toolaby 1.6.1 → 1.6.3

package/lib/safe.js

@@ -1,5 +1,6 @@
 // What this command will not do, whoever asks: write outside the project it was pointed at, write a file of a new
-// extension it does not know, open a sign-in page that is not the Wall's, or put a private file in a store zip.
+// extension it does not know, open a sign-in page that is not the Wall's, put a private file in a store zip, print a
+// line it did not write, ask whatever address a project names, or take a download without end.
 //
 // Each of these took someone else's word. A cloned repository's manifest named the file `wire` wrote — a service
 // worker at "../../.zshrc" overwrote the shell's startup file — and a link in the folder took a write wherever it
@@ -7,8 +8,10 @@
 // address (--wall, TOOLABY_WALL) could write any file with any content. And on Windows the sign-in address went
 // through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
 // command's own boundary, not a wiring rule the browser shares.
-import { lstatSync } from 'node:fs';
-import { isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
 
 /**
  * The minimal extension's own files, as the Wall names them (SCAFFOLD_FILES in wall/src/packages/wiring/files.ts;
@@ -44,6 +47,328 @@ export function inside(root, rel) {
 
 const LOOPBACK = /^(localhost|127(\.\d{1,3}){3}|\[::1\])$|\.localhost$/i;
 
+/**
+ * A value from a Wall's answer or a project's file, as one line. Every line leaves without terminal controls (bin.mjs),
+ * but keeps its line breaks, which the command's own messages need — so a tool name with "\n✓ Ready to publish" in it
+ * printed a whole line of its own, under the command's real ones (25 Sep 2026). Each such value goes through this
+ * where it is put into a line: line breaks and tabs, and any run of space, are one space.
+ */
+export const oneLine = (value) => String(value).replace(/\s+/g, ' ').slice(0, 500);
+
+/** An address a Wall answers on: https, or http on this machine, for a Wall on the developer's laptop. */
+const wallScheme = (url) => url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.test(url.hostname));
+
+/**
+ * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, and nothing else —
+ * no path, no credentials, no other scheme — or null. The key is read from the project's own toolaby.config.js, and a
+ * cloned project's key sent `check`'s requests wherever it named: a server inside the developer's network, any path on
+ * any host (25 Sep 2026).
+ */
+export function keySite(site) {
+  let url;
+  try { url = new URL(site); } catch { return null; }
+  return url.origin === site && wallScheme(url) ? site : null;
+}
+
+/**
+ * A GET that cannot run away with the command: the body read up to `limit` bytes and no further, the whole within `ms`,
+ * and a redirect followed — five at most — only to an address a Wall answers on. Answers `{ status, ok, body }`, the
+ * body null when it passed the limit; throws as fetch does, and with a TimeoutError when the time runs out. A Wall at
+ * another address (--wall, TOOLABY_WALL) could send `create` an icon without end, which the new folder took until the
+ * disk was full; and an https address that redirected took `check` anywhere (25 Sep 2026).
+ */
+export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {}) {
+  const signal = AbortSignal.timeout(ms);
+  const origin = new URL(url).origin;
+  let res = await fetch(url, { redirect: 'manual', signal });
+  for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
+    const next = new URL(res.headers.get('location'), url);
+    // Within the address asked, and no further: an https Wall that redirected sent `check` to a service on this
+    // machine, whose answer it printed as the tool's (25 Sep 2026).
+    if (next.origin !== origin || !wallScheme(next)) break;
+    await res.body?.cancel().catch(() => {});
+    url = next.href;
+    res = await fetch(url, { redirect: 'manual', signal });
+  }
+  return { status: res.status, ok: res.ok, body: await readBounded(res, limit) };
+}
+
+/**
+ * A response's body, up to `limit` bytes and no further: null past it, and the rest let go of unread. What a server
+ * sends is read as it comes, so one that answered without end filled the command's memory — `fetchBounded`'s
+ * downloads, and every answer of a Wall at another address (--wall, TOOLABY_WALL), which the MCP server also handed
+ * on to an agent (25 Sep 2026).
+ */
+export async function readBounded(res, limit) {
+  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return null; }
+  const chunks = [];
+  let size = 0;
+  const reader = res.body?.getReader();
+  for (;;) {
+    const { done, value } = reader ? await reader.read() : { done: true };
+    if (done) break;
+    size += value.byteLength;
+    if (size > limit) { await reader.cancel().catch(() => {}); return null; }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}
+
+/**
+ * A request that follows a redirect only within the address it asked — a Wall moving a page on its own host — and
+ * refuses one elsewhere: fetch drops the session on the way, but the command took whatever the other address answered
+ * for the Wall's word, and the MCP server handed an agent a page from any host (25 Sep 2026).
+ */
+export async function fetchHere(url, init = {}) {
+  const origin = new URL(url).origin;
+  let res = await fetch(url, { ...init, redirect: 'manual' });
+  for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
+    const next = new URL(res.headers.get('location'), url);
+    await res.body?.cancel().catch(() => {});
+    if (next.origin !== origin) throw new Error(`it answered with a redirect to ${next.origin}, which is not followed`);
+    url = next.href;
+    res = await fetch(url, { ...init, redirect: 'manual' });
+  }
+  return res;
+}
+
+/** The most of one project file the command reads as text: a manifest, a config, a source file — none comes near it. */
+export const READ_LIMIT = 5 * 1024 * 1024;
+
+/**
+ * A project file's text, where it is a file and no larger than READ_LIMIT; otherwise it throws, as a missing one does.
+ * A cloned repository can hold a link to /dev/zero, or a pipe, under any name the command reads: it waited, or filled
+ * its memory, for ever (25 Sep 2026).
+ */
+export function readText(path, limit = READ_LIMIT) {
+  const st = statSync(path);
+  if (!st.isFile()) throw new Error(`${path} is not a file`);
+  if (st.size > limit) throw new Error(`${path} is larger than any file this reads`);
+  return readFileSync(path, 'utf8');
+}
+
+/**
+ * Why a file's contents have no place in a store zip, whatever it is called, or null: a private key, a cloud service
+ * account's key, a source map written into the code. Names alone let `key.txt`, a Google Cloud key under the name
+ * its console gives it, and a bundle's inline map through (25 Sep 2026). So did a live secret in a file of any name
+ * — a Stripe or AWS key, a GitHub, Slack or npm token, a password in an address — until round 7 of the same day.
+ */
+export function privateContent(bytes) {
+  const text = bytes.subarray(0, 4 * 1024 * 1024).toString('latin1');
+  if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
+  if (pemKey(text)) return 'a private key inside';
+  if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+  for (const [shape, why] of SECRETS) for (const [found] of text.matchAll(shape)) if (!standIn(found)) return why;
+  if (passwordIn(text)) return 'a password in an address inside';
+  return null;
+}
+
+/**
+ * A secret by its whole shape, and what to call it — never by its prefix alone, which code that checks for one holds
+ * (`key.startsWith('sk_live_')`), nor a publishable key, which is made to be in a browser.
+ */
+const SECRETS = [
+  [/\b[rs]k_live_[0-9A-Za-z]{24,}/g, 'a Stripe live key inside'],
+  [/\bwhsec_[A-Za-z0-9+/]{24,}/g, 'a webhook signing secret inside'],
+  [/\bAKIA[0-9A-Z]{16}\b/g, 'an AWS access key inside'],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{82,})/g, 'a GitHub token inside'],
+  [/\bxox[abprs]-\d+-[A-Za-z0-9-]{20,}/g, 'a Slack token inside'],
+  [/\bnpm_[A-Za-z0-9]{36,}/g, 'an npm token inside'],
+];
+/** What stands where a secret goes, in docs and examples: a run of one character, or AWS's own EXAMPLE key. */
+const standIn = (found) => /(.)\1{7}/.test(found) || found.includes('EXAMPLE');
+
+/** An address with a password in it, `scheme://user:password@host`: the user and password as an address spells them. */
+const ADDRESS = /\b[a-z][a-z0-9+.-]{1,15}:\/\/([a-z0-9._~%!+,;=-]{1,64}):([a-z0-9._~%!+,;=-]{1,128})@([a-z0-9.-]+|\[[0-9a-f:.]+\])/gi;
+/** A password that is the example's word for one, as docs and error messages write it. */
+const EXAMPLE_PASSWORD = /^(?:pass(?:word|wd)?|pwd|pw|secret|changeme|x+|\.+|(?:your|my)[-_]?pass(?:word)?)$/i;
+/**
+ * Whether the text holds a live password in an address: not an example's (`user:password@`, a user's own name as its
+ * password, as local databases are set up), and not one for this machine, which reaches nothing elsewhere.
+ */
+function passwordIn(text) {
+  for (const [, user, password, host] of text.matchAll(ADDRESS)) if (password !== user && !EXAMPLE_PASSWORD.test(password) && !LOOPBACK.test(host)) return true;
+  return false;
+}
+
+const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?)-----/g;
+/**
+ * Whether the text holds a PEM private key: its BEGIN line, lines of base64 after any header lines (Proc-Type,
+ * DEK-Info, a PGP block's Version), and its own END line — the line breaks real, or written as \n in JSON or a string.
+ * The BEGIN line alone is code's: jose's importPKCS8 checks a string starts with it, and a bundle holding jose was
+ * refused as a key until round 7 (25 Sep 2026).
+ */
+function pemKey(text) {
+  for (const begin of text.matchAll(PEM_BEGIN)) {
+    const from = begin.index + begin[0].length;
+    const to = text.indexOf(`-----END ${begin[1]}-----`, from);
+    if (to < 0 || to - from > 32 * 1024) continue;
+    const lines = text.slice(from, to).replace(/\\+[nr]|\r/g, '\n').split('\n').map((l) => l.trim().replace(/\\$/, '')).filter((l) => l && !/^[A-Za-z][A-Za-z-]*: /.test(l));
+    if (lines.length && lines.every((l) => /^[A-Za-z0-9+/=]+$/.test(l)) && lines.join('').length >= 40) return true;
+  }
+  return false;
+}
+
+/** Whether anything is at the path, a link to nowhere included. */
+const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+/**
+ * The project a built folder belongs to: the nearest folder at or above it with a package.json or a .git — or null,
+ * and never the home folder or the top of the disk, which are no project to look through.
+ */
+export function projectRoot(folder) {
+  const home = resolve(homedir());
+  for (let at = resolve(folder); at !== home && dirname(at) !== at; at = dirname(at)) {
+    if (there(join(at, 'package.json')) || there(join(at, '.git'))) return at;
+  }
+  return null;
+}
+
+/** The most of one file `pack` compares by its bytes, and how far into a project it looks for the private ones. */
+const COPY_LIMIT = 4 * 1024 * 1024;
+const LOOK = { depth: 4, entries: 20_000 };
+/** Folders the look for private files passes by: installed packages, caches, and git's own, of which only config is read. */
+const PASSED_BY = new Set(['node_modules', '.git', '.pnpm-store', '.yarn', '.next', '.turbo', '.cache']);
+
+/**
+ * What says a file of a build is a copy of a private one: `why(bytes)`, which answers "a copy of .env, an environment
+ * file" or null. Its bytes are compared (SHA-256) with every file under `root` that is private by its name (privateKind:
+ * .env files, keys, .npmrc, credentials…), with `root`'s .git/config, and with `more` — [path, what it is] — each a
+ * few MB at most and not empty. A build resolves a link before `pack` sees it: WXT and Vite copy what a link in public/
+ * points at as an ordinary file under the link's name, so a cloned template's public/icon-128.png -> ../.env reached
+ * the zip as a PNG, the developer's .env inside (25 Sep 2026).
+ */
+export function privateCopies(root, more = []) {
+  const known = new Map(); // size → hash → what the file is
+  const note = (path, what) => {
+    let bytes;
+    try { const st = statSync(path); if (!st.isFile() || st.size > COPY_LIMIT) return; bytes = readFileSync(path); } catch { return; }
+    // Nothing in it is nothing to keep, and a copy of nothing is every empty file.
+    if (!bytes.toString('latin1').trim()) return;
+    const same = known.get(bytes.length) ?? new Map();
+    known.set(bytes.length, same);
+    const hash = sha256(bytes);
+    if (!same.has(hash)) same.set(hash, what);
+  };
+  let entries = 0;
+  // Level by level, so the project's own top — where .env and .npmrc are kept — is always read, however large the rest.
+  for (let level = root ? [root] : [], depth = 0; level.length && depth <= LOOK.depth; depth++) {
+    const next = [];
+    for (const dir of level) {
+      let names;
+      try { names = readdirSync(dir).sort(); } catch { continue; }
+      for (const name of names) {
+        if (++entries > LOOK.entries) break;
+        const path = join(dir, name);
+        const rel = relative(root, path).split(sep).join('/');
+        let st;
+        try { st = lstatSync(path); } catch { continue; }
+        if (st.isDirectory()) {
+          if (name === '.git') note(join(path, 'config'), `${rel}/config`);
+          else if (!PASSED_BY.has(name)) next.push(path);
+          continue;
+        }
+        // A private file that is itself a link is read where it points: a build following a link reads it there too.
+        const kind = privateKind(name);
+        if (kind && kind !== 'a source map') note(path, `${rel}, ${kind}`);
+      }
+    }
+    level = next;
+  }
+  for (const [path, what] of more) note(path, what);
+  return (bytes) => {
+    const what = known.get(bytes.length)?.get(sha256(bytes));
+    return what ? `a copy of ${what}` : null;
+  };
+}
+
+/**
+ * Whether a folder is a git repository's own — HEAD, config and an objects/ folder — as a build leaves one it copied
+ * whole from a link to .git: the remote, with any token in its address, and every commit (25 Sep 2026). A repository
+ * with no commit yet has an empty objects/, which a build that copies files leaves behind; its HEAD says what it is.
+ */
+export function gitDirectory(dir) {
+  try {
+    if (!lstatSync(join(dir, 'HEAD')).isFile() || !lstatSync(join(dir, 'config')).isFile()) return false;
+    if (there(join(dir, 'objects')) && lstatSync(join(dir, 'objects')).isDirectory()) return true;
+    return /^(ref: refs\/|[0-9a-f]{40}\s|[0-9a-f]{64}\s)/.test(readText(join(dir, 'HEAD'), 4096));
+  } catch { return false; }
+}
+
+const RASTER = /\.(png|jpe?g|gif|webp|ico|bmp)$/i;
+/**
+ * The first bytes of each kind of picture an extension shows: PNG, JPEG, GIF, WebP, ICO, BMP (whose reserved bytes
+ * are zero, as no text's are), and AVIF's box. Any of them passes under any picture's name: Chrome reads a picture by
+ * its bytes, and a JPEG saved as .png is no secret.
+ */
+const PICTURE = [
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47])),
+  (b) => b.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff])),
+  (b) => /^GIF8[79]a/.test(b.subarray(0, 6).toString('latin1')),
+  (b) => b.subarray(0, 4).toString('latin1') === 'RIFF' && b.subarray(8, 12).toString('latin1') === 'WEBP',
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x00, 0x00, 0x01, 0x00])),
+  (b) => b.length >= 10 && b.subarray(0, 2).toString('latin1') === 'BM' && b.readUInt32LE(6) === 0,
+  (b) => b.subarray(4, 8).toString('latin1') === 'ftyp',
+];
+/**
+ * Why a file named as an image is none, or null: its first bytes are no picture's, or — an .svg — it is not SVG's
+ * text. A build that followed a link left a .env or a git config under an icon's name, and nothing else looked
+ * inside it (25 Sep 2026). An empty file holds nothing, and passes.
+ */
+export function notAnImage(name, bytes) {
+  if (!bytes.length) return null;
+  if (/\.svg$/i.test(name)) {
+    const text = bytes.subarray(0, 1024 * 1024).toString('utf8').replace(/^\ufeff/, '');
+    return /^\s*</.test(text) && /<svg[\s>/:]/i.test(text) ? null : 'not the image its name says';
+  }
+  return RASTER.test(name) && !PICTURE.some((is) => is(bytes)) ? 'not the image its name says' : null;
+}
+
+/** The folders a build copies as they are: public/ (Vite, CRXJS and WXT), WXT's under src/, and one a config names. */
+const PUBLIC_DIRS = ['public', 'src/public'];
+const BUILD_CONFIGS = ['wxt.config', 'vite.config'].flatMap((n) => ['ts', 'mts', 'js', 'mjs'].map((e) => `${n}.${e}`));
+
+/**
+ * The symbolic links in the folders of `root` that a build copies as they are, relative to it — but for those inside
+ * `packed`, whose links `pack` leaves out and names. WXT's copyPublicDirectory and Vite's copyDir copy what a link
+ * points at, so a template's public/icon-128.png -> ../.env is a PNG in the build; `pack` sees only the build, where
+ * the link is gone, and says where they are (25 Sep 2026).
+ */
+export function publicLinks(root, packed = null) {
+  const dirs = new Set(PUBLIC_DIRS);
+  for (const config of BUILD_CONFIGS) {
+    let text;
+    try { text = readText(join(root, config)); } catch { continue; }
+    const named = /\bpublicDir\s*:\s*(['"`])([^'"`\n]+)\1/.exec(text)?.[2];
+    if (named) dirs.add(posix.normalize(named).replace(/\/+$/, ''));
+  }
+  const links = [];
+  let entries = 0;
+  const walk = (dir, depth) => {
+    let names;
+    try { names = readdirSync(dir).sort(); } catch { return; }
+    for (const name of names) {
+      if (++entries > 5_000) return;
+      const path = join(dir, name);
+      let st;
+      try { st = lstatSync(path); } catch { continue; }
+      if (st.isSymbolicLink()) links.push(path);
+      else if (st.isDirectory() && depth < 8) walk(path, depth + 1);
+    }
+  };
+  for (const dir of dirs) {
+    const at = resolve(root, dir);
+    // Not one a config names outside the project, which is not this command's to look through, nor one in the folder packed.
+    if (!at.startsWith(resolve(root) + sep) || (packed && (at === packed || at.startsWith(packed + sep)))) continue;
+    let st;
+    try { st = lstatSync(at); } catch { continue; }
+    if (st.isSymbolicLink()) links.push(at);
+    else if (st.isDirectory()) walk(at, 0);
+  }
+  return [...new Set(links.map((p) => relative(root, p).split(sep).join('/')))].sort();
+}
+
 /**
  * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
  * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
@@ -72,15 +397,22 @@ export function opener(platform, url) {
 
 /**
  * Why a file has no place in a store zip, or null: a private key or a keystore (Chrome's own "Pack extension" leaves
- * the extension's .pem beside the folder, and it ends up inside), an environment file, a file of credentials by its
- * name, or a source map, which carries the source. A store zip is public: anyone can download an item and unzip it.
- * `pack` leaves these out and names them; --allow-private packs them. Dotfiles, .env among them, are never packed.
+ * the extension's .pem beside the folder, and it ends up inside), a certificate, an environment file, a file of
+ * credentials by its name — a cloud service account's key, a package registry's or a machine's login — or a source
+ * map, which carries the source. A store zip is public: anyone can download an item and unzip it. `pack` leaves these
+ * out and names them; --allow-private packs them. Dotfiles, .env and .npmrc among them, are never packed, and are
+ * named here all the same. A certificate, a service account's key under the name its console downloads it with
+ * (firebase-adminsdk-…json, …-service-account-…json), an SSH key with a suffix and Windows' _netrc were packed until
+ * 25 Sep 2026.
  */
 export function privateKind(name) {
   const n = name.toLowerCase();
-  if (/\.(pem|key|p12|pfx|p8|jks|keystore|ppk)$/.test(n) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(n)) return 'a private key';
+  if (/\.(pem|key|p12|pfx|p8|jks|keystore|bks|ppk)$/.test(n) || /^id_(rsa|dsa|ecdsa|ed25519)(?!.*\.pub$)/.test(n)) return 'a private key';
+  if (/\.(crt|cer|der)$/.test(n)) return 'a certificate';
   if (/\.env(\.[^.]+)*$/.test(n)) return 'an environment file';
-  if (/^(credentials|secrets?|service[-_]?account[^/]*)\.json$/.test(n)) return 'credentials';
+  if (/^(credentials|secrets?)(\.(json|ya?ml|toml))?$/.test(n) || /(service[-_]?account|firebase-adminsdk|^client_secret)[^/]*\.json$/.test(n)) return 'credentials';
+  if (/\.tfstate(\.backup)?$/.test(n)) return "a deployment's state";
+  if (/^[._]?(npmrc|yarnrc\.yml|netrc|pypirc|git-credentials|htpasswd|pgpass)$/.test(n)) return 'credentials';
   if (n.endsWith('.map')) return 'a source map';
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {