
Company News
Socket Has Acquired Secure Annex
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.
@arcanejs/toolkit
Advanced tools
Build web-accessible control interfaces for your long-running Node.js processes
@arcanejs/toolkitCore server/runtime package for ArcaneJS control panels.
@arcanejs/toolkit provides:
Group, Button, Switch, etc.)tree-full + tree-diff)Most users should pair this with @arcanejs/react-toolkit, but this package can also be used directly.
npm install @arcanejs/toolkit
If you use the default Arcane frontend renderer, install React peers:
npm install react@^19.2.0 react-dom@^19.2.0
import { Toolkit, Group, Button, Label } from '@arcanejs/toolkit';
const toolkit = new Toolkit({
title: 'My Control Panel',
path: '/',
});
toolkit.start({
mode: 'automatic',
port: 3000,
});
const root = new Group({ direction: 'vertical', title: 'Controls' });
const status = new Label({ text: 'Idle' });
const trigger = new Button({
text: 'Run',
onClick: async () => {
status.setText('Running...');
await doWork();
status.setText('Done');
},
});
root.appendChildren(status, trigger);
toolkit.setRoot(root);
ToolkitButton, Group, GroupHeader, Label, Rect, SliderButton, Switch, Tab, Tabs, TextInput, TimelineToolkitOptions, ToolkitConnection, ToolkitRenderContext, ToolkitServerListenerOptions, ToolkitServerListener, AnyComponent@arcanejs/toolkit/components/*: component classes and types@arcanejs/toolkit/components/base: Base, BaseParent, EventEmitter, related types@arcanejs/toolkit/frontend: browser entrypoint helpers (startArcaneFrontend)@arcanejs/toolkit/util: utility exports like HUE_GRADIENT and IDMapstartArcaneFrontend(...) supports:
renderers: frontend component renderer listthemeRootProps?: React.HTMLAttributes<HTMLDivElement> (root theme container props)loadingState?: () => ReactNode (custom render output while waiting for initial websocket metadata/tree sync)Theme switching is handled by Arcane via root classes (theme-auto, theme-dark, theme-light). Theme customization is CSS-only by overriding Arcane CSS variables in your entrypoint stylesheet.
Toolkit.start(...) supports three modes:
automatic: creates internal HTTP + WebSocket server on a portexpress: attaches websocket handling + route mounting to existing Express/HTTP servermanual: gives direct access to Server for custom integrationToolkit.listen(...) is also available when you want direct lifecycle control and a closable listener handle.
new Toolkit(options) supports:
title?: string: page titlepath: string (default: /): route prefix where Arcane UI is servedlog?: Logger: optional logger (debug, info, warn, error)entrypointJsFile?: string: custom frontend bundle path for custom namespaces/components. ArcaneJS expects a same-basename stylesheet (.css) to exist for this entrypoint so styles can be served automatically. Source maps (.js.map, .css.map) are optional and exposed when present.materialIconsFontFile?: string: explicit path to material-symbols-outlined.woff2 when auto-resolution is not possibleadditionalFiles?: Record<string, () => Promise<{ contentType: string; content: Buffer }>>: additional static files served from the toolkit path. Keys are relative request paths (for example styles/app.css -> /your-path/styles/app.css), and must not start with /.htmlPage?: (context) => string | Promise<string>: custom HTML renderer for the root route. Context includes:
coreAssets: URLs for built-in toolkit static assets (materialSymbolsOutlined, entrypointJs, entrypointJsMap, entrypointCss, entrypointCssMap)assetUrls: URL mapping for all static assets by relative path (core + additionalFiles)title, pathclockSync?: false | { pingIntervalMs: number }: optional browser/server clock synchronization. When enabled via object options, frontend stage context exposes timeDifferenceMs and lastPingMs.Important constraint:
path must start and end with / (for example: /, /control/)When using entrypointJsFile, build your browser bundle with
@arcanejs/build-utils:
arcane-build-frontend \
--entry src/frontend.tsx \
--outfile dist/custom-entrypoint.js \
--sourcemap
Import @arcanejs/toolkit-frontend/styles/core.css in the entrypoint so Arcane
core styles are included in the emitted .css sidecar.
Toolkit emits:
new-connection: when a browser connectsclosed-connection: when a browser disconnectsUse toolkit.getConnections() to inspect active connections. Each connection has a stable uuid.
Core components are stateful server objects. Notable interaction behavior:
Button uses request/response call flow (press action)Switch and SliderButton support controlled and uncontrolled usageTextInput updates value from browser messagesGroup supports editable titles and collapsible defaults (open, closed, auto)Tabs only accepts Tab childrenToolkit.setRoot(...) can only be called once@arcanejs/react-toolkit: React renderer for composing server-side component trees@arcanejs/toolkit-frontend: browser renderer components and stage context@arcanejs/protocol: wire protocol types@arcanejs/diff: JSON diff/patch engineFAQs
Build web-accessible control interfaces for your long-running Node.js processes
The npm package @arcanejs/toolkit receives a total of 159 weekly downloads. As such, @arcanejs/toolkit popularity was classified as not popular.
We found that @arcanejs/toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.

Product
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.