@extension.dev/mcp 3.17.0-canary.1779910200.ddcd9eb → 4.0.8

package/dist/module.js

@@ -7,10 +7,12 @@ import node_fs, { existsSync, readdirSync, statSync } from "node:fs";
 import node_path, { join } from "node:path";
 import node_os from "node:os";
 import { extensionBuild } from "extension-develop";
-import { execFile, spawn } from "node:child_process";
+import cross_spawn from "cross-spawn";
+import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import node_net from "node:net";
 import ws from "ws";
 import { extensionInstall, getManagedBrowsersCacheRoot } from "extension-install";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 var add_feature_namespaceObject = {};
 __webpack_require__.r(add_feature_namespaceObject);
@@ -78,17 +80,35 @@ __webpack_require__.d(list_browsers_namespaceObject, {
     handler: ()=>list_browsers_handler,
     schema: ()=>list_browsers_schema
 });
+var list_extensions_namespaceObject = {};
+__webpack_require__.r(list_extensions_namespaceObject);
+__webpack_require__.d(list_extensions_namespaceObject, {
+    handler: ()=>list_extensions_handler,
+    schema: ()=>list_extensions_schema
+});
 var list_templates_namespaceObject = {};
 __webpack_require__.r(list_templates_namespaceObject);
 __webpack_require__.d(list_templates_namespaceObject, {
     handler: ()=>list_templates_handler,
     schema: ()=>list_templates_schema
 });
+var login_namespaceObject = {};
+__webpack_require__.r(login_namespaceObject);
+__webpack_require__.d(login_namespaceObject, {
+    handler: ()=>login_handler,
+    schema: ()=>login_schema
+});
+var logout_namespaceObject = {};
+__webpack_require__.r(logout_namespaceObject);
+__webpack_require__.d(logout_namespaceObject, {
+    handler: ()=>logout_handler,
+    schema: ()=>logout_schema
+});
 var logs_namespaceObject = {};
 __webpack_require__.r(logs_namespaceObject);
 __webpack_require__.d(logs_namespaceObject, {
     handler: ()=>logs_handler,
-    schema: ()=>logs_schema
+    schema: ()=>logs_schema_schema
 });
 var manifest_validate_namespaceObject = {};
 __webpack_require__.r(manifest_validate_namespaceObject);
@@ -112,8 +132,16 @@ var publish_namespaceObject = {};
 __webpack_require__.r(publish_namespaceObject);
 __webpack_require__.d(publish_namespaceObject, {
     handler: ()=>publish_handler,
+    resolveToken: ()=>resolveToken,
+    safeApiBase: ()=>safeApiBase,
     schema: ()=>publish_schema
 });
+var release_promote_namespaceObject = {};
+__webpack_require__.r(release_promote_namespaceObject);
+__webpack_require__.d(release_promote_namespaceObject, {
+    handler: ()=>release_promote_handler,
+    schema: ()=>release_promote_schema
+});
 var reload_namespaceObject = {};
 __webpack_require__.r(reload_namespaceObject);
 __webpack_require__.d(reload_namespaceObject, {
@@ -144,6 +172,15 @@ __webpack_require__.d(wait_namespaceObject, {
     handler: ()=>wait_handler,
     schema: ()=>wait_schema
 });
+var whoami_namespaceObject = {};
+__webpack_require__.r(whoami_namespaceObject);
+__webpack_require__.d(whoami_namespaceObject, {
+    handler: ()=>whoami_handler,
+    schema: ()=>whoami_schema
+});
+var package_namespaceObject = {
+    rE: "4.0.8"
+};
 const schema = {
     name: "extension_create",
     description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options.",
@@ -373,7 +410,7 @@ async function build_handler(args) {
 }
 function runExtensionCli(args, options) {
     return new Promise((resolve)=>{
-        const child = spawn("npx", [
+        const child = cross_spawn("npx", [
             "extension",
             ...args
         ], {
@@ -388,7 +425,6 @@ function runExtensionCli(args, options) {
                 FORCE_COLOR: "0",
                 NO_COLOR: "1"
             },
-            shell: true,
             timeout: options?.timeoutMs ?? 30000
         });
         let stdout = "";
@@ -408,7 +444,7 @@ function runExtensionCli(args, options) {
     });
 }
 function spawnExtensionCli(args, options) {
-    const child = spawn("npx", [
+    const child = cross_spawn("npx", [
         "extension",
         ...args
     ], {
@@ -423,8 +459,7 @@ function spawnExtensionCli(args, options) {
             ...process.env,
             FORCE_COLOR: "0",
             NO_COLOR: "1"
-        },
-        shell: true
+        }
     });
     child.unref();
     return child;
@@ -753,9 +788,8 @@ async function manifest_validate_handler(args) {
     }
     if (!manifest.name) result.errors.push("Missing required field: name");
     if (!manifest.version) result.warnings.push("Missing field: version (required for store submission)");
-    const chromiumMv = manifest["chromium:manifest_version"] ?? manifest.manifest_version;
-    manifest["firefox:manifest_version"] ?? manifest.manifest_version;
-    if (!chromiumMv && !manifest.manifest_version) result.errors.push('Missing manifest_version. Use "chromium:manifest_version": 3 and "firefox:manifest_version": 2 for cross-browser support.');
+    const chromiumManifest = filterKeysForThisBrowser(manifest, "chrome");
+    if (!chromiumManifest.manifest_version) result.errors.push('Missing manifest_version. Use "chromium:manifest_version": 3 and "firefox:manifest_version": 2 for cross-browser support.');
     for (const browser of browsers){
         const isChromium = [
             "chrome",
@@ -766,25 +800,26 @@ async function manifest_validate_handler(args) {
             "firefox",
             "gecko-based"
         ].includes(browser);
+        const effective = filterKeysForThisBrowser(manifest, browser);
         const issues = [];
         if (isChromium) {
-            const mv = chromiumMv;
+            const mv = effective.manifest_version;
             if (mv && mv < 3) issues.push("Manifest V2 is deprecated on Chromium. Use chromium:manifest_version: 3.");
-            if (manifest["chromium:side_panel"] || manifest.side_panel) {
-                const perms = manifest["chromium:permissions"] ?? manifest.permissions ?? [];
+            if (effective.side_panel) {
+                const perms = effective.permissions ?? [];
                 if (!perms.includes("sidePanel")) issues.push('Side panel declared but "sidePanel" permission is missing.');
             }
-            if (manifest["firefox:browser_action"] && !manifest["chromium:action"] && !manifest.action) issues.push('Firefox browser_action found but no chromium:action. Chromium MV3 uses "action" instead of "browser_action".');
+            if (manifest["firefox:browser_action"] && !effective.action) issues.push('Firefox browser_action found but no chromium:action. Chromium MV3 uses "action" instead of "browser_action".');
         }
         if (isFirefox) {
-            const contentScripts = manifest.content_scripts;
+            const contentScripts = effective.content_scripts;
             if (contentScripts) {
                 for (const cs of contentScripts)if ("MAIN" === cs.world || "MAIN" === cs["world"]) issues.push('content_scripts.world: "MAIN" is Chromium-only. Use "chromium:world": "MAIN" and provide a Firefox fallback.');
             }
-            if (manifest["chromium:side_panel"] && !manifest["firefox:sidebar_action"]) issues.push("Chromium side_panel declared but no firefox:sidebar_action. Firefox uses sidebar_action for sidebars.");
-            const bg = manifest.background;
+            if (chromiumManifest.side_panel && !effective.sidebar_action) issues.push("Chromium side_panel declared but no firefox:sidebar_action. Firefox uses sidebar_action for sidebars.");
+            const bg = effective.background;
             if (bg) {
-                if (bg.service_worker && !bg["firefox:scripts"] && !bg.scripts) issues.push('Background service_worker declared but no firefox:scripts. Firefox uses "scripts" (array) instead of "service_worker".');
+                if (bg.service_worker && !bg.scripts) issues.push('Background service_worker declared but no firefox:scripts. Firefox uses "scripts" (array) instead of "service_worker".');
             }
         }
         result.browserSupport[browser] = {
@@ -794,11 +829,11 @@ async function manifest_validate_handler(args) {
         if (issues.length) result.valid = false;
     }
     const surfaces = [];
-    if (manifest.content_scripts) surfaces.push("content");
-    if (manifest["chromium:side_panel"] || manifest.side_panel) surfaces.push("sidebar");
-    if (manifest.action || manifest["chromium:action"] || manifest["firefox:browser_action"]) surfaces.push("action");
-    if (manifest.chrome_url_overrides?.newtab) surfaces.push("newtab");
-    if (manifest.background) surfaces.push("background");
+    if (chromiumManifest.content_scripts) surfaces.push("content");
+    if (chromiumManifest.side_panel) surfaces.push("sidebar");
+    if (chromiumManifest.action || manifest["firefox:browser_action"]) surfaces.push("action");
+    if (chromiumManifest.chrome_url_overrides?.newtab) surfaces.push("newtab");
+    if (chromiumManifest.background) surfaces.push("background");
     if (surfaces.length) try {
         const templates = await listTemplates();
         result.similarTemplates = templates.filter((t)=>t.surfaces.some((s)=>surfaces.includes(s))).slice(0, 5).map((t)=>({
@@ -975,7 +1010,7 @@ function _define_property(obj, key, value) {
     return obj;
 }
 const COMMAND_TIMEOUT_MS = 15000;
-class CDPClient {
+class CDPConnection {
     async connect(wsUrl) {
         return new Promise((resolve, reject)=>{
             this.ws = new ws(wsUrl);
@@ -1067,6 +1102,186 @@ class CDPClient {
             this.ws.send(JSON.stringify(message));
         });
     }
+    getConsoleMessages() {
+        return [
+            ...this.consoleMessages
+        ];
+    }
+    getConsoleSummary() {
+        const counts = {};
+        const uniqueByLevel = {};
+        for (const msg of this.consoleMessages){
+            counts[msg.level] = (counts[msg.level] ?? 0) + 1;
+            if (!uniqueByLevel[msg.level]) uniqueByLevel[msg.level] = new Map();
+            const key = msg.text.slice(0, 200);
+            uniqueByLevel[msg.level].set(key, (uniqueByLevel[msg.level].get(key) ?? 0) + 1);
+        }
+        const topMessages = [];
+        for (const [level, msgs] of Object.entries(uniqueByLevel)){
+            const sorted = [
+                ...msgs.entries()
+            ].sort((a, b)=>b[1] - a[1]);
+            for (const [text, count] of sorted.slice(0, 5))topMessages.push({
+                level,
+                text,
+                count
+            });
+        }
+        return {
+            total: this.consoleMessages.length,
+            counts,
+            topMessages: topMessages.sort((a, b)=>b.count - a.count).slice(0, 10)
+        };
+    }
+    onEvent(handler) {
+        this.eventListeners.add(handler);
+        return ()=>{
+            this.eventListeners.delete(handler);
+        };
+    }
+    constructor(){
+        _define_property(this, "ws", null);
+        _define_property(this, "messageId", 0);
+        _define_property(this, "eventListeners", new Set());
+        _define_property(this, "pendingRequests", new Map());
+        _define_property(this, "consoleMessages", []);
+    }
+}
+const PAGE_HTML_SCRIPT = `(() => {
+        try {
+          const doctype = document.doctype;
+          const dt = doctype
+            ? '<!DOCTYPE ' + doctype.name
+              + (doctype.publicId ? ' PUBLIC "' + doctype.publicId + '"' : '')
+              + (doctype.systemId ? ' "' + doctype.systemId + '"' : '')
+              + '>'
+            : '';
+          // Include shadow DOM content from extension roots
+          const roots = Array.from(document.querySelectorAll(
+            '#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])'
+          ));
+          if (roots.length) {
+            const clone = document.documentElement.cloneNode(true);
+            const clonedRoots = Array.from(clone.querySelectorAll(
+              '#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])'
+            ));
+            const s = new XMLSerializer();
+            for (let i = 0; i < Math.min(roots.length, clonedRoots.length); i++) {
+              const sr = roots[i].shadowRoot;
+              if (!sr) continue;
+              try {
+                const shadow = Array.from(sr.childNodes).map(n => {
+                  try { return s.serializeToString(n); } catch { return ''; }
+                }).join('');
+                if (shadow) clonedRoots[i].innerHTML = shadow;
+              } catch {}
+            }
+            return dt + '\\n' + clone.outerHTML;
+          }
+          return dt + '\\n' + document.documentElement.outerHTML;
+        } catch (e) { return ''; }
+      })()`;
+const PAGE_META_SCRIPT = `(() => {
+        try {
+          return {
+            title: document.title,
+            url: location.href,
+            readyState: document.readyState,
+            viewport: {
+              width: window.innerWidth,
+              height: window.innerHeight,
+              devicePixelRatio: window.devicePixelRatio
+            },
+            frameCount: window.frames.length,
+            scriptCount: document.querySelectorAll('script').length,
+            styleCount: document.querySelectorAll('style,link[rel="stylesheet"]').length
+          };
+        } catch { return {}; }
+      })()`;
+const EXTENSION_ROOT_META_SCRIPT = `(() => {
+        try {
+          const readGeneration = (node) => {
+            const raw = node.getAttribute && node.getAttribute('data-extjs-reinject-generation');
+            const parsed = Number(raw);
+            return Number.isFinite(parsed) ? parsed : undefined;
+          };
+          const normalize = (node) => ({
+            tag: node.tagName ? String(node.tagName).toLowerCase() : 'unknown',
+            id: node.id || undefined,
+            key: node.getAttribute ? node.getAttribute('data-extjs-reinject-key') || undefined : undefined,
+            generation: readGeneration(node),
+            status: node.getAttribute ? node.getAttribute('data-extjs-reinject-status') || undefined : undefined
+          });
+          const roots = Array.from(
+            document.querySelectorAll('#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])')
+          ).slice(0, 10).map(normalize);
+          const markers = Array.from(
+            document.querySelectorAll('[data-extjs-reinject-marker="true"]')
+          ).slice(0, 10).map(normalize);
+          if (!roots.length && !markers.length) return null;
+          const generations = [...roots, ...markers]
+            .map(e => e.generation)
+            .filter(g => typeof g === 'number');
+          return {
+            rootCount: roots.length,
+            markerCount: markers.length,
+            latestGeneration: generations.length ? Math.max(...generations) : 0,
+            roots,
+            markers
+          };
+        } catch { return null; }
+      })()`;
+function probeSelectorsScript(selectors) {
+    return `(() => {
+        const selectors = ${JSON.stringify(selectors)};
+        return selectors.map(selector => {
+          try {
+            const els = Array.from(document.querySelectorAll(selector));
+            return {
+              selector,
+              count: els.length,
+              samples: els.slice(0, 3).map(el => ({
+                tag: el.tagName.toLowerCase(),
+                id: el.id || undefined,
+                classes: Array.from(el.classList).join(' ') || undefined,
+                role: el.getAttribute('role') || undefined,
+                ariaLabel: el.getAttribute('aria-label') || undefined,
+                textLength: (el.textContent || '').length,
+                textSnippet: (el.textContent || '').trim().slice(0, 80)
+              }))
+            };
+          } catch (e) {
+            return { selector, count: 0, samples: [], error: String(e) };
+          }
+        });
+      })()`;
+}
+function domSnapshotScript(maxNodes) {
+    return `(() => {
+        const maxNodes = ${maxNodes};
+        const nodes = [];
+        const walk = (node, depth) => {
+          if (nodes.length >= maxNodes || depth > 20) return;
+          if (node.nodeType !== 1) return;
+          const el = node;
+          nodes.push({
+            tag: el.tagName.toLowerCase(),
+            depth,
+            id: el.id || undefined,
+            classes: Array.from(el.classList).slice(0, 5).join(' ') || undefined,
+            role: el.getAttribute('role') || undefined,
+            ariaLabel: el.getAttribute('aria-label') || undefined,
+            childCount: el.children.length
+          });
+          for (const child of el.children) {
+            walk(child, depth + 1);
+          }
+        };
+        walk(document.documentElement, 0);
+        return nodes;
+      })()`;
+}
+class CDPClient extends CDPConnection {
     static async discoverBrowserWsUrl(port, host = "127.0.0.1") {
         const res = await fetch(`http://${host}:${port}/json/version`);
         if (!res.ok) throw new Error(`CDP /json/version failed: ${res.status}`);
@@ -1121,40 +1336,7 @@ class CDPClient {
         return response.result?.value;
     }
     async getPageHTML(sessionId) {
-        const result = await this.evaluate(sessionId, `(() => {
-        try {
-          const doctype = document.doctype;
-          const dt = doctype
-            ? '<!DOCTYPE ' + doctype.name
-              + (doctype.publicId ? ' PUBLIC "' + doctype.publicId + '"' : '')
-              + (doctype.systemId ? ' "' + doctype.systemId + '"' : '')
-              + '>'
-            : '';
-          // Include shadow DOM content from extension roots
-          const roots = Array.from(document.querySelectorAll(
-            '#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])'
-          ));
-          if (roots.length) {
-            const clone = document.documentElement.cloneNode(true);
-            const clonedRoots = Array.from(clone.querySelectorAll(
-              '#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])'
-            ));
-            const s = new XMLSerializer();
-            for (let i = 0; i < Math.min(roots.length, clonedRoots.length); i++) {
-              const sr = roots[i].shadowRoot;
-              if (!sr) continue;
-              try {
-                const shadow = Array.from(sr.childNodes).map(n => {
-                  try { return s.serializeToString(n); } catch { return ''; }
-                }).join('');
-                if (shadow) clonedRoots[i].innerHTML = shadow;
-              } catch {}
-            }
-            return dt + '\\n' + clone.outerHTML;
-          }
-          return dt + '\\n' + document.documentElement.outerHTML;
-        } catch (e) { return ''; }
-      })()`);
+        const result = await this.evaluate(sessionId, PAGE_HTML_SCRIPT);
         return "string" == typeof result ? result : "";
     }
     async getClosedShadowRoots(sessionId, maxBytes = 65536) {
@@ -1208,157 +1390,21 @@ class CDPClient {
         return out;
     }
     async getPageMeta(sessionId) {
-        const result = await this.evaluate(sessionId, `(() => {
-        try {
-          return {
-            title: document.title,
-            url: location.href,
-            readyState: document.readyState,
-            viewport: {
-              width: window.innerWidth,
-              height: window.innerHeight,
-              devicePixelRatio: window.devicePixelRatio
-            },
-            frameCount: window.frames.length,
-            scriptCount: document.querySelectorAll('script').length,
-            styleCount: document.querySelectorAll('style,link[rel="stylesheet"]').length
-          };
-        } catch { return {}; }
-      })()`);
+        const result = await this.evaluate(sessionId, PAGE_META_SCRIPT);
         return result ?? {};
     }
     async probeSelectors(sessionId, selectors) {
-        const result = await this.evaluate(sessionId, `(() => {
-        const selectors = ${JSON.stringify(selectors)};
-        return selectors.map(selector => {
-          try {
-            const els = Array.from(document.querySelectorAll(selector));
-            return {
-              selector,
-              count: els.length,
-              samples: els.slice(0, 3).map(el => ({
-                tag: el.tagName.toLowerCase(),
-                id: el.id || undefined,
-                classes: Array.from(el.classList).join(' ') || undefined,
-                role: el.getAttribute('role') || undefined,
-                ariaLabel: el.getAttribute('aria-label') || undefined,
-                textLength: (el.textContent || '').length,
-                textSnippet: (el.textContent || '').trim().slice(0, 80)
-              }))
-            };
-          } catch (e) {
-            return { selector, count: 0, samples: [], error: String(e) };
-          }
-        });
-      })()`);
+        const result = await this.evaluate(sessionId, probeSelectorsScript(selectors));
         return result ?? [];
     }
     async getDomSnapshot(sessionId, maxNodes = 500) {
-        const result = await this.evaluate(sessionId, `(() => {
-        const maxNodes = ${maxNodes};
-        const nodes = [];
-        const walk = (node, depth) => {
-          if (nodes.length >= maxNodes || depth > 20) return;
-          if (node.nodeType !== 1) return;
-          const el = node;
-          nodes.push({
-            tag: el.tagName.toLowerCase(),
-            depth,
-            id: el.id || undefined,
-            classes: Array.from(el.classList).slice(0, 5).join(' ') || undefined,
-            role: el.getAttribute('role') || undefined,
-            ariaLabel: el.getAttribute('aria-label') || undefined,
-            childCount: el.children.length
-          });
-          for (const child of el.children) {
-            walk(child, depth + 1);
-          }
-        };
-        walk(document.documentElement, 0);
-        return nodes;
-      })()`);
+        const result = await this.evaluate(sessionId, domSnapshotScript(maxNodes));
         return result ?? [];
     }
     async getExtensionRootMeta(sessionId) {
-        const result = await this.evaluate(sessionId, `(() => {
-        try {
-          const readGeneration = (node) => {
-            const raw = node.getAttribute && node.getAttribute('data-extjs-reinject-generation');
-            const parsed = Number(raw);
-            return Number.isFinite(parsed) ? parsed : undefined;
-          };
-          const normalize = (node) => ({
-            tag: node.tagName ? String(node.tagName).toLowerCase() : 'unknown',
-            id: node.id || undefined,
-            key: node.getAttribute ? node.getAttribute('data-extjs-reinject-key') || undefined : undefined,
-            generation: readGeneration(node),
-            status: node.getAttribute ? node.getAttribute('data-extjs-reinject-status') || undefined : undefined
-          });
-          const roots = Array.from(
-            document.querySelectorAll('#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])')
-          ).slice(0, 10).map(normalize);
-          const markers = Array.from(
-            document.querySelectorAll('[data-extjs-reinject-marker="true"]')
-          ).slice(0, 10).map(normalize);
-          if (!roots.length && !markers.length) return null;
-          const generations = [...roots, ...markers]
-            .map(e => e.generation)
-            .filter(g => typeof g === 'number');
-          return {
-            rootCount: roots.length,
-            markerCount: markers.length,
-            latestGeneration: generations.length ? Math.max(...generations) : 0,
-            roots,
-            markers
-          };
-        } catch { return null; }
-      })()`);
+        const result = await this.evaluate(sessionId, EXTENSION_ROOT_META_SCRIPT);
         return result ?? null;
     }
-    getConsoleMessages() {
-        return [
-            ...this.consoleMessages
-        ];
-    }
-    getConsoleSummary() {
-        const counts = {};
-        const uniqueByLevel = {};
-        for (const msg of this.consoleMessages){
-            counts[msg.level] = (counts[msg.level] ?? 0) + 1;
-            if (!uniqueByLevel[msg.level]) uniqueByLevel[msg.level] = new Map();
-            const key = msg.text.slice(0, 200);
-            uniqueByLevel[msg.level].set(key, (uniqueByLevel[msg.level].get(key) ?? 0) + 1);
-        }
-        const topMessages = [];
-        for (const [level, msgs] of Object.entries(uniqueByLevel)){
-            const sorted = [
-                ...msgs.entries()
-            ].sort((a, b)=>b[1] - a[1]);
-            for (const [text, count] of sorted.slice(0, 5))topMessages.push({
-                level,
-                text,
-                count
-            });
-        }
-        return {
-            total: this.consoleMessages.length,
-            counts,
-            topMessages: topMessages.sort((a, b)=>b.count - a.count).slice(0, 10)
-        };
-    }
-    onEvent(handler) {
-        this.eventListeners.add(handler);
-        return ()=>{
-            this.eventListeners.delete(handler);
-        };
-    }
-    constructor(){
-        _define_property(this, "ws", null);
-        _define_property(this, "messageId", 0);
-        _define_property(this, "eventListeners", new Set());
-        _define_property(this, "pendingRequests", new Map());
-        _define_property(this, "consoleMessages", []);
-    }
 }
 const source_inspect_schema = {
     name: "extension_source_inspect",
@@ -1546,13 +1592,171 @@ async function source_inspect_handler(args) {
         cdp.disconnect();
     }
 }
-const CONTROL_ENVELOPE_VERSION = 1;
+const list_extensions_schema = {
+    name: "extension_list_extensions",
+    description: "List the extensions with a live context in the running dev browser via Chrome DevTools Protocol. Returns each extension's id, name, version, and live contexts (service worker, page). Identity is read read-only via the Extensions domain — other extensions' contexts are never attached to or evaluated in. A dormant MV3 service worker with no open page may be absent until it wakes. Chromium only (Firefox uses RDP, not yet supported). Requires an active dev or start session.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            projectPath: {
+                type: "string",
+                description: "Path to the extension project root (must have an active dev session)"
+            },
+            browser: {
+                type: "string",
+                default: "chrome"
+            }
+        },
+        required: [
+            "projectPath"
+        ]
+    }
+};
+async function list_extensions_handler(args) {
+    const browser = args.browser ?? "chrome";
+    const isChromium = [
+        "chrome",
+        "edge",
+        "chromium-based"
+    ].includes(browser);
+    if (!isChromium) return JSON.stringify({
+        error: `Listing extensions for ${browser} uses RDP (Remote Debug Protocol). Currently only Chromium CDP is supported.`,
+        hint: "Use --browser=chrome."
+    });
+    const cdpPort = await list_extensions_findCdpPort(args.projectPath, browser);
+    if (!cdpPort) return JSON.stringify({
+        error: "No active dev session found. Cannot connect to Chrome DevTools Protocol.",
+        hint: "Start a dev session first with extension_dev, then use extension_wait to confirm it is ready."
+    });
+    const cdp = new CDPClient();
+    try {
+        const browserWsUrl = await CDPClient.discoverBrowserWsUrl(cdpPort);
+        await cdp.connect(browserWsUrl);
+        const targets = await cdp.getTargets();
+        const byId = new Map();
+        for (const t of targets){
+            const url = String(t.url ?? "");
+            if (!url.startsWith("chrome-extension://")) continue;
+            const id = url.slice(19).split("/")[0];
+            if (!id) continue;
+            const list = byId.get(id) ?? [];
+            list.push({
+                type: String(t.type ?? ""),
+                url
+            });
+            byId.set(id, list);
+        }
+        const extensions = [];
+        for (const [id, ctxTargets] of byId){
+            const entry = {
+                id,
+                contexts: ctxTargets.map((c)=>({
+                        type: c.type,
+                        url: c.url
+                    })),
+                source: "target-only"
+            };
+            try {
+                const info = await cdp.sendCommand("Extensions.getExtensionInfo", {
+                    extensionId: id
+                });
+                if (info?.extensionInfo) {
+                    entry.name = info.extensionInfo.name;
+                    entry.version = info.extensionInfo.version;
+                    entry.source = "extensions-domain";
+                }
+            } catch  {}
+            extensions.push(entry);
+        }
+        extensions.sort((a, b)=>(a.name ?? a.id).localeCompare(b.name ?? b.id));
+        return JSON.stringify({
+            cdpPort,
+            browser,
+            count: extensions.length,
+            extensions,
+            note: "Lists extensions that currently have at least one live context (service worker or open page). An MV3 service worker that has gone dormant with no open page may be absent until it wakes. Identity is read read-only via the Extensions domain; other extensions' contexts are never attached to or evaluated in."
+        });
+    } catch (error) {
+        return JSON.stringify({
+            error: `Failed to list extensions: ${error.message}`
+        });
+    } finally{
+        cdp.disconnect();
+    }
+}
+async function list_extensions_findCdpPort(projectPath, browser) {
+    const readyPath = node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json");
+    try {
+        const contract = JSON.parse(node_fs.readFileSync(readyPath, "utf8"));
+        if ("number" == typeof contract.cdpPort) return contract.cdpPort;
+    } catch  {}
+    const defaultPort = 9222;
+    return new Promise((resolve)=>{
+        const socket = new node_net.Socket();
+        socket.setTimeout(1000);
+        socket.on("connect", ()=>{
+            socket.destroy();
+            resolve(defaultPort);
+        });
+        socket.on("error", ()=>resolve(null));
+        socket.on("timeout", ()=>{
+            socket.destroy();
+            resolve(null);
+        });
+        socket.connect(defaultPort, "127.0.0.1");
+    });
+}
 const CONTROL_WS_PATH = "/extjs-control";
-const DEFAULT_LIMIT = 200;
-const DEFAULT_FOLLOW_MS = 4000;
-const MIN_FOLLOW_MS = 500;
-const MAX_FOLLOW_MS = 15000;
-const logs_schema = {
+const LEVEL_ORDER = [
+    "error",
+    "warn",
+    "info",
+    "debug",
+    "trace"
+];
+function levelRank(level) {
+    const l = "log" === level ? "info" : level;
+    const i = LEVEL_ORDER.indexOf(l);
+    return -1 === i ? LEVEL_ORDER.length : i;
+}
+function makeUrlMatcher(pattern) {
+    const hasGlob = pattern.includes("*");
+    let re = null;
+    if (hasGlob) {
+        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+        re = new RegExp(escaped);
+    }
+    return (event)=>{
+        const candidates = [
+            event.url,
+            event.hostname
+        ].filter((v)=>"string" == typeof v);
+        if (0 === candidates.length) return false;
+        return candidates.some((c)=>re ? re.test(c) : c.includes(pattern));
+    };
+}
+function makeFilter(args) {
+    const minLevel = String(args.level || "all").toLowerCase();
+    const rawContexts = Array.isArray(args.context) ? args.context : "string" == typeof args.context ? args.context.split(",") : null;
+    const contexts = rawContexts && rawContexts.length ? new Set(rawContexts.map((c)=>c.trim()).filter(Boolean)) : null;
+    const sinceSeq = null != args.since ? Number(args.since) : null;
+    const urlMatches = args.url ? makeUrlMatcher(args.url) : null;
+    const tabId = null != args.tab ? Number(args.tab) : null;
+    return (event)=>{
+        if (!event || "object" != typeof event) return false;
+        if ("header" === event.type) return false;
+        if (args.signalsOnly && "dx.signal" !== event.eventType) return false;
+        if (contexts && !contexts.has(event.context)) return false;
+        if ("all" !== minLevel && "off" !== minLevel) {
+            if (levelRank(event.level) > levelRank(minLevel)) return false;
+        }
+        if (null != sinceSeq && Number.isFinite(sinceSeq) && "number" == typeof event.seq && event.seq <= sinceSeq) return false;
+        if (urlMatches && !urlMatches(event)) return false;
+        if (null != tabId && Number.isFinite(tabId) && event.tabId !== tabId) return false;
+        return true;
+    };
+}
+const logs_schema_schema = {
     name: "extension_logs",
     description: "Read or stream logs from every context of a running dev session (service worker, content scripts, popup, options, sidebar, devtools, pages) in one ordered timeline. Reads the same agent-bridge plane as the `extension logs` CLI: a one-shot returns the most recent matching lines from logs.ndjson; `follow:true` collects from the live control channel for a bounded window. Requires an active `extension dev` session.",
     inputSchema: {
@@ -1621,12 +1825,12 @@ const logs_schema = {
             },
             followMs: {
                 type: "number",
-                default: DEFAULT_FOLLOW_MS,
-                description: `How long to collect live frames when follow=true (clamped ${MIN_FOLLOW_MS}–${MAX_FOLLOW_MS}ms).`
+                default: 4000,
+                description: "How long to collect live frames when follow=true (clamped 500–15000ms)."
             },
             limit: {
                 type: "number",
-                default: DEFAULT_LIMIT,
+                default: 200,
                 description: "Maximum number of (most recent) events to return."
             }
         },
@@ -1634,56 +1838,7 @@ const logs_schema = {
             "projectPath"
         ]
     }
-};
-const LEVEL_ORDER = [
-    "error",
-    "warn",
-    "info",
-    "debug",
-    "trace"
-];
-function levelRank(level) {
-    const l = "log" === level ? "info" : level;
-    const i = LEVEL_ORDER.indexOf(l);
-    return -1 === i ? LEVEL_ORDER.length : i;
-}
-function makeUrlMatcher(pattern) {
-    const hasGlob = pattern.includes("*");
-    let re = null;
-    if (hasGlob) {
-        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-        re = new RegExp(escaped);
-    }
-    return (event)=>{
-        const candidates = [
-            event.url,
-            event.hostname
-        ].filter((v)=>"string" == typeof v);
-        if (0 === candidates.length) return false;
-        return candidates.some((c)=>re ? re.test(c) : c.includes(pattern));
-    };
-}
-function makeFilter(args) {
-    const minLevel = String(args.level || "all").toLowerCase();
-    const rawContexts = Array.isArray(args.context) ? args.context : "string" == typeof args.context ? args.context.split(",") : null;
-    const contexts = rawContexts && rawContexts.length ? new Set(rawContexts.map((c)=>c.trim()).filter(Boolean)) : null;
-    const sinceSeq = null != args.since ? Number(args.since) : null;
-    const urlMatches = args.url ? makeUrlMatcher(args.url) : null;
-    const tabId = null != args.tab ? Number(args.tab) : null;
-    return (event)=>{
-        if (!event || "object" != typeof event) return false;
-        if ("header" === event.type) return false;
-        if (args.signalsOnly && "dx.signal" !== event.eventType) return false;
-        if (contexts && !contexts.has(event.context)) return false;
-        if ("all" !== minLevel && "off" !== minLevel) {
-            if (levelRank(event.level) > levelRank(minLevel)) return false;
-        }
-        if (null != sinceSeq && Number.isFinite(sinceSeq) && "number" == typeof event.seq && event.seq <= sinceSeq) return false;
-        if (urlMatches && !urlMatches(event)) return false;
-        if (null != tabId && Number.isFinite(tabId) && event.tabId !== tabId) return false;
-        return true;
-    };
-}
+};
 function logsFilePath(projectPath, browser) {
     return node_path.resolve(projectPath, "dist", "extension-js", browser, "logs.ndjson");
 }
@@ -1759,7 +1914,7 @@ async function readFromStream(args, browser, limit) {
         error: `No active control channel found for ${browser}.`,
         hint: `Run extension_dev (browser: ${browser}) and wait for it to be ready, then retry. For past logs without a live channel, call without follow.`
     });
-    const followMs = Math.min(Math.max(args.followMs ?? DEFAULT_FOLLOW_MS, MIN_FOLLOW_MS), MAX_FOLLOW_MS);
+    const followMs = Math.min(Math.max(args.followMs ?? 4000, 500), 15000);
     const matches = makeFilter(args);
     const events = [];
     let dropped = 0;
@@ -1790,7 +1945,7 @@ async function readFromStream(args, browser, limit) {
             try {
                 socket.send(JSON.stringify({
                     type: "hello",
-                    v: CONTROL_ENVELOPE_VERSION,
+                    v: 1,
                     role: "consumer",
                     instanceId: ready.instanceId
                 }));
@@ -1822,7 +1977,7 @@ async function readFromStream(args, browser, limit) {
 }
 async function logs_handler(args) {
     const browser = args.browser ?? "chromium";
-    const limit = args.limit && args.limit > 0 ? args.limit : DEFAULT_LIMIT;
+    const limit = args.limit && args.limit > 0 ? args.limit : 200;
     if (args.follow) return readFromStream(args, browser, limit);
     return readFromFile(args, browser, limit);
 }
@@ -2046,7 +2201,7 @@ async function reload_handler(args) {
 }
 const open_schema = {
     name: "extension_open",
-    description: "Open an extension surface — popup, options, or sidebar — in a running session. Requires the dev session to be started with --allow-control. Wraps `extension open`.",
+    description: "Open an extension surface or replay an event in a running session. 'popup'/'options'/'sidebar' open UI surfaces. 'action' triggers the toolbar action: opens the action's popup, or (no popup) replays chrome.action.onClicked. 'command' replays a chrome.commands.onCommand keyboard shortcut (pass `name`). NOTE: action/command replay invokes your listener WITHOUT a user gesture, so the gesture-derived activeTab grant does not apply (the result includes gesture:false and a warning when activeTab is declared). Requires --allow-control. Wraps `extension open`.",
     inputSchema: {
         type: "object",
         properties: {
@@ -2059,9 +2214,15 @@ const open_schema = {
                 enum: [
                     "popup",
                     "options",
-                    "sidebar"
+                    "sidebar",
+                    "action",
+                    "command"
                 ],
-                description: "Which surface to open"
+                description: "Which surface to open or event to replay. 'action' triggers the toolbar action; 'command' replays a keyboard-shortcut command (requires `name`)."
+            },
+            name: {
+                type: "string",
+                description: "For surface 'command': the chrome.commands name to trigger."
             },
             browser: {
                 type: "string",
@@ -2084,6 +2245,7 @@ async function open_handler(args) {
         args.surface,
         args.projectPath
     ];
+    if ("command" === args.surface && args.name) cli.push("--name", args.name);
     if (args.browser) cli.push("--browser", args.browser);
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
@@ -2179,9 +2341,73 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
+function credentialsPath() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev", "auth.json");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev", "auth.json");
+}
+function readCredentials() {
+    try {
+        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const token = String(data.token || "").trim();
+        if (!token) return null;
+        return {
+            version: 1,
+            token,
+            workspaceSlug: String(data.workspaceSlug || ""),
+            projectSlug: String(data.projectSlug || ""),
+            expiresAt: Number(data.expiresAt || 0),
+            api: String(data.api || "")
+        };
+    } catch  {
+        return null;
+    }
+}
+function writeCredentials(creds) {
+    const file = credentialsPath();
+    node_fs.mkdirSync(node_path.dirname(file), {
+        recursive: true
+    });
+    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
+        mode: 384
+    });
+    try {
+        node_fs.chmodSync(file, 384);
+    } catch  {}
+    return file;
+}
+function clearCredentials() {
+    const file = credentialsPath();
+    try {
+        node_fs.unlinkSync(file);
+        return {
+            cleared: true,
+            path: file
+        };
+    } catch  {
+        return {
+            cleared: false,
+            path: file
+        };
+    }
+}
+function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
+    const creds = readCredentials();
+    if (!creds) return null;
+    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
+    return creds;
+}
+const DEFAULT_API = "https://www.extension.dev";
 const publish_schema = {
     name: "extension_publish",
-    description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Wraps `extension publish` (which posts to the platform's CLI publish endpoint). This is the only tool that talks to the hosted platform rather than the local browser.",
+    description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
     inputSchema: {
         type: "object",
         properties: {
@@ -2207,32 +2433,171 @@ const publish_schema = {
         ]
     }
 };
-async function publish_handler(args) {
-    const cli = [
-        "publish",
-        args.projectPath,
-        "--output",
-        "json"
-    ];
-    if (null != args.ttlHours) cli.push("--ttl", String(args.ttlHours));
-    if (args.buildSha) cli.push("--build-sha", args.buildSha);
-    if (args.api) cli.push("--api", args.api);
-    const { code, stdout, stderr } = await runExtensionCli(cli, {
-        cwd: args.projectPath
+function resolveToken() {
+    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
+    if (fromEnv) return fromEnv;
+    const creds = readValidCredentials();
+    return creds?.token ? String(creds.token).trim() : "";
+}
+function safeApiBase(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    } catch  {
+        return {
+            ok: false,
+            message: `Invalid platform URL: ${raw}`
+        };
+    }
+    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
+    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
+        ok: false,
+        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
+    };
+    return {
+        ok: true,
+        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
+    };
+}
+function fail(name, message) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        }
     });
-    const out = stdout.trim();
-    if (out) try {
-        JSON.parse(out);
-        return out;
-    } catch  {}
+}
+async function publish_handler(args) {
+    const token = resolveToken();
+    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
+    if (!apiCheck.ok) return fail("PublishConfigError", apiCheck.message);
+    const url = `${apiCheck.base}/api/cli/publish`;
+    const body = {};
+    if (null != args.ttlHours) body.ttlHours = Number(args.ttlHours);
+    if (args.buildSha) body.buildSha = args.buildSha;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return fail("PublishNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return fail("PublishError", `publish failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    return JSON.stringify(data);
+}
+const release_promote_DEFAULT_API = "https://www.extension.dev";
+const release_promote_schema = {
+    name: "extension_release_promote",
+    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
+    inputSchema: {
+        type: "object",
+        properties: {
+            buildId: {
+                type: "string",
+                description: "Build commit SHA to promote (a 7-char short SHA is fine)"
+            },
+            channel: {
+                type: "string",
+                description: "Target release channel, e.g. stable, preview, beta"
+            },
+            sourceChannel: {
+                type: "string",
+                description: "Channel to promote from (optional; inferred otherwise)"
+            },
+            browsers: {
+                type: "array",
+                items: {
+                    type: "string"
+                },
+                description: "Browsers to release (optional; auto-detected from the build)"
+            },
+            version: {
+                type: "string",
+                description: "Version label for the release (optional)"
+            },
+            releaseNotes: {
+                type: "string",
+                description: "Release notes markdown (optional)"
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
+            }
+        },
+        required: [
+            "buildId",
+            "channel"
+        ]
+    }
+};
+function release_promote_fail(name, message) {
     return JSON.stringify({
         ok: false,
         error: {
-            name: "PublishError",
-            message: stderr.trim() || `extension publish exited with code ${code}`
+            name,
+            message
         }
     });
 }
+async function release_promote_handler(args) {
+    const token = resolveToken();
+    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    const buildId = String(args.buildId || "").trim();
+    const channel = String(args.channel || "").trim();
+    if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
+    if (!apiCheck.ok) return release_promote_fail("ReleaseConfigError", apiCheck.message);
+    const url = `${apiCheck.base}/api/cli/release/promote`;
+    const body = {
+        buildId,
+        channel
+    };
+    if (args.sourceChannel) body.sourceChannel = String(args.sourceChannel).trim();
+    if (Array.isArray(args.browsers) && args.browsers.length) body.browsers = args.browsers.map((b)=>String(b).trim()).filter(Boolean);
+    if (args.version) body.version = String(args.version).trim();
+    if (args.releaseNotes) body.releaseNotes = String(args.releaseNotes);
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return release_promote_fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return release_promote_fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    return JSON.stringify(data);
+}
 const wait_schema = {
     name: "extension_wait",
     description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status.",
@@ -2528,6 +2893,303 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+async function startDeviceCode(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json"
+        },
+        body: JSON.stringify({
+            client_id: args.clientId,
+            scope: args.scope || "read:user"
+        })
+    });
+    const data = await res.json().catch(()=>({}));
+    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
+    return {
+        deviceCode: String(data.device_code || ""),
+        userCode: String(data.user_code || ""),
+        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
+        interval: Number(data.interval || 5),
+        expiresIn: Number(data.expires_in || 900)
+    };
+}
+async function pollForToken(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const sleep = args.sleepImpl ?? defaultSleep;
+    let intervalMs = 1000 * Math.max(1, args.interval);
+    const deadline = Date.now() + Math.max(0, args.budgetMs);
+    while(Date.now() < deadline){
+        await sleep(intervalMs);
+        const res = await doFetch(GITHUB_TOKEN_URL, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json"
+            },
+            body: JSON.stringify({
+                client_id: args.clientId,
+                device_code: args.deviceCode,
+                grant_type: DEVICE_GRANT_TYPE
+            })
+        });
+        const data = await res.json().catch(()=>({}));
+        const token = String(data.access_token || "").trim();
+        if (token) return {
+            ok: true,
+            githubToken: token
+        };
+        const error = String(data.error || "");
+        if ("authorization_pending" === error) continue;
+        if ("slow_down" === error) {
+            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
+            continue;
+        }
+        if ("expired_token" === error) return {
+            ok: false,
+            reason: "expired"
+        };
+        if ("access_denied" === error) return {
+            ok: false,
+            reason: "denied"
+        };
+    }
+    return {
+        ok: false,
+        reason: "pending"
+    };
+}
+const login_flow_DEFAULT_API = "https://www.extension.dev";
+function resolveApiBase(api) {
+    return String(api || process.env.EXTENSION_DEV_API_URL || login_flow_DEFAULT_API).replace(/\/+$/, "");
+}
+async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
+    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
+    if (override) return {
+        clientId: override,
+        scope: "read:user"
+    };
+    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
+        headers: {
+            accept: "application/json"
+        }
+    });
+    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
+    const data = await res.json().catch(()=>({}));
+    const clientId = String(data.githubClientId || "").trim();
+    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    return {
+        clientId,
+        scope: String(data.scope || "read:user")
+    };
+}
+async function exchangeAndPersist(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            githubToken: args.githubToken,
+            project: args.project
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
+    const token = String(data.token || "").trim();
+    if (!token) throw new Error("Login exchange returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(data.workspaceSlug || ""),
+        projectSlug: String(data.projectSlug || ""),
+        expiresAt: Number(data.expiresAt || 0),
+        api: args.apiBase
+    };
+    writeCredentials(creds);
+    return creds;
+}
+const login_schema = {
+    name: "extension_login",
+    description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            project: {
+                type: "string",
+                description: "Target project as '<workspace>/<project>' (the token is scoped to it)"
+            },
+            deviceCode: {
+                type: "string",
+                description: "Resume token from a prior call's `deviceCode`; omit on the first call"
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
+            }
+        },
+        required: [
+            "project"
+        ]
+    }
+};
+const FIRST_CALL_BUDGET_MS = 8000;
+const RESUME_BUDGET_MS = 22000;
+function login_fail(name, message) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        }
+    });
+}
+function success(creds) {
+    return JSON.stringify({
+        ok: true,
+        status: "logged-in",
+        workspaceSlug: creds.workspaceSlug,
+        projectSlug: creds.projectSlug,
+        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
+        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token.`
+    });
+}
+function login_pending(start) {
+    return JSON.stringify({
+        ok: false,
+        status: "authorization_pending",
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        deviceCode: start.deviceCode,
+        message: `Open ${start.verificationUri} and enter code ${start.userCode}, then call extension_login again with this deviceCode (and the same project).`
+    });
+}
+async function login_handler(args) {
+    const project = String(args.project || "").trim();
+    if (!/^[^/]+\/[^/]+$/.test(project)) return login_fail("BadRequest", "project must be in the form '<workspace>/<project>'.");
+    const apiBase = resolveApiBase(args.api);
+    let config;
+    try {
+        config = await fetchLoginConfig(apiBase);
+    } catch (err) {
+        return login_fail("LoginConfigError", err?.message || "Could not load login config.");
+    }
+    if (args.deviceCode) {
+        const poll = await pollForToken({
+            clientId: config.clientId,
+            deviceCode: String(args.deviceCode),
+            interval: 5,
+            budgetMs: RESUME_BUDGET_MS
+        });
+        if (!poll.ok) {
+            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
+            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
+            return login_pending({
+                deviceCode: String(args.deviceCode),
+                userCode: "(see the previous response)",
+                verificationUri: "https://github.com/login/device"
+            });
+        }
+        try {
+            const creds = await exchangeAndPersist({
+                apiBase,
+                githubToken: poll.githubToken,
+                project
+            });
+            return success(creds);
+        } catch (err) {
+            return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
+        }
+    }
+    let start;
+    try {
+        start = await startDeviceCode({
+            clientId: config.clientId,
+            scope: config.scope
+        });
+    } catch (err) {
+        return login_fail("LoginStartError", err?.message || "Could not start device flow.");
+    }
+    const poll = await pollForToken({
+        clientId: config.clientId,
+        deviceCode: start.deviceCode,
+        interval: start.interval,
+        budgetMs: FIRST_CALL_BUDGET_MS
+    });
+    if (poll.ok) try {
+        const creds = await exchangeAndPersist({
+            apiBase,
+            githubToken: poll.githubToken,
+            project
+        });
+        return success(creds);
+    } catch (err) {
+        return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
+    }
+    if (!poll.ok && "denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
+    return login_pending(start);
+}
+const whoami_schema = {
+    name: "extension_whoami",
+    description: "Report the locally stored extension.dev login (workspace/project and token expiry) without revealing the token. Returns logged-out status when no credentials are stored.",
+    inputSchema: {
+        type: "object",
+        properties: {}
+    }
+};
+async function whoami_handler() {
+    const creds = readCredentials();
+    if (!creds) return JSON.stringify({
+        ok: true,
+        status: "logged-out",
+        message: "No stored credentials. Run extension_login to authenticate."
+    });
+    const now = Math.floor(Date.now() / 1000);
+    const expired = Boolean(creds.expiresAt && creds.expiresAt <= now);
+    return JSON.stringify({
+        ok: true,
+        status: expired ? "expired" : "logged-in",
+        workspaceSlug: creds.workspaceSlug,
+        projectSlug: creds.projectSlug,
+        api: creds.api,
+        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
+        expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
+        expired,
+        message: expired ? "Stored token has expired. Run extension_login to refresh it." : `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`
+    });
+}
+const logout_schema = {
+    name: "extension_logout",
+    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (revoke from the dashboard if needed); only removes it from this machine.",
+    inputSchema: {
+        type: "object",
+        properties: {}
+    }
+};
+async function logout_handler() {
+    const result = clearCredentials();
+    return JSON.stringify({
+        ok: true,
+        cleared: result.cleared,
+        message: result.cleared ? "Local credentials removed." : "No stored credentials to remove."
+    });
+}
 const install_browser_schema = {
     name: "extension_install_browser",
     description: "Install a managed browser binary for extension testing. Useful in CI, Docker, or fresh environments where browsers are not pre-installed.",
@@ -2867,6 +3529,7 @@ const tools = [
     manifest_validate_namespaceObject,
     inspect_namespaceObject,
     source_inspect_namespaceObject,
+    list_extensions_namespaceObject,
     logs_namespaceObject,
     eval_namespaceObject,
     storage_namespaceObject,
@@ -2874,8 +3537,12 @@ const tools = [
     open_namespaceObject,
     dom_inspect_namespaceObject,
     publish_namespaceObject,
+    release_promote_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
+    login_namespaceObject,
+    whoami_namespaceObject,
+    logout_namespaceObject,
     install_browser_namespaceObject,
     list_browsers_namespaceObject,
     detect_browsers_namespaceObject
@@ -2885,7 +3552,7 @@ for (const tool of tools)toolMap.set(tool.schema.name, tool);
 async function startServer() {
     const server = new Server({
         name: "extension-dev",
-        version: "3.13.5"
+        version: package_namespaceObject.rE
     }, {
         capabilities: {
             tools: {}
@@ -2941,4 +3608,88 @@ async function startServer() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }
-export { startServer };
+async function runCli(cmd, args) {
+    const log = (msg)=>process.stderr.write(`${msg}\n`);
+    const flag = (name)=>{
+        const i = args.indexOf(`--${name}`);
+        return i >= 0 ? args[i + 1] : void 0;
+    };
+    if ("whoami" === cmd) {
+        log(await whoami_handler());
+        return 0;
+    }
+    if ("release" === cmd) {
+        const sub = String(args[0] || "").trim();
+        if ("promote" === sub) {
+            const buildId = String(flag("build") || flag("build-id") || "").trim();
+            const channel = String(flag("channel") || "").trim();
+            if (!buildId || !channel) {
+                log("Usage: extension-mcp release promote --build <sha> --channel <channel> [--source-channel <c>] [--version <v>] [--api <url>]");
+                return 1;
+            }
+            const out = await release_promote_handler({
+                buildId,
+                channel,
+                sourceChannel: flag("source-channel"),
+                version: flag("version"),
+                api: flag("api")
+            });
+            log(out);
+            let parsed = null;
+            try {
+                parsed = JSON.parse(out);
+            } catch  {
+                parsed = null;
+            }
+            return parsed?.ok === false ? 1 : 0;
+        }
+        log("Usage: extension-mcp release promote --build <sha> --channel <channel>");
+        return 1;
+    }
+    if ("logout" === cmd) {
+        log(await logout_handler());
+        return 0;
+    }
+    if ("login" === cmd) {
+        const project = String(flag("project") || "").trim();
+        if (!/^[^/]+\/[^/]+$/.test(project)) {
+            log("Usage: extension-mcp login --project <workspace>/<project> [--api <url>]");
+            return 1;
+        }
+        const apiBase = resolveApiBase(flag("api"));
+        try {
+            const config = await fetchLoginConfig(apiBase);
+            const start = await startDeviceCode({
+                clientId: config.clientId,
+                scope: config.scope
+            });
+            log("");
+            log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
+            log("");
+            log("  Waiting for authorization...");
+            const poll = await pollForToken({
+                clientId: config.clientId,
+                deviceCode: start.deviceCode,
+                interval: start.interval,
+                budgetMs: 1000 * start.expiresIn
+            });
+            if (!poll.ok) {
+                log("denied" === poll.reason ? "Authorization was denied on GitHub." : "Timed out waiting for authorization. Run login again.");
+                return 1;
+            }
+            const creds = await exchangeAndPersist({
+                apiBase,
+                githubToken: poll.githubToken,
+                project
+            });
+            log(`Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`);
+            return 0;
+        } catch (err) {
+            log(err instanceof Error ? err.message : String(err));
+            return 1;
+        }
+    }
+    log(`Unknown command: ${cmd}. Expected one of: login, logout, whoami, release.`);
+    return 1;
+}
+export { runCli, startServer };