toolaby 1.7.0 → 1.7.2

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`)
-toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
-toolaby wire <tool-id> --live # the same, on Live: the store build
+npm i -g toolaby                  # once; or run every command through `npx -y toolaby@latest …`
+toolaby-cli wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
+toolaby-cli wire <tool-id> --live # the same, on Live: the store build
 ```
 
+The command is `toolaby-cli`: on Windows, the Command Prompt runs a `toolaby.js` in the current folder before a command named `toolaby`, and every wired folder has one. Below, `toolaby <command>` names each command.
+
 In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
 
 Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.

package/bin.mjs

@@ -38,13 +38,13 @@ import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
 import { createHmac, randomBytes } from 'node:crypto';
 import { wireManifest, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
-import { wiringSummary, popupSwapIn, ownCode } from './lib/summary.js';
+import { wiringSummary, popupSwapIn, gatesIn, ownCode } from './lib/summary.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.7.0';
+const VERSION = '1.7.2';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -167,11 +167,11 @@ async function login() {
     }
     const why = poll.json.error;
     if (why === 'slow_down') every += 5000;
-    else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
+    else if (why === 'expired_token') fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
     else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
     else if (why && why !== 'authorization_pending') fail(`The Wall answered "${oneLine(why)}"${poll.json.error_description ? `: ${oneLine(poll.json.error_description)}` : ''}.`);
   }
-  fail('The code expired before it was approved. Run `toolaby login` again.');
+  fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
 }
 
 /** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
@@ -183,9 +183,9 @@ async function tokenOrLogin() {
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.${envElsewhere()}`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.${envElsewhere()}`);
   const me = await api('/api/cli/me', { token });
-  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`npx -y toolaby@latest login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
   out(`\n  ${oneLine(me.json.email)}  ·  ${side}  ·  ${wall}\n`);
   for (const w of me.json.workspaces) out(`    ${oneLine(w.name)}  (${oneLine(w.slug)}, ${oneLine(w.role)})  ${oneLine(w.site)}`);
@@ -207,7 +207,7 @@ async function logout() {
 async function tools() {
   const token = await tokenOrLogin();
   const res = await api('/api/cli/tools', { token });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
@@ -276,7 +276,7 @@ async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
 
 async function wire() {
   const slug = positional[0];
-  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: npx -y toolaby@latest upgrade <tool-id> [--into <folder>]   — `npx -y toolaby@latest tools` lists your ids' : 'usage: npx -y toolaby@latest wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--into') ?? '.');
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
@@ -297,9 +297,16 @@ async function wire() {
   const oldConfig = existsSync(configPath) ? readOr(configPath, '') : '';
   const remembered = oldConfig.match(/appPopup:\s*'([^']*)'/)?.[1] || null;
   const rememberedSidePanel = oldConfig.match(/appSidePanel:\s*'([^']*)'/)?.[1] || null;
+  // The extension's own code, read first: a popup it handles itself (setPopup, getPopup) decides which page stands in
+  // front, and whether it opens the paywall anywhere decides whether the lines for it are a step.
+  const code = project.manifestFile ? [...tree].filter(ownCode).slice(0, 400).map((path) => { let text = ''; try { if (statSync(join(dir, path)).size < 512_000) text = readOr(join(dir, path), ''); } catch { /* gone */ } return { path, text }; }) : [];
+  const popupSwap = popupSwapIn(code);
+  // Wired for the first time, an extension whose code handles its popup keeps it in front: the Wall's in front of it is
+  // skipped by setPopup(), and found by getPopup() where the code expects its own (Chrome's action sample threw so).
+  const keptForSwap = !oldConfig && !!popupSwap && typeof manifest?.action?.default_popup === 'string' && !flag('--own-popup');
   // An extension whose own pages draw the panel — what `create` makes, "your popup first", or asked with --own-popup —
   // keeps them in front.
-  const ownInFront = flag('--own-popup') || drawsItself(manifest, oldConfig);
+  const ownInFront = flag('--own-popup') || drawsItself(manifest, oldConfig) || keptForSwap;
   // The background the manifest names, read from inside the folder only: whether it starts the Wall, or is the Wall's.
   const namedWorker = workerIn(manifest) ?? '';
   const workerSource = namedWorker && has(namedWorker) && !inside(dir, namedWorker).why ? readOr(join(dir, namedWorker), '') : null;
@@ -344,9 +351,7 @@ async function wire() {
   } else if (project.createWorker) {
     write(project.createWorker.file, project.createWorker.content);
   }
-  // The extension's own code, read for a popup it swaps while it runs: the Wall's in front of it could be skipped then.
-  const code = appPopup ? [...tree].filter(ownCode).slice(0, 400).map((path) => { let text = ''; try { if (statSync(join(dir, path)).size < 512_000) text = readOr(join(dir, path), ''); } catch { /* gone */ } return { path, text }; }) : [];
-  const summary = wiringSummary({ project, wiring, appPopup, appSidePanel, workerStarts: !!project.worker && startsPlatform(join(dir, project.worker)), popupSwap: popupSwapIn(code) });
+  const summary = wiringSummary({ project, wiring, appPopup, appSidePanel, workerStarts: !!project.worker && startsPlatform(join(dir, project.worker)), popupSwap, keptForSwap, gates: project.manifestFile ? gatesIn(code) : null });
 
   // Wired again, a folder takes `upgrade` (wire, replacing the platform's files): the command, ready to paste.
   const into = opt('--into');
@@ -366,7 +371,7 @@ async function wire() {
 
 async function create() {
   const slug = positional[0];
-  if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail('usage: npx -y toolaby@latest create <tool-id> [--dir <folder>]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
   if (there(dir)) fail(`${dir} already exists`);
   // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
@@ -437,7 +442,7 @@ function devSecret() {
 }
 async function catalogue() {
   const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   return res.json.events;
 }
@@ -457,7 +462,7 @@ async function webhooks() {
   }
   if (sub === 'trigger') {
     const type = positional[1];
-    if (!type) fail('usage: toolaby webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `toolaby webhooks events` lists them');
+    if (!type) fail('usage: npx -y toolaby@latest webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `npx -y toolaby@latest webhooks events` lists them');
     const to = opt('--to');
     if (!to) {
       const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
@@ -467,7 +472,7 @@ async function webhooks() {
     }
     const events = await catalogue();
     const event = events.find((e) => e.type === type);
-    if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
+    if (!event) fail(`No event "${type}". \`npx -y toolaby@latest webhooks events\` lists them.`);
     const secret = opt('--secret') ?? devSecret();
     if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
     const id = `msg_${randomBytes(12).toString('base64url')}`;
@@ -489,14 +494,14 @@ async function webhooks() {
     const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  ${oneLine(res.json.workspace)} · ${side}\n`);
-    if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
+    if (res.json.endpoints.length === 0) out('    None yet. `npx -y toolaby@latest webhooks add <url>` registers one.');
     for (const e of res.json.endpoints) out(`    ${oneLine(e.id)}  ${e.disabled ? 'paused ' : 'on     '} ${oneLine(e.url)}${e.description ? `  — ${oneLine(e.description)}` : ''}${e.events.length ? `  (${oneLine(e.events.join(', '))})` : ''}`);
     out();
     return;
   }
   if (sub === 'add') {
     const url = positional[1];
-    if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
+    if (!url) fail('usage: npx -y toolaby@latest webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
     const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
     const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
@@ -505,13 +510,13 @@ async function webhooks() {
   }
   if (sub === 'remove') {
     const id = positional[1];
-    if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
+    if (!id) fail('usage: npx -y toolaby@latest webhooks remove <ep_…> [--workspace <slug>]   — `npx -y toolaby@latest webhooks endpoints` lists them');
     const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  Removed ${oneLine(res.json.removed)} · ${oneLine(res.json.workspace)} · ${side}. Deliveries to it stop at once.\n`);
     return;
   }
-  fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
+  fail('usage: npx -y toolaby@latest webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
 }
 
 // ── pack: the zip the Chrome Web Store takes ──────────────────────────────────────────────────────────────────────────
@@ -779,35 +784,37 @@ function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
 
-    toolaby wire <tool-id>             wire the extension in this folder to your tool, on Test
-    toolaby wire <tool-id> --live      the same, on Live: the store build
+    npx -y toolaby@latest <command>, or installed (npm i -g toolaby): toolaby-cli <command>
+
+    wire <tool-id>                     wire the extension in this folder to your tool, on Test
+    wire <tool-id> --live              the same, on Live: the store build
                                        --into <folder>   another folder     --force   replace the platform's files
                                        --own-popup       keep your popup in front (the Wall's opens from toolaby.showPaywall())
-    toolaby upgrade <tool-id>          the platform's files replaced with the current ones — the popup, the client — yours untouched
-    toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
+    upgrade <tool-id>                  the platform's files replaced with the current ones — the popup, the client — yours untouched
+    create <tool-id>                   a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
-    toolaby tools                      your tools, with their ids
-    toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
+    tools                              your tools, with their ids
+    pack [folder]                      the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
                                        leaves out keys, certificates, .env and credential files, source maps, secrets,
                                        git's files, a build's copy of a private file (compressed, UTF-16 or base64),
                                        an image that is none; refuses a build if one is a file the manifest names
                                        --allow-private packs them
-    toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
+    check [folder]                     whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
-    toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
+    mcp                                the Wall for coding agents, an MCP server on stdio:
                                        claude mcp add toolaby -- npx -y toolaby@latest mcp
-    toolaby webhooks events            the six events, with an example of each
-    toolaby webhooks trigger <event>   an example delivery to your endpoints; --to <url> sends it to a local server instead
-    toolaby webhooks endpoints         your endpoints; add <url> registers one (secret shown once), remove <id> removes one
-    toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
+    webhooks events                    the six events, with an example of each
+    webhooks trigger <event>           an example delivery to your endpoints; --to <url> sends it to a local server instead
+    webhooks endpoints                 your endpoints; add <url> registers one (secret shown once), remove <id> removes one
+    login · whoami · logout            the session, per side; a command that needs one signs you in itself
 
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
     sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
 
-    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
-    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
+    In a repository you did not write, install it (npm i -g toolaby) and type toolaby-cli: npx can run a toolaby
+    the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 

package/lib/summary.js

@@ -9,6 +9,8 @@ export function popupSwapIn(files) {
     }
     return null;
 }
+/** Whether the extension's own code opens the paywall anywhere: gate() or showPaywall(), outside its comments. */
+export const gatesIn = (files) => files.some((f) => /\btoolaby\s*\.\s*(gate|showPaywall)\s*\(/.test(withoutComments(f.text)));
 /** Whether a path is the extension's own code, for popupSwapIn: a script, not the Wall's, not a dependency's or a build's. */
 export const ownCode = (path) => /\.(m?js|jsx|ts|tsx)$/.test(path) && !/(^|\/)toolaby[^/]*$/.test(path) && !/(^|\/)(node_modules|dist|build|\.output|\.wxt|\.plasmo)\//.test(path);
 export function wiringSummary(o) {
@@ -21,6 +23,8 @@ export function wiringSummary(o) {
             ? { tone: 'warn', label: 'Popup', text: `Your code handles the popup itself (${o.popupSwap.call} in ${o.popupSwap.file}), so keep yours in front`, fix: 'own-popup' }
             : { tone: 'ok', label: 'Popup', text: `The Wall checks first, then opens ${o.appPopup}` });
     }
+    else if (ownPopup && o.keptForSwap && o.popupSwap)
+        rows.push({ tone: 'ok', label: 'Popup', text: `Yours stays in front, as your code handles it (${o.popupSwap.call} in ${o.popupSwap.file})` });
     else if (ownPopup)
         rows.push({ tone: 'ok', label: 'Popup', text: `Yours stays in front; toolaby.showPaywall() opens the Wall's` });
     else if (p.note)
@@ -55,6 +59,10 @@ export function wiringSummary(o) {
         rows.push({ tone: 'todo', label: 'Background', text: `Add these 2 lines to the top of ${p.worker}:`, code: p.workerLines.trim() });
     else if (p.worker)
         rows.push({ tone: 'ok', label: 'Background', text: `${p.worker} starts the Wall` });
+    // With no page of the Wall's in front, the paywall opens only where the code asks for it: when nothing does, the lines.
+    if (!o.appPopup && !o.appSidePanel && o.gates === false && p.kind === 'plain') {
+        rows.push({ tone: 'todo', label: 'Paywall', text: p.built ? 'Nothing opens it yet. Where your paid action starts, add (the import is the path to toolaby.js):' : 'Nothing opens it yet. Where your paid action starts, in a module script, add:', code: `import { toolaby } from '${p.built ? './toolaby.js' : '/toolaby.js'}';\n\nconst permit = await toolaby.gate();\nif (!permit.allowed) return toolaby.showPaywall(permit);` });
+    }
     // The manifest: what it gained, or, generated by a framework, what its config needs.
     if (w)
         rows.push({ tone: 'ok', label: 'Manifest', text: w.added.length ? w.added.join(' · ') : 'Has what the Wall needs' });

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "toolaby",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {
-    "toolaby": "bin.mjs"
+    "toolaby-cli": "bin.mjs"
   },
   "files": [
     "bin.mjs",