@extension.dev/mcp 5.1.1 → 5.2.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "5.1.1",
+      "version": "5.2.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 5.2.0
+
+### Added
+
+- `extension_manifest_validate` warns when a Chrome-desktop-only manifest
+  key (for example `file_browser_handlers`) rides an Edge target, where it
+  is inert. Family-level prefix resolution already worked; this adds
+  granularity inside the chromium family for Edge-targeted publishers.
+- `extension_logout` now returns `revokeUrl` pointing at the project's
+  access-tokens page and says plainly that the token stays valid
+  server-side until revoked there. The scope is read before the local
+  credentials are cleared so the link can still be built.
+
+## 5.1.2
+
+### Fixed
+
+- `extension_logs` no longer flags a healthy live session as stale. Newer
+  engine canaries stamp log and event rows with ready.json's `instanceId`
+  rather than its `runId`, so the staleness check compared ids from two
+  different spaces and every live read carried `stale: true` with a
+  do-not-trust warning. The comparator now accepts either identity field,
+  pinned by a test against the real contract shapes. (Filed upstream as
+  Extension.js bug 77 so the ready/logs contract agrees on one field.)
+
 ## 5.1.1
 
 ### Added

package/dist/module.js

@@ -203,7 +203,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"5.1.0","El":{"OP":"^4.0.13"}}');
+var package_namespaceObject = JSON.parse('{"rE":"5.2.0","El":{"OP":"^4.0.13"}}');
 function scaffoldEnginePin(projectPath) {
     try {
         const pkg = JSON.parse(node_fs.readFileSync(node_path.join(projectPath, "package.json"), "utf8"));
@@ -1657,6 +1657,12 @@ function isChromiumFamily(browser) {
 function isGeckoFamily(browser) {
     return GECKO_FAMILY.has(browser);
 }
+const CHROME_DESKTOP_ONLY_KEYS = [
+    "file_browser_handlers",
+    "file_system_provider_capabilities",
+    "input_components",
+    "chrome_os_system_extension"
+];
 const KNOWN_PERMISSIONS = new Set([
     "activeTab",
     "alarms",
@@ -2026,6 +2032,9 @@ async function manifest_validate_handler(args) {
                 if (!perms.includes("sidePanel")) issues.push('Side panel declared but "sidePanel" permission is missing.');
             }
             if (manifest["firefox:browser_action"] && !effective.action) issues.push('Firefox browser_action found but no chromium:action. Chromium MV3 uses "action" instead of "browser_action".');
+            if ("edge" === browser) {
+                for (const key of CHROME_DESKTOP_ONLY_KEYS)if (void 0 !== effective[key]) result.warnings.push(`Manifest key "${key}" works on Chrome but is inert on Edge (it is a Chrome-only surface). The edge build ships it as a no-op; move it under "chromium:${key}" only if you also target Chrome, or remove it.`);
+            }
         }
         if (isFirefox) {
             const contentScripts = effective.content_scripts;
@@ -3229,7 +3238,11 @@ function staleFileNote(projectPath, browser, eventsRunId) {
     } catch  {
         return `These events are from a PAST run: the session that wrote them (pid ${contract.pid}) is dead. Nothing current is producing logs; do not read these as live output.`;
     }
-    if (eventsRunId && contract.runId && String(contract.runId) !== eventsRunId) return `These events carry runId ${eventsRunId} but the current session is run ${String(contract.runId)}, which has written nothing yet. Do not read these as the current run's output.`;
+    const liveIds = [
+        contract.runId,
+        contract.instanceId
+    ].map((v)=>String(v || "")).filter(Boolean);
+    if (eventsRunId && liveIds.length > 0 && !liveIds.includes(eventsRunId)) return `These events carry runId ${eventsRunId} but the current session is run ${liveIds.join(" / ")}, which has written nothing yet. Do not read these as the current run's output.`;
 }
 async function readFromFile(args, browser, limit) {
     const file = logsFilePath(args.projectPath, browser);
@@ -5509,18 +5522,23 @@ async function whoami_handler() {
 }
 const logout_schema = {
     name: "extension_logout",
-    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (revoke from the dashboard if needed); only removes it from this machine.",
+    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (the response includes the dashboard URL where the token can be revoked); only removes it from this machine.",
     inputSchema: {
         type: "object",
         properties: {}
     }
 };
 async function logout_handler() {
+    const creds = readCredentials();
+    const revokeUrl = creds?.workspaceSlug && creds?.projectSlug ? `https://console.extension.dev/${creds.workspaceSlug}/${creds.projectSlug}/settings/access-tokens` : null;
     const result = clearCredentials();
     return JSON.stringify({
         ok: true,
         cleared: result.cleared,
-        message: result.cleared ? "Local credentials removed." : "No stored credentials to remove."
+        ...result.cleared && revokeUrl ? {
+            revokeUrl
+        } : {},
+        message: result.cleared ? revokeUrl ? `Local credentials removed. The token stays valid server-side until it expires; revoke it now at ${revokeUrl} (takes about a minute to propagate).` : "Local credentials removed. The token stays valid server-side until it expires; revoke it from the project's access-tokens page if needed." : "No stored credentials to remove."
     });
 }
 const install_browser_schema = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 31 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "MIT",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "5.1.1",
+      "version": "5.2.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"