toolaby 1.8.1 → 1.8.3

package/bin.mjs

@@ -44,7 +44,7 @@ import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.8.1';
+const VERSION = '1.8.3';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -312,7 +312,7 @@ async function wire() {
   // The background the manifest names, read from inside the folder only: whether it starts the Wall, or is the Wall's.
   const namedWorker = workerIn(manifest) ?? '';
   const workerSource = namedWorker && has(namedWorker) && !inside(dir, namedWorker).why ? readOr(join(dir, namedWorker), '') : null;
-  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource }) : null;
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, apex: new URL(wall).host, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource }) : null;
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
   const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
@@ -743,6 +743,15 @@ function pack() {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
     if (!hosts.includes(sitePattern(site)) || !ec.includes(sitePattern(site))) problems.push(`The manifest does not name ${oneLine(sitePattern(site))} in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
+  // A host under the Wall's address that no key in the build names: another workspace's, or the other side's Test
+  // address, left by an earlier wiring or pasted by hand. The store build asks its buyers for it at install, and gains
+  // nothing: the extension talks to its own key's host alone (30 Sep 2026).
+  const walls = [...new Set(['toolaby.app', new URL(wall).hostname])];
+  const hostOf = (m) => /^(?:\*|https?|wss?):\/\/([^/]+)\//.exec(m)?.[1]?.replace(/^\*\./, '').toLowerCase() ?? null;
+  const keys = new Set([...sites].map(sitePattern));
+  const strangers = [...new Set([...(manifest.host_permissions ?? []), ...(manifest.externally_connectable?.matches ?? [])])]
+    .filter((m) => typeof m === 'string' && !keys.has(m) && walls.some((w) => { const h = hostOf(m); return !!h && (h === w || h.endsWith(`.${w}`)); }));
+  if (strangers.length && !flag('--allow-wall-hosts')) problems.push(`The manifest names ${strangers.map(oneLine).join(', ')}: the Wall's, and no key's in this build — another workspace, or the other side's Test address. A store build asks its buyers for ${strangers.length > 1 ? 'these' : 'it'} at install for nothing: take ${strangers.length > 1 ? 'them' : 'it'} out of host_permissions and externally_connectable. (--allow-wall-hosts packs it anyway.)`);
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
   const hadKey = typeof manifest.key === 'string';
@@ -785,7 +794,7 @@ function mcp() {
 }
 
 async function check() {
-  const passed = await runCheck({ mark: (tone, text) => say(`  ${tone === 'ok' ? green('✓') : tone === 'warn' ? yellow('!') : red('✗')} ${plain(text)}`), dir: opt('--into') ?? positional[0] ?? '.', out, api: (path, o = {}) => api(path, o), token: storedToken, detectProject, wireManifest, listTree, readJson, browser: flag('--browser') });
+  const passed = await runCheck({ mark: (tone, text) => say(`  ${tone === 'ok' ? green('✓') : tone === 'warn' ? yellow('!') : red('✗')} ${plain(text)}`), dir: opt('--into') ?? positional[0] ?? '.', out, api: (path, o = {}) => api(path, o), token: storedToken, detectProject, wireManifest: (m, o) => wireManifest(m, { apex: new URL(wall).host, ...o }), listTree, readJson, browser: flag('--browser') });
   if (!passed) process.exit(1);
 }
 
@@ -804,7 +813,8 @@ function help() {
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
     tools                              your tools, with their ids
     pack [folder]                      the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
-                                       refuses a Test key or localhost inside   --out <file.zip>
+                                       refuses a Test key, localhost, or another of the Wall's hosts inside
+                                       --out <file.zip>
                                        leaves out keys, certificates, .env and credential files, source maps, secrets,
                                        git's files, a build's copy of a private file (compressed, UTF-16 or base64),
                                        an image that is none; refuses a build if one is a file the manifest names

package/lib/manifest.js

@@ -1,4 +1,5 @@
 // Generated from wall/src/packages/wiring/manifest.ts by wall/scripts/pack-create.mjs — edit there.
+import { isTestAddress } from './test-address.js';
 /**
  * What wiring an extension does to its manifest — the same in the browser
  * (Wire my extension, from the tool's page) and in the terminal
@@ -70,9 +71,9 @@ export const loadableName = (file) => {
 /** The background the manifest names, as the folder spells it: "./background.js" is background.js. */
 export const namedWorker = (manifest) => typeof manifest?.background?.service_worker === 'string' ? manifest.background.service_worker.trim().replace(/^(\.\/)+/, '') || null : null;
 /**
- * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it. Test shares
- * Live's hosts under /test (`https://northwind.toolaby.app/test`), so one pattern — `https://northwind.toolaby.app/*` —
- * lets the same build reach either side, and a Live wiring's manifest is the one it always was.
+ * The match pattern a manifest names the Wall by: the origin of the key's site, whatever path follows it —
+ * `https://northwind.toolaby.app/*` on Live; on Test, the address the Wall made for the workspace
+ * (`https://quiet-otter-4172.toolaby.app/*`, ./test-address). A wiring to one side takes the other's Test address out.
  */
 export function sitePattern(site) {
     try {
@@ -124,6 +125,26 @@ export function wireManifest(input, o) {
         added.push('storage');
     }
     const pattern = sitePattern(o.site);
+    // A Test address of the Wall's that is not this key's (./test-address): left by an earlier wiring to the other side.
+    // Test's workspaces have hosts of their own, and a build wired for Test and then for Live went on asking its buyers,
+    // at install, for access to Test's host too (29 Sep 2026). Only under the Wall's own address: a host of the
+    // developer's that reads like one, on a domain of theirs, was taken out of their build too (30 Sep 2026).
+    const apex = (o.apex ?? host.split('.').slice(1).join('.')).toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const underWall = new RegExp(`^https://([a-z0-9-]+)\\.${apex}/\\*$`);
+    const stale = (p) => typeof p === 'string' && p !== pattern && isTestAddress(underWall.exec(p)?.[1]);
+    for (const field of ['host_permissions', 'externally_connectable']) {
+        const list = field === 'host_permissions' ? manifest.host_permissions : manifest.externally_connectable?.matches;
+        const gone = Array.isArray(list) ? list.filter(stale) : [];
+        if (!gone.length)
+            continue;
+        const kept = list.filter((p) => !stale(p));
+        if (field === 'host_permissions')
+            manifest.host_permissions = kept;
+        else
+            manifest.externally_connectable = { ...manifest.externally_connectable, matches: kept };
+        for (const p of gone)
+            did.push(`${field === 'host_permissions' ? 'the host permission' : 'externally_connectable'} for ${p.slice('https://'.length, -2)} taken out: a Test address that is not this key's`);
+    }
     if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(pattern))) {
         manifest.host_permissions = add(manifest.host_permissions, pattern);
         did.push(`a host permission for ${host}`);

package/lib/test-address.js

@@ -0,0 +1,43 @@
+// Generated from wall/src/packages/wiring/test-address.ts by wall/scripts/pack-create.mjs — edit there.
+/**
+ * A Test workspace's address, as Clerk gives a development instance one (`<slug>.clerk.accounts.dev`): made by the Wall,
+ * never chosen, never changed — `quiet-otter-4172.toolaby.app/test`. Test and Live share the Wall's addresses, and a
+ * name is Live's: a Test workspace served under its chosen name sat at the address that name has on Live, which
+ * someone else could hold (29 Sep 2026). A Test address is of a shape no workspace may take as its name, on either side
+ * (isReservedSlug), so no Live workspace ever answers at one.
+ *
+ * The database computes it, from the workspace's id, which never changes (the column `test_address`, generated; its
+ * migration writes testAddressSql() out as it stands here). So neither list may ever change: every Test workspace's
+ * address, and every Test key that names one, would move.
+ */
+export const TEST_ADDRESS_ADJECTIVES = [
+    'amber', 'bold', 'brave', 'bright', 'brisk', 'calm', 'clever', 'cosmic', 'crisp', 'curious', 'daring', 'eager', 'early', 'fancy', 'fluffy', 'gentle',
+    'glad', 'golden', 'happy', 'hardy', 'honest', 'humble', 'jolly', 'keen', 'kind', 'lively', 'lucky', 'lunar', 'mellow', 'merry', 'mighty', 'misty',
+    'modest', 'nimble', 'noble', 'patient', 'plucky', 'polite', 'proud', 'quick', 'quiet', 'rapid', 'ready', 'rosy', 'rustic', 'shiny', 'silent', 'silver',
+    'smooth', 'snowy', 'solar', 'spry', 'steady', 'sturdy', 'sunny', 'swift', 'tidy', 'tranquil', 'trusty', 'vivid', 'warm', 'wise', 'witty', 'zesty',
+];
+export const TEST_ADDRESS_ANIMALS = [
+    'badger', 'beaver', 'bison', 'bobcat', 'camel', 'cheetah', 'crane', 'dingo', 'dolphin', 'eagle', 'falcon', 'ferret', 'finch', 'fox', 'gazelle', 'gecko',
+    'heron', 'hippo', 'ibis', 'jaguar', 'koala', 'lemur', 'leopard', 'llama', 'lynx', 'magpie', 'marmot', 'marten', 'meerkat', 'mink', 'moose', 'narwhal',
+    'newt', 'ocelot', 'orca', 'osprey', 'otter', 'owl', 'panda', 'panther', 'parrot', 'pelican', 'penguin', 'puffin', 'quail', 'rabbit', 'raven', 'robin',
+    'salmon', 'seal', 'sparrow', 'stork', 'swan', 'tapir', 'tiger', 'toucan', 'turtle', 'walrus', 'weasel', 'whale', 'wombat', 'wren', 'yak', 'zebra',
+];
+const ADJECTIVES = new Set(TEST_ADDRESS_ADJECTIVES);
+const ANIMALS = new Set(TEST_ADDRESS_ANIMALS);
+const SHAPE = /^([a-z]+)-([a-z]+)-([1-9]\d{3})$/;
+/** Whether a name is of a Test address's shape: one of the adjectives, one of the animals, a number of four digits. */
+export function isTestAddress(s) {
+    if (typeof s !== 'string')
+        return false;
+    const m = SHAPE.exec(s);
+    return !!m && ADJECTIVES.has(m[1]) && ANIMALS.has(m[2]);
+}
+/**
+ * The address from the four first bytes of md5 of the id: an adjective, an animal, 1000 + a number below 9000. As SQL,
+ * for the column the database generates; a test holds the migration to it, and computes the same in Node.
+ */
+export function testAddressSql(id = 'id') {
+    const h = `decode(md5(${id}), 'hex')`;
+    const list = (words) => `(array[${words.map((w) => `'${w}'`).join(', ')}]::text[])`;
+    return `${list(TEST_ADDRESS_ADJECTIVES)}[1 + get_byte(${h}, 0) % ${TEST_ADDRESS_ADJECTIVES.length}] || '-' || ${list(TEST_ADDRESS_ANIMALS)}[1 + get_byte(${h}, 1) % ${TEST_ADDRESS_ANIMALS.length}] || '-' || (1000 + (get_byte(${h}, 2) * 256 + get_byte(${h}, 3)) % 9000)::text`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.8.1",
+  "version": "1.8.3",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {