@extension.dev/mcp 3.17.0 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 4.1.0
+
+The MCP now consumes `@extension.dev/core` for all platform-auth logic
+(core MIGRATION.md phase 2). No tool schema changes, no behavior changes:
+the JSON-string envelopes are byte-compatible and pinned by tests.
+
+- New dependency `@extension.dev/core` ^0.2.0: device-code login, credential
+  store, and publish client now live there, shared with every other surface.
+- Deleted `src/lib/credentials.ts`, `src/lib/github-device.ts`,
+  `src/lib/login-flow.ts` and their migrated tests; `login`, `whoami`,
+  `logout`, and `release-promote` import from core.
+- `tools/publish.ts` is a thin adapter over core's `publish()`; the frozen
+  PublishAuthError / PublishConfigError / PublishNetworkError / PublishError
+  envelopes and the success passthrough are pinned by a new
+  `publish-envelope` test.
+- New `core-boundary` regression test: no file under `src/` may redefine the
+  credential store or import auth primitives from anywhere but
+  `@extension.dev/core`.
+- CI and Release workflows pass `NPM_TOKEN` to the install step (core is
+  npm-restricted until the public flip).
+
+## 4.0.8
+
+Tracks the `extension` 4.0.8 suite (the versioning convention: this package's
+version follows the CLI suite release it pairs with). One tool was added since
+3.17.0, `extension_release_promote`, bringing the surface to 27 tools.
+
+- Bump `extension-create`, `extension-develop`, `extension-install` from
+  ^3.13.5 to ^4.0.8. All consumed APIs (`extensionCreate`, `extensionBuild`,
+  `extensionInstall`, `getManagedBrowsersCacheRoot`) and all CLI verbs the
+  tools shell out to (`dev`, `start`, `preview`, `logs`, `eval`, `storage`,
+  `reload`, `open`, `inspect`, `publish`, including `--allow-control`,
+  `--allow-eval` and `--no-browser`) are unchanged in 4.x; verified
+  end-to-end (create -> build -> dev ready contract -> manifest validate).
+- `package.json` version now matches the published line (was a stale 0.0.1)
+  and the server reports its version from `package.json` instead of a
+  hardcoded string (previously stuck at 3.13.5).
+- `browser-extension-manifest-fields` ^2.2.8 -> ^2.2.9.
+- vitest config: resolve the extension-* test aliases from the packages'
+  exports maps; 4.x dropped the CJS entry, so `require.resolve` on the bare
+  specifier no longer works.
+
 ## 3.17.0
 
 First stable release on npm. The registry previously carried only canary

package/bin/extension-mcp.js

@@ -3,7 +3,7 @@ import {startServer, runCli} from '../dist/module.js'
 
 const [, , cmd, ...rest] = process.argv
 
-if (cmd && ['login', 'logout', 'whoami'].includes(cmd)) {
+if (cmd && ['login', 'logout', 'whoami', 'release'].includes(cmd)) {
   runCli(cmd, rest)
     .then((code) => process.exit(code))
     .catch((err) => {