way needs a person for a moment. For a number of days, or until revoked. On the Free plan a workspace holds 100 grants and other passes at once.',
+      inputSchema: {
+        type: 'object',
+        properties: { tool, email: { type: 'string' }, days: { type: 'integer', minimum: 1, maximum: 3650, description: 'Optional: how long. Default: until revoked.' } },
+        required: ['tool', 'email'],
+        additionalProperties: false,
+      },
+      run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/grants`, { method: 'POST', body: rest }),
+    },
+    {
+      name: 'toolaby_docs',
+      title: 'Read the docs',
+      description: 'The Wall\'s docs as Markdown. Without a page: the index, every page with what it covers. With a page (like "gating", "pricing", "reference/client"): that page.',
+      inputSchema: { type: 'object', properties: { page: { type: 'string' } }, additionalProperties: false },
+      run: (a, _api, docs) => docs(a.page),
+    },
+  ];
+}
+
+/** What a call answers, as MCP content: the Wall's JSON as text, and as structured content. */
+function resultOf(res) {
+  const body = res.json ?? {};
+  if (res.ok) return { content: [{ type: 'text', text: typeof res.text === 'string' ? res.text : JSON.stringify(body, null, 2) }], ...(typeof res.text === 'string' ? {} : { structuredContent: body }) };
+  const why = body.message ?? body.error ?? `The Wall answered HTTP ${res.status}.`;
+  return { content: [{ type: 'text', text: why }], isError: true };
+}
+
+/**
+ * Runs the server until stdin closes. `api(path, { method, body })` answers `{ ok, status, json }` with the stored
+ * session; `token()` says whether there is one.
+ */
+export function runMcp({ version, side, wall, api, token }) {
+  const tools = toolsFor(side);
+  const send = (msg) => process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', ...msg })}\n`);
+  const log = (s) => process.stderr.write(`[toolaby mcp] ${s}\n`);
+  const docs = async (page) => {
+    const clean = typeof page === 'string' ? page.replace(/^\/+|\.md$|\/+$/g, '').replace(/^docs\//, '') : '';
+    if (clean && !/^[a-z0-9-]+(\/[a-z0-9-]+)*$/.test(clean)) return { ok: false, status: 400, json: { message: 'A page is a path like "gating" or "reference/client".' } };
+    const url = clean ? `${wall}/docs/${clean}.md` : `${wall}/llms.txt`;
+    const res = await fetch(url).catch((e) => ({ ok: false, status: 0, text: async () => e.message }));
+    const text = await res.text();
+    return res.ok ? { ok: true, status: res.status, text } : { ok: false, status: res.status, json: { message: res.status === 404 ? `No docs page "${clean}". Call toolaby_docs without a page for the index.` : `The docs answered HTTP ${res.status}.` } };
+  };
+  const call = async (name, args) => {
+    const t = tools.find((x) => x.name === name);
+    if (!t) return { error: { code: -32602, message: `Unknown tool: ${name}` } };
+    if (name !== 'toolaby_docs' && !token()) {
+      return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx toolaby login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
+    }
+    try {
+      return { result: resultOf(await t.run(args ?? {}, api, docs)) };
+    } catch (e) {
+      return { result: { content: [{ type: 'text', text: e instanceof Error ? e.message : String(e) }], isError: true } };
+    }
+  };
+  const handle = async (msg) => {
+    if (!msg || msg.jsonrpc !== '2.0' || typeof msg.method !== 'string') {
+      if (msg && 'id' in msg && !('method' in msg)) return; // a response to nothing we asked: ignored
+      return send({ id: msg?.id ?? null, error: { code: -32600, message: 'Invalid request' } });
+    }
+    const isRequest = 'id' in msg;
+    switch (msg.method) {
+      case 'initialize': {
+        const asked = msg.params?.protocolVersion;
+        return send({ id: msg.id, result: {
+          protocolVersion: PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: 'toolaby', title: 'Toolaby Wall', version },
+          instructions: `The Toolaby Wall (${side}, ${wall}): accounts, licences, subscriptions and the paywall for Chrome extensions. Read a tool with toolaby_get_tool before changing it; the extension gates paid work with toolaby.gate({ feature }) and each feature key must exist on the tool (toolaby_set_features). Wire files with the shell: npx toolaby create|wire|upgrade <id>, check with npx toolaby check. toolaby_docs reads the docs.`,
+        } });
+      }
+      case 'notifications/initialized':
+      case 'notifications/cancelled':
+        return;
+      case 'ping':
+        return isRequest ? send({ id: msg.id, result: {} }) : undefined;
+      case 'tools/list':
+        return send({ id: msg.id, result: { tools: tools.map(({ run: _run, ...t }) => t) } });
+      case 'tools/call': {
+        const out = await call(msg.params?.name, msg.params?.arguments);
+        return send({ id: msg.id, ...out });
+      }
+      default:
+        return isRequest ? send({ id: msg.id, error: { code: -32601, message: `Method not found: ${msg.method}` } }) : undefined;
+    }
+  };
+
+  log(`${side} · ${wall} · ${token() ? 'signed in' : 'not signed in: tools ask for `npx toolaby login`'}`);
+  let buffer = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk) => {
+    buffer += chunk;
+    let at;
+    while ((at = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, at).trim();
+      buffer = buffer.slice(at + 1);
+      if (!line) continue;
+      let msg;
+      try { msg = JSON.parse(line); } catch { send({ id: null, error: { code: -32700, message: 'Parse error' } }); continue; }
+      // A batch (the 2025-03-26 revision allowed them): each message on its own.
+      for (const m of Array.isArray(msg) ? msg : [msg]) handle(m).catch((e) => log(e instanceof Error ? e.stack ?? e.message : String(e)));
+    }
+  });
+  process.stdin.on('end', () => process.exit(0));
+}

package/lib/project.js

@@ -9,15 +9,27 @@ export const MANIFEST_HELPER = ['toolaby.manifest.js', 'toolaby.manifest.d.ts'];
 export const POPUP_FILES = ['toolaby-popup.html', 'toolaby-popup.js'];
 /** The Wall's side panel: the same page at the panel's width, the same two files. */
 export const SIDE_PANEL_FILES = ['toolaby-sidepanel.html', 'toolaby-sidepanel.js'];
+/** What a coding agent reads, at the project's root: the guide to the wiring, and the skill where Claude Code finds skills (wiring/agents). Rewritten by every wiring. */
+export const AGENT_FILES = [
+    { name: 'TOOLABY.md', path: 'TOOLABY.md' },
+    { name: 'SKILL.md', path: '.claude/skills/toolaby/SKILL.md' },
+];
+/** Written only where the project has none: AGENTS.md, which every coding agent reads, and CLAUDE.md, which reads it for Claude Code. */
+export const AGENT_ENTRY_FILES = ['AGENTS.md', 'CLAUDE.md'];
 /** What earlier wirings wrote and this one does not: an upgrade takes them away, wherever a wiring put them. */
 export const STALE_FILES = ['toolaby-client.module.js', 'paywall.js', 'paywall.css', 'toolaby-popup.css', 'toolaby-account.js'];
-/** Every file a wiring writes, with its path: the code files, and — with a popup or a side panel to stand in front of — the Wall's shell for it. */
-export const filesToWrite = (p, appPopup, appSidePanel = null) => [
+/**
+ * Every file a wiring writes, with its path: the code files, and — for a popup or a side panel — the Wall's page for it:
+ * in front of the extension's (`appPopup`), or beside it when the extension's own page draws the panel (`own`), where
+ * showPaywall() opens it.
+ */
+export const filesToWrite = (p, appPopup, appSidePanel = null, own = {}) => [
     ...CODE_FILES.map((f) => `${p.codeDir}${f}`),
     ...(p.manifestFile ? [] : MANIFEST_HELPER.map((f) => `${p.codeDir}${f}`)),
-    ...(appPopup ? POPUP_FILES.map((f) => `${p.popupDir}${f}`) : []),
-    ...(appSidePanel ? SIDE_PANEL_FILES.map((f) => `${p.popupDir}${f}`) : []),
+    ...(appPopup || own.popup ? POPUP_FILES.map((f) => `${p.popupDir}${f}`) : []),
+    ...(appSidePanel || own.sidePanel ? SIDE_PANEL_FILES.map((f) => `${p.popupDir}${f}`) : []),
     ...(p.extraFiles ?? []).map((f) => f.to),
+    ...AGENT_FILES.map((f) => f.path),
 ];
 export const SURFACES = ['both', 'popup', 'side-panel', 'none'];
 export const surfacesOf = (v) => SURFACES.includes(v ?? '') ? v : 'both';
@@ -34,6 +46,8 @@ export const scaffoldFilesFor = (s, all) => all.filter((f) => (f === 'popup.html
  */
 export function scaffoldManifest(manifest, wrote) {
     const out = { ...manifest };
+    if (wrote.key && typeof out.key !== 'string')
+        out.key = wrote.key;
     if (wrote.popup === false) {
         const action = { ...out.action };
         delete action.default_popup;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "toolaby",
-  "version": "1.4.5",
-  "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one.",
+  "version": "1.6.0",
+  "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {
     "toolaby": "bin.mjs"
@@ -11,6 +11,9 @@
     "lib",
     "README.md"
   ],
+  "scripts": {
+    "test": "node --test"
+  },
   "engines": {
     "node": ">=18"
   },