toolaby 1.7.1 → 1.8.0

package/README.md

@@ -3,14 +3,16 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`); on Windows, type toolaby-cli
-toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
-toolaby wire <tool-id> --live # the same, on Live: the store build
+npm i -g toolaby                  # once; or run every command through `npx -y toolaby@latest …`
+toolaby-cli wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
+toolaby-cli wire <tool-id> --live # the same, on Live: the store build
 ```
 
+The command is `toolaby-cli`: on Windows, the Command Prompt runs a `toolaby.js` in the current folder before a command named `toolaby`, and every wired folder has one. Below, `toolaby <command>` names each command.
+
 In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
 
-Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
+Every command acts on the test Wall (`toolaby.app/test`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
 
 ## What it does
 

package/bin.mjs

@@ -17,7 +17,7 @@
 //   toolaby whoami · logout · help
 //
 // Test and live, as Stripe's command line has them: every command acts on
-// the TEST Wall (test.toolaby.app) unless told `--live`, so the everyday
+// the TEST Wall (toolaby.app/test) unless told `--live`, so the everyday
 // command is the safe one and going live is a word you type on purpose.
 // Signed in, the command acts as you and only on your tools, as Clerk's and
 // Stripe's do: nothing is fetched for a tool your workspaces do not own. The
@@ -37,14 +37,14 @@ import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
 import { createHmac, randomBytes } from 'node:crypto';
-import { wireManifest, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
+import { wireManifest, sitePattern, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
 import { wiringSummary, popupSwapIn, gatesIn, ownCode } from './lib/summary.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.7.1';
+const VERSION = '1.8.0';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -54,7 +54,8 @@ const positional = rest.filter((a) => !a.startsWith('--'));
 const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[i + 1] && !rest[i + 1].startsWith('--') ? rest[i + 1] : d; };
 // `upgrade` is `wire --force`: the platform's files replaced with the current ones, the extension's own untouched.
 const flag = (k) => rest.includes(k) || (k === '--force' && command === 'upgrade');
-const WALLS = { test: 'https://test.toolaby.app', live: 'https://toolaby.app' };
+// Test shares Live's addresses under /test, as Stripe keeps both modes on its own hosts.
+const WALLS = { test: 'https://toolaby.app/test', live: 'https://toolaby.app' };
 const live = flag('--live');
 // An address as fetch() reads it: a URL loses its tabs and line breaks when it is parsed, and kept in the name every
 // message prints, a --wall or a TOOLABY_WALL with one in it drew lines of its own (25 Sep 2026).
@@ -167,11 +168,11 @@ async function login() {
     }
     const why = poll.json.error;
     if (why === 'slow_down') every += 5000;
-    else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
+    else if (why === 'expired_token') fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
     else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
     else if (why && why !== 'authorization_pending') fail(`The Wall answered "${oneLine(why)}"${poll.json.error_description ? `: ${oneLine(poll.json.error_description)}` : ''}.`);
   }
-  fail('The code expired before it was approved. Run `toolaby login` again.');
+  fail('The code expired before it was approved. Run `npx -y toolaby@latest login` again.');
 }
 
 /** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
@@ -183,9 +184,9 @@ async function tokenOrLogin() {
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.${envElsewhere()}`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.${envElsewhere()}`);
   const me = await api('/api/cli/me', { token });
-  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`npx -y toolaby@latest login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
   out(`\n  ${oneLine(me.json.email)}  ·  ${side}  ·  ${wall}\n`);
   for (const w of me.json.workspaces) out(`    ${oneLine(w.name)}  (${oneLine(w.slug)}, ${oneLine(w.role)})  ${oneLine(w.site)}`);
@@ -207,7 +208,7 @@ async function logout() {
 async function tools() {
   const token = await tokenOrLogin();
   const res = await api('/api/cli/tools', { token });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
@@ -276,7 +277,7 @@ async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
 
 async function wire() {
   const slug = positional[0];
-  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: toolaby upgrade <tool-id> [--into <folder>]   — `toolaby tools` lists your ids' : 'usage: toolaby wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail(command === 'upgrade' ? 'usage: npx -y toolaby@latest upgrade <tool-id> [--into <folder>]   — `npx -y toolaby@latest tools` lists your ids' : 'usage: npx -y toolaby@latest wire <tool-id> [--into <folder>] [--force] [--adopt-key]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--into') ?? '.');
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
@@ -371,7 +372,7 @@ async function wire() {
 
 async function create() {
   const slug = positional[0];
-  if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
+  if (!isId(slug)) fail('usage: npx -y toolaby@latest create <tool-id> [--dir <folder>]   — `npx -y toolaby@latest tools` lists your ids');
   const dir = resolve(opt('--dir') ?? slug);
   if (there(dir)) fail(`${dir} already exists`);
   // Which surfaces this extension is made with, asked first: the files for coding agents name only what is written.
@@ -442,7 +443,7 @@ function devSecret() {
 }
 async function catalogue() {
   const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
-  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
   return res.json.events;
 }
@@ -462,7 +463,7 @@ async function webhooks() {
   }
   if (sub === 'trigger') {
     const type = positional[1];
-    if (!type) fail('usage: toolaby webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `toolaby webhooks events` lists them');
+    if (!type) fail('usage: npx -y toolaby@latest webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `npx -y toolaby@latest webhooks events` lists them');
     const to = opt('--to');
     if (!to) {
       const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
@@ -472,7 +473,7 @@ async function webhooks() {
     }
     const events = await catalogue();
     const event = events.find((e) => e.type === type);
-    if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
+    if (!event) fail(`No event "${type}". \`npx -y toolaby@latest webhooks events\` lists them.`);
     const secret = opt('--secret') ?? devSecret();
     if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
     const id = `msg_${randomBytes(12).toString('base64url')}`;
@@ -494,14 +495,14 @@ async function webhooks() {
     const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  ${oneLine(res.json.workspace)} · ${side}\n`);
-    if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
+    if (res.json.endpoints.length === 0) out('    None yet. `npx -y toolaby@latest webhooks add <url>` registers one.');
     for (const e of res.json.endpoints) out(`    ${oneLine(e.id)}  ${e.disabled ? 'paused ' : 'on     '} ${oneLine(e.url)}${e.description ? `  — ${oneLine(e.description)}` : ''}${e.events.length ? `  (${oneLine(e.events.join(', '))})` : ''}`);
     out();
     return;
   }
   if (sub === 'add') {
     const url = positional[1];
-    if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
+    if (!url) fail('usage: npx -y toolaby@latest webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
     const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
     const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
@@ -510,13 +511,13 @@ async function webhooks() {
   }
   if (sub === 'remove') {
     const id = positional[1];
-    if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
+    if (!id) fail('usage: npx -y toolaby@latest webhooks remove <ep_…> [--workspace <slug>]   — `npx -y toolaby@latest webhooks endpoints` lists them');
     const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
     if (!res.ok) fail(oneLine(res.json.message ?? `The Wall answered HTTP ${res.status}.`));
     out(`\n  Removed ${oneLine(res.json.removed)} · ${oneLine(res.json.workspace)} · ${side}. Deliveries to it stop at once.\n`);
     return;
   }
-  fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
+  fail('usage: npx -y toolaby@latest webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
 }
 
 // ── pack: the zip the Chrome Web Store takes ──────────────────────────────────────────────────────────────────────────
@@ -732,7 +733,7 @@ function pack() {
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(sitePattern(site)) || !ec.includes(sitePattern(site))) problems.push(`The manifest does not name ${oneLine(sitePattern(site))} in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
@@ -784,35 +785,37 @@ function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
 
-    toolaby wire <tool-id>             wire the extension in this folder to your tool, on Test
-    toolaby wire <tool-id> --live      the same, on Live: the store build
+    npx -y toolaby@latest <command>, or installed (npm i -g toolaby): toolaby-cli <command>
+
+    wire <tool-id>                     wire the extension in this folder to your tool, on Test
+    wire <tool-id> --live              the same, on Live: the store build
                                        --into <folder>   another folder     --force   replace the platform's files
                                        --own-popup       keep your popup in front (the Wall's opens from toolaby.showPaywall())
-    toolaby upgrade <tool-id>          the platform's files replaced with the current ones — the popup, the client — yours untouched
-    toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
+    upgrade <tool-id>                  the platform's files replaced with the current ones — the popup, the client — yours untouched
+    create <tool-id>                   a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
-    toolaby tools                      your tools, with their ids
-    toolaby pack [folder]              the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
+    tools                              your tools, with their ids
+    pack [folder]                      the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
                                        refuses a Test key or localhost inside   --out <file.zip>
                                        leaves out keys, certificates, .env and credential files, source maps, secrets,
                                        git's files, a build's copy of a private file (compressed, UTF-16 or base64),
                                        an image that is none; refuses a build if one is a file the manifest names
                                        --allow-private packs them
-    toolaby check [folder]             whether the extension here is wired right: files, key, manifest, client, features;
+    check [folder]                     whether the extension here is wired right: files, key, manifest, client, features;
                                        --browser loads it in Chromium (needs Playwright in the project)
-    toolaby mcp                        the Wall for coding agents, an MCP server on stdio:
+    mcp                                the Wall for coding agents, an MCP server on stdio:
                                        claude mcp add toolaby -- npx -y toolaby@latest mcp
-    toolaby webhooks events            the six events, with an example of each
-    toolaby webhooks trigger <event>   an example delivery to your endpoints; --to <url> sends it to a local server instead
-    toolaby webhooks endpoints         your endpoints; add <url> registers one (secret shown once), remove <id> removes one
-    toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
+    webhooks events                    the six events, with an example of each
+    webhooks trigger <event>           an example delivery to your endpoints; --to <url> sends it to a local server instead
+    webhooks endpoints                 your endpoints; add <url> registers one (secret shown once), remove <id> removes one
+    login · whoami · logout            the session, per side; a command that needs one signs you in itself
 
-    Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
+    Every command acts on Test (toolaby.app/test) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
-    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
+    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://toolaby.app/test for Test).
 
-    Not installed: npx -y toolaby@latest <command>. In a repository you did not write, install it (npm i -g toolaby)
-    and type toolaby: npx can run a toolaby the project carries, or fetch one from a registry its .npmrc names.
+    In a repository you did not write, install it (npm i -g toolaby) and type toolaby-cli: npx can run a toolaby
+    the project carries, or fetch one from a registry its .npmrc names.
 `);
 }
 

package/lib/check.js

@@ -8,7 +8,7 @@ import { join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { oneLine, keySite, fetchBounded, readText } from './safe.js';
-import { wrappedBy, namedWorker, startsPlatform as startsWall } from './manifest.js';
+import { wrappedBy, namedWorker, startsPlatform as startsWall, sitePattern } from './manifest.js';
 import { popupSwapIn, ownCode } from './summary.js';
 
 const KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/;
@@ -118,7 +118,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     else ok('The manifest has the permissions and host permissions the Wall needs.');
     // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
     if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
-  } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
+  } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${sitePattern(key.site)} in host_permissions and externally_connectable.`);
 
   // 4b. The background starts the Wall: the popup and every page ask it everything, so without it nothing answers.
   const upgrade = `\`npx -y toolaby@latest upgrade ${key.slug}\``;

package/lib/manifest.js

@@ -69,6 +69,19 @@ export const loadableName = (file) => {
 };
 /** The background the manifest names, as the folder spells it: "./background.js" is background.js. */
 export const namedWorker = (manifest) => typeof manifest?.background?.service_worker === 'string' ? manifest.background.service_worker.trim().replace(/^(\.\/)+/, '') || null : null;
+/**
+ * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it. Test shares
+ * Live's hosts under /test (`https://northwind.toolaby.app/test`), so one pattern — `https://northwind.toolaby.app/*` —
+ * lets the same build reach either side, and a Live wiring's manifest is the one it always was.
+ */
+export function sitePattern(site) {
+    try {
+        return `${new URL(site).origin}/*`;
+    }
+    catch {
+        return `${site.replace(/\/+$/, '')}/*`;
+    }
+}
 /**
  * Whether an earlier wiring left the extension's own pages drawing the panel: a configuration that says '' for both
  * pages while the manifest names none of the Wall's. That is what `create` makes, and the "your popup first" shape
@@ -110,16 +123,17 @@ export function wireManifest(input, o) {
         did.push('the "storage" permission');
         added.push('storage');
     }
-    if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(`${o.site}/*`))) {
-        manifest.host_permissions = add(manifest.host_permissions, `${o.site}/*`);
-        did.push(`a host permission for ${o.site}`);
+    const pattern = sitePattern(o.site);
+    if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(pattern))) {
+        manifest.host_permissions = add(manifest.host_permissions, pattern);
+        did.push(`a host permission for ${host}`);
         if (!added.includes(host))
             added.push(host);
     }
     const ec = manifest.externally_connectable ?? {};
-    if (!(Array.isArray(ec.matches) && ec.matches.includes(`${o.site}/*`))) {
-        manifest.externally_connectable = { ...ec, matches: add(ec.matches, `${o.site}/*`) };
-        did.push(`externally_connectable for ${o.site}`);
+    if (!(Array.isArray(ec.matches) && ec.matches.includes(pattern))) {
+        manifest.externally_connectable = { ...ec, matches: add(ec.matches, pattern) };
+        did.push(`externally_connectable for ${host}`);
         if (!added.includes(host))
             added.push(host);
     }

package/lib/project.js

@@ -1,4 +1,21 @@
 // Generated from wall/src/packages/wiring/project.ts by wall/scripts/pack-create.mjs — edit there.
+/**
+ * What kind of extension project a folder is, and where the platform's
+ * files go in it — the same files for every kind. A plain extension has
+ * its manifest.json at the root and everything beside it. A framework
+ * (WXT, Plasmo, CRXJS) generates the manifest at build time, bundles the
+ * background, and copies a folder of files as they are: the client goes
+ * where the build can import it, the Wall's popup — and its side panel,
+ * where the extension has one — where the build copies verbatim. What the manifest and the background need is the framework's
+ * own extension point where it has one — WXT loads a module from modules/
+ * by itself, so the wiring writes one and nothing is pasted — and, where it
+ * has none (Plasmo, CRXJS), a snippet for its config: shown, never written
+ * into someone's TypeScript. Pure:
+ * given what is in the folder, it says what to write and what to say.
+ * Shared by the browser (rb/WireExtension) and the terminal
+ * (`toolaby wire`, which carries a transpiled copy).
+ */
+import { sitePattern } from './manifest.js';
 /** What to tell a developer whose build ships the extension — the Wire button, the command and the Set up page all say it in these words. */
 export const BUILD_COPY_NOTE = 'A build ships this extension: make sure it copies every toolaby* file to its output — toolaby.js, toolaby.config.js, toolaby-popup.html and the rest — the way it copies your popup.html.';
 /** Always written, where the build imports from: the platform as one file (the client and the popup UI), its config, its types. */
@@ -109,7 +126,7 @@ export function detectProject(o) {
         const worker = first(has, [`${src}background.ts`, `${src}background.js`, `${src}background/index.ts`, `${src}background/index.js`]);
         const workerFile = worker ?? `${src}background.ts`;
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
-        const code = JSON.stringify({ manifest: { ...(o.manifestKey ? { key: o.manifestKey } : {}), permissions: ['storage'], host_permissions: [`${site}/*`], externally_connectable: { matches: [`${site}/*`] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
+        const code = JSON.stringify({ manifest: { ...(o.manifestKey ? { key: o.manifestKey } : {}), permissions: ['storage'], host_permissions: [sitePattern(site)], externally_connectable: { matches: [sitePattern(site)] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
         return {
             kind: 'plasmo', label: 'Plasmo', codeDir: '', popupDir: '', manifestFile: null, wrapper: false, appPopup: null, appSidePanel: null, worker, built: false, foundManifest: null,
             createWorker: worker ? null : { file: workerFile, content: workerLines },

package/lib/safe.js

@@ -60,15 +60,17 @@ export const oneLine = (value) => String(value).replace(/\s+/g, ' ').slice(0, 50
 const wallScheme = (url) => url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.test(url.hostname));
 
 /**
- * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, and nothing else —
- * no path, no credentials, no other scheme — or null. The key is read from the project's own toolaby.config.js, and a
+ * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, with nothing after
+ * it but Test's `/test`, where Test shares Live's hosts — no other path, no query, no credentials, no other scheme.
+ * Null otherwise. The key is read from the project's own toolaby.config.js, and a
  * cloned project's key sent `check`'s requests wherever it named: a server inside the developer's network, any path on
  * any host (25 Sep 2026).
  */
 export function keySite(site) {
   let url;
   try { url = new URL(site); } catch { return null; }
-  return url.origin === site && wallScheme(url) ? site : null;
+  const path = url.pathname === '/' ? '' : url.pathname;
+  return (path === '' || path === '/test') && `${url.origin}${path}` === site && wallScheme(url) ? site : null;
 }
 
 /**
@@ -673,13 +675,17 @@ function publicLinkEntries(root, packed = null) {
 /**
  * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
  * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
- * http, or a scheme such as file: that opens whatever it names.
+ * http, or a scheme such as file: that opens whatever it names. A Wall under a path gives a page under it: Test at
+ * toolaby.app/test approves its codes at toolaby.app/test/…, and Live's page of the same name knows none of them (a
+ * root path resolved against Test's own base loses /test: 29 Sep 2026).
  */
 export function signInPage(link, wall) {
   if (typeof link !== 'string') return null;
   let home; let page;
   try { home = new URL(wall); page = new URL(link, home); } catch { return null; }
   if (page.username || page.password) return null;
+  const base = home.pathname.replace(/\/+$/, '');
+  if (base && page.pathname !== base && !page.pathname.startsWith(`${base}/`)) return null;
   if (page.protocol === 'https:' && page.origin === home.origin) return page.href;
   const web = page.protocol === 'http:' || page.protocol === 'https:';
   return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "toolaby",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {
-    "toolaby-cli": "bin.mjs",
-    "toolaby": "bin.mjs"
+    "toolaby-cli": "bin.mjs"
   },
   "files": [
     "bin.mjs",