@extension.dev/mcp 4.4.0 → 4.5.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "4.4.0",
+      "version": "4.5.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 4.5.0
+
+The platform client (GitHub device-code login, the credential store, and the
+publish flow) is now vendored directly in this package instead of the
+separate `@extension.dev/core` dependency. No behavior change: the tool
+schemas, the credential file, token resolution, and the publish error
+envelopes are all unchanged. This drops a runtime dependency and the
+two-package release step.
+
 ## 4.4.0
 
 Browser-matrix parity release: the tool surface now mirrors the engine

package/README.md

@@ -9,7 +9,7 @@
 
 > Give your AI agent hands for browser extension development. 30 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
-<img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
+<img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="15.5%" />
 
 ```bash
 claude mcp add extension-dev npx @extension.dev/mcp
@@ -134,7 +134,6 @@ The four platform tools connect agents to [extension.dev](https://extension.dev)
 | --- | --- |
 | [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) | Teach AI agents the judgment half: cross-browser rules, gotchas, playbooks |
 | [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
-| [`@extension.dev/core`](https://www.npmjs.com/package/@extension.dev/core) | Authenticate and publish to the extension.dev platform |
 
 All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.
 

package/dist/module.js

@@ -11,7 +11,6 @@ import cross_spawn from "cross-spawn";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import ws from "ws";
 import node_http from "node:http";
-import { clearCredentials, exchangeAndPersist, fetchLoginConfig, pollForToken, publish, readCredentials, resolveApiBase, resolveToken, safeApiBase, startDeviceCode } from "@extension.dev/core";
 import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -135,9 +134,9 @@ __webpack_require__.d(preview_namespaceObject, {
     handler: ()=>preview_handler,
     schema: ()=>preview_schema
 });
-var publish_namespaceObject = {};
-__webpack_require__.r(publish_namespaceObject);
-__webpack_require__.d(publish_namespaceObject, {
+var tools_publish_namespaceObject = {};
+__webpack_require__.r(tools_publish_namespaceObject);
+__webpack_require__.d(tools_publish_namespaceObject, {
     handler: ()=>publish_handler,
     schema: ()=>publish_schema
 });
@@ -195,7 +194,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"4.4.0","El":{"OP":"^4.0.11"}}');
+var package_namespaceObject = JSON.parse('{"rE":"4.5.0","El":{"OP":"^4.0.11"}}');
 const create_schema = {
     name: "extension_create",
     description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options.",
@@ -2790,6 +2789,222 @@ async function dom_inspect_handler(args) {
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
     return runActVerb(cli, args.projectPath, args.timeout);
 }
+function credentialsPath() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev", "auth.json");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev", "auth.json");
+}
+function readCredentials() {
+    try {
+        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const token = String(data.token || "").trim();
+        if (!token) return null;
+        return {
+            version: 1,
+            token,
+            workspaceSlug: String(data.workspaceSlug || ""),
+            projectSlug: String(data.projectSlug || ""),
+            expiresAt: Number(data.expiresAt || 0),
+            api: String(data.api || "")
+        };
+    } catch  {
+        return null;
+    }
+}
+function writeCredentials(creds) {
+    const file = credentialsPath();
+    const dir = node_path.dirname(file);
+    node_fs.mkdirSync(dir, {
+        recursive: true,
+        mode: 448
+    });
+    try {
+        node_fs.chmodSync(dir, 448);
+    } catch  {}
+    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
+        mode: 384
+    });
+    try {
+        node_fs.chmodSync(file, 384);
+    } catch  {}
+    return file;
+}
+function clearCredentials() {
+    const file = credentialsPath();
+    try {
+        node_fs.unlinkSync(file);
+        return {
+            cleared: true,
+            path: file
+        };
+    } catch  {
+        return {
+            cleared: false,
+            path: file
+        };
+    }
+}
+function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
+    const creds = readCredentials();
+    if (!creds) return null;
+    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
+    return creds;
+}
+const DEFAULT_API = "https://www.extension.dev";
+function resolveApiBase(api) {
+    return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
+}
+function safeApiBase(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    } catch  {
+        return {
+            ok: false,
+            message: `Invalid platform URL: ${raw}`
+        };
+    }
+    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
+    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
+        ok: false,
+        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
+    };
+    return {
+        ok: true,
+        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
+    };
+}
+async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
+    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
+    if (override) return {
+        clientId: override,
+        scope: "read:user"
+    };
+    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
+        headers: {
+            accept: "application/json"
+        }
+    });
+    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
+    const data = await res.json().catch(()=>({}));
+    const clientId = String(data.githubClientId || "").trim();
+    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    return {
+        clientId,
+        scope: String(data.scope || "read:user")
+    };
+}
+async function exchangeAndPersist(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            githubToken: args.githubToken,
+            project: args.project
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
+    const token = String(data.token || "").trim();
+    if (!token) throw new Error("Login exchange returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(data.workspaceSlug || ""),
+        projectSlug: String(data.projectSlug || ""),
+        expiresAt: Number(data.expiresAt || 0),
+        api: args.apiBase
+    };
+    writeCredentials(creds);
+    return creds;
+}
+function resolveToken() {
+    const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
+    if (fromEnv) return fromEnv;
+    const creds = readValidCredentials();
+    return creds?.token ? String(creds.token).trim() : "";
+}
+async function publish(options = {}) {
+    const token = options.token ?? resolveToken();
+    if (!token) return {
+        ok: false,
+        error: {
+            name: "PublishAuthError",
+            message: "No token. Run login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+        }
+    };
+    const doFetch = options.fetchImpl ?? fetch;
+    const apiCheck = safeApiBase(resolveApiBase(options.api));
+    if (!apiCheck.ok) return {
+        ok: false,
+        error: {
+            name: "PublishConfigError",
+            message: apiCheck.message
+        }
+    };
+    const url = `${apiCheck.base}/api/cli/publish`;
+    const body = {};
+    if (null != options.ttlHours) body.ttlHours = Number(options.ttlHours);
+    if (options.buildSha) body.buildSha = options.buildSha;
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return {
+            ok: false,
+            error: {
+                name: "PublishNetworkError",
+                message: `Could not reach ${url}: ${err?.message || err}`
+            }
+        };
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return {
+        ok: false,
+        error: {
+            name: "PublishError",
+            message: `publish failed (${res.status}): ${data?.message || text || "unknown error"}`
+        }
+    };
+    return {
+        ok: true,
+        data
+    };
+}
 const publish_schema = {
     name: "extension_publish",
     description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
@@ -2835,7 +3050,7 @@ async function publish_handler(args) {
     });
     return result.ok ? JSON.stringify(result.data) : JSON.stringify(result);
 }
-const DEFAULT_API = "https://www.extension.dev";
+const release_promote_DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
     description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
@@ -2895,7 +3110,7 @@ async function release_promote_handler(args) {
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
     if (!buildId || !channel) return fail("ReleaseInputError", "buildId and channel are required.");
-    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API));
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
     if (!apiCheck.ok) return fail("ReleaseConfigError", apiCheck.message);
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const body = {
@@ -3225,6 +3440,78 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
+const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+async function startDeviceCode(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/json"
+        },
+        body: JSON.stringify({
+            client_id: args.clientId,
+            scope: args.scope || "read:user"
+        })
+    });
+    const data = await res.json().catch(()=>({}));
+    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
+    return {
+        deviceCode: String(data.device_code || ""),
+        userCode: String(data.user_code || ""),
+        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
+        interval: Number(data.interval || 5),
+        expiresIn: Number(data.expires_in || 900)
+    };
+}
+async function pollForToken(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const sleep = args.sleepImpl ?? defaultSleep;
+    let intervalMs = 1000 * Math.max(1, args.interval);
+    const deadline = Date.now() + Math.max(0, args.budgetMs);
+    while(Date.now() < deadline){
+        await sleep(intervalMs);
+        const res = await doFetch(GITHUB_TOKEN_URL, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json"
+            },
+            body: JSON.stringify({
+                client_id: args.clientId,
+                device_code: args.deviceCode,
+                grant_type: DEVICE_GRANT_TYPE
+            })
+        });
+        const data = await res.json().catch(()=>({}));
+        const token = String(data.access_token || "").trim();
+        if (token) return {
+            ok: true,
+            githubToken: token
+        };
+        const error = String(data.error || "");
+        if ("authorization_pending" === error) continue;
+        if ("slow_down" === error) {
+            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
+            continue;
+        }
+        if ("expired_token" === error) return {
+            ok: false,
+            reason: "expired"
+        };
+        if ("access_denied" === error) return {
+            ok: false,
+            reason: "denied"
+        };
+    }
+    return {
+        ok: false,
+        reason: "pending"
+    };
+}
 const login_schema = {
     name: "extension_login",
     description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
@@ -4006,7 +4293,7 @@ const tools = [
     reload_namespaceObject,
     open_namespaceObject,
     dom_inspect_namespaceObject,
-    publish_namespaceObject,
+    tools_publish_namespaceObject,
     release_promote_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,

package/dist/src/lib/credentials.d.ts

@@ -0,0 +1,24 @@
+export interface StoredCredentials {
+    version: 1;
+    /** The HMAC access token the publish path sends as `Bearer`. */
+    token: string;
+    workspaceSlug: string;
+    projectSlug: string;
+    /** Token expiry as unix epoch seconds (0 if unknown). */
+    expiresAt: number;
+    /** Platform base URL the token was minted against. */
+    api: string;
+}
+export declare function credentialsPath(): string;
+export declare function readCredentials(): StoredCredentials | null;
+export declare function writeCredentials(creds: StoredCredentials): string;
+export declare function clearCredentials(): {
+    cleared: boolean;
+    path: string;
+};
+/**
+ * Return stored credentials only if the token has not expired. Used by the
+ * publish token resolution so an expired local token falls through cleanly to
+ * "no token" instead of producing a 401 from the platform.
+ */
+export declare function readValidCredentials(nowSeconds?: number): StoredCredentials | null;

package/dist/src/lib/github-device.d.ts

@@ -0,0 +1,40 @@
+export interface DeviceCodeStart {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    /** Minimum seconds to wait between polls. */
+    interval: number;
+    /** Seconds until the device code expires. */
+    expiresIn: number;
+}
+export type PollResult = {
+    ok: true;
+    githubToken: string;
+} | {
+    ok: false;
+    reason: "pending" | "expired" | "denied";
+    error?: string;
+};
+type FetchImpl = typeof fetch;
+type SleepImpl = (ms: number) => Promise<void>;
+export declare function startDeviceCode(args: {
+    clientId: string;
+    scope?: string;
+    fetchImpl?: FetchImpl;
+}): Promise<DeviceCodeStart>;
+/**
+ * Poll for the access token until the budget elapses. A budget shorter than
+ * the device-code lifetime lets a caller (e.g. an MCP tool that must return
+ * promptly) poll in bounded slices and report "pending" between calls; a long
+ * budget (a blocking CLI) waits the whole time. Returns `pending` only on
+ * budget exhaustion; `expired`/`denied` are terminal.
+ */
+export declare function pollForToken(args: {
+    clientId: string;
+    deviceCode: string;
+    interval: number;
+    budgetMs: number;
+    fetchImpl?: FetchImpl;
+    sleepImpl?: SleepImpl;
+}): Promise<PollResult>;
+export {};

package/dist/src/lib/login-flow.d.ts

@@ -0,0 +1,40 @@
+import { type StoredCredentials } from "./credentials";
+type FetchImpl = typeof fetch;
+export declare function resolveApiBase(api?: string): string;
+/**
+ * Validate the platform base URL BEFORE we attach a bearer token to a request to
+ * it. SECURITY: the `api` arg / EXTENSION_DEV_API_URL is operator-supplied, but a
+ * hostile value (e.g. via prompt-injection in the client) could redirect the
+ * token to an attacker. The access token must never leave over plaintext or go to
+ * an arbitrary scheme, so we require https -- allowing http only for localhost
+ * dev. Returns the normalized base (no trailing slash) or an error message.
+ */
+export declare function safeApiBase(raw: string): {
+    ok: true;
+    base: string;
+} | {
+    ok: false;
+    message: string;
+};
+export interface LoginConfig {
+    clientId: string;
+    scope: string;
+}
+/**
+ * Resolve the GitHub OAuth client id the device flow authenticates against.
+ * EXTENSION_DEV_GITHUB_CLIENT_ID overrides (useful when pointing at a self-
+ * hosted platform); otherwise it comes from the platform's public config.
+ */
+export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl): Promise<LoginConfig>;
+/**
+ * Trade a verified GitHub user token for a project-scoped access token and
+ * write it to the local credentials file. Returns the stored credentials
+ * (token included for the caller's in-memory use; never logged).
+ */
+export declare function exchangeAndPersist(args: {
+    apiBase: string;
+    githubToken: string;
+    project: string;
+    fetchImpl?: FetchImpl;
+}): Promise<StoredCredentials>;
+export {};

package/dist/src/lib/publish.d.ts

@@ -0,0 +1,31 @@
+type FetchImpl = typeof fetch;
+/** Resolve the access token: EXTENSION_DEV_TOKEN env first, then the login creds file. */
+export declare function resolveToken(): string;
+export interface PublishOptions {
+    /** Share-link lifetime in hours (1-168, platform default 24). */
+    ttlHours?: number;
+    /** Pin the share URL to a specific build sha. */
+    buildSha?: string;
+    /** Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). */
+    api?: string;
+    /** Explicit token; defaults to resolveToken(). */
+    token?: string;
+    fetchImpl?: FetchImpl;
+}
+export type PublishResult = {
+    ok: true;
+    data: Record<string, unknown>;
+} | {
+    ok: false;
+    error: {
+        name: string;
+        message: string;
+    };
+};
+/**
+ * Publish the project the token is scoped to and return the platform
+ * response (shareUrl, visibility, ...). The publish target is identified by
+ * the token's claims (workspaceSlug/projectSlug), so no project path is sent.
+ */
+export declare function publish(options?: PublishOptions): Promise<PublishResult>;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 30 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "MIT",
@@ -84,7 +84,6 @@
     "extension.js"
   ],
   "dependencies": {
-    "@extension.dev/core": "^0.2.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "browser-extension-manifest-fields": "^2.2.9",
     "cross-spawn": "^7.0.6",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "4.4.0",
+      "version": "4.5.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"