toolaby 1.8.4 → 1.8.5

package/bin.mjs

@@ -8,7 +8,7 @@
 //   toolaby pack [folder]             the zip for the Chrome Web Store: the built extension, its manifest's key left out
 //   toolaby check [--into <folder>]   whether the extension here is wired right; --browser loads it in Chromium too
 //   toolaby mcp                       the Wall for coding agents: an MCP server on stdio (lib/mcp.js)
-//   toolaby webhooks events           the six events, with an example of each
+//   toolaby webhooks events           the six events and what each means
 //   toolaby webhooks trigger <event>  send an example delivery: to your registered endpoints, or with --to straight to a local server
 //   toolaby webhooks secret           this machine's development secret, which --to signs with
 //   toolaby webhooks endpoints        the workspace's endpoints
@@ -37,14 +37,14 @@ import { deflateRawSync } from 'node:zlib';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
 import { createHmac, randomBytes } from 'node:crypto';
-import { wireManifest, sitePattern, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT } from './lib/manifest.js';
+import { wireManifest, sitePattern, drawsItself, WORKER_LINES, wallWorkerSource, configValues, wrappedBy, namedWorker as workerIn, startsPlatform as startsWall, CLASSIC_CLIENT, parseManifest, notManifestV3 } from './lib/manifest.js';
 import { wiringSummary, popupSwapIn, gatesIn, ownCode } from './lib/summary.js';
 import { detectProject, CODE_FILES, POPUP_FILES, SIDE_PANEL_FILES, filesToWrite, fillPages, scaffoldManifest, scaffoldFilesFor, surfacesOf, hasPopup, hasSidePanel, SURFACES, STALE_FILES, BUILD_COPY_NOTE, AGENT_FILES, AGENT_ENTRY_FILES } from './lib/project.js';
 import { runMcp } from './lib/mcp.js';
 import { runCheck } from './lib/check.js';
 import { inside, signInPage, devicePolling, opener, privateKind, privateContent, privateCopies, googleKey, projectRoot, gitDirectory, gitObject, gitObjects, gitFile, notAnImage, unpacked, COMPRESSED, publicLinks, privateLinks, oneLine, fetchBounded, fetchHere, readBounded, readText, SCAFFOLD_FILES } from './lib/safe.js';
 
-const VERSION = '1.8.4';
+const VERSION = '1.8.5';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -211,7 +211,7 @@ async function tools() {
   const res = await api('/api/cli/tools', { token });
   if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`npx -y toolaby@latest login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`Toolaby answered HTTP ${res.status}.`);
-  if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
+  if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`npx -y toolaby@latest wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
   out(`\n  ${side}\n`);
   for (const t of res.json.tools) out(`    ${oneLine(t.slug).padEnd(40)} ${oneLine(t.name)}${t.bundle ? '  (bundle)' : ''}   ${oneLine(t.site)}`);
   out();
@@ -269,7 +269,7 @@ async function filesFor(slug, scaffold, manifestKey = null, surfaces = null) {
   if (res.status === 404) {
     // Say who the command is: the tool may well exist — in a workspace of another account of theirs.
     const me = await api('/api/cli/me', { token }).catch(() => null);
-    const who = me?.ok ? `\n\n  You are signed in as ${oneLine(me.json.email)}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => oneLine(w.slug)).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`toolaby logout\`, sign in to the dashboard as that account, then run this again.` : '';
+    const who = me?.ok ? `\n\n  You are signed in as ${oneLine(me.json.email)}${me.json.workspaces.length ? ` (workspaces: ${me.json.workspaces.map((w) => oneLine(w.slug)).join(', ')})` : ' (no workspace yet)'}.\n  Another account owns it? \`npx -y toolaby@latest logout\`, sign in to the dashboard as that account, then run this again.` : '';
     fail(`${oneLine(res.json.message ?? `No tool "${slug}" in your workspaces.`)}${who}`);
   }
   if (!res.ok) fail(oneLine(res.json.message ?? `Toolaby answered HTTP ${res.status}.`));
@@ -283,16 +283,23 @@ async function wire() {
   if (!existsSync(dir)) fail(`${dir} does not exist`);
   const tree = listTree(dir, 3);
   const has = (p) => tree.has(p.replace(/\/$/, ''));
-  const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
-  if (has('manifest.json') && !manifest) fail('manifest.json could not be read as JSON.');
+  // Read as Chrome reads it: comments and a trailing comma are fine there. Written back, it is plain JSON (said below).
+  const read = has('manifest.json') ? parseManifest(readOr(join(dir, 'manifest.json'), '')) : null;
+  const manifest = read?.manifest ?? null;
+  if (read && !manifest) fail(`manifest.json could not be read: ${oneLine(read.error ?? 'it is not JSON')}. Fix it, then wire again. Nothing was written.`);
+  // A Manifest V2 extension was wired as if it were V3 — its background page swapped for a service worker Chrome then
+  // refused to load (1 Oct 2026). Chrome runs V3 alone: said, and nothing written.
+  if (manifest && notManifestV3(manifest)) fail(`${notManifestV3(manifest)}\n  Nothing was written.`);
   // A key the manifest already has is the identity the platform adopts; otherwise the platform's goes in.
   const plan = await filesFor(slug, false, typeof manifest?.key === 'string' ? manifest.key : null);
   const site = plan.site;
   const manifestKey = plan.identity?.manifestKey ?? null;
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
   const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readOr(join(dir, configSource)) : null, site, tree, manifestKey });
-  // Nothing recognised: nothing is written and nothing guessed. A manifest below the top is where to point --into; otherwise the Set up page's Do it myself has the files and the three things to paste.
-  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${oneLine(project.foundManifest)}: run this with --into ${oneLine(dirname(project.foundManifest)) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
+  // Nothing recognised: nothing is written and nothing guessed. A manifest below the top is where to point --into — unless a
+  // build makes the background it names (Vite's public/), where the wiring's background would stand in its way; otherwise
+  // the Set up page's Wire it by hand has the files and the three things to paste.
+  if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${oneLine(project.foundManifest)}: run this with --into ${oneLine(dirname(project.foundManifest)) || '.'}, unless your build makes the background it names (then wire it by hand)` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Wire it by hand has the files and the three things to paste.`);
 
   // The extension's own popup and side panel: the manifest's, or — wired before — what the existing configuration remembers.
   const configPath = join(dir, `${project.codeDir}toolaby.config.js`);
@@ -312,7 +319,7 @@ async function wire() {
   // The background the manifest names, read from inside the folder only: whether it starts the Wall, or is the Wall's.
   const namedWorker = workerIn(manifest) ?? '';
   const workerSource = namedWorker && has(namedWorker) && !inside(dir, namedWorker).why ? readOr(join(dir, namedWorker), '') : null;
-  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, apex: new URL(wall).host, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource }) : null;
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, apex: new URL(wall).host, has, remembered, rememberedSidePanel, manifestKey, ownInFront, workerSource, built: project.built }) : null;
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const appSidePanel = wiring ? wiring.appSidePanel : project.wrapper ? (project.appSidePanel ?? rememberedSidePanel) : null;
   const targets = filesToWrite(project, appPopup, appSidePanel, { popup: !!wiring?.ownPopup, sidePanel: !!wiring?.ownSidePanel });
@@ -367,6 +374,7 @@ async function wire() {
     if (r.code) say(`\n${r.code.split('\n').map((l) => `        ${cyan(l)}`).join('\n')}\n`);
   }
   if (ownAgents) say(`    ${dim('Your AGENTS.md is your own: add "Before changing anything paid, read TOOLABY.md."')}`);
+  if (read?.comments && wiring?.changed) say(`    ${dim('manifest.json had comments: it is written back as plain JSON, without them.')}`);
   if (stale.length) say(`    ${dim(`Removed: ${stale.join(', ')} (now inside toolaby.js)`)}`);
   say(`\n  ${bold('Next')}  ${summary.rows.some((r) => r.again) ? `${plain(summary.next.replace(/wire again\.$/, 'run'))} ${cyan(again)}` : plain(summary.next)}\n`);
 }
@@ -454,11 +462,11 @@ async function webhooks() {
     const events = await catalogue();
     out(`\n  ${side}\n`);
     for (const e of events) out(`    ${oneLine(e.type).padEnd(26)} ${oneLine(e.description)}`);
-    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with this machine's development secret\n  toolaby webhooks secret                      → that secret, for the local server's WALL_WEBHOOK_SECRET\n`);
+    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with this machine's development secret\n  toolaby webhooks secret                      → that secret, for the local server's TOOLABY_WEBHOOK_SECRET\n`);
     return;
   }
   if (sub === 'secret') {
-    // For the server on this machine: `WALL_WEBHOOK_SECRET=$(npx -y toolaby@latest webhooks secret) node server.mjs`.
+    // For the server on this machine: `TOOLABY_WEBHOOK_SECRET=$(npx -y toolaby@latest webhooks secret) node server.mjs`.
     process.stdout.write(devSecret() + '\n');
     return;
   }
@@ -487,7 +495,7 @@ async function webhooks() {
     } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
     const text = (await res.text()).slice(0, 200);
     out(`\n  POST ${to}  →  ${res.status}${text ? `  ${oneLine(text)}` : ''}`);
-    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx -y toolaby@latest webhooks secret` prints it for WALL_WEBHOOK_SECRET"}.\n`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : "this machine's development secret — `npx -y toolaby@latest webhooks secret` prints it for TOOLABY_WEBHOOK_SECRET"}.\n`);
     if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
     return;
   }
@@ -823,7 +831,7 @@ function help() {
                                        --browser loads it in Chromium (needs Playwright in the project)
     mcp                                Toolaby for coding agents, an MCP server on stdio:
                                        claude mcp add toolaby -- npx -y toolaby@latest mcp
-    webhooks events                    the six events, with an example of each
+    webhooks events                    the six events and what each means
     webhooks trigger <event>           an example delivery to your endpoints; --to <url> sends it to a local server instead
     webhooks endpoints                 your endpoints; add <url> registers one (secret shown once), remove <id> removes one
     login · whoami · logout            the session, per side; a command that needs one signs you in itself

package/lib/check.js

@@ -8,7 +8,7 @@ import { join, relative, resolve } from 'node:path';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { oneLine, keySite, fetchBounded, readText } from './safe.js';
-import { wrappedBy, namedWorker, startsPlatform as startsWall, sitePattern } from './manifest.js';
+import { wrappedBy, namedWorker, startsPlatform as startsWall, sitePattern, parseManifest, notManifestV3 } from './manifest.js';
 import { popupSwapIn, ownCode } from './summary.js';
 
 const KEY = /tk_(test|live|dev)_[A-Za-z0-9_-]{20,}/;
@@ -69,8 +69,10 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
   if (!existsSync(dir)) { bad(`${dir} does not exist.`); return false; }
   const tree = listTree(dir, 3);
   const has = (p) => tree.has(p.replace(/\/$/, ''));
-  const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
+  // As Chrome reads it (comments allowed), and only a Manifest V3 extension: Chrome runs no other.
+  const manifest = has('manifest.json') ? parseManifest((() => { try { return readText(join(dir, 'manifest.json')); } catch { return ''; } })()).manifest : null;
   if (has('manifest.json') && !manifest) { bad('manifest.json is not valid JSON.'); return false; }
+  if (manifest && notManifestV3(manifest)) { bad(notManifestV3(manifest)); return false; }
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
   const readOr = (p, none = null) => { try { return readText(p); } catch { return none; } };
   const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readOr(join(dir, configSource)) : null, site: 'https://example.invalid', tree });
@@ -117,7 +119,7 @@ export async function runCheck({ dir: given, out, api, token, detectProject, wir
     if (needed.length) bad(`The manifest lacks what Toolaby needs: ${needed.map(oneLine).join('; ')}. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
     else ok('The manifest has the permissions and host permissions Toolaby needs.');
     // The identity: without the `key`, each copy's id follows its folder, and once the extension is named the tool key refuses every copy not chosen.
-    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Keys page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
+    if (typeof manifest.key !== 'string' && /manifestKey:\s*'[A-Za-z0-9+/]{100,}={0,2}'/.test(configText)) warn(`manifest.json has no "key": each copy's id then depends on its folder, and once your extension is named the tool key refuses any copy you did not choose on the Set up page. \`npx -y toolaby@latest upgrade ${key.slug}\` adds it.`);
   } else warn(`The manifest is generated by ${project.label}: build, then check the built manifest has ${sitePattern(key.site)} in host_permissions and externally_connectable.`);
 
   // 4b. The background starts the Wall: the popup and every page ask it everything, so without it nothing answers.

package/lib/manifest.js

@@ -33,6 +33,33 @@ const SCRIPT_PATH = /^(?!.*\.\.)(?!.*\/\/)[A-Za-z0-9_][A-Za-z0-9_\-./]*\.m?js$/;
 export function withoutComments(text) {
     return text.replace(/("(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\.)*`)|\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, (m, str) => (str ? m : ''));
 }
+/**
+ * manifest.json as Chrome reads it: JSON that may carry comments and a trailing comma (Vimium's does; 1 Oct 2026), which
+ * JSON.parse refuses. `comments` says whether the text needed them gone: written back, the manifest is plain JSON.
+ */
+export function parseManifest(text) {
+    const clean = String(text ?? '').replace(/^\uFEFF/, '');
+    try {
+        return { manifest: JSON.parse(clean), comments: false };
+    }
+    catch { /* JSON with comments, or not JSON at all */ }
+    const plain = withoutComments(clean).replace(/("(?:[^"\\\n]|\\.)*")|,(\s*[}\]])/g, (m, str, tail) => (str ? m : tail));
+    try {
+        return { manifest: JSON.parse(plain), comments: true };
+    }
+    catch (e) {
+        return { manifest: null, comments: false, error: e.message };
+    }
+}
+/** Why Chrome would not run this manifest as a Manifest V3 extension, or null: what wire and check refuse before anything else. */
+export function notManifestV3(manifest) {
+    const version = manifest?.manifest_version;
+    if (version === 3)
+        return null;
+    if (version === 2)
+        return 'This is a Manifest V2 extension (manifest_version 2), and Chrome runs Manifest V3 extensions only. Move it to Manifest V3 first, then wire it: https://developer.chrome.com/docs/extensions/develop/migrate';
+    return `manifest.json says manifest_version ${JSON.stringify(version ?? null)}: Chrome runs Manifest V3 extensions, with "manifest_version": 3.`;
+}
 /** Whether a background already starts the Wall itself: then it is left as it is. */
 export const startsPlatform = (source) => /\b(?:startBackground|ensureBackground)\s*\(/.test(withoutComments(source));
 /** The extension's own background the Wall's runs, read from the Wall's; null for any other file. */
@@ -205,7 +232,12 @@ export function wireManifest(input, o) {
     const named = namedWorker(manifest);
     let background;
     let workerMoved = false;
-    if (!named || !o.has(named)) {
+    if (named && !o.has(named) && o.built) {
+        // Vite's or webpack's output (Linkwarden, wired on 1 Oct 2026): a two-line background written at that name stood where
+        // the build writes the extension's own, and copied as the summary says, it would have replaced it.
+        background = { kind: 'built', file: named };
+    }
+    else if (!named || !o.has(named)) {
         const file = named ?? (o.has('background.js') ? WALL_WORKER : 'background.js');
         manifest.background = { service_worker: file, type: 'module' };
         did.push(`a service worker, ${file} (two lines: it starts the platform)`);

package/lib/summary.js

@@ -46,6 +46,8 @@ export function wiringSummary(o) {
             rows.push({ tone: 'ok', label: 'Background', text: `${b.file} starts Toolaby` });
         else if (b.kind === 'lines')
             rows.push({ tone: 'todo', label: 'Background', text: `Add these 2 lines to the top of ${b.file}:`, code: `import { toolaby } from '${importPath(b.file)}';\n\ntoolaby.startBackground();` });
+        else if (b.kind === 'built')
+            rows.push({ tone: 'todo', label: 'Background', text: `Your build makes ${b.file}. Add these 2 lines to the top of its source, with the path from there to toolaby.js:`, code: `import { toolaby } from './toolaby.js';\n\ntoolaby.startBackground();` });
         else if (b.kind === 'gone')
             rows.push({ tone: 'todo', label: 'Background', text: `${b.wraps} is no longer in the folder. Put your background's file name in manifest.json:`, code: '"background": { "service_worker": "your-background.js" }', again: true });
         else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.8.4",
+  "version": "1.8.5",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one; check it, and give coding agents the Wall as an MCP server.",
   "type": "module",
   "bin": {