toolaby 1.8.2 → 1.8.3

package/bin.mjs

@@ -44,7 +44,7 @@ import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.8.2';
+const VERSION = '1.8.3';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -312,7 +312,7 @@ async function wire() {
   // The background the manifest names, read from inside the folder only: whether it starts the Wall, or is the Wall's.
   const namedWorker = workerIn(manifest) ?? '';
   const workerSource = namedWorker && has(namedWorker) && !inside(dir, namedWorker).why ? readOr(join(dir, namedWorker), '') : null;
-  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource }) : null;
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, apex: new URL(wall).host, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource }) : null;
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
   const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
@@ -743,6 +743,15 @@ function pack() {
     const hosts = manifest.host_permissions ?? []; const ec = manifest.externally_connectable?.matches ?? [];
     if (!hosts.includes(sitePattern(site)) || !ec.includes(sitePattern(site))) problems.push(`The manifest does not name ${oneLine(sitePattern(site))} in both host_permissions and externally_connectable: sign-in and the purchase would not reach the extension. \`npx -y toolaby@latest wire <tool-id> --live --force\` adds them.`);
   }
+  // A host under the Wall's address that no key in the build names: another workspace's, or the other side's Test
+  // address, left by an earlier wiring or pasted by hand. The store build asks its buyers for it at install, and gains
+  // nothing: the extension talks to its own key's host alone (30 Sep 2026).
+  const walls = [...new Set(['toolaby.app', new URL(wall).hostname])];
+  const hostOf = (m) => /^(?:\*|https?|wss?):\/\/([^/]+)\//.exec(m)?.[1]?.replace(/^\*\./, '').toLowerCase() ?? null;
+  const keys = new Set([...sites].map(sitePattern));
+  const strangers = [...new Set([...(manifest.host_permissions ?? []), ...(manifest.externally_connectable?.matches ?? [])])]
+    .filter((m) => typeof m === 'string' && !keys.has(m) && walls.some((w) => { const h = hostOf(m); return !!h && (h === w || h.endsWith(`.${w}`)); }));
+  if (strangers.length && !flag('--allow-wall-hosts')) problems.push(`The manifest names ${strangers.map(oneLine).join(', ')}: the Wall's, and no key's in this build — another workspace, or the other side's Test address. A store build asks its buyers for ${strangers.length > 1 ? 'these' : 'it'} at install for nothing: take ${strangers.length > 1 ? 'them' : 'it'} out of host_permissions and externally_connectable. (--allow-wall-hosts packs it anyway.)`);
   if (problems.length) fail(`Not packed:\n\n${problems.map((p) => `  · ${p}`).join('\n\n')}`);
 
   const hadKey = typeof manifest.key === 'string';
@@ -785,7 +794,7 @@ function mcp() {
 }
 
 async function check() {
-  const passed = await runCheck({ mark: (tone, text) => say(`  ${tone === 'ok' ? green('✓') : tone === 'warn' ? yellow('!') : red('✗')} ${plain(text)}`), dir: opt('--into') ?? positional[0] ?? '.', out, api: (path, o = {}) => api(path, o), token: storedToken, detectProject, wireManifest, listTree, readJson, browser: flag('--browser') });
+  const passed = await runCheck({ mark: (tone, text) => say(`  ${tone === 'ok' ? green('✓') : tone === 'warn' ? yellow('!') : red('✗')} ${plain(text)}`), dir: opt('--into') ?? positional[0] ?? '.', out, api: (path, o = {}) => api(path, o), token: storedToken, detectProject, wireManifest: (m, o) => wireManifest(m, { apex: new URL(wall).host, ...o }), listTree, readJson, browser: flag('--browser') });
   if (!passed) process.exit(1);
 }
 
@@ -804,7 +813,8 @@ function help() {
                                        --surfaces both|popup|side-panel|none   what it opens (default: both)
     tools                              your tools, with their ids
     pack [folder]                      the zip for the Chrome Web Store: the built extension, its manifest's "key" left out;
-                                       refuses a Test key or localhost inside   --out <file.zip>
+                                       refuses a Test key, localhost, or another of the Wall's hosts inside
+                                       --out <file.zip>
                                        leaves out keys, certificates, .env and credential files, source maps, secrets,
                                        git's files, a build's copy of a private file (compressed, UTF-16 or base64),
                                        an image that is none; refuses a build if one is a file the manifest names

package/lib/manifest.js

@@ -127,8 +127,11 @@ export function wireManifest(input, o) {
     const pattern = sitePattern(o.site);
     // A Test address of the Wall's that is not this key's (./test-address): left by an earlier wiring to the other side.
     // Test's workspaces have hosts of their own, and a build wired for Test and then for Live went on asking its buyers,
-    // at install, for access to Test's host too (29 Sep 2026).
-    const stale = (p) => typeof p === 'string' && p !== pattern && isTestAddress(/^https:\/\/([a-z0-9-]+)\.[^/]+\/\*$/.exec(p)?.[1]);
+    // at install, for access to Test's host too (29 Sep 2026). Only under the Wall's own address: a host of the
+    // developer's that reads like one, on a domain of theirs, was taken out of their build too (30 Sep 2026).
+    const apex = (o.apex ?? host.split('.').slice(1).join('.')).toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const underWall = new RegExp(`^https://([a-z0-9-]+)\\.${apex}/\\*$`);
+    const stale = (p) => typeof p === 'string' && p !== pattern && isTestAddress(underWall.exec(p)?.[1]);
     for (const field of ['host_permissions', 'externally_connectable']) {
         const list = field === 'host_permissions' ? manifest.host_permissions : manifest.externally_connectable?.matches;
         const gone = Array.isArray(list) ? list.filter(stale) : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {