toolaby 1.6.0 → 1.6.2

package/README.md

@@ -12,7 +12,7 @@ Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`
 
 ## What it does
 
-**`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there — as the account the dashboard is signed in to — and the command is signed in as that account from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on that account's own tools.
+**`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there — as the account the dashboard is signed in to — and the command is signed in as that account from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on that account's own tools. It opens only the Wall's own page, over https (or on `localhost`, for a Wall on your machine); any other address is refused and nothing is signed in.
 
 **`toolaby wire <tool-id>`**, run in your extension's folder, wires that extension to your tool:
 
@@ -24,13 +24,15 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named; `--allow-private` packs them. Dotfiles and links that lead out of the folder are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 
 ## Where things live
 
 - Your session: `~/.config/toolaby/credentials.json`, readable by you alone (mode 600). `toolaby logout` deletes it after revoking it.
-- The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names any other Wall.
+- The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI), and is sent to one Wall only: Live (`toolaby.app`), or the one `TOOLABY_TOKEN_WALL` names — `TOOLABY_TOKEN_WALL=https://test.toolaby.app` for a Test session. If that Wall refuses it, the session `toolaby login` stored for that Wall is used instead. `TOOLABY_WALL` or `--wall <url>` names any other Wall.
+
+`wire` and `create` write only inside the folder they work on, and never through a symbolic link. A manifest, a framework's config or a Wall that names a place outside it (`../`, an absolute path, a link) is refused before anything is written. `create` writes only the files it knows a new extension has.
 
 The files the command writes into your extension contain nothing secret: your tool's id, your Wall's address and the *public* key your extension verifies licences with — the same things every copy of your extension carries once it is published.

package/bin.mjs

@@ -10,6 +10,7 @@
 //   toolaby mcp                       the Wall for coding agents: an MCP server on stdio (lib/mcp.js)
 //   toolaby webhooks events           the six events, with an example of each
 //   toolaby webhooks trigger <event>  send an example delivery: to your registered endpoints, or with --to straight to a local server
+//   toolaby webhooks secret           this machine's development secret, which --to signs with
 //   toolaby webhooks endpoints        the workspace's endpoints
 //   toolaby webhooks add <url>        register an endpoint; the secret is printed once
 //   toolaby webhooks remove <id>      remove one
@@ -23,14 +24,15 @@
 // session lives in ~/.config/toolaby/credentials.json (mode 600), one per
 // side; a command that needs one and has none signs you in on the spot.
 // `logout` revokes it on the server before forgetting it. TOOLABY_TOKEN
-// stands in for the file where there is no home (CI); TOOLABY_WALL or
-// `--wall <url>` names any other Wall (a laptop's, a self-hosted one).
+// stands in for the file where there is no home (CI), for one Wall alone:
+// Live, or the one TOOLABY_TOKEN_WALL names. TOOLABY_WALL or `--wall <url>`
+// names any other Wall (a laptop's, a self-hosted one).
 //
 // The wiring rules — what a folder is and what its manifest needs — are the
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
-import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, chmodSync, unlinkSync } from 'node:fs';
-import { join, resolve, dirname, relative, basename } from 'node:path';
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync, renameSync } from 'node:fs';
+import { join, resolve, dirname, relative, basename, sep } from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
@@ -39,8 +41,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
+import { inside, signInPage, opener, privateKind, privateContent, oneLine, fetchBounded, fetchHere, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.0';
+const VERSION = '1.6.2';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -52,11 +55,18 @@ const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[
 const flag = (k) => rest.includes(k) || (k === '--force' && command === 'upgrade');
 const WALLS = { test: 'https://test.toolaby.app', live: 'https://toolaby.app' };
 const live = flag('--live');
-const wall = (opt('--wall') ?? process.env.TOOLABY_WALL ?? (live ? WALLS.live : WALLS.test)).replace(/\/$/, '');
+// An address as fetch() reads it: a URL loses its tabs and line breaks when it is parsed, and kept in the name every
+// message prints, a --wall or a TOOLABY_WALL with one in it drew lines of its own (25 Sep 2026).
+const address = (s) => s.replace(/[\t\n\r]/g, '').replace(/\/$/, '');
+const wall = address(opt('--wall') ?? process.env.TOOLABY_WALL ?? (live ? WALLS.live : WALLS.test));
 /** The side, for every message: what a developer must never be unsure of. */
 const side = wall === WALLS.live ? 'Live' : wall === WALLS.test ? 'Test' : wall;
-const out = (s = '') => console.log(s);
-const fail = (s) => { console.error(`\n  ${s}\n`); process.exit(1); };
+// Every line leaves without terminal controls: names, paths and answers come from folders and servers this command does
+// not own, and one could clear the screen, draw a fake ✓ and hide what followed (25 Sep 2026). The command writes none,
+// nor any character that shows nothing — a zero width, a mark of direction, a filler — which could hide a word.
+const plain = (s) => String(s).replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u115f\u1160\u200b-\u200f\u2028-\u202e\u2060-\u2069\u2800\u3164\ufeff\uffa0]/g, '');
+const out = (s = '') => console.log(plain(s));
+const fail = (s) => { console.error(`\n  ${plain(s)}\n`); process.exit(1); };
 
 // ── The session: one per Wall, in the user's config, readable by them alone ─────────────────────────────────────────
 const CONFIG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'toolaby');
@@ -67,22 +77,38 @@ function writeCredentials(all) {
   writeFileSync(CREDENTIALS, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
   try { chmodSync(CREDENTIALS, 0o600); } catch { /* not every filesystem has modes */ }
 }
-const storedToken = () => process.env.TOOLABY_TOKEN || readCredentials()[wall]?.token || null;
+// TOOLABY_TOKEN goes to one Wall, the one it was made for: the one TOOLABY_TOKEN_WALL names, or — with none named —
+// Live. A --wall or a TOOLABY_WALL, which a cloned project's settings can set, once received it wherever it pointed,
+// and with no Wall named it went to Test and Live alike, so a CI job's Live session reached Test too (25 Sep 2026).
+// Refused there (401), it gives way to the session `toolaby login` stored for that Wall, and is not sent again.
+const tokenWall = address(process.env.TOOLABY_TOKEN_WALL || WALLS.live);
+let envRefused = false;
+const envToken = () => (process.env.TOOLABY_TOKEN && !envRefused && tokenWall === wall ? process.env.TOOLABY_TOKEN : null);
+const storedToken = () => envToken() || readCredentials()[wall]?.token || null;
+/** Said where a session is missing and TOOLABY_TOKEN is set: it is kept for another Wall, and a CI job should know. */
+const envElsewhere = () => (process.env.TOOLABY_TOKEN && !envRefused && !envToken() ? `\n  TOOLABY_TOKEN is sent to ${tokenWall} alone; TOOLABY_TOKEN_WALL=${wall} sends it here instead.` : '');
 
 async function api(path, { method = 'GET', body, token = storedToken(), raw = false } = {}) {
-  const res = await fetch(`${wall}${path}`, {
+  // Only the Wall answers for the Wall: a redirect elsewhere is refused (lib/safe.js).
+  const res = await fetchHere(`${wall}${path}`, {
     method,
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': `toolaby-cli/${VERSION}`, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
     body: body ? JSON.stringify(body) : undefined,
   }).catch((e) => { throw new Error(`Could not reach ${wall}: ${e.message}`); });
+  if (res.status === 401 && token && token === envToken()) {
+    envRefused = true;
+    const stored = storedToken();
+    if (stored && stored !== token) return api(path, { method, body, token: stored, raw });
+  }
   if (raw) return res;
   const json = await res.json().catch(() => ({}));
   return { status: res.status, ok: res.ok, json };
 }
 
 // ── login: RFC 8628, the way GitHub's and Stripe's command lines sign in ─────────────────────────────────────────────
+/** Opens the page, never through a shell (lib/safe.js); only a page signInPage() let through gets here. */
 function openBrowser(url) {
-  const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] : ['xdg-open', [url]];
+  const [cmd, args] = opener(process.platform, url);
   try { spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => {}).unref(); } catch { /* the URL is printed anyway */ }
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -92,8 +118,11 @@ async function login() {
   if (!start.ok || !start.json.device_code) fail(`The Wall at ${wall} did not start a sign-in (HTTP ${start.status}). Is the address right? --wall names another.`);
   const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
   const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
-  const page = link.startsWith('http') ? link : `${wall}${link}`;
-  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  // The Wall's own page, over https (http on this machine), or nothing opened and nothing signed in: an address the
+  // Wall hands over is opened on this computer, and a file: or another site's page opens whatever it names.
+  const page = signInPage(link, wall);
+  if (!page) fail(`The Wall at ${wall} gave ${JSON.stringify(String(link).slice(0, 200))} as its sign-in page, which is not its own address over https.\n  It was not opened, and nothing was signed in.`);
+  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
   openBrowser(page);
   let every = Math.max(1, Number(interval) || 5) * 1000;
   const until = Date.now() + Number(expires_in) * 1000;
@@ -109,44 +138,46 @@ async function login() {
       const all = readCredentials();
       all[wall] = { token, email, at: new Date().toISOString() };
       writeCredentials(all);
-      out(`\n\n  Signed in${email ? ` as ${email}` : ''} · ${side}.\n`);
+      out(`\n\n  Signed in${email ? ` as ${oneLine(email)}` : ''} · ${side}.\n`);
       return token;
     }
     const why = poll.json.error;
     if (why === 'slow_down') every += 5000;
     else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
     else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
-    else if (why && why !== 'authorization_pending') fail(`The Wall answered "${why}"${poll.json.error_description ? `: ${poll.json.error_description}` : ''}.`);
+    else if (why && why !== 'authorization_pending') fail(`The Wall answered "${oneLine(why)}"${poll.json.error_description ? `: ${oneLine(poll.json.error_description)}` : ''}.`);
   }
   fail('The code expired before it was approved. Run `toolaby login` again.');
 }
 
 /** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
 async function tokenOrLogin() {
-  return storedToken() ?? (await login());
+  const token = storedToken();
+  if (!token && envElsewhere()) out(envElsewhere());
+  return token ?? (await login());
 }
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.${envElsewhere()}`);
   const me = await api('/api/cli/me', { token });
   if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
-  out(`\n  ${me.json.email}  ·  ${side}  ·  ${wall}\n`);
-  for (const w of me.json.workspaces) out(`    ${w.name}  (${w.slug}, ${w.role})  ${w.site}`);
+  out(`\n  ${oneLine(me.json.email)}  ·  ${side}  ·  ${wall}\n`);
+  for (const w of me.json.workspaces) out(`    ${oneLine(w.name)}  (${oneLine(w.slug)}, ${oneLine(w.role)})  ${oneLine(w.site)}`);
   out();
 }
 
 async function logout() {
   const all = readCredentials();
   const entry = all[wall];
-  if (!entry && !process.env.TOOLABY_TOKEN) { out(`\n  Not signed in to ${side} (${wall}).\n`); return; }
+  if (!entry && !envToken()) { out(`\n  Not signed in to ${side} (${wall}).\n`); return; }
   // Revoked on the server first; forgotten here whatever the server said — but the difference is reported.
-  const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? process.env.TOOLABY_TOKEN }).catch(() => ({ ok: false, status: 0 }));
+  const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? envToken() }).catch(() => ({ ok: false, status: 0 }));
   delete all[wall];
   writeCredentials(all);
   out(res.ok ? `\n  Signed out of ${side} (${wall}): the session was revoked and forgotten.\n` : `\n  The session was forgotten here, but the Wall could not be reached to revoke it (HTTP ${res.status}); it expires on its own, or sign it out from the dashboard.\n`);
-  if (process.env.TOOLABY_TOKEN) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
+  if (envToken()) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
 }
 
 async function tools() {
@@ -156,7 +187,7 @@ async function tools() {
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
-  for (const t of res.json.tools) out(`    ${t.slug.padEnd(40)} ${t.name}${t.bundle ? '  (bundle)' : ''}   ${t.site}`);
+  for (const t of res.json.tools) out(`    ${oneLine(t.slug).padEnd(40)} ${oneLine(t.name)}${t.bundle ? '  (bundle)' : ''}   ${oneLine(t.site)}`);
   out();
 }
 
@@ -172,30 +203,56 @@ function listTree(dir, depth, prefix = '', acc = new Set()) {
   }
   return acc;
 }
-const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+const readJson = (path) => { try { return JSON.parse(readText(path)); } catch { return null; } };
+/** A project file's text, or `none` where it is no file to read (lib/safe.js readText): a link to a device reads as nothing. */
+const readOr = (path, none = null) => { try { return readText(path); } catch { return none; } };
 /** Whether a background already starts the platform, outside its comments: then it needs no lines added. */
-const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readFileSync(path, 'utf8').replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
+const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readText(path).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
 const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
+/** Whether anything is at the path, a link to nowhere included (existsSync follows a link, and says no for a dangling one). */
+const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
+
+/**
+ * Where each path lands in `root`, every one settled before the first is written: inside the folder and through no
+ * symbolic link (lib/safe.js), or a refusal and nothing written. What a manifest, a framework's config or the Wall
+ * names is theirs to say; where it is written is this command's. `named` says where a path came from, for the refusal.
+ */
+function placesIn(root, paths, named = {}) {
+  const at = {}; const refused = [];
+  for (const rel of new Set(paths)) {
+    const r = inside(root, rel);
+    if (r.why) refused.push(`${JSON.stringify(rel)}${named[rel] ? ` (${named[rel]})` : ''}: ${oneLine(r.why)}`);
+    else at[rel] = r.path;
+  }
+  if (refused.length) fail(`Refused:\n\n${refused.map((r) => `    ${r}`).join('\n')}\n\n  This command writes only inside ${root}, and never through a symbolic link. Nothing was written.`);
+  return at;
+}
 
 /** The tool's files from the Wall, as the signed-in developer: a tool of theirs, or a clear no. */
 async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
   const token = await tokenOrLogin();
   const q = new URLSearchParams(); if (scaffold) q.set('scaffold', '1'); if (manifestKey) q.set('manifestKey', manifestKey); if (surfaces) q.set('surfaces', surfaces);
+  // The folder's manifest names another extension than the tool's: switched only when asked (--adopt-key).
+  if (manifestKey && flag('--adopt-key')) q.set('adoptKey', '1');
   const res = await api(`/api/cli/wiring/${slug}${q.size ? `?${q}` : ''}`, { token });
   if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold, manifestKey, surfaces); }
+  if (res.status === 409 && res.json?.error === 'identity_conflict') {
+    const offered = oneLine(res.json.offered); const current = oneLine(res.json.current);
+    fail(`This folder's manifest names the extension ${offered}; ${slug} is bound to ${current}. Nothing was written.\n\n  Run it again with --adopt-key to make ${offered} the tool's extension: its key then works from that one, and ${current}'s copies are named no more.\n  Or take the key out of this folder's manifest, and the tool's own goes in.`);
+  }
   if (res.status === 404) {
     // Say who the command is: the tool may well exist — in a workspace of another account of theirs.
     const me = await api('/api/cli/me', { token }).catch(() => null);
-    const who = me?.ok ? `\n\n  You are signed in as ${me.json.email}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => w.slug).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`toolaby logout\`, sign in to the dashboard as that account, then run this again.` : '';
-    fail(`${res.json.message ?? `No tool "${slug}" in your workspaces.`}${who}`);
+    const who = me?.ok ? `\n\n  You are signed in as ${oneLine(me.json.email)}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => oneLine(w.slug)).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`toolaby logout\`, sign in to the dashboard as that account, then run this again.` : '';
+    fail(`${oneLine(res.json.message ?? `No tool "${slug}" in your workspaces.`)}${who}`);
   }
-  if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+  if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
   return res.json;
 }
 
 async function wire() {
   const slug = positional[0];
-  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `toolaby tools` lists your ids');
   const dir = resolve(opt('--into') ?? '.');
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
@@ -207,13 +264,13 @@ async function wire() {
   const site = plan.site;
   const manifestKey = plan.identity?.manifestKey ?? null;
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
-  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site, tree, manifestKey });
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readOr(join(dir, configSource)) : null, site, tree, manifestKey });
   // Nothing recognised: nothing is written and nothing guessed. A manifest below the top is where to point --into; otherwise the Set up page's Do it myself has the files and the three things to paste.
-  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${project.foundManifest}: run this with --into ${dirname(project.foundManifest) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
+  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${oneLine(project.foundManifest)}: run this with --into ${oneLine(dirname(project.foundManifest)) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
 
   // The extension's own popup and side panel: the manifest's, or — wired before — what the existing configuration remembers.
   const configPath = join(dir, `${project.codeDir}toolaby.config.js`);
-  const oldConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+  const oldConfig = existsSync(configPath) ? readOr(configPath, '') : '';
   const remembered = oldConfig.match(/appPopup:\s*'([^']*)'/)?.[1] || null;
   const rememberedSidePanel = oldConfig.match(/appSidePanel:\s*'([^']*)'/)?.[1] || null;
   // An extension whose own pages draw the panel — what `create` makes, or "your popup first" — keeps them in front.
@@ -222,9 +279,19 @@ async function wire() {
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
   const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
+  // AGENTS.md and CLAUDE.md, for coding agents, only where the project has none: its own are never replaced.
+  const entries = AGENT_ENTRY_FILES.filter((f) => !has(f) && typeof plan.files[f] === 'string');
+  // What an earlier wiring wrote and this one does not, wherever it put them: taken away, so nothing stale is shipped.
+  const stale = [...new Set([project.codeDir, project.popupDir, 'public/', 'src/public/'])].flatMap((under) => STALE_FILES.map((f) => `${under}${f}`)).filter((p) => existsSync(join(dir, p)));
+  // The background a manifest names and that is not there is written — at the name the manifest gives, which is the repository's to choose.
+  const worker = wiring ? wiring.writeWorker : project.createWorker?.file ?? null;
+  const at = placesIn(dir, [...targets, ...entries, ...stale, ...(worker ? [worker] : []), ...(wiring?.did.length ? ['manifest.json'] : [])], worker ? { [worker]: 'the background the manifest names' } : {});
+  // Taken for missing, it may only be out of the listing's sight — spelt "./background.js", in dist/, or deeper down:
+  // the developer's own background is never replaced by two lines of ours.
+  if (worker && there(at[worker])) fail(`${JSON.stringify(worker)}, the background the manifest names, is already in ${dir}; it would have been replaced. Nothing was written.\n  Name it in the manifest as the folder spells it — or, if a build writes it, run this with --into the folder whose manifest.json names it.`);
   const present = targets.filter((f) => existsSync(join(dir, f)));
   if (present.length && !flag('--force')) fail(`${present.join(', ')} already in ${dir}; add --force to replace them.`);
-  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
+  const write = (rel, content) => { mkdirSync(dirname(at[rel]), { recursive: true }); writeFileSync(at[rel], content); };
   // A command older than the Wall asks for files the Wall no longer hands out: said, with the way to the current one, rather than a crash.
   // The agent files come from Walls that write them; one that does not is older, not newer, than this command.
   const agentPaths = new Set(AGENT_FILES.map((f) => f.path));
@@ -232,12 +299,9 @@ async function wire() {
   if (missing.length) fail(`This command (${VERSION}) is older than the Wall at ${wall}: it expects ${missing.join(', ')}, which the Wall no longer hands out.\n  Update it: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz ${command} ${slug}`);
   const wrote = targets.filter((path) => typeof plan.files[path.split('/').pop()] === 'string');
   for (const path of wrote) write(path, fillPages(plan.files[path.split('/').pop()], { appPopup, appSidePanel }));
-  // AGENTS.md and CLAUDE.md, for coding agents, only where the project has none: its own are never replaced.
-  for (const f of AGENT_ENTRY_FILES) if (!has(f) && typeof plan.files[f] === 'string') { write(f, plan.files[f]); wrote.push(f); }
-  const ownAgents = has('AGENTS.md') && !readFileSync(join(dir, 'AGENTS.md'), 'utf8').includes('TOOLABY.md');
-  // What an earlier wiring wrote and this one does not, wherever it put them: taken away, so nothing stale is shipped.
-  const removed = [];
-  for (const at of new Set([project.codeDir, project.popupDir, 'public/', 'src/public/'])) for (const f of STALE_FILES) { const p = join(dir, `${at}${f}`); if (existsSync(p)) { unlinkSync(p); removed.push(`${at}${f}`); } }
+  for (const f of entries) { write(f, plan.files[f]); wrote.push(f); }
+  const ownAgents = has('AGENTS.md') && !readOr(join(dir, 'AGENTS.md'), '').includes('TOOLABY.md');
+  for (const p of stale) unlinkSync(at[p]);
   const did = [];
   let ownWorker = null;
   if (wiring) {
@@ -253,12 +317,13 @@ async function wire() {
     ownWorker = { file: project.worker, classic: false };
   }
 
-  out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
-  out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
+  out(`\n  ${oneLine(plan.name)} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
+  // Each thing done is a line, and names what the manifest and the Wall named: the popup, the background, the address.
+  out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.map(oneLine).join(',\n           ')}` : ''}.\n`);
   if (ownAgents) out('  Your AGENTS.md is your own: add a line so coding agents find the Wall\'s guide — "Before changing anything paid, read TOOLABY.md."\n');
-  if (removed.length) out(`  Removed: ${removed.join(', ')} — earlier files, now inside toolaby.js.\n`);
+  if (stale.length) out(`  Removed: ${stale.join(', ')} — earlier files, now inside toolaby.js.\n`);
   for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
-  if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
+  if (ownWorker) out(`  Your background, ${oneLine(ownWorker.file)}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (project.built) out(`  ${BUILD_COPY_NOTE}\n`);
   out(`  Next: ${project.kind === 'plain' && !project.built ? '' : 'build or start the dev server, then '}chrome://extensions → reload it. The tool's Set up page says "checked in" the moment it starts.`);
   if (project.note) out(`  ${project.note}\n`);
@@ -271,36 +336,49 @@ async function create() {
   const slug = positional[0];
   if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
-  if (existsSync(dir)) fail(`${dir} already exists`);
+  if (there(dir)) fail(`${dir} already exists`);
   // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
   const asked = opt('--surfaces');
   if (asked && !SURFACES.includes(asked)) fail(`--surfaces takes ${SURFACES.join(', ')} — not "${asked}".`);
   const surfaces = surfacesOf(asked);
   const plan = await filesFor(slug, true, null, surfaces);
-  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
-  // The scaffold's own files as the Wall names them (older Walls did not, hence the list): a Wall that adds one to the
-  // minimal extension is written by this command too, instead of a manifest naming a file that never arrived.
-  const scaffold = Array.isArray(plan.scaffold) && plan.scaffold.length ? plan.scaffold : ['manifest.json', 'background.js', 'popup.html', 'sidepanel.html', 'popup.css', 'popup.js', 'README.md'];
+  // The scaffold's own files as the Wall names them (older Walls did not, hence the list), and only names this command
+  // knows (lib/safe.js): the Wall's list says which files a new extension has, never where they go. A name joined to
+  // the folder as it came let a Wall at another address — --wall, TOOLABY_WALL — write any file, anywhere.
+  const scaffold = Array.isArray(plan.scaffold) && plan.scaffold.length ? plan.scaffold : SCAFFOLD_FILES;
+  const unknown = scaffold.filter((f) => !SCAFFOLD_FILES.includes(f));
+  if (unknown.length) fail(`The Wall at ${wall} named ${unknown.map((f) => JSON.stringify(f)).join(', ')} among a new extension's files: not ${unknown.length > 1 ? 'files' : 'a file'} this command (${VERSION}) writes.\n  Nothing was written. If the Wall is newer than this command, update it: npm install -g toolaby@latest`);
   // Both surfaces (the default), one of them, or none at all for a tool that works from the background — and beside each,
   // the Wall's page for it, which toolaby.showPaywall() opens when an action is refused (the extension's own pages stay in front).
   const wanted = [...CODE_FILES, ...scaffoldFilesFor(surfaces, scaffold), ...(hasPopup(surfaces) ? POPUP_FILES : []), ...(hasSidePanel(surfaces) ? SIDE_PANEL_FILES : [])];
   const absent = wanted.filter((f) => typeof plan.files[f] !== 'string');
   if (absent.length) fail(`The Wall at ${wall} named ${absent.join(', ')} for a new extension but did not hand ${absent.length > 1 ? 'them' : 'it'} over.\n  Nothing was written. Update this command: npm install -g toolaby@latest — or run the Wall's own copy: npx --yes ${wall}/toolaby.tgz create ${slug}`);
+  // What a coding agent reads: the guide with this tool's features and plans, the skill, AGENTS.md and CLAUDE.md.
+  const agentFiles = AGENT_FILES.filter((f) => typeof plan.files[f.name] === 'string');
+  const entries = AGENT_ENTRY_FILES.filter((f) => typeof plan.files[f] === 'string');
+  const icons = [16, 48, 128].map((s) => `icons/icon${s}.png`);
+  const at = placesIn(dir, [...wanted, 'manifest.json', ...icons, ...agentFiles.map((f) => f.path), ...entries]);
+  // The icons first, each within a megabyte and half a minute, and nothing written until they are in: a Wall at another
+  // address (--wall, TOOLABY_WALL) could send one without end, and the new folder took it until the disk was full
+  // (25 Sep 2026).
+  const iconBytes = {};
+  for (const icon of icons) {
+    const got = await fetchBounded(`${wall}/boilerplate/${icon}`).catch((e) => ({ why: e.name === 'TimeoutError' ? 'it took longer than 30 seconds' : oneLine(e.message) }));
+    if (got.why || !got.body) fail(`The Wall at ${wall} did not send ${icon}: ${got.why ?? 'it sent more than a megabyte, which no icon is'}. Nothing was written.`);
+    iconBytes[icon] = got.body;
+  }
+  const write = (rel, content) => { mkdirSync(dirname(at[rel]), { recursive: true }); writeFileSync(at[rel], content); };
   // Both surfaces, and the panel drawn inside them: no page of the Wall's stands in front, so both names stay empty.
   for (const f of wanted) write(f, fillPages(plan.files[f]));
   // The manifest names the side panel only now that the page is beside it — an extension whose side_panel points at a
   // missing file does not load at all, so a Wall that stops serving the page must not leave the key behind either.
   // The extension's identity too: every copy gets the id the tool key is bound to, wherever its folder is.
-  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
-  for (const s of [16, 48, 128]) {
-    const res = await fetch(`${wall}/boilerplate/icons/icon${s}.png`);
-    write(join('icons', `icon${s}.png`), Buffer.from(await res.arrayBuffer()));
-  }
-  // What a coding agent reads: the guide with this tool's features and plans, the skill, AGENTS.md and CLAUDE.md.
-  for (const f of AGENT_FILES) if (typeof plan.files[f.name] === 'string') write(f.path, plan.files[f.name]);
-  for (const f of AGENT_ENTRY_FILES) if (typeof plan.files[f] === 'string') write(f, plan.files[f]);
+  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readText(at['manifest.json'])), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
+  for (const icon of icons) write(icon, iconBytes[icon]);
+  for (const f of agentFiles) write(f.path, plan.files[f.name]);
+  for (const f of entries) write(f, plan.files[f]);
   const clicking = { both: 'Click the icon: the popup shows what the Free plan holds. Open side panel, in it, is the same page at the panel\'s width', popup: 'Click the icon: the popup shows what the Free plan holds', 'side-panel': 'Click the icon: the side panel opens — it has no popup, so the click is the panel\'s', none: 'No popup and no side panel: nothing opens on a click. Your code says when to sell — toolaby.openPaymentPage()' }[surfaces];
-  out(`\n  ${plan.name} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${plan.buyer ?? `${plan.site}/tools/${slug}`}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
+  out(`\n  ${oneLine(plan.name)} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${oneLine(plan.buyer ?? `${plan.site}/tools/${slug}`)}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
   if (typeof plan.files['TOOLABY.md'] === 'string') out(`  With a coding agent: AGENTS.md and TOOLABY.md tell it how this extension sells. For Claude Code, the Wall itself:\n    claude mcp add toolaby -- npx -y toolaby@latest mcp${live ? ' --live' : ''}\n`);
 }
 
@@ -313,7 +391,18 @@ async function create() {
 // (or one it prints) and POSTs it to the URL — a server on localhost, no
 // tunnel, no deploy — so a handler can be written and run before anything
 // is registered.
-const DEV_SECRET = 'whsec_dG9vbGFieS1kZXYtd2ViaG9vay1zZWNyZXQtMDAwMQ==';
+// This machine's development secret: made once, kept beside the credentials (mode 600), never the same as anyone
+// else's. It was one constant, shipped in the package and printed in the docs, and a server deployed with it took
+// forged events from anyone (25 Sep 2026).
+const DEV_SECRET_FILE = join(CONFIG_DIR, 'dev-webhook-secret');
+function devSecret() {
+  try { const kept = readFileSync(DEV_SECRET_FILE, 'utf8').trim(); if (/^whsec_[A-Za-z0-9+/=]{20,}$/.test(kept)) return kept; } catch { /* made below */ }
+  const made = `whsec_${randomBytes(24).toString('base64')}`;
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(DEV_SECRET_FILE, made + '\n', { mode: 0o600 });
+  try { chmodSync(DEV_SECRET_FILE, 0o600); } catch { /* not every filesystem has modes */ }
+  return made;
+}
 async function catalogue() {
   const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
   if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
@@ -325,8 +414,13 @@ async function webhooks() {
   if (sub === 'events') {
     const events = await catalogue();
     out(`\n  ${side}\n`);
-    for (const e of events) out(`    ${e.type.padEnd(26)} ${e.description}`);
-    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with a secret you name\n`);
+    for (const e of events) out(`    ${oneLine(e.type).padEnd(26)} ${oneLine(e.description)}`);
+    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with this machine's development secret\n  toolaby webhooks secret                      → that secret, for the local server's WALL_WEBHOOK_SECRET\n`);
+    return;
+  }
+  if (sub === 'secret') {
+    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx toolaby webhooks secret) node server.mjs`.
+    process.stdout.write(devSecret() + '\n');
     return;
   }
   if (sub === 'trigger') {
@@ -335,14 +429,14 @@ async function webhooks() {
     const to = opt('--to');
     if (!to) {
       const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-      if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-      out(`\n  Sent ${res.json.sent} to every endpoint of ${res.json.workspace} · ${side}. Its id is ${res.json.id}; the delivery log is under Configure → Webhooks.\n`);
+      if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+      out(`\n  Sent ${oneLine(res.json.sent)} to every endpoint of ${oneLine(res.json.workspace)} · ${side}. Its id is ${oneLine(res.json.id)}; the delivery log is under Configure → Webhooks.\n`);
       return;
     }
     const events = await catalogue();
     const event = events.find((e) => e.type === type);
     if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
-    const secret = opt('--secret') ?? DEV_SECRET;
+    const secret = opt('--secret') ?? devSecret();
     if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
     const id = `msg_${randomBytes(12).toString('base64url')}`;
     const timestamp = Math.floor(Date.now() / 1000);
@@ -353,18 +447,18 @@ async function webhooks() {
       res = await fetch(to, { method: 'POST', headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': String(timestamp), 'webhook-signature': signature, 'User-Agent': `toolaby-cli/${VERSION}` }, body });
     } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
     const text = (await res.text()).slice(0, 200);
-    out(`\n  POST ${to}  →  ${res.status}${text ? `  ${text.replace(/\s+/g, ' ')}` : ''}`);
-    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : `${DEV_SECRET} — set WALL_WEBHOOK_SECRET to it to verify`}.\n`);
+    out(`\n  POST ${to}  →  ${res.status}${text ? `  ${oneLine(text)}` : ''}`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx toolaby webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
     if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
     return;
   }
   if (sub === 'endpoints') {
     const ws = opt('--workspace');
     const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  ${res.json.workspace} · ${side}\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  ${oneLine(res.json.workspace)} · ${side}\n`);
     if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
-    for (const e of res.json.endpoints) out(`    ${e.id}  ${e.disabled ? 'paused ' : 'on     '} ${e.url}${e.description ? `  — ${e.description}` : ''}${e.events.length ? `  (${e.events.join(', ')})` : ''}`);
+    for (const e of res.json.endpoints) out(`    ${oneLine(e.id)}  ${e.disabled ? 'paused ' : 'on     '} ${oneLine(e.url)}${e.description ? `  — ${oneLine(e.description)}` : ''}${e.events.length ? `  (${oneLine(e.events.join(', '))})` : ''}`);
     out();
     return;
   }
@@ -373,16 +467,16 @@ async function webhooks() {
     if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
     const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
     const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  Added ${res.json.id} → ${res.json.url} · ${res.json.workspace} · ${side}\n\n  Signing secret, shown once — keep it where your server keeps secrets:\n\n    ${res.json.secret}\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  Added ${oneLine(res.json.id)} → ${oneLine(res.json.url)} · ${oneLine(res.json.workspace)} · ${side}\n\n  Signing secret, shown once — keep it where your server keeps secrets:\n\n    ${oneLine(res.json.secret)}\n`);
     return;
   }
   if (sub === 'remove') {
     const id = positional[1];
     if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
     const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  Removed ${res.json.removed} · ${res.json.workspace} · ${side}. Deliveries to it stop at once.\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  Removed ${oneLine(res.json.removed)} · ${oneLine(res.json.workspace)} · ${side}. Deliveries to it stop at once.\n`);
     return;
   }
   fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
@@ -393,7 +487,8 @@ async function webhooks() {
 // package and any key but the item's own in an update, and it keeps the id it gave the item either way — the Wall
 // admits that id once the listing's address is on the tool. It refuses a build that would sell on Test (a tk_test_
 // or tk_dev_ key inside) or that points at this machine (localhost in the manifest), the two mistakes a store build
-// can ship with. Nothing is sent anywhere: it reads the folder and writes one file.
+// can ship with. What looks private — a key, an environment file, a source map — is left out and named, and so is a
+// link out of the folder: a store zip is public. Nothing is sent anywhere: it reads the folder and writes one file.
 const BUILD_DIRS = ['.', '.output/chrome-mv3', 'dist', 'build/chrome-mv3-prod', 'build'];
 const TOOL_KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/g;
 const LOCAL = /^(https?|wss?):\/\/(localhost|127\.0\.0\.1|\[::1\]|[^/]*\.localhost)(:\d+)?\//i;
@@ -429,17 +524,32 @@ function zipOf(entries) {
   return Buffer.concat([...locals, cd, end]);
 }
 
+/**
+ * What goes in the zip: every file in the folder but dotfiles, node_modules and zips — and, left out with the reason,
+ * a file that looks private by its name or its contents (lib/safe.js), which --allow-private packs anyway, and never a
+ * link: one out of the folder can put ~/.ssh/id_rsa in a store zip as logo.png, and one inside it the folder's own
+ * .env or .git, under an innocent name (25 Sep 2026). Nor a name no zip should hold — a backslash, which unzips as a
+ * folder, or a control character — nor anything but a file. A zip is public once the store serves it.
+ */
 function filesIn(root) {
-  const found = [];
+  const found = []; const left = []; const privately = [];
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
       const p = join(dir, name);
-      if (statSync(p).isDirectory()) walk(p); else found.push(p);
+      const rel = relative(root, p).split(sep).join('/');
+      const st = lstatSync(p);
+      if (st.isSymbolicLink()) { left.push([rel, 'a link']); continue; }
+      if (/[\\\u0000-\u001f\u007f]/.test(name)) { left.push([rel, 'a name no zip should hold']); continue; }
+      if (st.isDirectory()) { walk(p); continue; }
+      if (!st.isFile()) { left.push([rel, 'not a file']); continue; }
+      const why = privateKind(name) ?? privateContent(readFileSync(p));
+      if (why && !flag('--allow-private')) left.push([rel, why]);
+      else { found.push(p); if (why) privately.push([rel, why]); }
     }
   };
   walk(root);
-  return found;
+  return { found, left, privately };
 }
 
 function pack() {
@@ -447,9 +557,13 @@ function pack() {
   const folder = given ? resolve(given) : BUILD_DIRS.map((d) => resolve(d)).find((d) => existsSync(join(d, 'manifest.json')));
   if (!folder || !existsSync(join(folder, 'manifest.json'))) fail(given ? `No manifest.json in ${given}.` : `No manifest.json here or in ${BUILD_DIRS.slice(1).join(', ')}. Build first, or name the folder: toolaby pack <folder>.`);
   let manifest;
-  try { manifest = JSON.parse(readFileSync(join(folder, 'manifest.json'), 'utf8')); } catch (e) { fail(`manifest.json does not parse: ${e.message}`); }
+  // The parser's message quotes the file it could not read, line breaks and all.
+  try { manifest = JSON.parse(readText(join(folder, 'manifest.json'))); } catch (e) { fail(`manifest.json does not parse: ${oneLine(e.message)}`); }
   if (!manifest.version) fail('manifest.json has no "version".');
-  const files = filesIn(folder);
+  // One to four numbers, as Chrome and the store take it — and a file name here: the zip is named with it, and a
+  // version with "../" in it put the zip outside the folder.
+  if (typeof manifest.version !== 'string' || !/^\d{1,5}(\.\d{1,5}){0,3}$/.test(manifest.version)) fail(`manifest.json's "version" is ${JSON.stringify(manifest.version)}: Chrome takes one to four numbers separated by dots, like 1.2.0.`);
+  const { found: files, left, privately } = filesIn(folder);
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -466,28 +580,38 @@ function pack() {
 
   // Addresses of this machine have no place in a store build.
   const local = [...(manifest.host_permissions ?? []), ...(manifest.externally_connectable?.matches ?? [])].filter((m) => typeof m === 'string' && LOCAL.test(m));
-  if (local.length && !flag('--allow-local')) problems.push(`The manifest points at this machine: ${local.join(', ')}. A store build has no localhost in host_permissions or externally_connectable. (--allow-local packs it anyway.)`);
+  if (local.length && !flag('--allow-local')) problems.push(`The manifest points at this machine: ${local.map(oneLine).join(', ')}. A store build has no localhost in host_permissions or externally_connectable. (--allow-local packs it anyway.)`);
 
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${site}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
   const hadKey = typeof manifest.key === 'string';
   const { key: _key, ...forStore } = manifest;
   const entries = files.map((f) => {
-    const name = relative(folder, f).split('\\').join('/');
+    const name = relative(folder, f).split(sep).join('/');
     return [name, name === 'manifest.json' ? Buffer.from(JSON.stringify(forStore, null, 2) + '\n') : readFileSync(f)];
   });
   // Named after the extension, or after its folder when the name is a __MSG_…__ placeholder.
   const named = typeof manifest.name === 'string' && !manifest.name.startsWith('__MSG_') ? manifest.name : basename(folder);
   const safe = named.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'extension';
   const target = resolve(opt('--out') ?? `${safe}-${manifest.version}.zip`);
-  writeFileSync(target, zipOf(entries));
+  // Written beside it under a name nobody could have made, then moved over it: a link a cloned project left under the
+  // zip's own name took the write wherever it pointed (25 Sep 2026). A move replaces the link itself.
+  const fresh = `${target}.${process.pid}.${randomBytes(6).toString('hex')}.part`;
+  writeFileSync(fresh, zipOf(entries), { flag: 'wx' });
+  renameSync(fresh, target);
   const kb = (statSync(target).size / 1024).toFixed(0);
   out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
+  // What was left out, and why — or, asked for, what private file went in: a store zip is public.
+  const links = left.filter(([, why]) => why === 'a link' || why === 'not a file' || why === 'a name no zip should hold');
+  const kept = left.filter((entry) => !links.includes(entry));
+  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
+  if (links.length) out(`  Left out: ${links.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
+  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
   if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
   out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
 }
@@ -517,6 +641,7 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
+                                       leaves out keys, certificates, .env and credential files, source maps   --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
@@ -527,11 +652,12 @@ function help() {
     toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
 
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
-    --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI.
+    --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
+    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
 `);
 }
 
 const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, upgrade: wire, create, webhooks, pack, check, mcp, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
 const run = commands[command];
 if (!run) { console.error(`\n  Unknown command "${command}".`); help(); process.exit(1); }
-Promise.resolve().then(run).catch((e) => fail(e.message));
+Promise.resolve().then(run).catch((e) => fail(oneLine(e.message)));

package/lib/check.js

@@ -3,12 +3,15 @@
 // client's freshness, the feature keys the code gates on against the tool's, the paywall's page, whether a copy has
 // checked in and whether the key is current, and — with --browser, where Playwright is installed — the extension
 // loaded in Chromium, its background answering and its own pages opening without an error.
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
+import { oneLine, keySite, fetchBounded, readText } from './safe.js';
 
 const KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/;
+/** A tool id as the Wall makes them (lib/mcp.js has the same): the only thing the check puts after a Wall's address. */
+const TOOL_ID = /^[a-z0-9][a-z0-9-]{1,118}$/;
 const CODE = /\.(m?js|jsx|ts|tsx|html|vue|svelte)$/;
 const SKIP = new Set(['node_modules', '.git', 'dist', 'build', '.output', '.wxt', '.plasmo', '.next', 'coverage']);
 const sha = (s) => createHash('sha256').update(s).digest('hex');
@@ -65,8 +68,9 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
   if (has('manifest.json') && !manifest) { bad('manifest.json is not valid JSON.'); return false; }
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
-  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site: 'https://example.invalid', tree });
-  if (project.kind === 'unknown') { bad(`Not an extension project: no manifest.json at the top, and not WXT, CRXJS or Plasmo${project.foundManifest ? ` (there is a manifest at ${project.foundManifest}: run this with --into ${project.foundManifest.replace(/\/?manifest\.json$/, '') || '.'})` : ''}.`); return false; }
+  const readOr = (p, none = null) => { try { return readText(p); } catch { return none; } };
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readOr(join(dir, configSource)) : null, site: 'https://example.invalid', tree });
+  if (project.kind === 'unknown') { bad(`Not an extension project: no manifest.json at the top, and not WXT, CRXJS or Plasmo${project.foundManifest ? ` (there is a manifest at ${oneLine(project.foundManifest)}: run this with --into ${oneLine(project.foundManifest.replace(/\/?manifest\.json$/, '')) || '.'})` : ''}.`); return false; }
   ok(project.kind === 'plain' ? 'A plain extension: manifest.json at the top.' : `A ${project.label} project.`);
 
   // 2. The Wall's files.
@@ -75,40 +79,48 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx toolaby wire <tool-id>\` here.`); return false; }
   ok(`The Wall's files are in ${project.codeDir || 'the top folder'}.`);
 
-  // 3. The tool key, and the tool it names.
-  const keyText = readFileSync(at('toolaby.config.js'), 'utf8').match(KEY)?.[0];
+  // 3. The tool key, and the tool it names — from a file: a link to a device or a pipe is read as nothing.
+  const configText = readOr(at('toolaby.config.js'), '');
+  const keyText = configText.match(KEY)?.[0];
   const key = keyText ? decodeKey(keyText) : null;
   if (!key) { bad('toolaby.config.js holds no tool key. Run `npx toolaby upgrade <tool-id>` here.'); return false; }
   const mode = keyText.split('_')[1];
+  // The key is the project's: the Wall it names is asked twice below, with no session, and its tool id goes into a path
+  // the developer's session asks of their own Wall. So only a Wall's address (lib/safe.js), and only a tool id. A cloned
+  // project's key sent the two requests wherever it named, and a tool id of ".." made the signed-in one a request for
+  // another route (25 Sep 2026).
+  if (!keySite(key.site) || !TOOL_ID.test(key.slug)) {
+    bad(`The tool key names ${JSON.stringify(key.slug)} at ${JSON.stringify(key.site)}, which is not a tool on a Wall: its address is https (http only on this machine) with nothing after the host, and its id lowercase letters, digits and dashes. Nothing was asked of it. \`npx toolaby upgrade <tool-id>\` writes the tool's own key.`);
+    return false;
+  }
   ok(`The tool key names ${key.slug}, on ${mode === 'live' ? 'Live' : mode === 'test' ? 'Test' : 'a development Wall'} (${key.site}).`);
-  const pub = await fetch(`${key.site}/api/tools/${encodeURIComponent(key.slug)}`).then(async (r) => ({ status: r.status, json: await r.json().catch(() => null) })).catch((e) => ({ status: 0, json: null, error: e.message }));
+  const pub = await fetchBounded(`${key.site}/api/tools/${encodeURIComponent(key.slug)}`).then((r) => ({ status: r.status, json: jsonOf(r.body) })).catch(() => ({ status: 0, json: null }));
   const tool = pub.status === 200 ? pub.json : null;
   if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx toolaby tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
   else {
-    ok(`The Wall knows it: ${tool.name}.`);
+    ok(`The Wall knows it: ${oneLine(tool.name)}.`);
     const jwk = tool.publicKeyJwk ?? {};
     if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx toolaby upgrade <tool-id>` writes it in.');
   }
 
   // 4. The manifest, against the platform's own wiring rules: what wiring it again would add.
-  const configText = readFileSync(at('toolaby.config.js'), 'utf8');
   if (project.manifestFile && manifest) {
     const again = wireManifest(manifest, { site: key.site, has, remembered: null, rememberedSidePanel: null, manifestKey: typeof manifest.key === 'string' ? manifest.key : null });
     const needed = (again.did ?? []).filter((d) => !/popup|side panel/i.test(d));
-    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.map(oneLine).join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
     else ok('The manifest has the permissions and host permissions the Wall needs.');
-    // The identity: without the `key`, each copy's id follows its folder, and the tool key opens for the first to connect only.
-    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and the tool key opens only for the first copy to connect. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx toolaby upgrade ${key.slug}\` adds it.`);
   } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
 
   // 5. The client, as fresh as the Wall's.
-  const client = await fetch(`${key.site}/client/toolaby.js`).then((r) => (r.ok ? r.text() : null)).catch(() => null);
+  const client = await fetchBounded(`${key.site}/client/toolaby.js`).then((r) => (r.ok && r.body ? r.body.toString('utf8') : null)).catch(() => null);
   if (client === null) warn('The Wall\'s current client could not be read to compare.');
-  else if (sha(client) !== sha(readFileSync(at('toolaby.js'), 'utf8'))) warn(`toolaby.js is not the Wall's current client. \`npx toolaby upgrade ${key.slug}\` replaces it (your own files stay).`);
+  else if (sha(client) !== sha(readOr(at('toolaby.js'), ''))) warn(`toolaby.js is not the Wall's current client. \`npx toolaby upgrade ${key.slug}\` replaces it (your own files stay).`);
   else ok('toolaby.js is the Wall\'s current client.');
 
   // 6. The features the code gates on, against the tool's; and the page showPaywall() opens.
-  const sources = sourceFiles(dir).map((f) => readFileSync(f, 'utf8'));
+  const sources = sourceFiles(dir).map((f) => { try { return readText(f); } catch { return ''; } });
   if (project.manifestFile && manifest && sources.some((s) => /\bshowPaywall\s*\(/.test(withoutComments(s)))) {
     const pages = [manifest.action?.default_popup ? 'toolaby-popup.html' : null, (manifest.side_panel?.default_path || manifest.sidebar_action?.default_panel) ? 'toolaby-sidepanel.html' : null].filter(Boolean);
     const absent = pages.filter((p) => !existsSync(join(dir, `${project.popupDir}${p}`)));
@@ -168,7 +180,7 @@ async function browserCheck({ dir, project, manifest, ok, warn, bad }) {
       new Promise((r) => setTimeout(() => r('timeout'), 8000)),
     ])).catch((e) => `error: ${e.message}`);
     if (answer && answer !== 'timeout' && !String(answer).startsWith('error')) ok('The background answers the Wall\'s client: its listeners registered.');
-    else bad(`The background did not answer (${answer ?? 'nothing'}): its module threw while loading, so none of its listeners registered.`);
+    else bad(`The background did not answer (${oneLine(answer ?? 'nothing')}): its module threw while loading, so none of its listeners registered.`);
     await page.close().catch(() => {});
     // The extension's own pages, each opened in a tab: one whose script throws is a popup that opens blank.
     const own = [shipped?.action?.default_popup, shipped?.side_panel?.default_path].filter((p, i, all) => typeof p === 'string' && p && all.indexOf(p) === i);
@@ -179,12 +191,13 @@ async function browserCheck({ dir, project, manifest, ok, warn, bad }) {
       await tab.goto(`chrome-extension://${id}/${p}`).catch((e) => errors.push(e.message));
       await tab.waitForTimeout(1500);
       await tab.close().catch(() => {});
-      if (errors.length) bad(`${p} threw when it opened: ${errors[0]}`);
-      else ok(`${p} opens without an error.`);
+      if (errors.length) bad(`${oneLine(p)} threw when it opened: ${oneLine(errors[0])}`);
+      else ok(`${oneLine(p)} opens without an error.`);
     }
   } finally {
     await ctx.close().catch(() => {});
   }
 }
 
-function readJsonSafe(p) { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } }
+function readJsonSafe(p) { try { return JSON.parse(readText(p)); } catch { return null; } }
+function jsonOf(body) { try { return body ? JSON.parse(body.toString('utf8')) : null; } catch { return null; } }

package/lib/mcp.js

@@ -10,17 +10,34 @@
 // them) to a command line that has none and that the Wall also serves as one tarball; this is the stdio transport and
 // the tools capability exactly as the specification words them. Nothing but protocol messages goes to stdout.
 
+import { fetchBounded } from './safe.js';
+
 const PROTOCOL_VERSIONS = ['2025-06-18', '2025-03-26', '2024-11-05'];
+/**
+ * A tool id as the Wall makes them. Checked before it goes into a path: `..`, encoded or not, is a path the address
+ * resolves away, and `/api/cli/tools/../x` asked for `/api/cli/x` (25 Sep 2026).
+ */
+const TOOL_ID = /^[a-z0-9][a-z0-9-]{1,118}$/;
+
+/**
+ * What a tool does, as the specification's annotations say it (2025-03-26 on), for a client deciding what it may run
+ * without asking: a read changes nothing, a write changes the developer's own workspace — destructive where it takes
+ * away or gives away (what the Free plan holds, the feature list, access to someone), idempotent where a second call
+ * changes nothing more. Every tool acts on that workspace on the Wall and nothing beyond it. The writes carried no
+ * annotations, and a client took them for whatever its defaults were (25 Sep 2026).
+ */
+const READS = { readOnlyHint: true, openWorldHint: false };
 
 /** The tools, with JSON Schema for their arguments, and what each calls on the Wall. */
 function toolsFor(side) {
-  const tool = { type: 'string', description: 'The tool id, as `toolaby_list_tools` gives it (like "acme--word-counter").' };
+  const tool = { type: 'string', pattern: TOOL_ID.source, description: 'The tool id, as `toolaby_list_tools` gives it (like "acme--word-counter").' };
   return [
     {
       name: 'toolaby_whoami',
       title: 'Who is signed in',
       description: `The developer signed in to the ${side} Wall, and their workspaces.`,
       inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+      annotations: READS,
       run: (_a, api) => api('/api/cli/me'),
     },
     {
@@ -28,6 +45,7 @@ function toolsFor(side) {
       title: 'List tools',
       description: `Every tool in the developer's workspaces on the ${side} Wall, with the id the other tools take.`,
       inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+      annotations: READS,
       run: (_a, api) => api('/api/cli/tools'),
     },
     {
@@ -35,12 +53,13 @@ function toolsFor(side) {
       title: 'Read a tool',
       description: `One tool on the ${side} Wall: what the Free plan holds (freePlan.holds, in a sentence), its features, its plans with what each unlocks, its tool key, and its extension: identityId is the id of every copy whose manifest has the tool's key (such a copy needs no binding, so boundId stays null), checkedInAt says whether one has checked in, inUse which builds. Then the addresses of its pages.`,
       inputSchema: { type: 'object', properties: { tool }, required: ['tool'], additionalProperties: false },
+      annotations: READS,
       run: (a, api) => api(`/api/cli/tools/${encodeURIComponent(a.tool)}`),
     },
     {
       name: 'toolaby_create_tool',
       title: 'Create a tool',
-      description: `A new tool on the ${side} Wall. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx toolaby create <id>\` for a new one, \`npx toolaby wire <id>\` for an existing one.`,
+      description: `A new tool on the ${side} Wall. This changes what the developer's own workspace sells: one more tool. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx toolaby create <id>\` for a new one, \`npx toolaby wire <id>\` for an existing one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -52,12 +71,13 @@ function toolsFor(side) {
         required: ['name'],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
       run: (a, api) => api('/api/cli/tools', { method: 'POST', body: a }),
     },
     {
       name: 'toolaby_set_access',
       title: 'Set what the Free plan holds',
-      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx toolaby upgrade <id>` then writes the new one.',
+      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). This changes access in the developer\'s own workspace, for every buyer of the tool. Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx toolaby upgrade <id>` then writes the new one.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -69,12 +89,13 @@ function toolsFor(side) {
         required: ['tool', 'access'],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
       run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/access`, { method: 'POST', body: rest }),
     },
     {
       name: 'toolaby_set_features',
       title: 'Set features, and the plans that unlock them',
-      description: 'The tool\'s whole feature list (it replaces the current one: send the features it has too), and which plans unlock which. A feature\'s key is what the extension passes to gate({ feature }) and has(). A feature marked free is on the Free plan too; one that is not free and that no plan unlocks is refused to everyone. The plans must exist first (toolaby_add_plan); a plan not named in `plans` keeps what it unlocks.',
+      description: 'The tool\'s whole feature list (it replaces the current one: send the features it has too), and which plans unlock which. This changes billing in the developer\'s own workspace: what every plan of the tool sells. A feature\'s key is what the extension passes to gate({ feature }) and has(). A feature marked free is on the Free plan too; one that is not free and that no plan unlocks is refused to everyone. The plans must exist first (toolaby_add_plan); a plan not named in `plans` keeps what it unlocks.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -102,12 +123,13 @@ function toolsFor(side) {
         required: ['tool', 'features'],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
       run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/features`, { method: 'POST', body: rest }),
     },
     {
       name: 'toolaby_add_plan',
       title: 'Add a plan',
-      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx toolaby upgrade <id>\` then writes the new one.`,
+      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). This changes billing in the developer's own workspace. "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx toolaby upgrade <id>\` then writes the new one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -124,18 +146,20 @@ function toolsFor(side) {
         required: ['tool', 'billing', 'amount', 'currency'],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
       run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/plans`, { method: 'POST', body: rest }),
     },
     {
       name: 'toolaby_grant',
       title: 'Grant access',
-      description: 'Access to the tool without paying: to test a paid feature on Test, or for a reviewer. An address with no account gets one; the grant applies once that person signs in to the extension with it (the link arrives by email), so testing a paid feature this way needs a person for a moment. For a number of days, or until revoked. On the Free plan a workspace holds 100 grants and other passes at once.',
+      description: 'Access to the tool without paying: to test a paid feature on Test, or for a reviewer. This changes access in the developer\'s own workspace: the person gets the paid features, and each call is another grant. An address with no account gets one; the grant applies once that person signs in to the extension with it (the link arrives by email), so testing a paid feature this way needs a person for a moment. For a number of days, or until revoked. On the Free plan a workspace holds 100 grants and other passes at once.',
       inputSchema: {
         type: 'object',
         properties: { tool, email: { type: 'string' }, days: { type: 'integer', minimum: 1, maximum: 3650, description: 'Optional: how long. Default: until revoked.' } },
         required: ['tool', 'email'],
         additionalProperties: false,
       },
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
       run: ({ tool: t, ...rest }, api) => api(`/api/cli/tools/${encodeURIComponent(t)}/grants`, { method: 'POST', body: rest }),
     },
     {
@@ -143,6 +167,7 @@ function toolsFor(side) {
       title: 'Read the docs',
       description: 'The Wall\'s docs as Markdown. Without a page: the index, every page with what it covers. With a page (like "gating", "pricing", "reference/client"): that page.',
       inputSchema: { type: 'object', properties: { page: { type: 'string' } }, additionalProperties: false },
+      annotations: READS,
       run: (a, _api, docs) => docs(a.page),
     },
   ];
@@ -168,13 +193,20 @@ export function runMcp({ version, side, wall, api, token }) {
     const clean = typeof page === 'string' ? page.replace(/^\/+|\.md$|\/+$/g, '').replace(/^docs\//, '') : '';
     if (clean && !/^[a-z0-9-]+(\/[a-z0-9-]+)*$/.test(clean)) return { ok: false, status: 400, json: { message: 'A page is a path like "gating" or "reference/client".' } };
     const url = clean ? `${wall}/docs/${clean}.md` : `${wall}/llms.txt`;
-    const res = await fetch(url).catch((e) => ({ ok: false, status: 0, text: async () => e.message }));
-    const text = await res.text();
+    // The Wall's own pages, a few megabytes at most: a redirect elsewhere handed an agent any host's page as the docs (25 Sep 2026).
+    const res = await fetchBounded(url, { limit: 4 * 1024 * 1024 }).catch(() => ({ ok: false, status: 0, body: null }));
+    if (res.ok && !res.body) return { ok: false, status: 413, json: { message: 'The docs page is larger than any the Wall serves.' } };
+    const text = res.body ? res.body.toString('utf8') : '';
     return res.ok ? { ok: true, status: res.status, text } : { ok: false, status: res.status, json: { message: res.status === 404 ? `No docs page "${clean}". Call toolaby_docs without a page for the index.` : `The docs answered HTTP ${res.status}.` } };
   };
   const call = async (name, args) => {
     const t = tools.find((x) => x.name === name);
     if (!t) return { error: { code: -32602, message: `Unknown tool: ${name}` } };
+    // Arguments are an object, or none: anything else threw before the answer, and the request went unanswered.
+    if (args !== undefined && (args === null || typeof args !== 'object' || Array.isArray(args))) return { error: { code: -32602, message: 'Arguments are an object.' } };
+    if (args && 'tool' in args && (typeof args.tool !== 'string' || !TOOL_ID.test(args.tool))) {
+      return { result: { content: [{ type: 'text', text: 'A tool id is lowercase letters, digits and dashes, as toolaby_list_tools gives it.' }], isError: true } };
+    }
     if (name !== 'toolaby_docs' && !token()) {
       return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx toolaby login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
     }

package/lib/project.js

@@ -120,11 +120,13 @@ export function detectProject(o) {
     if (crxjs && !has('manifest.json')) {
         const configFile = first(has, ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'manifest.js', 'src/manifest.ts', 'src/manifest.js']);
         const source = o.manifestSource ?? '';
-        const declared = source.match(/default_popup:\s*['"]([^'"]+)['"]/)?.[1] ?? null;
+        // A name as one line of a path: read across a line break or a backslash, a project's config drew lines of its own
+        // into the snippets the command prints and the dashboard shows (25 Sep 2026).
+        const declared = source.match(/default_popup:\s*['"]([^'"\\\r\n]+)['"]/)?.[1] ?? null;
         const appPopup = declared && declared !== 'toolaby-popup.html' ? declared : null;
-        const declaredPanel = source.match(/default_path:\s*['"]([^'"]+)['"]/)?.[1] ?? null;
+        const declaredPanel = source.match(/default_path:\s*['"]([^'"\\\r\n]+)['"]/)?.[1] ?? null;
         const appSidePanel = declaredPanel && declaredPanel !== 'toolaby-sidepanel.html' ? declaredPanel : null;
-        const worker = source.match(/service_worker:\s*['"]([^'"]+)['"]/)?.[1] ?? first(has, ['src/background.ts', 'src/background.js', 'background.ts', 'background.js']);
+        const worker = source.match(/service_worker:\s*['"]([^'"\\\r\n]+)['"]/)?.[1] ?? first(has, ['src/background.ts', 'src/background.js', 'background.ts', 'background.js']);
         const workerFile = worker ?? 'src/background.ts';
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
         const code = [

package/lib/safe.js

@@ -0,0 +1,198 @@
+// What this command will not do, whoever asks: write outside the project it was pointed at, write a file of a new
+// extension it does not know, open a sign-in page that is not the Wall's, put a private file in a store zip, print a
+// line it did not write, ask whatever address a project names, or take a download without end.
+//
+// Each of these took someone else's word. A cloned repository's manifest named the file `wire` wrote — a service
+// worker at "../../.zshrc" overwrote the shell's startup file — and a link in the folder took a write wherever it
+// pointed. The Wall's list of a new extension's files was joined to the folder as it came, so a Wall at another
+// address (--wall, TOOLABY_WALL) could write any file with any content. And on Windows the sign-in address went
+// through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
+// command's own boundary, not a wiring rule the browser shares.
+import { lstatSync, readFileSync, statSync } from 'node:fs';
+import { isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
+
+/**
+ * The minimal extension's own files, as the Wall names them (SCAFFOLD_FILES in wall/src/packages/wiring/files.ts;
+ * a test keeps the two equal): the only names `create` accepts from the Wall's list, which says which of them to
+ * write and never where. A name the Wall adds later is refused by a command that predates it — nothing is written,
+ * and `npm install -g toolaby@latest` is the way on.
+ */
+export const SCAFFOLD_FILES = ['manifest.json', 'background.js', 'popup.html', 'sidepanel.html', 'popup.css', 'popup.js', 'README.md'];
+
+/**
+ * Where `rel` lands inside `root` — `{ path }` — or why it may not — `{ why }`. Refused: an absolute path, a `..`,
+ * a backslash on POSIX (there it is part of a name, not a separator), anything that resolves outside the folder,
+ * and a symbolic link at any step below the root, dangling or not: a link in a cloned repository points wherever
+ * its author chose, and writing through it writes there. The root itself is the developer's to choose.
+ */
+export function inside(root, rel) {
+  if (typeof rel !== 'string' || !rel.trim() || rel.includes('\0')) return { why: 'it is not a file name' };
+  if (isAbsolute(rel) || posix.isAbsolute(rel) || win32.isAbsolute(rel)) return { why: 'it is an absolute path' };
+  if (sep === '/' && rel.includes('\\')) return { why: 'it has a backslash in it' };
+  if (rel.split(/[\\/]/).includes('..')) return { why: 'it has ".." in it' };
+  const base = resolve(root);
+  const path = resolve(base, rel);
+  if (!path.startsWith(base + sep)) return { why: 'it is outside the folder' };
+  let at = base;
+  for (const part of relative(base, path).split(sep)) {
+    at = join(at, part);
+    let st;
+    try { st = lstatSync(at); } catch { break; } // not there yet, and so nothing below it is
+    if (st.isSymbolicLink()) return { why: `${relative(base, at).split(sep).join('/')} is a symbolic link` };
+  }
+  return { path };
+}
+
+const LOOPBACK = /^(localhost|127(\.\d{1,3}){3}|\[::1\])$|\.localhost$/i;
+
+/**
+ * A value from a Wall's answer or a project's file, as one line. Every line leaves without terminal controls (bin.mjs),
+ * but keeps its line breaks, which the command's own messages need — so a tool name with "\n✓ Ready to publish" in it
+ * printed a whole line of its own, under the command's real ones (25 Sep 2026). Each such value goes through this
+ * where it is put into a line: line breaks and tabs, and any run of space, are one space.
+ */
+export const oneLine = (value) => String(value).replace(/\s+/g, ' ').slice(0, 500);
+
+/** An address a Wall answers on: https, or http on this machine, for a Wall on the developer's laptop. */
+const wallScheme = (url) => url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.test(url.hostname));
+
+/**
+ * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, and nothing else —
+ * no path, no credentials, no other scheme — or null. The key is read from the project's own toolaby.config.js, and a
+ * cloned project's key sent `check`'s requests wherever it named: a server inside the developer's network, any path on
+ * any host (25 Sep 2026).
+ */
+export function keySite(site) {
+  let url;
+  try { url = new URL(site); } catch { return null; }
+  return url.origin === site && wallScheme(url) ? site : null;
+}
+
+/**
+ * A GET that cannot run away with the command: the body read up to `limit` bytes and no further, the whole within `ms`,
+ * and a redirect followed — five at most — only to an address a Wall answers on. Answers `{ status, ok, body }`, the
+ * body null when it passed the limit; throws as fetch does, and with a TimeoutError when the time runs out. A Wall at
+ * another address (--wall, TOOLABY_WALL) could send `create` an icon without end, which the new folder took until the
+ * disk was full; and an https address that redirected took `check` anywhere (25 Sep 2026).
+ */
+export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {}) {
+  const signal = AbortSignal.timeout(ms);
+  const origin = new URL(url).origin;
+  let res = await fetch(url, { redirect: 'manual', signal });
+  for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
+    const next = new URL(res.headers.get('location'), url);
+    // Within the address asked, and no further: an https Wall that redirected sent `check` to a service on this
+    // machine, whose answer it printed as the tool's (25 Sep 2026).
+    if (next.origin !== origin || !wallScheme(next)) break;
+    await res.body?.cancel().catch(() => {});
+    url = next.href;
+    res = await fetch(url, { redirect: 'manual', signal });
+  }
+  const answered = { status: res.status, ok: res.ok };
+  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return { ...answered, body: null }; }
+  const chunks = [];
+  let size = 0;
+  const reader = res.body?.getReader();
+  for (;;) {
+    const { done, value } = reader ? await reader.read() : { done: true };
+    if (done) break;
+    size += value.byteLength;
+    if (size > limit) { await reader.cancel().catch(() => {}); return { ...answered, body: null }; }
+    chunks.push(value);
+  }
+  return { ...answered, body: Buffer.concat(chunks) };
+}
+
+/**
+ * A request that follows a redirect only within the address it asked — a Wall moving a page on its own host — and
+ * refuses one elsewhere: fetch drops the session on the way, but the command took whatever the other address answered
+ * for the Wall's word, and the MCP server handed an agent a page from any host (25 Sep 2026).
+ */
+export async function fetchHere(url, init = {}) {
+  const origin = new URL(url).origin;
+  let res = await fetch(url, { ...init, redirect: 'manual' });
+  for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
+    const next = new URL(res.headers.get('location'), url);
+    await res.body?.cancel().catch(() => {});
+    if (next.origin !== origin) throw new Error(`it answered with a redirect to ${next.origin}, which is not followed`);
+    url = next.href;
+    res = await fetch(url, { ...init, redirect: 'manual' });
+  }
+  return res;
+}
+
+/** The most of one project file the command reads as text: a manifest, a config, a source file — none comes near it. */
+export const READ_LIMIT = 5 * 1024 * 1024;
+
+/**
+ * A project file's text, where it is a file and no larger than READ_LIMIT; otherwise it throws, as a missing one does.
+ * A cloned repository can hold a link to /dev/zero, or a pipe, under any name the command reads: it waited, or filled
+ * its memory, for ever (25 Sep 2026).
+ */
+export function readText(path, limit = READ_LIMIT) {
+  const st = statSync(path);
+  if (!st.isFile()) throw new Error(`${path} is not a file`);
+  if (st.size > limit) throw new Error(`${path} is larger than any file this reads`);
+  return readFileSync(path, 'utf8');
+}
+
+/**
+ * Why a file's contents have no place in a store zip, whatever it is called, or null: a private key, a cloud service
+ * account's key, a source map written into the code. Names alone let `key.txt`, a Google Cloud key under the name
+ * its console gives it, and a bundle's inline map through (25 Sep 2026).
+ */
+export function privateContent(bytes) {
+  const text = bytes.subarray(0, 4 * 1024 * 1024).toString('latin1');
+  if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
+  if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY( BLOCK)?-----/.test(text)) return 'a private key inside';
+  if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+  return null;
+}
+
+/**
+ * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
+ * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
+ * http, or a scheme such as file: that opens whatever it names.
+ */
+export function signInPage(link, wall) {
+  if (typeof link !== 'string') return null;
+  let home; let page;
+  try { home = new URL(wall); page = new URL(link, home); } catch { return null; }
+  if (page.username || page.password) return null;
+  if (page.protocol === 'https:' && page.origin === home.origin) return page.href;
+  const web = page.protocol === 'http:' || page.protocol === 'https:';
+  return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;
+}
+
+/**
+ * How a page is opened on each platform, the address one argument and no shell in between. On Windows,
+ * `cmd /c start "" <url>` read an `&` in the address as a second command; rundll32 hands it to the default browser
+ * as it is.
+ */
+export function opener(platform, url) {
+  if (platform === 'darwin') return ['open', [url]];
+  if (platform === 'win32') return ['rundll32', ['url.dll,FileProtocolHandler', url]];
+  return ['xdg-open', [url]];
+}
+
+/**
+ * Why a file has no place in a store zip, or null: a private key or a keystore (Chrome's own "Pack extension" leaves
+ * the extension's .pem beside the folder, and it ends up inside), a certificate, an environment file, a file of
+ * credentials by its name — a cloud service account's key, a package registry's or a machine's login — or a source
+ * map, which carries the source. A store zip is public: anyone can download an item and unzip it. `pack` leaves these
+ * out and names them; --allow-private packs them. Dotfiles, .env and .npmrc among them, are never packed, and are
+ * named here all the same. A certificate, a service account's key under the name its console downloads it with
+ * (firebase-adminsdk-…json, …-service-account-…json), an SSH key with a suffix and Windows' _netrc were packed until
+ * 25 Sep 2026.
+ */
+export function privateKind(name) {
+  const n = name.toLowerCase();
+  if (/\.(pem|key|p12|pfx|p8|jks|keystore|bks|ppk)$/.test(n) || /^id_(rsa|dsa|ecdsa|ed25519)(?!.*\.pub$)/.test(n)) return 'a private key';
+  if (/\.(crt|cer|der)$/.test(n)) return 'a certificate';
+  if (/\.env(\.[^.]+)*$/.test(n)) return 'an environment file';
+  if (/^(credentials|secrets?)(\.(json|ya?ml|toml))?$/.test(n) || /(service[-_]?account|firebase-adminsdk|^client_secret)[^/]*\.json$/.test(n)) return 'credentials';
+  if (/\.tfstate(\.backup)?$/.test(n)) return "a deployment's state";
+  if (/^[._]?(npmrc|yarnrc\.yml|netrc|pypirc|git-credentials|htpasswd|pgpass)$/.test(n)) return 'credentials';
+  if (n.endsWith('.map')) return 'a source map';
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {