toolaby 1.8.1 → 1.8.2

package/bin.mjs

@@ -44,7 +44,7 @@ import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.8.1';
+const VERSION = '1.8.2';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.

package/lib/manifest.js

@@ -1,4 +1,5 @@
 // Generated from wall/src/packages/wiring/manifest.ts by wall/scripts/pack-create.mjs — edit there.
+import { isTestAddress } from './test-address.js';
 /**
  * What wiring an extension does to its manifest — the same in the browser
  * (Wire my extension, from the tool's page) and in the terminal
@@ -70,9 +71,9 @@ export const loadableName = (file) => {
 /** The background the manifest names, as the folder spells it: "./background.js" is background.js. */
 export const namedWorker = (manifest) => typeof manifest?.background?.service_worker === 'string' ? manifest.background.service_worker.trim().replace(/^(\.\/)+/, '') || null : null;
 /**
- * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it. Test shares
- * Live's hosts under /test (`https://northwind.toolaby.app/test`), so one pattern — `https://northwind.toolaby.app/*` —
- * lets the same build reach either side, and a Live wiring's manifest is the one it always was.
+ * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it —
+ * `https://northwind.toolaby.app/*` on Live; on Test, the address the Wall made for the workspace
+ * (`https://quiet-otter-4172.toolaby.app/*`, ./test-address). A wiring to one side takes the other's Test address out.
  */
 export function sitePattern(site) {
     try {
@@ -124,6 +125,23 @@ export function wireManifest(input, o) {
         added.push('storage');
     }
     const pattern = sitePattern(o.site);
+    // A Test address of the Wall's that is not this key's (./test-address): left by an earlier wiring to the other side.
+    // Test's workspaces have hosts of their own, and a build wired for Test and then for Live went on asking its buyers,
+    // at install, for access to Test's host too (29 Sep 2026).
+    const stale = (p) => typeof p === 'string' && p !== pattern && isTestAddress(/^https:\/\/([a-z0-9-]+)\.[^/]+\/\*$/.exec(p)?.[1]);
+    for (const field of ['host_permissions', 'externally_connectable']) {
+        const list = field === 'host_permissions' ? manifest.host_permissions : manifest.externally_connectable?.matches;
+        const gone = Array.isArray(list) ? list.filter(stale) : [];
+        if (!gone.length)
+            continue;
+        const kept = list.filter((p) => !stale(p));
+        if (field === 'host_permissions')
+            manifest.host_permissions = kept;
+        else
+            manifest.externally_connectable = { ...manifest.externally_connectable, matches: kept };
+        for (const p of gone)
+            did.push(`${field === 'host_permissions' ? 'the host permission' : 'externally_connectable'} for ${p.slice('https://'.length, -2)} taken out: a Test address that is not this key's`);
+    }
     if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(pattern))) {
         manifest.host_permissions = add(manifest.host_permissions, pattern);
         did.push(`a host permission for ${host}`);

package/lib/test-address.js

@@ -0,0 +1,43 @@
+// Generated from wall/src/packages/wiring/test-address.ts by wall/scripts/pack-create.mjs — edit there.
+/**
+ * A Test workspace's address, as Clerk gives a development instance one (`<slug>.clerk.accounts.dev`): made by the Wall,
+ * never chosen, never changed — `quiet-otter-4172.toolaby.app/test`. Test and Live share the Wall's addresses, and a
+ * name is Live's: a Test workspace served under its chosen name sat at the address that name has on Live, which
+ * someone else could hold (29 Sep 2026). A Test address is of a shape no workspace may take as its name, on either side
+ * (isReservedSlug), so no Live workspace ever answers at one.
+ *
+ * The database computes it, from the workspace's id, which never changes (the column `test_address`, generated; its
+ * migration writes testAddressSql() out as it stands here). So neither list may ever change: every Test workspace's
+ * address, and every Test key that names one, would move.
+ */
+export const TEST_ADDRESS_ADJECTIVES = [
+    'amber', 'bold', 'brave', 'bright', 'brisk', 'calm', 'clever', 'cosmic', 'crisp', 'curious', 'daring', 'eager', 'early', 'fancy', 'fluffy', 'gentle',
+    'glad', 'golden', 'happy', 'hardy', 'honest', 'humble', 'jolly', 'keen', 'kind', 'lively', 'lucky', 'lunar', 'mellow', 'merry', 'mighty', 'misty',
+    'modest', 'nimble', 'noble', 'patient', 'plucky', 'polite', 'proud', 'quick', 'quiet', 'rapid', 'ready', 'rosy', 'rustic', 'shiny', 'silent', 'silver',
+    'smooth', 'snowy', 'solar', 'spry', 'steady', 'sturdy', 'sunny', 'swift', 'tidy', 'tranquil', 'trusty', 'vivid', 'warm', 'wise', 'witty', 'zesty',
+];
+export const TEST_ADDRESS_ANIMALS = [
+    'badger', 'beaver', 'bison', 'bobcat', 'camel', 'cheetah', 'crane', 'dingo', 'dolphin', 'eagle', 'falcon', 'ferret', 'finch', 'fox', 'gazelle', 'gecko',
+    'heron', 'hippo', 'ibis', 'jaguar', 'koala', 'lemur', 'leopard', 'llama', 'lynx', 'magpie', 'marmot', 'marten', 'meerkat', 'mink', 'moose', 'narwhal',
+    'newt', 'ocelot', 'orca', 'osprey', 'otter', 'owl', 'panda', 'panther', 'parrot', 'pelican', 'penguin', 'puffin', 'quail', 'rabbit', 'raven', 'robin',
+    'salmon', 'seal', 'sparrow', 'stork', 'swan', 'tapir', 'tiger', 'toucan', 'turtle', 'walrus', 'weasel', 'whale', 'wombat', 'wren', 'yak', 'zebra',
+];
+const ADJECTIVES = new Set(TEST_ADDRESS_ADJECTIVES);
+const ANIMALS = new Set(TEST_ADDRESS_ANIMALS);
+const SHAPE = /^([a-z]+)-([a-z]+)-([1-9]\d{3})$/;
+/** Whether a name is of a Test address's shape: one of the adjectives, one of the animals, a number of four digits. */
+export function isTestAddress(s) {
+    if (typeof s !== 'string')
+        return false;
+    const m = SHAPE.exec(s);
+    return !!m && ADJECTIVES.has(m[1]) && ANIMALS.has(m[2]);
+}
+/**
+ * The address from the four first bytes of md5 of the id: an adjective, an animal, 1000 + a number below 9000. As SQL,
+ * for the column the database generates; a test holds the migration to it, and computes the same in Node.
+ */
+export function testAddressSql(id = 'id') {
+    const h = `decode(md5(${id}), 'hex')`;
+    const list = (words) => `(array[${words.map((w) => `'${w}'`).join(', ')}]::text[])`;
+    return `${list(TEST_ADDRESS_ADJECTIVES)}[1 + get_byte(${h}, 0) % ${TEST_ADDRESS_ADJECTIVES.length}] || '-' || ${list(TEST_ADDRESS_ANIMALS)}[1 + get_byte(${h}, 1) % ${TEST_ADDRESS_ANIMALS.length}] || '-' || (1000 + (get_byte(${h}, 2) * 256 + get_byte(${h}, 3)) % 9000)::text`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {