@extension.dev/mcp 4.0.8 → 4.1.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 4.1.1
+
+README rewritten for the public npm page: Extension.js-style header
+(badges, tagline, quick start), tool table updated to the full 27-tool
+surface (release-promote was missing), and links to private repos or
+npm-restricted packages removed. Package description tool count fixed
+(26 -> 27). No code changes.
+
+## 4.1.0
+
+The MCP now consumes `@extension.dev/core` for all platform-auth logic
+(core MIGRATION.md phase 2). No tool schema changes, no behavior changes:
+the JSON-string envelopes are byte-compatible and pinned by tests.
+
+- New dependency `@extension.dev/core` ^0.2.0: device-code login, credential
+  store, and publish client now live there, shared with every other surface.
+- Deleted `src/lib/credentials.ts`, `src/lib/github-device.ts`,
+  `src/lib/login-flow.ts` and their migrated tests; `login`, `whoami`,
+  `logout`, and `release-promote` import from core.
+- `tools/publish.ts` is a thin adapter over core's `publish()`; the frozen
+  PublishAuthError / PublishConfigError / PublishNetworkError / PublishError
+  envelopes and the success passthrough are pinned by a new
+  `publish-envelope` test.
+- New `core-boundary` regression test: no file under `src/` may redefine the
+  credential store or import auth primitives from anywhere but
+  `@extension.dev/core`.
+- CI and Release workflows pass `NPM_TOKEN` to the install step (core is
+  npm-restricted until the public flip).
+
 ## 4.0.8
 
 Tracks the `extension` 4.0.8 suite (the versioning convention: this package's

package/README.md

@@ -1,48 +1,37 @@
-[npm-version-image]: https://img.shields.io/npm/v/%40extension.dev%2Fmcp
+[npm-version-image]: https://img.shields.io/npm/v/%40extension.dev%2Fmcp.svg?color=0971fe
 [npm-version-url]: https://www.npmjs.com/package/@extension.dev/mcp
-[action-image]: https://github.com/extensiondev/mcp/actions/workflows/ci.yml/badge.svg?branch=main
-[action-url]: https://github.com/extensiondev/mcp/actions
+[npm-downloads-image]: https://img.shields.io/npm/dm/%40extension.dev%2Fmcp.svg?color=0971fe
+[npm-downloads-url]: https://www.npmjs.com/package/@extension.dev/mcp
+[discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=0971fe
+[discord-url]: https://discord.gg/v9h2RgeTSN
 
-[![Version][npm-version-image]][npm-version-url] [![workflow][action-image]][action-url]
+# @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-# @extension.dev/mcp
+> Give your AI agent hands for browser extension development. 27 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
-Give your AI agent hands for browser extension development. One command connects Claude Code, Claude Desktop, Cursor, or any MCP client to 26 tools that scaffold, run, inspect, debug, and publish cross-browser extensions:
+<img alt="Logo" align="right" src="https://avatars.githubusercontent.com/u/106714027" width="20%" />
 
 ```bash
 claude mcp add extension-dev npx @extension.dev/mcp
 ```
 
-Extensions fail silently: content scripts that never inject, panels that never open, permissions that return `undefined` with no error. These tools give agents eyes on the live browser (DOM probes, unified logs from every context, storage access, event replay) so they debug from evidence instead of guessing. Scaffolding draws on the 60+ template catalog of the [extension.dev](https://extension.dev) platform, built on [Extension.js](https://extension.js.org).
+Works with Claude Code, Claude Desktop, Cursor, and any MCP client.
 
-## What's in this package
+[extension.dev](https://extension.dev) · [Documentation](https://extension.js.org) · [Templates](https://templates.extension.dev) · [Examples](https://github.com/extension-js/examples) · [Discord](https://discord.gg/v9h2RgeTSN)
 
-```
-@extension.dev/mcp
-  src/              MCP server source (26 tools)
-  claude/           Claude Code integration (CLAUDE.md, slash commands, rules)
-  bin/              CLI entrypoint
-```
-
-**MCP server**: programmatic bridge between AI assistants and the extension.dev platform. Imports from published npm packages:
+## Why an MCP server for extensions
 
-- `extension-create`: project scaffolding
-- `extension-develop`: build/dev/preview
-- `extension-install`: managed browser binaries
+Extensions fail silently: content scripts that never inject, panels that never open, permissions that return `undefined` with no error. An agent editing files blind will happily "fix" all of them without noticing none of them work.
 
-**Claude Code integration**: drop-in instructions, slash commands, and rules for Claude Code:
+These tools give agents eyes on the live browser, so they debug from evidence instead of guessing:
 
-- `claude/CLAUDE.md`: project-level instructions for any extension project
-- `claude/commands/`: slash commands (`/extension`, `/extension-add`, `/extension-debug`, `/extension-publish`)
-- `claude/rules/`: rules for extension development, cross-browser compat, and MCP tools
+- **Scaffold** from the 60+ template catalog behind [templates.extension.dev](https://templates.extension.dev), or add a popup, sidebar, or content script to an existing project
+- **Run** the dev server with HMR in Chrome, Edge, Firefox, or any managed browser binary, no build config
+- **See** the live DOM, unified logs from every extension context, `chrome.storage` contents, and the loaded-extension list
+- **Act**: evaluate code in any context, trigger the action button and commands, reload the extension, replay events
+- **Ship**: validate the manifest cross-browser, build for production, publish a shareable preview, and promote builds to release channels headlessly
 
-**Agent Skill**: the knowledge companion to this server lives in [`@extension.dev/skill`](https://npmjs.com/package/@extension.dev/skill): a portable [Agent Skills](https://agentskills.io)-format skill (SKILL.md + references) covering cross-browser rules, silent-failure gotchas, debugging playbooks, and store publishing. This server gives agents hands; the skill gives them judgment. Pair them:
-
-```bash
-mkdir -p .claude/skills && cp -R node_modules/@extension.dev/skill/skills/extension-dev .claude/skills/
-```
-
-Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI since they require the full browser launcher infrastructure.
+Built on [Extension.js](https://extension.js.org), the open-source cross-browser extension framework.
 
 ## Setup
 
@@ -52,7 +41,7 @@ Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension`
 claude mcp add extension-dev npx @extension.dev/mcp
 ```
 
-### Claude Desktop / .mcp.json
+### Claude Desktop / `.mcp.json`
 
 ```json
 {
@@ -65,79 +54,63 @@ claude mcp add extension-dev npx @extension.dev/mcp
 }
 ```
 
-### Claude Code integration (manual)
+### Claude Code project integration
 
-Copy the Claude Code rules and commands into any extension project:
+The package ships drop-in instructions, slash commands, and rules for extension projects:
 
 ```bash
 # Rules (how Claude understands your project)
 cp node_modules/@extension.dev/mcp/claude/CLAUDE.md ~/my-extension/.claude/CLAUDE.md
 
-# Slash commands
+# Slash commands (/extension, /extension-add, /extension-debug, /extension-publish)
 mkdir -p ~/my-extension/.claude/commands
 cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/commands/
 ```
 
 ## Tools
 
-| Tier | Tool                            | Integration                     | Description                       |
-| ---- | ------------------------------- | ------------------------------- | --------------------------------- |
-| 1    | `extension_create`              | `extensionCreate()`             | Scaffold from a template          |
-| 1    | `extension_list_templates`      | native                          | Browse 60+ templates              |
-| 1    | `extension_build`               | `extensionBuild()`              | Build for production              |
-| 1    | `extension_dev`                 | CLI spawn                       | Dev server with HMR               |
-| 1    | `extension_start`               | CLI spawn                       | Build + preview                   |
-| 1    | `extension_preview`             | CLI spawn                       | Preview production build          |
-| 2    | `extension_get_template_source` | native                          | Read template source files        |
-| 2    | `extension_manifest_validate`   | native                          | Cross-browser manifest validation |
-| 2    | `extension_inspect`             | native                          | Build output analysis             |
-| 2    | `extension_source_inspect`      | CDP WebSocket                   | Live DOM inspection               |
-| 2    | `extension_dom_inspect`         | agent bridge                    | CDP-free DOM snapshot             |
-| 2    | `extension_list_extensions`     | CDP WebSocket                   | List loaded extensions (Chromium) |
-| 2    | `extension_logs`                | agent bridge                    | Stream logs from every context    |
-| 2    | `extension_wait`                | native                          | Poll ready.json contract          |
-| 2    | `extension_add_feature`         | native                          | Add sidebar/popup/content script  |
-| act  | `extension_eval`                | agent bridge                    | Eval in a context (`--allow-eval`) |
-| act  | `extension_storage`             | agent bridge                    | Read/write `chrome.storage`       |
-| act  | `extension_reload`              | agent bridge                    | Reload extension or tab           |
-| act  | `extension_open`                | agent bridge                    | Open surface / trigger `action`,`command` |
-| 3    | `extension_install_browser`     | `extensionInstall()`            | Install managed browser           |
-| 3    | `extension_list_browsers`       | `getManagedBrowsersCacheRoot()` | List managed browsers             |
-| 3    | `extension_detect_browsers`     | native                          | System browser detection          |
-| auth | `extension_login`               | platform                        | GitHub device-code → stored token |
-| auth | `extension_whoami`              | native                          | Show stored login (no token)      |
-| auth | `extension_logout`              | native                          | Remove stored credentials         |
-| auth | `extension_publish`             | platform                        | Publish to extension.dev (token)  |
-
-## Development
-
-```bash
-pnpm install
-pnpm compile    # Build with rslib
-pnpm test       # Run tests
-pnpm start      # Start MCP server
-```
-
-### Publishing
-
-```bash
-NPM_TOKEN=<token> pnpm publish
-```
-
-Uses `prepublishOnly` to run tests and compile before publishing.
-
-## The extension.dev open source stack
-
-| Package | Use it to |
-| --- | --- |
-| [`@extension.dev/skill`](https://github.com/extensiondev/skill) | Teach agents the cross-browser rules and silent-failure gotchas |
-| [`@extension.dev/deploy`](https://github.com/extensiondev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
-| [`@extension.dev/artifact-integrity`](https://github.com/extensiondev/artifact-integrity) | Gate releases on artifact verification |
-| [`@extension.dev/compiler`](https://github.com/extensiondev/compiler) | Build extensions in the browser with esbuild-wasm |
-| [`@extension.dev/core`](https://github.com/extensiondev/core) | Authenticate and publish to the extension.dev platform |
-
-All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.
+| Tier | Tool | Description |
+| ---- | ---- | ----------- |
+| build | `extension_create` | Scaffold from a template |
+| build | `extension_list_templates` | Browse 60+ templates |
+| build | `extension_get_template_source` | Read template source files |
+| build | `extension_add_feature` | Add sidebar/popup/content script |
+| build | `extension_build` | Build for production |
+| run | `extension_dev` | Dev server with HMR |
+| run | `extension_start` | Build + preview |
+| run | `extension_preview` | Preview the production build |
+| run | `extension_wait` | Poll the dev-server ready contract |
+| see | `extension_manifest_validate` | Cross-browser manifest validation |
+| see | `extension_inspect` | Build output analysis |
+| see | `extension_source_inspect` | Live DOM inspection (CDP) |
+| see | `extension_dom_inspect` | CDP-free DOM snapshot |
+| see | `extension_list_extensions` | List loaded extensions (Chromium) |
+| see | `extension_logs` | Stream logs from every context |
+| act | `extension_eval` | Evaluate in a context (`--allow-eval`) |
+| act | `extension_storage` | Read/write `chrome.storage` |
+| act | `extension_reload` | Reload extension or tab |
+| act | `extension_open` | Open a surface / trigger `action`, `command` |
+| browsers | `extension_install_browser` | Install a managed browser binary |
+| browsers | `extension_list_browsers` | List managed browsers |
+| browsers | `extension_detect_browsers` | Detect system browsers |
+| platform | `extension_login` | GitHub device-code login, stored token |
+| platform | `extension_whoami` | Show the stored login (never the token) |
+| platform | `extension_logout` | Remove stored credentials |
+| platform | `extension_publish` | Publish a shareable preview to extension.dev |
+| platform | `extension_release_promote` | Promote a build to a release channel, headless |
+
+Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI; everything else runs in-process.
+
+## From preview to store
+
+The four platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. To automate store submission itself (Chrome Web Store, Edge Add-ons, Firefox AMO), pair with [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy).
+
+## Community
+
+- Join the [Discord](https://discord.gg/v9h2RgeTSN) for help and feedback
+- Browse production-ready [examples](https://github.com/extension-js/examples)
+- Report Extension.js framework issues on [GitHub](https://github.com/extension-js/extension.js/issues)
 
 ## License
 
-MIT
+MIT (c) Cezar Augusto and the Extension.js authors.

package/dist/module.js

@@ -11,6 +11,7 @@ import cross_spawn from "cross-spawn";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import node_net from "node:net";
 import ws from "ws";
+import { clearCredentials, exchangeAndPersist, fetchLoginConfig, pollForToken, publish, readCredentials, resolveApiBase, resolveToken, safeApiBase, startDeviceCode } from "@extension.dev/core";
 import { extensionInstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -132,8 +133,6 @@ var publish_namespaceObject = {};
 __webpack_require__.r(publish_namespaceObject);
 __webpack_require__.d(publish_namespaceObject, {
     handler: ()=>publish_handler,
-    resolveToken: ()=>resolveToken,
-    safeApiBase: ()=>safeApiBase,
     schema: ()=>publish_schema
 });
 var release_promote_namespaceObject = {};
@@ -179,7 +178,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     schema: ()=>whoami_schema
 });
 var package_namespaceObject = {
-    rE: "4.0.8"
+    rE: "4.1.1"
 };
 const schema = {
     name: "extension_create",
@@ -2341,70 +2340,6 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
-function credentialsPath() {
-    if ("win32" === process.platform) {
-        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
-        return node_path.join(base, "extension-dev", "auth.json");
-    }
-    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
-    const base = xdg || node_path.join(node_os.homedir(), ".config");
-    return node_path.join(base, "extension-dev", "auth.json");
-}
-function readCredentials() {
-    try {
-        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
-        const data = JSON.parse(raw);
-        if (!data || "object" != typeof data) return null;
-        if (1 !== data.version) return null;
-        const token = String(data.token || "").trim();
-        if (!token) return null;
-        return {
-            version: 1,
-            token,
-            workspaceSlug: String(data.workspaceSlug || ""),
-            projectSlug: String(data.projectSlug || ""),
-            expiresAt: Number(data.expiresAt || 0),
-            api: String(data.api || "")
-        };
-    } catch  {
-        return null;
-    }
-}
-function writeCredentials(creds) {
-    const file = credentialsPath();
-    node_fs.mkdirSync(node_path.dirname(file), {
-        recursive: true
-    });
-    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
-        mode: 384
-    });
-    try {
-        node_fs.chmodSync(file, 384);
-    } catch  {}
-    return file;
-}
-function clearCredentials() {
-    const file = credentialsPath();
-    try {
-        node_fs.unlinkSync(file);
-        return {
-            cleared: true,
-            path: file
-        };
-    } catch  {
-        return {
-            cleared: false,
-            path: file
-        };
-    }
-}
-function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
-    const creds = readCredentials();
-    if (!creds) return null;
-    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
-    return creds;
-}
-const DEFAULT_API = "https://www.extension.dev";
 const publish_schema = {
     name: "extension_publish",
     description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
@@ -2433,76 +2368,24 @@ const publish_schema = {
         ]
     }
 };
-function resolveToken() {
-    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
-    if (fromEnv) return fromEnv;
-    const creds = readValidCredentials();
-    return creds?.token ? String(creds.token).trim() : "";
-}
-function safeApiBase(raw) {
-    let parsed;
-    try {
-        parsed = new URL(raw);
-    } catch  {
-        return {
-            ok: false,
-            message: `Invalid platform URL: ${raw}`
-        };
-    }
-    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
-    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
-        ok: false,
-        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
-    };
-    return {
-        ok: true,
-        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
-    };
-}
-function fail(name, message) {
-    return JSON.stringify({
+async function publish_handler(args) {
+    const token = resolveToken();
+    if (!token) return JSON.stringify({
         ok: false,
         error: {
-            name,
-            message
+            name: "PublishAuthError",
+            message: "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
         }
     });
+    const result = await publish({
+        ttlHours: args.ttlHours,
+        buildSha: args.buildSha,
+        api: args.api,
+        token
+    });
+    return result.ok ? JSON.stringify(result.data) : JSON.stringify(result);
 }
-async function publish_handler(args) {
-    const token = resolveToken();
-    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
-    if (!apiCheck.ok) return fail("PublishConfigError", apiCheck.message);
-    const url = `${apiCheck.base}/api/cli/publish`;
-    const body = {};
-    if (null != args.ttlHours) body.ttlHours = Number(args.ttlHours);
-    if (args.buildSha) body.buildSha = args.buildSha;
-    let res;
-    try {
-        res = await fetch(url, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${token}`,
-                "content-type": "application/json"
-            },
-            body: JSON.stringify(body)
-        });
-    } catch (err) {
-        return fail("PublishNetworkError", `Could not reach ${url}: ${err?.message || err}`);
-    }
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) return fail("PublishError", `publish failed (${res.status}): ${data?.message || text || "unknown error"}`);
-    return JSON.stringify(data);
-}
-const release_promote_DEFAULT_API = "https://www.extension.dev";
+const DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
     description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
@@ -2547,7 +2430,7 @@ const release_promote_schema = {
         ]
     }
 };
-function release_promote_fail(name, message) {
+function fail(name, message) {
     return JSON.stringify({
         ok: false,
         error: {
@@ -2558,12 +2441,12 @@ function release_promote_fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    if (!token) return fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
-    if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
-    if (!apiCheck.ok) return release_promote_fail("ReleaseConfigError", apiCheck.message);
+    if (!buildId || !channel) return fail("ReleaseInputError", "buildId and channel are required.");
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
+    if (!apiCheck.ok) return fail("ReleaseConfigError", apiCheck.message);
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const body = {
         buildId,
@@ -2584,7 +2467,7 @@ async function release_promote_handler(args) {
             body: JSON.stringify(body)
         });
     } catch (err) {
-        return release_promote_fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+        return fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
     }
     const text = await res.text();
     let data;
@@ -2595,7 +2478,7 @@ async function release_promote_handler(args) {
             message: text
         };
     }
-    if (!res.ok) return release_promote_fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    if (!res.ok) return fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
     return JSON.stringify(data);
 }
 const wait_schema = {
@@ -2893,138 +2776,6 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
-async function startDeviceCode(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/json"
-        },
-        body: JSON.stringify({
-            client_id: args.clientId,
-            scope: args.scope || "read:user"
-        })
-    });
-    const data = await res.json().catch(()=>({}));
-    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
-    return {
-        deviceCode: String(data.device_code || ""),
-        userCode: String(data.user_code || ""),
-        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
-        interval: Number(data.interval || 5),
-        expiresIn: Number(data.expires_in || 900)
-    };
-}
-async function pollForToken(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const sleep = args.sleepImpl ?? defaultSleep;
-    let intervalMs = 1000 * Math.max(1, args.interval);
-    const deadline = Date.now() + Math.max(0, args.budgetMs);
-    while(Date.now() < deadline){
-        await sleep(intervalMs);
-        const res = await doFetch(GITHUB_TOKEN_URL, {
-            method: "POST",
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json"
-            },
-            body: JSON.stringify({
-                client_id: args.clientId,
-                device_code: args.deviceCode,
-                grant_type: DEVICE_GRANT_TYPE
-            })
-        });
-        const data = await res.json().catch(()=>({}));
-        const token = String(data.access_token || "").trim();
-        if (token) return {
-            ok: true,
-            githubToken: token
-        };
-        const error = String(data.error || "");
-        if ("authorization_pending" === error) continue;
-        if ("slow_down" === error) {
-            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
-            continue;
-        }
-        if ("expired_token" === error) return {
-            ok: false,
-            reason: "expired"
-        };
-        if ("access_denied" === error) return {
-            ok: false,
-            reason: "denied"
-        };
-    }
-    return {
-        ok: false,
-        reason: "pending"
-    };
-}
-const login_flow_DEFAULT_API = "https://www.extension.dev";
-function resolveApiBase(api) {
-    return String(api || process.env.EXTENSION_DEV_API_URL || login_flow_DEFAULT_API).replace(/\/+$/, "");
-}
-async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        clientId: override,
-        scope: "read:user"
-    };
-    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
-        headers: {
-            accept: "application/json"
-        }
-    });
-    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
-    const data = await res.json().catch(()=>({}));
-    const clientId = String(data.githubClientId || "").trim();
-    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
-    return {
-        clientId,
-        scope: String(data.scope || "read:user")
-    };
-}
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    const token = String(data.token || "").trim();
-    if (!token) throw new Error("Login exchange returned no token.");
-    const creds = {
-        version: 1,
-        token,
-        workspaceSlug: String(data.workspaceSlug || ""),
-        projectSlug: String(data.projectSlug || ""),
-        expiresAt: Number(data.expiresAt || 0),
-        api: args.apiBase
-    };
-    writeCredentials(creds);
-    return creds;
-}
 const login_schema = {
     name: "extension_login",
     description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",

package/dist/src/tools/publish.d.ts

@@ -24,23 +24,6 @@ export declare const schema: {
         required: string[];
     };
 };
-/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
-export declare function resolveToken(): string;
-/**
- * Validate the platform base URL BEFORE we attach a bearer token to a request to
- * it. SECURITY: the `api` arg / EXTENSION_DEV_API_URL is operator-supplied, but a
- * hostile value (e.g. via prompt-injection in the client) could redirect the
- * token to an attacker. The access token must never leave over plaintext or go to
- * an arbitrary scheme, so we require https -- allowing http only for localhost
- * dev. Returns the normalized base (no trailing slash) or an error message.
- */
-export declare function safeApiBase(raw: string): {
-    ok: true;
-    base: string;
-} | {
-    ok: false;
-    message: string;
-};
 export declare function handler(args: {
     projectPath: string;
     ttlHours?: number;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "4.0.8",
-  "description": "MCP server that lets AI agents build, run, inspect, and publish browser extensions. 26 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox.",
+  "version": "4.1.1",
+  "description": "MCP server that lets AI agents build, run, inspect, and publish browser extensions. 27 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, and Firefox.",
   "license": "MIT",
   "author": {
     "name": "Cezar Augusto",
@@ -62,6 +62,7 @@
     "extension.dev"
   ],
   "dependencies": {
+    "@extension.dev/core": "^0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",

package/dist/src/lib/credentials.d.ts

@@ -1,24 +0,0 @@
-export interface StoredCredentials {
-    version: 1;
-    /** The HMAC access token the publish path sends as `Bearer`. */
-    token: string;
-    workspaceSlug: string;
-    projectSlug: string;
-    /** Token expiry as unix epoch seconds (0 if unknown). */
-    expiresAt: number;
-    /** Platform base URL the token was minted against. */
-    api: string;
-}
-export declare function credentialsPath(): string;
-export declare function readCredentials(): StoredCredentials | null;
-export declare function writeCredentials(creds: StoredCredentials): string;
-export declare function clearCredentials(): {
-    cleared: boolean;
-    path: string;
-};
-/**
- * Return stored credentials only if the token has not expired. Used by the
- * publish token resolution so an expired local token falls through cleanly to
- * "no token" instead of producing a 401 from the platform.
- */
-export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -1,40 +0,0 @@
-export interface DeviceCodeStart {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    /** Minimum seconds to wait between polls. */
-    interval: number;
-    /** Seconds until the device code expires. */
-    expiresIn: number;
-}
-export type PollResult = {
-    ok: true;
-    githubToken: string;
-} | {
-    ok: false;
-    reason: "pending" | "expired" | "denied";
-    error?: string;
-};
-type FetchImpl = typeof fetch;
-type SleepImpl = (ms: number) => Promise<void>;
-export declare function startDeviceCode(args: {
-    clientId: string;
-    scope?: string;
-    fetchImpl?: FetchImpl;
-}): Promise<DeviceCodeStart>;
-/**
- * Poll for the access token until the budget elapses. A budget shorter than
- * the device-code lifetime lets a caller (e.g. an MCP tool that must return
- * promptly) poll in bounded slices and report "pending" between calls; a long
- * budget (a blocking CLI) waits the whole time. Returns `pending` only on
- * budget exhaustion; `expired`/`denied` are terminal.
- */
-export declare function pollForToken(args: {
-    clientId: string;
-    deviceCode: string;
-    interval: number;
-    budgetMs: number;
-    fetchImpl?: FetchImpl;
-    sleepImpl?: SleepImpl;
-}): Promise<PollResult>;
-export {};

package/dist/src/lib/login-flow.d.ts

@@ -1,25 +0,0 @@
-import { type StoredCredentials } from "./credentials";
-type FetchImpl = typeof fetch;
-export declare function resolveApiBase(api?: string): string;
-export interface LoginConfig {
-    clientId: string;
-    scope: string;
-}
-/**
- * Resolve the GitHub OAuth client id the device flow authenticates against.
- * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
- * hosted platform); otherwise it comes from the platform's public config.
- */
-export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
-/**
- * Trade a verified GitHub user token for a project-scoped access token and
- * write it to the local credentials file. Returns the stored credentials
- * (token included for the caller's in-memory use; never logged).
- */
-export declare function exchangeAndPersist(args: {
-    apiBase: string;
-    githubToken: string;
-    project: string;
-    fetchImpl?: FetchImpl;
-}): Promise<StoredCredentials>;
-export {};