@extension.dev/mcp 4.5.0 → 4.7.0

package/dist/module.js

@@ -2,11 +2,10 @@ import { __webpack_require__ } from "./rslib-runtime.js";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import node_fs, { existsSync, readdirSync, statSync } from "node:fs";
 import node_path, { join } from "node:path";
 import { extensionCreate } from "extension-create";
-import node_fs, { existsSync, readdirSync, statSync } from "node:fs";
 import node_os from "node:os";
-import { extensionBuild } from "extension-develop";
 import cross_spawn from "cross-spawn";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import ws from "ws";
@@ -32,6 +31,12 @@ __webpack_require__.d(create_namespaceObject, {
     handler: ()=>create_handler,
     schema: ()=>create_schema
 });
+var deploy_namespaceObject = {};
+__webpack_require__.r(deploy_namespaceObject);
+__webpack_require__.d(deploy_namespaceObject, {
+    handler: ()=>deploy_handler,
+    schema: ()=>deploy_schema
+});
 var detect_browsers_namespaceObject = {};
 __webpack_require__.r(detect_browsers_namespaceObject);
 __webpack_require__.d(detect_browsers_namespaceObject, {
@@ -194,7 +199,33 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"4.5.0","El":{"OP":"^4.0.11"}}');
+var package_namespaceObject = JSON.parse('{"rE":"4.6.0","El":{"OP":"^4.0.11"}}');
+function detectPackageManager(projectPath) {
+    const byLockfile = [
+        [
+            "bun.lock",
+            "bun"
+        ],
+        [
+            "bun.lockb",
+            "bun"
+        ],
+        [
+            "pnpm-lock.yaml",
+            "pnpm"
+        ],
+        [
+            "yarn.lock",
+            "yarn"
+        ],
+        [
+            "package-lock.json",
+            "npm"
+        ]
+    ];
+    for (const [lockfile, pm] of byLockfile)if (node_fs.existsSync(node_path.join(projectPath, lockfile))) return pm;
+    return "npm";
+}
 const create_schema = {
     name: "extension_create",
     description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options.",
@@ -212,7 +243,7 @@ const create_schema = {
             template: {
                 type: "string",
                 default: "typescript",
-                description: "Template slug from the extension.dev template catalog (e.g. 'react', 'sidebar-claude', 'content-vue'). Use extension_list_templates to discover options."
+                description: "Template slug from the extension.dev template catalog (e.g. 'react', 'ai-claude', 'content-vue'). Use extension_list_templates to discover options."
             },
             install: {
                 type: "boolean",
@@ -228,30 +259,47 @@ const create_schema = {
 async function create_handler(args) {
     const start = Date.now();
     const projectInput = args.parentDir ? node_path.resolve(args.parentDir, args.projectName) : args.projectName;
+    const logLines = [];
+    const capture = (stream)=>(...parts)=>{
+            const line = parts.map((p)=>"string" == typeof p ? p : String(p)).join(" ").trim();
+            if (line) logLines.push("error" === stream ? `[error] ${line}` : line);
+        };
+    const logTail = (max = 20)=>logLines.slice(-max);
     try {
         const result = await extensionCreate(projectInput, {
             template: args.template ?? "typescript",
             install: args.install ?? true,
             logger: {
-                log: ()=>{},
-                error: ()=>{}
+                log: capture("log"),
+                error: capture("error")
             }
         });
+        const packageManager = result.depsInstalled ? detectPackageManager(result.projectPath) : "npm";
+        const runDev = `${packageManager} run dev`;
         return JSON.stringify({
             projectPath: result.projectPath,
             projectName: result.projectName,
             template: result.template,
             depsInstalled: result.depsInstalled,
+            packageManager: result.depsInstalled ? packageManager : null,
             duration: Date.now() - start,
-            nextSteps: [
+            nextSteps: result.depsInstalled ? [
                 `cd ${result.projectPath}`,
+                runDev
+            ] : [
+                `cd ${result.projectPath}`,
+                "npm install",
                 "npm run dev"
-            ]
+            ],
+            ...result.depsInstalled ? {} : {
+                warnings: logTail()
+            }
         });
     } catch (err) {
         return JSON.stringify({
             error: err instanceof Error ? err.message : String(err),
-            duration: Date.now() - start
+            duration: Date.now() - start,
+            log: logTail()
         });
     }
 }
@@ -292,8 +340,49 @@ async function listTemplates(filters) {
     if (filters?.tags?.length) templates = templates.filter((t)=>filters.tags.some((tag)=>t.tags?.includes(tag) || t.aiRecommendFor?.includes(tag)));
     if (filters?.featured) templates = templates.filter((t)=>t.featured);
     if (filters?.query) {
-        const q = filters.query.toLowerCase();
-        templates = templates.filter((t)=>t.slug.includes(q) || t.description.toLowerCase().includes(q) || t.tags?.some((tag)=>tag.includes(q)) || t.useCases?.some((uc)=>uc.toLowerCase().includes(q)) || t.aiPromptExamples?.some((ex)=>ex.toLowerCase().includes(q)));
+        const phrase = filters.query.toLowerCase().trim();
+        const STOP = new Set([
+            "the",
+            "a",
+            "an",
+            "and",
+            "or",
+            "for",
+            "with",
+            "that",
+            "this",
+            "to",
+            "of",
+            "on",
+            "in",
+            "into",
+            "your",
+            "my",
+            "me",
+            "it",
+            "is"
+        ]);
+        const tokens = phrase.split(/\s+/).filter((tok)=>tok.length >= 2 && !STOP.has(tok));
+        const bodyOf = (t)=>[
+                t.description,
+                ...t.tags ?? [],
+                ...t.useCases ?? [],
+                ...t.aiPromptExamples ?? []
+            ].join(" ").toLowerCase();
+        const scored = templates.map((t)=>{
+            const slug = t.slug.toLowerCase();
+            const body = bodyOf(t);
+            const hay = `${slug} ${body}`;
+            let score = 0;
+            if (phrase && hay.includes(phrase)) score += 100;
+            for (const tok of tokens)if (slug.includes(tok)) score += 3;
+            else if (body.includes(tok)) score += 1;
+            return {
+                t,
+                score
+            };
+        }).filter((entry)=>entry.score > 0).sort((a, b)=>b.score - a.score);
+        templates = scored.map((entry)=>entry.t);
     }
     return templates;
 }
@@ -303,7 +392,7 @@ async function getTemplateBySlug(slug) {
 }
 const list_templates_schema = {
     name: "extension_list_templates",
-    description: "List available extension templates from the extension.dev template catalog. Filter by surface, framework, or tags. Returns structured metadata from templates-meta.json.",
+    description: "List available extension templates from the extension.dev template catalog. Filter by surface, framework, or tags. Returns structured metadata from templates-meta.json. Note: 'framework' is the UI framework only (react/vue/svelte/preact/vanilla) - it is not the language. TypeScript and JavaScript templates live under slugs (e.g. 'typescript', 'content-typescript'); shadcn is a React variant ('sidebar-shadcn') and provider AIs are tagged 'ai' ('ai-chatgpt', 'ai-claude'). Reach those with query/tags/slug, not framework.",
     inputSchema: {
         type: "object",
         properties: {
@@ -312,13 +401,10 @@ const list_templates_schema = {
                 enum: [
                     "content",
                     "sidebar",
-                    "action",
                     "newtab",
-                    "devtools",
-                    "options",
                     "background"
                 ],
-                description: "Filter by extension surface type"
+                description: "Filter by extension surface type. For a popup/action starter use the 'action' slug (query:'action'), not a surface filter."
             },
             framework: {
                 type: "string",
@@ -329,7 +415,7 @@ const list_templates_schema = {
                     "preact",
                     ""
                 ],
-                description: "Filter by UI framework (empty string = vanilla JS)"
+                description: "Filter by UI framework only (empty string = vanilla JS). Not a language filter - for TypeScript/JavaScript use query or slug."
             },
             tags: {
                 type: "array",
@@ -344,7 +430,7 @@ const list_templates_schema = {
             },
             query: {
                 type: "string",
-                description: "Free-text search across slug, description, tags, and useCases"
+                description: "Keyword search across slug, description, tags, and useCases. Ranks by how many query words match, so a natural phrase works; single keywords are fine too."
             }
         }
     }
@@ -368,112 +454,6 @@ async function list_templates_handler(args) {
         templates: results
     });
 }
-const build_schema = {
-    name: "extension_build",
-    description: "Build a browser extension for production. Outputs to dist/<browser>/. Optionally creates .zip for store submission.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari",
-                    "chromium-based",
-                    "gecko-based",
-                    "firefox-based",
-                    "webkit-based"
-                ],
-                default: "chrome",
-                description: "Target browser"
-            },
-            zip: {
-                type: "boolean",
-                default: false,
-                description: "Create a .zip file for store distribution"
-            },
-            zipSource: {
-                type: "boolean",
-                default: false,
-                description: "Include source code zip (required by some stores)"
-            },
-            zipFilename: {
-                type: "string",
-                description: "Custom .zip file name (defaults to name and version)"
-            },
-            polyfill: {
-                type: "boolean",
-                default: false,
-                description: "Apply cross-browser polyfill"
-            },
-            silent: {
-                type: "boolean",
-                default: false,
-                description: "Suppress build output"
-            },
-            mode: {
-                type: "string",
-                enum: [
-                    "development",
-                    "production",
-                    "none"
-                ],
-                default: "production",
-                description: "Bundler mode override (also sets NODE_ENV)"
-            }
-        },
-        required: [
-            "projectPath"
-        ]
-    }
-};
-async function build_handler(args) {
-    const start = Date.now();
-    try {
-        const summary = await extensionBuild(args.projectPath, {
-            browser: args.browser ?? "chrome",
-            zip: args.zip ?? false,
-            zipSource: args.zipSource ?? false,
-            ...args.zipFilename ? {
-                zipFilename: args.zipFilename
-            } : {},
-            ...void 0 !== args.polyfill ? {
-                polyfill: args.polyfill
-            } : {},
-            ...void 0 !== args.silent ? {
-                silent: args.silent
-            } : {},
-            ...args.mode ? {
-                mode: args.mode
-            } : {},
-            exitOnError: false
-        });
-        return JSON.stringify({
-            success: true,
-            ...summary,
-            duration: Date.now() - start
-        });
-    } catch (err) {
-        return JSON.stringify({
-            error: err instanceof Error ? err.message : String(err),
-            duration: Date.now() - start,
-            hint: "Check that the project has a valid src/manifest.json and all dependencies are installed."
-        });
-    }
-}
 const PINNED_CLI_VERSION = String(package_namespaceObject.El.OP ?? "latest").replace(/^[\^~]/, "");
 function pinnedCliVersion() {
     const override = String(process.env.EXTENSION_MCP_CLI_VERSION || "").trim();
@@ -555,6 +535,126 @@ function spawnExtensionCli(args, options) {
     child.unref();
     return child;
 }
+const build_schema = {
+    name: "extension_build",
+    description: "Build a browser extension for production. Outputs to dist/<browser>/. Optionally creates .zip for store submission.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            projectPath: {
+                type: "string",
+                description: "Path to the extension project root"
+            },
+            browser: {
+                type: "string",
+                enum: [
+                    "chrome",
+                    "chromium",
+                    "edge",
+                    "brave",
+                    "opera",
+                    "vivaldi",
+                    "yandex",
+                    "firefox",
+                    "waterfox",
+                    "librewolf",
+                    "safari",
+                    "chromium-based",
+                    "gecko-based",
+                    "firefox-based",
+                    "webkit-based"
+                ],
+                default: "chrome",
+                description: "Target browser"
+            },
+            zip: {
+                type: "boolean",
+                default: false,
+                description: "Create a .zip file for store distribution"
+            },
+            zipSource: {
+                type: "boolean",
+                default: false,
+                description: "Include source code zip (required by some stores)"
+            },
+            zipFilename: {
+                type: "string",
+                description: "Custom .zip file name (defaults to name and version)"
+            },
+            polyfill: {
+                type: "boolean",
+                default: false,
+                description: "Apply cross-browser polyfill"
+            },
+            silent: {
+                type: "boolean",
+                default: false,
+                description: "Suppress build output"
+            },
+            mode: {
+                type: "string",
+                enum: [
+                    "development",
+                    "production",
+                    "none"
+                ],
+                default: "production",
+                description: "Bundler mode override (also sets NODE_ENV)"
+            }
+        },
+        required: [
+            "projectPath"
+        ]
+    }
+};
+async function build_handler(args) {
+    const start = Date.now();
+    const browser = args.browser ?? "chrome";
+    const cliArgs = [
+        "build",
+        args.projectPath,
+        "--browser",
+        browser
+    ];
+    if (args.zip) cliArgs.push("--zip");
+    if (args.zipSource) cliArgs.push("--zip-source");
+    if (args.zipFilename) cliArgs.push("--zip-filename", args.zipFilename);
+    if (args.polyfill) cliArgs.push("--polyfill");
+    if (args.silent) cliArgs.push("--silent");
+    if (args.mode) cliArgs.push("--mode", args.mode);
+    const { code, stdout, stderr } = await runExtensionCli(cliArgs, {
+        cwd: args.projectPath,
+        timeoutMs: 180000
+    });
+    const duration = Date.now() - start;
+    const out = (stdout ?? "").trim();
+    const lastLines = (text, n)=>text.split("\n").slice(-n).join("\n");
+    if (0 === code) {
+        const size = out.match(/Size:\s*([\d.]+\s*[kKmMgG]?B)/)?.[1];
+        const status = out.match(/Build Status:\s*(\w+)/)?.[1];
+        return JSON.stringify({
+            success: true,
+            browser,
+            ...size ? {
+                size
+            } : {},
+            ...status ? {
+                status
+            } : {},
+            zip: args.zip ?? false,
+            duration,
+            output: lastLines(out, 12)
+        });
+    }
+    const message = stderr.trim() || out || `extension build exited with code ${code}`;
+    return JSON.stringify({
+        success: false,
+        browser,
+        error: message.slice(0, 1200),
+        duration,
+        hint: "Check that the project has a valid src/manifest.json and its dependencies are installed (extension_dev auto-installs; build does not)."
+    });
+}
 const process_manager_sessions = new Map();
 function sessionKey(projectPath, browser) {
     return `${node_path.resolve(projectPath)}::${browser}`;
@@ -719,9 +819,20 @@ async function dev_handler(args) {
         projectPath: args.projectPath,
         status: "started",
         hint: "Use extension_wait to check when the extension is fully loaded, then extension_source_inspect to inspect the live state. When you are done, call extension_stop to shut down the dev server and browser.",
-        earlyOutput: earlyOutput.slice(0, 500)
+        earlyOutput: denoiseEarlyOutput(earlyOutput).slice(0, 500)
     });
 }
+function denoiseEarlyOutput(raw) {
+    const NOISE = [
+        /^npm warn Unknown project config/i,
+        /This will stop working in the next major version of npm/i,
+        /^npm warn config/i,
+        /V8: .*Invalid asm\.js/i,
+        /^\(node:\d+\) V8:/i,
+        /Use `node --trace-warnings/i
+    ];
+    return raw.split("\n").filter((line)=>!NOISE.some((re)=>re.test(line.trim()))).join("\n").replace(/\n{2,}/g, "\n").trimStart();
+}
 const start_schema = {
     name: "extension_start",
     description: "Build the extension for production and immediately preview it in a browser. Combines build + preview in one step. No hot reload.",
@@ -1011,7 +1122,7 @@ const get_template_source_schema = {
         properties: {
             slug: {
                 type: "string",
-                description: "Template slug (e.g. 'sidebar-claude', 'content-react')"
+                description: "Template slug (e.g. 'ai-claude', 'content-react')"
             },
             files: {
                 type: "array",
@@ -1094,6 +1205,91 @@ function isChromiumFamily(browser) {
 function isGeckoFamily(browser) {
     return GECKO_FAMILY.has(browser);
 }
+const KNOWN_PERMISSIONS = new Set([
+    "activeTab",
+    "alarms",
+    "background",
+    "bookmarks",
+    "browsingData",
+    "certificateProvider",
+    "clipboardRead",
+    "clipboardWrite",
+    "contentSettings",
+    "contextMenus",
+    "cookies",
+    "debugger",
+    "declarativeContent",
+    "declarativeNetRequest",
+    "declarativeNetRequestWithHostAccess",
+    "declarativeNetRequestFeedback",
+    "desktopCapture",
+    "dns",
+    "documentScan",
+    "downloads",
+    "downloads.open",
+    "downloads.ui",
+    "enterprise.deviceAttributes",
+    "enterprise.hardwarePlatform",
+    "enterprise.networkingAttributes",
+    "enterprise.platformKeys",
+    "favicon",
+    "fileBrowserHandler",
+    "fileSystemProvider",
+    "fontSettings",
+    "gcm",
+    "geolocation",
+    "history",
+    "identity",
+    "identity.email",
+    "idle",
+    "loginState",
+    "management",
+    "nativeMessaging",
+    "notifications",
+    "offscreen",
+    "pageCapture",
+    "power",
+    "printerProvider",
+    "printing",
+    "printingMetrics",
+    "privacy",
+    "processes",
+    "proxy",
+    "readingList",
+    "runtime",
+    "scripting",
+    "search",
+    "sessions",
+    "sidePanel",
+    "storage",
+    "system.cpu",
+    "system.display",
+    "system.memory",
+    "system.storage",
+    "tabCapture",
+    "tabGroups",
+    "tabs",
+    "topSites",
+    "tts",
+    "ttsEngine",
+    "unlimitedStorage",
+    "vpnProvider",
+    "wallpaper",
+    "webAuthenticationProxy",
+    "webNavigation",
+    "webRequest",
+    "webRequestBlocking",
+    "webRequestAuthProvider",
+    "browserSettings",
+    "captivePortal",
+    "contextualIdentities",
+    "dns",
+    "menus",
+    "menus.overrideContext",
+    "pkcs11",
+    "theme",
+    "webRequestFilterResponse"
+]);
 const manifest_validate_schema = {
     name: "extension_manifest_validate",
     description: "Validate a manifest.json file for correctness across browsers. Reports missing fields, invalid permissions, and cross-browser compatibility issues.",
@@ -1152,6 +1348,13 @@ async function manifest_validate_handler(args) {
     if (!manifest.version) result.warnings.push("Missing field: version (required for store submission)");
     const chromiumManifest = filterKeysForThisBrowser(manifest, "chrome");
     if (!chromiumManifest.manifest_version) result.errors.push('Missing manifest_version. Use "chromium:manifest_version": 3 and "firefox:manifest_version": 2 for cross-browser support.');
+    const declaredPerms = [
+        ...chromiumManifest.permissions ?? [],
+        ...chromiumManifest.optional_permissions ?? []
+    ].filter((p)=>"string" == typeof p);
+    for (const perm of declaredPerms)if (!(perm.includes("://") || perm.includes("*")) && "<all_urls>" !== perm) {
+        if (!KNOWN_PERMISSIONS.has(perm)) result.warnings.push(`Unrecognized permission "${perm}" — check for a typo (host/match patterns belong in host_permissions, not permissions).`);
+    }
     for (const browser of browsers){
         const isChromium = isChromiumFamily(browser);
         const isFirefox = isGeckoFamily(browser);
@@ -1189,9 +1392,15 @@ async function manifest_validate_handler(args) {
     if (chromiumManifest.action || manifest["firefox:browser_action"]) surfaces.push("action");
     if (chromiumManifest.chrome_url_overrides?.newtab) surfaces.push("newtab");
     if (chromiumManifest.background) surfaces.push("background");
-    if (surfaces.length) try {
+    const distinctive = surfaces.filter((s)=>"background" !== s);
+    const matchOn = distinctive.length ? distinctive : surfaces;
+    if (matchOn.length) try {
         const templates = await listTemplates();
-        result.similarTemplates = templates.filter((t)=>t.surfaces.some((s)=>surfaces.includes(s))).slice(0, 5).map((t)=>({
+        result.similarTemplates = templates.map((t)=>({
+                slug: t.slug,
+                surfaces: t.surfaces,
+                score: t.surfaces.filter((s)=>matchOn.includes(s)).length
+            })).filter((t)=>t.score > 0).sort((a, b)=>b.score - a.score).slice(0, 5).map((t)=>({
                 slug: t.slug,
                 surfaces: t.surfaces
             }));
@@ -1313,12 +1522,21 @@ async function inspect_handler(args) {
         byType[f.type].count++;
         byType[f.type].size += f.size;
     }
+    const sourcemapSize = byType.sourcemap?.size ?? 0;
+    const buildType = sourcemapSize > 0 ? "development" : "production";
+    const shippableSize = totalSize - sourcemapSize;
     const result = {
         browser,
         distPath,
+        buildType,
         totalSize,
         totalSizeFormatted: formatBytes(totalSize),
+        shippableSize,
+        shippableSizeFormatted: formatBytes(shippableSize),
         fileCount: files.length,
+        ..."development" === buildType ? {
+            note: `This dist contains ${formatBytes(sourcemapSize)} of sourcemaps and looks like a dev build; run extension_build for production sizes. shippableSize excludes sourcemaps.`
+        } : {},
         manifest: {
             name: manifest.name,
             version: manifest.version,
@@ -1763,13 +1981,16 @@ class CDPClient extends CDPConnection {
 }
 async function resolveCdpPort(projectPath, browser, options) {
     const waitMs = options?.waitMs ?? 20000;
+    const graceMs = options?.graceMs ?? 2500;
     const readyPath = node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json");
     const deadline = Date.now() + waitMs;
     let contractSeen = false;
+    let contractSeenAt = null;
     for(;;){
         try {
             const contract = JSON.parse(node_fs.readFileSync(readyPath, "utf8"));
             contractSeen = true;
+            if (null == contractSeenAt) contractSeenAt = Date.now();
             if ("number" == typeof contract.cdpPort) return {
                 port: contract.cdpPort,
                 source: "contract"
@@ -1777,7 +1998,8 @@ async function resolveCdpPort(projectPath, browser, options) {
         } catch  {
             if (!contractSeen) break;
         }
-        if (Date.now() >= deadline) break;
+        const effectiveDeadline = null != contractSeenAt ? Math.min(deadline, contractSeenAt + graceMs) : deadline;
+        if (Date.now() >= effectiveDeadline) break;
         await new Promise((resolve)=>setTimeout(resolve, 500));
     }
     if (!contractSeen && await isCdpEndpoint(9222)) return {
@@ -1947,16 +2169,26 @@ async function source_inspect_handler(args) {
     const cdp = new CDPClient();
     try {
         const allTargets = await CDPClient.discoverTargets(cdpPort);
-        const pageTargets = allTargets.filter((t)=>"page" === t.type && !t.url.startsWith("chrome://") && !t.url.startsWith("devtools://"));
-        if (0 === pageTargets.length) return JSON.stringify({
-            cdpPort,
-            browser,
-            warning: "No inspectable page targets found. The extension may not have opened a page yet.",
-            allTargets: allTargets.map((t)=>({
-                    type: t.type,
-                    url: t.url?.slice(0, 100)
-                }))
-        });
+        const OVERRIDE_PAGES = [
+            "chrome://newtab/",
+            "chrome://new-tab-page/",
+            "chrome://bookmarks/",
+            "chrome://history/"
+        ];
+        const isOverridePage = (url)=>OVERRIDE_PAGES.some((p)=>url.startsWith(p));
+        const pageTargets = allTargets.filter((t)=>"page" === t.type && !t.url.startsWith("devtools://") && (!t.url.startsWith("chrome://") || isOverridePage(t.url)));
+        if (0 === pageTargets.length) {
+            const chromeOnly = allTargets.some((t)=>"page" === t.type && t.url.startsWith("chrome://"));
+            return JSON.stringify({
+                cdpPort,
+                browser,
+                warning: chromeOnly ? "No inspectable page targets found. Only internal chrome:// pages are open; open the extension's surface (or pass a url to navigate a tab) first." : "No inspectable page targets found. The extension may not have opened a page yet.",
+                allTargets: allTargets.map((t)=>({
+                        type: t.type,
+                        url: t.url?.slice(0, 100)
+                    }))
+            });
+        }
         const target = args.url ? pageTargets.find((t)=>t.url.includes(args.url)) ?? pageTargets[0] : pageTargets[0];
         const browserWsUrl = await CDPClient.discoverBrowserWsUrl(cdpPort);
         await cdp.connect(browserWsUrl);
@@ -2452,7 +2684,7 @@ function commonFlags(args) {
 }
 const eval_schema = {
     name: "extension_eval",
-    description: "Evaluate an expression in a running extension context (service worker, content script, popup, options, sidebar). Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Wraps `extension eval`.",
+    description: "Evaluate an expression in a running extension context. Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Chromium caveats: eval in the MV3 background/service_worker is blocked by CSP (use an MV2/Firefox build for that context), and context content/page/popup require a numeric `tab` id (a chrome.tabs id) — the `url` arg alone does not target a tab. To read a content-script DOM without a tab id, prefer extension_source_inspect (it auto-selects the active page and can navigate by url). Wraps `extension eval`.",
     inputSchema: {
         type: "object",
         properties: {
@@ -2480,11 +2712,11 @@ const eval_schema = {
             },
             url: {
                 type: "string",
-                description: "For content/page: document(s) to target"
+                description: "For content/page: filters which matching document(s) to target, but does NOT by itself select a tab — a numeric `tab` id is still required on Chromium."
             },
             tab: {
                 type: "number",
-                description: "For content/page: a specific tab id"
+                description: "Numeric chrome.tabs id. Required for context content/page/popup on Chromium (the `url` arg does not substitute for it)."
             },
             browser: {
                 type: "string",
@@ -2696,7 +2928,21 @@ async function open_handler(args) {
     if ("command" === args.surface && args.name) cli.push("--name", args.name);
     cli.push("--browser", browser);
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
-    return runActVerb(cli, args.projectPath, args.timeout);
+    const raw = await runActVerb(cli, args.projectPath, args.timeout);
+    const headless = /^(1|true)$/i.test(process.env.EXTENSION_HEADLESS ?? "");
+    if (headless && [
+        "popup",
+        "action",
+        "sidebar"
+    ].includes(args.surface)) try {
+        const parsed = JSON.parse(raw);
+        const msg = String(parsed?.error?.message ?? "");
+        if (parsed?.ok === false && !parsed.hint && /active browser window|no active|headless/i.test(msg)) {
+            parsed.hint = "The dev browser is running headless (EXTENSION_HEADLESS), which has no visible window to attach a popup/sidebar to. Relaunch a headed dev session to open UI surfaces.";
+            return JSON.stringify(parsed);
+        }
+    } catch  {}
+    return raw;
 }
 const dom_inspect_schema = {
     name: "extension_dom_inspect",
@@ -2773,8 +3019,9 @@ async function dom_inspect_handler(args) {
         ok: false,
         error: {
             name: "BadRequest",
-            message: "content/page inspect requires a tab id"
-        }
+            message: "content/page inspect requires a numeric tab id (chrome.tabs id, not a CDP target id)."
+        },
+        hint: "To inspect a content script's DOM without hunting for a tab id, use extension_source_inspect (it auto-selects the active page and can navigate via its url arg). Use extension_dom_inspect with context popup/options/sidebar/devtools for an open surface (no tab needed)."
     });
     const cli = [
         "inspect",
@@ -2806,13 +3053,17 @@ function readCredentials() {
         if (1 !== data.version) return null;
         const token = String(data.token || "").trim();
         if (!token) return null;
+        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
         return {
             version: 1,
             token,
             workspaceSlug: String(data.workspaceSlug || ""),
             projectSlug: String(data.projectSlug || ""),
             expiresAt: Number(data.expiresAt || 0),
-            api: String(data.api || "")
+            api: String(data.api || ""),
+            ...provider ? {
+                provider
+            } : {}
         };
     } catch  {
         return null;
@@ -2884,8 +3135,12 @@ function safeApiBase(raw) {
 async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
     const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
     if (override) return {
+        provider: "github",
         clientId: override,
-        scope: "read:user"
+        scope: "read:user",
+        deviceCodeUrl: "/api/cli/device/code",
+        deviceTokenUrl: "/api/cli/device/token",
+        verificationUri: "https://github.com/login/device"
     };
     const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
         headers: {
@@ -2894,12 +3149,32 @@ async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
     });
     if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
     const data = await res.json().catch(()=>({}));
+    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
     const clientId = String(data.githubClientId || "").trim();
-    if (!clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
     return {
+        provider,
         clientId,
-        scope: String(data.scope || "read:user")
+        scope: String(data.scope || "read:user"),
+        deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
+        deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
+        verificationUri: String(data.verificationUri || "https://github.com/login/device")
+    };
+}
+function persistTokenResponse(args) {
+    const token = String(args.data.token || "").trim();
+    if (!token) throw new Error("Login returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(args.data.workspaceSlug || ""),
+        projectSlug: String(args.data.projectSlug || ""),
+        expiresAt: Number(args.data.expiresAt || 0),
+        api: args.apiBase,
+        provider: args.provider
     };
+    writeCredentials(creds);
+    return creds;
 }
 async function exchangeAndPersist(args) {
     const doFetch = args.fetchImpl ?? fetch;
@@ -2924,18 +3199,11 @@ async function exchangeAndPersist(args) {
         };
     }
     if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    const token = String(data.token || "").trim();
-    if (!token) throw new Error("Login exchange returned no token.");
-    const creds = {
-        version: 1,
-        token,
-        workspaceSlug: String(data.workspaceSlug || ""),
-        projectSlug: String(data.projectSlug || ""),
-        expiresAt: Number(data.expiresAt || 0),
-        api: args.apiBase
-    };
-    writeCredentials(creds);
-    return creds;
+    return persistTokenResponse({
+        apiBase: args.apiBase,
+        data,
+        provider: "github"
+    });
 }
 function resolveToken() {
     const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
@@ -3007,53 +3275,60 @@ async function publish(options = {}) {
 }
 const publish_schema = {
     name: "extension_publish",
-    description: "Publish a project to extension.dev and return a shareable URL. Auth-gated: requires EXTENSION_DEV_TOKEN (a workspace/project access token) in the environment. Posts to the platform's CLI publish endpoint directly. This is the only tool that talks to the hosted platform rather than the local browser.",
+    description: "Publish the project your stored token is scoped to (from extension_login, or EXTENSION_DEV_TOKEN) to extension.dev and return its shareable URL. The publish target is the token's project -- there is no projectPath, the local files are not uploaded. For a PUBLIC project the URL is the canonical public page and ttlHours does not apply; for a PRIVATE project it is a fresh time-limited share link (?share=) whose lifetime is ttlHours. Posts to the platform's CLI publish endpoint. Besides extension_login this is the only tool that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
             ttlHours: {
                 type: "number",
-                description: "Share-link lifetime in hours (1–168, default 24)"
+                description: "Private-project share-link lifetime in hours, 1-168 (default 24). Ignored for public projects."
             },
             buildSha: {
                 type: "string",
-                description: "Pin the share URL to a specific build sha"
+                description: "Pin the share URL to a specific build sha (7-40 hex chars). The platform verifies the build exists in the project's build index and rejects an unknown sha, so the returned URL always points at a real build."
             },
             api: {
                 type: "string",
                 description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
             }
         },
-        required: [
-            "projectPath"
-        ]
+        required: []
     }
 };
-async function publish_handler(args) {
-    const token = resolveToken();
-    if (!token) return JSON.stringify({
+function fail(name, message) {
+    return JSON.stringify({
         ok: false,
         error: {
-            name: "PublishAuthError",
-            message: "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+            name,
+            message
         }
     });
+}
+async function publish_handler(args) {
+    const token = resolveToken();
+    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
+    if (null != args.ttlHours) {
+        const t = Number(args.ttlHours);
+        if (!Number.isInteger(t) || t < 1 || t > 168) return fail("PublishBadRequest", "ttlHours must be an integer between 1 and 168.");
+    }
+    if (null != args.buildSha && "" !== args.buildSha) {
+        if (!/^[0-9a-f]{7,40}$/i.test(args.buildSha)) return fail("PublishBadRequest", "buildSha must be a 7-40 character hex git sha.");
+    }
     const result = await publish({
         ttlHours: args.ttlHours,
         buildSha: args.buildSha,
         api: args.api,
         token
     });
-    return result.ok ? JSON.stringify(result.data) : JSON.stringify(result);
+    if (!result.ok) return JSON.stringify(result);
+    const data = result.data;
+    if (null != args.ttlHours && "public" === data.visibility) data.note = "ttlHours was ignored: this is a public project, whose share URL is its canonical public page.";
+    return JSON.stringify(data);
 }
 const release_promote_DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
-    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: requires a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
+    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
     inputSchema: {
         type: "object",
         properties: {
@@ -3095,7 +3370,7 @@ const release_promote_schema = {
         ]
     }
 };
-function fail(name, message) {
+function release_promote_fail(name, message) {
     return JSON.stringify({
         ok: false,
         error: {
@@ -3106,12 +3381,12 @@ function fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
-    if (!buildId || !channel) return fail("ReleaseInputError", "buildId and channel are required.");
+    if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
     const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || release_promote_DEFAULT_API));
-    if (!apiCheck.ok) return fail("ReleaseConfigError", apiCheck.message);
+    if (!apiCheck.ok) return release_promote_fail("ReleaseConfigError", apiCheck.message);
     const url = `${apiCheck.base}/api/cli/release/promote`;
     const body = {
         buildId,
@@ -3132,7 +3407,7 @@ async function release_promote_handler(args) {
             body: JSON.stringify(body)
         });
     } catch (err) {
-        return fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+        return release_promote_fail("ReleaseNetworkError", `Could not reach ${url}: ${err?.message || err}`);
     }
     const text = await res.text();
     let data;
@@ -3143,12 +3418,117 @@ async function release_promote_handler(args) {
             message: text
         };
     }
-    if (!res.ok) return fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    if (!res.ok) return release_promote_fail("ReleaseError", `promote failed (${res.status}): ${data?.message || text || "unknown error"}`);
     return JSON.stringify(data);
 }
+const deploy_DEFAULT_API = "https://www.extension.dev";
+const deploy_schema = {
+    name: "extension_deploy",
+    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight: verifies auth, the project, that the build exists, and the store workflow - dispatches nothing); pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN); store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha. Posts to the platform's CLI store-submission endpoint.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            browsers: {
+                type: "array",
+                items: {
+                    type: "string",
+                    enum: [
+                        "chrome",
+                        "firefox",
+                        "edge",
+                        "safari"
+                    ]
+                },
+                description: "Stores to submit to."
+            },
+            buildSha: {
+                type: "string",
+                description: "The built commit SHA to submit. It must have a completed build in the project's build index; an unknown sha is rejected."
+            },
+            channel: {
+                type: "string",
+                description: "Release channel to submit from (default stable)."
+            },
+            version: {
+                type: "string",
+                description: "Version label for the submission record (optional)."
+            },
+            dryRun: {
+                type: "boolean",
+                default: true,
+                description: "Preflight only (verify auth, project, build, and store workflow). Pass false to actually dispatch the submission (irreversible, enters store review)."
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
+            }
+        },
+        required: [
+            "browsers",
+            "buildSha"
+        ]
+    }
+};
+function deploy_fail(name, message) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        }
+    });
+}
+async function deploy_handler(args) {
+    const token = resolveToken();
+    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens).");
+    const browsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim().toLowerCase()).filter(Boolean);
+    if (0 === browsers.length) return deploy_fail("DeployInputError", 'browsers is required (e.g. ["chrome","firefox","edge"]).');
+    const buildSha = String(args.buildSha || "").trim();
+    if (!buildSha) return deploy_fail("DeployInputError", "buildSha is required (the built commit to submit).");
+    const apiCheck = safeApiBase(String(args.api || process.env.EXTENSION_DEV_API_URL || deploy_DEFAULT_API));
+    if (!apiCheck.ok) return deploy_fail("DeployConfigError", apiCheck.message);
+    const url = `${apiCheck.base}/api/cli/stores/submit`;
+    const dryRun = false !== args.dryRun;
+    const body = {
+        browsers,
+        buildSha,
+        dryRun
+    };
+    if (args.channel) body.channel = String(args.channel).trim();
+    if (args.version) body.version = String(args.version).trim();
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json"
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return deploy_fail("DeployNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return deploy_fail("DeployError", `submit failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    return JSON.stringify({
+        mode: "platform",
+        dryRun,
+        ...data
+    });
+}
+const SAFE_CEILING_MS = 50000;
 const wait_schema = {
     name: "extension_wait",
-    description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status.",
+    description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status. A single call is bounded to ~50s to stay under the MCP client request timeout; if it returns status:'timeout', call it again to keep waiting (polling resumes on the same contract).",
     inputSchema: {
         type: "object",
         properties: {
@@ -3162,8 +3542,8 @@ const wait_schema = {
             },
             timeout: {
                 type: "number",
-                default: 60000,
-                description: "Timeout in milliseconds"
+                default: 45000,
+                description: "Requested wait in milliseconds. Clamped to ~50s per call so it never exceeds the MCP client request timeout; call again to keep waiting for slower builds."
             }
         },
         required: [
@@ -3173,7 +3553,9 @@ const wait_schema = {
 };
 async function wait_handler(args) {
     const { browser } = resolveSessionBrowser(args.projectPath, args.browser, "chrome");
-    const timeout = args.timeout ?? 60000;
+    const requested = args.timeout ?? 45000;
+    const timeout = Math.min(Math.max(requested, 1000), SAFE_CEILING_MS);
+    const clamped = requested > SAFE_CEILING_MS;
     const readyPath = node_path.resolve(args.projectPath, "dist", "extension-js", browser, "ready.json");
     const start = Date.now();
     const pollInterval = 1000;
@@ -3206,9 +3588,11 @@ async function wait_handler(args) {
     }
     return JSON.stringify({
         status: "timeout",
-        message: `Extension did not become ready within ${timeout}ms`,
+        message: `Extension not ready after ${timeout}ms this call`,
         readyPath,
-        hint: "The dev session may still be building. Try increasing the timeout, or check if the dev process is still running."
+        waitDuration: Date.now() - start,
+        clamped: clamped ? `requested ${requested}ms was clamped to ${SAFE_CEILING_MS}ms to stay under the MCP client request timeout` : void 0,
+        hint: "Still building — call extension_wait again to keep waiting (it resumes polling the same contract). If it never readies, check the dev process with extension_doctor."
     });
 }
 const add_feature_schema = {
@@ -3378,7 +3762,23 @@ async function add_feature_handler(args) {
     });
     const template = await getTemplateBySlug(templateSlug);
     const referenceFiles = template?.keyFiles ?? template?.files ?? [];
-    const featureDir = "content-script" === args.feature ? "content" : args.feature;
+    const FEATURE_DIR = {
+        "content-script": "content",
+        popup: "action"
+    };
+    const featureDir = FEATURE_DIR[args.feature] ?? args.feature;
+    const scriptExt = "react" === framework || "preact" === framework ? "tsx" : "ts";
+    const componentExt = "vue" === framework ? "vue" : "svelte" === framework ? "svelte" : "tsx";
+    const COMPONENT_BASE = {
+        content: "Content",
+        sidebar: "Sidebar",
+        action: "Action",
+        newtab: "NewTab",
+        options: "Options",
+        devtools: "DevTools",
+        background: "Background"
+    };
+    const componentBase = COMPONENT_BASE[featureDir] ?? featureDir.charAt(0).toUpperCase() + featureDir.slice(1);
     const filesToCreate = [];
     const manifestUpdates = MANIFEST_ADDITIONS[args.feature] ?? {};
     if ([
@@ -3392,24 +3792,42 @@ async function add_feature_handler(args) {
             path: `src/${featureDir}/index.html`,
             hint: "HTML entry point"
         }, {
-            path: `src/${featureDir}/scripts.${"vanilla" === framework ? "ts" : "tsx"}`,
+            path: `src/${featureDir}/scripts.${scriptExt}`,
             hint: "vanilla" === framework ? "Script entry point" : `${framework} mount point`
         }, {
             path: `src/${featureDir}/styles.css`,
             hint: "Stylesheet"
         });
-        if ("vanilla" !== framework) filesToCreate.push({
-            path: `src/${featureDir}/${featureDir.charAt(0).toUpperCase() + featureDir.slice(1)}App.tsx`,
-            hint: `Main ${framework} component`
+        if ("vanilla" !== framework) {
+            filesToCreate.push({
+                path: `src/${featureDir}/${componentBase}App.${componentExt}`,
+                hint: `Main ${framework} component`
+            });
+            if ("vue" === framework) filesToCreate.push({
+                path: `src/${featureDir}/shims-vue.d.ts`,
+                hint: "Vue SFC type shim (lets TS import .vue components)"
+            });
+        }
+    }
+    if ("content-script" === args.feature) {
+        filesToCreate.push({
+            path: "src/content/scripts.ts",
+            hint: "vanilla" === framework ? "Content script entry point" : `${framework} content-script mount point`
+        }, {
+            path: "src/content/styles.css",
+            hint: "Content script styles"
         });
+        if ("vanilla" !== framework) {
+            filesToCreate.push({
+                path: `src/content/ContentApp.${componentExt}`,
+                hint: `Main ${framework} component mounted by the content script`
+            });
+            if ("vue" === framework) filesToCreate.push({
+                path: "src/content/shims-vue.d.ts",
+                hint: "Vue SFC type shim (lets TS import .vue components)"
+            });
+        }
     }
-    if ("content-script" === args.feature) filesToCreate.push({
-        path: "src/content/scripts.ts",
-        hint: "Content script entry point"
-    }, {
-        path: "src/content/styles.css",
-        hint: "Content script styles"
-    });
     if ("background" === args.feature) filesToCreate.push({
         path: "src/background.ts",
         hint: "Background service worker / script"
@@ -3512,9 +3930,102 @@ async function pollForToken(args) {
         reason: "pending"
     };
 }
+async function requestDeviceCode(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}${args.path}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            project: args.project,
+            clientName: args.clientName ?? "extension-mcp"
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Device code request failed (${res.status}): ${data.message || "unknown error"}`);
+    const deviceCode = String(data.device_code || "").trim();
+    const userCode = String(data.user_code || "").trim();
+    if (!deviceCode || !userCode) throw new Error("Device code response missing device_code/user_code.");
+    return {
+        deviceCode,
+        userCode,
+        verificationUri: String(data.verification_uri || "https://extension.dev/device"),
+        verificationUriComplete: String(data.verification_uri_complete || data.verification_uri || ""),
+        interval: Number(data.interval || 5),
+        expiresIn: Number(data.expires_in || 900)
+    };
+}
+async function pollDeviceToken(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const deadline = Date.now() + args.budgetMs;
+    let interval = Math.max(1, args.interval);
+    for(;;){
+        const res = await doFetch(`${args.apiBase}${args.path}`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json"
+            },
+            body: JSON.stringify({
+                device_code: args.deviceCode,
+                project: args.project
+            })
+        });
+        const text = await res.text();
+        let data;
+        try {
+            data = JSON.parse(text);
+        } catch  {
+            data = {
+                message: text
+            };
+        }
+        if (res.ok && data.token) {
+            const creds = persistTokenResponse({
+                apiBase: args.apiBase,
+                data,
+                provider: "extensiondev"
+            });
+            return {
+                ok: true,
+                creds
+            };
+        }
+        const error = String(data.error || "");
+        if ("access_denied" === error) return {
+            ok: false,
+            reason: "denied"
+        };
+        if ("expired_token" === error) return {
+            ok: false,
+            reason: "expired"
+        };
+        if ("slow_down" === error) interval += 5;
+        else if (error && "authorization_pending" !== error) return {
+            ok: false,
+            reason: "error",
+            message: String(data.message || error)
+        };
+        if (Date.now() + 1000 * interval >= deadline) return {
+            ok: false,
+            reason: "pending"
+        };
+        await new Promise((r)=>setTimeout(r, 1000 * interval));
+    }
+}
 const login_schema = {
     name: "extension_login",
-    description: "Authenticate to extension.dev via GitHub device-code and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
+    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
@@ -3577,6 +4088,52 @@ async function login_handler(args) {
     } catch (err) {
         return login_fail("LoginConfigError", err?.message || "Could not load login config.");
     }
+    if ("extensiondev" === config.provider) {
+        if (args.deviceCode) {
+            const poll = await pollDeviceToken({
+                apiBase,
+                path: config.deviceTokenUrl,
+                project,
+                deviceCode: String(args.deviceCode),
+                interval: 5,
+                budgetMs: RESUME_BUDGET_MS
+            });
+            if (poll.ok) return success(poll.creds);
+            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
+            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+            if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
+            return login_pending({
+                deviceCode: String(args.deviceCode),
+                userCode: "(see the previous response)",
+                verificationUri: config.verificationUri
+            });
+        }
+        let start;
+        try {
+            start = await requestDeviceCode({
+                apiBase,
+                path: config.deviceCodeUrl,
+                project
+            });
+        } catch (err) {
+            return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
+        }
+        const poll = await pollDeviceToken({
+            apiBase,
+            path: config.deviceTokenUrl,
+            project,
+            deviceCode: start.deviceCode,
+            interval: start.interval,
+            budgetMs: FIRST_CALL_BUDGET_MS
+        });
+        if (poll.ok) return success(poll.creds);
+        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+        return login_pending({
+            deviceCode: start.deviceCode,
+            userCode: start.userCode,
+            verificationUri: start.verificationUri
+        });
+    }
     if (args.deviceCode) {
         const poll = await pollForToken({
             clientId: config.clientId,
@@ -3655,6 +4212,7 @@ async function whoami_handler() {
         workspaceSlug: creds.workspaceSlug,
         projectSlug: creds.projectSlug,
         api: creds.api,
+        provider: creds.provider ?? "github",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
@@ -3679,7 +4237,7 @@ async function logout_handler() {
 }
 const install_browser_schema = {
     name: "extension_install_browser",
-    description: "Install a managed browser binary for extension testing. Useful in CI, Docker, or fresh environments where browsers are not pre-installed.",
+    description: "Install a managed browser binary for extension testing. Useful in CI, Docker, or fresh environments where browsers are not pre-installed. This downloads ~580-625 MB in a single blocking call (30s+ on a fast link); on a slow network it can exceed a client's default request timeout, so allow a generous timeout when calling it.",
     inputSchema: {
         type: "object",
         properties: {
@@ -4155,35 +4713,70 @@ async function detect_browsers_handler(args) {
 }
 const doctor_schema = {
     name: "extension_doctor",
-    description: "Diagnose a dev session end-to-end: ready contract, dev-server process, control-port agreement, control channel, eval token, executor, and browser liveness. Returns one {check, status, detail, remediation?} entry per leg in dependency order — a 'skip' names the check that blocked it and is NOT a pass. Run this first when any act tool (storage/reload/eval/open) errors unexpectedly. Wraps `extension doctor`.",
+    description: "Diagnose a dev session end-to-end: ready contract, dev-server process, control-port agreement, control channel, eval token, executor, and browser liveness. Returns one {check, status, detail, remediation?} entry per leg in dependency order — a 'skip' names the check that blocked it and is NOT a pass. Run this first when any act tool (storage/reload/eval/open) errors unexpectedly. Wraps `extension doctor`. Call with no projectPath for a pre-flight environment check (node, extension CLI, template cache) before any project exists.",
     inputSchema: {
         type: "object",
         properties: {
             projectPath: {
                 type: "string",
-                description: "Path to the extension project root"
+                description: "Path to the extension project root. Omit for a pre-flight environment check with no project."
             },
             browser: {
                 type: "string",
                 description: "Browser session to diagnose. Defaults to the active dev session's browser for this project."
             }
-        },
-        required: [
-            "projectPath"
-        ]
+        }
     }
 };
+async function environmentPreflight() {
+    const checks = [];
+    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    checks.push({
+        check: "node",
+        status: nodeMajor >= 20 ? "pass" : "fail",
+        detail: `Node ${process.versions.node} on ${process.platform}/${process.arch}`,
+        remediation: nodeMajor >= 20 ? void 0 : "Extension.js needs Node >= 20.18."
+    });
+    const { code, stdout, stderr } = await runExtensionCli([
+        "--version"
+    ], {
+        timeoutMs: 60000
+    });
+    const cliVersion = stdout.trim() || stderr.trim();
+    checks.push({
+        check: "extension-cli",
+        status: 0 === code ? "pass" : "fail",
+        detail: 0 === code ? `extension CLI resolvable (${cliVersion})` : "extension CLI could not be resolved",
+        remediation: 0 === code ? void 0 : "Install locally (npm i -D extension) or rely on npx; check network access to the npm registry."
+    });
+    const cacheFile = node_path.join(node_os.homedir(), ".cache", "extension-js", "templates-meta.json");
+    const cacheExists = node_fs.existsSync(cacheFile);
+    checks.push({
+        check: "template-cache",
+        status: cacheExists ? "pass" : "warn",
+        detail: cacheExists ? `Template catalog cached at ${cacheFile}` : "Template catalog not cached yet (first extension_list_templates will fetch it)"
+    });
+    const healthy = checks.every((c)=>"fail" !== c.status);
+    return JSON.stringify({
+        mode: "environment",
+        healthy,
+        checks,
+        hint: "Pass projectPath to diagnose a live dev session end-to-end."
+    });
+}
 async function doctor_handler(args) {
-    const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
+    if (!args.projectPath) return environmentPreflight();
+    const projectPath = args.projectPath;
+    const { browser } = resolveSessionBrowser(projectPath, args.browser);
     const { code, stdout, stderr } = await runExtensionCli([
         "doctor",
-        args.projectPath,
+        projectPath,
         "--browser",
         browser,
         "--output",
         "json"
     ], {
-        cwd: args.projectPath
+        cwd: projectPath
     });
     const out = stdout.trim();
     try {
@@ -4295,6 +4888,7 @@ const tools = [
     dom_inspect_namespaceObject,
     tools_publish_namespaceObject,
     release_promote_namespaceObject,
+    deploy_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
     login_namespaceObject,
@@ -4428,6 +5022,31 @@ async function runCli(cmd, args) {
         const apiBase = resolveApiBase(flag("api"));
         try {
             const config = await fetchLoginConfig(apiBase);
+            if ("extensiondev" === config.provider) {
+                const start = await requestDeviceCode({
+                    apiBase,
+                    path: config.deviceCodeUrl,
+                    project
+                });
+                log("");
+                log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
+                log("");
+                log("  Waiting for authorization...");
+                const poll = await pollDeviceToken({
+                    apiBase,
+                    path: config.deviceTokenUrl,
+                    project,
+                    deviceCode: start.deviceCode,
+                    interval: start.interval,
+                    budgetMs: 1000 * start.expiresIn
+                });
+                if (!poll.ok) {
+                    log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
+                    return 1;
+                }
+                log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
+                return 0;
+            }
             const start = await startDeviceCode({
                 clientId: config.clientId,
                 scope: config.scope