toolaby 1.7.1 → 1.7.2

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`); on Windows, type toolaby-cli
-toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
-toolaby wire <tool-id> --live # the same, on Live: the store build
+npm i -g toolaby                  # once; or run every command through `npx -y toolaby@latest …`
+toolaby-cli wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
+toolaby-cli wire <tool-id> --live # the same, on Live: the store build
 ```
 
+The command is `toolaby-cli`: on Windows, the Command Prompt runs a `toolaby.js` in the current folder before a command named `toolaby`, and every wired folder has one. Below, `toolaby <command>` names each command.
+
 In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
 
 Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.

package/bin.mjs

@@ -44,7 +44,7 @@ import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.7.1';
+const VERSION = '1.7.2';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -167,11 +167,11 @@ async function login() {
     }
     const why = poll.json.error;
     if (why === 'slow_down') every += 5000;
-    else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
+    else if (why === 'expired_token') fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
     else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
     else if (why && why !== 'authorization_pending') fail(`The Wall answered "${oneLine(why)}"${poll.json.error_description ? `: ${oneLine(poll.json.error_description)}` : ''}.`);
   }
-  fail('The code expired before it was approved. Run `toolaby login` again.');
+  fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
 }
 
 /** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
@@ -183,9 +183,9 @@ async function tokenOrLogin() {
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.${envElsewhere()}`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.${envElsewhere()}`);
   const me = await api('/api/cli/me', { token });
-  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`npx -y toolaby@latest login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
   out(`\n  ${oneLine(me.json.email)}  ·  ${side}  ·  ${wall}\n`);
   for (const w of me.json.workspaces) out(`    ${oneLine(w.name)}  (${oneLine(w.slug)}, ${oneLine(w.role)})  ${oneLine(w.site)}`);
@@ -207,7 +207,7 @@ async function logout() {
 async function tools() {
   const token = await tokenOrLogin();
   const res = await api('/api/cli/tools', { token });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
@@ -276,7 +276,7 @@ async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
 
 async function wire() {
   const slug = positional[0];
-  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: npx -y toolaby@latest upgrade <tool-id> [--into <folder>]   — `npx -y toolaby@latest tools` lists your ids' : 'usage: npx -y toolaby@latest wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--into') ?? '.');
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
@@ -371,7 +371,7 @@ async function wire() {
 
 async function create() {
   const slug = positional[0];
-  if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail('usage: npx -y toolaby@latest create <tool-id> [--dir <folder>]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
   if (there(dir)) fail(`${dir} already exists`);
   // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
@@ -442,7 +442,7 @@ function devSecret() {
 }
 async function catalogue() {
   const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   return res.json.events;
 }
@@ -462,7 +462,7 @@ async function webhooks() {
   }
   if (sub === 'trigger') {
     const type = positional[1];
-    if (!type) fail('usage: toolaby webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `toolaby webhooks events` lists them');
+    if (!type) fail('usage: npx -y toolaby@latest webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `npx -y toolaby@latest webhooks events` lists them');
     const to = opt('--to');
     if (!to) {
       const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
@@ -472,7 +472,7 @@ async function webhooks() {
     }
     const events = await catalogue();
     const event = events.find((e) => e.type === type);
-    if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
+    if (!event) fail(`No event "${type}". \`npx -y toolaby@latest webhooks events\` lists them.`);
     const secret = opt('--secret') ?? devSecret();
     if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
     const id = `msg_${randomBytes(12).toString('base64url')}`;
@@ -494,14 +494,14 @@ async function webhooks() {
     const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  ${oneLine(res.json.workspace)} · ${side}\n`);
-    if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
+    if (res.json.endpoints.length === 0) out('    None yet. `npx -y toolaby@latest webhooks add <url>` registers one.');
     for (const e of res.json.endpoints) out(`    ${oneLine(e.id)}  ${e.disabled ? 'paused ' : 'on     '} ${oneLine(e.url)}${e.description ? `  — ${oneLine(e.description)}` : ''}${e.events.length ? `  (${oneLine(e.events.join(', '))})` : ''}`);
     out();
     return;
   }
   if (sub === 'add') {
     const url = positional[1];
-    if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
+    if (!url) fail('usage: npx -y toolaby@latest webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
     const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
     const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
@@ -510,13 +510,13 @@ async function webhooks() {
   }
   if (sub === 'remove') {
     const id = positional[1];
-    if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
+    if (!id) fail('usage: npx -y toolaby@latest webhooks remove <ep_…> [--workspace <slug>]   — `npx -y toolaby@latest webhooks endpoints` lists them');
     const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  Removed ${oneLine(res.json.removed)} · ${oneLine(res.json.workspace)} · ${side}. Deliveries to it stop at once.\n`);
     return;
   }
-  fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
+  fail('usage: npx -y toolaby@latest webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
 }
 
 // ── pack: the zip the Chrome Web Store takes ──────────────────────────────────────────────────────────────────────────
@@ -784,35 +784,37 @@ function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
 
-    toolaby wire <tool-id>             wire the extension in this folder to your tool, on Test
-    toolaby wire <tool-id> --live      the same, on Live: the store build
+    npx -y toolaby@latest <command>, or installed (npm i -g toolaby): toolaby-cli <command>
+
+    wire <tool-id>                     wire the extension in this folder to your tool, on Test
+    wire <tool-id> --live              the same, on Live: the store build
                                        --into <folder>   another folder     --force   replace the platform's files
                                        --own-popup       keep your popup in front (the Wall's opens from toolaby.showPaywall())
-    toolaby upgrade <tool-id>          the platform's files replaced with the current ones — the popup, the client — yours untouched
-    toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
+    upgrade <tool-id>                  the platform's files replaced with the current ones — the popup, the client — yours untouched
+    create <tool-id>                   a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
-    toolaby tools                      your tools, with their ids
-    toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
+    tools                              your tools, with their ids
+    pack [folder]                      the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
                                        leaves out keys, certificates, .env and credential files, source maps, secrets,
                                        git's files, a build's copy of a private file (compressed, UTF-16 or base64),
                                        an image that is none; refuses a build if one is a file the manifest names
                                        --allow-private packs them
-    toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
+    check [folder]                     whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
-    toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
+    mcp                                the Wall for coding agents, an MCP server on stdio:
                                        claude mcp add toolaby -- npx -y toolaby@latest mcp
-    toolaby webhooks events            the six events, with an example of each
-    toolaby webhooks trigger <event>   an example delivery to your endpoints; --to <url> sends it to a local server instead
-    toolaby webhooks endpoints         your endpoints; add <url> registers one (secret shown once), remove <id> removes one
-    toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
+    webhooks events                    the six events, with an example of each
+    webhooks trigger <event>           an example delivery to your endpoints; --to <url> sends it to a local server instead
+    webhooks endpoints                 your endpoints; add <url> registers one (secret shown once), remove <id> removes one
+    login · whoami · logout            the session, per side; a command that needs one signs you in itself
 
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
     sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
 
-    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
-    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
+    In a repository you did not write, install it (npm i -g toolaby) and type toolaby-cli: npx can run a toolaby
+    the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "toolaby",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {
-    "toolaby-cli": "bin.mjs",
-    "toolaby": "bin.mjs"
+    "toolaby-cli": "bin.mjs"
   },
   "files": [
     "bin.mjs",