toolaby 1.6.2 → 1.6.5

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby …`)
+npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`)
 toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
 toolaby wire <tool-id> --live # the same, on Live: the store build
 ```
 
+In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
+
 Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
 
 ## What it does
@@ -24,7 +26,7 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named; `--allow-private` packs them. Dotfiles and links that lead out of the folder are never packed. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named, and so is a file of any name that holds a private key or a secret (a Stripe key, live or test, a webhook secret, an AWS access key, long-term or temporary, or a secret access key, an OpenAI or Anthropic key, a Google OAuth client secret, a GitHub, Slack or npm token, a PuTTY key, a Supabase `service_role` key, a password in an address), read to its end, and in UTF-16 or base64 too. A Google API key is made to be in a browser: its file is packed and named, for you to restrict the key in Google Cloud. A build copies what a link in `public/` points at, so `pack` also leaves out a file with the same bytes or text as one of the project's private files or the command's own session, in UTF-16 or base64 as well, a folder that is a git repository's own, git's history, index, refs, logs and config under any name, and a file named as an image that holds none, and it names the links in `public/`. A `.gz` or `.br` a build's compression plugin writes is judged by what it holds. It refuses a build when a file the manifest names would be left out, or when a public folder is itself a link into `.git`. `--allow-private` packs what it left out. Dotfiles and links are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 

package/bin.mjs

@@ -32,7 +32,7 @@
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
 import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync, renameSync } from 'node:fs';
-import { join, resolve, dirname, relative, basename, sep } from 'node:path';
+import { join, resolve, dirname, relative, basename, sep, posix } from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
@@ -41,9 +41,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
-import { inside, signInPage, opener, privateKind, privateContent, oneLine, fetchBounded, fetchHere, readText, SCAFFOLD_FILES } from './lib/safe.js';
+import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.2';
+const VERSION = '1.6.5';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -88,20 +88,34 @@ const storedToken = () => envToken() || readCredentials()[wall]?.token || null;
 /** Said where a session is missing and TOOLABY_TOKEN is set: it is kept for another Wall, and a CI job should know. */
 const envElsewhere = () => (process.env.TOOLABY_TOKEN && !envRefused && !envToken() ? `\n  TOOLABY_TOKEN is sent to ${tokenWall} alone; TOOLABY_TOKEN_WALL=${wall} sends it here instead.` : '');
 
-async function api(path, { method = 'GET', body, token = storedToken(), raw = false } = {}) {
+/** The most of one answer the command reads from a Wall: none of the Wall's comes near it (the largest, a wiring, is under 1 MB). */
+const ANSWER_LIMIT = 4 * 1024 * 1024;
+/** How long it waits for one, the whole of it: none of the Wall's takes more than a few seconds. */
+const ANSWER_TIME = 30_000;
+
+async function api(path, { method = 'GET', body, token = storedToken() } = {}) {
+  // The time ran out (fetchHere's deadline; AbortError where an older Node says so): one line, whichever part was late.
+  // A Wall that answered a byte at a time held `login` and `wire` for ever (round 8, 25 Sep 2026).
+  const late = (e) => (e?.name === 'TimeoutError' || e?.name === 'AbortError' ? new Error(`The Wall at ${wall} did not answer ${path.split('?')[0]} within ${ANSWER_TIME / 1000} seconds.`) : null);
   // Only the Wall answers for the Wall: a redirect elsewhere is refused (lib/safe.js).
   const res = await fetchHere(`${wall}${path}`, {
+    ms: ANSWER_TIME,
     method,
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': `toolaby-cli/${VERSION}`, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
     body: body ? JSON.stringify(body) : undefined,
-  }).catch((e) => { throw new Error(`Could not reach ${wall}: ${e.message}`); });
+  }).catch((e) => { throw late(e) ?? new Error(`Could not reach ${wall}: ${e.message}`); });
   if (res.status === 401 && token && token === envToken()) {
     envRefused = true;
     const stored = storedToken();
-    if (stored && stored !== token) return api(path, { method, body, token: stored, raw });
+    if (stored && stored !== token) { await res.body?.cancel().catch(() => {}); return api(path, { method, body, token: stored }); }
   }
-  if (raw) return res;
-  const json = await res.json().catch(() => ({}));
+  // Read up to a few megabytes and no further: a Wall at another address (--wall, TOOLABY_WALL) that answered without
+  // end filled the command's memory, and the MCP server's, which hands what it reads to an agent (25 Sep 2026).
+  // An answer cut short reads as no JSON, as it always has; only one past the limit, or the time, stops the command.
+  const bytes = await readBounded(res, ANSWER_LIMIT).catch((e) => { const why = late(e); if (why) throw why; return Buffer.alloc(0); });
+  if (!bytes) throw new Error(`The Wall at ${wall} answered ${path.split('?')[0]} with more than ${ANSWER_LIMIT / 1024 / 1024} MB, which no answer of a Wall's is. None of it was used.`);
+  let json = {};
+  try { json = JSON.parse(bytes.toString('utf8')); } catch { /* not JSON: the status says what happened */ }
   return { status: res.status, ok: res.ok, json };
 }
 
@@ -116,19 +130,22 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function login() {
   const start = await api('/api/dev-auth/device/code', { method: 'POST', body: { client_id: CLIENT_ID }, token: null });
   if (!start.ok || !start.json.device_code) fail(`The Wall at ${wall} did not start a sign-in (HTTP ${start.status}). Is the address right? --wall names another.`);
-  const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
+  const { device_code, user_code, verification_uri, verification_uri_complete } = start.json;
   const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
   // The Wall's own page, over https (http on this machine), or nothing opened and nothing signed in: an address the
   // Wall hands over is opened on this computer, and a file: or another site's page opens whatever it names.
   const page = signInPage(link, wall);
   if (!page) fail(`The Wall at ${wall} gave ${JSON.stringify(String(link).slice(0, 200))} as its sign-in page, which is not its own address over https.\n  It was not opened, and nothing was signed in.`);
-  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  // How often it asks and for how long: what the Wall said, a quarter of an hour at most (lib/safe.js).
+  const { every: first, lasts } = devicePolling(start.json);
+  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(lasts / 60_000)} minutes)\n`);
   openBrowser(page);
-  let every = Math.max(1, Number(interval) || 5) * 1000;
-  const until = Date.now() + Number(expires_in) * 1000;
+  let every = first;
+  const until = Date.now() + lasts;
   process.stdout.write('  Waiting for your approval');
   while (Date.now() < until) {
-    await sleep(every);
+    // Never past the code's end: the last ask comes as it ends.
+    await sleep(Math.min(every, until - Date.now()));
     process.stdout.write('.');
     const poll = await api('/api/dev-auth/device/token', { method: 'POST', body: { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code, client_id: CLIENT_ID }, token: null });
     if (poll.ok && poll.json.access_token) {
@@ -419,7 +436,7 @@ async function webhooks() {
     return;
   }
   if (sub === 'secret') {
-    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx toolaby webhooks secret) node server.mjs`.
+    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx -y toolaby@latest webhooks secret) node server.mjs`.
     process.stdout.write(devSecret() + '\n');
     return;
   }
@@ -448,7 +465,7 @@ async function webhooks() {
     } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
     const text = (await res.text()).slice(0, 200);
     out(`\n  POST ${to}  →  ${res.status}${text ? `  ${oneLine(text)}` : ''}`);
-    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx toolaby webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx -y toolaby@latest webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
     if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
     return;
   }
@@ -488,10 +505,52 @@ async function webhooks() {
 // admits that id once the listing's address is on the tool. It refuses a build that would sell on Test (a tk_test_
 // or tk_dev_ key inside) or that points at this machine (localhost in the manifest), the two mistakes a store build
 // can ship with. What looks private — a key, an environment file, a source map — is left out and named, and so is a
-// link out of the folder: a store zip is public. Nothing is sent anywhere: it reads the folder and writes one file.
+// link out of the folder: a store zip is public. A build it would leave a file of the manifest's out of, which Chrome
+// would not load, is refused, as is one whose public folder is a link into .git (round 9, 25 Sep 2026). Nothing is
+// sent anywhere: it reads the folder and writes one file.
 const BUILD_DIRS = ['.', '.output/chrome-mv3', 'dist', 'build/chrome-mv3-prod', 'build'];
 const TOOL_KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/g;
 const LOCAL = /^(https?|wss?):\/\/(localhost|127\.0\.0\.1|\[::1\]|[^/]*\.localhost)(:\d+)?\//i;
+/** Why a file is left out as no file of the folder's own, not as a private one: never packed, --allow-private or not. */
+const NOT_OWN = ['a link', 'not a file', 'a name no zip should hold'];
+
+/**
+ * The files a manifest names, each with what it is to the extension, as the zip spells them: no leading ./ or /, no
+ * query or fragment. A pattern (a web-accessible resource's `*`) names no one file, and an address none at all.
+ */
+function namedFiles(manifest) {
+  const named = [];
+  const add = (path, what) => {
+    if (typeof path !== 'string' || path.includes('*') || /^[a-z][a-z0-9+.-]*:/i.test(path)) return;
+    const clean = posix.normalize(path.split(/[?#]/)[0].replace(/^(?:\.?\/)+/, ''));
+    if (clean && clean !== '.' && clean !== '..' && !clean.startsWith('../')) named.push([clean, what]);
+  };
+  const list = (value) => (Array.isArray(value) ? value : []);
+  const icons = (value) => { for (const path of value && typeof value === 'object' ? Object.values(value) : [value]) add(path, 'an icon'); };
+  add('manifest.json', 'the manifest');
+  add(manifest.background?.service_worker, 'the background service worker');
+  for (const path of list(manifest.background?.scripts)) add(path, 'a background script');
+  add(manifest.background?.page, 'the background page');
+  for (const script of list(manifest.content_scripts)) {
+    for (const path of list(script?.js)) add(path, 'a content script');
+    for (const path of list(script?.css)) add(path, "a content script's style sheet");
+  }
+  for (const surface of ['action', 'browser_action', 'page_action']) { add(manifest[surface]?.default_popup, 'the popup'); icons(manifest[surface]?.default_icon); }
+  add(manifest.side_panel?.default_path, 'the side panel');
+  add(manifest.sidebar_action?.default_panel, 'the side panel');
+  icons(manifest.sidebar_action?.default_icon);
+  add(manifest.options_page, 'the options page');
+  add(manifest.options_ui?.page, 'the options page');
+  add(manifest.devtools_page, 'the DevTools page');
+  if (manifest.chrome_url_overrides && typeof manifest.chrome_url_overrides === 'object') for (const path of Object.values(manifest.chrome_url_overrides)) add(path, 'a page it replaces');
+  for (const path of list(manifest.sandbox?.pages)) add(path, 'a sandboxed page');
+  icons(manifest.icons);
+  for (const entry of list(manifest.web_accessible_resources)) for (const path of typeof entry === 'string' ? [entry] : list(entry?.resources)) add(path, 'a web-accessible resource');
+  for (const rules of list(manifest.declarative_net_request?.rule_resources)) add(rules?.path, 'a rule set');
+  add(manifest.storage?.managed_schema, 'its managed storage schema');
+  if (typeof manifest.default_locale === 'string') add(`_locales/${manifest.default_locale}/messages.json`, 'its default locale');
+  return named;
+}
 
 const CRC_TABLE = Array.from({ length: 256 }, (_, n) => { let c = n; for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1; return c >>> 0; });
 const crc32 = (buf) => { let c = 0xffffffff; for (const b of buf) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8); return (c ^ 0xffffffff) >>> 0; };
@@ -530,9 +589,22 @@ function zipOf(entries) {
  * link: one out of the folder can put ~/.ssh/id_rsa in a store zip as logo.png, and one inside it the folder's own
  * .env or .git, under an innocent name (25 Sep 2026). Nor a name no zip should hold — a backslash, which unzips as a
  * folder, or a control character — nor anything but a file. A zip is public once the store serves it.
+ *
+ * A build has already followed the links of the project it came from: what they pointed at is an ordinary file here.
+ * So a file is also private when it is a copy of one of the project's (`copyOf`), a folder when it is a git
+ * repository's own, and a file named as an image when it holds none (round 7, 25 Sep 2026).
+ *
+ * And a compressed file is what it holds (round 8, 25 Sep 2026): a build's compression plugin writes data.json.gz and
+ * data.json.br beside data.json, and `pack` left data.json out as private while it packed both. One beside a file left
+ * out goes with it, however large; any other is opened, a few MB of it at most (lib/safe.js), and judged as the file.
+ *
+ * And git's other files are git's, whatever their names — its index, its refs, its logs, a config (round 9, 25 Sep 2026).
  */
-function filesIn(root) {
+function filesIn(root, copyOf = () => null, fromLink = () => null) {
   const found = []; const left = []; const privately = [];
+  const allowed = flag('--allow-private');
+  const judge = (name, bytes) => privateKind(name) ?? copyOf(bytes) ?? privateContent(bytes) ?? gitObject(bytes) ?? gitFile(bytes) ?? notAnImage(name, bytes);
+  const judged = new Map(); // what each file found private is, by its path: a compressed one beside it is the same
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
@@ -541,10 +613,28 @@ function filesIn(root) {
       const st = lstatSync(p);
       if (st.isSymbolicLink()) { left.push([rel, 'a link']); continue; }
       if (/[\\\u0000-\u001f\u007f]/.test(name)) { left.push([rel, 'a name no zip should hold']); continue; }
-      if (st.isDirectory()) { walk(p); continue; }
+      // What a build copied from a link into .git, or to a private file, left out whole, as the link's (round 8).
+      const via = fromLink(rel);
+      if (via) { judged.set(rel, via); if (!allowed) { left.push([rel, via]); continue; } privately.push([rel, via]); }
+      if (st.isDirectory()) {
+        // Left out whole, unwalked: its config and its history are the repository's, whatever the folder is called.
+        const git = gitDirectory(p) ? 'a git directory' : gitObjects(p) ? 'git history' : null;
+        if (git && !via) { if (!allowed) { left.push([rel, git]); continue; } privately.push([rel, git]); }
+        walk(p);
+        continue;
+      }
       if (!st.isFile()) { left.push([rel, 'not a file']); continue; }
-      const why = privateKind(name) ?? privateContent(readFileSync(p));
-      if (why && !flag('--allow-private')) left.push([rel, why]);
+      const bytes = readFileSync(p);
+      let why = judge(name, bytes);
+      if (!why) {
+        // Sorted, data.json comes before data.json.br and data.json.gz: its verdict is known when theirs is asked.
+        const twin = COMPRESSED.test(name) ? judged.get(rel.replace(COMPRESSED, '')) : null;
+        const inner = twin ? null : unpacked(name, bytes);
+        const held = twin ?? (inner && judge(inner.name, inner.bytes));
+        if (held) why = `${held}, compressed`;
+      }
+      if (why) judged.set(rel, why);
+      if (why && !allowed) left.push([rel, why]);
       else { found.push(p); if (why) privately.push([rel, why]); }
     }
   };
@@ -552,6 +642,9 @@ function filesIn(root) {
   return { found, left, privately };
 }
 
+/** A path as the developer knows it: under their home folder, from ~. */
+const fromHome = (path) => (path.startsWith(homedir() + sep) ? `~${path.slice(homedir().length)}` : path);
+
 function pack() {
   const given = positional[0];
   const folder = given ? resolve(given) : BUILD_DIRS.map((d) => resolve(d)).find((d) => existsSync(join(d, 'manifest.json')));
@@ -563,7 +656,41 @@ function pack() {
   // One to four numbers, as Chrome and the store take it — and a file name here: the zip is named with it, and a
   // version with "../" in it put the zip outside the folder.
   if (typeof manifest.version !== 'string' || !/^\d{1,5}(\.\d{1,5}){0,3}$/.test(manifest.version)) fail(`manifest.json's "version" is ${JSON.stringify(manifest.version)}: Chrome takes one to four numbers separated by dots, like 1.2.0.`);
-  const { found: files, left, privately } = filesIn(folder);
+  // The project the build came from — or, with none above it, the folder alone — and the command's own secrets: what a
+  // build could have copied in under another name, by following a link (lib/safe.js).
+  const project = projectRoot(folder);
+  const allowed = flag('--allow-private');
+  const copyOf = privateCopies(project ?? folder, [[CREDENTIALS, `${fromHome(CREDENTIALS)}, this command's session`], [DEV_SECRET_FILE, `${fromHome(DEV_SECRET_FILE)}, this machine's webhook secret`]]);
+  // What a link in the project's public folders put into the build, when it points into .git or at a private file.
+  const leaking = project ? privateLinks(project, folder) : [];
+  // A public folder that is itself such a link, or a build whose top is a git repository's own folder, is refused: the
+  // build copied what the link points at to the top of its output, among the extension's own files, and nothing tells
+  // them apart — `public -> .git` put the repository's index, its logs and its last commit message in the zip (round 9,
+  // 25 Sep 2026).
+  const whole = leaking.filter((l) => !l.within);
+  if (whole.length && !allowed) fail(`Not packed: ${whole.map((l) => `${oneLine(l.link)} is ${l.why}`).join(', ')}. A build copies what a public folder links to, whole, to the top of its output.\n  Make ${whole.length > 1 ? 'each' : 'it'} a folder of its own, build again, and pack. (--allow-private packs it anyway.)`);
+  if (gitDirectory(folder) && !allowed) fail(`Not packed: ${oneLine(relative(process.cwd(), folder) || '.')} is a git repository's own folder (HEAD, config and its history), as a build leaves when its public folder is a link to .git.\n  Make the public folder a folder of its own, build again, and pack. (--allow-private packs it anyway.)`);
+  const fromLink = (rel) => { const hit = leaking.find((l) => l.within && (rel === l.within || rel.startsWith(`${l.within}/`))); return hit ? `from ${hit.link}, ${hit.why}` : null; };
+  const { found: files, left, privately } = filesIn(folder, copyOf, fromLink);
+  // What was left out as no file of the folder's own, and what as private.
+  const links = left.filter(([, why]) => NOT_OWN.includes(why));
+  const kept = left.filter((entry) => !links.includes(entry));
+
+  // A file the manifest names that is left out makes a zip Chrome does not load, or loads without its worker, a page or
+  // an icon: refused, and nothing written (round 9, 25 Sep 2026). --allow-private packs a private one; a link, never.
+  const broken = [];
+  for (const [path, what] of namedFiles(manifest)) {
+    const gone = left.find(([rel]) => path.toLowerCase() === rel.toLowerCase() || path.toLowerCase().startsWith(`${rel.toLowerCase()}/`));
+    if (gone && !broken.some(([p]) => p === path)) broken.push([path, what, gone[1]]);
+  }
+  if (broken.length) {
+    const secret = broken.filter(([, , why]) => !NOT_OWN.includes(why)).length;
+    const advice = [
+      secret && `Take out what is private and build again, or pack ${secret > 1 ? 'them' : 'it'} anyway with --allow-private, for anyone who downloads the item to read.`,
+      secret < broken.length && 'The zip holds the folder\'s own files, and never a link: make each the file itself.',
+    ].filter(Boolean);
+    fail(`Not packed: the manifest names ${broken.length > 1 ? 'files' : 'a file'} this leaves out, and the zip would not load:\n\n${broken.map(([path, what, why]) => `  · ${oneLine(path)}, ${what} (${oneLine(why)})`).join('\n')}\n\n  ${advice.join('\n  ')}`);
+  }
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -575,7 +702,7 @@ function pack() {
       try { const facts = JSON.parse(Buffer.from(k.split('_')[2], 'base64url').toString('utf8')); if (typeof facts.s === 'string') sites.add(facts.s.replace(/\/$/, '')); } catch { /* not a key after all */ }
     }
   }
-  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx toolaby wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
+  if ((modes.has('test') || modes.has('dev')) && !flag('--allow-test')) problems.push(`It carries a ${[...modes].filter((m) => m !== 'live').map((m) => `tk_${m}_`).join(' and ')} key: it would sell on ${modes.has('test') ? 'Test, with test cards' : 'a development Wall'}. Run \`npx -y toolaby@latest wire <tool-id> --live --force\`, build again, then pack. (--allow-test packs it anyway, for a build you will not publish.)`);
   if (modes.size === 0) out('\n  No tool key found in the build: it is not wired to the Wall, or the key is somewhere this cannot read. Packing anyway.');
 
   // Addresses of this machine have no place in a store build.
@@ -585,7 +712,7 @@ function pack() {
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx toolaby wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
@@ -606,12 +733,17 @@ function pack() {
   renameSync(fresh, target);
   const kb = (statSync(target).size / 1024).toFixed(0);
   out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
-  // What was left out, and why — or, asked for, what private file went in: a store zip is public.
-  const links = left.filter(([, why]) => why === 'a link' || why === 'not a file' || why === 'a name no zip should hold');
-  const kept = left.filter((entry) => !links.includes(entry));
-  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
+  // What was left out, and why — or, asked for, what private file went in: a store zip is public. A reason can name a
+  // file of the project's (a copy of…, from a link…), and so is put on one line, as the file's own name is.
+  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${oneLine(why)})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
   if (links.length) out(`  Left out: ${links.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
-  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${oneLine(why)})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  // Packed and named: a Google API key is made to be in a browser, and kept to its use by its restrictions (lib/safe.js).
+  const google = entries.filter(([, bytes]) => googleKey(bytes)).map(([name]) => oneLine(name));
+  if (google.length) out(`  ${google.length > 1 ? 'Google API keys are' : 'A Google API key is'} in ${google.join(', ')}: anyone who downloads the item can read ${google.length > 1 ? 'them' : 'it'}. Restrict ${google.length > 1 ? 'each' : 'it'} to this extension, and to the APIs it calls, in Google Cloud → Credentials.`);
+  // Said, not refused: the links are the project's, not the build's, and the build may hold nothing of theirs yet.
+  const linked = project ? publicLinks(project, folder) : [];
+  if (linked.length) out(`  Links in the folders a build copies as they are: ${linked.slice(0, 8).map(oneLine).join(', ')}${linked.length > 8 ? ` and ${linked.length - 8} more` : ''}. The build copies what each points at, a private file too: make each the file itself.`);
   if (hadKey) out('  The manifest\'s "key" is left out: the store keeps the id it gives the item. Your unpacked copy keeps the key and its own id; the Wall admits both once the listing\'s address is on the tool.');
   out('  Upload it at https://chrome.google.com/webstore/devconsole — a new item, or Package → Upload new package.\n');
 }
@@ -641,7 +773,10 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
-                                       leaves out keys, certificates, .env and credential files, source maps   --allow-private packs them
+                                       leaves out keys, certificates, .env and credential files, source maps, secrets,
+                                       git's files, a build's copy of a private file (compressed, UTF-16 or base64),
+                                       an image that is none; refuses a build if one is a file the manifest names
+                                       --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
@@ -654,6 +789,9 @@ function help() {
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
     sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
+
+    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
+    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 

package/lib/check.js

@@ -76,47 +76,47 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   // 2. The Wall's files.
   const at = (f) => join(dir, `${project.codeDir}${f}`);
   const missing = ['toolaby.js', 'toolaby.config.js'].filter((f) => !existsSync(at(f)));
-  if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx toolaby wire <tool-id>\` here.`); return false; }
+  if (missing.length) { bad(`${missing.map((f) => `${project.codeDir}${f}`).join(' and ')} missing. Run \`npx -y toolaby@latest wire <tool-id>\` here.`); return false; }
   ok(`The Wall's files are in ${project.codeDir || 'the top folder'}.`);
 
   // 3. The tool key, and the tool it names — from a file: a link to a device or a pipe is read as nothing.
   const configText = readOr(at('toolaby.config.js'), '');
   const keyText = configText.match(KEY)?.[0];
   const key = keyText ? decodeKey(keyText) : null;
-  if (!key) { bad('toolaby.config.js holds no tool key. Run `npx toolaby upgrade <tool-id>` here.'); return false; }
+  if (!key) { bad('toolaby.config.js holds no tool key. Run `npx -y toolaby@latest upgrade <tool-id>` here.'); return false; }
   const mode = keyText.split('_')[1];
   // The key is the project's: the Wall it names is asked twice below, with no session, and its tool id goes into a path
   // the developer's session asks of their own Wall. So only a Wall's address (lib/safe.js), and only a tool id. A cloned
   // project's key sent the two requests wherever it named, and a tool id of ".." made the signed-in one a request for
   // another route (25 Sep 2026).
   if (!keySite(key.site) || !TOOL_ID.test(key.slug)) {
-    bad(`The tool key names ${JSON.stringify(key.slug)} at ${JSON.stringify(key.site)}, which is not a tool on a Wall: its address is https (http only on this machine) with nothing after the host, and its id lowercase letters, digits and dashes. Nothing was asked of it. \`npx toolaby upgrade <tool-id>\` writes the tool's own key.`);
+    bad(`The tool key names ${JSON.stringify(key.slug)} at ${JSON.stringify(key.site)}, which is not a tool on a Wall: its address is https (http only on this machine) with nothing after the host, and its id lowercase letters, digits and dashes. Nothing was asked of it. \`npx -y toolaby@latest upgrade <tool-id>\` writes the tool's own key.`);
     return false;
   }
   ok(`The tool key names ${key.slug}, on ${mode === 'live' ? 'Live' : mode === 'test' ? 'Test' : 'a development Wall'} (${key.site}).`);
   const pub = await fetchBounded(`${key.site}/api/tools/${encodeURIComponent(key.slug)}`).then((r) => ({ status: r.status, json: jsonOf(r.body) })).catch(() => ({ status: 0, json: null }));
   const tool = pub.status === 200 ? pub.json : null;
-  if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx toolaby tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
+  if (!tool) bad(pub.status === 0 ? `The Wall at ${key.site} could not be reached.` : pub.status === 404 ? `The Wall does not sell ${key.slug}: deleted, switched off, or on the other side. \`npx -y toolaby@latest tools${mode === 'live' ? ' --live' : ''}\` lists yours.` : `The Wall answered HTTP ${pub.status} for the tool.`);
   else {
     ok(`The Wall knows it: ${oneLine(tool.name)}.`);
     const jwk = tool.publicKeyJwk ?? {};
-    if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx toolaby upgrade <tool-id>` writes it in.');
+    if (key.x && jwk.x && (key.x !== jwk.x || key.y !== jwk.y)) warn('The workspace\'s signing key was rotated after this key was written. Installed copies fetch the new one; `npx -y toolaby@latest upgrade <tool-id>` writes it in.');
   }
 
   // 4. The manifest, against the platform's own wiring rules: what wiring it again would add.
   if (project.manifestFile && manifest) {
     const again = wireManifest(manifest, { site: key.site, has, remembered: null, rememberedSidePanel: null, manifestKey: typeof manifest.key === 'string' ? manifest.key : null });
     const needed = (again.did ?? []).filter((d) => !/popup|side panel/i.test(d));
-    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.map(oneLine).join('; ')}. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    if (needed.length) bad(`The manifest lacks what the Wall needs: ${needed.map(oneLine).join('; ')}. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
     else ok('The manifest has the permissions and host permissions the Wall needs.');
     // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
-    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx toolaby upgrade ${key.slug}\` adds it.`);
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
   } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
 
   // 5. The client, as fresh as the Wall's.
   const client = await fetchBounded(`${key.site}/client/toolaby.js`).then((r) => (r.ok && r.body ? r.body.toString('utf8') : null)).catch(() => null);
   if (client === null) warn('The Wall\'s current client could not be read to compare.');
-  else if (sha(client) !== sha(readOr(at('toolaby.js'), ''))) warn(`toolaby.js is not the Wall's current client. \`npx toolaby upgrade ${key.slug}\` replaces it (your own files stay).`);
+  else if (sha(client) !== sha(readOr(at('toolaby.js'), ''))) warn(`toolaby.js is not the Wall's current client. \`npx -y toolaby@latest upgrade ${key.slug}\` replaces it (your own files stay).`);
   else ok('toolaby.js is the Wall\'s current client.');
 
   // 6. The features the code gates on, against the tool's; and the page showPaywall() opens.
@@ -124,7 +124,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   if (project.manifestFile && manifest && sources.some((s) => /\bshowPaywall\s*\(/.test(withoutComments(s)))) {
     const pages = [manifest.action?.default_popup ? 'toolaby-popup.html' : null, (manifest.side_panel?.default_path || manifest.sidebar_action?.default_panel) ? 'toolaby-sidepanel.html' : null].filter(Boolean);
     const absent = pages.filter((p) => !existsSync(join(dir, `${project.popupDir}${p}`)));
-    if (absent.length) warn(`The code calls toolaby.showPaywall(), which opens ${absent.join(' and ')}, and the extension has no such page: the paywall opens the buyer page in a new tab instead. \`npx toolaby upgrade ${key.slug}\` writes ${absent.length > 1 ? 'them' : 'it'}; your pages stay in front.`);
+    if (absent.length) warn(`The code calls toolaby.showPaywall(), which opens ${absent.join(' and ')}, and the extension has no such page: the paywall opens the buyer page in a new tab instead. \`npx -y toolaby@latest upgrade ${key.slug}\` writes ${absent.length > 1 ? 'them' : 'it'}; your pages stay in front.`);
   }
   if (tool) {
     const used = new Set();
@@ -146,7 +146,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     else if (facts?.ok) warn('No copy has checked in yet: load it at chrome://extensions and open it once.');
     // The key carries what the Free plan holds and the kind of plan sold: a change since it was written leaves it behind.
     const current = facts?.ok ? facts.json?.toolKey : null;
-    if (typeof current === 'string' && current.split('_')[1] === mode && current !== keyText) warn(`The tool key in toolaby.config.js is older than the Wall's: what the Free plan holds, the plans or the signing key changed since it was written. \`npx toolaby upgrade ${key.slug}\` writes the current one.`);
+    if (typeof current === 'string' && current.split('_')[1] === mode && current !== keyText) warn(`The tool key in toolaby.config.js is older than the Wall's: what the Free plan holds, the plans or the signing key changed since it was written. \`npx -y toolaby@latest upgrade ${key.slug}\` writes the current one.`);
   }
 
   // 8. In a browser: the background answers.

package/lib/mcp.js

@@ -1,6 +1,6 @@
 // `toolaby mcp`: the Wall for coding agents, as a Model Context Protocol server on stdio.
 //
-// An agent (Claude Code, Cursor, Codex, any MCP client) starts it — `claude mcp add toolaby -- npx -y toolaby mcp` —
+// An agent (Claude Code, Cursor, Codex, any MCP client) starts it — `claude mcp add toolaby -- npx -y toolaby@latest mcp` —
 // and gets tools to read and change the developer's tools on the Wall: what the Free plan holds, features, plans,
 // grants, and the docs. It acts with the session `toolaby login` stored, on Test unless started with --live, through
 // the same routes and the same checks as the dashboard.
@@ -59,7 +59,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_create_tool',
       title: 'Create a tool',
-      description: `A new tool on the ${side} Wall. This changes what the developer's own workspace sells: one more tool. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx toolaby create <id>\` for a new one, \`npx toolaby wire <id>\` for an existing one.`,
+      description: `A new tool on the ${side} Wall. This changes what the developer's own workspace sells: one more tool. Its Free plan holds everything until access is set. Then wire an extension to it: \`npx -y toolaby@latest create <id>\` for a new one, \`npx -y toolaby@latest wire <id>\` for an existing one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -77,7 +77,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_set_access',
       title: 'Set what the Free plan holds',
-      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). This changes access in the developer\'s own workspace, for every buyer of the tool. Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx toolaby upgrade <id>` then writes the new one.',
+      description: 'What a buyer gets before paying: "open" (the tool\'s use, unlimited), "free_uses" (a number of uses per device, counted by gate() without a feature), or "paid" (nothing before a plan). This changes access in the developer\'s own workspace, for every buyer of the tool. Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check. The answer says when the tool key changed: `npx -y toolaby@latest upgrade <id>` then writes the new one.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -129,7 +129,7 @@ function toolsFor(side) {
     {
       name: 'toolaby_add_plan',
       title: 'Add a plan',
-      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). This changes billing in the developer's own workspace. "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx toolaby upgrade <id>\` then writes the new one.`,
+      description: `A plan buyers can buy: a Price on the workspace's Stripe account (${side === 'Test' ? 'on Test, its test account' : 'on Live, the connected account'}). This changes billing in the developer's own workspace. "one_time" makes a lifetime licence; "subscription" bills monthly or yearly. Answers with the plan: its id (the tool's first plan is "default"), which openPaymentPage(id) takes, and its name as buyers see it, the name given and the kind ("Pro · Lifetime"). Then say what it unlocks with toolaby_set_features. The answer says when the tool key changed (the first subscription plan changes it): \`npx -y toolaby@latest upgrade <id>\` then writes the new one.`,
       inputSchema: {
         type: 'object',
         properties: {
@@ -208,7 +208,7 @@ export function runMcp({ version, side, wall, api, token }) {
       return { result: { content: [{ type: 'text', text: 'A tool id is lowercase letters, digits and dashes, as toolaby_list_tools gives it.' }], isError: true } };
     }
     if (name !== 'toolaby_docs' && !token()) {
-      return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx toolaby login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
+      return { result: { content: [{ type: 'text', text: `Not signed in to the ${side} Wall (${wall}). Run \`npx -y toolaby@latest login${side === 'Live' ? ' --live' : ''}\` in a terminal, then call this again.` }], isError: true } };
     }
     try {
       return { result: resultOf(await t.run(args ?? {}, api, docs)) };
@@ -229,7 +229,7 @@ export function runMcp({ version, side, wall, api, token }) {
           protocolVersion: PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
           capabilities: { tools: { listChanged: false } },
           serverInfo: { name: 'toolaby', title: 'Toolaby Wall', version },
-          instructions: `The Toolaby Wall (${side}, ${wall}): accounts, licences, subscriptions and the paywall for Chrome extensions. Read a tool with toolaby_get_tool before changing it; the extension gates paid work with toolaby.gate({ feature }) and each feature key must exist on the tool (toolaby_set_features). Wire files with the shell: npx toolaby create|wire|upgrade <id>, check with npx toolaby check. toolaby_docs reads the docs.`,
+          instructions: `The Toolaby Wall (${side}, ${wall}): accounts, licences, subscriptions and the paywall for Chrome extensions. Read a tool with toolaby_get_tool before changing it; the extension gates paid work with toolaby.gate({ feature }) and each feature key must exist on the tool (toolaby_set_features). Wire files with the shell: npx -y toolaby@latest create|wire|upgrade <id>, check with npx -y toolaby@latest check. toolaby_docs reads the docs.`,
         } });
       }
       case 'notifications/initialized':
@@ -248,7 +248,7 @@ export function runMcp({ version, side, wall, api, token }) {
     }
   };
 
-  log(`${side} · ${wall} · ${token() ? 'signed in' : 'not signed in: tools ask for `npx toolaby login`'}`);
+  log(`${side} · ${wall} · ${token() ? 'signed in' : 'not signed in: tools ask for `npx -y toolaby@latest login`'}`);
   let buffer = '';
   process.stdin.setEncoding('utf8');
   process.stdin.on('data', (chunk) => {

package/lib/safe.js

@@ -1,6 +1,6 @@
 // What this command will not do, whoever asks: write outside the project it was pointed at, write a file of a new
 // extension it does not know, open a sign-in page that is not the Wall's, put a private file in a store zip, print a
-// line it did not write, ask whatever address a project names, or take a download without end.
+// line it did not write, ask whatever address a project names, or take a download or wait for a sign-in without end.
 //
 // Each of these took someone else's word. A cloned repository's manifest named the file `wire` wrote — a service
 // worker at "../../.zshrc" overwrote the shell's startup file — and a link in the folder took a write wherever it
@@ -8,8 +8,11 @@
 // address (--wall, TOOLABY_WALL) could write any file with any content. And on Windows the sign-in address went
 // through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
 // command's own boundary, not a wiring rule the browser shares.
-import { lstatSync, readFileSync, statSync } from 'node:fs';
-import { isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync, constants as zlibConstants } from 'node:zlib';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
 
 /**
  * The minimal extension's own files, as the Wall names them (SCAFFOLD_FILES in wall/src/packages/wiring/files.ts;
@@ -88,8 +91,17 @@ export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {
     url = next.href;
     res = await fetch(url, { redirect: 'manual', signal });
   }
-  const answered = { status: res.status, ok: res.ok };
-  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return { ...answered, body: null }; }
+  return { status: res.status, ok: res.ok, body: await readBounded(res, limit) };
+}
+
+/**
+ * A response's body, up to `limit` bytes and no further: null past it, and the rest let go of unread. What a server
+ * sends is read as it comes, so one that answered without end filled the command's memory — `fetchBounded`'s
+ * downloads, and every answer of a Wall at another address (--wall, TOOLABY_WALL), which the MCP server also handed
+ * on to an agent (25 Sep 2026).
+ */
+export async function readBounded(res, limit) {
+  if (Number(res.headers.get('content-length')) > limit) { await res.body?.cancel().catch(() => {}); return null; }
   const chunks = [];
   let size = 0;
   const reader = res.body?.getReader();
@@ -97,26 +109,31 @@ export async function fetchBounded(url, { limit = 1024 * 1024, ms = 30_000 } = {
     const { done, value } = reader ? await reader.read() : { done: true };
     if (done) break;
     size += value.byteLength;
-    if (size > limit) { await reader.cancel().catch(() => {}); return { ...answered, body: null }; }
+    if (size > limit) { await reader.cancel().catch(() => {}); return null; }
     chunks.push(value);
   }
-  return { ...answered, body: Buffer.concat(chunks) };
+  return Buffer.concat(chunks);
 }
 
 /**
  * A request that follows a redirect only within the address it asked — a Wall moving a page on its own host — and
  * refuses one elsewhere: fetch drops the session on the way, but the command took whatever the other address answered
  * for the Wall's word, and the MCP server handed an agent a page from any host (25 Sep 2026).
+ *
+ * And one that gives up at its time: the answer, redirects and body alike — read or not yet — within `ms` of asking, or
+ * a TimeoutError, as fetchBounded's. Bounded in size alone, a Wall that answered a byte at a time held `login`, `wire`
+ * and the MCP server for ever (round 8, 25 Sep 2026).
  */
-export async function fetchHere(url, init = {}) {
+export async function fetchHere(url, { ms = 30_000, ...init } = {}) {
+  const signal = AbortSignal.timeout(ms);
   const origin = new URL(url).origin;
-  let res = await fetch(url, { ...init, redirect: 'manual' });
+  let res = await fetch(url, { ...init, redirect: 'manual', signal });
   for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
     const next = new URL(res.headers.get('location'), url);
     await res.body?.cancel().catch(() => {});
     if (next.origin !== origin) throw new Error(`it answered with a redirect to ${next.origin}, which is not followed`);
     url = next.href;
-    res = await fetch(url, { ...init, redirect: 'manual' });
+    res = await fetch(url, { ...init, redirect: 'manual', signal });
   }
   return res;
 }
@@ -139,16 +156,520 @@ export function readText(path, limit = READ_LIMIT) {
 /**
  * Why a file's contents have no place in a store zip, whatever it is called, or null: a private key, a cloud service
  * account's key, a source map written into the code. Names alone let `key.txt`, a Google Cloud key under the name
- * its console gives it, and a bundle's inline map through (25 Sep 2026).
+ * its console gives it, and a bundle's inline map through (25 Sep 2026). So did a live secret in a file of any name
+ * — a Stripe or AWS key, a GitHub, Slack or npm token, a password in an address — until round 7 of the same day, and
+ * an OpenAI or Anthropic key, a Slack app token, a Stripe test key and an AWS secret access key until round 8.
+ *
+ * All of the file, in each form a copy of a text takes (readThrough): the first 4 MB alone were read, so a key further
+ * into a large bundle was packed; and a copy in UTF-16, or in base64, held its secret between NULs or in other letters
+ * (round 9, 25 Sep 2026).
  */
 export function privateContent(bytes) {
-  const text = bytes.subarray(0, 4 * 1024 * 1024).toString('latin1');
-  if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
-  if (/-----BEGIN [A-Z0-9 ]*PRIVATE KEY( BLOCK)?-----/.test(text)) return 'a private key inside';
-  if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+  return readThrough(bytes, (text) => {
+    if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
+    if (pemKey(text)) return 'a private key inside';
+    if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+    for (const [shape, why, honest] of SECRETS) for (const found of text.matchAll(shape)) if (!standIn(found[1] ?? found[0]) && !honest?.(found)) return why;
+    if (passwordIn(text)) return 'a password in an address inside';
+    return null;
+  });
+}
+
+/**
+ * A secret by its whole shape, and what to call it — never by its prefix alone, which code that checks for one holds
+ * (`key.startsWith('sk_live_')`), nor a publishable key, which is made to be in a browser — and, for some, what says
+ * the one found is honest after all. Where a shape captures, the capture is the secret, and the rest what names it.
+ */
+const SECRETS = [
+  [/\b[rs]k_live_[0-9A-Za-z]{24,}/g, 'a Stripe live key inside'],
+  // A test key reads and writes the account's test data, customers' addresses among them: a secret too (round 8).
+  [/\b[rs]k_test_[0-9A-Za-z]{24,}/g, 'a Stripe test key inside'],
+  [/\bwhsec_[A-Za-z0-9+/]{24,}/g, 'a webhook signing secret inside'],
+  // A long-term key's id, or a temporary one's (ASIA…), which comes with its secret and a session token (round 9).
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, 'an AWS access key inside'],
+  // Its secret, which a file can hold without the AKIA id beside it: 40 characters of base64 where a name says what
+  // they are (aws_secret_access_key, AWS_SECRET_ACCESS_KEY, secretAccessKey…), both cases in them, as no hex digest's.
+  [/(?:(?<![A-Za-z0-9])aws[\w.-]{0,30}?|secret_?access_?key)["']?[ \t]{0,16}(?:[:=]|=>)[ \t]{0,16}["']?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+=])/gi, 'an AWS secret access key inside', ([, key]) => !/[A-Z]/.test(key) || !/[a-z]/.test(key)],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{82,})/g, 'a GitHub token inside'],
+  [/\bxox[abprs]-\d+-[A-Za-z0-9-]{20,}/g, 'a Slack token inside'],
+  [/\bxapp-\d-[A-Z0-9]{8,}-\d{8,}-[A-Za-z0-9]{32,}/g, 'a Slack app token inside'],
+  [/\bnpm_[A-Za-z0-9]{36,}/g, 'an npm token inside'],
+  // Google's OAuth client secret, which signs in as the app: both cases after GOCSPX-, as no placeholder has (round 9).
+  [/\bGOCSPX-[A-Za-z0-9_-]{20,}/g, 'a Google OAuth client secret inside', ([secret]) => !/[A-Z]/.test(secret.slice(7)) || !/[a-z]/.test(secret.slice(7))],
+  // OpenAI's: a project's, a service account's or an admin's, or the first kind, 48 characters after sk-.
+  [/\bsk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{80,}|[A-Za-z0-9]{48}(?![A-Za-z0-9_-]))/g, 'an OpenAI key inside'],
+  [/\bsk-ant-[a-z]{2,8}\d{2}-[A-Za-z0-9_-]{80,}/g, 'an Anthropic key inside'],
+  // A PuTTY key file by its first two lines, the key's kind and then its encryption: code that reads one holds neither (round 9).
+  [/PuTTY-User-Key-File-\d+: [\w.@-]+(?:\r?\n|(?:\\r)?\\n)Encryption: [\w-]+/g, 'a private key inside'],
+  // Supabase's service_role key: a JWT whose payload names the role, which passes every row-level rule. The anon key and
+  // a signed-in user's token have the same shape, and are made to be in a browser, as a publishable key is (round 9).
+  [/\bey[A-Za-z0-9_-]{10,500}\.ey[A-Za-z0-9_-]{10,4000}\.[A-Za-z0-9_-]{20,1000}/g, 'a Supabase service_role key inside', ([jwt]) => !adminRole(jwt)],
+];
+/** What stands where a secret goes, in docs and examples: a run of one character, or AWS's own EXAMPLE key. */
+const standIn = (found) => /(.)\1{7}/.test(found) || found.includes('EXAMPLE');
+/** Whether a JWT's payload names Supabase's service_role, or its supabase_admin. */
+function adminRole(jwt) {
+  try { return ['service_role', 'supabase_admin'].includes(JSON.parse(Buffer.from(jwt.split('.')[1], 'base64url').toString('utf8')).role); } catch { return false; }
+}
+
+/** A Google API key: `AIza` and 35 more. */
+const GOOGLE_KEY = /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g;
+/**
+ * Whether a file holds a Google API key, a stand-in aside. Such a key is made to be in a browser — a Firebase web
+ * config's, the Maps or YouTube key an extension calls with — and is kept to its use by its restrictions in Google
+ * Cloud, not by being unseen. `pack` packs the file and names it (round 9, 25 Sep 2026): it left it out until then,
+ * breaking the zip for a lone Firebase key or a YouTube key, and let any key through beside a Firebase word.
+ */
+export function googleKey(bytes) {
+  return readThrough(bytes, (text) => ([...text.matchAll(GOOGLE_KEY)].some(([key]) => !standIn(key)) ? 'a Google API key' : null)) !== null;
+}
+
+/** How much of a file is read as text at once, and how far each piece reaches back into the one before: further than any shape read here, a private key's 32 KB among them. */
+const PIECE = 4 * 1024 * 1024;
+const OVERLAP = 128 * 1024;
+
+/**
+ * The first answer `look` gives for a file's text, with the form the file held it in, or null. Each of the file's
+ * readings is read in pieces of PIECE bytes, each reaching OVERLAP back into the one before: what a boundary splits is
+ * whole in one of them, and no string is larger than a piece, however large the file.
+ */
+function readThrough(bytes, look) {
+  for (const [view, how] of readings(bytes)) {
+    for (let from = 0; from < view.length; from += PIECE - OVERLAP) {
+      const found = look(view.subarray(from, from + PIECE).toString('latin1'));
+      if (found) return `${found}${how}`;
+      if (from + PIECE >= view.length) break;
+    }
+  }
+  return null;
+}
+
+/**
+ * A file's bytes in each form a copy of a text takes, as [bytes, how it held them]: as they are; decoded from UTF-16,
+ * as Windows PowerShell 5.1 writes `Get-Content .env > dist\data.txt`; decoded from base64, where the file is that and
+ * nothing else; and one inside the other, three deep, since PowerShell's `>` writes base64 in UTF-16 too. Only a file
+ * of `limit` bytes at most is decoded (round 9, 25 Sep 2026).
+ */
+function readings(bytes, limit = Infinity, how = '', depth = 3) {
+  const all = [[bytes, how && `, in ${how}`]];
+  if (!depth || bytes.length > limit) return all;
+  const order = utf16(bytes);
+  if (order) all.push(...readings(fromUtf16(bytes, order), limit, how ? `${how} and UTF-16` : 'UTF-16', depth - 1));
+  const held = fromBase64(bytes);
+  if (held) all.push(...readings(held, limit, how ? `${how} and base64` : 'base64', depth - 1));
+  return all;
+}
+
+/**
+ * Which way round a text in UTF-16 is, 'le' or 'be', or null: by its byte-order mark (FF FE, FE FF), or, with none, by
+ * the NULs of its Latin letters, in the same half of three pairs in four over its first 512.
+ */
+function utf16(bytes) {
+  if (bytes[0] === 0xff && bytes[1] === 0xfe) return 'le';
+  if (bytes[0] === 0xfe && bytes[1] === 0xff) return 'be';
+  const pairs = Math.min(bytes.length >> 1, 512);
+  if (pairs < 8) return null;
+  let low = 0; let high = 0;
+  for (let i = 0; i < pairs * 2; i += 2) {
+    if (bytes[i] && !bytes[i + 1]) low++;
+    else if (!bytes[i] && bytes[i + 1]) high++;
+  }
+  return low >= pairs * 0.75 ? 'le' : high >= pairs * 0.75 ? 'be' : null;
+}
+
+/** A text in UTF-16 as UTF-8, a piece at a time. */
+function fromUtf16(bytes, order) {
+  const even = bytes.length - (bytes.length % 2);
+  const parts = [];
+  for (let from = 0; from < even; from += PIECE) {
+    const piece = bytes.subarray(from, Math.min(from + PIECE, even));
+    // Big-endian turned round in a copy: swap16 turns the bytes it is given round where they are.
+    parts.push(Buffer.from((order === 'be' ? Buffer.from(piece).swap16() : piece).toString('utf16le'), 'utf8'));
+  }
+  return Buffer.concat(parts);
+}
+
+const BASE64 = new Uint8Array(256);
+for (const c of 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/-_') BASE64[c.charCodeAt(0)] = 1;
+/**
+ * What a file that is base64 and nothing else holds, or null: past blank space and a byte-order mark, 16 characters at
+ * least, of either alphabet, and `=` only at the end. Decoded a piece at a time: PIECE is a whole number of quartets.
+ */
+function fromBase64(bytes) {
+  let count = 0; let end = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    const b = bytes[i];
+    if (blank(b)) continue;
+    if (b === 0x3d) { if (++end > 2) return null; } else if (end || !BASE64[b]) return null;
+    count++;
+  }
+  if (count < 16 || (count - end) % 4 === 1) return null;
+  const parts = [];
+  const chars = Buffer.allocUnsafe(Math.min(count, PIECE));
+  let n = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    if (blank(bytes[i])) continue;
+    chars[n++] = bytes[i];
+    if (n === chars.length) { parts.push(Buffer.from(chars.toString('latin1'), 'base64')); n = 0; }
+  }
+  if (n) parts.push(Buffer.from(chars.toString('latin1', 0, n), 'base64'));
+  return Buffer.concat(parts);
+}
+
+/** An address with a password in it, `scheme://user:password@host`: the user and password as an address spells them. */
+const ADDRESS = /\b[a-z][a-z0-9+.-]{1,15}:\/\/([a-z0-9._~%!+,;=-]{1,64}):([a-z0-9._~%!+,;=-]{1,128})@([a-z0-9.-]+|\[[0-9a-f:.]+\])/gi;
+/** A password that is the example's word for one, as docs and error messages write it. */
+const EXAMPLE_PASSWORD = /^(?:pass(?:word|wd)?|pwd|pw|secret|changeme|x+|\.+|(?:your|my)[-_]?pass(?:word)?)$/i;
+/**
+ * Whether the text holds a live password in an address: not an example's (`user:password@`, a user's own name as its
+ * password, as local databases are set up), and not one for this machine, which reaches nothing elsewhere.
+ */
+function passwordIn(text) {
+  for (const [, user, password, host] of text.matchAll(ADDRESS)) if (password !== user && !EXAMPLE_PASSWORD.test(password) && !LOOPBACK.test(host)) return true;
+  return false;
+}
+
+const PEM_BEGIN = /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?)-----/g;
+/**
+ * Whether the text holds a PEM private key: its BEGIN line, lines of base64 after any header lines (Proc-Type,
+ * DEK-Info, a PGP block's Version), and its own END line — the line breaks real, or written as \n in JSON or a string.
+ * The BEGIN line alone is code's: jose's importPKCS8 checks a string starts with it, and a bundle holding jose was
+ * refused as a key until round 7 (25 Sep 2026).
+ */
+function pemKey(text) {
+  for (const begin of text.matchAll(PEM_BEGIN)) {
+    const from = begin.index + begin[0].length;
+    const to = text.indexOf(`-----END ${begin[1]}-----`, from);
+    if (to < 0 || to - from > 32 * 1024) continue;
+    const lines = text.slice(from, to).replace(/\\+[nr]|\r/g, '\n').split('\n').map((l) => l.trim().replace(/\\$/, '')).filter((l) => l && !/^[A-Za-z][A-Za-z-]*: /.test(l));
+    if (lines.length && lines.every((l) => /^[A-Za-z0-9+/=]+$/.test(l)) && lines.join('').length >= 40) return true;
+  }
+  return false;
+}
+
+/** Whether anything is at the path, a link to nowhere included. */
+const there = (path) => { try { lstatSync(path); return true; } catch { return false; } };
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+/**
+ * The project a built folder belongs to: the nearest folder at or above it with a package.json or a .git — or null,
+ * and never the home folder or the top of the disk, which are no project to look through.
+ */
+export function projectRoot(folder) {
+  const home = resolve(homedir());
+  for (let at = resolve(folder); at !== home && dirname(at) !== at; at = dirname(at)) {
+    if (there(join(at, 'package.json')) || there(join(at, '.git'))) return at;
+  }
+  return null;
+}
+
+/** The most of one file `pack` compares by its bytes, and how far into a project it looks for the private ones. */
+const COPY_LIMIT = 4 * 1024 * 1024;
+const LOOK = { depth: 4, entries: 20_000 };
+/** Folders the look for private files passes by: installed packages, caches, and git's own, of which only config is read. */
+const PASSED_BY = new Set(['node_modules', '.git', '.pnpm-store', '.yarn', '.next', '.turbo', '.cache']);
+
+/** Space, tab, and the line ends and feeds: what a text form changes, and what its start passes over. */
+const blank = (b) => b === 0x20 || (b >= 0x09 && b <= 0x0d);
+const bom = (bytes) => (bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf ? 3 : 0);
+
+/**
+ * A text as it reads, whatever an editor, a platform or a build did around its words: no byte-order mark, LF line
+ * ends, no space or tab at the end of a line, nothing blank at the end — or null for what is no text (a NUL in its
+ * first 8,000 bytes, as git judges one) or nothing but blank. One pass, and no pattern that could backtrack.
+ */
+function textForm(bytes) {
+  if (bytes.subarray(0, 8000).includes(0)) return null;
+  const out = Buffer.allocUnsafe(bytes.length);
+  let n = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    const b = bytes[i];
+    if (b !== 0x0a && b !== 0x0d) { out[n++] = b; continue; }
+    if (b === 0x0d && bytes[i + 1] === 0x0a) i++;
+    while (n && (out[n - 1] === 0x20 || out[n - 1] === 0x09)) n--;
+    out[n++] = 0x0a;
+  }
+  while (n && blank(out[n - 1])) n--;
+  return n ? out.subarray(0, n) : null;
+}
+
+/**
+ * The first 64 bytes of a text that are not blank, after a byte-order mark: every text form of a text starts with the
+ * same, so a file that starts otherwise is no copy — told without reading on. Null for a NUL among them, or none.
+ */
+function textStart(bytes) {
+  let start = '';
+  for (let i = bom(bytes); i < bytes.length && start.length < 64; i++) {
+    if (bytes[i] === 0) return null;
+    if (!blank(bytes[i])) start += String.fromCharCode(bytes[i]);
+  }
+  return start || null;
+}
+
+/** The names a build gives a compressed copy: vite-plugin-compression's and compression-webpack-plugin's, beside the file. */
+export const COMPRESSED = /\.(gz|br)$/i;
+
+/**
+ * What a compressed file holds, and the name it had — `{ name, bytes }` — or null: a gzip whatever its name, and by the
+ * name a build gives it a .gz of zlib's (a plugin's "deflate") or a .br. Opened to `limit` bytes and no further, as
+ * zlib's maxOutputLength stops it: one that holds more, a bomb among them, is null, as are what is not compressed and
+ * what does not open. A build's compression plugin writes data.json.gz and .br beside data.json, and `pack` judged
+ * them by their compressed bytes, in which nothing private can be read (round 8, 25 Sep 2026).
+ *
+ * A .gz that is not zlib's is opened as raw deflate, which has no header to know it by: vite-plugin-compression's
+ * deflateRaw writes one under that name, and it was packed (round 9, 25 Sep 2026).
+ */
+export function unpacked(name, bytes, limit = COPY_LIMIT) {
+  const ways = bytes[0] === 0x1f && bytes[1] === 0x8b ? [gunzipSync] : /\.br$/i.test(name) ? [brotliDecompressSync] : /\.gz$/i.test(name) ? [inflateSync, inflateRawSync] : [];
+  for (const open of ways) {
+    try { return { name: name.replace(COMPRESSED, ''), bytes: open(bytes, { maxOutputLength: limit }) }; } catch { /* the next way, if there is one */ }
+  }
+  return null;
+}
+
+/**
+ * What says a file of a build is a copy of a private one: `why(bytes)`, which answers "a copy of .env, an environment
+ * file" or null. Its bytes are compared (SHA-256) with every file under `root` that is private by its name (privateKind:
+ * .env files, keys, .npmrc, credentials…), with `root`'s .git/config, and with `more` — [path, what it is] — each a
+ * few MB at most and not empty. A build resolves a link before `pack` sees it: WXT and Vite copy what a link in public/
+ * points at as an ordinary file under the link's name, so a cloned template's public/icon-128.png -> ../.env reached
+ * the zip as a PNG, the developer's .env inside (25 Sep 2026).
+ *
+ * And so is their text: a copy with CRLF line ends, a byte-order mark, or a newline more or less at its end had other
+ * bytes, and was packed (round 8, 25 Sep 2026). Each text form is compared too — only a file whose text starts as a
+ * private one's is read through, so a build's bundles cost a look at their first 64 characters.
+ *
+ * And so is what they hold in each form a copy of a text takes (readings): a copy in UTF-16, which Windows PowerShell
+ * 5.1 writes for `Get-Content .env > dist\data.txt`, or in base64, had other bytes and no text form, and was packed
+ * (round 9, 25 Sep 2026). A private file in UTF-16 is known by its text in UTF-8 as well.
+ */
+export function privateCopies(root, more = []) {
+  const known = new Map(); // size → hash → what the file is
+  const texts = new Map(); // how its text starts → hash of its text form → what the file is
+  const note = (path, what) => {
+    let bytes;
+    try { const st = statSync(path); if (!st.isFile() || st.size > COPY_LIMIT) return; bytes = readFileSync(path); } catch { return; }
+    for (const [view] of readings(bytes)) {
+      // Nothing in it is nothing to keep, and a copy of nothing is every empty file.
+      if (!view.toString('latin1').trim()) continue;
+      const same = known.get(view.length) ?? new Map();
+      known.set(view.length, same);
+      const hash = sha256(view);
+      if (!same.has(hash)) same.set(hash, what);
+      const form = textForm(view);
+      const start = form && textStart(view);
+      if (!start) continue;
+      const alike = texts.get(start) ?? new Map();
+      texts.set(start, alike);
+      const formHash = sha256(form);
+      if (!alike.has(formHash)) alike.set(formHash, what);
+    }
+  };
+  let entries = 0;
+  // Level by level, so the project's own top — where .env and .npmrc are kept — is always read, however large the rest.
+  for (let level = root ? [root] : [], depth = 0; level.length && depth <= LOOK.depth; depth++) {
+    const next = [];
+    for (const dir of level) {
+      let names;
+      try { names = readdirSync(dir).sort(); } catch { continue; }
+      for (const name of names) {
+        if (++entries > LOOK.entries) break;
+        const path = join(dir, name);
+        const rel = relative(root, path).split(sep).join('/');
+        let st;
+        try { st = lstatSync(path); } catch { continue; }
+        if (st.isDirectory()) {
+          if (name === '.git') note(join(path, 'config'), `${rel}/config`);
+          else if (!PASSED_BY.has(name)) next.push(path);
+          continue;
+        }
+        // A private file that is itself a link is read where it points: a build following a link reads it there too.
+        const kind = privateKind(name);
+        if (kind && kind !== 'a source map') note(path, `${rel}, ${kind}`);
+      }
+    }
+    level = next;
+  }
+  for (const [path, what] of more) note(path, what);
+  return (bytes) => {
+    // Decoded up to three times the most a private file is: its copy in UTF-16, or in base64 written in UTF-16, is no larger.
+    for (const [view, how] of readings(bytes, 3 * COPY_LIMIT)) {
+      let what = known.get(view.length)?.get(sha256(view));
+      if (!what && view.length <= COPY_LIMIT) {
+        const alike = texts.get(textStart(view));
+        const form = alike && textForm(view);
+        if (form) what = alike.get(sha256(form));
+      }
+      if (what) return `a copy of ${what}${how}`;
+    }
+    return null;
+  };
+}
+
+/**
+ * Whether a folder is a git repository's own — HEAD, config and an objects/ folder — as a build leaves one it copied
+ * whole from a link to .git: the remote, with any token in its address, and every commit (25 Sep 2026). A repository
+ * with no commit yet has an empty objects/, which a build that copies files leaves behind; its HEAD says what it is.
+ */
+export function gitDirectory(dir) {
+  try {
+    if (!lstatSync(join(dir, 'HEAD')).isFile() || !lstatSync(join(dir, 'config')).isFile()) return false;
+    if (there(join(dir, 'objects')) && lstatSync(join(dir, 'objects')).isDirectory()) return true;
+    return /^(ref: refs\/|[0-9a-f]{40}\s|[0-9a-f]{64}\s)/.test(readText(join(dir, 'HEAD'), 4096));
+  } catch { return false; }
+}
+
+/**
+ * Git's own history, whatever its name: a pack or its index (`PACK`, `\xfftOc`), or a loose object — zlib that opens
+ * on `blob 57\0`, `tree`, `commit`, `tag`. A build that follows a link to .git/objects copies a folder of these, every
+ * commit in it, files removed from the tree among them; round seven looked for a repository's HEAD and config, which
+ * an object store has not (round 8, 25 Sep 2026).
+ */
+export function gitObject(bytes) {
+  if (bytes.length >= 8 && (bytes.subarray(0, 4).toString('latin1') === 'PACK' || bytes.subarray(0, 4).equals(Buffer.from([0xff, 0x74, 0x4f, 0x63])))) return 'git history';
+  if (bytes.length >= 2 && bytes[0] === 0x78 && (bytes[0] * 256 + bytes[1]) % 31 === 0) {
+    try {
+      const head = inflateSync(bytes.subarray(0, 1024), { finishFlush: zlibConstants.Z_SYNC_FLUSH }).subarray(0, 32).toString('latin1');
+      if (/^(blob|tree|commit|tag) \d+\0/.test(head)) return 'git history';
+    } catch { /* not zlib, or not whole: nothing git reads */ }
+  }
+  return null;
+}
+
+/** A line of git's list of refs (packed-refs, which starts with its own header, or FETCH_HEAD), and one of its logs. */
+const GIT_REFS = /^(?:# pack-refs with:|[0-9a-f]{40}(?:[0-9a-f]{24})?\t(?:not-for-merge)?\t)/;
+const GIT_LOG = /^[0-9a-f]{40}(?:[0-9a-f]{24})? [0-9a-f]{40}(?:[0-9a-f]{24})? [^\n<]*<[^\n>]*> \d+ [+-]\d{4}(?:\t|\r?\n|$)/;
+/**
+ * Git's other files, whatever their names, by what they hold: its index (`DIRC`), its list of refs, the log of where
+ * each branch has been — an author, a time and a commit's subject a line — and a repository's config, which names its
+ * remote. A build that copied them from .git under other names shipped them all, the objects aside (round 9, 25 Sep
+ * 2026). A commit message being written (COMMIT_EDITMSG) is text like any other, and is not told apart.
+ */
+export function gitFile(bytes) {
+  if (bytes.length >= 12 && bytes.toString('latin1', 0, 4) === 'DIRC' && [2, 3, 4].includes(bytes.readUInt32BE(4))) return "git's index";
+  const head = bytes.subarray(0, 64 * 1024).toString('latin1');
+  if (GIT_REFS.test(head)) return "git's refs";
+  if (GIT_LOG.test(head)) return "git's log";
+  // A config from its first section on (comments before it aside), with the [core] and the format version git writes.
+  if (/^\s*(?:[#;][^\n]*\n\s*)*\[[^\]\n]+\]/.test(head) && /^[ \t]*\[core\][ \t]*\r?$/m.test(head) && /^[ \t]*repositoryformatversion[ \t]*=/m.test(head)) return "git's config";
   return null;
 }
 
+/** Whether a folder is a copy of git's object store — its pack/ or a two-hex folder holding an object — to leave out whole, one line said. */
+export function gitObjects(dir) {
+  try {
+    for (const name of readdirSync(dir).slice(0, 300)) {
+      const p = join(dir, name);
+      if (!lstatSync(p).isDirectory() || !(name === 'pack' || /^[0-9a-f]{2}$/.test(name))) continue;
+      const first = readdirSync(p).find((f) => lstatSync(join(p, f)).isFile());
+      if (first && gitObject(readFileSync(join(p, first)).subarray(0, 4096))) return true;
+    }
+  } catch { /* unread: its files are judged one by one */ }
+  return false;
+}
+
+// .avif, .tif and .tiff, and .apng and .jfif (a PNG's and a JPEG's bytes), were no picture's names until round 8.
+const RASTER = /\.(a?png|jpe?g|jfif|gif|webp|avif|ico|bmp|tiff?)$/i;
+/**
+ * The first bytes of each kind of picture an extension shows: PNG, JPEG, GIF, WebP, ICO, BMP (whose reserved bytes
+ * are zero, as no text's are), AVIF's box, and TIFF's byte order and 42 (43 for BigTIFF). Any of them passes under any
+ * picture's name: Chrome reads a picture by its bytes, and a JPEG saved as .png is no secret.
+ */
+const PICTURE = [
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47])),
+  (b) => b.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff])),
+  (b) => /^GIF8[79]a/.test(b.subarray(0, 6).toString('latin1')),
+  (b) => b.subarray(0, 4).toString('latin1') === 'RIFF' && b.subarray(8, 12).toString('latin1') === 'WEBP',
+  (b) => b.subarray(0, 4).equals(Buffer.from([0x00, 0x00, 0x01, 0x00])),
+  (b) => b.length >= 10 && b.subarray(0, 2).toString('latin1') === 'BM' && b.readUInt32LE(6) === 0,
+  (b) => b.subarray(4, 8).toString('latin1') === 'ftyp',
+  (b) => ['49492a00', '4d4d002a', '49492b00', '4d4d002b'].includes(b.subarray(0, 4).toString('hex')),
+];
+/**
+ * Why a file named as an image is none, or null: its first bytes are no picture's, or — an .svg — it is not SVG's
+ * text. A build that followed a link left a .env or a git config under an icon's name, and nothing else looked
+ * inside it (25 Sep 2026). An empty file holds nothing, and passes.
+ */
+export function notAnImage(name, bytes) {
+  if (!bytes.length) return null;
+  if (/\.svg$/i.test(name)) {
+    const text = bytes.subarray(0, 1024 * 1024).toString('utf8').replace(/^\ufeff/, '');
+    return /^\s*</.test(text) && /<svg[\s>/:]/i.test(text) ? null : 'not the image its name says';
+  }
+  return RASTER.test(name) && !PICTURE.some((is) => is(bytes)) ? 'not the image its name says' : null;
+}
+
+/** The folders a build copies as they are: public/ (Vite, CRXJS and WXT), WXT's under src/, and one a config names. */
+const PUBLIC_DIRS = ['public', 'src/public'];
+const BUILD_CONFIGS = ['wxt.config', 'vite.config'].flatMap((n) => ['ts', 'mts', 'js', 'mjs'].map((e) => `${n}.${e}`));
+
+/**
+ * The symbolic links in the folders of `root` that a build copies as they are, relative to it — but for those inside
+ * `packed`, whose links `pack` leaves out and names. WXT's copyPublicDirectory and Vite's copyDir copy what a link
+ * points at, so a template's public/icon-128.png -> ../.env is a PNG in the build; `pack` sees only the build, where
+ * the link is gone, and says where they are (25 Sep 2026).
+ */
+export function publicLinks(root, packed = null) {
+  return [...new Set(publicLinkEntries(root, packed).map((e) => e.link))].sort();
+}
+
+/**
+ * The links of the folders a build copies as they are whose target a store zip must never hold — inside a .git
+ * folder, or private by its name — and where the build put each: its path under the folder it is in, which the build
+ * copies to the top of its output. `pack` leaves those out of the build, and says why (round 8, 25 Sep 2026): a warning
+ * let `public/vendor -> ../.git/objects` ship every commit. A link to anything else is said, as before, not refused:
+ * a monorepo's shared icons are links too.
+ *
+ * `.git` in any case: macOS and Windows find `../.GIT/logs` all the same, and it was packed (round 9, 25 Sep 2026).
+ */
+export function privateLinks(root, packed = null) {
+  const out = [];
+  for (const { link, within, path } of publicLinkEntries(root, packed)) {
+    let target;
+    try { target = realpathSync(path); } catch { continue; }
+    const kind = privateKind(target.split(sep).pop() ?? '');
+    const why = target.split(sep).some((part) => part.toLowerCase() === '.git') ? 'a link into .git' : kind ? `a link to ${kind}` : null;
+    if (why) out.push({ link, within, why });
+  }
+  return out;
+}
+
+function publicLinkEntries(root, packed = null) {
+  const dirs = new Set(PUBLIC_DIRS);
+  for (const config of BUILD_CONFIGS) {
+    let text;
+    try { text = readText(join(root, config)); } catch { continue; }
+    const named = /\bpublicDir\s*:\s*(['"`])([^'"`\n]+)\1/.exec(text)?.[2];
+    if (named) dirs.add(posix.normalize(named).replace(/\/+$/, ''));
+  }
+  const links = [];
+  let entries = 0;
+  const walk = (base, dir, depth) => {
+    let names;
+    try { names = readdirSync(dir).sort(); } catch { return; }
+    for (const name of names) {
+      if (++entries > 5_000) return;
+      const path = join(dir, name);
+      let st;
+      try { st = lstatSync(path); } catch { continue; }
+      if (st.isSymbolicLink()) links.push({ path, base });
+      else if (st.isDirectory() && depth < 8) walk(base, path, depth + 1);
+    }
+  };
+  for (const dir of dirs) {
+    const at = resolve(root, dir);
+    // Not one a config names outside the project, which is not this command's to look through, nor one in the folder packed.
+    if (!at.startsWith(resolve(root) + sep) || (packed && (at === packed || at.startsWith(packed + sep)))) continue;
+    let st;
+    try { st = lstatSync(at); } catch { continue; }
+    // The folder itself a link: the build copies it whole, to the top of its output.
+    if (st.isSymbolicLink()) links.push({ path: at, base: at });
+    else if (st.isDirectory()) walk(at, at, 0);
+  }
+  const posixOf = (p) => p.split(sep).join('/');
+  return links.map(({ path, base }) => ({ path, link: posixOf(relative(root, path)), within: path === base ? '' : posixOf(relative(base, path)) }));
+}
+
 /**
  * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
  * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
@@ -164,6 +685,17 @@ export function signInPage(link, wall) {
   return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;
 }
 
+/**
+ * How long `login` waits between asking whether its code was approved, and how long it asks at all, in milliseconds:
+ * what the Wall said (where it said nothing, RFC 8628's 5 seconds, and ten minutes), within one second and half a
+ * minute between asks, and a quarter of an hour in all. It took the Wall's word, so a Wall at another address (--wall,
+ * TOOLABY_WALL) kept it waiting as long as it said (round 9, 25 Sep 2026).
+ */
+export function devicePolling({ interval, expires_in: expiresIn } = {}) {
+  const seconds = (value, otherwise, least, most) => Math.min(Math.max(Number(value) > 0 && Number.isFinite(Number(value)) ? Number(value) : otherwise, least), most);
+  return { every: seconds(interval, 5, 1, 30) * 1000, lasts: seconds(expiresIn, 600, 1, 15 * 60) * 1000 };
+}
+
 /**
  * How a page is opened on each platform, the address one argument and no shell in between. On Windows,
  * `cmd /c start "" <url>` read an `&` in the address as a second command; rundll32 hands it to the default browser

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.2",
+  "version": "1.6.5",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {