@extension.dev/mcp 5.1.2 → 5.2.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "5.1.2",
+      "version": "5.2.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "boss@cezaraugusto.net",

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 5.2.0
+
+### Added
+
+- `extension_manifest_validate` warns when a Chrome-desktop-only manifest
+  key (for example `file_browser_handlers`) rides an Edge target, where it
+  is inert. Family-level prefix resolution already worked; this adds
+  granularity inside the chromium family for Edge-targeted publishers.
+- `extension_logout` now returns `revokeUrl` pointing at the project's
+  access-tokens page and says plainly that the token stays valid
+  server-side until revoked there. The scope is read before the local
+  credentials are cleared so the link can still be built.
+
 ## 5.1.2
 
 ### Fixed

package/dist/module.js

@@ -203,7 +203,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"5.1.1","El":{"OP":"^4.0.13"}}');
+var package_namespaceObject = JSON.parse('{"rE":"5.2.0","El":{"OP":"^4.0.13"}}');
 function scaffoldEnginePin(projectPath) {
     try {
         const pkg = JSON.parse(node_fs.readFileSync(node_path.join(projectPath, "package.json"), "utf8"));
@@ -1657,6 +1657,12 @@ function isChromiumFamily(browser) {
 function isGeckoFamily(browser) {
     return GECKO_FAMILY.has(browser);
 }
+const CHROME_DESKTOP_ONLY_KEYS = [
+    "file_browser_handlers",
+    "file_system_provider_capabilities",
+    "input_components",
+    "chrome_os_system_extension"
+];
 const KNOWN_PERMISSIONS = new Set([
     "activeTab",
     "alarms",
@@ -2026,6 +2032,9 @@ async function manifest_validate_handler(args) {
                 if (!perms.includes("sidePanel")) issues.push('Side panel declared but "sidePanel" permission is missing.');
             }
             if (manifest["firefox:browser_action"] && !effective.action) issues.push('Firefox browser_action found but no chromium:action. Chromium MV3 uses "action" instead of "browser_action".');
+            if ("edge" === browser) {
+                for (const key of CHROME_DESKTOP_ONLY_KEYS)if (void 0 !== effective[key]) result.warnings.push(`Manifest key "${key}" works on Chrome but is inert on Edge (it is a Chrome-only surface). The edge build ships it as a no-op; move it under "chromium:${key}" only if you also target Chrome, or remove it.`);
+            }
         }
         if (isFirefox) {
             const contentScripts = effective.content_scripts;
@@ -5513,18 +5522,23 @@ async function whoami_handler() {
 }
 const logout_schema = {
     name: "extension_logout",
-    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (revoke from the dashboard if needed); only removes it from this machine.",
+    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (the response includes the dashboard URL where the token can be revoked); only removes it from this machine.",
     inputSchema: {
         type: "object",
         properties: {}
     }
 };
 async function logout_handler() {
+    const creds = readCredentials();
+    const revokeUrl = creds?.workspaceSlug && creds?.projectSlug ? `https://console.extension.dev/${creds.workspaceSlug}/${creds.projectSlug}/settings/access-tokens` : null;
     const result = clearCredentials();
     return JSON.stringify({
         ok: true,
         cleared: result.cleared,
-        message: result.cleared ? "Local credentials removed." : "No stored credentials to remove."
+        ...result.cleared && revokeUrl ? {
+            revokeUrl
+        } : {},
+        message: result.cleared ? revokeUrl ? `Local credentials removed. The token stays valid server-side until it expires; revoke it now at ${revokeUrl} (takes about a minute to propagate).` : "Local credentials removed. The token stays valid server-side until it expires; revoke it from the project's access-tokens page if needed." : "No stored credentials to remove."
     });
 }
 const install_browser_schema = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 31 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "MIT",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "5.1.2",
+  "version": "5.2.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "5.1.2",
+      "version": "5.2.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"