@extension.dev/mcp 5.4.0 → 5.5.1

package/.claude-plugin/marketplace.json

@@ -2,7 +2,7 @@
   "name": "extensiondev-mcp",
   "owner": {
     "name": "Cezar Augusto",
-    "email": "boss@cezaraugusto.net",
+    "email": "hello@extension.dev",
     "url": "https://extension.dev"
   },
   "plugins": [
@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "5.4.0",
+      "version": "5.5.1",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "5.4.0",
+  "version": "5.5.1",
   "author": {
     "name": "Cezar Augusto",
-    "email": "boss@cezaraugusto.net",
+    "email": "hello@extension.dev",
     "url": "https://cezaraugusto.com"
   },
   "homepage": "https://github.com/extensiondev/mcp",

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 5.5.1
+
+The store journey stops being write-only after submit, and the token
+surfaces start telling the truth about lifetimes and API bases.
+
+### Added
+
+- `extension_store_status` (tool 33): the post-submit sibling of
+  `extension_deploy`. Reads the project's public registry
+  (`stores/health.json`, `stores/status.json`, `stores/submissions.json`)
+  and reports per store whether it is configured, its latest credential
+  health check, the last recorded submission (version, status, store
+  URL, submitted-at), and the latest review status. Normalizes both the
+  v3 merged status schema and legacy v2 poller documents. Defaults to
+  the logged-in project; accepts `workspace` + `project` overrides like
+  `extension_release_list`. A configured store with a failing credential
+  reports `configured: true` with `health.ok: false` (rotate the
+  credential, deep-linked), never "not configured".
+
+### Fixed
+
+- `extension_whoami` no longer asserts a bare `api` field that could
+  misstate the platform base (a login minted via a localhost dev server
+  kept reporting that dead base for a token that authenticates against
+  production). The recorded login base is now labeled
+  `apiRecordedAtLogin`, `apiDefault` reports what authenticated tools
+  actually target, the message flags any divergence, and a set
+  `EXTENSION_DEV_TOKEN` is disclosed as outranking the stored login.
+- The 7-day token TTL (server-enforced) is now stated everywhere a CI
+  author looks: `extension_login`'s description and success/pending
+  results, `extension_whoami`'s `tokenTtlNote` (with the deep console
+  Access tokens URL), and the auth prose of `extension_deploy` and
+  `extension_release_promote` (`extension_publish`'s auth envelope is
+  byte-frozen and unchanged).
+- `extension_deploy`'s description says the per-store rows in the result
+  are the verdict to trust: the platform's bare preflight line does not
+  check store health. A real (non-dry-run) submission now points at
+  `extension_store_status` for tracking.
+
+## 5.5.0
+
+The debug surfaces learn to point at things: tabs are targetable by
+URL, extensions in lists have names, and eval works on the default
+template by default.
+
+### Added
+
+- `extension_dom_inspect` targets tabs by `tabUrl` (case-insensitive
+  URL substring, title as fallback). Exactly one match inspects it and
+  the result names the resolved target; zero or multiple matches return
+  the candidate targets instead of guessing. `listTargets: true` lists
+  the browser's live CDP page targets (targetId, url, title, type) with
+  the standing warning that a CDP targetId is NOT a chrome.tabs id.
+- `extension_list_extensions` names its entries. The dev session's own
+  extension resolves to `name`, `version`, and `ownExtension: true`
+  (identified by recomputing Chrome's unpacked-extension id from the
+  ready contract's distPath) and sorts first; entries that cannot be
+  resolved carry a note saying why instead of a silent bare id. Other
+  extensions' contexts are never attached to or evaluated in.
+
+### Fixed
+
+- `extension_eval` works on the default template by default. On
+  Chromium with an MV3 manifest the default context is now `page` (the
+  MV3 service worker CSP blocks background eval), disclosed in the
+  result as `defaultedContext` with the reason; explicit
+  `context: "background"` is unchanged and keeps its CSP explanation.
+  Firefox and MV2 defaults are untouched. A defaulted eval that lands
+  on an unreachable active tab returns a hint to navigate or pass
+  `url`/`tab`.
+- Error remedies speak tool arguments, never CLI flags: the engine's
+  `--context page --tab <id>` prose is rewritten into `context:`/
+  `tab:`/`url:` vocabulary, with guards so ordinary prose is never
+  garbled by the rewriting.
+- The debugging documentation's headline example now runs on the
+  default template (page-context eval); the background variant is
+  labeled MV2/Firefox, and the cross-browser matrix states per-context
+  eval support honestly with the MV3 CSP footnote.
+
 ## 5.4.0
 
 The DevX swarm's non-blocker friction clusters, cleared: waiting is
@@ -604,7 +683,7 @@ this release graduates that line to stable and becomes `latest`.
 
 # @extension.dev/mcp, Changelog
 
-## Unreleased, agent-bridge tools
+## 5.5.1, agent-bridge tools
 
 Adds the MCP client surface for the Extension.js **agent bridge** (dev-time
 observe + act + inspect). All new tools shell out to the `extension` CLI verbs
@@ -639,7 +718,7 @@ Internal: `lib/act` (CLI shell-out helper), `lib/exec.runExtensionCli` (capture)
 `lib/cdp.getClosedShadowRoots`. Test infra aligned to the workspace vitest
 catalog.
 
-## Unreleased, login (auth tools)
+## 5.5.1, login (auth tools)
 
 Adds the missing `login` flow so `extension_publish` no longer requires the user
 to mint and export `EXTENSION_DEV_TOKEN` by hand. Auth stays auth-AWARE: the

package/README.md

@@ -7,7 +7,7 @@
 
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 30 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 33 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -127,7 +127,7 @@ Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension`
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
 
 ## The extension.dev stack