toolbox-portal/README.md

add·ideas Toolbox Portal

toolbox-portal is the static launcher and release assembler for the add·ideas browser toolbox. Version 0.2.23 reads one same-origin catalogue, shows each app as a compact launch tile, and keeps personal pins, drag-and-drop ordering, visibility, and appearance in the current browser. Pinned tools have their own section; search, category, and clickable tag filters stay close to the tool list.

The v1 boundary is intentionally small:

• apps remain separately versioned and released repositories;
• @add-ideas/toolbox-contract owns manifest, catalogue, and URL validation;
• the portal navigates to apps—there are no iframes, plugins, remote modules, or runtime-loaded application code;
• the assembler copies already-built, exact ZIP artifacts and never builds app source or resolves a latest release.

Development

Requirements: Node.js 22 or newer and npm 11 or newer. The committed .npmrc selects the public, token-free package scope on Gitea; registry credentials are not required to install the Toolbox SDK packages. Install and verify the portal:

npm ci
npm test
npm run lint
npm run build
npm run dev

The package lock resolves the ^0.3.0 SDK ranges to the published 0.3.0 packages. A sibling SDK checkout is only needed when intentionally developing the SDK and portal together.

Vite uses base: './', so the built portal works at / or a nested static path. The development catalogue at public/toolbox.catalog.json points to assembled paths (./apps/pdf/, ./apps/xslt/, ./apps/onenote/, ./apps/av/, ./apps/regex/, ./apps/svg/, ./apps/auth/, ./apps/sudoku/, ./apps/colour/, ./apps/office/, ./apps/image/, ./apps/file/, ./apps/epub/, ./apps/archive/, ./apps/privacy/, ./apps/crypto/, ./apps/barcode/, ./apps/network/, ./apps/geo/, ./apps/helper/, ./apps/rand/, ./apps/data/, ./apps/diff/, ./apps/time/, ./apps/text/, ./apps/unicode/, ./apps/flow/, ./apps/subtitle/, ./apps/midi/, ./apps/3d/, ./apps/query/, ./apps/scan/, ./apps/package/, ./apps/label/, ./apps/font/, ./apps/fixture/, ./apps/minimize/, ./apps/format-lab/, ./apps/repro/, ./apps/schema/, ./apps/log/, ./apps/binary/, ./apps/git/, ./apps/api/, ./apps/mail/, ./apps/calendar/, ./apps/contact/, ./apps/diagram/, ./apps/token/, and ./apps/device/). Those manifests will correctly appear as unavailable until an assembled release is being served.

Catalogue and launches

The portal fetches ./toolbox.catalog.json, validates it with the shared contract, and then validates each enabled manifest. A bad individual manifest is reported without hiding valid apps; a bad or unreachable catalogue gets a retry state. An empty valid catalogue gets its own empty state.

Internal launch links stay same-origin and receive the exact catalogue URL in a toolbox query parameter. For example:

/apps/pdf/?toolbox=https%3A%2F%2Ftoolbox.example%2Ftoolbox.catalog.json

Apps discover that context through the shared shell/contract and retain their standalone fallback when no context is present. External catalogue entries open according to their declared launch mode and do not receive toolbox context.

Personal settings use the namespaced local-storage key @add-ideas/toolbox-portal:v1:preferences. The preferences panel can reset, export, and import the versioned JSON document. The portal itself does not transmit preferences. Because Toolbox apps share an origin, code explicitly trusted in an app can access same-origin browser storage; review each app's privacy and executable-code warning. Light, dark, and system modes are supported.

Production deployment behind Traefik

The committed compose.yaml is the shortest production path. Its release container downloads the immutable Toolbox 0.20.0 ZIP during the image build, verifies SHA-256 before extracting it, and then copies only the verified static files into the pinned unprivileged nginx image. Node.js and a local portal assembly are not required on the deployment host.

Prerequisites:

• Docker with the Compose plugin;
• Traefik attached to the existing external Docker network internal;
• Traefik HTTP and HTTPS entrypoints named web and websecure;
• a certificate resolver named netcup;
• DNS for toolbox.add-ideas.de and auth.toolbox.add-ideas.de pointing to that Traefik instance; and
• outbound HTTPS access to git.add-ideas.de while the image is built.

Deploy a fresh clone with:

git clone https://git.add-ideas.de/lotobo/toolbox-portal.git
cd toolbox-portal
./scripts/deploy-update.sh

If you prefer the inline command:

git fetch origin --tags && \
git pull --ff-only origin main && \
{ TAG="$(git describe --tags --exact-match 2>/dev/null || git describe --tags --abbrev=0 2>/dev/null || true)"; \
  if [ -n "$TAG" ]; then echo "$TAG"; else echo "warning: no matching tags found"; fi; } && \
docker compose up -d --build && \
docker compose ps

No host port is published. Traefik permanently redirects http://toolbox.add-ideas.de to HTTPS, routes https://toolbox.add-ideas.de to nginx on the shared network at port 8080, and obtains its TLS certificate through netcup. The hostname, network, resolver, release version, and matching checksum can be overridden through environment variables; copy .env.example to .env only when an override is needed. For example, set TOOLBOX_HOST=staging.toolbox.add-ideas.de for a staging host.

The same container also exposes only the packaged authentication app at https://auth.toolbox.add-ideas.de/. Traefik adds the internal /apps/auth prefix while the public URL remains /, so assets remain relative and the browser binds WebAuthn credentials to the dedicated auth.toolbox.add-ideas.de RP ID. The main Toolbox copy at /apps/auth/ remains useful for offline inspection but disables live ceremonies because all Portal apps share that origin. The router hostname can be overridden with AUTH_TOOLS_HOST, but the bundled Auth Tools release enables live ceremonies only on its pinned production host (or localhost); other hosts remain inspect-only. A different production host therefore also requires rebuilding Auth Tools with the new exact host. Never widen the RP ID to add-ideas.de.

The external network is deliberately not created by this project. Creating a private project-local network would prevent an independently managed Traefik container from reaching the service.

Exact release assembly

Every app release ZIP must put these items at its archive root:

index.html (or the entry declared by toolbox-app.json)
toolbox-app.json
CHANGELOG.md
LICENSES/
SOURCE.md
...built static assets

The app release should also publish a matching .sha256 sidecar. The manifest must declare the pinned reverse-DNS id and version. Application and portal versions are independent.

release/toolbox.lock.json is the reviewed Toolbox v0.20.0 / Portal v0.2.23 lock. Its URLs and checksums pin PDF Tools 0.4.4, XSLT Tools 0.4.3, OneNote Tools 0.3.4, Audio & Video Tools 0.3.0, Regex Tools 0.4.2, OTP & Passkey Tools 0.3.1, Sudoku Tools 0.2.1, and the coordinated 0.2.0 releases of SVG, Colour, Office, Image, File, EPUB, Archive, Privacy, Crypto, Barcode, Network, Geo, Helper, Random, Data, Diff, Time, Text, Unicode, Flow, Subtitle, MIDI, 3D, Query, Scan, Package, Label, Font, Fixture, Minimize, Format Lab, Repro, Schema, Log, Binary, Git, API, Mail, Calendar, Contact, Diagram, Token, and Device Tools. Use release/toolbox.lock.example.json as the template for a future release and verify every downloaded asset before committing updated values. Artifacts may be:

• a path relative to the lock file;
• a file: URL; or
• a credential-free HTTPS URL to an immutable release asset.

For a private Gitea release, download the exact asset first and put its local path in the lock. Do not put credentials in a lock URL.

Build the portal and assemble the distribution:

npm ci
npm test
npm run build
npm run assemble -- \
  --lock release/toolbox.lock.json \
  --portal-dist dist \
  --output build/toolbox \
  --archive build/add-ideas-toolbox-0.20.0.zip

Existing output is refused. Pass --force only when replacing those exact paths is intended. A successful run produces:

build/toolbox/
├── index.html
├── toolbox.catalog.json       generated from the lock
├── toolbox.release.json       ids, versions, targets, checksums
├── LICENSE.txt
├── SOURCE.md
├── THIRD_PARTY_LICENSES.txt
├── THIRD_PARTY_NOTICES.md
└── apps/
    ├── pdf/
    ├── xslt/
    ├── onenote/
    ├── av/
    ├── regex/
    ├── svg/
    ├── auth/
    ├── sudoku/
    ├── colour/
    ├── office/
    ├── image/
    ├── file/
    ├── epub/
    ├── archive/
    ├── privacy/
    ├── crypto/
    ├── barcode/
    ├── network/
    ├── geo/
    ├── helper/
    ├── rand/
    ├── data/
    ├── diff/
    ├── time/
    ├── text/
    ├── unicode/
    ├── flow/
    ├── subtitle/
    ├── midi/
    ├── 3d/
    ├── query/
    ├── scan/
    ├── package/
    ├── label/
    ├── font/
    ├── fixture/
    ├── minimize/
    ├── format-lab/
    ├── repro/
    ├── schema/
    ├── log/
    ├── binary/
    ├── git/
    ├── api/
    ├── mail/
    ├── calendar/
    ├── contact/
    ├── diagram/
    ├── token/
    └── device/

build/add-ideas-toolbox-0.20.0.zip
build/add-ideas-toolbox-0.20.0.zip.sha256

The assembler verifies SHA-256 before opening an artifact, validates every app manifest with @add-ideas/toolbox-contract, requires its id/version to equal the lock, and smoke-checks each declared entry, icon, and packaged manifest asset after extraction. It rejects insecure or credential-bearing redirects, HTTP, latest aliases, ZIP traversal, absolute paths, symlinks, special files, duplicate paths, oversized entries, and unsafe compression ratios. Canonical path checks protect source and output trees even through symlink aliases, and publication rolls all outputs back if a staged rename fails. Artifacts are unpacked only under apps/<locked-target>. The assembler never runs artifact content.

The archive writer sorts file names and fixes ZIP timestamps and modes so the same assembled directory produces stable bytes. To package an already assembled directory separately:

npm run package:static -- \
  --input build/toolbox \
  --output artifacts/add-ideas-toolbox-0.20.0.zip

This also emits a .sha256 sidecar.

Local assembled container and publication

Containerfile serves only the assembled files with unprivileged nginx on port 8080. It adds restrictive browser headers, same-origin isolation, explicit application/javascript for .mjs engine modules, application/wasm, and application/gzip for the bundled Scan OCR language model, immutable caching only for Vite-hashed assets and narrowly matched semver-versioned FFmpeg core files, and revalidation for all other files. The opaque-origin SVG preview iframe loads its packaged controller with a URI-exact CORS and cross-origin resource-policy exception; all other files retain the same-origin policy and every normal security header. Camera access is denied by default. It is granted to the dedicated auth.toolbox.add-ideas.de origin and, on the shared Toolbox host, only to /apps/barcode/, /apps/scan/, and /apps/device/. Device Tools alone additionally receives microphone and screen- capture policy at its exact path; every probe remains explicitly user initiated. If AUTH_TOOLS_HOST is customized, update the exact host entry in deploy/nginx.conf and Auth Tools' pinned WebAuthn host at the same time. Every Toolbox app, including Random Tools, is constrained to same-origin connections. Random Tools implements its random generators locally with browser APIs and never calls a third-party randomness service.

The packaged policy intentionally does not grant CSP unsafe-eval. SaxonJS's ixsl:eval() extension is therefore unsupported in this deployment profile; normal local XML/XSLT transformations do not require that permission.

Assemble first, then:

podman build -f Containerfile \
  -t git.add-ideas.de/lotobo/toolbox:0.20.0 .
podman run --rm -p 8080:8080 \
  git.add-ideas.de/lotobo/toolbox:0.20.0

For a direct-port local deployment after assembly, use the separate example:

docker compose -f compose.example.yaml up -d --build

Publish both common architectures from a buildx-enabled workstation or Gitea runner:

docker login git.add-ideas.de
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  --file Containerfile.release \
  --tag git.add-ideas.de/lotobo/toolbox:0.20.0 \
  --tag git.add-ideas.de/lotobo/toolbox:0.20 \
  --push .

The default unprivileged nginx image is the security-fixed 1.31.3-alpine baseline pinned to its reviewed multi-architecture digest. Re-resolve and review that digest whenever the base image is upgraded, then record it in the release notes.

Manual Gitea publication checklist

No credentials belong in this repository. The publishing workstation or runner needs permission to push code, releases, and container packages to lotobo/toolbox-portal.

1. Run npm ci, npm test, npm run lint, and npm run build from a clean checkout of the intended portal tag.
2. Publish each app's versioned ZIP, .sha256, toolbox-app.json, changelog, and licence notices in its own Gitea release.
3. Verify downloaded app assets with sha256sum -c <asset>.sha256; copy those exact values into a reviewed toolbox lock.
4. Run the assembler and serve build/toolbox from a nested test path. Open all 50 apps, switch between them, and confirm the encoded toolbox context.
5. Verify the distribution with (cd build && sha256sum -c add-ideas-toolbox-0.20.0.zip.sha256).
6. Commit the reviewed lock, tag the toolbox release (for example v0.20.0), and push the branch and tag to Gitea.
7. In Gitea, open Releases → New release, select the tag, and upload the static ZIP plus its .sha256 file. Do not use a mutable “latest” URL in a future lock.
8. Build and push the AMD64/ARM64 OCI image as shown above. Record the resulting multi-architecture manifest digest in the release notes.

For Gitea Actions, store registry credentials as repository secrets, check out the exact tag, install with npm ci, run the same verification/assembly commands, and upload only the already-created ZIP/checksum and OCI image. The workflow must not re-resolve app versions or substitute a newer release.

Toolbox 0.20.0 portfolio expansion

Toolbox 0.20.0 publishes the coordinated multi-repository depth pass. It adds:

• bounded byte/stream/worker/blob helpers, manifest I/O and capability profiles, versioned evidence envelopes, and same-origin one-time artifact transfers;
• deeper batch, conversion, safe-share, schema, semantic diff, reproducibility, archive, text, Unicode, colour, random, network, barcode, crypto and geospatial workflows;
• richer EPUB, Office, SVG, image, subtitle, MIDI, 3D, scan, label, font, diagram, design-token and structured-flow authoring/inspection, including bounded HTML/Markdown/text-to-EPUB adaptation and TTC/OTC face inspection;
• modern PBES2/PBKDF2 PKCS #12 inspection, structural 7z/RAR inventory, and OpenAPI 3.1/3.2 webhook receiver analysis with explicit fail-closed limits;
• expanded Query, Fixture, Minimize, Format Lab, Binary, Git, API, Mail, Calendar, Contact, Log and Device evidence and interoperability; and
• repository-native Gitea verification workflows covering formatting, lint, unit tests, production builds, Toolbox smoke checks, runtime dependency audit and browser tests where applicable.

Every addition remains local-first, bounded and explicit about unsupported formats or incomplete standards coverage. The release order is Toolbox SDK 0.3.0, @add-ideas/toolbox-helpers@0.2.0, the 43 app releases at 0.2.0, and Portal 0.2.23 with aggregate Toolbox 0.20.0. The reviewed lock pins those exact immutable app archives and checksums.

Existing tools

Tool	State and boundary	Principal workflows	Important concrete scope	Critical considerations and integrations
pdf-tools	Existing; dedicated repository	Merge, split, reorder, rotate and export PDF pages	Thumbnail workspace; multi-document operations; ZIP and PDF output; saved local workspace	Workers and IndexedDB; large-document memory control; future signature inspection through crypto-tools; metadata and safe-sharing through privacy-tools
xslt-tools	Existing; dedicated repository	Develop, test and run XSLT transformations	XML/XSLT editors; transformation results; local files; saved projects; validation and diagnostics	Lazy SaxonJS loading; relocatable assets; useful handoffs to data-tools, schema-tools and diff-tools
onenote-tools	Existing rich-reader release; dedicated repository	Open, browse, inspect and export OneNote sections and packages locally	Desktop/unfragmented FSSHTTPB .one/.onetoc2; none/LZX/MSZIP/Quantum and multi-cabinet .onepkg; trees, rich text, images, tables, ink, attachments and export	Native TypeScript worker with no Wasm; bounded parsing, rendering and export; fragmented FSSHTTP fails safely; no editing or pixel-perfect fidelity
av-tools	Existing local-first v0.3.0 release; dedicated repository	Convert and lightly edit audio and video locally in the browser	Immediate native playback and basic file information; progressive stream inspection on demand; quick conversion; trim, split and crossfade concatenate; crop, resize, normalize, fades, waveform, metadata, chapters, subtitles, scene thumbnails/contact sheets, presets and export	Reviewed ffmpeg.wasm 0.12.10 ST/MT build with verified Opus and bundled label font; bounded queue, temporary storage and resource policy; isolation enables MT with automatic ST fallback; versioned core assets are immutable
regex-tools	Current local-first v0.4.2 release; dedicated repository	Develop, explain, test and apply JavaScript, PCRE2, PHP, Perl, Python, Ruby, Java, C++, Go, .NET, Rust and Scala/JVM-compatible regular expressions	Deterministic syntax trees; engine-native matching, captures and bounded replacement; stable double-buffered live results; PCRE2 tracing and C17 generation; comparison; corpus apply; tests; risk/growth/benchmark analysis; generated cases; bounded minimization; validated ECMAScript formatting; project import/export and optional local persistence	Open-source regexpp and pinned local WebAssembly runtimes for PCRE2, PHP preg, legacy Perl, CPython, CRuby, TeaVM Java/Scala compatibility, libc++ C++, Go, .NET and Rust in killable workers; explicit source/licence inventories, resource limits and engine-specific offset semantics
svg-tools	Current local-first v0.2.0 release; dedicated repository	Inspect and edit SVG source, structure, geometry, references and accessibility locally	Synchronized source/tree/canvas/inspector; path and transform tools; reference analysis; optimization; app-owned, validated opacity-animation preview; exact, sanitized, raster and project export	Untrusted SVG is sanitized into an opaque-origin sandbox; bounded parsing and decompression, explicit security findings and a URI-scoped controller header exception; later milestone slices remain intentionally tracked in the app repository
auth-tools	Current local-first v0.3.1 release; dedicated repository	Generate, migrate and diagnose OTP credentials, and inspect, verify and test WebAuthn/passkey ceremonies locally	HOTP/TOTP/OCRA with time travel, resynchronization and rotation planning; QR, Google, Aegis and encrypted PSKC migration; WebAuthn extension experiments and replayable traces; assertion, attestation, signer-chain and historical metadata-policy evaluation	Authentication material remains memory-only unless explicitly exported; redaction is deliberate but not a secrecy guarantee; live ceremonies and camera scanning are enabled only at the exact dedicated auth.toolbox.add-ideas.de origin, while the shared Portal path remains inspect-only; v0.3.1 corrects source provenance and cross-timezone artifact reproducibility; no raw CTAP administration
sudoku-tools	Current local-first v0.2.1 release; dedicated repository	Set, play, generate, analyse and solve classic, Killer and rich variant Sudoku locally	4×4–16×16 grids; registry-backed constraint packs including cages, lines, dots, XV, inequalities, indexing and Fog of War; staged hints, candidate maintenance, advanced logical techniques, setter quality checks, mixed-variant generation, source-preserving f-puzzles/SudokuPad interoperability, autosave recovery and searchable local projects	Worker-bounded solving, generation and quality analysis; strict inert imported-visual validation; fog-safe play assistance; IndexedDB history with memory fallback; stable workspace geometry, responsive zoom and pan, a 3×3 standard keypad, tap selection, patterned colours, accessibility controls and an offline-capable PWA shell
colour-tools	Current local-first v0.2.0 release; dedicated repository	Convert, composite, interpolate, pick, sample, analyse and export colours locally	General colour conversion; arbitrary RGBA compositing; multi-stop colour steps and gradient editing; large visual/native/EyeDropper pickers; local image sampling and palette extraction; contrast, gamut, Delta E and colour-vision analysis; harmonies; DTCG 2025.10 token import/export with local reference resolution; directional contrast matrices; CSS and recipe export	Processing and image access remain local; colour spaces, encoded versus linear-light compositing, interpolation and gamut-mapping assumptions are explicit; mathematical conversion is distinguished from display simulation; integrates with SVG, image and token tools
office-tools	Current local-first v0.2.0 read-only release; dedicated repository	Open, inspect and view word-processing documents, spreadsheets and presentations locally; download exact source copies and bounded ODF semantic exports	DOCX/DOCM/DOTX/DOTM, XLSX/XLSM/XLTX/XLTM and PPTX/PPTM/POTX/POTM/PPSX/PPSM plus ODT/ODS/ODP; search/navigation/zoom; text, tables, images, styles, metadata, cached formula values and notes; exact source-copy plus ODF text/CSV/outline/JSON export	Bounded worker-based inert package and XML parsers never execute macros, scripts, formulas, active content or external resources; legacy binary DOC, XLS and PPT are unsupported; viewing is intentionally read-only and does not promise pixel-perfect Office-suite layout fidelity
image-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, crop, rotate, resize, preview before/after and batch-convert static raster images locally	Static JPEG/PNG/WebP; bounded pre-decode animation/profile inspection; synchronized 25–400% source/result zoom; pointer/keyboard crop and fit/fill/exact resize; versioned recipes; cancellable batch ZIP with per-image reports; capability-probed PNG/JPEG/WebP export	Animated and multi-picture inputs are inspect-only; canvas re-encoding does not preserve arbitrary metadata, ICC profiles, HDR precision or byte identity
file-tools	Current local-first v0.2.0 release; dedicated repository	Identify, inspect, hash, compare, inventory, rename-copy, split and join local files	Signature and claimed-MIME comparison; paged hex/ASCII and strings; SHA-256/SHA-512; deterministic manifests; duplicate candidates; collision-safe rename/copy plans; byte-exact split/join	Detection and entropy are heuristics rather than validation or malware analysis; rename operations export safe copies and never mutate the source filesystem
epub-tools	Current local-first v0.2.0 release; dedicated repository	Read, inspect and validate EPUB 2/3 publications; adapt text formats, edit metadata and covers, and rebuild EPUBs locally	EPUB 2/3 package/nav/spine inspection; determinate open progress; sandboxed reflow/fixed-layout reading with packaged CSS/fonts/images/media; bounded HTML/XHTML/Markdown/text adapters; search, bookmarks and annotations; metadata/cover editing; text/Markdown/safe-HTML/chapter/report exports; normalized rebuilds with IDPF font-obfuscation preservation	Strict bounded ZIP and XML handling; active and external content are blocked; DRM is detected but never bypassed; focused preflight is not a complete EPUBCheck implementation
archive-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, create, compare and safely extract archive content	ZIP/ZIP64, TAR/USTAR/PAX, gzip and tar.gz plus bounded structural 7z and RAR4/RAR5 inspection; inert previews; ZipCrypto/WinZip AES read and create; deterministic unencrypted ZIP/TAR/tar.gz; cross-format comparison; selected-file verification and repackaging	Path, entry-count, expanded-size and compression-ratio limits; no direct filesystem restoration or nested expansion; multipart ZIP and 7z/RAR decompression/extraction remain unsupported; links and special entries are inventory-only and blocked from restoration
privacy-tools	Current local-first v0.2.0 release; dedicated repository	Inspect image metadata and make independently verified sharing copies	Deep JPEG/PNG/WebP EXIF/IPTC/XMP/profile/preview/provenance/trailing-data scans; orientation-normalized re-encoding with mandatory output rescan and pixel comparison; source/output hashes; pseudonymized safe-share and detailed JSON/ZIP reports; reusable remove/preserve/review policy evidence	Not an anonymity guarantee; verified re-encoding is limited to complete static JPEG/PNG/WebP scans, while other recognized formats are inventory/inspect-only; re-encoding can change pixels and remove colour, resolution and authenticity information; detailed reports can contain sensitive metadata
crypto-tools	Current local-first v0.2.0 inspection and operations release; dedicated repository	Inspect certificates, requests, CRLs, keys, encrypted PKCS #8, PKCS #12/PFX and JWK/JWKS material, and run fixed-profile local cryptographic operations	Bounded X.509/CSR/CRL, PBES2/PBKDF2 PKCS #8 and PKCS #12 inspection/decryption; JWK/JWKS and RFC 7638; explicit certificate-path checks without trust claims; DNS SAN checks; fixed-profile RSA-PSS/PKCS1, ECDSA and browser-supported Ed25519 sign/verify; RSA-OAEP and AES-256-GCM text operations	No browser/OS trust implication, complete RFC 5280 validation, revocation service, issuance, CMS/JWS, legacy PKCS #1/SEC1 conversion, legacy PKCS #12 PBE or general-purpose file cryptography; sensitive inputs remain bounded and memory-only, with documented temporary-buffer wiping
barcode-tools	Current local-first v0.2.0 release; dedicated repository	Generate and decode QR codes and common barcodes	SVG QR, Data Matrix, PDF417, Aztec and selected linear formats; bounded image or explicit camera decode; escaped structured QR payloads; deterministic CSV batch ZIP; common GS1 AI/FNC1/date/check-digit/decimal validation; GTIN checks; physical/raster planning and print-sized SVG export	Decoded payloads remain inert text and are never opened automatically; camera is path-scoped and user initiated; generated output, GS1 allocation and print quality still require applicable interoperability checks
network-tools	Current offline v0.2.0 release; dedicated repository	Calculate IP networks and construct or inspect common network values	IPv4/IPv6 canonicalization and CIDR ranges plus largest-first IPv4 VLSM; URL/query parsing with password-redacted display; DNS-record construction and bounded inert zone-file parsing; CSP and HTTP security-header analysis/builder; offline MIME reference	Performs no DNS, URL, HTTP or scanning request; pasted values remain bounded and inert; results are construction and calculation aids rather than live network observations
geo-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, edit, convert, simplify, measure and analyse geospatial files locally	GeoJSON, GPX, KML and coordinate CSV; full Point/MultiPoint/LineString/MultiLineString/Polygon/MultiPolygon/nested GeometryCollection model; bounds, distance, elevation and simplification; validated feature/coordinate edits and line reversal; track inventory; local distance/bearing/midpoint ruler; coordinate-only sketch	Full geometry model retains scalar properties, while GPX/CSV conversion may flatten grouping; no topology repair, CRS transformation, basemap request or survey-grade claim; conversion losses are explicit
helper-tools	Current v0.2.0 app and reusable package release	Encode, convert, inspect and calculate with shared bounded primitives	Base/byte/text/URL conversion; byte cursors and streams; worker jobs; Unicode and line transforms; exact numbers and units; incremental hashes; CIDR; timestamps; hardened JSON/CSV; random primitives	Framework-free @add-ideas/toolbox-helpers 0.2.0 is consumed directly across the Toolbox app set; operations disclose strictness, limits and non-cryptographic seeded boundaries
rand-tools	Local-only v0.2.0 release; dedicated repository	Generate secure or reproducible random values through focused workspaces	Unbiased WebCrypto integers/strings; explicitly seeded deterministic generation; UUIDv4/v7 and ULID; dice, samples, shuffles, passphrases and normal values; local coin/card/date/fraction/spherical draws; exact weighted sampling; versioned executable recipes; domain-separated WebCrypto commit–reveal	Secure local generation never falls back; deterministic output is reproducible rather than secret; the app makes no third-party randomness request and the Portal grants it no external network destination
data-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, format, query, infer schemas, edit, flatten and convert structured data	JSON, YAML 1.2, TOML, XML, CSV, TSV and NDJSON; exact JSON numbers; bounded tree/table/leaf views; JSON Pointer and safe path queries; sample-labelled JSON Schema inference; reviewed immutable RFC 6901 add/replace/remove edits; registry-backed all-format conversion with loss/coercion reports; spreadsheet-formula neutralization	Disposable bounded parser worker; rejects active XML constructs and unsafe object keys; conversions surface information loss and round-trip instability
diff-tools	Current local-first v0.2.0 release; dedicated repository	Compare text and structured files, build directory manifests and perform bounded three-way merges locally	Line/word/code-point/grapheme text diff; exact-number JSON/RFC 6902; namespace-aware XML; keyed CSV/TSV; bounded directory manifests; line-oriented three-way merge; portable reports	Normalization and ignored distinctions remain visible; bounded disposable workers and two-file hash concurrency; directory comparison is manifest-based and merge conflicts remain explicit
time-tools	Current local-first v0.2.0 release; dedicated repository	Convert exact timestamps, plan across IANA zones and inspect calendars, arithmetic and recurrences locally	Signed nanosecond epochs; IANA-zone/DST comparison; wall-clock versus elapsed arithmetic; explicit Unix/Vixie, GitHub Actions, Croner, Quartz and EventBridge cron dialects; RRULE previews; multi-participant meeting planner; business days; bounded ICS import with EXDATE/RDATE and recurrence overrides; escaped UTC ICS export	Uses browser IANA data and does not model leap seconds; holidays are only those supplied; custom VTIMEZONE data is inventoried but not guessed when the browser cannot execute its TZID; URLs and attachments are inert and never fetched
text-tools	Current local-first v0.2.0 release; dedicated repository	Build ordered, inspectable plain-text transformation pipelines	Ordered literal/line transforms; locale case, Unicode normalization and transliteration; strict escape/decode stages; RFC-style quoted CSV column selection; explicit UTF-8, UTF-16LE and Latin-1 file decoding with byte evidence; versioned recipes and paired text/provenance artifacts	Exact source/result and per-step changes stay visible; compatibility normalization, transliteration, narrow encodings and selected transforms may be lossy; artifact evidence is portable, but automatic Toolbox handoff is not enabled in v0.2.0
unicode-tools	Current local-first v0.2.0 release; dedicated repository	Search and inspect Unicode characters, emoji, scripts, text and confusables	Checksum-pinned Unicode 17.0 catalogue and virtualized code chart; name/alias/code-point search; emoji and named sequences with bounded variant construction; UTF-8/UTF-16/escape and grapheme inspection; normalization; UTS #39 skeleton, Identifier_Status/Type and restriction evidence; selected Unihan fields; source-identity reports	Official Unicode data is redistributed under Unicode-3.0 and no symbol-site content is scraped; unassigned, private-use, noncharacter and surrogate states remain distinct; constructed emoji do not claim RGI or font support; confusable/mixed-script findings are review signals, not verdicts
flow-tools	Current local-first v0.2.0 release; dedicated repository	Design and run deterministic structured-data pipelines	Bounded JSON, CSV, NDJSON and XML sources; select, rename, filter, map, sort, group, join, type-format, deduplicate, slice and explode stages; per-stage snapshots, analysis and loss notes; validated recipes plus JSON/CSV and inert pipeline-SVG export	2 MiB sources, 10,000 input rows, 20,000 expanded rows, 200 fields, 30 stages and 256 KiB recipes; no arbitrary code, eval, plug-in or network stage
subtitle-tools	Current local-first v0.2.0 release; dedicated repository	Edit, validate, synchronize, compare and convert captions	Bounded SRT, WebVTT, ASS/SSA and flat-profile TTML/DFXP; cue add/duplicate/split/merge/delete and direct editing; shift/stretch, frame-rate conversion and snapping; editorial diagnostics and index-aligned revision comparison; immediate media playback with cancellable waveform extraction and navigation; explicit UTF-8/UTF-16/Latin-1 decoding	Preserves format-specific data where possible and reports conversion loss; TTML regions, styling definitions and inherited timing are inspected but not laid out and export is a flat resource-free profile; no speech recognition, automatic alignment, semantic comparison or pixel-perfect ASS rendering
midi-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, visualize, edit, audition and export Standard MIDI files	SMF type 0/1 events and metadata; worker-backed edit/export with progress and cancellation; tempo/time/key timelines and piano roll; paired-note editing, transpose, quantize, tempo, crop and channel operations with undo; Web Audio preview and opt-in Web MIDI output; bounded local SF2/SF3 structure inspection; deterministic MIDI/CSV/JSON export	8 MiB, 256-track and 250,000-event caps; PPQN only; Web MIDI is permission-gated and sends channel-note messages without SysEx; SF2/SF3 is inspection-only; the bounded sine preview is not a General MIDI or SoundFont renderer
3d-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, preview, repair and export triangle meshes	OBJ, binary/ASCII STL, ASCII/binary little-endian PLY and embedded glTF/GLB 2; selected-scene hierarchy/TRS/matrix and instancing flattening; material, node, bounds, area and degeneracy statistics; worker-backed capped WebGL preview; normal/degeneracy repair and transform baking; normalized OBJ, binary STL and ASCII PLY export	32 MiB and one-million-vertex/triangle caps; glTF is an embedded FLOAT POSITION/NORMAL TRIANGLES subset with no external assets, sparse accessors, animation, skins, texture or compression decoding; selected-scene transforms and instances are baked into the normalized mesh, but source material graphs are not recreated
query-tools	Current local-first v0.2.0 release; dedicated repository	Query structured local data through bounded row and path languages	JSON, CSV, NDJSON and inert XML with raw inference/precision evidence; parsed SQL/path syntax trees; focused SQL-like and JSONPath-like modes; optional bounded read-only DuckDB-WASM SELECT mode; table/tree/JSON views, saved queries and JSON/CSV/NDJSON export	Built-in modes are not full SQL, JSONPath or JMESPath; 2 MiB/10,000-row-or-value/200-field/200,000-node caps; DuckDB is capped at 10,000 input and 1,000 result rows, 128 MiB, 30-second startup and ten-second queries with no files, network, extensions, DDL/DML, COPY or PRAGMA; hosting needs correct WASM MIME/cache and scoped wasm-unsafe-eval
scan-tools	Current local-first v0.2.0 release; dedicated repository	Correct photographed pages, run optional OCR and assemble local output	Up to 24 PNG/JPEG/WebP pages; precise four-corner projective correction, rotate/deskew, tonal, grayscale and threshold controls in cancellable workers with bounded fallback; drag reorder; PNG/JPEG and image-only PDF export; bundled same-origin English OCR with word geometry plus text, hOCR, TSV and combined multipage-text export	Camera is exact-path and opt-in; strict pixel/byte/page caps; English-only OCR may use roughly 100–300 MiB transient memory and is not an accuracy guarantee; no PDF input, automatic corners, handwriting guarantee, shadow/finger removal or searchable PDF text layer
package-tools	Current local-first v0.2.0 release; dedicated repository	Inspect and compare ZIP/ZIP64 compound packages	ZIP/ZIP64 tree and risk diagnostics; EPUB, OOXML, ODF, JAR, APK and WebExtension adapters; relationships, manifests and orphan evidence; signature-material/digest plus dependency/licence inventories; bounded text/media preview and verified entry download/share; decompressed SHA-256 comparison with safe semantic diffs; JSON inventory export	Inspection is not a specialized renderer, APK signing-block decoder, signature/trust verifier, dependency resolver, vulnerability scanner or legal licence interpretation; encrypted, split, unsafe, unsupported and over-budget entries stay inventory-only; an explicitly chosen OS share target may upload an entry even though the app itself does not
label-tools	Current local-first v0.2.0 release; dedicated repository	Merge local records into printable labels, badges and asset tags	CSV/JSON mapping; visual text/image/barcode/shape template designer with drag, keyboard and exact-unit positioning; serial/random values; ten QR/1D/2D barcode formats; stock/custom grids, calibration and marks; template JSON; paginated preview; physical-size SVG, deterministic multi-page ZIP and vector PDF export	2 MiB/2,000-row/100-field data bounds and bounded images/pages; stock names are geometries, not vendor certification; system fonts are not embedded; vector PDF uses built-in Helvetica/WinAnsi, visibly replaces unsupported characters and omits WebP images, so it is print-dimensioned rather than archival/press quality
font-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, compare, preview and prepare local fonts	TTF, OTF, WOFF, WOFF2, TTC and OTC metadata/tables; Unicode coverage, variable axes, GSUB/GPOS inventories and embedding signals; sandboxed shaping/fallback comparison; safe CSS; validated collection face selection; rights-confirmed static glyf/CFF subset with loss report	Disposable eight-second worker and strict file/table/face/glyph bounds; WOFF2 is decoded locally and TTC/OTC faces are reconstructed only for bounded in-memory preview; WOFF2/collection subset and collection export remain disabled; fsType is technical evidence, variable flattening is unsupported and browser shaping is not a HarfBuzz reference
fixture-tools	Current local-first v0.2.0 release; dedicated repository	Generate deterministic synthetic test fixtures	Focused JSON Schema, SQL DDL, XSD, CSV-heading and portable-model import; scalar/composite uniqueness and foreign keys; dependency-topological generation with uniform, sequential, normal and constant distributions; boundary/intentional-negative cases and a violation ledger; coverage matrix; person/network/commerce provider profiles; JSON/CSV/NDJSON/XML/SQL/recipe export	Importers are documented subsets; remote references, schema code, database access, XML entities, unsupported XSD/SQL constructs and cyclic relational recipes are rejected; 2 MiB input, 20 tables, 100 fields/table, 50,000 rows, 100,000 values and 8 MiB/output caps; synthetic data is not anonymization and seeded output is reproducible, not secret
minimize-tools	Current local-first v0.2.0 release; dedicated repository	Reduce failing inputs while continuously preserving a selected predicate	Line/token/code-point and structure-aware JSON/XML reduction; literal, syntax, timing, isolated-regex, focused JSON Schema and restricted local-XSLT predicates with failure-signature preservation; single/majority/strict retry voting and flaky evidence; bounded multi-file bundle adapters; budgets, cancellation and deterministic minimized-case/trace/report export	Locally minimal under attempted transformations and budget, not globally shortest; schema/XSLT subsets fail closed; 2 MiB input, 2,000-test/30-second, one-second-regex and 200-XSLT-test caps; bundles are limited to 100 files/4 MiB and adapters neither emulate a filesystem nor execute a target program
format-lab	Current local-first v0.2.0 release; dedicated repository	Explore conversion paths and measure representative round-trip loss	Conservative data/image/AV/subtitle format graphs; executable JSON/NDJSON/CSV/typed-XML record conversion; property selection and loss-aware path ranking; measured round trips beside catalogue expectations; versioned evidence envelopes and catalogue export; masked-offset signature catalogue; deterministic edge-case corpus and reports	Media graphs plan handoffs rather than duplicate codecs; executable conversion handles bounded canonical records, not arbitrary documents; catalogue expectations are not file measurements; signature hits suggest likely containers but do not validate safety or format conformance; catalogue-only formats are not claimed executable
repro-tools	Current local-first v0.2.0 release; dedicated repository	Build, compare, sign and package reproducible local file inventories	Cancellable streamed SHA-256/SHA-512 manifests with deterministic paths and JSON/CSV; reference comparison; fixed-metadata ZIP; streaming ZIP-content manifests and compression-independent comparison; CycloneDX/SPDX/npm-lock inventory with portable evidence and explicit non-conformant local provenance; optional memory-only P-256 signature envelope	64 MiB/file, 256 MiB/selection and 10,000-entry caps; ZIP creation is capped at 128 MiB and inspection at 5,000 entries/256 MiB expanded; signatures prove integrity only relative to an independently authenticated public key and are intentionally not byte-reproducible; provenance makes no SLSA, authority or builder-identity claim
schema-tools	Hardened local-first v0.2.0 release; dedicated repository	Inspect, validate, compare and derive examples from schema workspaces	Local JSON Schema/OpenAPI reference graphs; focused JSON Schema validation; OpenAPI operation/sample/change analysis; XSD, Relax NG and Schematron structure; bounded heuristic XML samples	Remote/escaping references, entities, code and XPath are blocked; JSON Schema/OpenAPI support is a documented subset, while XML languages receive structural inspection rather than complete instance validation; shared work/node/depth/text/output budgets, linear cached traversal and well-formed XML fallbacks are regression-tested
log-tools	Current local-first v0.2.0 release; dedicated repository	Stream, inspect, correlate, redact and export large logs	Incremental UTF-8 file scan; plain, JSONL, nginx, syslog and logfmt parsing with configurable Java/.NET/Python/generic multiline assembly; whole-scan aggregates; bounded multi-file temporal merge with trace/span and request-ID correlation; search/filter and deterministic redaction; OTLP/JSON plus CSV/NDJSON/text export, including a complete cancellable second pass with direct-file or bounded-Blob output	Eight-GiB gate and five-million-line stop without whole-file strings; interactive search/redaction uses a 10,000-record/32 MiB preview, while complete single-source export reapplies filters and recipes in a second streaming pass; multi-file correlation uses explicitly bounded retained evidence; parsers and auto/multiline detection are focused heuristics
binary-tools	Current local-first v0.2.0 release; dedicated repository	Convert, inspect and decode byte-oriented values	Synchronized UTF-8/hex/Base64/Base32/Base58; checked byte insert/replace/delete; exact and wildcard search with isolated-worker deadline; paged byte inspector and endian integer/float/timestamp interpretations; bookmarks and audited PNG/RIFF/ELF templates; CBOR, MessagePack, strict DER and schema-assisted Protocol Buffers	Inert with no requests or evaluation; 1 MiB input/edit/output, depth-64 and 10,000-node bounds; Base58 and search patterns are capped at 4 KiB and large searches use a five-second disposable worker; protobuf groups/full generated runtime and complete template-based format validation are out of scope
git-tools	Current local-first v0.2.0 release; dedicated repository	Inspect and author Git interchange text without repository access	Unified/git patch inspection and bounded authoring; exact atomic patch apply/reverse against explicit text snapshots with JSON/ZIP export; layered .gitignore plus tracked-state explanations; root .gitattributes evaluation; SemVer ranges; Conventional Commit build/lint and advisory release plan; changelog normalization	Patch/diff-matrix/snapshot bounds; patch application is exact, atomic and text-only against an explicit local JSON snapshot; ignore analysis models layered supplied global/info/nested sources and tracked state but not command-line excludes or submodule boundaries; attribute macros/nested attribute files are unsupported; no workspace or .git access
api-tools	Current local-first v0.2.0 release; dedicated repository	Inspect and compare HTTP and event API descriptions and check saved HTTP evidence	Bounded JSON/YAML OpenAPI 3.0–3.2 and AsyncAPI 2.0–3.1; local multi-file $ref; path/webhook/channel/message navigation; security inventory and focused examples; inert curl/Fetch/Python text; conservative revision comparison; HAR 1.2 coverage and focused contract checks	Never executes HTTP, opens a broker connection, follows URLs, resolves remote references or stores credentials; focused OpenAPI/AsyncAPI/JSON Schema validation, examples and HAR checks are not a complete validator, code generator, HTTP/broker client, proxy or security scanner
mail-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, thread, compare, download and redact EML/MIME and mbox content	Original-octet EML/MIME with RFC 2047 and RFC 2231 headers; bounded multipart/nested-message tree; Base64/quoted-printable and byte-safe attachments; mbox/mboxrd threading/search; text and opaque sandboxed HTML with safe local CID images; auth-header diagnostics plus pasted-key RSA/Ed25519 DKIM verification; canonical and deeper redacted export	Remote/active HTML is removed and never loaded; no mail/DNS contact, mailbox client, decryption, sender-identity, malware or anonymity claim; local DKIM verification proves preserved bytes only against the pasted key and cannot establish that key's authenticity or currency; canonical/redacted export does not promise byte identity
calendar-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, repair, merge and reconcile iCalendar data	RFC 5545 events, VTODO, VJOURNAL, VFREEBUSY, VALARM, attendees and VTIMEZONE; recurrence preview with moved/cancelled/duration-changing/RANGE=THISANDFUTURE overrides; duplicate/overlap diagnostics and UID/RECURRENCE-ID merge; canonical repair and DST evidence; agenda/month views, bounded event/task authoring and free-slot planning; lossless jCal and focused JSCalendar Event/Task interchange	4 MiB plus line/component/event and recurrence-horizon caps; browser IANA data and focused recurrence interpretation are evidence, not a calendar-server implementation; JSCalendar is a focused Event/Task adapter with explicit loss warnings
contact-tools	Current local-first v0.2.0 release; dedicated repository	Inspect, edit, convert and reconcile sensitive contacts	vCard 2.1/3/4 parsing, core editing and canonical export; bounded quoted-printable/Base64 decoding plus grouped and unmapped-property preservation; inferred reviewable CSV mapping; jCard and focused JSContact import/export with loss evidence; duplicate candidates, conflict-reporting merge and bounded local vCard QR	2 MiB, 50,000-line and 2,000-contact caps; encoded properties are capped at 64 KiB and malformed encodings retain raw evidence; JSContact support is focused and unsupported values are surfaced rather than silently lost; no persistence or telemetry
diagram-tools	Current local-first v0.2.0 release; dedicated repository	Author safe deterministic text diagrams and export accessible graphics	Independent script-free flow/graph, sequence, class, state, entity-relationship, mind-map and timeline grammars; line diagnostics, examples, pan/zoom, normalized JSON, deterministic SVG/2× PNG and accessible textual outline/source export	Not full Mermaid or Graphviz; directives, clicks, styles, scripts, HTML and remote assets are rejected; 50,000-character, 2,000-line, 200-node, 500-edge and 20-megapixel caps
token-tools	Current local-first v0.2.0 release; dedicated repository	Edit, validate, theme and export design tokens	DTCG-style nested $type/$value JSON with inherited groups plus local sets/themes/modes; recursive aliases inside composite values with cycle/missing/type diagnostics; colour, dimension, duration, font, Bézier, stroke, border, transition, gradient, typography, shadow and scalar tokens; W3C-style JSON, CSS, Sass, Android and Swift export with collision and loss reports	The $sets/$themes wrapper is app-specific; 1 MiB, depth-64, 10,000-token and 50,000-node bounds; malformed wrappers, unknown types and token/group conflicts fail explicitly; Android/Swift composite output requires project conventions and unsupported values are reported as losses
device-tools	Current local-first v0.2.0 release; dedicated repository	Inspect browser capability evidence without creating a device fingerprint	Passive context/display/input/accessibility/media/storage/PWA/API inventory; individually initiated permission, storage, WebGL/WebGPU, media-device, battery, network, camera, microphone and screen probes; pasted Toolbox-manifest compatibility analysis with required/optional/unknown capability evidence; opt-in MediaCapabilities codec lab; deterministic bucketed JSON/CSV reports	No identifier, uniqueness score, high-entropy report, recording, persistence, canvas/audio fingerprint or passive permission prompt; sensitive probes are exact-path and individually initiated, returned tracks stop immediately, and downloaded reports bucket precision; results are capability evidence, not a reliability guarantee

Planned tools

No unreleased applications are currently listed here. New ideas should be added only after their intended local-processing boundary and first honest release scope are documented; shipped applications remain in the Existing tools table.

Licensing

Portal source is AGPL-3.0-only; see LICENSE. The contract is Apache-2.0, and each assembled application retains its own licence and notices. An assembled ZIP/container is an aggregate of those independently licensed components; see THIRD_PARTY_NOTICES.md and each apps/<slug>/LICENSES/ directory.