toolaby 1.6.2 → 1.6.3

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby …`)
+npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`)
 toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
 toolaby wire <tool-id> --live # the same, on Live: the store build
 ```
 
+In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
+
 Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
 
 ## What it does
@@ -24,7 +26,7 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named; `--allow-private` packs them. Dotfiles and links that lead out of the folder are never packed. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named, and so is a file of any name that holds a private key or a live secret (a Stripe live key, a webhook secret, an AWS access key, a GitHub, Slack or npm token, a password in an address). A build copies what a link in `public/` points at, so `pack` also leaves out a file with the same bytes as one of the project's private files or the command's own session, a folder that is a git repository's own, and a file named as an image that holds none, and it names the links in `public/`. `--allow-private` packs what it left out. Dotfiles and links are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 

package/bin.mjs

@@ -41,9 +41,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
-import { inside, signInPage, opener, privateKind, privateContent, oneLine, fetchBounded, fetchHere, readText, SCAFFOLD_FILES } from './lib/safe.js';
+import { inside, signInPage, opener, privateKind, privateContent, privateCopies, projectRoot, gitDirectory, notAnImage, publicLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.2';
+const VERSION = '1.6.3';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -88,7 +88,10 @@ const storedToken = () => envToken() || readCredentials()[wall]?.token || null;
 /** Said where a session is missing and TOOLABY_TOKEN is set: it is kept for another Wall, and a CI job should know. */
 const envElsewhere = () => (process.env.TOOLABY_TOKEN && !envRefused && !envToken() ? `\n  TOOLABY_TOKEN is sent to ${tokenWall} alone; TOOLABY_TOKEN_WALL=${wall} sends it here instead.` : '');
 
-async function api(path, { method = 'GET', body, token = storedToken(), raw = false } = {}) {
+/** The most of one answer the command reads from a Wall: none of the Wall's comes near it (the largest, a wiring, is under 1 MB). */
+const ANSWER_LIMIT = 4 * 1024 * 1024;
+
+async function api(path, { method = 'GET', body, token = storedToken() } = {}) {
   // Only the Wall answers for the Wall: a redirect elsewhere is refused (lib/safe.js).
   const res = await fetchHere(`${wall}${path}`, {
     method,
@@ -98,10 +101,15 @@ async function api(path, { method = 'GET', body, token = storedToken(), raw = fa
   if (res.status === 401 && token && token === envToken()) {
     envRefused = true;
     const stored = storedToken();
-    if (stored && stored !== token) return api(path, { method, body, token: stored, raw });
+    if (stored && stored !== token) { await res.body?.cancel().catch(() => {}); return api(path, { method, body, token: stored }); }
   }
-  if (raw) return res;
-  const json = await res.json().catch(() => ({}));
+  // Read up to a few megabytes and no further: a Wall at another address (--wall, TOOLABY_WALL) that answered without
+  // end filled the command's memory, and the MCP server's, which hands what it reads to an agent (25 Sep 2026).
+  // An answer cut short reads as no JSON, as it always has; only one past the limit stops the command.
+  const bytes = await readBounded(res, ANSWER_LIMIT).catch(() => Buffer.alloc(0));
+  if (!bytes) throw new Error(`The Wall at ${wall} answered ${path.split('?')[0]} with more than ${ANSWER_LIMIT / 1024 / 1024} MB, which no answer of a Wall's is. None of it was used.`);
+  let json = {};
+  try { json = JSON.parse(bytes.toString('utf8')); } catch { /* not JSON: the status says what happened */ }
   return { status: res.status, ok: res.ok, json };
 }
 
@@ -419,7 +427,7 @@ async function webhooks() {
     return;
   }
   if (sub === 'secret') {
-    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx toolaby webhooks secret) node server.mjs`.
+    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx -y toolaby@latest webhooks secret) node server.mjs`.
     process.stdout.write(devSecret() + '\n');
     return;
   }
@@ -448,7 +456,7 @@ async function webhooks() {
     } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
     const text = (await res.text()).slice(0, 200);
     out(`\n  POST ${to}  →  ${res.status}${text ? `  ${oneLine(text)}` : ''}`);
-    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx toolaby webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx -y toolaby@latest webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
     if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
     return;
   }
@@ -530,9 +538,14 @@ function zipOf(entries) {
  * link: one out of the folder can put ~/.ssh/id_rsa in a store zip as logo.png, and one inside it the folder's own
  * .env or .git, under an innocent name (25 Sep 2026). Nor a name no zip should hold — a backslash, which unzips as a
  * folder, or a control character — nor anything but a file. A zip is public once the store serves it.
+ *
+ * A build has already followed the links of the project it came from: what they pointed at is an ordinary file here.
+ * So a file is also private when it is a copy of one of the project's (`copyOf`), a folder when it is a git
+ * repository's own, and a file named as an image when it holds none (round 7, 25 Sep 2026).
  */
-function filesIn(root) {
+function filesIn(root, copyOf = () => null) {
   const found = []; const left = []; const privately = [];
+  const allowed = flag('--allow-private');
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
@@ -541,10 +554,16 @@ function filesIn(root) {
       const st = lstatSync(p);
       if (st.isSymbolicLink()) { left.push([rel, 'a link']); continue; }
       if (/[\\\u0000-\u001f\u007f]/.test(name)) { left.push([rel, 'a name no zip should hold']); continue; }
-      if (st.isDirectory()) { walk(p); continue; }
+      if (st.isDirectory()) {
+        // Left out whole, unwalked: its config and its history are the repository's, whatever the folder is called.
+        if (gitDirectory(p)) { if (!allowed) { left.push([rel, 'a git directory']); continue; } privately.push([rel, 'a git directory']); }
+        walk(p);
+        continue;
+      }
       if (!st.isFile()) { left.push([rel, 'not a file']); continue; }
-      const why = privateKind(name) ?? privateContent(readFileSync(p));
-      if (why && !flag('--allow-private')) left.push([rel, why]);
+      const bytes = readFileSync(p);
+      const why = privateKind(name) ?? copyOf(bytes) ?? privateContent(bytes) ?? notAnImage(name, bytes);
+      if (why && !allowed) left.push([rel, why]);
       else { found.push(p); if (why) privately.push([rel, why]); }
     }
   };
@@ -552,6 +571,9 @@ function filesIn(root) {
   return { found, left, privately };
 }
 
+/** A path as the developer knows it: under their home folder, from ~. */
+const fromHome = (path) => (path.startsWith(homedir() + sep) ? `~${path.slice(homedir().length)}` : path);
+
 function pack() {
   const given = positional[0];
   const folder = given ? resolve(given) : BUILD_DIRS.map((d) => resolve(d)).find((d) => existsSync(join(d, 'manifest.json')));
@@ -563,7 +585,11 @@ function pack() {
   // One to four numbers, as Chrome and the store take it — and a file name here: the zip is named with it, and a
   // version with "../" in it put the zip outside the folder.
   if (typeof manifest.version !== 'string' || !/^\d{1,5}(\.\d{1,5}){0,3}$/.test(manifest.version)) fail(`manifest.json's "version" is ${JSON.stringify(manifest.version)}: Chrome takes one to four numbers separated by dots, like 1.2.0.`);
-  const { found: files, left, privately } = filesIn(folder);
+  // The project the build came from — or, with none above it, the folder alone — and the command's own secrets: what a
+  // build could have copied in under another name, by following a link (lib/safe.js).
+  const project = projectRoot(folder);
+  const copyOf = privateCopies(project ?? folder, [[CREDENTIALS, `${fromHome(CREDENTIALS)}, this command's session`], [DEV_SECRET_FILE, `${fromHome(DEV_SECRET_FILE)}, this machine's webhook secret`]]);
+  const { found: files, left, privately } = filesIn(folder, copyOf);
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -575,7 +601,7 @@ function pack() {
       try { const facts = JSON.parse(Buffer.from(k.split('_')[2], 'base64url').toString('utf8')); if (typeof facts.s === 'string') sites.add(facts.s.replace(/\/$/, '')); } catch { /* not a key after all */ }
     }
   }
-  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx toolaby wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
+  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx -y toolaby@latest wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
   if (modes.size === 0) out('\n  No tool key found in the build: it is not wired to the Wall, or the key is somewhere this cannot read. Packing anyway.');
 
   // Addresses of this machine have no place in a store build.
@@ -585,7 +611,7 @@ function pack() {
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
@@ -612,6 +638,9 @@ function pack() {
   if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
   if (links.length) out(`  Left out: ${links.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
   if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  // Said, not refused: the links are the project's, not the build's, and the build may hold nothing of theirs yet.
+  const linked = project ? publicLinks(project, folder) : [];
+  if (linked.length) out(`  Links in the folders a build copies as they are: ${linked.slice(0, 8).map(oneLine).join(', ')}${linked.length > 8 ? ` and ${linked.length - 8} more` : ''}. The build copies what each points at, a private file too: make each the file itself.`);
   if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
   out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
 }
@@ -641,7 +670,8 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
-                                       leaves out keys, certificates, .env and credential files, source maps   --allow-private packs them
+                                       leaves out keys, certificates, .env and credential files, source maps, live secrets,
+                                       a build's copy of a private file, a git folder, an image that is none   --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
@@ -654,6 +684,9 @@ function help() {
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
     sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
+
+    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
+    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 

package/lib/check.js

@@ -76,47 +76,47 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   // 2. The Wall's files.
   const at = (f) => join(dir, `${project.codeDir}${f}`);
   const missing = ['toolaby.js', 'toolaby.config.js'].filter((f) => !existsSync(at(f)));
-  if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx toolaby wire <tool-id>\` here.`); return false; }
+  if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx -y toolaby@latest wire <tool-id>\` here.`); return false; }
   ok(`The Wall's files are in ${project.codeDir || 'the top folder'}.`);
 
   // 3. The tool key, and the tool it names — from a file: a link to a device or a pipe is read as nothing.
   const configText = readOr(at('toolaby.config.js'), '');
   const keyText = configText.match(KEY)?.[0];
   const key = keyText ? decodeKey(keyText) : null;
-  if (!key) { bad('toolaby.config.js holds no tool key. Run `npx toolaby upgrade <tool-id>` here.'); return false; }
+  if (!key) { bad('toolaby.config.js holds no tool key. Run `npx -y toolaby@latest upgrade <tool-id>` here.'); return false; }
   const mode = keyText.split('_')[1];
   // The key is the project's: the Wall it names is asked twice below, with no session, and its tool id goes into a path
   // the developer's session asks of their own Wall. So only a Wall's address (lib/safe.js), and only a tool id. A cloned
   // project's key sent the two requests wherever it named, and a tool id of ".." made the signed-in one a request for
   // another route (25 Sep 2026).
   if (!keySite(key.site) || !TOOL_ID.test(key.slug)) {
-    bad(`The tool key names ${JSON.stringify(key.slug)} at ${JSON.stringify(key.site)}, which is not a tool on a Wall: its address is https (http only on this machine) with nothing after the host, and its id lowercase letters, digits and dashes. Nothing was asked of it. \`npx toolaby upgrade <tool-id>\` writes the tool's own key.`);
+    bad(`The tool key names ${JSON.stringify(key.slug)} at ${JSON.stringify(key.site)}, which is not a tool on a Wall: its address is https (http only on this machine) with nothing after the host, and its id lowercase letters, digits and dashes. Nothing was asked of it. \`npx -y toolaby@latest upgrade <tool-id>\` writes the tool's own key.`);
     return false;
   }
   ok(`The tool key names ${key.slug}, on ${mode === 'live' ? 'Live' : mode === 'test' ? 'Test' : 'a development Wall'} (${key.site}).`);
   const pub = await fetchBounded(`${key.site}/api/tools/${encodeURIComponent(key.slug)}`).then((r) => ({ status: r.status, json: jsonOf(r.body) })).catch(() => ({ status: 0, json: null }));
   const tool = pub.status === 200 ? pub.json : null;
-  if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx toolaby tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
+  if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx -y toolaby@latest tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
   else {
     ok(`The Wall knows it: ${oneLine(tool.name)}.`);
     const jwk = tool.publicKeyJwk ?? {};
-    if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx toolaby upgrade <tool-id>` writes it in.');
+    if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx -y toolaby@latest upgrade <tool-id>` writes it in.');
   }
 
   // 4. The manifest, against the platform's own wiring rules: what wiring it again would add.
   if (project.manifestFile && manifest) {
     const again = wireManifest(manifest, { site: key.site, has, remembered: null, rememberedSidePanel: null, manifestKey: typeof manifest.key === 'string' ? manifest.key : null });
     const needed = (again.did ?? []).filter((d) => !/popup|side panel/i.test(d));
-    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.map(oneLine).join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.map(oneLine).join('; ')}. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
     else ok('The manifest has the permissions and host permissions the Wall needs.');
     // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
-    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
   } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
 
   // 5. The client, as fresh as the Wall's.
   const client = await fetchBounded(`${key.site}/client/toolaby.js`).then((r) => (r.ok && r.body ? r.body.toString('utf8') : null)).catch(() => null);
   if (client === null) warn('The Wall\'s current client could not be read to compare.');
-  else if (sha(client) !== sha(readOr(at('toolaby.js'), ''))) warn(`toolaby.js is not the Wall's current client. \`npx toolaby upgrade ${key.slug}\` replaces it (your own files stay).`);
+  else if (sha(client) !== sha(readOr(at('toolaby.js'), ''))) warn(`toolaby.js is not the Wall's current client. \`npx -y toolaby@latest upgrade ${key.slug}\` replaces it (your own files stay).`);
   else ok('toolaby.js is the Wall\'s current client.');
 
   // 6. The features the code gates on, against the tool's; and the page showPaywall() opens.
@@ -124,7 +124,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   if (project.manifestFile && manifest && sources.some((s) => /\bshowPaywall\s*\(/.test(withoutComments(s)))) {
     const pages = [manifest.action?.default_popup ? 'toolaby-popup.html' : null, (manifest.side_panel?.default_path || manifest.sidebar_action?.default_panel) ? 'toolaby-sidepanel.html' : null].filter(Boolean);
     const absent = pages.filter((p) => !existsSync(join(dir, `${project.popupDir}${p}`)));
-    if (absent.length) warn(`The code calls toolaby.showPaywall(), which opens ${absent.join(' and ')}, and the extension has no such page: the paywall opens the buyer page in a new tab instead. \`npx toolaby upgrade ${key.slug}\` writes ${absent.length > 1 ? 'them' : 'it'}; your pages stay in front.`);
+    if (absent.length) warn(`The code calls toolaby.showPaywall(), which opens ${absent.join(' and ')}, and the extension has no such page: the paywall opens the buyer page in a new tab instead. \`npx -y toolaby@latest upgrade ${key.slug}\` writes ${absent.length > 1 ? 'them' : 'it'}; your pages stay in front.`);
   }
   if (tool) {
     const used = new Set();
@@ -146,7 +146,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     else if (facts?.ok) warn('No copy has checked in yet: load it at chrome://extensions and open it once.');
     // The key carries what the Free plan holds and the kind of plan sold: a change since it was written leaves it behind.
     const current = facts?.ok ? facts.json?.toolKey : null;
-    if (typeof current === 'string' && current.split('_')[1] === mode && current !== keyText) warn(`The tool key in toolaby.config.js is older than the Wall's: what the Free plan holds, the plans or the signing key changed since it was written. \`npx toolaby upgrade ${key.slug}\` writes the current one.`);
+    if (typeof current === 'string' && current.split('_')[1] === mode && current !== keyText) warn(`The tool key in toolaby.config.js is older than the Wall's: what the Free plan holds, the plans or the signing key changed since it was written. \`npx -y toolaby@latest upgrade ${key.slug}\` writes the current one.`);
   }
 
   // 8. In a browser: the background answers.

package/lib/mcp.js

@@ -1,6 +1,6 @@
 // `toolaby mcp`: the Wall for coding agents, as a Model Context Protocol server on stdio.
 //
-// An agent (Claude Code, Cursor, Codex, any MCP client) starts it — `claude mcp add toolaby -- npx -y toolaby mcp` —
+// An agent (Claude Code, Cursor, Codex, any MCP client) starts it — `claude mcp add toolaby -- npx -y toolaby@latest mcp` —
 // and gets tools to read and change the developer's tools on the Wall: what the Free plan holds, features, plans,
 // grants, and the docs. It acts with the session `toolaby login` stored, on Test unless started with --live, through
 // the same routes and the same checks as the dashboard.
@@ -59,7 +59,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_create_tool',
       title: 'Create a tool',
-      description: `A new tool on the ${side} Wall. This changes what the developer's own workspace sells: one more tool. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx toolaby create <id>\` for a new one, \`npx toolaby wire <id>\` for an existing one.`,
+      description: `A new tool on the ${side} Wall. This changes what the developer's own workspace sells: one more tool. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx -y toolaby@latest create <id>\` for a new one, \`npx -y toolaby@latest wire <id>\` for an existing one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -77,7 +77,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_set_access',
       title: 'Set what the Free plan holds',
-      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). This changes access in the developer\'s own workspace, for every buyer of the tool. Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx toolaby upgrade <id>` then writes the new one.',
+      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). This changes access in the developer\'s own workspace, for every buyer of the tool. Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx -y toolaby@latest upgrade <id>` then writes the new one.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -129,7 +129,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_add_plan',
       title: 'Add a plan',
-      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). This changes billing in the developer's own workspace. "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx toolaby upgrade <id>\` then writes the new one.`,
+      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). This changes billing in the developer's own workspace. "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx -y toolaby@latest upgrade <id>\` then writes the new one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -208,7 +208,7 @@ export function runMcp({ version, side, wall, api, token }) {
       return { result: { content: [{ type: 'text', text: 'A tool id is lowercase letters, digits and dashes, as toolaby_list_tools gives it.' }], isError: true } };
     }
     if (name !== 'toolaby_docs' && !token()) {
-      return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx toolaby login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
+      return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx -y toolaby@latest login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
     }
     try {
       return { result: resultOf(await t.run(args ?? {}, api, docs)) };
@@ -229,7 +229,7 @@ export function runMcp({ version, side, wall, api, token }) {
           protocolVersion: PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
           capabilities: { tools: { listChanged: false } },
           serverInfo: { name: 'toolaby', title: 'Toolaby Wall', version },
-          instructions: `The Toolaby Wall (${side}, ${wall}): accounts, licences, subscriptions and the paywall for Chrome extensions. Read a tool with toolaby_get_tool before changing it; the extension gates paid work with toolaby.gate({ feature }) and each feature key must exist on the tool (toolaby_set_features). Wire files with the shell: npx toolaby create|wire|upgrade <id>, check with npx toolaby check. toolaby_docs reads the docs.`,
+          instructions: `The Toolaby Wall (${side}, ${wall}): accounts, licences, subscriptions and the paywall for Chrome extensions. Read a tool with toolaby_get_tool before changing it; the extension gates paid work with toolaby.gate({ feature }) and each feature key must exist on the tool (toolaby_set_features). Wire files with the shell: npx -y toolaby@latest create|wire|upgrade <id>, check with npx -y toolaby@latest check. toolaby_docs reads the docs.`,
         } });
       }
       case 'notifications/initialized':
@@ -248,7 +248,7 @@ export function runMcp({ version, side, wall, api, token }) {
     }
   };
 
-  log(`${side} · ${wall} · ${token() ? 'signed in' : 'not signed in: tools ask for `npx toolaby login`'}`);
+  log(`${side} · ${wall} · ${token() ? 'signed in' : 'not signed in: tools ask for `npx -y toolaby@latest login`'}`);
   let buffer = '';
   process.stdin.setEncoding('utf8');
   process.stdin.on('data', (chunk) => {

package/lib/safe.js

@@ -8,8 +8,10 @@
 // address (--wall, TOOLABY_WALL) could write any file with any content. And on Windows the sign-in address went
 // through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
 // command's own boundary, not a wiring rule the browser shares.
-import { lstatSync, readFileSync, statSync } from 'node:fs';
-import { isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
 
 /**
  * The minimal extension's own files, as the Wall names them (SCAFFOLD_FILES in wall/src/packages/wiring/files.ts;
@@ -88,8 +90,17 @@ export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {
     url = next.href;
     res = await fetch(url, { redirect: 'manual', signal });
   }
-  const answered = { status: res.status, ok: res.ok };
-  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return { ...answered, body: null }; }
+  return { status: res.status, ok: res.ok, body: await readBounded(res, limit) };
+}
+
+/**
+ * A response's body, up to `limit` bytes and no further: null past it, and the rest let go of unread. What a server
+ * sends is read as it comes, so one that answered without end filled the command's memory — `fetchBounded`'s
+ * downloads, and every answer of a Wall at another address (--wall, TOOLABY_WALL), which the MCP server also handed
+ * on to an agent (25 Sep 2026).
+ */
+export async function readBounded(res, limit) {
+  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return null; }
   const chunks = [];
   let size = 0;
   const reader = res.body?.getReader();
@@ -97,10 +108,10 @@ export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {
     const { done, value } = reader ? await reader.read() : { done: true };
     if (done) break;
     size += value.byteLength;
-    if (size > limit) { await reader.cancel().catch(() => {}); return { ...answered, body: null }; }
+    if (size > limit) { await reader.cancel().catch(() => {}); return null; }
     chunks.push(value);
   }
-  return { ...answered, body: Buffer.concat(chunks) };
+  return Buffer.concat(chunks);
 }
 
 /**
@@ -139,16 +150,225 @@ export function readText(path, limit = READ_LIMIT) {
 /**
  * Why a file's contents have no place in a store zip, whatever it is called, or null: a private key, a cloud service
  * account's key, a source map written into the code. Names alone let `key.txt`, a Google Cloud key under the name
- * its console gives it, and a bundle's inline map through (25 Sep 2026).
+ * its console gives it, and a bundle's inline map through (25 Sep 2026). So did a live secret in a file of any name
+ * — a Stripe or AWS key, a GitHub, Slack or npm token, a password in an address — until round 7 of the same day.
  */
 export function privateContent(bytes) {
   const text = bytes.subarray(0, 4 * 1024 * 1024).toString('latin1');
   if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
-  if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY( BLOCK)?-----/.test(text)) return 'a private key inside';
+  if (pemKey(text)) return 'a private key inside';
   if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+  for (const [shape, why] of SECRETS) for (const [found] of text.matchAll(shape)) if (!standIn(found)) return why;
+  if (passwordIn(text)) return 'a password in an address inside';
+  return null;
+}
+
+/**
+ * A secret by its whole shape, and what to call it — never by its prefix alone, which code that checks for one holds
+ * (`key.startsWith('sk_live_')`), nor a publishable key, which is made to be in a browser.
+ */
+const SECRETS = [
+  [/\b[rs]k_live_[0-9A-Za-z]{24,}/g, 'a Stripe live key inside'],
+  [/\bwhsec_[A-Za-z0-9+/]{24,}/g, 'a webhook signing secret inside'],
+  [/\bAKIA[0-9A-Z]{16}\b/g, 'an AWS access key inside'],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{82,})/g, 'a GitHub token inside'],
+  [/\bxox[abprs]-\d+-[A-Za-z0-9-]{20,}/g, 'a Slack token inside'],
+  [/\bnpm_[A-Za-z0-9]{36,}/g, 'an npm token inside'],
+];
+/** What stands where a secret goes, in docs and examples: a run of one character, or AWS's own EXAMPLE key. */
+const standIn = (found) => /(.)\1{7}/.test(found) || found.includes('EXAMPLE');
+
+/** An address with a password in it, `scheme://user:password@host`: the user and password as an address spells them. */
+const ADDRESS = /\b[a-z][a-z0-9+.-]{1,15}:\/\/([a-z0-9._~%!+,;=-]{1,64}):([a-z0-9._~%!+,;=-]{1,128})@([a-z0-9.-]+|\[[0-9a-f:.]+\])/gi;
+/** A password that is the example's word for one, as docs and error messages write it. */
+const EXAMPLE_PASSWORD = /^(?:pass(?:word|wd)?|pwd|pw|secret|changeme|x+|\.+|(?:your|my)[-_]?pass(?:word)?)$/i;
+/**
+ * Whether the text holds a live password in an address: not an example's (`user:password@`, a user's own name as its
+ * password, as local databases are set up), and not one for this machine, which reaches nothing elsewhere.
+ */
+function passwordIn(text) {
+  for (const [, user, password, host] of text.matchAll(ADDRESS)) if (password !== user && !EXAMPLE_PASSWORD.test(password) && !LOOPBACK.test(host)) return true;
+  return false;
+}
+
+const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?)-----/g;
+/**
+ * Whether the text holds a PEM private key: its BEGIN line, lines of base64 after any header lines (Proc-Type,
+ * DEK-Info, a PGP block's Version), and its own END line — the line breaks real, or written as \n in JSON or a string.
+ * The BEGIN line alone is code's: jose's importPKCS8 checks a string starts with it, and a bundle holding jose was
+ * refused as a key until round 7 (25 Sep 2026).
+ */
+function pemKey(text) {
+  for (const begin of text.matchAll(PEM_BEGIN)) {
+    const from = begin.index + begin[0].length;
+    const to = text.indexOf(`-----END ${begin[1]}-----`, from);
+    if (to < 0 || to - from > 32 * 1024) continue;
+    const lines = text.slice(from, to).replace(/\\+[nr]|\r/g, '\n').split('\n').map((l) => l.trim().replace(/\\$/, '')).filter((l) => l && !/^[A-Za-z][A-Za-z-]*: /.test(l));
+    if (lines.length && lines.every((l) => /^[A-Za-z0-9+/=]+$/.test(l)) && lines.join('').length >= 40) return true;
+  }
+  return false;
+}
+
+/** Whether anything is at the path, a link to nowhere included. */
+const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+/**
+ * The project a built folder belongs to: the nearest folder at or above it with a package.json or a .git — or null,
+ * and never the home folder or the top of the disk, which are no project to look through.
+ */
+export function projectRoot(folder) {
+  const home = resolve(homedir());
+  for (let at = resolve(folder); at !== home && dirname(at) !== at; at = dirname(at)) {
+    if (there(join(at, 'package.json')) || there(join(at, '.git'))) return at;
+  }
   return null;
 }
 
+/** The most of one file `pack` compares by its bytes, and how far into a project it looks for the private ones. */
+const COPY_LIMIT = 4 * 1024 * 1024;
+const LOOK = { depth: 4, entries: 20_000 };
+/** Folders the look for private files passes by: installed packages, caches, and git's own, of which only config is read. */
+const PASSED_BY = new Set(['node_modules', '.git', '.pnpm-store', '.yarn', '.next', '.turbo', '.cache']);
+
+/**
+ * What says a file of a build is a copy of a private one: `why(bytes)`, which answers "a copy of .env, an environment
+ * file" or null. Its bytes are compared (SHA-256) with every file under `root` that is private by its name (privateKind:
+ * .env files, keys, .npmrc, credentials…), with `root`'s .git/config, and with `more` — [path, what it is] — each a
+ * few MB at most and not empty. A build resolves a link before `pack` sees it: WXT and Vite copy what a link in public/
+ * points at as an ordinary file under the link's name, so a cloned template's public/icon-128.png -> ../.env reached
+ * the zip as a PNG, the developer's .env inside (25 Sep 2026).
+ */
+export function privateCopies(root, more = []) {
+  const known = new Map(); // size → hash → what the file is
+  const note = (path, what) => {
+    let bytes;
+    try { const st = statSync(path); if (!st.isFile() || st.size > COPY_LIMIT) return; bytes = readFileSync(path); } catch { return; }
+    // Nothing in it is nothing to keep, and a copy of nothing is every empty file.
+    if (!bytes.toString('latin1').trim()) return;
+    const same = known.get(bytes.length) ?? new Map();
+    known.set(bytes.length, same);
+    const hash = sha256(bytes);
+    if (!same.has(hash)) same.set(hash, what);
+  };
+  let entries = 0;
+  // Level by level, so the project's own top — where .env and .npmrc are kept — is always read, however large the rest.
+  for (let level = root ? [root] : [], depth = 0; level.length && depth <= LOOK.depth; depth++) {
+    const next = [];
+    for (const dir of level) {
+      let names;
+      try { names = readdirSync(dir).sort(); } catch { continue; }
+      for (const name of names) {
+        if (++entries > LOOK.entries) break;
+        const path = join(dir, name);
+        const rel = relative(root, path).split(sep).join('/');
+        let st;
+        try { st = lstatSync(path); } catch { continue; }
+        if (st.isDirectory()) {
+          if (name === '.git') note(join(path, 'config'), `${rel}/config`);
+          else if (!PASSED_BY.has(name)) next.push(path);
+          continue;
+        }
+        // A private file that is itself a link is read where it points: a build following a link reads it there too.
+        const kind = privateKind(name);
+        if (kind && kind !== 'a source map') note(path, `${rel}, ${kind}`);
+      }
+    }
+    level = next;
+  }
+  for (const [path, what] of more) note(path, what);
+  return (bytes) => {
+    const what = known.get(bytes.length)?.get(sha256(bytes));
+    return what ? `a copy of ${what}` : null;
+  };
+}
+
+/**
+ * Whether a folder is a git repository's own — HEAD, config and an objects/ folder — as a build leaves one it copied
+ * whole from a link to .git: the remote, with any token in its address, and every commit (25 Sep 2026). A repository
+ * with no commit yet has an empty objects/, which a build that copies files leaves behind; its HEAD says what it is.
+ */
+export function gitDirectory(dir) {
+  try {
+    if (!lstatSync(join(dir, 'HEAD')).isFile() || !lstatSync(join(dir, 'config')).isFile()) return false;
+    if (there(join(dir, 'objects')) && lstatSync(join(dir, 'objects')).isDirectory()) return true;
+    return /^(ref: refs\/|[0-9a-f]{40}\s|[0-9a-f]{64}\s)/.test(readText(join(dir, 'HEAD'), 4096));
+  } catch { return false; }
+}
+
+const RASTER = /\.(png|jpe?g|gif|webp|ico|bmp)$/i;
+/**
+ * The first bytes of each kind of picture an extension shows: PNG, JPEG, GIF, WebP, ICO, BMP (whose reserved bytes
+ * are zero, as no text's are), and AVIF's box. Any of them passes under any picture's name: Chrome reads a picture by
+ * its bytes, and a JPEG saved as .png is no secret.
+ */
+const PICTURE = [
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47])),
+  (b) => b.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff])),
+  (b) => /^GIF8[79]a/.test(b.subarray(0, 6).toString('latin1')),
+  (b) => b.subarray(0, 4).toString('latin1') === 'RIFF' && b.subarray(8, 12).toString('latin1') === 'WEBP',
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x00, 0x00, 0x01, 0x00])),
+  (b) => b.length >= 10 && b.subarray(0, 2).toString('latin1') === 'BM' && b.readUInt32LE(6) === 0,
+  (b) => b.subarray(4, 8).toString('latin1') === 'ftyp',
+];
+/**
+ * Why a file named as an image is none, or null: its first bytes are no picture's, or — an .svg — it is not SVG's
+ * text. A build that followed a link left a .env or a git config under an icon's name, and nothing else looked
+ * inside it (25 Sep 2026). An empty file holds nothing, and passes.
+ */
+export function notAnImage(name, bytes) {
+  if (!bytes.length) return null;
+  if (/\.svg$/i.test(name)) {
+    const text = bytes.subarray(0, 1024 * 1024).toString('utf8').replace(/^\ufeff/, '');
+    return /^\s*</.test(text) && /<svg[\s>/:]/i.test(text) ? null : 'not the image its name says';
+  }
+  return RASTER.test(name) && !PICTURE.some((is) => is(bytes)) ? 'not the image its name says' : null;
+}
+
+/** The folders a build copies as they are: public/ (Vite, CRXJS and WXT), WXT's under src/, and one a config names. */
+const PUBLIC_DIRS = ['public', 'src/public'];
+const BUILD_CONFIGS = ['wxt.config', 'vite.config'].flatMap((n) => ['ts', 'mts', 'js', 'mjs'].map((e) => `${n}.${e}`));
+
+/**
+ * The symbolic links in the folders of `root` that a build copies as they are, relative to it — but for those inside
+ * `packed`, whose links `pack` leaves out and names. WXT's copyPublicDirectory and Vite's copyDir copy what a link
+ * points at, so a template's public/icon-128.png -> ../.env is a PNG in the build; `pack` sees only the build, where
+ * the link is gone, and says where they are (25 Sep 2026).
+ */
+export function publicLinks(root, packed = null) {
+  const dirs = new Set(PUBLIC_DIRS);
+  for (const config of BUILD_CONFIGS) {
+    let text;
+    try { text = readText(join(root, config)); } catch { continue; }
+    const named = /\bpublicDir\s*:\s*(['"`])([^'"`\n]+)\1/.exec(text)?.[2];
+    if (named) dirs.add(posix.normalize(named).replace(/\/+$/, ''));
+  }
+  const links = [];
+  let entries = 0;
+  const walk = (dir, depth) => {
+    let names;
+    try { names = readdirSync(dir).sort(); } catch { return; }
+    for (const name of names) {
+      if (++entries > 5_000) return;
+      const path = join(dir, name);
+      let st;
+      try { st = lstatSync(path); } catch { continue; }
+      if (st.isSymbolicLink()) links.push(path);
+      else if (st.isDirectory() && depth < 8) walk(path, depth + 1);
+    }
+  };
+  for (const dir of dirs) {
+    const at = resolve(root, dir);
+    // Not one a config names outside the project, which is not this command's to look through, nor one in the folder packed.
+    if (!at.startsWith(resolve(root) + sep) || (packed && (at === packed || at.startsWith(packed + sep)))) continue;
+    let st;
+    try { st = lstatSync(at); } catch { continue; }
+    if (st.isSymbolicLink()) links.push(at);
+    else if (st.isDirectory()) walk(at, 0);
+  }
+  return [...new Set(links.map((p) => relative(root, p).split(sep).join('/')))].sort();
+}
+
 /**
  * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
  * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {