tool: a Tools tab and tfg tool, with checksums as the first tool

.github/workflows/ci.yml

@@ -1016,7 +1016,7 @@ jobs:
         # in somebody else's file.
         run: |
           set -euo pipefail
-          watched='internal/format/registry.go internal/damage/damage.go cmd/tfg/main.go internal/gui/window/run.go internal/gui/run_cgo.go internal/gui/window/tidy.go internal/audit/parallel.go internal/engine/parallel.go go.mod .github/workflows/ci.yml .github/build-tags'
+          watched='internal/format/registry.go internal/damage/damage.go cmd/tfg/main.go internal/gui/window/run.go internal/gui/run_cgo.go internal/gui/window/tidy.go internal/audit/parallel.go internal/engine/parallel.go internal/tool/tool.go internal/gui/window/tools.go go.mod .github/workflows/ci.yml .github/build-tags'
           # On a pull request there is no "before" - the field belongs to a push
           # - so this asked for something empty and every pull request answered
           # "touched". That quietly undid the decision of 2026-08-20, because

CHANGELOG.md

@@ -16,6 +16,14 @@ because it turns other people's test suites red.
 
 ### Added
 
+- **A Tools tab, and `tfg tool`.** Small things to do with files you already
+  have, in the window and on the command line with the same settings. The
+  first works out the checksum of a file - md5, sha1, sha256, sha512 or crc32,
+  sha256 unless you ask - and compares it with one you were given, telling the
+  algorithm from its length: `tfg tool checksum file.iso --expected
+  <checksum>`. A checksum that does not match ends with code 7, the same as
+  `tfg verify`. The file is only read. `tfg tool list` and `tfg tool show
+  <id>` say what there is, both with `--json`.
 - **The window in Polish, and a Preferences tab.** The window now speaks the
   language your system is set to when it has that language, and English
   otherwise - so on a system set to Polish it opens in Polish. Preferences
@@ -96,6 +104,11 @@ because it turns other people's test suites red.
   the file to remove, instead of calling an empty file the record of an
   earlier run.
 
+- **Ctrl+Enter, Ctrl+P and Escape act on the tab you are looking at.** With
+  About on show, Ctrl+Enter used to run Generate on the last work tab you had
+  left, which you could not see, and Escape could stop a run there. On a tab
+  with nothing to run the three keys now do nothing.
+
 ## [0.4.0] - 2026-09-25
 
 ### Changed

README.md

@@ -285,6 +285,7 @@ tfg recipe fmt  print a recipe in its settled shape
 tfg preset      build a set of files from a named test question
 tfg formats     list the formats this build supports
 tfg damage      list the ways this build can break a file on purpose
+tfg tool        small things to do with files you already have
 tfg version     print the tool version
 tfg license     print the licence and what it means for generated files
 ```
@@ -380,6 +381,21 @@ tfg formats [--json]     every format, with fidelity, determinism and smallest s
 tfg formats <id>         what a single format accepts
 ```
 
+### `tfg tool`
+
+```
+tfg tool list [--json]                          the tools this build has
+tfg tool show <id> [--json]                     what one tool works on and takes
+tfg tool checksum <file> [--algorithm sha256] [--expected <checksum>] [--json]
+```
+
+Small things to do with files you already have, beside the generator. Every tool
+is also on the Tools tab of the window, with the same settings. The first one
+works out the checksum of a file - md5, sha1, sha256, sha512 or crc32, sha256
+unless you ask - and compares it with one you were given, telling the algorithm
+from its length. A checksum that does not match ends with code 7, the same as
+`tfg verify`. crc32 is the one ZIP and PNG use, not the one `cksum` prints.
+
 ### `tfg damage`
 
 ```
@@ -666,8 +682,8 @@ not a cut down version: a test compares the two interfaces capability by
 capability, and anything only one of them can do has to be declared and
 justified rather than quietly drifting apart.
 
-Five screens - one batch, presets, several batches at once, preferences, and
-about. It shows what a run would cost before writing anything, reports progress
+Six screens - one batch, presets, several batches at once, tools, preferences,
+and about. It shows what a run would cost before writing anything, reports progress
 while it runs, and can be cancelled part way without leaving a half written file
 behind. The window speaks your system's language when it has it (English and
 Polish today) and English otherwise. Preferences lets you choose another, and

internal/cli/cli.go

@@ -20,6 +20,7 @@ import (
 	"github.com/donislawdev/TestingFilesGenerator/internal/engine"
 	"github.com/donislawdev/TestingFilesGenerator/internal/format"
 	_ "github.com/donislawdev/TestingFilesGenerator/internal/format/all"
+	_ "github.com/donislawdev/TestingFilesGenerator/internal/tool/all"
 )
 
 // Exit codes are a frozen contract. Changing what one means is a breaking

internal/cli/commands.go

@@ -99,6 +99,7 @@ func commands() []command {
 				return damageCmd(args, out, errOut)
 			},
 		},
+		{Verb: "tool", Summary: "small things to do with files you already have", Run: toolCmd},
 		{
 			Verb: "version", Aliases: []string{"--version"},
 			Summary: "print the tool version",

internal/cli/errors.go

@@ -19,6 +19,7 @@ import (
 	"github.com/donislawdev/TestingFilesGenerator/internal/manifest"
 	"github.com/donislawdev/TestingFilesGenerator/internal/preset"
 	"github.com/donislawdev/TestingFilesGenerator/internal/recipe"
+	"github.com/donislawdev/TestingFilesGenerator/internal/tool"
 )
 
 // describeError renders an error for a person, in English, whatever language
@@ -145,6 +146,9 @@ func mustBeFile(path, kind, command string) error {
 // subject changes is the cut that costs nothing to read: a caller still asks
 // one question and gets one number.
 func classify(err error) int {
+	if code, ok := classifyTool(err); ok {
+		return code
+	}
 	if code, ok := classifyRequest(err); ok {
 		return code
 	}
@@ -170,6 +174,23 @@ func classify(err error) int {
 	return ExitRuntime
 }
 
+// classifyTool covers the refusals of a tool, which say what kind they are
+// (tool.Classified) - so a tool added tomorrow ends with the right code and
+// nothing here names it.
+func classifyTool(err error) (int, bool) {
+	var refusal tool.Classified
+	if !errors.As(err, &refusal) {
+		return 0, false
+	}
+	switch refusal.Class() {
+	case tool.Asked:
+		return ExitUsage, true
+	case tool.Reading:
+		return ExitIO, true
+	}
+	return 0, false
+}
+
 // classifyRequest covers what was asked for: the recipe, the preset and what
 // the format can deliver.
 func classifyRequest(err error) (int, bool) {