@extension.dev/mcp 10.2.0 → 10.3.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "10.2.0",
+      "version": "10.3.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 50+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "10.2.0",
+  "version": "10.3.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 10.3.0
+
+Four fixes for places where a tool answered confidently about something it
+had not actually checked: a login refusal that never said where the slugs
+come from, a doctor report labelled with a browser that had no session, a
+preview probe that certified whatever was listening on the port, and a
+release gate that passed on a stale bundle.
+
+- `extension_auth login` refused a malformed `project` without saying
+  where the two slugs come from. Both the refusal and the input schema now
+  name the console address bar as the source: an existing project's page is
+  `console.extension.dev/<workspace>/<project>`, and a project that does
+  not exist yet is created at extension.dev/new first.
+- `extension_doctor` diagnoses the session that exists, not a hardcoded
+  default. The shared session resolver only counts contracts marked
+  "ready", which is exactly wrong for the tool you reach for when a session
+  failed: doctor fell back to chrome, labelled the report with it, read the
+  absent contract, and returned a healthy verdict over a session that had
+  errored. When there is no ready session, the browser with a contract on
+  disk wins, newest first and whatever its status.
+- `extension_preview_web` certifies the probe against the build the call
+  just minted instead of against the port. Anything can be listening on the
+  local preview port, and the old probe read `hostReachable` and
+  `previewLoadable` as true off whatever JSON came back, then echoed that
+  server's `identifier`, name and version into the envelope unmarked, which
+  made any local server a text channel into the agent's context. The name
+  and version must now match the `dist` manifest read off disk, and the
+  identifier is echoed only when it matches the derivation the real
+  middleware uses. A mismatch returns the status
+  `host-serving-different-artifact` with `previewLoadable: false`, and
+  anything the host claimed that could not be confirmed locally travels
+  clipped under `probe.hostReported`, named as the host's claim.
+- The release gate asserts the version the built bundle exports rather than
+  grepping the bundle for the version string. The grep greenwashed: the
+  bundle carries the pinned engine version and fifty-two `"version":"1.0.0"`
+  strings from the template corpus, so a release cut at any of those
+  numbers passed the gate over a stale `dist`. `dist/module.js` now exports
+  the manifest version it inlined at build time, and the gate reads it back
+  and compares.
+
 ## 10.2.0
 
 A production walk of the full share-and-publish loop, then a fix for every

package/dist/module.d.ts

@@ -1 +1 @@
-export { startServer, runCli } from "./src/index";
+export { startServer, runCli, version } from "./src/index";

package/dist/module.js

@@ -582,7 +582,7 @@ __webpack_require__.d(wait_namespaceObject, {
     handler: ()=>wait_handler,
     schema: ()=>wait_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"10.2.0","El":{"OP":"4.0.20"}}');
+var package_namespaceObject = JSON.parse('{"rE":"10.3.0","El":{"OP":"4.0.20"}}');
 const ENVELOPE_SCHEMA = 1;
 const collectWarnings = (warnings)=>{
     if (!warnings) return [];
@@ -6305,6 +6305,14 @@ function safeHostBase(raw) {
         base: trimmed
     };
 }
+const HOST_CLAIM_MAX_CHARS = 120;
+function clipHostClaim(value) {
+    return value.length > HOST_CLAIM_MAX_CHARS ? value.slice(0, HOST_CLAIM_MAX_CHARS) : value;
+}
+function expectedPreviewIdentifier(name, distDir) {
+    const base = (name ?? node_path.basename(distDir)).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "extension";
+    return base.startsWith("local-") ? base : `local-${base}`;
+}
 const SURFACE = {
     defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
     scheme: (encoded)=>`preview://build/${encoded}`,
@@ -6651,7 +6659,14 @@ async function preview_web_handler(args) {
             }
         });
         const contentType = res.headers.get("content-type") ?? "";
-        if (!res.ok || !contentType.includes("application/json")) return envelope_envelope({
+        let raw = null;
+        if (res.ok && contentType.includes("application/json")) try {
+            raw = await res.json();
+        } catch  {
+            raw = null;
+        }
+        const payload = raw && "object" == typeof raw && !Array.isArray(raw) ? raw : null;
+        if (!payload) return envelope_envelope({
             ok: true,
             command: preview_web_COMMAND,
             status: "host-not-serving-preview",
@@ -6670,7 +6685,62 @@ async function preview_web_handler(args) {
                 `${SURFACE.label} answered but not with a preview payload. On the deployed host ${SURFACE.fetchPath} does not exist, because it is dev-only. ${remedy}`
             ]
         });
-        const payload = await res.json();
+        const localName = "string" == typeof manifest.name ? manifest.name : null;
+        const localVersion = "string" == typeof manifest.version ? manifest.version : null;
+        const remoteName = "string" == typeof payload.manifest?.name ? payload.manifest.name : null;
+        const remoteVersion = "string" == typeof payload.version ? payload.version : null;
+        const remoteIdentifier = "string" == typeof payload.identifier ? payload.identifier : null;
+        const fileCount = Array.isArray(payload.files) ? payload.files.length : 0;
+        const matchesDist = (null === localName || remoteName === localName) && (null === localVersion || remoteVersion === localVersion);
+        if (!matchesDist) {
+            const hostReported = {
+                ...null !== remoteIdentifier ? {
+                    identifier: clipHostClaim(remoteIdentifier)
+                } : {},
+                ...null !== remoteName ? {
+                    name: clipHostClaim(remoteName)
+                } : {},
+                ...null !== remoteVersion ? {
+                    version: clipHostClaim(remoteVersion)
+                } : {}
+            };
+            return envelope_envelope({
+                ok: true,
+                command: preview_web_COMMAND,
+                status: "host-serving-different-artifact",
+                value: {
+                    ...result,
+                    hostReachable: true,
+                    previewLoadable: false,
+                    probe: {
+                        method: "server-fetch",
+                        provesBrowserLoad: false,
+                        matchesDist: false,
+                        fileCount,
+                        ...Object.keys(hostReported).length ? {
+                            hostReported
+                        } : {}
+                    }
+                },
+                hint,
+                warnings: [
+                    ...previewWarnings,
+                    `Something answered at ${hostBase}${SURFACE.fetchPath} but described a different artifact than the build this call minted, so previewLoadable stays false. probe.hostReported carries that host's own claims, clipped and unverified, not facts about your build; another local server on this port is the usual cause. ${remedy}`
+                ]
+            });
+        }
+        const identifierConfirmed = null !== remoteIdentifier && remoteIdentifier === expectedPreviewIdentifier(localName, distDir);
+        const unconfirmed = {
+            ...!identifierConfirmed && null !== remoteIdentifier ? {
+                identifier: clipHostClaim(remoteIdentifier)
+            } : {},
+            ...null === localName && null !== remoteName ? {
+                name: clipHostClaim(remoteName)
+            } : {},
+            ...null === localVersion && null !== remoteVersion ? {
+                version: clipHostClaim(remoteVersion)
+            } : {}
+        };
         return envelope_envelope({
             ok: true,
             command: preview_web_COMMAND,
@@ -6681,12 +6751,22 @@ async function preview_web_handler(args) {
                 previewLoadable: true,
                 previewLoadableLane: "local-dev-host",
                 probe: {
-                    identifier: payload.identifier,
-                    loadedName: payload.manifest?.name,
-                    loadedVersion: payload.version,
-                    fileCount: Array.isArray(payload.files) ? payload.files.length : 0,
+                    ...identifierConfirmed ? {
+                        identifier: remoteIdentifier
+                    } : {},
+                    ...null !== localName ? {
+                        loadedName: localName
+                    } : {},
+                    ...null !== localVersion ? {
+                        loadedVersion: localVersion
+                    } : {},
+                    fileCount,
                     method: "server-fetch",
-                    provesBrowserLoad: false
+                    provesBrowserLoad: false,
+                    matchesDist: true,
+                    ...Object.keys(unconfirmed).length ? {
+                        hostReported: unconfirmed
+                    } : {}
                 }
             },
             hint,
@@ -11456,6 +11536,23 @@ function readContractForDiagnosis(projectPath, browser) {
         return null;
     }
 }
+function sightedContractBrowser(projectPath) {
+    let dirs;
+    try {
+        dirs = node_fs.readdirSync(sessionArtifactsRootDir(projectPath));
+    } catch  {
+        return null;
+    }
+    let best = null;
+    for (const dir of dirs)try {
+        const stat = node_fs.statSync(bridge_readyContractPath(projectPath, dir));
+        if (!best || stat.mtimeMs > best.mtimeMs) best = {
+            browser: dir,
+            mtimeMs: stat.mtimeMs
+        };
+    } catch  {}
+    return best ? best.browser : null;
+}
 const doctor_schema = {
     name: "extension_doctor",
     description: "Diagnose a dev session end to end: ready contract, dev-server process, control-port agreement, control channel, eval token, executor, browser liveness. This returns one {check, status, detail, remediation?} per leg, in dependency order. Read a 'skip' as blocked, not as a pass: it names the check that blocked it. Run this first when any act tool (storage, reload, eval, open) errors unexpectedly. Call it with no projectPath for a pre-flight environment check (node, the Extension.js CLI, the template cache) before any project exists.",
@@ -11551,7 +11648,8 @@ function capabilityProbeChecks(parsed) {
 async function doctor_handler(args) {
     if (!args.projectPath) return environmentPreflight();
     const projectPath = args.projectPath;
-    const { browser } = resolveSessionBrowser(projectPath, args.browser);
+    const resolved = resolveSessionBrowser(projectPath, args.browser);
+    const browser = "fallback" === resolved.source ? sightedContractBrowser(projectPath) ?? resolved.browser : resolved.browser;
     const { code, stdout, stderr } = await runExtensionCli([
         "doctor",
         projectPath,
@@ -12321,7 +12419,7 @@ function resumePending(deviceCode, verificationUri) {
 }
 async function loginToProject(args) {
     const project = String(args.project || "").trim();
-    if (!/^[^/]+\/[^/]+$/.test(project)) return login_fail("BadRequest", "project must be in the form '<workspace>/<project>'.", "bad-request", "E_BAD_REQUEST");
+    if (!/^[^/]+\/[^/]+$/.test(project)) return login_fail("BadRequest", "project must be in the form '<workspace>/<project>'. The slug pair is the console address bar: an existing project's page is console.extension.dev/<workspace>/<project>. If the project does not exist yet, create it at extension.dev/new, then log in with the slugs the console shows.", "bad-request", "E_BAD_REQUEST");
     const apiCheck = safeApiBase(resolveApiBase(args.api), args.api);
     if (!apiCheck.ok) return login_fail("LoginConfigError", apiCheck.message, "login-failed", "E_AUTH_FAILED");
     const apiBase = apiCheck.base;
@@ -12562,7 +12660,7 @@ const auth_schema = {
             },
             project: {
                 type: "string",
-                description: "login: target project as '<workspace>/<project>'; the token is scoped to it."
+                description: "login: target project as '<workspace>/<project>'; the token is scoped to it. The slug pair is the console address bar: an existing project's page is console.extension.dev/<workspace>/<project>. Create one at extension.dev/new if none exists yet."
             },
             deviceCode: {
                 type: "string",
@@ -13461,4 +13559,5 @@ async function runCli(cmd, args) {
     log(`Unknown command: ${cmd}. Expected one of: login, logout, whoami, release.`);
     return 1;
 }
-export { runCli, startServer };
+var version_0 = package_namespaceObject.rE;
+export { runCli, startServer, version_0 as version };

package/dist/src/index.d.ts

@@ -1,3 +1,5 @@
+import { version } from "../package.json";
+export { version };
 export interface ToolModule {
     schema: {
         name: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "10.2.0",
+  "version": "10.3.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 28 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "10.2.0",
+  "version": "10.3.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "10.2.0",
+      "version": "10.3.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"