toolaby 1.7.2 → 1.8.0

package/README.md

@@ -12,7 +12,7 @@ The command is `toolaby-cli`: on Windows, the Command Prompt runs a `toolaby.js`
 
 In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
 
-Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
+Every command acts on the test Wall (`toolaby.app/test`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
 
 ## What it does
 

package/bin.mjs

@@ -17,7 +17,7 @@
 //   toolaby whoami · logout · help
 //
 // Test and live, as Stripe's command line has them: every command acts on
-// the TEST Wall (test.toolaby.app) unless told `--live`, so the everyday
+// the TEST Wall (toolaby.app/test) unless told `--live`, so the everyday
 // command is the safe one and going live is a word you type on purpose.
 // Signed in, the command acts as you and only on your tools, as Clerk's and
 // Stripe's do: nothing is fetched for a tool your workspaces do not own. The
@@ -37,14 +37,14 @@ import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
 import { createHmac, randomBytes } from 'node:crypto';
-import { wireManifest, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
+import { wireManifest, sitePattern, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
 import { wiringSummary, popupSwapIn, gatesIn, ownCode } from './lib/summary.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.7.2';
+const VERSION = '1.8.0';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -54,7 +54,8 @@ const positional = rest.filter((a) => !a.startsWith('--'));
 const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[i + 1] && !rest[i + 1].startsWith('--') ? rest[i + 1] : d; };
 // `upgrade` is `wire --force`: the platform's files replaced with the current ones, the extension's own untouched.
 const flag = (k) => rest.includes(k) || (k === '--force' && command === 'upgrade');
-const WALLS = { test: 'https://test.toolaby.app', live: 'https://toolaby.app' };
+// Test shares Live's addresses under /test, as Stripe keeps both modes on its own hosts.
+const WALLS = { test: 'https://toolaby.app/test', live: 'https://toolaby.app' };
 const live = flag('--live');
 // An address as fetch() reads it: a URL loses its tabs and line breaks when it is parsed, and kept in the name every
 // message prints, a --wall or a TOOLABY_WALL with one in it drew lines of its own (25 Sep 2026).
@@ -732,7 +733,7 @@ function pack() {
   // The Wall the key names must be reachable from the extension, or sign-in and the purchase handoff fail.
   for (const site of sites) {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
-    if (!hosts.includes(`${site}/*`) || !ec.includes(`${site}/*`)) problems.push(`The manifest does not name ${oneLine(site)}/* in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
+    if (!hosts.includes(sitePattern(site)) || !ec.includes(sitePattern(site))) problems.push(`The manifest does not name ${oneLine(sitePattern(site))} in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
@@ -809,9 +810,9 @@ function help() {
     webhooks endpoints                 your endpoints; add <url> registers one (secret shown once), remove <id> removes one
     login · whoami · logout            the session, per side; a command that needs one signs you in itself
 
-    Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
+    Every command acts on Test (toolaby.app/test) unless told --live (toolaby.app).
     --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI —
-    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://test.toolaby.app for Test).
+    sent to Live alone, or to the one Wall TOOLABY_TOKEN_WALL names (https://toolaby.app/test for Test).
 
     In a repository you did not write, install it (npm i -g toolaby) and type toolaby-cli: npx can run a toolaby
     the project carries, or fetch one from a registry its .npmrc names.

package/lib/check.js

@@ -8,7 +8,7 @@ import { join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { oneLine, keySite, fetchBounded, readText } from './safe.js';
-import { wrappedBy, namedWorker, startsPlatform as startsWall } from './manifest.js';
+import { wrappedBy, namedWorker, startsPlatform as startsWall, sitePattern } from './manifest.js';
 import { popupSwapIn, ownCode } from './summary.js';
 
 const KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/;
@@ -118,7 +118,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     else ok('The manifest has the permissions and host permissions the Wall needs.');
     // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
     if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
-  } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${key.site}/* in host_permissions and externally_connectable.`);
+  } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${sitePattern(key.site)} in host_permissions and externally_connectable.`);
 
   // 4b. The background starts the Wall: the popup and every page ask it everything, so without it nothing answers.
   const upgrade = `\`npx -y toolaby@latest upgrade ${key.slug}\``;

package/lib/manifest.js

@@ -69,6 +69,19 @@ export const loadableName = (file) => {
 };
 /** The background the manifest names, as the folder spells it: "./background.js" is background.js. */
 export const namedWorker = (manifest) => typeof manifest?.background?.service_worker === 'string' ? manifest.background.service_worker.trim().replace(/^(\.\/)+/, '') || null : null;
+/**
+ * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it. Test shares
+ * Live's hosts under /test (`https://northwind.toolaby.app/test`), so one pattern — `https://northwind.toolaby.app/*` —
+ * lets the same build reach either side, and a Live wiring's manifest is the one it always was.
+ */
+export function sitePattern(site) {
+    try {
+        return `${new URL(site).origin}/*`;
+    }
+    catch {
+        return `${site.replace(/\/+$/, '')}/*`;
+    }
+}
 /**
  * Whether an earlier wiring left the extension's own pages drawing the panel: a configuration that says '' for both
  * pages while the manifest names none of the Wall's. That is what `create` makes, and the "your popup first" shape
@@ -110,16 +123,17 @@ export function wireManifest(input, o) {
         did.push('the "storage" permission');
         added.push('storage');
     }
-    if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(`${o.site}/*`))) {
-        manifest.host_permissions = add(manifest.host_permissions, `${o.site}/*`);
-        did.push(`a host permission for ${o.site}`);
+    const pattern = sitePattern(o.site);
+    if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(pattern))) {
+        manifest.host_permissions = add(manifest.host_permissions, pattern);
+        did.push(`a host permission for ${host}`);
         if (!added.includes(host))
             added.push(host);
     }
     const ec = manifest.externally_connectable ?? {};
-    if (!(Array.isArray(ec.matches) && ec.matches.includes(`${o.site}/*`))) {
-        manifest.externally_connectable = { ...ec, matches: add(ec.matches, `${o.site}/*`) };
-        did.push(`externally_connectable for ${o.site}`);
+    if (!(Array.isArray(ec.matches) && ec.matches.includes(pattern))) {
+        manifest.externally_connectable = { ...ec, matches: add(ec.matches, pattern) };
+        did.push(`externally_connectable for ${host}`);
         if (!added.includes(host))
             added.push(host);
     }

package/lib/project.js

@@ -1,4 +1,21 @@
 // Generated from wall/src/packages/wiring/project.ts by wall/scripts/pack-create.mjs — edit there.
+/**
+ * What kind of extension project a folder is, and where the platform's
+ * files go in it — the same files for every kind. A plain extension has
+ * its manifest.json at the root and everything beside it. A framework
+ * (WXT, Plasmo, CRXJS) generates the manifest at build time, bundles the
+ * background, and copies a folder of files as they are: the client goes
+ * where the build can import it, the Wall's popup — and its side panel,
+ * where the extension has one — where the build copies verbatim. What the manifest and the background need is the framework's
+ * own extension point where it has one — WXT loads a module from modules/
+ * by itself, so the wiring writes one and nothing is pasted — and, where it
+ * has none (Plasmo, CRXJS), a snippet for its config: shown, never written
+ * into someone's TypeScript. Pure:
+ * given what is in the folder, it says what to write and what to say.
+ * Shared by the browser (rb/WireExtension) and the terminal
+ * (`toolaby wire`, which carries a transpiled copy).
+ */
+import { sitePattern } from './manifest.js';
 /** What to tell a developer whose build ships the extension — the Wire button, the command and the Set up page all say it in these words. */
 export const BUILD_COPY_NOTE = 'A build ships this extension: make sure it copies every toolaby* file to its output — toolaby.js, toolaby.config.js, toolaby-popup.html and the rest — the way it copies your popup.html.';
 /** Always written, where the build imports from: the platform as one file (the client and the popup UI), its config, its types. */
@@ -109,7 +126,7 @@ export function detectProject(o) {
         const worker = first(has, [`${src}background.ts`, `${src}background.js`, `${src}background/index.ts`, `${src}background/index.js`]);
         const workerFile = worker ?? `${src}background.ts`;
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
-        const code = JSON.stringify({ manifest: { ...(o.manifestKey ? { key: o.manifestKey } : {}), permissions: ['storage'], host_permissions: [`${site}/*`], externally_connectable: { matches: [`${site}/*`] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
+        const code = JSON.stringify({ manifest: { ...(o.manifestKey ? { key: o.manifestKey } : {}), permissions: ['storage'], host_permissions: [sitePattern(site)], externally_connectable: { matches: [sitePattern(site)] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
         return {
             kind: 'plasmo', label: 'Plasmo', codeDir: '', popupDir: '', manifestFile: null, wrapper: false, appPopup: null, appSidePanel: null, worker, built: false, foundManifest: null,
             createWorker: worker ? null : { file: workerFile, content: workerLines },

package/lib/safe.js

@@ -60,15 +60,17 @@ export const oneLine = (value) => String(value).replace(/\s+/g, ' ').slice(0, 50
 const wallScheme = (url) => url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK.test(url.hostname));
 
 /**
- * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, and nothing else —
- * no path, no credentials, no other scheme — or null. The key is read from the project's own toolaby.config.js, and a
+ * The Wall a tool key names, when `check` may ask it anything: an origin, https or on this machine, with nothing after
+ * it but Test's `/test`, where Test shares Live's hosts — no other path, no query, no credentials, no other scheme.
+ * Null otherwise. The key is read from the project's own toolaby.config.js, and a
  * cloned project's key sent `check`'s requests wherever it named: a server inside the developer's network, any path on
  * any host (25 Sep 2026).
  */
 export function keySite(site) {
   let url;
   try { url = new URL(site); } catch { return null; }
-  return url.origin === site && wallScheme(url) ? site : null;
+  const path = url.pathname === '/' ? '' : url.pathname;
+  return (path === '' || path === '/test') && `${url.origin}${path}` === site && wallScheme(url) ? site : null;
 }
 
 /**
@@ -673,13 +675,17 @@ function publicLinkEntries(root, packed = null) {
 /**
  * The page `login` opens: the one the Wall gave, when it is the Wall's own over https — or, for a Wall on this
  * machine, a page on this machine. Anything else is null, and is not opened: an address elsewhere, a downgrade to
- * http, or a scheme such as file: that opens whatever it names.
+ * http, or a scheme such as file: that opens whatever it names. A Wall under a path gives a page under it: Test at
+ * toolaby.app/test approves its codes at toolaby.app/test/…, and Live's page of the same name knows none of them (a
+ * root path resolved against Test's own base loses /test: 29 Sep 2026).
  */
 export function signInPage(link, wall) {
   if (typeof link !== 'string') return null;
   let home; let page;
   try { home = new URL(wall); page = new URL(link, home); } catch { return null; }
   if (page.username || page.password) return null;
+  const base = home.pathname.replace(/\/+$/, '');
+  if (base && page.pathname !== base && !page.pathname.startsWith(`${base}/`)) return null;
   if (page.protocol === 'https:' && page.origin === home.origin) return page.href;
   const web = page.protocol === 'http:' || page.protocol === 'https:';
   return web && LOOPBACK.test(home.hostname) && LOOPBACK.test(page.hostname) ? page.href : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {