toolaby 1.6.1 → 1.6.3

package/bin.mjs

@@ -10,6 +10,7 @@
 //   toolaby mcp                       the Wall for coding agents: an MCP server on stdio (lib/mcp.js)
 //   toolaby webhooks events           the six events, with an example of each
 //   toolaby webhooks trigger <event>  send an example delivery: to your registered endpoints, or with --to straight to a local server
+//   toolaby webhooks secret           this machine's development secret, which --to signs with
 //   toolaby webhooks endpoints        the workspace's endpoints
 //   toolaby webhooks add <url>        register an endpoint; the secret is printed once
 //   toolaby webhooks remove <id>      remove one
@@ -23,13 +24,14 @@
 // session lives in ~/.config/toolaby/credentials.json (mode 600), one per
 // side; a command that needs one and has none signs you in on the spot.
 // `logout` revokes it on the server before forgetting it. TOOLABY_TOKEN
-// stands in for the file where there is no home (CI); TOOLABY_WALL or
-// `--wall <url>` names any other Wall (a laptop's, a self-hosted one).
+// stands in for the file where there is no home (CI), for one Wall alone:
+// Live, or the one TOOLABY_TOKEN_WALL names. TOOLABY_WALL or `--wall <url>`
+// names any other Wall (a laptop's, a self-hosted one).
 //
 // The wiring rules — what a folder is and what its manifest needs — are the
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
-import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync } from 'node:fs';
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync, renameSync } from 'node:fs';
 import { join, resolve, dirname, relative, basename, sep } from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
@@ -39,9 +41,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
-import { inside, signInPage, opener, privateKind, SCAFFOLD_FILES } from './lib/safe.js';
+import { inside, signInPage, opener, privateKind, privateContent, privateCopies, projectRoot, gitDirectory, notAnImage, publicLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.1';
+const VERSION = '1.6.3';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -53,11 +55,18 @@ const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[
 const flag = (k) => rest.includes(k) || (k === '--force' && command === 'upgrade');
 const WALLS = { test: 'https://test.toolaby.app', live: 'https://toolaby.app' };
 const live = flag('--live');
-const wall = (opt('--wall') ?? process.env.TOOLABY_WALL ?? (live ? WALLS.live : WALLS.test)).replace(/\/$/, '');
+// An address as fetch() reads it: a URL loses its tabs and line breaks when it is parsed, and kept in the name every
+// message prints, a --wall or a TOOLABY_WALL with one in it drew lines of its own (25 Sep 2026).
+const address = (s) => s.replace(/[\t\n\r]/g, '').replace(/\/$/, '');
+const wall = address(opt('--wall') ?? process.env.TOOLABY_WALL ?? (live ? WALLS.live : WALLS.test));
 /** The side, for every message: what a developer must never be unsure of. */
 const side = wall === WALLS.live ? 'Live' : wall === WALLS.test ? 'Test' : wall;
-const out = (s = '') => console.log(s);
-const fail = (s) => { console.error(`\n  ${s}\n`); process.exit(1); };
+// Every line leaves without terminal controls: names, paths and answers come from folders and servers this command does
+// not own, and one could clear the screen, draw a fake ✓ and hide what followed (25 Sep 2026). The command writes none,
+// nor any character that shows nothing — a zero width, a mark of direction, a filler — which could hide a word.
+const plain = (s) => String(s).replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u115f\u1160\u200b-\u200f\u2028-\u202e\u2060-\u2069\u2800\u3164\ufeff\uffa0]/g, '');
+const out = (s = '') => console.log(plain(s));
+const fail = (s) => { console.error(`\n  ${plain(s)}\n`); process.exit(1); };
 
 // ── The session: one per Wall, in the user's config, readable by them alone ─────────────────────────────────────────
 const CONFIG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'toolaby');
@@ -68,16 +77,39 @@ function writeCredentials(all) {
   writeFileSync(CREDENTIALS, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
   try { chmodSync(CREDENTIALS, 0o600); } catch { /* not every filesystem has modes */ }
 }
-const storedToken = () => process.env.TOOLABY_TOKEN || readCredentials()[wall]?.token || null;
-
-async function api(path, { method = 'GET', body, token = storedToken(), raw = false } = {}) {
-  const res = await fetch(`${wall}${path}`, {
+// TOOLABY_TOKEN goes to one Wall, the one it was made for: the one TOOLABY_TOKEN_WALL names, or — with none named —
+// Live. A --wall or a TOOLABY_WALL, which a cloned project's settings can set, once received it wherever it pointed,
+// and with no Wall named it went to Test and Live alike, so a CI job's Live session reached Test too (25 Sep 2026).
+// Refused there (401), it gives way to the session `toolaby login` stored for that Wall, and is not sent again.
+const tokenWall = address(process.env.TOOLABY_TOKEN_WALL || WALLS.live);
+let envRefused = false;
+const envToken = () => (process.env.TOOLABY_TOKEN && !envRefused && tokenWall === wall ? process.env.TOOLABY_TOKEN : null);
+const storedToken = () => envToken() || readCredentials()[wall]?.token || null;
+/** Said where a session is missing and TOOLABY_TOKEN is set: it is kept for another Wall, and a CI job should know. */
+const envElsewhere = () => (process.env.TOOLABY_TOKEN && !envRefused && !envToken() ? `\n  TOOLABY_TOKEN is sent to ${tokenWall} alone; TOOLABY_TOKEN_WALL=${wall} sends it here instead.` : '');
+
+/** The most of one answer the command reads from a Wall: none of the Wall's comes near it (the largest, a wiring, is under 1 MB). */
+const ANSWER_LIMIT = 4 * 1024 * 1024;
+
+async function api(path, { method = 'GET', body, token = storedToken() } = {}) {
+  // Only the Wall answers for the Wall: a redirect elsewhere is refused (lib/safe.js).
+  const res = await fetchHere(`${wall}${path}`, {
     method,
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': `toolaby-cli/${VERSION}`, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
     body: body ? JSON.stringify(body) : undefined,
   }).catch((e) => { throw new Error(`Could not reach ${wall}: ${e.message}`); });
-  if (raw) return res;
-  const json = await res.json().catch(() => ({}));
+  if (res.status === 401 && token && token === envToken()) {
+    envRefused = true;
+    const stored = storedToken();
+    if (stored && stored !== token) { await res.body?.cancel().catch(() => {}); return api(path, { method, body, token: stored }); }
+  }
+  // Read up to a few megabytes and no further: a Wall at another address (--wall, TOOLABY_WALL) that answered without
+  // end filled the command's memory, and the MCP server's, which hands what it reads to an agent (25 Sep 2026).
+  // An answer cut short reads as no JSON, as it always has; only one past the limit stops the command.
+  const bytes = await readBounded(res, ANSWER_LIMIT).catch(() => Buffer.alloc(0));
+  if (!bytes) throw new Error(`The Wall at ${wall} answered ${path.split('?')[0]} with more than ${ANSWER_LIMIT / 1024 / 1024} MB, which no answer of a Wall's is. None of it was used.`);
+  let json = {};
+  try { json = JSON.parse(bytes.toString('utf8')); } catch { /* not JSON: the status says what happened */ }
   return { status: res.status, ok: res.ok, json };
 }
 
@@ -98,7 +130,7 @@ async function login() {
   // Wall hands over is opened on this computer, and a file: or another site's page opens whatever it names.
   const page = signInPage(link, wall);
   if (!page) fail(`The Wall at ${wall} gave ${JSON.stringify(String(link).slice(0, 200))} as its sign-in page, which is not its own address over https.\n  It was not opened, and nothing was signed in.`);
-  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
   openBrowser(page);
   let every = Math.max(1, Number(interval) || 5) * 1000;
   const until = Date.now() + Number(expires_in) * 1000;
@@ -114,44 +146,46 @@ async function login() {
       const all = readCredentials();
       all[wall] = { token, email, at: new Date().toISOString() };
       writeCredentials(all);
-      out(`\n\n  Signed in${email ? ` as ${email}` : ''} · ${side}.\n`);
+      out(`\n\n  Signed in${email ? ` as ${oneLine(email)}` : ''} · ${side}.\n`);
       return token;
     }
     const why = poll.json.error;
     if (why === 'slow_down') every += 5000;
     else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
     else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
-    else if (why && why !== 'authorization_pending') fail(`The Wall answered "${why}"${poll.json.error_description ? `: ${poll.json.error_description}` : ''}.`);
+    else if (why && why !== 'authorization_pending') fail(`The Wall answered "${oneLine(why)}"${poll.json.error_description ? `: ${oneLine(poll.json.error_description)}` : ''}.`);
   }
   fail('The code expired before it was approved. Run `toolaby login` again.');
 }
 
 /** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
 async function tokenOrLogin() {
-  return storedToken() ?? (await login());
+  const token = storedToken();
+  if (!token && envElsewhere()) out(envElsewhere());
+  return token ?? (await login());
 }
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.${envElsewhere()}`);
   const me = await api('/api/cli/me', { token });
   if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
-  out(`\n  ${me.json.email}  ·  ${side}  ·  ${wall}\n`);
-  for (const w of me.json.workspaces) out(`    ${w.name}  (${w.slug}, ${w.role})  ${w.site}`);
+  out(`\n  ${oneLine(me.json.email)}  ·  ${side}  ·  ${wall}\n`);
+  for (const w of me.json.workspaces) out(`    ${oneLine(w.name)}  (${oneLine(w.slug)}, ${oneLine(w.role)})  ${oneLine(w.site)}`);
   out();
 }
 
 async function logout() {
   const all = readCredentials();
   const entry = all[wall];
-  if (!entry && !process.env.TOOLABY_TOKEN) { out(`\n  Not signed in to ${side} (${wall}).\n`); return; }
+  if (!entry && !envToken()) { out(`\n  Not signed in to ${side} (${wall}).\n`); return; }
   // Revoked on the server first; forgotten here whatever the server said — but the difference is reported.
-  const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? process.env.TOOLABY_TOKEN }).catch(() => ({ ok: false, status: 0 }));
+  const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? envToken() }).catch(() => ({ ok: false, status: 0 }));
   delete all[wall];
   writeCredentials(all);
   out(res.ok ? `\n  Signed out of ${side} (${wall}): the session was revoked and forgotten.\n` : `\n  The session was forgotten here, but the Wall could not be reached to revoke it (HTTP ${res.status}); it expires on its own, or sign it out from the dashboard.\n`);
-  if (process.env.TOOLABY_TOKEN) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
+  if (envToken()) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
 }
 
 async function tools() {
@@ -161,7 +195,7 @@ async function tools() {
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
-  for (const t of res.json.tools) out(`    ${t.slug.padEnd(40)} ${t.name}${t.bundle ? '  (bundle)' : ''}   ${t.site}`);
+  for (const t of res.json.tools) out(`    ${oneLine(t.slug).padEnd(40)} ${oneLine(t.name)}${t.bundle ? '  (bundle)' : ''}   ${oneLine(t.site)}`);
   out();
 }
 
@@ -177,9 +211,11 @@ function listTree(dir, depth, prefix = '', acc = new Set()) {
   }
   return acc;
 }
-const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+const readJson = (path) => { try { return JSON.parse(readText(path)); } catch { return null; } };
+/** A project file's text, or `none` where it is no file to read (lib/safe.js readText): a link to a device reads as nothing. */
+const readOr = (path, none = null) => { try { return readText(path); } catch { return none; } };
 /** Whether a background already starts the platform, outside its comments: then it needs no lines added. */
-const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readFileSync(path, 'utf8').replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
+const startsPlatform = (path) => { try { return /\bstartBackground\s*\(/.test(readText(path).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, '')); } catch { return false; } };
 const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
 /** Whether anything is at the path, a link to nowhere included (existsSync follows a link, and says no for a dangling one). */
 const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
@@ -193,7 +229,7 @@ function placesIn(root, paths, named = {}) {
   const at = {}; const refused = [];
   for (const rel of new Set(paths)) {
     const r = inside(root, rel);
-    if (r.why) refused.push(`${JSON.stringify(rel)}${named[rel] ? ` (${named[rel]})` : ''}: ${r.why}`);
+    if (r.why) refused.push(`${JSON.stringify(rel)}${named[rel] ? ` (${named[rel]})` : ''}: ${oneLine(r.why)}`);
     else at[rel] = r.path;
   }
   if (refused.length) fail(`Refused:\n\n${refused.map((r) => `    ${r}`).join('\n')}\n\n  This command writes only inside ${root}, and never through a symbolic link. Nothing was written.`);
@@ -204,21 +240,27 @@ function placesIn(root, paths, named = {}) {
 async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
   const token = await tokenOrLogin();
   const q = new URLSearchParams(); if (scaffold) q.set('scaffold', '1'); if (manifestKey) q.set('manifestKey', manifestKey); if (surfaces) q.set('surfaces', surfaces);
+  // The folder's manifest names another extension than the tool's: switched only when asked (--adopt-key).
+  if (manifestKey && flag('--adopt-key')) q.set('adoptKey', '1');
   const res = await api(`/api/cli/wiring/${slug}${q.size ? `?${q}` : ''}`, { token });
   if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold, manifestKey, surfaces); }
+  if (res.status === 409 && res.json?.error === 'identity_conflict') {
+    const offered = oneLine(res.json.offered); const current = oneLine(res.json.current);
+    fail(`This folder's manifest names the extension ${offered}; ${slug} is bound to ${current}. Nothing was written.\n\n  Run it again with --adopt-key to make ${offered} the tool's extension: its key then works from that one, and ${current}'s copies are named no more.\n  Or take the key out of this folder's manifest, and the tool's own goes in.`);
+  }
   if (res.status === 404) {
     // Say who the command is: the tool may well exist — in a workspace of another account of theirs.
     const me = await api('/api/cli/me', { token }).catch(() => null);
-    const who = me?.ok ? `\n\n  You are signed in as ${me.json.email}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => w.slug).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`toolaby logout\`, sign in to the dashboard as that account, then run this again.` : '';
-    fail(`${res.json.message ?? `No tool "${slug}" in your workspaces.`}${who}`);
+    const who = me?.ok ? `\n\n  You are signed in as ${oneLine(me.json.email)}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => oneLine(w.slug)).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`toolaby logout\`, sign in to the dashboard as that account, then run this again.` : '';
+    fail(`${oneLine(res.json.message ?? `No tool "${slug}" in your workspaces.`)}${who}`);
   }
-  if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+  if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
   return res.json;
 }
 
 async function wire() {
   const slug = positional[0];
-  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `toolaby tools` lists your ids');
   const dir = resolve(opt('--into') ?? '.');
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
@@ -230,13 +272,13 @@ async function wire() {
   const site = plan.site;
   const manifestKey = plan.identity?.manifestKey ?? null;
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
-  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site, tree, manifestKey });
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readOr(join(dir, configSource)) : null, site, tree, manifestKey });
   // Nothing recognised: nothing is written and nothing guessed. A manifest below the top is where to point --into; otherwise the Set up page's Do it myself has the files and the three things to paste.
-  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${project.foundManifest}: run this with --into ${dirname(project.foundManifest) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
+  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${oneLine(project.foundManifest)}: run this with --into ${oneLine(dirname(project.foundManifest)) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
 
   // The extension's own popup and side panel: the manifest's, or — wired before — what the existing configuration remembers.
   const configPath = join(dir, `${project.codeDir}toolaby.config.js`);
-  const oldConfig = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+  const oldConfig = existsSync(configPath) ? readOr(configPath, '') : '';
   const remembered = oldConfig.match(/appPopup:\s*'([^']*)'/)?.[1] || null;
   const rememberedSidePanel = oldConfig.match(/appSidePanel:\s*'([^']*)'/)?.[1] || null;
   // An extension whose own pages draw the panel — what `create` makes, or "your popup first" — keeps them in front.
@@ -266,7 +308,7 @@ async function wire() {
   const wrote = targets.filter((path) => typeof plan.files[path.split('/').pop()] === 'string');
   for (const path of wrote) write(path, fillPages(plan.files[path.split('/').pop()], { appPopup, appSidePanel }));
   for (const f of entries) { write(f, plan.files[f]); wrote.push(f); }
-  const ownAgents = has('AGENTS.md') && !readFileSync(join(dir, 'AGENTS.md'), 'utf8').includes('TOOLABY.md');
+  const ownAgents = has('AGENTS.md') && !readOr(join(dir, 'AGENTS.md'), '').includes('TOOLABY.md');
   for (const p of stale) unlinkSync(at[p]);
   const did = [];
   let ownWorker = null;
@@ -283,12 +325,13 @@ async function wire() {
     ownWorker = { file: project.worker, classic: false };
   }
 
-  out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
-  out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
+  out(`\n  ${oneLine(plan.name)} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
+  // Each thing done is a line, and names what the manifest and the Wall named: the popup, the background, the address.
+  out(`  Written: ${wrote.join(', ')}${did.length ? `,\n           ${did.map(oneLine).join(',\n           ')}` : ''}.\n`);
   if (ownAgents) out('  Your AGENTS.md is your own: add a line so coding agents find the Wall\'s guide — "Before changing anything paid, read TOOLABY.md."\n');
   if (stale.length) out(`  Removed: ${stale.join(', ')} — earlier files, now inside toolaby.js.\n`);
   for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
-  if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
+  if (ownWorker) out(`  Your background, ${oneLine(ownWorker.file)}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (project.built) out(`  ${BUILD_COPY_NOTE}\n`);
   out(`  Next: ${project.kind === 'plain' && !project.built ? '' : 'build or start the dev server, then '}chrome://extensions → reload it. The tool's Set up page says "checked in" the moment it starts.`);
   if (project.note) out(`  ${project.note}\n`);
@@ -323,21 +366,27 @@ async function create() {
   const entries = AGENT_ENTRY_FILES.filter((f) => typeof plan.files[f] === 'string');
   const icons = [16, 48, 128].map((s) => `icons/icon${s}.png`);
   const at = placesIn(dir, [...wanted, 'manifest.json', ...icons, ...agentFiles.map((f) => f.path), ...entries]);
+  // The icons first, each within a megabyte and half a minute, and nothing written until they are in: a Wall at another
+  // address (--wall, TOOLABY_WALL) could send one without end, and the new folder took it until the disk was full
+  // (25 Sep 2026).
+  const iconBytes = {};
+  for (const icon of icons) {
+    const got = await fetchBounded(`${wall}/boilerplate/${icon}`).catch((e) => ({ why: e.name === 'TimeoutError' ? 'it took longer than 30 seconds' : oneLine(e.message) }));
+    if (got.why || !got.body) fail(`The Wall at ${wall} did not send ${icon}: ${got.why ?? 'it sent more than a megabyte, which no icon is'}. Nothing was written.`);
+    iconBytes[icon] = got.body;
+  }
   const write = (rel, content) => { mkdirSync(dirname(at[rel]), { recursive: true }); writeFileSync(at[rel], content); };
   // Both surfaces, and the panel drawn inside them: no page of the Wall's stands in front, so both names stay empty.
   for (const f of wanted) write(f, fillPages(plan.files[f]));
   // The manifest names the side panel only now that the page is beside it — an extension whose side_panel points at a
   // missing file does not load at all, so a Wall that stops serving the page must not leave the key behind either.
   // The extension's identity too: every copy gets the id the tool key is bound to, wherever its folder is.
-  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readFileSync(at['manifest.json'], 'utf8')), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
-  for (const icon of icons) {
-    const res = await fetch(`${wall}/boilerplate/${icon}`);
-    write(icon, Buffer.from(await res.arrayBuffer()));
-  }
+  write('manifest.json', JSON.stringify(scaffoldManifest(JSON.parse(readText(at['manifest.json'])), { sidePanel: hasSidePanel(surfaces), popup: hasPopup(surfaces), key: plan.identity?.manifestKey ?? null }), null, 2) + '\n');
+  for (const icon of icons) write(icon, iconBytes[icon]);
   for (const f of agentFiles) write(f.path, plan.files[f.name]);
   for (const f of entries) write(f, plan.files[f]);
   const clicking = { both: 'Click the icon: the popup shows what the Free plan holds. Open side panel, in it, is the same page at the panel\'s width', popup: 'Click the icon: the popup shows what the Free plan holds', 'side-panel': 'Click the icon: the side panel opens — it has no popup, so the click is the panel\'s', none: 'No popup and no side panel: nothing opens on a click. Your code says when to sell — toolaby.openPaymentPage()' }[surfaces];
-  out(`\n  ${plan.name} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${plan.buyer ?? `${plan.site}/tools/${slug}`}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
+  out(`\n  ${oneLine(plan.name)} → ${dir}${surfaces === 'both' ? '' : `  (--surfaces ${surfaces})`}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. ${clicking}; Buy opens ${oneLine(plan.buyer ?? `${plan.site}/tools/${slug}`)}\n\n  Edit background.js: your work goes behind toolaby.gate().\n  Surfaces, and how to add or drop one later: ${wall}/docs/surfaces\n`);
   if (typeof plan.files['TOOLABY.md'] === 'string') out(`  With a coding agent: AGENTS.md and TOOLABY.md tell it how this extension sells. For Claude Code, the Wall itself:\n    claude mcp add toolaby -- npx -y toolaby@latest mcp${live ? ' --live' : ''}\n`);
 }
 
@@ -350,7 +399,18 @@ async function create() {
 // (or one it prints) and POSTs it to the URL — a server on localhost, no
 // tunnel, no deploy — so a handler can be written and run before anything
 // is registered.
-const DEV_SECRET = 'whsec_dG9vbGFieS1kZXYtd2ViaG9vay1zZWNyZXQtMDAwMQ==';
+// This machine's development secret: made once, kept beside the credentials (mode 600), never the same as anyone
+// else's. It was one constant, shipped in the package and printed in the docs, and a server deployed with it took
+// forged events from anyone (25 Sep 2026).
+const DEV_SECRET_FILE = join(CONFIG_DIR, 'dev-webhook-secret');
+function devSecret() {
+  try { const kept = readFileSync(DEV_SECRET_FILE, 'utf8').trim(); if (/^whsec_[A-Za-z0-9+/=]{20,}$/.test(kept)) return kept; } catch { /* made below */ }
+  const made = `whsec_${randomBytes(24).toString('base64')}`;
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(DEV_SECRET_FILE, made + '\n', { mode: 0o600 });
+  try { chmodSync(DEV_SECRET_FILE, 0o600); } catch { /* not every filesystem has modes */ }
+  return made;
+}
 async function catalogue() {
   const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
   if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
@@ -362,8 +422,13 @@ async function webhooks() {
   if (sub === 'events') {
     const events = await catalogue();
     out(`\n  ${side}\n`);
-    for (const e of events) out(`    ${e.type.padEnd(26)} ${e.description}`);
-    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with a secret you name\n`);
+    for (const e of events) out(`    ${oneLine(e.type).padEnd(26)} ${oneLine(e.description)}`);
+    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with this machine's development secret\n  toolaby webhooks secret                      → that secret, for the local server's WALL_WEBHOOK_SECRET\n`);
+    return;
+  }
+  if (sub === 'secret') {
+    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx -y toolaby@latest webhooks secret) node server.mjs`.
+    process.stdout.write(devSecret() + '\n');
     return;
   }
   if (sub === 'trigger') {
@@ -372,14 +437,14 @@ async function webhooks() {
     const to = opt('--to');
     if (!to) {
       const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-      if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-      out(`\n  Sent ${res.json.sent} to every endpoint of ${res.json.workspace} · ${side}. Its id is ${res.json.id}; the delivery log is under Configure → Webhooks.\n`);
+      if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+      out(`\n  Sent ${oneLine(res.json.sent)} to every endpoint of ${oneLine(res.json.workspace)} · ${side}. Its id is ${oneLine(res.json.id)}; the delivery log is under Configure → Webhooks.\n`);
       return;
     }
     const events = await catalogue();
     const event = events.find((e) => e.type === type);
     if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
-    const secret = opt('--secret') ?? DEV_SECRET;
+    const secret = opt('--secret') ?? devSecret();
     if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
     const id = `msg_${randomBytes(12).toString('base64url')}`;
     const timestamp = Math.floor(Date.now() / 1000);
@@ -390,18 +455,18 @@ async function webhooks() {
       res = await fetch(to, { method: 'POST', headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': String(timestamp), 'webhook-signature': signature, 'User-Agent': `toolaby-cli/${VERSION}` }, body });
     } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
     const text = (await res.text()).slice(0, 200);
-    out(`\n  POST ${to}  →  ${res.status}${text ? `  ${text.replace(/\s+/g, ' ')}` : ''}`);
-    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : `${DEV_SECRET} — set WALL_WEBHOOK_SECRET to it to verify`}.\n`);
+    out(`\n  POST ${to}  →  ${res.status}${text ? `  ${oneLine(text)}` : ''}`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx -y toolaby@latest webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
     if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
     return;
   }
   if (sub === 'endpoints') {
     const ws = opt('--workspace');
     const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  ${res.json.workspace} · ${side}\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  ${oneLine(res.json.workspace)} · ${side}\n`);
     if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
-    for (const e of res.json.endpoints) out(`    ${e.id}  ${e.disabled ? 'paused ' : 'on     '} ${e.url}${e.description ? `  — ${e.description}` : ''}${e.events.length ? `  (${e.events.join(', ')})` : ''}`);
+    for (const e of res.json.endpoints) out(`    ${oneLine(e.id)}  ${e.disabled ? 'paused ' : 'on     '} ${oneLine(e.url)}${e.description ? `  — ${oneLine(e.description)}` : ''}${e.events.length ? `  (${oneLine(e.events.join(', '))})` : ''}`);
     out();
     return;
   }
@@ -410,16 +475,16 @@ async function webhooks() {
     if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
     const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
     const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  Added ${res.json.id} → ${res.json.url} · ${res.json.workspace} · ${side}\n\n  Signing secret, shown once — keep it where your server keeps secrets:\n\n    ${res.json.secret}\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  Added ${oneLine(res.json.id)} → ${oneLine(res.json.url)} · ${oneLine(res.json.workspace)} · ${side}\n\n  Signing secret, shown once — keep it where your server keeps secrets:\n\n    ${oneLine(res.json.secret)}\n`);
     return;
   }
   if (sub === 'remove') {
     const id = positional[1];
     if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
     const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
-    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
-    out(`\n  Removed ${res.json.removed} · ${res.json.workspace} · ${side}. Deliveries to it stop at once.\n`);
+    if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
+    out(`\n  Removed ${oneLine(res.json.removed)} · ${oneLine(res.json.workspace)} · ${side}. Deliveries to it stop at once.\n`);
     return;
   }
   fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
@@ -469,41 +534,62 @@ function zipOf(entries) {
 
 /**
  * What goes in the zip: every file in the folder but dotfiles, node_modules and zips — and, left out with the reason,
- * a file that looks private (lib/safe.js), which --allow-private packs anyway, and a link that leads out of the folder
- * or to nothing, which is never packed: a link in a cloned repository can put ~/.ssh/id_rsa in a store zip as logo.png.
- * A zip is public once the store serves it. A folder reached twice through links is walked once.
+ * a file that looks private by its name or its contents (lib/safe.js), which --allow-private packs anyway, and never a
+ * link: one out of the folder can put ~/.ssh/id_rsa in a store zip as logo.png, and one inside it the folder's own
+ * .env or .git, under an innocent name (25 Sep 2026). Nor a name no zip should hold — a backslash, which unzips as a
+ * folder, or a control character — nor anything but a file. A zip is public once the store serves it.
+ *
+ * A build has already followed the links of the project it came from: what they pointed at is an ordinary file here.
+ * So a file is also private when it is a copy of one of the project's (`copyOf`), a folder when it is a git
+ * repository's own, and a file named as an image when it holds none (round 7, 25 Sep 2026).
  */
-function filesIn(root) {
-  const top = realpathSync(root);
-  const found = []; const left = []; const walked = new Set([top]);
+function filesIn(root, copyOf = () => null) {
+  const found = []; const left = []; const privately = [];
+  const allowed = flag('--allow-private');
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
       const p = join(dir, name);
-      const rel = relative(root, p).split('\\').join('/');
-      let real = null; try { real = realpathSync(p); } catch { /* a link to nothing */ }
-      if (!real || (real !== top && !real.startsWith(top + sep))) { left.push([rel, real ? 'a link out of the folder' : 'a link to nothing']); continue; }
-      if (statSync(p).isDirectory()) { if (!walked.has(real)) { walked.add(real); walk(p); } continue; }
-      const why = privateKind(name);
-      if (why && !flag('--allow-private')) left.push([rel, why]);
-      else found.push(p);
+      const rel = relative(root, p).split(sep).join('/');
+      const st = lstatSync(p);
+      if (st.isSymbolicLink()) { left.push([rel, 'a link']); continue; }
+      if (/[\\\u0000-\u001f\u007f]/.test(name)) { left.push([rel, 'a name no zip should hold']); continue; }
+      if (st.isDirectory()) {
+        // Left out whole, unwalked: its config and its history are the repository's, whatever the folder is called.
+        if (gitDirectory(p)) { if (!allowed) { left.push([rel, 'a git directory']); continue; } privately.push([rel, 'a git directory']); }
+        walk(p);
+        continue;
+      }
+      if (!st.isFile()) { left.push([rel, 'not a file']); continue; }
+      const bytes = readFileSync(p);
+      const why = privateKind(name) ?? copyOf(bytes) ?? privateContent(bytes) ?? notAnImage(name, bytes);
+      if (why && !allowed) left.push([rel, why]);
+      else { found.push(p); if (why) privately.push([rel, why]); }
     }
   };
   walk(root);
-  return { found, left };
+  return { found, left, privately };
 }
 
+/** A path as the developer knows it: under their home folder, from ~. */
+const fromHome = (path) => (path.startsWith(homedir() + sep) ? `~${path.slice(homedir().length)}` : path);
+
 function pack() {
   const given = positional[0];
   const folder = given ? resolve(given) : BUILD_DIRS.map((d) => resolve(d)).find((d) => existsSync(join(d, 'manifest.json')));
   if (!folder || !existsSync(join(folder, 'manifest.json'))) fail(given ? `No manifest.json in ${given}.` : `No manifest.json here or in ${BUILD_DIRS.slice(1).join(', ')}. Build first, or name the folder: toolaby pack <folder>.`);
   let manifest;
-  try { manifest = JSON.parse(readFileSync(join(folder, 'manifest.json'), 'utf8')); } catch (e) { fail(`manifest.json does not parse: ${e.message}`); }
+  // The parser's message quotes the file it could not read, line breaks and all.
+  try { manifest = JSON.parse(readText(join(folder, 'manifest.json'))); } catch (e) { fail(`manifest.json does not parse: ${oneLine(e.message)}`); }
   if (!manifest.version) fail('manifest.json has no "version".');
   // One to four numbers, as Chrome and the store take it — and a file name here: the zip is named with it, and a
   // version with "../" in it put the zip outside the folder.
   if (typeof manifest.version !== 'string' || !/^\d{1,5}(\.\d{1,5}){0,3}$/.test(manifest.version)) fail(`manifest.json's "version" is ${JSON.stringify(manifest.version)}: Chrome takes one to four numbers separated by dots, like 1.2.0.`);
-  const { found: files, left } = filesIn(folder);
+  // The project the build came from — or, with none above it, the folder alone — and the command's own secrets: what a
+  // build could have copied in under another name, by following a link (lib/safe.js).
+  const project = projectRoot(folder);
+  const copyOf = privateCopies(project ?? folder, [[CREDENTIALS, `${fromHome(CREDENTIALS)}, this command's session`], [DEV_SECRET_FILE, `${fromHome(DEV_SECRET_FILE)}, this machine's webhook secret`]]);
+  const { found: files, left, privately } = filesIn(folder, copyOf);
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -515,40 +601,46 @@ function pack() {
       try { const facts = JSON.parse(Buffer.from(k.split('_')[2], 'base64url').toString('utf8')); if (typeof facts.s === 'string') sites.add(facts.s.replace(/\/$/, '')); } catch { /* not a key after all */ }
     }
   }
-  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx toolaby wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
+  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx -y toolaby@latest wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
   if (modes.size === 0) out('\n  No tool key found in the build: it is not wired to the Wall, or the key is somewhere this cannot read. Packing anyway.');
 
   // Addresses of this machine have no place in a store build.
   const local = [...(manifest.host_permissions ?? []), ...(manifest.externally_connectable?.matches ?? [])].filter((m) => typeof m === 'string' && LOCAL.test(m));
-  if (local.length && !flag('--allow-local')) problems.push(`The manifest points at this machine: ${local.join(', ')}. A store build has no localhost in host_permissions or externally_connectable. (--allow-local packs it anyway.)`);
+  if (local.length && !flag('--allow-local')) problems.push(`The manifest points at this machine: ${local.map(oneLine).join(', ')}. A store build has no localhost in host_permissions or externally_connectable. (--allow-local packs it anyway.)`);
 
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${site}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
   const hadKey = typeof manifest.key === 'string';
   const { key: _key, ...forStore } = manifest;
   const entries = files.map((f) => {
-    const name = relative(folder, f).split('\\').join('/');
+    const name = relative(folder, f).split(sep).join('/');
     return [name, name === 'manifest.json' ? Buffer.from(JSON.stringify(forStore, null, 2) + '\n') : readFileSync(f)];
   });
   // Named after the extension, or after its folder when the name is a __MSG_…__ placeholder.
   const named = typeof manifest.name === 'string' && !manifest.name.startsWith('__MSG_') ? manifest.name : basename(folder);
   const safe = named.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'extension';
   const target = resolve(opt('--out') ?? `${safe}-${manifest.version}.zip`);
-  writeFileSync(target, zipOf(entries));
+  // Written beside it under a name nobody could have made, then moved over it: a link a cloned project left under the
+  // zip's own name took the write wherever it pointed (25 Sep 2026). A move replaces the link itself.
+  const fresh = `${target}.${process.pid}.${randomBytes(6).toString('hex')}.part`;
+  writeFileSync(fresh, zipOf(entries), { flag: 'wx' });
+  renameSync(fresh, target);
   const kb = (statSync(target).size / 1024).toFixed(0);
   out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
   // What was left out, and why — or, asked for, what private file went in: a store zip is public.
-  const links = left.filter(([, why]) => why.startsWith('a link'));
-  const kept = left.filter(([, why]) => !why.startsWith('a link'));
-  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${f} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
-  if (links.length) out(`  Left out: ${links.map(([f, why]) => `${f} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
-  const privately = flag('--allow-private') ? files.map((f) => [relative(folder, f).split('\\').join('/'), privateKind(basename(f))]).filter(([, why]) => why) : [];
-  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${f} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  const links = left.filter(([, why]) => why === 'a link' || why === 'not a file' || why === 'a name no zip should hold');
+  const kept = left.filter((entry) => !links.includes(entry));
+  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
+  if (links.length) out(`  Left out: ${links.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
+  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  // Said, not refused: the links are the project's, not the build's, and the build may hold nothing of theirs yet.
+  const linked = project ? publicLinks(project, folder) : [];
+  if (linked.length) out(`  Links in the folders a build copies as they are: ${linked.slice(0, 8).map(oneLine).join(', ')}${linked.length > 8 ? ` and ${linked.length - 8} more` : ''}. The build copies what each points at, a private file too: make each the file itself.`);
   if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
   out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
 }
@@ -578,7 +670,8 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
-                                       leaves out keys, .env files and source maps   --allow-private packs them
+                                       leaves out keys, certificates, .env and credential files, source maps, live secrets,
+                                       a build's copy of a private file, a git folder, an image that is none   --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
@@ -589,11 +682,15 @@ function help() {
     toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
 
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
-    --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI.
+    --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
+    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
+
+    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
+    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 
 const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, upgrade: wire, create, webhooks, pack, check, mcp, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
 const run = commands[command];
 if (!run) { console.error(`\n  Unknown command "${command}".`); help(); process.exit(1); }
-Promise.resolve().then(run).catch((e) => fail(e.message));
+Promise.resolve().then(run).catch((e) => fail(oneLine(e.message)));