@extension.dev/mcp 4.6.0 → 4.8.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "4.6.0",
+      "version": "4.8.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,10 +1,56 @@
 # Changelog
 
+## 4.8.0
+
+Dev-session ergonomics hardened from a 30-persona agent walk of the toolchain.
+
+- **`allowEval` now implies `allowControl`.** Enabling eval on `extension_dev`
+  also opens the control channel, so a single `allowEval: true` unlocks
+  `extension_storage`/`reload`/`open`/`dom_inspect` too. `extension_dev` now
+  returns a `capabilities` block naming exactly which verbs the session unlocked,
+  ending the stop-and-restart loop that hit agents who passed one flag and not
+  the other.
+- **Session-aware browser default.** `extension_stop` (and the other
+  browser-scoped tools) resolve the browser from the one live session for the
+  project instead of assuming `chrome`. `extension_stop` also reaps the launched
+  browser's process tree and refuses to report `stopped: true` while a process
+  survives, fixing orphaned browsers (notably Firefox) after a stop.
+- **Forgiving argument names.** Common synonyms are accepted and normalized:
+  `path`/`dir` for `projectPath`, `name` for `projectName`, `template` for
+  `slug`, `code` for `expression`, and more, so a reasonable first guess no
+  longer 400s.
+- **`extension_manifest_validate`** accepts `projectPath` (it finds the
+  manifest) and probes path-valued fields (popup, service worker, icons, content
+  scripts) against disk, warning on dangling references instead of a false
+  all-clear.
+- **`extension_doctor`** inlines the dev session's own recorded errors so a build
+  or load failure no longer reads as healthy.
+- **`extension_inspect`** lists declared entrypoints (so a small content script
+  is not buried under assets) and warns when a store-listing promo image is
+  shipped inside the package.
+- **`extension_source_inspect`** on a Gecko session now names the working
+  alternatives (`extension_logs`, `extension_eval`) instead of pointing back at
+  the tool that just refused.
+
+## 4.7.0
+
+`extension_deploy` now submits **through** extension.dev instead of driving a
+local CLI. Pass `browsers` + `buildSha` and the submission is routed to the
+platform, which holds your store credentials and dispatches the release from
+your project's mirror CI; authentication is your `extension_login` session or a
+release token in `EXTENSION_DEV_TOKEN`, and it defaults to a dry run. The tool
+is now a thin authenticated client of the platform's store-submission endpoint,
+exactly like `extension_publish` and `extension_release_promote`, with no
+external CLI dependency. This replaces the previous mode that shelled out to a
+standalone local CLI. Direct zip-based submission with store credentials in the
+environment is no longer exposed through the MCP; use your own CI pipeline for
+that.
+
 ## 4.6.0
 
 New `extension_deploy` tool (31 tools total): submit a built extension to the
-Chrome Web Store, Firefox AMO, and Edge Add-ons by driving the standalone
-`@extension.dev/deploy` CLI. Store targets are inferred from the `.zip` paths
+Chrome Web Store, Firefox AMO, and Edge Add-ons by driving a standalone
+deploy CLI. Store targets are inferred from the `.zip` paths
 you pass. It defaults to a dry run, and store credentials are read from the
 environment or a `.env.submit` file, never from tool arguments, so secrets
 never enter the agent transcript.

package/README.md

@@ -121,20 +121,20 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | platform | `extension_logout` | Remove stored credentials |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
-| platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores (wraps `@extension.dev/deploy`) |
+| platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores through extension.dev |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI — the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits the built `.zip` to the Chrome Web Store, Edge Add-ons, and Firefox AMO by driving the standalone [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) CLI — it defaults to a dry run and reads store credentials from the environment or a `.env.submit` file, never from tool arguments.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI — it defaults to a dry run and store credentials are never tool arguments.
 
 ## The extension.dev stack
 
 | Package | Use it to |
 | --- | --- |
 | [`@extension.dev/skill`](https://www.npmjs.com/package/@extension.dev/skill) | Teach AI agents the judgment half: cross-browser rules, gotchas, playbooks |
-| [`@extension.dev/deploy`](https://www.npmjs.com/package/@extension.dev/deploy) | Ship to Chrome, Firefox, and Edge stores from CI |
+| [`@extension.dev/artifact-integrity`](https://www.npmjs.com/package/@extension.dev/artifact-integrity) | Verify extension artifacts and gate CI on tampered bytes before they ship |
 
 All of it rides on [Extension.js](https://github.com/extension-js/extension.js), the open-source cross-browser extension framework.