@extension.dev/mcp 4.0.8 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 4.1.0
+
+The MCP now consumes `@extension.dev/core` for all platform-auth logic
+(core MIGRATION.md phase 2). No tool schema changes, no behavior changes:
+the JSON-string envelopes are byte-compatible and pinned by tests.
+
+- New dependency `@extension.dev/core` ^0.2.0: device-code login, credential
+  store, and publish client now live there, shared with every other surface.
+- Deleted `src/lib/credentials.ts`, `src/lib/github-device.ts`,
+  `src/lib/login-flow.ts` and their migrated tests; `login`, `whoami`,
+  `logout`, and `release-promote` import from core.
+- `tools/publish.ts` is a thin adapter over core's `publish()`; the frozen
+  PublishAuthError / PublishConfigError / PublishNetworkError / PublishError
+  envelopes and the success passthrough are pinned by a new
+  `publish-envelope` test.
+- New `core-boundary` regression test: no file under `src/` may redefine the
+  credential store or import auth primitives from anywhere but
+  `@extension.dev/core`.
+- CI and Release workflows pass `NPM_TOKEN` to the install step (core is
+  npm-restricted until the public flip).
+
 ## 4.0.8
 
 Tracks the `extension` 4.0.8 suite (the versioning convention: this package's

package/dist/module.js

@@ -11,6 +11,7 @@ import cross_spawn from "cross-spawn";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import node_net from "node:net";
 import ws from "ws";
+import { clearCredentials, exchangeAndPersist, fetchLoginConfig, pollForToken, publish, readCredentials, resolveApiBase, resolveToken, safeApiBase, startDeviceCode } from "@extension.dev/core";
 import { extensionInstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -132,8 +133,6 @@ var publish_namespaceObject = {};
 __webpack_require__.r(publish_namespaceObject);
 __webpack_require__.d(publish_namespaceObject, {
     handler: ()=>publish_handler,
-    resolveToken: ()=>resolveToken,
-    safeApiBase: ()=>safeApiBase,
     schema: ()=>publish_schema
 });
 var release_promote_namespaceObject = {};
@@ -179,7 +178,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     schema: ()=>whoami_schema
 });
 var package_namespaceObject = {
-    rE: "4.0.8"
+    rE: "4.1.0"
 };
 const schema = {
     name: "extension_create",
@@ -2341,70 +2340,6 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
-function credentialsPath() {
-    if ("win32" === process.platform) {
-        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
-        return node_path.join(base, "extension-dev", "auth.json");
-    }
-    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
-    const base = xdg || node_path.join(node_os.homedir(), ".config");
-    return node_path.join(base, "extension-dev", "auth.json");
-}
-function readCredentials() {
-    try {
-        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
-        const data = JSON.parse(raw);
-        if (!data || "object" != typeof data) return null;
-        if (1 !== data.version) return null;
-        const token = String(data.token || "").trim();
-        if (!token) return null;
-        return {
-            version: 1,
-            token,
-            workspaceSlug: String(data.workspaceSlug || ""),
-            projectSlug: String(data.projectSlug || ""),
-            expiresAt: Number(data.expiresAt || 0),
-            api: String(data.api || "")
-        };
-    } catch  {
-        return null;
-    }
-}
-function writeCredentials(creds) {
-    const file = credentialsPath();
-    node_fs.mkdirSync(node_path.dirname(file), {
-        recursive: true
-    });
-    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
-        mode: 384
-    });
-    try {
-        node_fs.chmodSync(file, 384);
-    } catch  {}
-    return file;
-}
-function clearCredentials() {
-    const file = credentialsPath();
-    try {
-        node_fs.unlinkSync(file);
-        return {
-            cleared: true,
-            path: file
-        };
-    } catch  {
-        return {
-            cleared: false,
-            path: file
-        };
-    }
-}
-function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
-    const creds = readCredentials();
-    if (!creds) return null;
-    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
-    return creds;
-}
-const DEFAULT_API = "https://www.extension.dev";
 const publish_schema = {
     name: "extension_publish",
     description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
@@ -2433,76 +2368,24 @@ const publish_schema = {
         ]
     }
 };
-function resolveToken() {
-    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
-    if (fromEnv) return fromEnv;
-    const creds = readValidCredentials();
-    return creds?.token ? String(creds.token).trim() : "";
-}
-function safeApiBase(raw) {
-    let parsed;
-    try {
-        parsed = new URL(raw);
-    } catch  {
-        return {
-            ok: false,
-            message: `Invalid platform URL: ${raw}`
-        };
-    }
-    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
-    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
-        ok: false,
-        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
-    };
-    return {
-        ok: true,
-        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
-    };
-}
-function fail(name, message) {
-    return JSON.stringify({
+async function publish_handler(args) {
+    const token = resolveToken();
+    if (!token) return JSON.stringify({
         ok: false,
         error: {
-            name,
-            message
+            name: "PublishAuthError",
+            message: "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
         }
     });
+    const result = await publish({
+        ttlHours: args.ttlHours,
+        buildSha: args.buildSha,
+        api: args.api,
+        token
+    });
+    return result.ok ? JSON.stringify(result.data) : JSON.stringify(result);
 }
-async function publish_handler(args) {
-    const token = resolveToken();
-    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
-    if (!apiCheck.ok) return fail("PublishConfigError", apiCheck.message);
-    const url = `${apiCheck.base}/api/cli/publish`;
-    const body = {};
-    if (null != args.ttlHours) body.ttlHours = Number(args.ttlHours);
-    if (args.buildSha) body.buildSha = args.buildSha;
-    let res;
-    try {
-        res = await fetch(url, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${token}`,
-                "content-type": "application/json"
-            },
-            body: JSON.stringify(body)
-        });
-    } catch (err) {
-        return fail("PublishNetworkError", `Could not reach ${url}: ${err?.message || err}`);
-    }
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) return fail("PublishError", `publish failed (${res.status}): ${data?.message || text || "unknown error"}`);
-    return JSON.stringify(data);
-}
-const release_promote_DEFAULT_API = "https://www.extension.dev";
+const DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
     description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
@@ -2547,7 +2430,7 @@ const release_promote_schema = {
         ]
     }
 };
-function release_promote_fail(name, message) {
+function fail(name, message) {
     return JSON.stringify({
         ok: false,
         error: {
@@ -2558,12 +2441,12 @@ function release_promote_fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    if (!token) return fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
-    if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
-    if (!apiCheck.ok) return release_promote_fail("ReleaseConfigError", apiCheck.message);
+    if (!buildId || !channel) return fail("ReleaseInputError", "buildId and channel are required.");
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
+    if (!apiCheck.ok) return fail("ReleaseConfigError", apiCheck.message);
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const body = {
         buildId,
@@ -2584,7 +2467,7 @@ async function release_promote_handler(args) {
             body: JSON.stringify(body)
         });
     } catch (err) {
-        return release_promote_fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+        return fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
     }
     const text = await res.text();
     let data;
@@ -2595,7 +2478,7 @@ async function release_promote_handler(args) {
             message: text
         };
     }
-    if (!res.ok) return release_promote_fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    if (!res.ok) return fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
     return JSON.stringify(data);
 }
 const wait_schema = {
@@ -2893,138 +2776,6 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
-async function startDeviceCode(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/json"
-        },
-        body: JSON.stringify({
-            client_id: args.clientId,
-            scope: args.scope || "read:user"
-        })
-    });
-    const data = await res.json().catch(()=>({}));
-    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
-    return {
-        deviceCode: String(data.device_code || ""),
-        userCode: String(data.user_code || ""),
-        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
-        interval: Number(data.interval || 5),
-        expiresIn: Number(data.expires_in || 900)
-    };
-}
-async function pollForToken(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const sleep = args.sleepImpl ?? defaultSleep;
-    let intervalMs = 1000 * Math.max(1, args.interval);
-    const deadline = Date.now() + Math.max(0, args.budgetMs);
-    while(Date.now() < deadline){
-        await sleep(intervalMs);
-        const res = await doFetch(GITHUB_TOKEN_URL, {
-            method: "POST",
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json"
-            },
-            body: JSON.stringify({
-                client_id: args.clientId,
-                device_code: args.deviceCode,
-                grant_type: DEVICE_GRANT_TYPE
-            })
-        });
-        const data = await res.json().catch(()=>({}));
-        const token = String(data.access_token || "").trim();
-        if (token) return {
-            ok: true,
-            githubToken: token
-        };
-        const error = String(data.error || "");
-        if ("authorization_pending" === error) continue;
-        if ("slow_down" === error) {
-            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
-            continue;
-        }
-        if ("expired_token" === error) return {
-            ok: false,
-            reason: "expired"
-        };
-        if ("access_denied" === error) return {
-            ok: false,
-            reason: "denied"
-        };
-    }
-    return {
-        ok: false,
-        reason: "pending"
-    };
-}
-const login_flow_DEFAULT_API = "https://www.extension.dev";
-function resolveApiBase(api) {
-    return String(api || process.env.EXTENSION_DEV_API_URL || login_flow_DEFAULT_API).replace(/\/+$/, "");
-}
-async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        clientId: override,
-        scope: "read:user"
-    };
-    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
-        headers: {
-            accept: "application/json"
-        }
-    });
-    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
-    const data = await res.json().catch(()=>({}));
-    const clientId = String(data.githubClientId || "").trim();
-    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
-    return {
-        clientId,
-        scope: String(data.scope || "read:user")
-    };
-}
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    const token = String(data.token || "").trim();
-    if (!token) throw new Error("Login exchange returned no token.");
-    const creds = {
-        version: 1,
-        token,
-        workspaceSlug: String(data.workspaceSlug || ""),
-        projectSlug: String(data.projectSlug || ""),
-        expiresAt: Number(data.expiresAt || 0),
-        api: args.apiBase
-    };
-    writeCredentials(creds);
-    return creds;
-}
 const login_schema = {
     name: "extension_login",
     description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",

package/dist/src/tools/publish.d.ts

@@ -24,23 +24,6 @@ export declare const schema: {
         required: string[];
     };
 };
-/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
-export declare function resolveToken(): string;
-/**
- * Validate the platform base URL BEFORE we attach a bearer token to a request to
- * it. SECURITY: the `api` arg / EXTENSION_DEV_API_URL is operator-supplied, but a
- * hostile value (e.g. via prompt-injection in the client) could redirect the
- * token to an attacker. The access token must never leave over plaintext or go to
- * an arbitrary scheme, so we require https -- allowing http only for localhost
- * dev. Returns the normalized base (no trailing slash) or an error message.
- */
-export declare function safeApiBase(raw: string): {
-    ok: true;
-    base: string;
-} | {
-    ok: false;
-    message: string;
-};
 export declare function handler(args: {
     projectPath: string;
     ttlHours?: number;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "4.0.8",
+  "version": "4.1.0",
   "description": "MCP server that lets AI agents build, run, inspect, and publish browser extensions. 26 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox.",
   "license": "MIT",
   "author": {
@@ -62,6 +62,7 @@
     "extension.dev"
   ],
   "dependencies": {
+    "@extension.dev/core": "^0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",

package/dist/src/lib/credentials.d.ts

@@ -1,24 +0,0 @@
-export interface StoredCredentials {
-    version: 1;
-    /** The HMAC access token the publish path sends as `Bearer`. */
-    token: string;
-    workspaceSlug: string;
-    projectSlug: string;
-    /** Token expiry as unix epoch seconds (0 if unknown). */
-    expiresAt: number;
-    /** Platform base URL the token was minted against. */
-    api: string;
-}
-export declare function credentialsPath(): string;
-export declare function readCredentials(): StoredCredentials | null;
-export declare function writeCredentials(creds: StoredCredentials): string;
-export declare function clearCredentials(): {
-    cleared: boolean;
-    path: string;
-};
-/**
- * Return stored credentials only if the token has not expired. Used by the
- * publish token resolution so an expired local token falls through cleanly to
- * "no token" instead of producing a 401 from the platform.
- */
-export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -1,40 +0,0 @@
-export interface DeviceCodeStart {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    /** Minimum seconds to wait between polls. */
-    interval: number;
-    /** Seconds until the device code expires. */
-    expiresIn: number;
-}
-export type PollResult = {
-    ok: true;
-    githubToken: string;
-} | {
-    ok: false;
-    reason: "pending" | "expired" | "denied";
-    error?: string;
-};
-type FetchImpl = typeof fetch;
-type SleepImpl = (ms: number) => Promise<void>;
-export declare function startDeviceCode(args: {
-    clientId: string;
-    scope?: string;
-    fetchImpl?: FetchImpl;
-}): Promise<DeviceCodeStart>;
-/**
- * Poll for the access token until the budget elapses. A budget shorter than
- * the device-code lifetime lets a caller (e.g. an MCP tool that must return
- * promptly) poll in bounded slices and report "pending" between calls; a long
- * budget (a blocking CLI) waits the whole time. Returns `pending` only on
- * budget exhaustion; `expired`/`denied` are terminal.
- */
-export declare function pollForToken(args: {
-    clientId: string;
-    deviceCode: string;
-    interval: number;
-    budgetMs: number;
-    fetchImpl?: FetchImpl;
-    sleepImpl?: SleepImpl;
-}): Promise<PollResult>;
-export {};

package/dist/src/lib/login-flow.d.ts

@@ -1,25 +0,0 @@
-import { type StoredCredentials } from "./credentials";
-type FetchImpl = typeof fetch;
-export declare function resolveApiBase(api?: string): string;
-export interface LoginConfig {
-    clientId: string;
-    scope: string;
-}
-/**
- * Resolve the GitHub OAuth client id the device flow authenticates against.
- * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
- * hosted platform); otherwise it comes from the platform's public config.
- */
-export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
-/**
- * Trade a verified GitHub user token for a project-scoped access token and
- * write it to the local credentials file. Returns the stored credentials
- * (token included for the caller's in-memory use; never logged).
- */
-export declare function exchangeAndPersist(args: {
-    apiBase: string;
-    githubToken: string;
-    project: string;
-    fetchImpl?: FetchImpl;
-}): Promise<StoredCredentials>;
-export {};