@extension.dev/mcp 10.1.0 → 10.2.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "10.1.0",
+      "version": "10.2.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "10.1.0",
+  "version": "10.2.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## 10.2.0
+
+A production walk of the full share-and-publish loop, then a fix for every
+roughness it surfaced, on top of a week of engine tracking and preview
+hardening. Everything landed since 10.1.0 ships here; the 10.1.1 version
+bump was never published and is folded in.
+
+- Revoking a share accepts the ids the platform actually mints: `gen_` plus
+  64 hex characters, with the older 32-character form still valid. A
+  malformed reference is refused by name, with what a real id looks like,
+  instead of being silently cut down to a 32-character prefix that revokes
+  nothing while reporting the wrong cause.
+- Every revoke handle the tools return points at `www.extension.dev`
+  directly, so one plain DELETE works. The apex `extension.dev` answers
+  DELETE with a redirect, and a caller that does not follow redirects got
+  "Redirecting..." back while the share stayed live.
+- `extension_doctor` hands over the CLI's own report when the engine exits
+  nonzero with output the server cannot parse: the response carries
+  `cliReport`, the doctor's actual check list and remediations, instead of
+  discarding it and guessing that the local CLI is stale.
+- `extension_inspect` with no `url` ranks the extension's own surfaces
+  first and the toolchain's pages last, so it no longer inspects the
+  Extension.js welcome surface and reports on the wrong document. When only
+  toolchain or override pages are open, a warning names exactly which page
+  was inspected and how to target yours.
+- `extension_publish` against a host where the token's project does not
+  exist now says what to do: check the token's scope with `extension_auth`,
+  create the project first at extension.dev/new, or log in against a
+  project that exists there.
+- `extension_auth status` asks the platform who the stored credential
+  really is instead of trusting the file on this machine, and reports the
+  three answers apart: the server confirmed it, the server refused it and
+  the workspace shown is only a local claim, or the server could not be
+  reached and nothing here is server confirmed. A credential minted against
+  a development deployment reads as refused where production refuses it,
+  which is what it always was and never said.
+- The MCP `isError` flag now agrees with the envelope: every `ok: false`
+  result is marked `isError: true`, so an agent branching on the transport
+  flag no longer reads a platform refusal, a publish 404 or an auth 401, as
+  success.
+- `extension_preview_web` with `share: true` no longer fails a working
+  share because the local dev lane is dead: the uploaded link is what was
+  asked for, so the result is `ok: true` with status `shared` and a warning
+  naming the unreachable local leg, which is expected outside the
+  extension.dev monorepo.
+- The Extension.js engine pin moved to 4.0.20, the server asks the engine
+  its version and JSON support from its published capabilities instead of
+  paying for a second build to find out, and a canary pin no longer parses
+  to NaN.
+- Safari packaging lets an agent name the app and bundle id it is
+  packaging, and the docs say what a derived bundle id actually costs a
+  developer instead of claiming Apple rejects it.
+- Preview and share housekeeping: `hostUrl` is pinned to a local server,
+  stale carriers are cleared on start and swept on every exit, re-sharing
+  is documented for what it really does, and the CORS verdict is read off
+  the last hop a browser would follow.
+- The offline template fallback points at the published corpus, three
+  control refusals are told apart instead of sharing one message, and a
+  stray binary file no longer ships in the package.
+
 ## 10.1.0
 
 A six-lens audit of the whole surface (auth, platform, run, see, act and

package/README.md

@@ -17,7 +17,7 @@ claude mcp add extension-dev npx @extension.dev/mcp
 
 Works with Claude Code, Claude Desktop, Cursor, and any MCP client.
 
-[extension.dev](https://extension.dev) · [Documentation](https://extension.js.org) · [Templates](https://templates.extension.dev) · [Examples](https://github.com/extension-js/examples) · [Discord](https://discord.gg/v9h2RgeTSN)
+[extension.dev](https://extension.dev) · [Extension.js](https://extension.js.org) · [Templates](https://templates.extension.dev) · [Examples](https://github.com/extension-js/examples) · [Discord](https://discord.gg/v9h2RgeTSN)
 
 ## Why an MCP server for extensions
 
@@ -134,7 +134,7 @@ Browser-launching tools (`dev`, `start`) shell out to the `extension` CLI, the p
 
 ## Sharing a build in progress
 
-An unpacked extension is unusually hard to hand to someone: the only way to look at a colleague's work-in-progress has been to take their zip and run untrusted code with real browser permissions on your own machine. `extension_preview_web` with `share: true` uploads the `dist/` it just built and returns a link that renders those exact bytes in the emulator. Whoever opens it installs nothing and signs in to nothing, which is what lets a designer, a PM, or a reviewer into the loop at all. Sharing needs auth (`extension_auth` or `EXTENSION_DEV_TOKEN`), the link expires, and `DELETE`ing the returned `revokeUrl` with the same token kills it early. Revocation is permanent and re-sharing mints a new link, so that `revokeUrl` is the only handle to the link you just made; every share is also appended to `.extension.dev/shared-previews.json` in the project (gitignored) so it survives losing the tool output. Without `share`, the tool returns a local-only deep link and uploads nothing.
+An unpacked extension is unusually hard to hand to someone: the only way to look at a colleague's work-in-progress has been to take their zip and run untrusted code with real browser permissions on your own machine. `extension_preview_web` with `share: true` uploads the `dist/` it just built and returns a link that renders those exact bytes in the emulator. Whoever opens it installs nothing and signs in to nothing, which is what lets a designer, a PM, or a reviewer into the loop at all. Those bytes run in an isolated sandbox origin or they do not run at all: preview refuses a shared build rather than serving it in its own renderer. Sharing needs auth (`extension_auth` or `EXTENSION_DEV_TOKEN`), the link lives 30 days, and `DELETE`ing the returned `revokeUrl` with the same token kills it early. Re-sharing an unchanged build returns that same link rather than a second one, and only a revoked link is replaced by a different one, because revocation is permanent: the address is burned and never resolves again. That makes `revokeUrl` the handle to the link you just made, so every share is also appended to `.extension.dev/shared-previews.json` in the project (gitignored) so it survives losing the tool output. The upload holds up to 2,000 files and about 64MB of text, or roughly 48MB when the build is mostly images, fonts or wasm, which travel base64-encoded. Without `share`, the tool returns a local-only deep link and uploads nothing.
 
 `extension_shares` is the other half of that: it lists every link the token has shared, live and dead, with the `previewUrl` and `revokeUrl` of each, and revokes one by `artifactId` or by pasting any of its URLs. Pass `projectPath` and it reconciles the platform's answer with the project's own record, so a link shared from another machine shows up as `remoteOnly` and a record with nothing behind it any more shows up under `localOnly`. It never rewrites the local file.
 
@@ -155,8 +155,9 @@ All of it rides on [Extension.js](https://github.com/extension-js/extension.js),
 
 ## Community
 
-- Join the [Discord](https://discord.gg/v9h2RgeTSN) for help and feedback
-- Browse production-ready [examples](https://github.com/extension-js/examples)
+- Join the extension.dev [Discord](https://discord.gg/v9h2RgeTSN) for help and feedback
+- Browse production-ready templates at [templates.extension.dev](https://templates.extension.dev)
+- Follow the platform's public packages on [GitHub](https://github.com/extensiondev)
 - Report Extension.js framework issues on [GitHub](https://github.com/extension-js/extension.js/issues)
 
 ## License