toolaby 1.6.0 → 1.6.1

package/README.md

@@ -12,7 +12,7 @@ Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`
 
 ## What it does
 
-**`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there — as the account the dashboard is signed in to — and the command is signed in as that account from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on that account's own tools.
+**`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there — as the account the dashboard is signed in to — and the command is signed in as that account from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on that account's own tools. It opens only the Wall's own page, over https (or on `localhost`, for a Wall on your machine); any other address is refused and nothing is signed in.
 
 **`toolaby wire <tool-id>`**, run in your extension's folder, wires that extension to your tool:
 
@@ -24,7 +24,7 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `*.env`, `credentials.json`, source maps) are left out and named; `--allow-private` packs them. Dotfiles and links that lead out of the folder are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 
@@ -33,4 +33,6 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 - Your session: `~/.config/toolaby/credentials.json`, readable by you alone (mode 600). `toolaby logout` deletes it after revoking it.
 - The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names any other Wall.
 
+`wire` and `create` write only inside the folder they work on, and never through a symbolic link. A manifest, a framework's config or a Wall that names a place outside it (`../`, an absolute path, a link) is refused before anything is written. `create` writes only the files it knows a new extension has.
+
 The files the command writes into your extension contain nothing secret: your tool's id, your Wall's address and the *public* key your extension verifies licences with — the same things every copy of your extension carries once it is published.

package/bin.mjs

@@ -29,8 +29,8 @@
 // The wiring rules — what a folder is and what its manifest needs — are the
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
-import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, chmodSync, unlinkSync } from 'node:fs';
-import { join, resolve, dirname, relative, basename } from 'node:path';
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync } from 'node:fs';
+import { join, resolve, dirname, relative, basename, sep } from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
@@ -39,8 +39,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
+import { inside, signInPage, opener, privateKind, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.0';
+const VERSION = '1.6.1';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -81,8 +82,9 @@ async function api(path, { method = 'GET', body, token = storedToken(), raw = fa
 }
 
 // ── login: RFC 8628, the way GitHub's and Stripe's command lines sign in ─────────────────────────────────────────────
+/** Opens the page, never through a shell (lib/safe.js); only a page signInPage() let through gets here. */
 function openBrowser(url) {
-  const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] : ['xdg-open', [url]];
+  const [cmd, args] = opener(process.platform, url);
   try { spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => {}).unref(); } catch { /* the URL is printed anyway */ }
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -92,7 +94,10 @@ async function login() {
   if (!start.ok || !start.json.device_code) fail(`The Wall at ${wall} did not start a sign-in (HTTP ${start.status}). Is the address right? --wall names another.`);
   const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
   const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
-  const page = link.startsWith('http') ? link : `${wall}${link}`;
+  // The Wall's own page, over https (http on this machine), or nothing opened and nothing signed in: an address the
+  // Wall hands over is opened on this computer, and a file: or another site's page opens whatever it names.
+  const page = signInPage(link, wall);
+  if (!page) fail(`The Wall at ${wall} gave ${JSON.stringify(String(link).slice(0, 200))} as its sign-in page, which is not its own address over https.\n  It was not opened, and nothing was signed in.`);
   out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
   openBrowser(page);
   let every = Math.max(1, Number(interval) || 5) * 1000;
@@ -176,6 +181,24 @@ const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8'))
 /** Whether a background already starts the platform, outside its comments: then it needs no lines added. */
 const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readFileSync(path, 'utf8').replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
 const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
+/** Whether anything is at the path, a link to nowhere included (existsSync follows a link, and says no for a dangling one). */
+const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
+
+/**
+ * Where each path lands in `root`, every one settled before the first is written: inside the folder and through no
+ * symbolic link (lib/safe.js), or a refusal and nothing written. What a manifest, a framework's config or the Wall
+ * names is theirs to say; where it is written is this command's. `named` says where a path came from, for the refusal.
+ */
+function placesIn(root, paths, named = {}) {
+  const at = {}; const refused = [];
+  for (const rel of new Set(paths)) {
+    const r = inside(root, rel);
+    if (r.why) refused.push(`${JSON.stringify(rel)}${named[rel] ? ` (${named[rel]})` : ''}: ${r.why}`);
+    else at[rel] = r.path;
+  }
+  if (refused.length) fail(`Refused:\n\n${refused.map((r) => `    ${r}`).join('\n')}\n\n  This command writes only inside ${root}, and never through a symbolic link. Nothing was written.`);
+  return at;
+}
 
 /** The tool's files from the Wall, as the signed-in developer: a tool of theirs, or a clear no. */
 async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
@@ -222,9 +245,19 @@ async function wire() {
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
   const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
+  // AGENTS.md and CLAUDE.md, for coding agents, only where the project has none: its own are never replaced.
+  const entries = AGENT_ENTRY_FILES.filter((f) => !has(f) && typeof plan.files[f] === 'string');
+  // What an earlier wiring wrote and this one does not, wherever it put them: taken away, so nothing stale is shipped.
+  const stale = [...new Set([project.codeDir, project.popupDir, 'public/', 'src/public/'])].flatMap((under) => STALE_FILES.map((f) => `${under}${f}`)).filter((p) => existsSync(join(dir, p)));
+  // The background a manifest names and that is not there is written — at the name the manifest gives, which is the repository's to choose.
+  const worker = wiring ? wiring.writeWorker : project.createWorker?.file ?? null;
+  const at = placesIn(dir, [...targets, ...entries, ...stale, ...(worker ? [worker] : []), ...(wiring?.did.length ? ['manifest.json'] : [])], worker ? { [worker]: 'the background the manifest names' } : {});
+  // Taken for missing, it may only be out of the listing's sight — spelt "./background.js", in dist/, or deeper down:
+  // the developer's own background is never replaced by two lines of ours.
+  if (worker && there(at[worker])) fail(`${JSON.stringify(worker)}, the background the manifest names, is already in ${dir}; it would have been replaced. Nothing was written.\n  Name it in the manifest as the folder spells it — or, if a build writes it, run this with --into the folder whose manifest.json names it.`);
   const present = targets.filter((f) => existsSync(join(dir, f)));
   if (present.length && !flag('--force')) fail(`${present.join(', ')} already in ${dir}; add --force to replace them.`);
-  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
+  const write = (rel, content) => { mkdirSync(dirname(at[rel]), { recursive: true }); writeFileSync(at[rel], content); };
   // A command older than the Wall asks for files the Wall no longer hands out: said, with the way to the current one, rather than a crash.
   // The agent files come from Walls that write them; one that does not is older, not newer, than this command.
   const agentPaths = new Set(AGENT_FILES.map((f) => f.path));
@@ -232,12 +265,9 @@ async function wire() {
   if (missing.length) fail(`This command (${VERSION}) is older than the Wall at ${wall}: it expects ${missing.join(', ')}, which the Wall no longer hands out.\n  Update it: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz ${command} ${slug}`);
   const wrote = targets.filter((path) => typeof plan.files[path.split('/').pop()] === 'string');
   for (const path of wrote) write(path, fillPages(plan.files[path.split('/').pop()], { appPopup, appSidePanel }));
-  // AGENTS.md and CLAUDE.md, for coding agents, only where the project has none: its own are never replaced.
-  for (const f of AGENT_ENTRY_FILES) if (!has(f) && typeof plan.files[f] === 'string') { write(f, plan.files[f]); wrote.push(f); }
+  for (const f of entries) { write(f, plan.files[f]); wrote.push(f); }
   const ownAgents = has('AGENTS.md') && !readFileSync(join(dir, 'AGENTS.md'), 'utf8').includes('TOOLABY.md');
-  // What an earlier wiring wrote and this one does not, wherever it put them: taken away, so nothing stale is shipped.
-  const removed = [];
-  for (const at of new Set([project.codeDir, project.popupDir, 'public/', 'src/public/'])) for (const f of STALE_FILES) { const p = join(dir, `${at}${f}`); if (existsSync(p)) { unlinkSync(p); removed.push(`${at}${f}`); } }
+  for (const p of stale) unlinkSync(at[p]);
   const did = [];
   let ownWorker = null;
   if (wiring) {
@@ -256,7 +286,7 @@ async function wire() {
   out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
   out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
   if (ownAgents) out('  Your AGENTS.md is your own: add a line so coding agents find the Wall\'s guide — "Before changing anything paid, read TOOLABY.md."\n');
-  if (removed.length) out(`  Removed: ${removed.join(', ')} — earlier files, now inside toolaby.js.\n`);
+  if (stale.length) out(`  Removed: ${stale.join(', ')} — earlier files, now inside toolaby.js.\n`);
   for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (project.built) out(`  ${BUILD_COPY_NOTE}\n`);
@@ -271,34 +301,41 @@ async function create() {
   const slug = positional[0];
   if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
-  if (existsSync(dir)) fail(`${dir} already exists`);
+  if (there(dir)) fail(`${dir} already exists`);
   // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
   const asked = opt('--surfaces');
   if (asked && !SURFACES.includes(asked)) fail(`--surfaces takes ${SURFACES.join(', ')} — not "${asked}".`);
   const surfaces = surfacesOf(asked);
   const plan = await filesFor(slug, true, null, surfaces);
-  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
-  // The scaffold's own files as the Wall names them (older Walls did not, hence the list): a Wall that adds one to the
-  // minimal extension is written by this command too, instead of a manifest naming a file that never arrived.
-  const scaffold = Array.isArray(plan.scaffold) && plan.scaffold.length ? plan.scaffold : ['manifest.json', 'background.js', 'popup.html', 'sidepanel.html', 'popup.css', 'popup.js', 'README.md'];
+  // The scaffold's own files as the Wall names them (older Walls did not, hence the list), and only names this command
+  // knows (lib/safe.js): the Wall's list says which files a new extension has, never where they go. A name joined to
+  // the folder as it came let a Wall at another address — --wall, TOOLABY_WALL — write any file, anywhere.
+  const scaffold = Array.isArray(plan.scaffold) && plan.scaffold.length ? plan.scaffold : SCAFFOLD_FILES;
+  const unknown = scaffold.filter((f) => !SCAFFOLD_FILES.includes(f));
+  if (unknown.length) fail(`The Wall at ${wall} named ${unknown.map((f) => JSON.stringify(f)).join(', ')} among a new extension's files: not ${unknown.length > 1 ? 'files' : 'a file'} this command (${VERSION}) writes.\n  Nothing was written. If the Wall is newer than this command, update it: npm install -g toolaby@latest`);
   // Both surfaces (the default), one of them, or none at all for a tool that works from the background — and beside each,
   // the Wall's page for it, which toolaby.showPaywall() opens when an action is refused (the extension's own pages stay in front).
   const wanted = [...CODE_FILES, ...scaffoldFilesFor(surfaces, scaffold), ...(hasPopup(surfaces) ? POPUP_FILES : []), ...(hasSidePanel(surfaces) ? SIDE_PANEL_FILES : [])];
   const absent = wanted.filter((f) => typeof plan.files[f] !== 'string');
   if (absent.length) fail(`The Wall at ${wall} named ${absent.join(', ')} for a new extension but did not hand ${absent.length > 1 ? 'them' : 'it'} over.\n  Nothing was written. Update this command: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz create ${slug}`);
+  // What a coding agent reads: the guide with this tool's features and plans, the skill, AGENTS.md and CLAUDE.md.
+  const agentFiles = AGENT_FILES.filter((f) => typeof plan.files[f.name] === 'string');
+  const entries = AGENT_ENTRY_FILES.filter((f) => typeof plan.files[f] === 'string');
+  const icons = [16, 48, 128].map((s) => `icons/icon${s}.png`);
+  const at = placesIn(dir, [...wanted, 'manifest.json', ...icons, ...agentFiles.map((f) => f.path), ...entries]);
+  const write = (rel, content) => { mkdirSync(dirname(at[rel]), { recursive: true }); writeFileSync(at[rel], content); };
   // Both surfaces, and the panel drawn inside them: no page of the Wall's stands in front, so both names stay empty.
   for (const f of wanted) write(f, fillPages(plan.files[f]));
   // The manifest names the side panel only now that the page is beside it — an extension whose side_panel points at a
   // missing file does not load at all, so a Wall that stops serving the page must not leave the key behind either.
   // The extension's identity too: every copy gets the id the tool key is bound to, wherever its folder is.
-  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
-  for (const s of [16, 48, 128]) {
-    const res = await fetch(`${wall}/boilerplate/icons/icon${s}.png`);
-    write(join('icons', `icon${s}.png`), Buffer.from(await res.arrayBuffer()));
+  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(at['manifest.json'], 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
+  for (const icon of icons) {
+    const res = await fetch(`${wall}/boilerplate/${icon}`);
+    write(icon, Buffer.from(await res.arrayBuffer()));
   }
-  // What a coding agent reads: the guide with this tool's features and plans, the skill, AGENTS.md and CLAUDE.md.
-  for (const f of AGENT_FILES) if (typeof plan.files[f.name] === 'string') write(f.path, plan.files[f.name]);
-  for (const f of AGENT_ENTRY_FILES) if (typeof plan.files[f] === 'string') write(f, plan.files[f]);
+  for (const f of agentFiles) write(f.path, plan.files[f.name]);
+  for (const f of entries) write(f, plan.files[f]);
   const clicking = { both: 'Click the icon: the popup shows what the Free plan holds. Open side panel, in it, is the same page at the panel\'s width', popup: 'Click the icon: the popup shows what the Free plan holds', 'side-panel': 'Click the icon: the side panel opens — it has no popup, so the click is the panel\'s', none: 'No popup and no side panel: nothing opens on a click. Your code says when to sell — toolaby.openPaymentPage()' }[surfaces];
   out(`\n  ${plan.name} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${plan.buyer ?? `${plan.site}/tools/${slug}`}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
   if (typeof plan.files['TOOLABY.md'] === 'string') out(`  With a coding agent: AGENTS.md and TOOLABY.md tell it how this extension sells. For Claude Code, the Wall itself:\n    claude mcp add toolaby -- npx -y toolaby@latest mcp${live ? ' --live' : ''}\n`);
@@ -393,7 +430,8 @@ async function webhooks() {
 // package and any key but the item's own in an update, and it keeps the id it gave the item either way — the Wall
 // admits that id once the listing's address is on the tool. It refuses a build that would sell on Test (a tk_test_
 // or tk_dev_ key inside) or that points at this machine (localhost in the manifest), the two mistakes a store build
-// can ship with. Nothing is sent anywhere: it reads the folder and writes one file.
+// can ship with. What looks private — a key, an environment file, a source map — is left out and named, and so is a
+// link out of the folder: a store zip is public. Nothing is sent anywhere: it reads the folder and writes one file.
 const BUILD_DIRS = ['.', '.output/chrome-mv3', 'dist', 'build/chrome-mv3-prod', 'build'];
 const TOOL_KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/g;
 const LOCAL = /^(https?|wss?):\/\/(localhost|127\.0\.0\.1|\[::1\]|[^/]*\.localhost)(:\d+)?\//i;
@@ -429,17 +467,30 @@ function zipOf(entries) {
   return Buffer.concat([...locals, cd, end]);
 }
 
+/**
+ * What goes in the zip: every file in the folder but dotfiles, node_modules and zips — and, left out with the reason,
+ * a file that looks private (lib/safe.js), which --allow-private packs anyway, and a link that leads out of the folder
+ * or to nothing, which is never packed: a link in a cloned repository can put ~/.ssh/id_rsa in a store zip as logo.png.
+ * A zip is public once the store serves it. A folder reached twice through links is walked once.
+ */
 function filesIn(root) {
-  const found = [];
+  const top = realpathSync(root);
+  const found = []; const left = []; const walked = new Set([top]);
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
       const p = join(dir, name);
-      if (statSync(p).isDirectory()) walk(p); else found.push(p);
+      const rel = relative(root, p).split('\\').join('/');
+      let real = null; try { real = realpathSync(p); } catch { /* a link to nothing */ }
+      if (!real || (real !== top && !real.startsWith(top + sep))) { left.push([rel, real ? 'a link out of the folder' : 'a link to nothing']); continue; }
+      if (statSync(p).isDirectory()) { if (!walked.has(real)) { walked.add(real); walk(p); } continue; }
+      const why = privateKind(name);
+      if (why && !flag('--allow-private')) left.push([rel, why]);
+      else found.push(p);
     }
   };
   walk(root);
-  return found;
+  return { found, left };
 }
 
 function pack() {
@@ -449,7 +500,10 @@ function pack() {
   let manifest;
   try { manifest = JSON.parse(readFileSync(join(folder, 'manifest.json'), 'utf8')); } catch (e) { fail(`manifest.json does not parse: ${e.message}`); }
   if (!manifest.version) fail('manifest.json has no "version".');
-  const files = filesIn(folder);
+  // One to four numbers, as Chrome and the store take it — and a file name here: the zip is named with it, and a
+  // version with "../" in it put the zip outside the folder.
+  if (typeof manifest.version !== 'string' || !/^\d{1,5}(\.\d{1,5}){0,3}$/.test(manifest.version)) fail(`manifest.json's "version" is ${JSON.stringify(manifest.version)}: Chrome takes one to four numbers separated by dots, like 1.2.0.`);
+  const { found: files, left } = filesIn(folder);
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -488,6 +542,13 @@ function pack() {
   writeFileSync(target, zipOf(entries));
   const kb = (statSync(target).size / 1024).toFixed(0);
   out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
+  // What was left out, and why — or, asked for, what private file went in: a store zip is public.
+  const links = left.filter(([, why]) => why.startsWith('a link'));
+  const kept = left.filter(([, why]) => !why.startsWith('a link'));
+  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${f} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
+  if (links.length) out(`  Left out: ${links.map(([f, why]) => `${f} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
+  const privately = flag('--allow-private') ? files.map((f) => [relative(folder, f).split('\\').join('/'), privateKind(basename(f))]).filter(([, why]) => why) : [];
+  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${f} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
   if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
   out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
 }
@@ -517,6 +578,7 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
+                                       leaves out keys, .env files and source maps   --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:

package/lib/check.js

@@ -97,8 +97,8 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     const needed = (again.did ?? []).filter((d) => !/popup|side panel/i.test(d));
     if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
     else ok('The manifest has the permissions and host permissions the Wall needs.');
-    // The identity: without the `key`, each copy's id follows its folder, and the tool key opens for the first to connect only.
-    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and the tool key opens only for the first copy to connect. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx toolaby upgrade ${key.slug}\` adds it.`);
   } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
 
   // 5. The client, as fresh as the Wall's.

package/lib/safe.js

@@ -0,0 +1,86 @@
+// What this command will not do, whoever asks: write outside the project it was pointed at, write a file of a new
+// extension it does not know, open a sign-in page that is not the Wall's, or put a private file in a store zip.
+//
+// Each of these took someone else's word. A cloned repository's manifest named the file `wire` wrote — a service
+// worker at "../../.zshrc" overwrote the shell's startup file — and a link in the folder took a write wherever it
+// pointed. The Wall's list of a new extension's files was joined to the folder as it came, so a Wall at another
+// address (--wall, TOOLABY_WALL) could write any file with any content. And on Windows the sign-in address went
+// through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
+// command's own boundary, not a wiring rule the browser shares.
+import { lstatSync } from 'node:fs';
+import { isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
+
+/**
+ * The minimal extension's own files, as the Wall names them (SCAFFOLD_FILES in wall/src/packages/wiring/files.ts;
+ * a test keeps the two equal): the only names `create` accepts from the Wall's list, which says which of them to
+ * write and never where. A name the Wall adds later is refused by a command that predates it — nothing is written,
+ * and `npm install -g toolaby@latest` is the way on.
+ */
+export const SCAFFOLD_FILES = ['manifest.json', 'background.js', 'popup.html', 'sidepanel.html', 'popup.css', 'popup.js', 'README.md'];
+
+/**
+ * Where `rel` lands inside `root` — `{ path }` — or why it may not — `{ why }`. Refused: an absolute path, a `..`,
+ * a backslash on POSIX (there it is part of a name, not a separator), anything that resolves outside the folder,
+ * and a symbolic link at any step below the root, dangling or not: a link in a cloned repository points wherever
+ * its author chose, and writing through it writes there. The root itself is the developer's to choose.
+ */
+export function inside(root, rel) {
+  if (typeof rel !== 'string' || !rel.trim() || rel.includes('\0')) return { why: 'it is not a file name' };
+  if (isAbsolute(rel) || posix.isAbsolute(rel) || win32.isAbsolute(rel)) return { why: 'it is an absolute path' };
+  if (sep === '/' && rel.includes('\\')) return { why: 'it has a backslash in it' };
+  if (rel.split(/[\\/]/).includes('..')) return { why: 'it has ".." in it' };
+  const base = resolve(root);
+  const path = resolve(base, rel);
+  if (!path.startsWith(base + sep)) return { why: 'it is outside the folder' };
+  let at = base;
+  for (const part of relative(base, path).split(sep)) {
+    at = join(at, part);
+    let st;
+    try { st = lstatSync(at); } catch { break; } // not there yet, and so nothing below it is
+    if (st.isSymbolicLink()) return { why: `${relative(base, at).split(sep).join('/')} is a symbolic link` };
+  }
+  return { path };
+}
+
+const LOOPBACK = /^(localhost|127(\.\d{1,3}){3}|\[::1\])$|\.localhost$/i;
+
+/**
+ * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
+ * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
+ * http, or a scheme such as file: that opens whatever it names.
+ */
+export function signInPage(link, wall) {
+  if (typeof link !== 'string') return null;
+  let home; let page;
+  try { home = new URL(wall); page = new URL(link, home); } catch { return null; }
+  if (page.username || page.password) return null;
+  if (page.protocol === 'https:' && page.origin === home.origin) return page.href;
+  const web = page.protocol === 'http:' || page.protocol === 'https:';
+  return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;
+}
+
+/**
+ * How a page is opened on each platform, the address one argument and no shell in between. On Windows,
+ * `cmd /c start "" <url>` read an `&` in the address as a second command; rundll32 hands it to the default browser
+ * as it is.
+ */
+export function opener(platform, url) {
+  if (platform === 'darwin') return ['open', [url]];
+  if (platform === 'win32') return ['rundll32', ['url.dll,FileProtocolHandler', url]];
+  return ['xdg-open', [url]];
+}
+
+/**
+ * Why a file has no place in a store zip, or null: a private key or a keystore (Chrome's own "Pack extension" leaves
+ * the extension's .pem beside the folder, and it ends up inside), an environment file, a file of credentials by its
+ * name, or a source map, which carries the source. A store zip is public: anyone can download an item and unzip it.
+ * `pack` leaves these out and names them; --allow-private packs them. Dotfiles, .env among them, are never packed.
+ */
+export function privateKind(name) {
+  const n = name.toLowerCase();
+  if (/\.(pem|key|p12|pfx|p8|jks|keystore|ppk)$/.test(n) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(n)) return 'a private key';
+  if (/\.env(\.[^.]+)*$/.test(n)) return 'an environment file';
+  if (/^(credentials|secrets?|service[-_]?account[^/]*)\.json$/.test(n)) return 'credentials';
+  if (n.endsWith('.map')) return 'a source map';
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {