@extension.dev/mcp 10.10.1 → 10.10.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "10.10.1",
+      "version": "10.10.3",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "10.10.1",
+  "version": "10.10.3",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,219 @@
 # Changelog
 
+## 10.10.3
+
+- The engine pin moves off the canary to Extension.js `4.1.31` stable:
+  `extension_dev`, `extension_start` and `extension_build` spawn that
+  release when a project has no engine of its own, and the nightly
+  engine-pin check reads it against `latest` again.
+
+- A human now approves a real store submission and a promotion to stable
+  before either runs, by default. The first call answers
+  `approval-required` with an `approvalUrl` on extension.dev
+  (`/device/approve/<id>`) and an `approvalId`; once a workspace member
+  approves (an owner, for a submission), the same call with that
+  `approvalId` runs exactly that action, once. Promotions to other channels
+  and share revokes stay ungated unless `EXTENSION_DEV_APPROVAL_GATE=1`;
+  `EXTENSION_DEV_APPROVAL_GATE=0` turns the default off. Whatever the
+  setting, a platform that answers `APPROVAL_REQUIRED` now gets the same
+  approval flow instead of a bare failure.
+
+- Two server flags narrow what an agent can reach. `--features=local`
+  or `--features=platform` (env `EXTENSION_DEV_FEATURES`) lists one tool
+  group; `local` alone is about 40% smaller. `--no-ship` (env
+  `EXTENSION_DEV_NO_SHIP`) hides `extension_publish` and
+  `extension_release_promote` and refuses a real submit, a share link and
+  a share revoke, while dry runs and listing keep working. A refused call
+  answers the new code `E_TOOL_DISABLED` with the flag to change. Both
+  default to everything on, so no existing setup changes.
+- Every tool now carries MCP annotations (`readOnlyHint`,
+  `destructiveHint`, `idempotentHint`, `openWorldHint`) from one policy
+  table, so clients can auto-approve reads and ask before the rest. A
+  merged tool takes its worst action: `extension_shares` is destructive
+  because revoke is.
+- A device-flow step waiting on a human (`extension_auth` login,
+  `extension_project_create`, `extension_workspace_create`) now answers
+  `ok: true` with `status: "authorization-pending"` and no error, instead
+  of `ok: false` with `E_AUTH_PENDING`, so clients stop rendering the
+  first login step as a failure. The approval link and code stay in
+  `hint` and `value`; `E_AUTH_PENDING` is retired.
+
+## 10.10.2
+
+- The engine pin moves to the Extension.js canary
+  `4.1.31-canary.1791055414.4bbb683a` (ruled 2026-10-01, refreshed
+  2026-10-03 when the canary moved on): `extension_dev`,
+  `extension_start` and `extension_build` spawn that build when a project
+  has no engine of its own, and the nightly engine-pin check now reads a
+  canary pin against the canary dist-tag instead of latest. The canary's
+  log query treats level `off` as none (it was a synonym for all), which
+  changes nothing for `extension_logs`, whose `off` stays "signals only".
+  The canary also adopts a project root only when it owns the manifest
+  (same folder, the `src/manifest.json` layout, a dependency on
+  Extension.js, or an `extension.config.*` beside it) and otherwise builds
+  into the manifest's own folder; the session artifact resolver here
+  applies the same four tests, so `extension_wait` and `extension_logs`
+  keep reading the ready.json the engine writes.
+- Logins to several projects now live side by side in `auth.json`, one
+  entry per workspace/project with the latest marked active, instead of
+  one slot the next login overwrote. `extension_publish`,
+  `extension_release_promote`, `extension_submit`, `extension_shares` and
+  `extension_preview_web` take `project` ('<workspace>/<project>', or a
+  project slug that matches one login) to pick a stored login, which
+  outranks `EXTENSION_DEV_TOKEN`; omitted, the order stays environment
+  first, then the active login. `extension_auth` status lists every login
+  under `logins`, and logout with `project` removes just that one. A
+  version 1 file is read as a store of one and rewritten on the next login
+  (BUGS_TO_FIX_MCP.md entry 36).
+- Four findings from the six-browser sweep (BUGS_TO_FIX_MCP.md entries 40
+  to 43): `extension_open` reads new headless off the `User-Agent` field
+  of `/json/version` as well (`--headless=new` keeps `Chrome/151` in the
+  `Browser` field) and, whatever the launch flags said, falls back to the
+  tab route on any window refusal: Chromium's gesture refusal for a popup,
+  an options or popup window the engine called opened but no document
+  appeared for within 3 s, and Gecko's "Popup is disabled"; a Gecko
+  browser that gets Chromium's gesture sentence (the engine counts every
+  non-Firefox name as Chromium, extension.js ledger 642) is answered with
+  Gecko wording; and when the background refuses the `runtime.getURL` eval
+  the tab route needs (an extension CSP that forbids eval), the
+  `moz-extension://` base is read off the profile's
+  `extensions.webextensions.uuids` pref through the add-on id the built
+  manifest declares, so the fallback still lands (40). `extension_eval` context `background` wakes an idle
+  MV3 worker through `ServiceWorker.startWorker` from a page session
+  before evaluating, with a warning that it was idle, instead of answering
+  `E_NO_TARGET` (41). `extension_open surface: "devtools"` takes `waitMs`
+  and `reload` (reload the inspected tab once DevTools is open, for
+  extensions that create their panel when the page reports to them) and
+  the missing-panel hint names both (42). A page eval the PAGE's CSP
+  refuses on a Gecko MV2 build is re-run through `tabs.executeScript`, the
+  same wrapper the no-scripting-API case uses (43); an MV3 Gecko build
+  keeps the policy explanation, pending engine ledger 560.
+- `extension_eval` over CDP awaits a promise-valued expression again. The
+  CDP routes added for entries 29 and 31 passed `replMode` on every
+  `Runtime.evaluate`, and Chrome 151 answers a replMode evaluate with the
+  promise object itself, ignoring `awaitPromise`, so `Promise.resolve(42)`,
+  an async IIFE or `chrome.tabs.query({}).then(...)` read as `{}` with
+  `ok: true` on pages and workers alike. The evaluate now runs without
+  replMode, and only an expression Chrome refuses for a top-level `await`
+  is re-run in replMode with the promise settled through
+  `Runtime.awaitPromise` (BUGS_TO_FIX_MCP.md entry 39, a regression of
+  10.10.2's own, never released).
+- `extension_open` takes `surface: "devtools"` on Chromium: it opens the
+  browser's real DevTools on a tab (the one `url` matches, else the first
+  web page) through CDP `Target.openDevTools`, waits for the extension's
+  `devtools_page` to register its panel, shows it (`panel` picks a title
+  when there are several) and hands back the panel document's url, which
+  `extension_eval` reads with context `page` and that url, with
+  `chrome.devtools` available. Context `devtools` on `extension_eval` now
+  evaluates over CDP on an MV3 session like the other surfaces, and an
+  extension document lookup matches the iframe targets a DevTools panel
+  and its devtools page are. Works headed or headless (measured Chrome
+  151). Gecko gets a refusal that says no protocol opens its developer
+  tools (BUGS_TO_FIX_MCP.md entry 38).
+- `zen` and `floorp` join the browser enum of `extension_dev`,
+  `extension_start` and friends, the Gecko family, `extension_browsers`
+  detection (app bundles, Linux and Windows paths) and the process match
+  `extension_stop` uses, the same way waterfox is listed; the engine has
+  launched both since 4.1.26 (entry 37).
+- The dependency floors move past every advisory `pnpm audit` reported on
+  2026-09-30 (42: 18 high, 22 moderate, 2 low, all transitive): axios,
+  brace-expansion, fast-uri, js-yaml, nanoid, devalue, hono, ip-address,
+  qs and postcss-selector-parser through `pnpm.overrides`, vitest to 4.1.11
+  as a dev dependency. The audit reads zero; nothing the server does
+  changes.
+- The bundled template catalog moves to the corpus at `2c3a486a`, which
+  renamed the `new-*` examples to `newtab-*` and added the `devtools-*`
+  family and `sidebar-monorepo-nx`. `extension_add_feature`'s newtab row
+  now names `newtab`, `newtab-react`, `newtab-vue`, `newtab-svelte` and
+  `newtab-preact`; the catalog-sync PR had failed on the old names every
+  day since 2026-09-26 (BUGS_TO_FIX_MCP.md entry 14).
+
+Nine findings from a session that brought ten third-party extensions under
+the server in one day (BUGS_TO_FIX_MCP.md entries 15 to 27; the ones this
+release closes are 16 to 19 and 21 to 25):
+
+- `extension_dev` and `extension_start` spawn the engine in the project
+  directory, not where the MCP client started the server, so the engine a
+  session drives is the project's own and the started envelope names it
+  under `value.engine` (entry 25).
+- Every session artifact path (ready.json, logs, the build summary) now
+  resolves from the engine's project root, the nearest package.json,
+  deno.json or deno.jsonc at or above the manifest, so a project whose
+  manifest sits in a subfolder no longer makes `extension_wait` watch a
+  contract the engine never writes (entry 23).
+- A failed `extension_build` carries the compiler errors the engine stamped
+  on its contract under `value.errors`, or the bundler's own output under
+  `value.output`, and its hint no longer asserts a manifest location the
+  engine does not require (entry 16).
+- `extension_wait` on an `extension_start` session answers `launched` at
+  once with the production-build guidance instead of spending its budget on
+  a "transient" `E_NOT_ATTACHED` that is permanent there; a clamped budget
+  is reported in `warnings` on every exit; and a dead-contract note names
+  only the browser the call asked about (entry 18).
+- `extension_eval` names the extension's own content security policy when
+  the engine refuses with "call to eval() blocked by CSP", instead of
+  blaming the expression (entry 19), and on MV2 Gecko a page or content
+  eval goes through `tabs.executeScript` from the background when the
+  engine has no scripting API, with the content-world caveat stated
+  (entry 24).
+- `extension_open` with a `url` opens a new tab unless `tab` names one, so
+  a page under test is never taken over; a path with no scheme resolves
+  against the extension's own origin on Chromium and Gecko (entry 21).
+- `extension_manifest_validate` reads `public/` when resolving manifest
+  references, warns rather than blocks on a missing web-accessible resource
+  and on a Chromium-only side panel, counts `devtools_page` and options
+  pages when ranking similar templates and ranks by surface overlap ratio,
+  and on Firefox warns on a missing `browser_specific_settings.gecko.id`,
+  on Chromium-only keys and on `extension_ids`, and gives an MV2 manifest
+  the keys to port for MV3 (entries 17 and 22).
+- `extension_start` takes `outputPath`, an existing unpacked extension
+  directory to launch as it is through the engine's preview verb, so an
+  artifact another toolchain produced, or the exact release candidate, can
+  be run and watched without an Extension.js build (entry 26). A directory
+  with no manifest.json is refused before anything launches.
+- `extension_manifest_validate` warns on Firefox when
+  `browser_specific_settings.gecko.data_collection_permissions` is missing,
+  which AMO now requires for new add-ons, and shows the minimal form.
+
+Seven more from the same session's functional sweep (entries 29 to 35):
+
+- `extension_eval` reaches the Chromium background over CDP: the MV3 service
+  worker or MV2 background page is a target of its own, and evaluating on it
+  is the inspector path the extension's content security policy does not
+  govern, so state only the worker knows is readable again under
+  `script-src 'self'`. An idle worker with no target answers `E_NO_TARGET`
+  with how to wake it (entry 29).
+- `extension_eval` with context `page` and a url evaluates on the matching
+  tab's CDP target, so a site that enforces Trusted Types (YouTube, Gmail)
+  no longer refuses the string; the active-tab refusal names Trusted Types
+  and the url route (entry 31). Every CDP route falls back to the in-bundle
+  relay when the session has no debug port.
+- `extension_open` asks the browser whether it is headless (HeadlessChrome
+  names itself) and renders popup, options and sidebar as a tab at once
+  when it is, instead of opening a popup that is gone before the next call
+  (entry 32). A page the browser swapped for its own error page answers
+  `navigate-blocked` with the browser's title instead of `navigated`, and
+  eval refuses such a tab (entry 35).
+- `extension_browsers` reports the newest managed version when several sit
+  in the cache, the one the engine launches (entry 30).
+- `extension_inspect` probes on Gecko return the same shape as on Chromium,
+  `{selector, count, samples[]}` with a text snippet per element
+  (entry 34).
+- `extension_assert` on Gecko reads `background-worker-booted` off the
+  control channel (the bridge executor runs in the background) and
+  `surface-rendered` off the surface relay, instead of answering
+  inconclusive for want of a CDP target list; a selector clause stays
+  inconclusive there and names the tool that probes it (entry 33).
+
+- `@extension.dev/urls` moves to `^0.8.1`, which reserves `chromium`,
+  `firefox`, `mcp` and `skill` as mint slugs.
+- `extension_browsers` install hands the canary's installer the server's
+  own managed-binary search as `locateInstalledBinary`, which that
+  installer now requires to verify an install before it reports success.
+- The stored login reader no longer types a missing entry as `undefined`
+  where it promises `null`, so consumers that compile the server's source
+  under `noUncheckedIndexedAccess` typecheck it.
+
 ## 10.10.1
 
 Five Gecko findings from one agent session on Firefox and Waterfox

package/README.md

@@ -7,7 +7,7 @@
 
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 30 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 31 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -26,7 +26,7 @@ Extensions fail silently: content scripts that never inject, panels that never o
 These tools give agents eyes on the live browser, so they debug from evidence instead of guessing:
 
 - **Scaffold** from the 50+ template catalog behind [templates.extension.dev](https://templates.extension.dev), or add a popup, sidebar, or content script to an existing project
-- **Run** the dev server with HMR in Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary, plus Safari on macOS (no HMR yet), no build config
+- **Run** the dev server with HMR in Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, Zen, Floorp, or any Chromium- or Gecko-based binary, plus Safari on macOS (no HMR yet), no build config
 - **See** the live DOM, unified logs from every extension context, `chrome.storage` contents, and the loaded-extension list
 - **Act**: evaluate code in any context, trigger the action button and commands, reload the extension, replay events
 - **Ship**: validate the manifest cross-browser, build for production, publish a shareable preview, and promote builds to release channels headlessly
@@ -75,6 +75,30 @@ Or install it as a plugin, the MCP server plus the `/extension`, `/extension-add
 }
 ```
 
+### Choosing what the agent can reach
+
+Two flags (or environment variables) narrow the server before an agent sees it:
+
+- `--features=local` exposes only the tools that work on this machine (create, run, inspect, build), which also cuts the tool list by about 40%. `--features=platform` exposes only the extension.dev account, share, release and store tools. Both are on by default. Env: `EXTENSION_DEV_FEATURES`.
+- `--no-ship` keeps everything that stays on this machine and refuses every call that reaches other people: `extension_publish`, `extension_release_promote`, `extension_submit` with `dryRun: false`, `extension_preview_web` with `share: true`, and a share revoke. Dry runs and share listing still work. Env: `EXTENSION_DEV_NO_SHIP=1`.
+
+A refused call answers `E_TOOL_DISABLED` with the flag to change.
+
+A real store submission and a promotion to stable also wait for a person by default: the first call answers `approval-required` with a link on extension.dev, a workspace member approves exactly that action, and the same call with the returned `approvalId` runs it once. `EXTENSION_DEV_APPROVAL_GATE=1` extends this to every promotion and share revoke; `EXTENSION_DEV_APPROVAL_GATE=0` turns it off.
+
+Every tool also carries MCP annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`), so clients can auto-approve reads and ask before the rest.
+
+```json
+{
+  "mcpServers": {
+    "extension-dev": {
+      "command": "npx",
+      "args": ["@extension.dev/mcp", "--no-ship"]
+    }
+  }
+}
+```
+
 ### Pair with the skill
 
 This server gives agents hands; [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) gives them judgment: the cross-browser rules, silent-failure gotchas, debugging playbooks, and store checklist, packaged in the open [Agent Skills](https://agentskills.io) format. With both installed, agents know to verify against the live browser instead of guessing, and these tools make that a one-call operation.
@@ -106,7 +130,7 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | build | `extension_add_feature` | Add sidebar/popup/content script |
 | build | `extension_build` | Build for production |
 | run | `extension_dev` | Dev server with HMR |
-| run | `extension_start` | Build + launch the production build (`build: false` launches the existing dist) |
+| run | `extension_start` | Build + launch the production build (`build: false` launches the existing dist; `outputPath` launches any prebuilt unpacked directory) |
 | run | `extension_wait` | Poll the dev-server ready contract |
 | run | `extension_stop` | Stop a dev/start/preview session (server + browser) |
 | see | `extension_manifest_validate` | Cross-browser manifest validation |
@@ -121,9 +145,10 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | act | `extension_eval` | Evaluate in a context (needs `allowEval: true` on `extension_dev`) |
 | act | `extension_storage` | Read/write `chrome.storage` |
 | act | `extension_reload` | Reload extension or tab |
-| act | `extension_open` | Open a surface / trigger `action`, `command` |
+| act | `extension_open` | Open a surface (popup, options, sidebar, devtools panel, override pages) / trigger `action`, `command` |
 | browsers | `extension_browsers` | Detect, list, install, and uninstall browsers |
 | platform | `extension_auth` | Device login at extension.dev, plus login status and logout |
+| platform | `extension_workspace_create` | Create an extension.dev workspace, headless, via device approval; the approver becomes its owner |
 | platform | `extension_project_create` | Create the extension.dev project for a built extension, headless, via device approval |
 | platform | `extension_preview_web` | Render a build in the web emulator, and share it as a link |
 | platform | `extension_shares` | List every link you have shared, and revoke one permanently |

package/bin/extension-mcp.js

@@ -8,7 +8,7 @@
 // Apache License 2.0 (c) 2026 Cezar Augusto and the extension.dev collaborators
 
 import {createRequire} from 'node:module'
-import {startServer, runCli} from '../dist/module.js'
+import {startServer, runCli, isServerFlag, resolveServerOptions} from '../dist/module.js'
 
 const require = createRequire(import.meta.url)
 const {version} = require('../package.json')
@@ -16,18 +16,28 @@ const {version} = require('../package.json')
 const usage = `@extension.dev/mcp ${version}
 
 Usage:
-  extension-mcp                 Start the MCP server on stdio
+  extension-mcp [flags]         Start the MCP server on stdio
   extension-mcp login [flags]   Device login at extension.dev
   extension-mcp logout          Remove the stored credentials
   extension-mcp whoami          Show the stored identity
   extension-mcp release [...]   Headless release commands
   extension-mcp --version       Print the version
+
+Server flags:
+  --features=local,platform     Tool groups to expose (default: both)
+  --no-ship                     Refuse publish, promote, real submits,
+                                share links and share revokes
 `
 
 const [, , cmd, ...rest] = process.argv
 
-if (cmd === undefined) {
-  startServer()
+if (cmd === undefined || isServerFlag(cmd)) {
+  const resolved = resolveServerOptions(process.argv.slice(2), process.env)
+  if (!resolved.ok) {
+    process.stderr.write(`${resolved.message}\n\n${usage}`)
+    process.exit(1)
+  }
+  startServer(resolved.options)
 } else if (['login', 'logout', 'whoami', 'release'].includes(cmd)) {
   runCli(cmd, rest)
     .then((code) => process.exit(code))

package/claude/CLAUDE.md

@@ -26,7 +26,8 @@ The extension.dev platform ships 50+ templates in the [examples](https://github.
 | Content script | `content`    | `content-react`  | `content-vue` | `content-svelte` | n/a              |
 | Sidebar        | `sidebar`    | `sidebar-shadcn` | n/a           | n/a              | `ai-claude`      |
 | Action popup   | `action`     | n/a              | n/a           | n/a              | `ai-chatgpt`     |
-| New tab        | `new`        | `new-react`      | `new-vue`     | `new-svelte`     | n/a              |
+| New tab        | `newtab`     | `newtab-react`   | `newtab-vue`  | `newtab-svelte`  | n/a              |
+| DevTools       | `devtools`   | `devtools-react` | `devtools-vue`| `devtools-svelte`| n/a              |
 | Full framework | `javascript` | `react`          | `vue`         | `svelte`         | n/a              |
 
 **When recommending a template:**

package/dist/module.d.ts

@@ -1 +1,2 @@
 export { startServer, runCli, version } from "./src/index";
+export { isServerFlag, resolveServerOptions } from "./src/lib/tool-policy";