toolaby 1.6.3 → 1.6.5

package/README.md

@@ -26,7 +26,7 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named, and so is a file of any name that holds a private key or a live secret (a Stripe live key, a webhook secret, an AWS access key, a GitHub, Slack or npm token, a password in an address). A build copies what a link in `public/` points at, so `pack` also leaves out a file with the same bytes as one of the project's private files or the command's own session, a folder that is a git repository's own, and a file named as an image that holds none, and it names the links in `public/`. `--allow-private` packs what it left out. Dotfiles and links are never packed. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named, and so is a file of any name that holds a private key or a secret (a Stripe key, live or test, a webhook secret, an AWS access key, long-term or temporary, or a secret access key, an OpenAI or Anthropic key, a Google OAuth client secret, a GitHub, Slack or npm token, a PuTTY key, a Supabase `service_role` key, a password in an address), read to its end, and in UTF-16 or base64 too. A Google API key is made to be in a browser: its file is packed and named, for you to restrict the key in Google Cloud. A build copies what a link in `public/` points at, so `pack` also leaves out a file with the same bytes or text as one of the project's private files or the command's own session, in UTF-16 or base64 as well, a folder that is a git repository's own, git's history, index, refs, logs and config under any name, and a file named as an image that holds none, and it names the links in `public/`. A `.gz` or `.br` a build's compression plugin writes is judged by what it holds. It refuses a build when a file the manifest names would be left out, or when a public folder is itself a link into `.git`. `--allow-private` packs what it left out. Dotfiles and links are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 

package/bin.mjs

@@ -32,7 +32,7 @@
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
 // so this and the dashboard's Wire button never disagree.
 import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, lstatSync, realpathSync, chmodSync, unlinkSync, renameSync } from 'node:fs';
-import { join, resolve, dirname, relative, basename, sep } from 'node:path';
+import { join, resolve, dirname, relative, basename, sep, posix } from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
@@ -41,9 +41,9 @@ import { wireManifest, drawsItself, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
-import { inside, signInPage, opener, privateKind, privateContent, privateCopies, projectRoot, gitDirectory, notAnImage, publicLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
+import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.6.3';
+const VERSION = '1.6.5';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -90,14 +90,20 @@ const envElsewhere = () => (process.env.TOOLABY_TOKEN && !envRefused && !envToke
 
 /** The most of one answer the command reads from a Wall: none of the Wall's comes near it (the largest, a wiring, is under 1 MB). */
 const ANSWER_LIMIT = 4 * 1024 * 1024;
+/** How long it waits for one, the whole of it: none of the Wall's takes more than a few seconds. */
+const ANSWER_TIME = 30_000;
 
 async function api(path, { method = 'GET', body, token = storedToken() } = {}) {
+  // The time ran out (fetchHere's deadline; AbortError where an older Node says so): one line, whichever part was late.
+  // A Wall that answered a byte at a time held `login` and `wire` for ever (round 8, 25 Sep 2026).
+  const late = (e) => (e?.name === 'TimeoutError' || e?.name === 'AbortError' ? new Error(`The Wall at ${wall} did not answer ${path.split('?')[0]} within ${ANSWER_TIME / 1000} seconds.`) : null);
   // Only the Wall answers for the Wall: a redirect elsewhere is refused (lib/safe.js).
   const res = await fetchHere(`${wall}${path}`, {
+    ms: ANSWER_TIME,
     method,
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': `toolaby-cli/${VERSION}`, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
     body: body ? JSON.stringify(body) : undefined,
-  }).catch((e) => { throw new Error(`Could not reach ${wall}: ${e.message}`); });
+  }).catch((e) => { throw late(e) ?? new Error(`Could not reach ${wall}: ${e.message}`); });
   if (res.status === 401 && token && token === envToken()) {
     envRefused = true;
     const stored = storedToken();
@@ -105,8 +111,8 @@ async function api(path, { method = 'GET', body, token = storedToken() } = {}) {
   }
   // Read up to a few megabytes and no further: a Wall at another address (--wall, TOOLABY_WALL) that answered without
   // end filled the command's memory, and the MCP server's, which hands what it reads to an agent (25 Sep 2026).
-  // An answer cut short reads as no JSON, as it always has; only one past the limit stops the command.
-  const bytes = await readBounded(res, ANSWER_LIMIT).catch(() => Buffer.alloc(0));
+  // An answer cut short reads as no JSON, as it always has; only one past the limit, or the time, stops the command.
+  const bytes = await readBounded(res, ANSWER_LIMIT).catch((e) => { const why = late(e); if (why) throw why; return Buffer.alloc(0); });
   if (!bytes) throw new Error(`The Wall at ${wall} answered ${path.split('?')[0]} with more than ${ANSWER_LIMIT / 1024 / 1024} MB, which no answer of a Wall's is. None of it was used.`);
   let json = {};
   try { json = JSON.parse(bytes.toString('utf8')); } catch { /* not JSON: the status says what happened */ }
@@ -124,19 +130,22 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function login() {
   const start = await api('/api/dev-auth/device/code', { method: 'POST', body: { client_id: CLIENT_ID }, token: null });
   if (!start.ok || !start.json.device_code) fail(`The Wall at ${wall} did not start a sign-in (HTTP ${start.status}). Is the address right? --wall names another.`);
-  const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
+  const { device_code, user_code, verification_uri, verification_uri_complete } = start.json;
   const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
   // The Wall's own page, over https (http on this machine), or nothing opened and nothing signed in: an address the
   // Wall hands over is opened on this computer, and a file: or another site's page opens whatever it names.
   const page = signInPage(link, wall);
   if (!page) fail(`The Wall at ${wall} gave ${JSON.stringify(String(link).slice(0, 200))} as its sign-in page, which is not its own address over https.\n  It was not opened, and nothing was signed in.`);
-  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  // How often it asks and for how long: what the Wall said, a quarter of an hour at most (lib/safe.js).
+  const { every: first, lasts } = devicePolling(start.json);
+  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${oneLine(user_code)}   (approve it there — it expires in ${Math.round(lasts / 60_000)} minutes)\n`);
   openBrowser(page);
-  let every = Math.max(1, Number(interval) || 5) * 1000;
-  const until = Date.now() + Number(expires_in) * 1000;
+  let every = first;
+  const until = Date.now() + lasts;
   process.stdout.write('  Waiting for your approval');
   while (Date.now() < until) {
-    await sleep(every);
+    // Never past the code's end: the last ask comes as it ends.
+    await sleep(Math.min(every, until - Date.now()));
     process.stdout.write('.');
     const poll = await api('/api/dev-auth/device/token', { method: 'POST', body: { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code, client_id: CLIENT_ID }, token: null });
     if (poll.ok && poll.json.access_token) {
@@ -496,10 +505,52 @@ async function webhooks() {
 // admits that id once the listing's address is on the tool. It refuses a build that would sell on Test (a tk_test_
 // or tk_dev_ key inside) or that points at this machine (localhost in the manifest), the two mistakes a store build
 // can ship with. What looks private — a key, an environment file, a source map — is left out and named, and so is a
-// link out of the folder: a store zip is public. Nothing is sent anywhere: it reads the folder and writes one file.
+// link out of the folder: a store zip is public. A build it would leave a file of the manifest's out of, which Chrome
+// would not load, is refused, as is one whose public folder is a link into .git (round 9, 25 Sep 2026). Nothing is
+// sent anywhere: it reads the folder and writes one file.
 const BUILD_DIRS = ['.', '.output/chrome-mv3', 'dist', 'build/chrome-mv3-prod', 'build'];
 const TOOL_KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/g;
 const LOCAL = /^(https?|wss?):\/\/(localhost|127\.0\.0\.1|\[::1\]|[^/]*\.localhost)(:\d+)?\//i;
+/** Why a file is left out as no file of the folder's own, not as a private one: never packed, --allow-private or not. */
+const NOT_OWN = ['a link', 'not a file', 'a name no zip should hold'];
+
+/**
+ * The files a manifest names, each with what it is to the extension, as the zip spells them: no leading ./ or /, no
+ * query or fragment. A pattern (a web-accessible resource's `*`) names no one file, and an address none at all.
+ */
+function namedFiles(manifest) {
+  const named = [];
+  const add = (path, what) => {
+    if (typeof path !== 'string' || path.includes('*') || /^[a-z][a-z0-9+.-]*:/i.test(path)) return;
+    const clean = posix.normalize(path.split(/[?#]/)[0].replace(/^(?:\.?\/)+/, ''));
+    if (clean && clean !== '.' && clean !== '..' && !clean.startsWith('../')) named.push([clean, what]);
+  };
+  const list = (value) => (Array.isArray(value) ? value : []);
+  const icons = (value) => { for (const path of value && typeof value === 'object' ? Object.values(value) : [value]) add(path, 'an icon'); };
+  add('manifest.json', 'the manifest');
+  add(manifest.background?.service_worker, 'the background service worker');
+  for (const path of list(manifest.background?.scripts)) add(path, 'a background script');
+  add(manifest.background?.page, 'the background page');
+  for (const script of list(manifest.content_scripts)) {
+    for (const path of list(script?.js)) add(path, 'a content script');
+    for (const path of list(script?.css)) add(path, "a content script's style sheet");
+  }
+  for (const surface of ['action', 'browser_action', 'page_action']) { add(manifest[surface]?.default_popup, 'the popup'); icons(manifest[surface]?.default_icon); }
+  add(manifest.side_panel?.default_path, 'the side panel');
+  add(manifest.sidebar_action?.default_panel, 'the side panel');
+  icons(manifest.sidebar_action?.default_icon);
+  add(manifest.options_page, 'the options page');
+  add(manifest.options_ui?.page, 'the options page');
+  add(manifest.devtools_page, 'the DevTools page');
+  if (manifest.chrome_url_overrides && typeof manifest.chrome_url_overrides === 'object') for (const path of Object.values(manifest.chrome_url_overrides)) add(path, 'a page it replaces');
+  for (const path of list(manifest.sandbox?.pages)) add(path, 'a sandboxed page');
+  icons(manifest.icons);
+  for (const entry of list(manifest.web_accessible_resources)) for (const path of typeof entry === 'string' ? [entry] : list(entry?.resources)) add(path, 'a web-accessible resource');
+  for (const rules of list(manifest.declarative_net_request?.rule_resources)) add(rules?.path, 'a rule set');
+  add(manifest.storage?.managed_schema, 'its managed storage schema');
+  if (typeof manifest.default_locale === 'string') add(`_locales/${manifest.default_locale}/messages.json`, 'its default locale');
+  return named;
+}
 
 const CRC_TABLE = Array.from({ length: 256 }, (_, n) => { let c = n; for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1; return c >>> 0; });
 const crc32 = (buf) => { let c = 0xffffffff; for (const b of buf) c = CRC_TABLE[(c ^ b) & 0xff] ^ (c >>> 8); return (c ^ 0xffffffff) >>> 0; };
@@ -542,10 +593,18 @@ function zipOf(entries) {
  * A build has already followed the links of the project it came from: what they pointed at is an ordinary file here.
  * So a file is also private when it is a copy of one of the project's (`copyOf`), a folder when it is a git
  * repository's own, and a file named as an image when it holds none (round 7, 25 Sep 2026).
+ *
+ * And a compressed file is what it holds (round 8, 25 Sep 2026): a build's compression plugin writes data.json.gz and
+ * data.json.br beside data.json, and `pack` left data.json out as private while it packed both. One beside a file left
+ * out goes with it, however large; any other is opened, a few MB of it at most (lib/safe.js), and judged as the file.
+ *
+ * And git's other files are git's, whatever their names — its index, its refs, its logs, a config (round 9, 25 Sep 2026).
  */
-function filesIn(root, copyOf = () => null) {
+function filesIn(root, copyOf = () => null, fromLink = () => null) {
   const found = []; const left = []; const privately = [];
   const allowed = flag('--allow-private');
+  const judge = (name, bytes) => privateKind(name) ?? copyOf(bytes) ?? privateContent(bytes) ?? gitObject(bytes) ?? gitFile(bytes) ?? notAnImage(name, bytes);
+  const judged = new Map(); // what each file found private is, by its path: a compressed one beside it is the same
   const walk = (dir) => {
     for (const name of readdirSync(dir).sort()) {
       if (name.startsWith('.') || name === 'node_modules' || name.endsWith('.zip')) continue;
@@ -554,15 +613,27 @@ function filesIn(root, copyOf = () => null) {
       const st = lstatSync(p);
       if (st.isSymbolicLink()) { left.push([rel, 'a link']); continue; }
       if (/[\\\u0000-\u001f\u007f]/.test(name)) { left.push([rel, 'a name no zip should hold']); continue; }
+      // What a build copied from a link into .git, or to a private file, left out whole, as the link's (round 8).
+      const via = fromLink(rel);
+      if (via) { judged.set(rel, via); if (!allowed) { left.push([rel, via]); continue; } privately.push([rel, via]); }
       if (st.isDirectory()) {
         // Left out whole, unwalked: its config and its history are the repository's, whatever the folder is called.
-        if (gitDirectory(p)) { if (!allowed) { left.push([rel, 'a git directory']); continue; } privately.push([rel, 'a git directory']); }
+        const git = gitDirectory(p) ? 'a git directory' : gitObjects(p) ? 'git history' : null;
+        if (git && !via) { if (!allowed) { left.push([rel, git]); continue; } privately.push([rel, git]); }
         walk(p);
         continue;
       }
       if (!st.isFile()) { left.push([rel, 'not a file']); continue; }
       const bytes = readFileSync(p);
-      const why = privateKind(name) ?? copyOf(bytes) ?? privateContent(bytes) ?? notAnImage(name, bytes);
+      let why = judge(name, bytes);
+      if (!why) {
+        // Sorted, data.json comes before data.json.br and data.json.gz: its verdict is known when theirs is asked.
+        const twin = COMPRESSED.test(name) ? judged.get(rel.replace(COMPRESSED, '')) : null;
+        const inner = twin ? null : unpacked(name, bytes);
+        const held = twin ?? (inner && judge(inner.name, inner.bytes));
+        if (held) why = `${held}, compressed`;
+      }
+      if (why) judged.set(rel, why);
       if (why && !allowed) left.push([rel, why]);
       else { found.push(p); if (why) privately.push([rel, why]); }
     }
@@ -588,8 +659,38 @@ function pack() {
   // The project the build came from — or, with none above it, the folder alone — and the command's own secrets: what a
   // build could have copied in under another name, by following a link (lib/safe.js).
   const project = projectRoot(folder);
+  const allowed = flag('--allow-private');
   const copyOf = privateCopies(project ?? folder, [[CREDENTIALS, `${fromHome(CREDENTIALS)}, this command's session`], [DEV_SECRET_FILE, `${fromHome(DEV_SECRET_FILE)}, this machine's webhook secret`]]);
-  const { found: files, left, privately } = filesIn(folder, copyOf);
+  // What a link in the project's public folders put into the build, when it points into .git or at a private file.
+  const leaking = project ? privateLinks(project, folder) : [];
+  // A public folder that is itself such a link, or a build whose top is a git repository's own folder, is refused: the
+  // build copied what the link points at to the top of its output, among the extension's own files, and nothing tells
+  // them apart — `public -> .git` put the repository's index, its logs and its last commit message in the zip (round 9,
+  // 25 Sep 2026).
+  const whole = leaking.filter((l) => !l.within);
+  if (whole.length && !allowed) fail(`Not packed: ${whole.map((l) => `${oneLine(l.link)} is ${l.why}`).join(', ')}. A build copies what a public folder links to, whole, to the top of its output.\n  Make ${whole.length > 1 ? 'each' : 'it'} a folder of its own, build again, and pack. (--allow-private packs it anyway.)`);
+  if (gitDirectory(folder) && !allowed) fail(`Not packed: ${oneLine(relative(process.cwd(), folder) || '.')} is a git repository's own folder (HEAD, config and its history), as a build leaves when its public folder is a link to .git.\n  Make the public folder a folder of its own, build again, and pack. (--allow-private packs it anyway.)`);
+  const fromLink = (rel) => { const hit = leaking.find((l) => l.within && (rel === l.within || rel.startsWith(`${l.within}/`))); return hit ? `from ${hit.link}, ${hit.why}` : null; };
+  const { found: files, left, privately } = filesIn(folder, copyOf, fromLink);
+  // What was left out as no file of the folder's own, and what as private.
+  const links = left.filter(([, why]) => NOT_OWN.includes(why));
+  const kept = left.filter((entry) => !links.includes(entry));
+
+  // A file the manifest names that is left out makes a zip Chrome does not load, or loads without its worker, a page or
+  // an icon: refused, and nothing written (round 9, 25 Sep 2026). --allow-private packs a private one; a link, never.
+  const broken = [];
+  for (const [path, what] of namedFiles(manifest)) {
+    const gone = left.find(([rel]) => path.toLowerCase() === rel.toLowerCase() || path.toLowerCase().startsWith(`${rel.toLowerCase()}/`));
+    if (gone && !broken.some(([p]) => p === path)) broken.push([path, what, gone[1]]);
+  }
+  if (broken.length) {
+    const secret = broken.filter(([, , why]) => !NOT_OWN.includes(why)).length;
+    const advice = [
+      secret && `Take out what is private and build again, or pack ${secret > 1 ? 'them' : 'it'} anyway with --allow-private, for anyone who downloads the item to read.`,
+      secret < broken.length && 'The zip holds the folder\'s own files, and never a link: make each the file itself.',
+    ].filter(Boolean);
+    fail(`Not packed: the manifest names ${broken.length > 1 ? 'files' : 'a file'} this leaves out, and the zip would not load:\n\n${broken.map(([path, what, why]) => `  · ${oneLine(path)}, ${what} (${oneLine(why)})`).join('\n')}\n\n  ${advice.join('\n  ')}`);
+  }
   const problems = [];
 
   // Which side the build sells on: the tool keys inside it, wherever the bundler put them.
@@ -632,12 +733,14 @@ function pack() {
   renameSync(fresh, target);
   const kb = (statSync(target).size / 1024).toFixed(0);
   out(`\n  ${relative(process.cwd(), target) || target}  ·  ${entries.length} files, ${kb} KB  ·  version ${manifest.version}${modes.has('live') ? '  ·  Live key' : ''}`);
-  // What was left out, and why — or, asked for, what private file went in: a store zip is public.
-  const links = left.filter(([, why]) => why === 'a link' || why === 'not a file' || why === 'a name no zip should hold');
-  const kept = left.filter((entry) => !links.includes(entry));
-  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
+  // What was left out, and why — or, asked for, what private file went in: a store zip is public. A reason can name a
+  // file of the project's (a copy of…, from a link…), and so is put on one line, as the file's own name is.
+  if (kept.length) out(`  Left out, as private: ${kept.map(([f, why]) => `${oneLine(f)} (${oneLine(why)})`).join(', ')}. Anyone can download a store item and unzip it; --allow-private packs ${kept.length > 1 ? 'them' : 'it'} anyway.`);
   if (links.length) out(`  Left out: ${links.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. The zip holds the folder's own files: copy in what belongs in it.`);
-  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${why})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  if (privately.length) out(`  Packed as asked (--allow-private): ${privately.map(([f, why]) => `${oneLine(f)} (${oneLine(why)})`).join(', ')}. Anyone who downloads the item can read ${privately.length > 1 ? 'them' : 'it'}.`);
+  // Packed and named: a Google API key is made to be in a browser, and kept to its use by its restrictions (lib/safe.js).
+  const google = entries.filter(([, bytes]) => googleKey(bytes)).map(([name]) => oneLine(name));
+  if (google.length) out(`  ${google.length > 1 ? 'Google API keys are' : 'A Google API key is'} in ${google.join(', ')}: anyone who downloads the item can read ${google.length > 1 ? 'them' : 'it'}. Restrict ${google.length > 1 ? 'each' : 'it'} to this extension, and to the APIs it calls, in Google Cloud → Credentials.`);
   // Said, not refused: the links are the project's, not the build's, and the build may hold nothing of theirs yet.
   const linked = project ? publicLinks(project, folder) : [];
   if (linked.length) out(`  Links in the folders a build copies as they are: ${linked.slice(0, 8).map(oneLine).join(', ')}${linked.length > 8 ? ` and ${linked.length - 8} more` : ''}. The build copies what each points at, a private file too: make each the file itself.`);
@@ -670,8 +773,10 @@ function help() {
     toolaby tools                      your tools, with their ids
     toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
-                                       leaves out keys, certificates, .env and credential files, source maps, live secrets,
-                                       a build's copy of a private file, a git folder, an image that is none   --allow-private packs them
+                                       leaves out keys, certificates, .env and credential files, source maps, secrets,
+                                       git's files, a build's copy of a private file (compressed, UTF-16 or base64),
+                                       an image that is none; refuses a build if one is a file the manifest names
+                                       --allow-private packs them
     toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
     toolaby mcp                        the Wall for coding agents, an MCP server on stdio:

package/lib/safe.js

@@ -1,6 +1,6 @@
 // What this command will not do, whoever asks: write outside the project it was pointed at, write a file of a new
 // extension it does not know, open a sign-in page that is not the Wall's, put a private file in a store zip, print a
-// line it did not write, ask whatever address a project names, or take a download without end.
+// line it did not write, ask whatever address a project names, or take a download or wait for a sign-in without end.
 //
 // Each of these took someone else's word. A cloned repository's manifest named the file `wire` wrote — a service
 // worker at "../../.zshrc" overwrote the shell's startup file — and a link in the folder took a write wherever it
@@ -9,7 +9,8 @@
 // through cmd.exe, where an `&` in it ran a command. Hand-written, unlike manifest.js and project.js: this is the
 // command's own boundary, not a wiring rule the browser shares.
 import { createHash } from 'node:crypto';
-import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { brotliDecompressSync, gunzipSync, inflateRawSync, inflateSync, constants as zlibConstants } from 'node:zlib';
 import { homedir } from 'node:os';
 import { dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from 'node:path';
 
@@ -118,16 +119,21 @@ export async function readBounded(res, limit) {
  * A request that follows a redirect only within the address it asked — a Wall moving a page on its own host — and
  * refuses one elsewhere: fetch drops the session on the way, but the command took whatever the other address answered
  * for the Wall's word, and the MCP server handed an agent a page from any host (25 Sep 2026).
+ *
+ * And one that gives up at its time: the answer, redirects and body alike — read or not yet — within `ms` of asking, or
+ * a TimeoutError, as fetchBounded's. Bounded in size alone, a Wall that answered a byte at a time held `login`, `wire`
+ * and the MCP server for ever (round 8, 25 Sep 2026).
  */
-export async function fetchHere(url, init = {}) {
+export async function fetchHere(url, { ms = 30_000, ...init } = {}) {
+  const signal = AbortSignal.timeout(ms);
   const origin = new URL(url).origin;
-  let res = await fetch(url, { ...init, redirect: 'manual' });
+  let res = await fetch(url, { ...init, redirect: 'manual', signal });
   for (let hops = 0; hops < 5 && res.status >= 300 && res.status < 400 && res.headers.get('location'); hops++) {
     const next = new URL(res.headers.get('location'), url);
     await res.body?.cancel().catch(() => {});
     if (next.origin !== origin) throw new Error(`it answered with a redirect to ${next.origin}, which is not followed`);
     url = next.href;
-    res = await fetch(url, { ...init, redirect: 'manual' });
+    res = await fetch(url, { ...init, redirect: 'manual', signal });
   }
   return res;
 }
@@ -151,32 +157,164 @@ export function readText(path, limit = READ_LIMIT) {
  * Why a file's contents have no place in a store zip, whatever it is called, or null: a private key, a cloud service
  * account's key, a source map written into the code. Names alone let `key.txt`, a Google Cloud key under the name
  * its console gives it, and a bundle's inline map through (25 Sep 2026). So did a live secret in a file of any name
- * — a Stripe or AWS key, a GitHub, Slack or npm token, a password in an address — until round 7 of the same day.
+ * — a Stripe or AWS key, a GitHub, Slack or npm token, a password in an address — until round 7 of the same day, and
+ * an OpenAI or Anthropic key, a Slack app token, a Stripe test key and an AWS secret access key until round 8.
+ *
+ * All of the file, in each form a copy of a text takes (readThrough): the first 4 MB alone were read, so a key further
+ * into a large bundle was packed; and a copy in UTF-16, or in base64, held its secret between NULs or in other letters
+ * (round 9, 25 Sep 2026).
  */
 export function privateContent(bytes) {
-  const text = bytes.subarray(0, 4 * 1024 * 1024).toString('latin1');
-  if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
-  if (pemKey(text)) return 'a private key inside';
-  if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
-  for (const [shape, why] of SECRETS) for (const [found] of text.matchAll(shape)) if (!standIn(found)) return why;
-  if (passwordIn(text)) return 'a password in an address inside';
-  return null;
+  return readThrough(bytes, (text) => {
+    if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text)) return "a service account's key inside";
+    if (pemKey(text)) return 'a private key inside';
+    if (/[#@]\s*sourceMappingURL\s*=\s*data:/.test(text)) return 'a source map inside';
+    for (const [shape, why, honest] of SECRETS) for (const found of text.matchAll(shape)) if (!standIn(found[1] ?? found[0]) && !honest?.(found)) return why;
+    if (passwordIn(text)) return 'a password in an address inside';
+    return null;
+  });
 }
 
 /**
  * A secret by its whole shape, and what to call it — never by its prefix alone, which code that checks for one holds
- * (`key.startsWith('sk_live_')`), nor a publishable key, which is made to be in a browser.
+ * (`key.startsWith('sk_live_')`), nor a publishable key, which is made to be in a browser — and, for some, what says
+ * the one found is honest after all. Where a shape captures, the capture is the secret, and the rest what names it.
  */
 const SECRETS = [
   [/\b[rs]k_live_[0-9A-Za-z]{24,}/g, 'a Stripe live key inside'],
+  // A test key reads and writes the account's test data, customers' addresses among them: a secret too (round 8).
+  [/\b[rs]k_test_[0-9A-Za-z]{24,}/g, 'a Stripe test key inside'],
   [/\bwhsec_[A-Za-z0-9+/]{24,}/g, 'a webhook signing secret inside'],
-  [/\bAKIA[0-9A-Z]{16}\b/g, 'an AWS access key inside'],
+  // A long-term key's id, or a temporary one's (ASIA…), which comes with its secret and a session token (round 9).
+  [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, 'an AWS access key inside'],
+  // Its secret, which a file can hold without the AKIA id beside it: 40 characters of base64 where a name says what
+  // they are (aws_secret_access_key, AWS_SECRET_ACCESS_KEY, secretAccessKey…), both cases in them, as no hex digest's.
+  [/(?:(?<![A-Za-z0-9])aws[\w.-]{0,30}?|secret_?access_?key)["']?[ \t]{0,16}(?:[:=]|=>)[ \t]{0,16}["']?([A-Za-z0-9/+]{40})(?![A-Za-z0-9/+=])/gi, 'an AWS secret access key inside', ([, key]) => !/[A-Z]/.test(key) || !/[a-z]/.test(key)],
   [/\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{82,})/g, 'a GitHub token inside'],
   [/\bxox[abprs]-\d+-[A-Za-z0-9-]{20,}/g, 'a Slack token inside'],
+  [/\bxapp-\d-[A-Z0-9]{8,}-\d{8,}-[A-Za-z0-9]{32,}/g, 'a Slack app token inside'],
   [/\bnpm_[A-Za-z0-9]{36,}/g, 'an npm token inside'],
+  // Google's OAuth client secret, which signs in as the app: both cases after GOCSPX-, as no placeholder has (round 9).
+  [/\bGOCSPX-[A-Za-z0-9_-]{20,}/g, 'a Google OAuth client secret inside', ([secret]) => !/[A-Z]/.test(secret.slice(7)) || !/[a-z]/.test(secret.slice(7))],
+  // OpenAI's: a project's, a service account's or an admin's, or the first kind, 48 characters after sk-.
+  [/\bsk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{80,}|[A-Za-z0-9]{48}(?![A-Za-z0-9_-]))/g, 'an OpenAI key inside'],
+  [/\bsk-ant-[a-z]{2,8}\d{2}-[A-Za-z0-9_-]{80,}/g, 'an Anthropic key inside'],
+  // A PuTTY key file by its first two lines, the key's kind and then its encryption: code that reads one holds neither (round 9).
+  [/PuTTY-User-Key-File-\d+: [\w.@-]+(?:\r?\n|(?:\\r)?\\n)Encryption: [\w-]+/g, 'a private key inside'],
+  // Supabase's service_role key: a JWT whose payload names the role, which passes every row-level rule. The anon key and
+  // a signed-in user's token have the same shape, and are made to be in a browser, as a publishable key is (round 9).
+  [/\bey[A-Za-z0-9_-]{10,500}\.ey[A-Za-z0-9_-]{10,4000}\.[A-Za-z0-9_-]{20,1000}/g, 'a Supabase service_role key inside', ([jwt]) => !adminRole(jwt)],
 ];
 /** What stands where a secret goes, in docs and examples: a run of one character, or AWS's own EXAMPLE key. */
 const standIn = (found) => /(.)\1{7}/.test(found) || found.includes('EXAMPLE');
+/** Whether a JWT's payload names Supabase's service_role, or its supabase_admin. */
+function adminRole(jwt) {
+  try { return ['service_role', 'supabase_admin'].includes(JSON.parse(Buffer.from(jwt.split('.')[1], 'base64url').toString('utf8')).role); } catch { return false; }
+}
+
+/** A Google API key: `AIza` and 35 more. */
+const GOOGLE_KEY = /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g;
+/**
+ * Whether a file holds a Google API key, a stand-in aside. Such a key is made to be in a browser — a Firebase web
+ * config's, the Maps or YouTube key an extension calls with — and is kept to its use by its restrictions in Google
+ * Cloud, not by being unseen. `pack` packs the file and names it (round 9, 25 Sep 2026): it left it out until then,
+ * breaking the zip for a lone Firebase key or a YouTube key, and let any key through beside a Firebase word.
+ */
+export function googleKey(bytes) {
+  return readThrough(bytes, (text) => ([...text.matchAll(GOOGLE_KEY)].some(([key]) => !standIn(key)) ? 'a Google API key' : null)) !== null;
+}
+
+/** How much of a file is read as text at once, and how far each piece reaches back into the one before: further than any shape read here, a private key's 32 KB among them. */
+const PIECE = 4 * 1024 * 1024;
+const OVERLAP = 128 * 1024;
+
+/**
+ * The first answer `look` gives for a file's text, with the form the file held it in, or null. Each of the file's
+ * readings is read in pieces of PIECE bytes, each reaching OVERLAP back into the one before: what a boundary splits is
+ * whole in one of them, and no string is larger than a piece, however large the file.
+ */
+function readThrough(bytes, look) {
+  for (const [view, how] of readings(bytes)) {
+    for (let from = 0; from < view.length; from += PIECE - OVERLAP) {
+      const found = look(view.subarray(from, from + PIECE).toString('latin1'));
+      if (found) return `${found}${how}`;
+      if (from + PIECE >= view.length) break;
+    }
+  }
+  return null;
+}
+
+/**
+ * A file's bytes in each form a copy of a text takes, as [bytes, how it held them]: as they are; decoded from UTF-16,
+ * as Windows PowerShell 5.1 writes `Get-Content .env > dist\data.txt`; decoded from base64, where the file is that and
+ * nothing else; and one inside the other, three deep, since PowerShell's `>` writes base64 in UTF-16 too. Only a file
+ * of `limit` bytes at most is decoded (round 9, 25 Sep 2026).
+ */
+function readings(bytes, limit = Infinity, how = '', depth = 3) {
+  const all = [[bytes, how && `, in ${how}`]];
+  if (!depth || bytes.length > limit) return all;
+  const order = utf16(bytes);
+  if (order) all.push(...readings(fromUtf16(bytes, order), limit, how ? `${how} and UTF-16` : 'UTF-16', depth - 1));
+  const held = fromBase64(bytes);
+  if (held) all.push(...readings(held, limit, how ? `${how} and base64` : 'base64', depth - 1));
+  return all;
+}
+
+/**
+ * Which way round a text in UTF-16 is, 'le' or 'be', or null: by its byte-order mark (FF FE, FE FF), or, with none, by
+ * the NULs of its Latin letters, in the same half of three pairs in four over its first 512.
+ */
+function utf16(bytes) {
+  if (bytes[0] === 0xff && bytes[1] === 0xfe) return 'le';
+  if (bytes[0] === 0xfe && bytes[1] === 0xff) return 'be';
+  const pairs = Math.min(bytes.length >> 1, 512);
+  if (pairs < 8) return null;
+  let low = 0; let high = 0;
+  for (let i = 0; i < pairs * 2; i += 2) {
+    if (bytes[i] && !bytes[i + 1]) low++;
+    else if (!bytes[i] && bytes[i + 1]) high++;
+  }
+  return low >= pairs * 0.75 ? 'le' : high >= pairs * 0.75 ? 'be' : null;
+}
+
+/** A text in UTF-16 as UTF-8, a piece at a time. */
+function fromUtf16(bytes, order) {
+  const even = bytes.length - (bytes.length % 2);
+  const parts = [];
+  for (let from = 0; from < even; from += PIECE) {
+    const piece = bytes.subarray(from, Math.min(from + PIECE, even));
+    // Big-endian turned round in a copy: swap16 turns the bytes it is given round where they are.
+    parts.push(Buffer.from((order === 'be' ? Buffer.from(piece).swap16() : piece).toString('utf16le'), 'utf8'));
+  }
+  return Buffer.concat(parts);
+}
+
+const BASE64 = new Uint8Array(256);
+for (const c of 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/-_') BASE64[c.charCodeAt(0)] = 1;
+/**
+ * What a file that is base64 and nothing else holds, or null: past blank space and a byte-order mark, 16 characters at
+ * least, of either alphabet, and `=` only at the end. Decoded a piece at a time: PIECE is a whole number of quartets.
+ */
+function fromBase64(bytes) {
+  let count = 0; let end = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    const b = bytes[i];
+    if (blank(b)) continue;
+    if (b === 0x3d) { if (++end > 2) return null; } else if (end || !BASE64[b]) return null;
+    count++;
+  }
+  if (count < 16 || (count - end) % 4 === 1) return null;
+  const parts = [];
+  const chars = Buffer.allocUnsafe(Math.min(count, PIECE));
+  let n = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    if (blank(bytes[i])) continue;
+    chars[n++] = bytes[i];
+    if (n === chars.length) { parts.push(Buffer.from(chars.toString('latin1'), 'base64')); n = 0; }
+  }
+  if (n) parts.push(Buffer.from(chars.toString('latin1', 0, n), 'base64'));
+  return Buffer.concat(parts);
+}
 
 /** An address with a password in it, `scheme://user:password@host`: the user and password as an address spells them. */
 const ADDRESS = /\b[a-z][a-z0-9+.-]{1,15}:\/\/([a-z0-9._~%!+,;=-]{1,64}):([a-z0-9._~%!+,;=-]{1,128})@([a-z0-9.-]+|\[[0-9a-f:.]+\])/gi;
@@ -231,6 +369,64 @@ const LOOK = { depth: 4, entries: 20_000 };
 /** Folders the look for private files passes by: installed packages, caches, and git's own, of which only config is read. */
 const PASSED_BY = new Set(['node_modules', '.git', '.pnpm-store', '.yarn', '.next', '.turbo', '.cache']);
 
+/** Space, tab, and the line ends and feeds: what a text form changes, and what its start passes over. */
+const blank = (b) => b === 0x20 || (b >= 0x09 && b <= 0x0d);
+const bom = (bytes) => (bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf ? 3 : 0);
+
+/**
+ * A text as it reads, whatever an editor, a platform or a build did around its words: no byte-order mark, LF line
+ * ends, no space or tab at the end of a line, nothing blank at the end — or null for what is no text (a NUL in its
+ * first 8,000 bytes, as git judges one) or nothing but blank. One pass, and no pattern that could backtrack.
+ */
+function textForm(bytes) {
+  if (bytes.subarray(0, 8000).includes(0)) return null;
+  const out = Buffer.allocUnsafe(bytes.length);
+  let n = 0;
+  for (let i = bom(bytes); i < bytes.length; i++) {
+    const b = bytes[i];
+    if (b !== 0x0a && b !== 0x0d) { out[n++] = b; continue; }
+    if (b === 0x0d && bytes[i + 1] === 0x0a) i++;
+    while (n && (out[n - 1] === 0x20 || out[n - 1] === 0x09)) n--;
+    out[n++] = 0x0a;
+  }
+  while (n && blank(out[n - 1])) n--;
+  return n ? out.subarray(0, n) : null;
+}
+
+/**
+ * The first 64 bytes of a text that are not blank, after a byte-order mark: every text form of a text starts with the
+ * same, so a file that starts otherwise is no copy — told without reading on. Null for a NUL among them, or none.
+ */
+function textStart(bytes) {
+  let start = '';
+  for (let i = bom(bytes); i < bytes.length && start.length < 64; i++) {
+    if (bytes[i] === 0) return null;
+    if (!blank(bytes[i])) start += String.fromCharCode(bytes[i]);
+  }
+  return start || null;
+}
+
+/** The names a build gives a compressed copy: vite-plugin-compression's and compression-webpack-plugin's, beside the file. */
+export const COMPRESSED = /\.(gz|br)$/i;
+
+/**
+ * What a compressed file holds, and the name it had — `{ name, bytes }` — or null: a gzip whatever its name, and by the
+ * name a build gives it a .gz of zlib's (a plugin's "deflate") or a .br. Opened to `limit` bytes and no further, as
+ * zlib's maxOutputLength stops it: one that holds more, a bomb among them, is null, as are what is not compressed and
+ * what does not open. A build's compression plugin writes data.json.gz and .br beside data.json, and `pack` judged
+ * them by their compressed bytes, in which nothing private can be read (round 8, 25 Sep 2026).
+ *
+ * A .gz that is not zlib's is opened as raw deflate, which has no header to know it by: vite-plugin-compression's
+ * deflateRaw writes one under that name, and it was packed (round 9, 25 Sep 2026).
+ */
+export function unpacked(name, bytes, limit = COPY_LIMIT) {
+  const ways = bytes[0] === 0x1f && bytes[1] === 0x8b ? [gunzipSync] : /\.br$/i.test(name) ? [brotliDecompressSync] : /\.gz$/i.test(name) ? [inflateSync, inflateRawSync] : [];
+  for (const open of ways) {
+    try { return { name: name.replace(COMPRESSED, ''), bytes: open(bytes, { maxOutputLength: limit }) }; } catch { /* the next way, if there is one */ }
+  }
+  return null;
+}
+
 /**
  * What says a file of a build is a copy of a private one: `why(bytes)`, which answers "a copy of .env, an environment
  * file" or null. Its bytes are compared (SHA-256) with every file under `root` that is private by its name (privateKind:
@@ -238,18 +434,36 @@ const PASSED_BY = new Set(['node_modules', '.git', '.pnpm-store', '.yarn', '.nex
  * few MB at most and not empty. A build resolves a link before `pack` sees it: WXT and Vite copy what a link in public/
  * points at as an ordinary file under the link's name, so a cloned template's public/icon-128.png -> ../.env reached
  * the zip as a PNG, the developer's .env inside (25 Sep 2026).
+ *
+ * And so is their text: a copy with CRLF line ends, a byte-order mark, or a newline more or less at its end had other
+ * bytes, and was packed (round 8, 25 Sep 2026). Each text form is compared too — only a file whose text starts as a
+ * private one's is read through, so a build's bundles cost a look at their first 64 characters.
+ *
+ * And so is what they hold in each form a copy of a text takes (readings): a copy in UTF-16, which Windows PowerShell
+ * 5.1 writes for `Get-Content .env > dist\data.txt`, or in base64, had other bytes and no text form, and was packed
+ * (round 9, 25 Sep 2026). A private file in UTF-16 is known by its text in UTF-8 as well.
  */
 export function privateCopies(root, more = []) {
   const known = new Map(); // size → hash → what the file is
+  const texts = new Map(); // how its text starts → hash of its text form → what the file is
   const note = (path, what) => {
     let bytes;
     try { const st = statSync(path); if (!st.isFile() || st.size > COPY_LIMIT) return; bytes = readFileSync(path); } catch { return; }
-    // Nothing in it is nothing to keep, and a copy of nothing is every empty file.
-    if (!bytes.toString('latin1').trim()) return;
-    const same = known.get(bytes.length) ?? new Map();
-    known.set(bytes.length, same);
-    const hash = sha256(bytes);
-    if (!same.has(hash)) same.set(hash, what);
+    for (const [view] of readings(bytes)) {
+      // Nothing in it is nothing to keep, and a copy of nothing is every empty file.
+      if (!view.toString('latin1').trim()) continue;
+      const same = known.get(view.length) ?? new Map();
+      known.set(view.length, same);
+      const hash = sha256(view);
+      if (!same.has(hash)) same.set(hash, what);
+      const form = textForm(view);
+      const start = form && textStart(view);
+      if (!start) continue;
+      const alike = texts.get(start) ?? new Map();
+      texts.set(start, alike);
+      const formHash = sha256(form);
+      if (!alike.has(formHash)) alike.set(formHash, what);
+    }
   };
   let entries = 0;
   // Level by level, so the project's own top — where .env and .npmrc are kept — is always read, however large the rest.
@@ -278,8 +492,17 @@ export function privateCopies(root, more = []) {
   }
   for (const [path, what] of more) note(path, what);
   return (bytes) => {
-    const what = known.get(bytes.length)?.get(sha256(bytes));
-    return what ? `a copy of ${what}` : null;
+    // Decoded up to three times the most a private file is: its copy in UTF-16, or in base64 written in UTF-16, is no larger.
+    for (const [view, how] of readings(bytes, 3 * COPY_LIMIT)) {
+      let what = known.get(view.length)?.get(sha256(view));
+      if (!what && view.length <= COPY_LIMIT) {
+        const alike = texts.get(textStart(view));
+        const form = alike && textForm(view);
+        if (form) what = alike.get(sha256(form));
+      }
+      if (what) return `a copy of ${what}${how}`;
+    }
+    return null;
   };
 }
 
@@ -296,11 +519,61 @@ export function gitDirectory(dir) {
   } catch { return false; }
 }
 
-const RASTER = /\.(png|jpe?g|gif|webp|ico|bmp)$/i;
+/**
+ * Git's own history, whatever its name: a pack or its index (`PACK`, `\xfftOc`), or a loose object — zlib that opens
+ * on `blob 57\0`, `tree`, `commit`, `tag`. A build that follows a link to .git/objects copies a folder of these, every
+ * commit in it, files removed from the tree among them; round seven looked for a repository's HEAD and config, which
+ * an object store has not (round 8, 25 Sep 2026).
+ */
+export function gitObject(bytes) {
+  if (bytes.length >= 8 && (bytes.subarray(0, 4).toString('latin1') === 'PACK' || bytes.subarray(0, 4).equals(Buffer.from([0xff, 0x74, 0x4f, 0x63])))) return 'git history';
+  if (bytes.length >= 2 && bytes[0] === 0x78 && (bytes[0] * 256 + bytes[1]) % 31 === 0) {
+    try {
+      const head = inflateSync(bytes.subarray(0, 1024), { finishFlush: zlibConstants.Z_SYNC_FLUSH }).subarray(0, 32).toString('latin1');
+      if (/^(blob|tree|commit|tag) \d+\0/.test(head)) return 'git history';
+    } catch { /* not zlib, or not whole: nothing git reads */ }
+  }
+  return null;
+}
+
+/** A line of git's list of refs (packed-refs, which starts with its own header, or FETCH_HEAD), and one of its logs. */
+const GIT_REFS = /^(?:# pack-refs with:|[0-9a-f]{40}(?:[0-9a-f]{24})?\t(?:not-for-merge)?\t)/;
+const GIT_LOG = /^[0-9a-f]{40}(?:[0-9a-f]{24})? [0-9a-f]{40}(?:[0-9a-f]{24})? [^\n<]*<[^\n>]*> \d+ [+-]\d{4}(?:\t|\r?\n|$)/;
+/**
+ * Git's other files, whatever their names, by what they hold: its index (`DIRC`), its list of refs, the log of where
+ * each branch has been — an author, a time and a commit's subject a line — and a repository's config, which names its
+ * remote. A build that copied them from .git under other names shipped them all, the objects aside (round 9, 25 Sep
+ * 2026). A commit message being written (COMMIT_EDITMSG) is text like any other, and is not told apart.
+ */
+export function gitFile(bytes) {
+  if (bytes.length >= 12 && bytes.toString('latin1', 0, 4) === 'DIRC' && [2, 3, 4].includes(bytes.readUInt32BE(4))) return "git's index";
+  const head = bytes.subarray(0, 64 * 1024).toString('latin1');
+  if (GIT_REFS.test(head)) return "git's refs";
+  if (GIT_LOG.test(head)) return "git's log";
+  // A config from its first section on (comments before it aside), with the [core] and the format version git writes.
+  if (/^\s*(?:[#;][^\n]*\n\s*)*\[[^\]\n]+\]/.test(head) && /^[ \t]*\[core\][ \t]*\r?$/m.test(head) && /^[ \t]*repositoryformatversion[ \t]*=/m.test(head)) return "git's config";
+  return null;
+}
+
+/** Whether a folder is a copy of git's object store — its pack/ or a two-hex folder holding an object — to leave out whole, one line said. */
+export function gitObjects(dir) {
+  try {
+    for (const name of readdirSync(dir).slice(0, 300)) {
+      const p = join(dir, name);
+      if (!lstatSync(p).isDirectory() || !(name === 'pack' || /^[0-9a-f]{2}$/.test(name))) continue;
+      const first = readdirSync(p).find((f) => lstatSync(join(p, f)).isFile());
+      if (first && gitObject(readFileSync(join(p, first)).subarray(0, 4096))) return true;
+    }
+  } catch { /* unread: its files are judged one by one */ }
+  return false;
+}
+
+// .avif, .tif and .tiff, and .apng and .jfif (a PNG's and a JPEG's bytes), were no picture's names until round 8.
+const RASTER = /\.(a?png|jpe?g|jfif|gif|webp|avif|ico|bmp|tiff?)$/i;
 /**
  * The first bytes of each kind of picture an extension shows: PNG, JPEG, GIF, WebP, ICO, BMP (whose reserved bytes
- * are zero, as no text's are), and AVIF's box. Any of them passes under any picture's name: Chrome reads a picture by
- * its bytes, and a JPEG saved as .png is no secret.
+ * are zero, as no text's are), AVIF's box, and TIFF's byte order and 42 (43 for BigTIFF). Any of them passes under any
+ * picture's name: Chrome reads a picture by its bytes, and a JPEG saved as .png is no secret.
  */
 const PICTURE = [
   (b) => b.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47])),
@@ -310,6 +583,7 @@ const PICTURE = [
   (b) => b.subarray(0, 4).equals(Buffer.from([0x00, 0x00, 0x01, 0x00])),
   (b) => b.length >= 10 && b.subarray(0, 2).toString('latin1') === 'BM' && b.readUInt32LE(6) === 0,
   (b) => b.subarray(4, 8).toString('latin1') === 'ftyp',
+  (b) => ['49492a00', '4d4d002a', '49492b00', '4d4d002b'].includes(b.subarray(0, 4).toString('hex')),
 ];
 /**
  * Why a file named as an image is none, or null: its first bytes are no picture's, or — an .svg — it is not SVG's
@@ -336,6 +610,31 @@ const BUILD_CONFIGS = ['wxt.config', 'vite.config'].flatMap((n) => ['ts', 'mts',
  * the link is gone, and says where they are (25 Sep 2026).
  */
 export function publicLinks(root, packed = null) {
+  return [...new Set(publicLinkEntries(root, packed).map((e) => e.link))].sort();
+}
+
+/**
+ * The links of the folders a build copies as they are whose target a store zip must never hold — inside a .git
+ * folder, or private by its name — and where the build put each: its path under the folder it is in, which the build
+ * copies to the top of its output. `pack` leaves those out of the build, and says why (round 8, 25 Sep 2026): a warning
+ * let `public/vendor -> ../.git/objects` ship every commit. A link to anything else is said, as before, not refused:
+ * a monorepo's shared icons are links too.
+ *
+ * `.git` in any case: macOS and Windows find `../.GIT/logs` all the same, and it was packed (round 9, 25 Sep 2026).
+ */
+export function privateLinks(root, packed = null) {
+  const out = [];
+  for (const { link, within, path } of publicLinkEntries(root, packed)) {
+    let target;
+    try { target = realpathSync(path); } catch { continue; }
+    const kind = privateKind(target.split(sep).pop() ?? '');
+    const why = target.split(sep).some((part) => part.toLowerCase() === '.git') ? 'a link into .git' : kind ? `a link to ${kind}` : null;
+    if (why) out.push({ link, within, why });
+  }
+  return out;
+}
+
+function publicLinkEntries(root, packed = null) {
   const dirs = new Set(PUBLIC_DIRS);
   for (const config of BUILD_CONFIGS) {
     let text;
@@ -345,7 +644,7 @@ export function publicLinks(root, packed = null) {
   }
   const links = [];
   let entries = 0;
-  const walk = (dir, depth) => {
+  const walk = (base, dir, depth) => {
     let names;
     try { names = readdirSync(dir).sort(); } catch { return; }
     for (const name of names) {
@@ -353,8 +652,8 @@ export function publicLinks(root, packed = null) {
       const path = join(dir, name);
       let st;
       try { st = lstatSync(path); } catch { continue; }
-      if (st.isSymbolicLink()) links.push(path);
-      else if (st.isDirectory() && depth < 8) walk(path, depth + 1);
+      if (st.isSymbolicLink()) links.push({ path, base });
+      else if (st.isDirectory() && depth < 8) walk(base, path, depth + 1);
     }
   };
   for (const dir of dirs) {
@@ -363,10 +662,12 @@ export function publicLinks(root, packed = null) {
     if (!at.startsWith(resolve(root) + sep) || (packed && (at === packed || at.startsWith(packed + sep)))) continue;
     let st;
     try { st = lstatSync(at); } catch { continue; }
-    if (st.isSymbolicLink()) links.push(at);
-    else if (st.isDirectory()) walk(at, 0);
+    // The folder itself a link: the build copies it whole, to the top of its output.
+    if (st.isSymbolicLink()) links.push({ path: at, base: at });
+    else if (st.isDirectory()) walk(at, at, 0);
   }
-  return [...new Set(links.map((p) => relative(root, p).split(sep).join('/')))].sort();
+  const posixOf = (p) => p.split(sep).join('/');
+  return links.map(({ path, base }) => ({ path, link: posixOf(relative(root, path)), within: path === base ? '' : posixOf(relative(base, path)) }));
 }
 
 /**
@@ -384,6 +685,17 @@ export function signInPage(link, wall) {
   return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;
 }
 
+/**
+ * How long `login` waits between asking whether its code was approved, and how long it asks at all, in milliseconds:
+ * what the Wall said (where it said nothing, RFC 8628's 5 seconds, and ten minutes), within one second and half a
+ * minute between asks, and a quarter of an hour in all. It took the Wall's word, so a Wall at another address (--wall,
+ * TOOLABY_WALL) kept it waiting as long as it said (round 9, 25 Sep 2026).
+ */
+export function devicePolling({ interval, expires_in: expiresIn } = {}) {
+  const seconds = (value, otherwise, least, most) => Math.min(Math.max(Number(value) > 0 && Number.isFinite(Number(value)) ? Number(value) : otherwise, least), most);
+  return { every: seconds(interval, 5, 1, 30) * 1000, lasts: seconds(expiresIn, 600, 1, 15 * 60) * 1000 };
+}
+
 /**
  * How a page is opened on each platform, the address one argument and no shell in between. On Windows,
  * `cmd /c start "" <url>` read an `&` in the address as a second command; rundll32 hands it to the default browser

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {