@extension.dev/mcp 5.4.0 → 5.5.1

package/dist/module.js

@@ -68,6 +68,7 @@ var eval_namespaceObject = {};
 __webpack_require__.r(eval_namespaceObject);
 __webpack_require__.d(eval_namespaceObject, {
     handler: ()=>eval_handler,
+    resolveDefaultEvalContext: ()=>resolveDefaultEvalContext,
     schema: ()=>eval_schema
 });
 var get_template_source_namespaceObject = {};
@@ -192,6 +193,14 @@ __webpack_require__.d(storage_namespaceObject, {
     handler: ()=>storage_handler,
     schema: ()=>storage_schema
 });
+var store_status_namespaceObject = {};
+__webpack_require__.r(store_status_namespaceObject);
+__webpack_require__.d(store_status_namespaceObject, {
+    handler: ()=>store_status_handler,
+    latestSubmissionsByStore: ()=>latestSubmissionsByStore,
+    normalizeStoresStatus: ()=>normalizeStoresStatus,
+    schema: ()=>store_status_schema
+});
 var uninstall_browser_namespaceObject = {};
 __webpack_require__.r(uninstall_browser_namespaceObject);
 __webpack_require__.d(uninstall_browser_namespaceObject, {
@@ -210,7 +219,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"5.4.0","El":{"OP":"^4.0.13"}}');
+var package_namespaceObject = JSON.parse('{"rE":"5.5.1","El":{"OP":"^4.0.13"}}');
 function scaffoldEnginePin(projectPath) {
     try {
         const pkg = JSON.parse(node_fs.readFileSync(node_path.join(projectPath, "package.json"), "utf8"));
@@ -3179,7 +3188,7 @@ async function source_inspect_handler(args) {
 }
 const list_extensions_schema = {
     name: "extension_list_extensions",
-    description: "List the extensions with a live context in the running dev browser via Chrome DevTools Protocol. Returns each extension's id, name, version, and live contexts (service worker, page). Identity is read read-only via the Extensions domain, other extensions' contexts are never attached to or evaluated in. A dormant MV3 service worker with no open page may be absent until it wakes. Chromium only (Firefox uses RDP, not yet supported). Requires an active dev or start session.",
+    description: "List the extensions with a live context in the running dev browser via Chrome DevTools Protocol. Returns each extension's id, name, version, and live contexts (service worker, page). The entry for THIS dev session's extension (the project being served) is flagged ownExtension: true, with name and version resolved from the session's ready contract even when the browser exposes no identity. Other extensions resolve via the read-only Extensions domain when available; their contexts are never attached to or evaluated in, so an id that the domain does not describe stays id-only with a note saying why. A dormant MV3 service worker with no open page may be absent until it wakes. Chromium only (Firefox uses RDP, not yet supported). Requires an active dev or start session.",
     inputSchema: {
         type: "object",
         properties: {
@@ -3197,6 +3206,47 @@ const list_extensions_schema = {
         ]
     }
 };
+function unpackedExtensionId(distPath) {
+    const digest = node_crypto.createHash("sha256").update(distPath).digest();
+    let id = "";
+    for(let i = 0; i < 16; i++){
+        id += String.fromCharCode(97 + (digest[i] >> 4));
+        id += String.fromCharCode(97 + (0x0f & digest[i]));
+    }
+    return id;
+}
+function readOwnIdentity(projectPath, browser) {
+    let contract;
+    try {
+        const file = node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json");
+        contract = JSON.parse(node_fs.readFileSync(file, "utf8"));
+    } catch  {
+        return null;
+    }
+    const distPath = "string" == typeof contract?.distPath ? contract.distPath : null;
+    const ids = [];
+    if (distPath) {
+        ids.push(unpackedExtensionId(distPath));
+        try {
+            const real = node_fs.realpathSync(distPath);
+            if (real !== distPath) ids.push(unpackedExtensionId(real));
+        } catch  {}
+    }
+    let name = "string" == typeof contract?.extensionName ? contract.extensionName : void 0;
+    let version = "string" == typeof contract?.extensionVersion ? contract.extensionVersion : void 0;
+    if ((!name || !version) && distPath) try {
+        const manifest = JSON.parse(node_fs.readFileSync(node_path.join(distPath, "manifest.json"), "utf8"));
+        if (!name && "string" == typeof manifest?.name && !manifest.name.startsWith("__MSG_")) name = manifest.name;
+        if (!version && "string" == typeof manifest?.version) version = manifest.version;
+    } catch  {}
+    if (0 === ids.length && !name) return null;
+    return {
+        ids,
+        name,
+        version
+    };
+}
+const UNRESOLVED_NOTE = "Identity unresolved: the browser's Extensions CDP domain returned nothing for this id, and other extensions' contexts are never attached to or evaluated in to read a manifest.";
 async function list_extensions_handler(args) {
     const { browser } = resolveSessionBrowser(args.projectPath, args.browser, "chrome");
     if (!isChromiumFamily(browser)) return JSON.stringify({
@@ -3237,6 +3287,7 @@ async function list_extensions_handler(args) {
             });
             byId.set(id, list);
         }
+        const own = readOwnIdentity(args.projectPath, browser);
         const extensions = [];
         for (const [id, ctxTargets] of byId){
             const entry = {
@@ -3257,15 +3308,33 @@ async function list_extensions_handler(args) {
                     entry.source = "extensions-domain";
                 }
             } catch  {}
+            if (own?.ids.includes(id)) {
+                entry.ownExtension = true;
+                if (void 0 === entry.name && void 0 !== own.name) {
+                    entry.name = own.name;
+                    if (void 0 !== own.version) entry.version = own.version;
+                    entry.source = "session-contract";
+                }
+            }
             extensions.push(entry);
         }
-        extensions.sort((a, b)=>(a.name ?? a.id).localeCompare(b.name ?? b.id));
+        if (own?.name && !extensions.some((e)=>e.ownExtension)) {
+            const byName = extensions.filter((e)=>e.name === own.name);
+            if (1 === byName.length) byName[0].ownExtension = true;
+        }
+        for (const entry of extensions)if (void 0 === entry.name) entry.note = UNRESOLVED_NOTE;
+        extensions.sort((a, b)=>{
+            if ((a.ownExtension ?? false) !== (b.ownExtension ?? false)) return a.ownExtension ? -1 : 1;
+            return (a.name ?? a.id).localeCompare(b.name ?? b.id);
+        });
+        const ownEntry = extensions.find((e)=>e.ownExtension);
         return JSON.stringify({
             cdpPort,
             browser,
             count: extensions.length,
+            ownExtensionId: ownEntry?.id ?? null,
             extensions,
-            note: "Lists extensions that currently have at least one live context (service worker or open page). An MV3 service worker that has gone dormant with no open page may be absent until it wakes. Identity is read read-only via the Extensions domain; other extensions' contexts are never attached to or evaluated in."
+            note: "Lists extensions that currently have at least one live context (service worker or open page). An MV3 service worker that has gone dormant with no open page may be absent until it wakes. ownExtension marks the extension this dev session serves, identified from the session's ready contract. Other identity is read read-only via the Extensions domain; other extensions' contexts are never attached to or evaluated in."
         });
     } catch (error) {
         return JSON.stringify({
@@ -3597,7 +3666,7 @@ async function logs_handler(args) {
     return readFromFile(args, browser, limit);
 }
 function toMcpSpeak(text) {
-    return text.replace(/`?extension dev(?: [^\s`]*)? --browser[= ]([\w-]+) --allow-control`?/g, 'extension_dev with { browser: "$1", allowControl: true }').replace(/--allow-control/g, "allowControl: true (extension_dev)").replace(/--allow-eval/g, "allowEval: true (extension_dev)").replace(/--context[= ]([\w-]+)/g, 'context: "$1"').replace(/--tab[= ](\d+)/g, "tab: $1").replace(/--url[= ](\S+)/g, 'url: "$1"').replace(/--browser[= ]([\w-]+)/g, 'browser: "$1"').replace(/`extension dev`/g, "extension_dev").replace(/\bextension dev\b/g, "extension_dev");
+    return text.replace(/`?extension dev(?: [^\s`]*)? --browser[= ]([\w-]+) --allow-control`?/g, 'extension_dev with { browser: "$1", allowControl: true }').replace(/--allow-control/g, "allowControl: true (extension_dev)").replace(/--allow-eval/g, "allowEval: true (extension_dev)").replace(/Use --context page --tab <id>/g, 'Use context: "page" (targets the active tab; pass url or tab to pick another)').replace(/--context[= ](background|popup|options|sidebar|devtools|newtab|history|bookmarks|content|page)\b/g, 'context: "$1"').replace(/--tab[= ](\d+|<[\w-]+>)/g, "tab: $1").replace(/--url[= ]"([^"]+)"/g, 'url: "$1"').replace(/--url[= ](<[\w-]+>|\S*(?:\/\/|\*)\S*)/g, 'url: "$1"').replace(/--browser[= ]([\w]+-based|chrome|chromium|edge|brave|opera|vivaldi|yandex|firefox|waterfox|librewolf|safari)\b/g, 'browser: "$1"').replace(/--timeout[= ](\d+)/g, "timeout: $1").replace(/`extension dev`/g, "extension_dev").replace(/\bextension dev\b/g, "extension_dev").replace(/--tab\b/g, "`tab`").replace(/--url\b/g, "`url`").replace(/--context\b/g, "`context`").replace(/--browser\b/g, "`browser`").replace(/--timeout\b/g, "`timeout`");
 }
 function withSessionContext(message, projectPath) {
     const isControlError = /no active control channel|control channel refused|\b1006\b|no executor connected|is the session started with allowControl/i.test(message);
@@ -3650,7 +3719,7 @@ function commonFlags(args) {
 }
 const eval_schema = {
     name: "extension_eval",
-    description: "Evaluate an expression in a running extension context. Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Targeting for context content/page: pass `url` to pick the matching tab, or omit both `url` and `tab` to use the ACTIVE tab; a numeric `tab` id is only needed to disambiguate. Extension surfaces (popup/options/sidebar/devtools) and override pages (newtab/history/bookmarks) evaluate over the in-bundle relay and need NO tab id; the surface must be OPEN (extension_open first; a closed surface returns an explicit error). Chromium caveat: eval in the MV3 background/service_worker is blocked by CSP (use an MV2/Firefox build for that context). Use extension_dom_inspect with listTabs: true to enumerate {tabId,url,title}. Wraps `extension eval`.",
+    description: "Evaluate an expression in a running extension context. Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Context default: on a Chromium session whose manifest is MV3 (the default template) the default is `page` (the active tab), because the MV3 background is a service worker whose CSP blocks eval, so a background default would fail on the most common path; on Firefox/MV2 sessions the default stays `background`. Pass `context: \"background\"` explicitly to target the worker anyway (on Chromium MV3 that returns the CSP explanation). Targeting for context content/page: pass `url` to pick the matching tab, or omit both `url` and `tab` to use the ACTIVE tab; a numeric `tab` id is only needed to disambiguate. Extension surfaces (popup/options/sidebar/devtools) and override pages (newtab/history/bookmarks) evaluate over the in-bundle relay and need NO tab id; the surface must be OPEN (extension_open first; a closed surface returns an explicit error). Use extension_dom_inspect with listTabs: true to enumerate {tabId,url,title}. Wraps `extension eval`.",
     inputSchema: {
         type: "object",
         properties: {
@@ -3676,8 +3745,7 @@ const eval_schema = {
                     "content",
                     "page"
                 ],
-                default: "background",
-                description: "Which extension surface to evaluate in"
+                description: "Which extension surface to evaluate in. Default: `background`, EXCEPT on Chromium sessions whose manifest is MV3, where the default is `page` (the active tab) because the MV3 service worker CSP blocks eval; pass `context: \"background\"` explicitly to target the worker anyway."
             },
             url: {
                 type: "string",
@@ -3702,14 +3770,38 @@ const eval_schema = {
         ]
     }
 };
+function resolveDefaultEvalContext(projectPath, browser) {
+    if (!isChromiumFamily(browser)) return "background";
+    const candidates = [
+        node_path.join(projectPath, "dist", browser, "manifest.json"),
+        node_path.join(projectPath, "dist", "manifest.json"),
+        node_path.join(projectPath, "src", "manifest.json"),
+        node_path.join(projectPath, "manifest.json")
+    ];
+    for (const file of candidates){
+        let manifest;
+        try {
+            manifest = JSON.parse(node_fs.readFileSync(file, "utf8"));
+        } catch  {
+            continue;
+        }
+        const version = manifest["chromium:manifest_version"] ?? manifest.manifest_version;
+        if (3 === version) return "page";
+        if (2 === version) break;
+    }
+    return "background";
+}
 async function eval_handler(args) {
     const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
+    const defaulted = !args.context && "page" === resolveDefaultEvalContext(args.projectPath, browser);
+    const context = defaulted ? "page" : args.context;
     const raw = await runActVerb([
         "eval",
         args.expression,
         args.projectPath,
         ...commonFlags({
             ...args,
+            context,
             browser
         })
     ], args.projectPath, args.timeout);
@@ -3720,6 +3812,15 @@ async function eval_handler(args) {
             return JSON.stringify(parsed);
         }
     } catch  {}
+    if (defaulted) try {
+        const parsed = JSON.parse(raw);
+        if (parsed && "object" == typeof parsed) {
+            parsed.defaultedContext = "page";
+            parsed.contextNote = 'No context given: defaulted to "page" (the active tab) because this Chromium session\'s MV3 background is a service worker whose CSP blocks eval. Pass context: "background" explicitly to target the worker (works on Firefox/MV2 builds).';
+            if (false === parsed.ok && /cannot access|chrome-extension:\/\/|chrome:\/\//i.test(JSON.stringify(parsed.error ?? ""))) parsed.hint = "The active tab is a browser or extension page that eval cannot reach. Navigate the dev browser to a regular web page, or pass url (match pattern) or tab to pick one; extension_dom_inspect with listTabs: true lists open tabs.";
+            return JSON.stringify(parsed);
+        }
+    } catch  {}
     return raw;
 }
 const storage_schema = {
@@ -3948,7 +4049,7 @@ async function navigateToUrl(projectPath, browser, url) {
         } catch  {}
     }
 }
-function unpackedExtensionId(distPath) {
+function open_unpackedExtensionId(distPath) {
     const digest = node_crypto.createHash("sha256").update(distPath).digest();
     let id = "";
     for(let i = 0; i < 16; i++){
@@ -3959,7 +4060,7 @@ function unpackedExtensionId(distPath) {
 }
 async function resolveExtensionId(projectPath, browser) {
     const distPath = readDistPath(projectPath, browser);
-    const computed = distPath ? unpackedExtensionId(distPath) : null;
+    const computed = distPath ? open_unpackedExtensionId(distPath) : null;
     const resolved = await resolveCdpPort(projectPath, browser);
     if (!resolved) return computed;
     const ids = new Set();
@@ -4283,9 +4384,27 @@ async function open_handler(args) {
     } catch  {}
     return raw;
 }
+const TARGET_ID_NOTE = "targetId is a CDP target id, NOT a chrome.tabs id: do not pass it as `tab`. Target a tab with `tabUrl` (URL substring) or `url`; if you need a numeric tab id, call extension_dom_inspect with listTabs: true.";
+function filterPageTargets(raw) {
+    return raw.filter((t)=>"page" === t.type && !String(t.url ?? "").startsWith("devtools://")).map((t)=>({
+            targetId: String(t.id),
+            type: String(t.type),
+            url: String(t.url ?? ""),
+            title: String(t.title ?? "")
+        }));
+}
+async function listPageTargets(port) {
+    return filterPageTargets(await CDPClient.discoverTargets(port));
+}
+function matchTargetsByUrl(targets, needle) {
+    const wanted = needle.toLowerCase();
+    const byUrl = targets.filter((t)=>t.url.toLowerCase().includes(wanted));
+    if (byUrl.length > 0) return byUrl;
+    return targets.filter((t)=>t.title.toLowerCase().includes(wanted));
+}
 const dom_inspect_schema = {
     name: "extension_dom_inspect",
-    description: "Inspect a page/content-script DOM via the agent bridge (CDP-free, localhost). Returns a structured snapshot (counts, extension roots, open shadow roots, optional capped HTML). Requires the dev session to be started with allowControl: true (extension_dev). For closed shadow roots or deep CDP inspection use extension_source_inspect. Wraps `extension inspect`.",
+    description: "Inspect a page/content-script DOM via the agent bridge (CDP-free, localhost). Returns a structured snapshot (counts, extension roots, open shadow roots, optional capped HTML). Target a tab by `tabUrl` (case-insensitive URL substring resolved against the browser's live page targets; zero or several matches return the candidates instead of guessing), by `url`, or by numeric `tab`. Discover what is open with listTargets: true (CDP targetIds) or listTabs: true (numeric chrome.tabs ids). Requires the dev session to be started with allowControl: true (extension_dev). For closed shadow roots or deep CDP inspection use extension_source_inspect. Wraps `extension inspect`.",
     inputSchema: {
         type: "object",
         properties: {
@@ -4301,6 +4420,15 @@ const dom_inspect_schema = {
                 type: "string",
                 description: "For content/page: selects the target tab by url (match pattern, then substring fallback). Preferred over `tab`."
             },
+            tabUrl: {
+                type: "string",
+                description: "Target the tab whose URL contains this substring (case-insensitive; titles are checked only when no url matches). Resolved against the live browser's CDP page targets BEFORE inspecting: exactly one match proceeds; zero or several matches return the candidate targets (targetId/url/title) so you can narrow, never a guess. Chromium sessions only; on Firefox use `url`/`tab`. Alternative to `url`."
+            },
+            listTargets: {
+                type: "boolean",
+                default: false,
+                description: "Enumerate the browser's CDP page targets as {targetId,url,title,type} and return, ignoring the other args. The discovery path for `tabUrl`. targetId is a CDP target id, NOT a numeric chrome.tabs id (for those use listTabs)."
+            },
             listTabs: {
                 type: "boolean",
                 default: false,
@@ -4361,8 +4489,55 @@ const dom_inspect_schema = {
         ]
     }
 };
+async function cdpPortOrError(projectPath, browser, feature) {
+    if (!isChromiumFamily(browser)) return {
+        error: JSON.stringify({
+            ok: false,
+            error: {
+                name: "Unsupported",
+                message: `${feature} reads the browser's CDP page targets, which ${browser} (Gecko) does not expose. Target the tab with \`url\` or \`tab\` instead, and discover tabs with listTabs: true (agent bridge, works on every browser).`
+            }
+        })
+    };
+    const resolved = await resolveCdpPort(projectPath, browser);
+    if (!resolved) return {
+        error: JSON.stringify({
+            ok: false,
+            error: {
+                name: "NoSession",
+                message: `No active dev session / CDP port for ${browser}, so ${feature} has no browser to ask. Start extension_dev and extension_wait for ready. ${CDP_PORT_MISSING_HINT}`
+            }
+        })
+    };
+    return {
+        port: resolved.port
+    };
+}
 async function dom_inspect_handler(args) {
     const withConsole = true === args.withConsole ? 50 : false === args.withConsole ? void 0 : args.withConsole;
+    if (args.listTargets) {
+        const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
+        const cdp = await cdpPortOrError(args.projectPath, browser, "listTargets");
+        if ("error" in cdp) return cdp.error;
+        try {
+            const targets = await listPageTargets(cdp.port);
+            return JSON.stringify({
+                ok: true,
+                browser,
+                targets,
+                note: TARGET_ID_NOTE
+            });
+        } catch (e) {
+            return JSON.stringify({
+                ok: false,
+                error: {
+                    name: "CdpError",
+                    message: `Could not list page targets: ${e instanceof Error ? e.message : String(e)}`
+                },
+                hint: "Confirm the session is ready (extension_wait), then retry. listTabs: true is the CDP-free alternative."
+            });
+        }
+    }
     if (args.listTabs) return runActVerb([
         "inspect",
         args.projectPath,
@@ -4374,19 +4549,78 @@ async function dom_inspect_handler(args) {
             String(args.timeout)
         ] : []
     ], args.projectPath, args.timeout);
+    let targetUrl = args.url;
+    let resolvedTarget = null;
+    if (args.tabUrl) {
+        if (null != args.tab || args.url) return JSON.stringify({
+            ok: false,
+            error: {
+                name: "BadRequest",
+                message: "Pass ONE tab selector: `tabUrl` (URL substring, resolved against live targets), `url` (engine-side match), or `tab` (numeric chrome.tabs id), not several."
+            }
+        });
+        const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
+        const cdp = await cdpPortOrError(args.projectPath, browser, "tabUrl");
+        if ("error" in cdp) return cdp.error;
+        let targets;
+        try {
+            targets = await listPageTargets(cdp.port);
+        } catch (e) {
+            return JSON.stringify({
+                ok: false,
+                error: {
+                    name: "CdpError",
+                    message: `Could not list page targets to resolve tabUrl: ${e instanceof Error ? e.message : String(e)}`
+                },
+                hint: "Confirm the session is ready (extension_wait), then retry, or target with `url`/`tab` instead."
+            });
+        }
+        const matches = matchTargetsByUrl(targets, args.tabUrl);
+        if (0 === matches.length) return JSON.stringify({
+            ok: false,
+            error: {
+                name: "NoMatchingTarget",
+                message: `No open page target's url (or title) contains "${args.tabUrl}" (case-insensitive).`
+            },
+            availableTargets: targets,
+            hint: `Pick one from availableTargets and retry with a \`tabUrl\` substring of its url, or open the page first (extension_open with \`url\`). ${TARGET_ID_NOTE}`
+        });
+        if (matches.length > 1) return JSON.stringify({
+            ok: false,
+            error: {
+                name: "AmbiguousTabUrl",
+                message: `${matches.length} page targets match "${args.tabUrl}"; refusing to guess which tab you mean.`
+            },
+            matchingTargets: matches,
+            hint: `Narrow \`tabUrl\` to a longer substring that matches exactly one url in matchingTargets. ${TARGET_ID_NOTE}`
+        });
+        resolvedTarget = matches[0];
+        targetUrl = resolvedTarget.url;
+    }
     const cli = [
         "inspect",
         args.projectPath
     ];
     if (null != args.tab) cli.push("--tab", String(args.tab));
-    if (args.url) cli.push("--url", args.url);
+    if (targetUrl) cli.push("--url", targetUrl);
     if (args.context) cli.push("--context", args.context);
     if (args.include?.length) cli.push("--include", args.include.join(","));
     if (null != args.maxBytes) cli.push("--max-bytes", String(args.maxBytes));
     if (null != withConsole) cli.push("--with-console", String(withConsole));
     cli.push("--browser", resolveSessionBrowser(args.projectPath, args.browser).browser);
     if (null != args.timeout) cli.push("--timeout", String(args.timeout));
-    return runActVerb(cli, args.projectPath, args.timeout);
+    const raw = await runActVerb(cli, args.projectPath, args.timeout);
+    if (!resolvedTarget) return raw;
+    try {
+        const parsed = JSON.parse(raw);
+        parsed.resolvedTarget = {
+            ...resolvedTarget,
+            matchedBy: "tabUrl"
+        };
+        return JSON.stringify(parsed);
+    } catch  {
+        return raw;
+    }
 }
 function credentialsPath() {
     if ("win32" === process.platform) {
@@ -4460,7 +4694,117 @@ function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
     if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
     return creds;
 }
+const REGISTRY_BASE_DEFAULT = "https://registry.extension.land";
+const CONSOLE_BASE = "https://console.extension.dev";
+function registryBase() {
+    const fromEnv = String(process.env.EXTENSION_DEV_REGISTRY_URL || "").trim();
+    return (fromEnv || REGISTRY_BASE_DEFAULT).replace(/\/+$/, "");
+}
+function resolveProjectRef(overrides) {
+    const workspace = String(overrides?.workspace || "").trim();
+    const project = String(overrides?.project || "").trim();
+    if (workspace && project) return {
+        workspace,
+        project
+    };
+    const creds = readCredentials();
+    const ws = workspace || String(creds?.workspaceSlug || "").trim();
+    const proj = project || String(creds?.projectSlug || "").trim();
+    if (!ws || !proj) return null;
+    return {
+        workspace: ws,
+        project: proj
+    };
+}
+function registryFileUrl(ref, file) {
+    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
+}
+function consoleProjectUrl(ref, page) {
+    if (!ref) return `${CONSOLE_BASE}`;
+    return `${CONSOLE_BASE}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/${page}`;
+}
+async function fetchRegistryJson(url, fetchImpl = fetch) {
+    let res;
+    try {
+        res = await fetchImpl(url);
+    } catch (err) {
+        return {
+            ok: false,
+            message: `Could not reach ${url}: ${err?.message || err}`
+        };
+    }
+    if (!res.ok) return {
+        ok: false,
+        status: res.status,
+        message: `${url} returned ${res.status}`
+    };
+    try {
+        const text = await res.text();
+        return {
+            ok: true,
+            json: JSON.parse(text)
+        };
+    } catch  {
+        return {
+            ok: false,
+            message: `${url} did not return valid JSON`
+        };
+    }
+}
+function parseChannels(json) {
+    if (!json || "object" != typeof json || Array.isArray(json)) return [];
+    const out = [];
+    for (const [channel, raw] of Object.entries(json)){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const description = "string" == typeof row.description ? row.description : void 0;
+        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
+        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
+        const entry = {
+            channel,
+            sha: String(row.sha ?? "")
+        };
+        if (row.buildId) entry.buildId = String(row.buildId);
+        if (row.version) entry.version = String(row.version);
+        const promotedAt = promotedAtField || fromDescription;
+        if (promotedAt) entry.promotedAt = promotedAt;
+        if (description) entry.description = description;
+        out.push(entry);
+    }
+    return out;
+}
+function parseBuildIndex(json) {
+    const items = json?.items;
+    if (!Array.isArray(items)) return [];
+    const out = [];
+    for (const raw of items){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
+        if (!sha) continue;
+        const entry = {
+            sha
+        };
+        if (row.commit) entry.commit = String(row.commit);
+        if (row.channel) entry.channel = String(row.channel);
+        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
+        if (row.status) entry.status = String(row.status);
+        if (row.version) entry.version = String(row.version);
+        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
+        if (row.timestamp) entry.timestamp = String(row.timestamp);
+        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
+        out.push(entry);
+    }
+    return out;
+}
 const DEFAULT_API = "https://www.extension.dev";
+function tokenTtlNote(workspaceSlug, projectSlug) {
+    const tokensUrl = workspaceSlug && projectSlug ? consoleProjectUrl({
+        workspace: workspaceSlug,
+        project: projectSlug
+    }, "settings/access-tokens") : CONSOLE_BASE;
+    return `extension.dev CLI tokens live at most 7 days (server-enforced). CI pipelines must re-mint before expiry on the console's Access tokens page: ${tokensUrl}`;
+}
 function resolveApiBase(api) {
     return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
 }
@@ -4625,109 +4969,6 @@ async function publish(options = {}) {
         data
     };
 }
-const REGISTRY_BASE_DEFAULT = "https://registry.extension.land";
-const CONSOLE_BASE = "https://console.extension.dev";
-function registryBase() {
-    const fromEnv = String(process.env.EXTENSION_DEV_REGISTRY_URL || "").trim();
-    return (fromEnv || REGISTRY_BASE_DEFAULT).replace(/\/+$/, "");
-}
-function resolveProjectRef(overrides) {
-    const workspace = String(overrides?.workspace || "").trim();
-    const project = String(overrides?.project || "").trim();
-    if (workspace && project) return {
-        workspace,
-        project
-    };
-    const creds = readCredentials();
-    const ws = workspace || String(creds?.workspaceSlug || "").trim();
-    const proj = project || String(creds?.projectSlug || "").trim();
-    if (!ws || !proj) return null;
-    return {
-        workspace: ws,
-        project: proj
-    };
-}
-function registryFileUrl(ref, file) {
-    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
-}
-function consoleProjectUrl(ref, page) {
-    if (!ref) return `${CONSOLE_BASE}`;
-    return `${CONSOLE_BASE}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/${page}`;
-}
-async function fetchRegistryJson(url, fetchImpl = fetch) {
-    let res;
-    try {
-        res = await fetchImpl(url);
-    } catch (err) {
-        return {
-            ok: false,
-            message: `Could not reach ${url}: ${err?.message || err}`
-        };
-    }
-    if (!res.ok) return {
-        ok: false,
-        status: res.status,
-        message: `${url} returned ${res.status}`
-    };
-    try {
-        const text = await res.text();
-        return {
-            ok: true,
-            json: JSON.parse(text)
-        };
-    } catch  {
-        return {
-            ok: false,
-            message: `${url} did not return valid JSON`
-        };
-    }
-}
-function parseChannels(json) {
-    if (!json || "object" != typeof json || Array.isArray(json)) return [];
-    const out = [];
-    for (const [channel, raw] of Object.entries(json)){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const description = "string" == typeof row.description ? row.description : void 0;
-        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
-        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
-        const entry = {
-            channel,
-            sha: String(row.sha ?? "")
-        };
-        if (row.buildId) entry.buildId = String(row.buildId);
-        if (row.version) entry.version = String(row.version);
-        const promotedAt = promotedAtField || fromDescription;
-        if (promotedAt) entry.promotedAt = promotedAt;
-        if (description) entry.description = description;
-        out.push(entry);
-    }
-    return out;
-}
-function parseBuildIndex(json) {
-    const items = json?.items;
-    if (!Array.isArray(items)) return [];
-    const out = [];
-    for (const raw of items){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
-        if (!sha) continue;
-        const entry = {
-            sha
-        };
-        if (row.commit) entry.commit = String(row.commit);
-        if (row.channel) entry.channel = String(row.channel);
-        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
-        if (row.status) entry.status = String(row.status);
-        if (row.version) entry.version = String(row.version);
-        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
-        if (row.timestamp) entry.timestamp = String(row.timestamp);
-        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
-        out.push(entry);
-    }
-    return out;
-}
 const publish_schema = {
     name: "extension_publish",
     description: "Publish the project your stored token is scoped to (from extension_login, or EXTENSION_DEV_TOKEN) to extension.dev and return its shareable URL. The publish target is the token's project -- there is no projectPath, the local files are not uploaded. For a PUBLIC project the URL is the canonical public page and ttlHours does not apply; for a PRIVATE project it is a fresh time-limited share link (?share=) whose lifetime is ttlHours. Posts to the platform's CLI publish endpoint. Besides extension_login this is the only tool that talks to the hosted platform.",
@@ -4805,7 +5046,7 @@ async function publish_handler(args) {
 const release_promote_DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
-    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
+    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
     inputSchema: {
         type: "object",
         properties: {
@@ -4858,7 +5099,7 @@ function release_promote_fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry), or run extension_login.");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
     if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
@@ -5010,7 +5251,7 @@ function storeMdWarnings(browsers, cwd) {
         content = node_fs.readFileSync(node_path.join(cwd, "STORE.md"), "utf8");
     } catch  {
         return [
-            "No STORE.md found in the project root. Reviewer notes (Firefox) and certification notes (Edge) will not accompany the submission. See the extension-dev skill's store-md reference."
+            "No STORE.md found in the current working directory. Platform submissions read STORE.md from the project's source repository, so this may not apply here; make sure STORE.md exists there for Firefox reviewer notes and Edge certification notes. See the extension-dev skill's store-md reference."
         ];
     }
     const hasField = (section, field)=>{
@@ -5029,7 +5270,7 @@ function storeMdWarnings(browsers, cwd) {
 }
 const deploy_schema = {
     name: "extension_deploy",
-    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight: verifies auth, the project, that the build exists, and the store workflow - dispatches nothing); pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN); store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha. Posts to the platform's CLI store-submission endpoint.",
+    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight - dispatches nothing): the platform side verifies auth, the project, that the build exists, and the store workflow, and this tool then adds the per-store verdict from each store's public credential-health record; trust the per-store rows in the result over the platform's bare preflight line, which does not check store health. Pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN; tokens live at most 7 days, so CI must re-mint from the console's Access tokens page). Store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha (extension_release_list lists valid shas); after a real submission, extension_store_status reads the recorded outcome and review state. Posts to the platform's CLI store-submission endpoint.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5085,7 +5326,7 @@ function deploy_fail(name, message) {
 }
 async function deploy_handler(args) {
     const token = resolveToken();
-    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens).");
+    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry).");
     const browsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim().toLowerCase()).filter(Boolean);
     if (0 === browsers.length) return deploy_fail("DeployInputError", 'browsers is required (e.g. ["chrome","firefox","edge"]).');
     const buildSha = String(args.buildSha || "").trim();
@@ -5203,9 +5444,214 @@ async function deploy_handler(args) {
         if ("string" == typeof data?.message) result.platformMessage = data.message;
         result.message = summaryParts.join(" ");
     }
+    if (!dryRun) result.statusNote = "Track this submission with extension_store_status: it reads the recorded outcome, per-store credential health, and review state from the public registry.";
     if (warnings.length > 0) result.warnings = warnings;
     return JSON.stringify(result);
 }
+const KNOWN_STORES = [
+    "chrome",
+    "firefox",
+    "edge",
+    "safari"
+];
+const store_status_schema = {
+    name: "extension_store_status",
+    description: "Report the project's browser-store state after an extension_deploy submission: per store (chrome, firefox, edge, safari) whether it is configured, its latest credential health check, the last recorded submission (version, status, store URL, submitted-at), and the latest review status. Reads the project's public registry (registry.extension.land: stores/health.json, stores/status.json, stores/submissions.json) - read-only, dispatches nothing, no auth needed for public projects. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another public project. Registry state can lag the store dashboards by up to a polling interval.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            workspace: {
+                type: "string",
+                description: "Workspace slug override (defaults to the stored login's workspace)."
+            },
+            project: {
+                type: "string",
+                description: "Project slug override (defaults to the stored login's project)."
+            }
+        },
+        required: []
+    }
+};
+function isPlainObject(value) {
+    return Boolean(value) && "object" == typeof value && !Array.isArray(value);
+}
+function str(value) {
+    const text = String(value ?? "").trim();
+    return text || void 0;
+}
+function submissionView(row) {
+    const view = {};
+    const version = str(row.version);
+    const status = str(row.status);
+    const storeUrl = str(row.storeUrl);
+    const submittedAt = str(row.submittedAt) || str(row.timestamp);
+    const channel = str(row.channel);
+    const buildSha = str(row.buildSha) || str(row.buildId);
+    const storeSubmissionId = str(row.storeSubmissionId);
+    const failureReason = str(row.failureReason);
+    if (version) view.version = version;
+    if (status) view.status = status;
+    if (storeUrl) view.storeUrl = storeUrl;
+    if (submittedAt) view.submittedAt = submittedAt;
+    if (channel) view.channel = channel;
+    if (buildSha) view.buildSha = buildSha;
+    if (storeSubmissionId) view.storeSubmissionId = storeSubmissionId;
+    if (failureReason) view.failureReason = failureReason;
+    return view;
+}
+function latestSubmissionsByStore(json) {
+    const list = json?.submissions;
+    const out = {};
+    for (const raw of Array.isArray(list) ? list : []){
+        if (!isPlainObject(raw)) continue;
+        const store = str(raw.store);
+        if (!store) continue;
+        const at = Date.parse(String(raw.submittedAt || raw.updatedAt || ""));
+        const stamp = Number.isFinite(at) ? at : 0;
+        if (!out[store] || stamp >= out[store].at) out[store] = {
+            at: stamp,
+            view: submissionView(raw)
+        };
+    }
+    const flat = {};
+    for (const [store, entry] of Object.entries(out))flat[store] = entry.view;
+    return flat;
+}
+function normalizeStoresStatus(json) {
+    const base = isPlainObject(json) ? json : {};
+    const out = {
+        reviews: {}
+    };
+    if (isPlainObject(base.lastSubmission)) out.lastSubmission = base.lastSubmission;
+    if (isPlainObject(base.lastOverride)) out.lastOverride = base.lastOverride;
+    if (isPlainObject(base.reviews)) {
+        for (const [store, raw] of Object.entries(base.reviews))if (isPlainObject(raw)) out.reviews[store] = {
+            status: str(raw.status),
+            version: str(raw.version),
+            buildId: str(raw.buildId),
+            checkedAt: str(raw.checkedAt)
+        };
+    }
+    const lastPoll = isPlainObject(base.lastPoll) ? base.lastPoll : null;
+    const looksLikeLegacyPoll = !lastPoll && ("store_status" === base.kind || Array.isArray(base.updates));
+    if (lastPoll) out.lastPollAt = str(lastPoll.timestamp);
+    else if (looksLikeLegacyPoll) {
+        out.lastPollAt = str(base.updatedAt);
+        for (const raw of Array.isArray(base.updates) ? base.updates : []){
+            if (!isPlainObject(raw)) continue;
+            const store = str(raw.store);
+            if (store && !out.reviews[store]) out.reviews[store] = {
+                status: str(raw.status),
+                version: str(raw.version),
+                buildId: str(raw.buildId),
+                checkedAt: str(base.updatedAt)
+            };
+        }
+    }
+    return out;
+}
+function store_status_fail(name, message, extra) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        },
+        ...extra ?? {}
+    });
+}
+async function store_status_handler(args) {
+    const ref = resolveProjectRef(args);
+    if (!ref) return store_status_fail("StoreStatusInputError", "No project to inspect. Run extension_login (the stored login names the project), or pass workspace + project explicitly.");
+    const healthUrl = registryFileUrl(ref, "stores/health.json");
+    const statusUrl = registryFileUrl(ref, "stores/status.json");
+    const submissionsUrl = registryFileUrl(ref, "stores/submissions.json");
+    const consoleStoresUrl = consoleProjectUrl(ref, "stores");
+    const [healthRes, statusRes, submissionsRes] = await Promise.all([
+        fetchRegistryJson(healthUrl),
+        fetchRegistryJson(statusUrl),
+        fetchRegistryJson(submissionsUrl)
+    ]);
+    if (!healthRes.ok && !statusRes.ok && !submissionsRes.ok) return store_status_fail("StoreStatusNotFound", `No store data on the registry for ${ref.workspace}/${ref.project} (${healthUrl} returned ${healthRes.status ?? "no response"}). The project may have no stores configured yet, be private (private registry data needs a share token), or the workspace/project slugs may be wrong. Configure stores at ${consoleStoresUrl}/new; the console Stores page is the authoritative view: ${consoleStoresUrl}`, {
+        workspace: ref.workspace,
+        project: ref.project,
+        registryUrls: {
+            health: healthUrl,
+            status: statusUrl,
+            submissions: submissionsUrl
+        },
+        consoleStoresUrl
+    });
+    const healthStores = healthRes.ok ? isPlainObject(healthRes.json?.stores) ? healthRes.json.stores ?? null : null : null;
+    const status = normalizeStoresStatus(statusRes.ok ? statusRes.json : null);
+    const submissionsByStore = submissionsRes.ok ? latestSubmissionsByStore(submissionsRes.json) : {};
+    const statusLastStore = str(status.lastSubmission?.store);
+    if (statusLastStore && !submissionsByStore[statusLastStore] && status.lastSubmission) submissionsByStore[statusLastStore] = submissionView(status.lastSubmission);
+    const stores = [
+        ...KNOWN_STORES,
+        ...Object.keys({
+            ...healthStores,
+            ...submissionsByStore,
+            ...status.reviews
+        }).filter((s)=>!KNOWN_STORES.includes(s))
+    ];
+    const rows = stores.map((store)=>{
+        const healthRow = healthStores?.[store];
+        const configured = healthStores ? Boolean(healthRow) : "unknown";
+        const row = {
+            store,
+            configured
+        };
+        if (healthRow) row.health = {
+            ok: true === healthRow.ok,
+            checkedAt: str(healthRow.checkedAt),
+            message: str(healthRow.message)
+        };
+        const submission = submissionsByStore[store];
+        if (submission && Object.keys(submission).length > 0) row.lastSubmission = submission;
+        const review = status.reviews[store];
+        if (review && Object.values(review).some(Boolean)) row.review = review;
+        return row;
+    });
+    const summaryParts = rows.map((row)=>{
+        const store = String(row.store);
+        const health = row.health;
+        const submission = row.lastSubmission;
+        const review = row.review;
+        let head;
+        head = "unknown" === row.configured ? `${store}: configuration unknown (stores/health.json is unreadable)` : false === row.configured ? `${store}: not configured (add it at ${consoleStoresUrl}/new)` : health && !health.ok ? `${store}: configured but its credentials FAILED the last health check (${health.message || "no reason recorded"}) - fix them at ${consoleStoresUrl}/${store}` : `${store}: configured, credentials healthy`;
+        const tail = [];
+        if (submission) {
+            tail.push(`last submission${submission.version ? ` v${submission.version}` : ""} ${submission.status || "recorded"}${submission.submittedAt ? ` at ${submission.submittedAt}` : ""}${submission.failureReason ? ` (${submission.failureReason})` : ""}`);
+            if (submission.storeUrl) tail.push(`listing ${submission.storeUrl}`);
+        } else if (true === row.configured) tail.push("no submissions recorded");
+        if (review?.status) tail.push(`review ${review.status}${review.checkedAt ? ` (checked ${review.checkedAt})` : ""}`);
+        return tail.length > 0 ? `${head}; ${tail.join("; ")}` : head;
+    });
+    const result = {
+        ok: true,
+        workspace: ref.workspace,
+        project: ref.project,
+        stores: rows,
+        ...status.lastSubmission ? {
+            lastSubmission: status.lastSubmission
+        } : {},
+        ...status.lastPollAt ? {
+            lastPollAt: status.lastPollAt
+        } : {},
+        registryUrls: {
+            health: healthUrl,
+            status: statusUrl,
+            submissions: submissionsUrl
+        },
+        consoleStoresUrl,
+        message: `${summaryParts.join(". ")}. This is the registry's recorded state (submissions and the review poller write it); the store dashboards are authoritative and may be ahead of it.`
+    };
+    if (!healthRes.ok) result.healthUnavailable = `stores/health.json unreadable: ${healthRes.message}`;
+    if (!statusRes.ok) result.statusUnavailable = `stores/status.json unreadable: ${statusRes.message}`;
+    if (!submissionsRes.ok && 404 !== submissionsRes.status) result.submissionsUnavailable = `stores/submissions.json unreadable: ${submissionsRes.message}`;
+    return JSON.stringify(result);
+}
 function doctor_readReadyContract(projectPath, browser) {
     try {
         const raw = node_fs.readFileSync(node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json"), "utf8");
@@ -5961,7 +6407,7 @@ async function pollDeviceToken(args) {
 }
 const login_schema = {
     name: "extension_login",
-    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
+    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5995,13 +6441,15 @@ function login_fail(name, message) {
     });
 }
 function success(creds) {
+    const expiresAt = creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null;
     return JSON.stringify({
         ok: true,
         status: "logged-in",
         workspaceSlug: creds.workspaceSlug,
         projectSlug: creds.projectSlug,
-        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
-        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token.`
+        expiresAt,
+        tokenTtlNote: tokenTtlNote(creds.workspaceSlug, creds.projectSlug),
+        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token. The token expires ${expiresAt ?? "within 7 days"}: extension.dev CLI tokens live at most 7 days, so CI must re-mint before then (console: project settings -> Access tokens).`
     });
 }
 function login_pending(start) {
@@ -6017,6 +6465,7 @@ function login_pending(start) {
             verificationUriComplete: complete
         } : {},
         deviceCode: start.deviceCode,
+        tokenTtlNote: "Once authorized, the minted token lives at most 7 days (server-enforced); CI must re-mint before expiry (console: project settings -> Access tokens).",
         message
     });
 }
@@ -6026,6 +6475,7 @@ function resumePending(deviceCode, verificationUri) {
         status: "authorization_pending",
         verificationUri,
         deviceCode,
+        tokenTtlNote: "Once authorized, the minted token lives at most 7 days (server-enforced); CI must re-mint before expiry (console: project settings -> Access tokens).",
         message: `Still waiting for authorization. The one-click link and code from the previous response are still valid: open that link (or enter the code at ${verificationUri}), then call extension_login again with this same deviceCode (and the same project).`
     });
 }
@@ -6135,7 +6585,7 @@ async function login_handler(args) {
 }
 const whoami_schema = {
     name: "extension_whoami",
-    description: "Report the identity carried by the locally stored extension.dev token that extension_login minted (workspace/project scoped), plus its expiry, without revealing the token. The identity comes from that stored token alone; it does not change with the current working directory or whichever project folder you are in. Returns logged-out status when no credentials are stored.",
+    description: "Report the identity carried by the locally stored extension.dev token that extension_login minted (workspace/project scoped), plus its expiry, without revealing the token. The identity comes from that stored token alone; it does not change with the current working directory or whichever project folder you are in. The result records where the login was minted (apiRecordedAtLogin) without asserting a platform base URL: authenticated tools target their own api argument, EXTENSION_DEV_API_URL, or the production default. Returns logged-out status when no credentials are stored.",
     inputSchema: {
         type: "object",
         properties: {}
@@ -6150,17 +6600,32 @@ async function whoami_handler() {
     });
     const now = Math.floor(Date.now() / 1000);
     const expired = Boolean(creds.expiresAt && creds.expiresAt <= now);
+    const recordedApi = String(creds.api || "").trim();
+    const effectiveDefaultApi = resolveApiBase();
+    const apiDiverges = Boolean(recordedApi) && recordedApi !== effectiveDefaultApi;
+    const envTokenSet = Boolean(String(process.env.EXTENSION_DEV_TOKEN || "").trim());
+    const messageParts = [];
+    messageParts.push(expired ? "The stored token has expired. Run extension_login to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_login stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`);
+    if (apiDiverges) messageParts.push(`This login was minted via ${recordedApi}, but authenticated tools do not read that recorded value: they target ${effectiveDefaultApi} unless given an api argument.`);
+    if (envTokenSet) messageParts.push("EXTENSION_DEV_TOKEN is set and takes precedence over this stored login for authenticated tools; this report describes only the stored login.");
     return JSON.stringify({
         ok: true,
         status: expired ? "expired" : "logged-in",
         workspaceSlug: creds.workspaceSlug,
         projectSlug: creds.projectSlug,
-        api: creds.api,
+        ...recordedApi ? {
+            apiRecordedAtLogin: recordedApi
+        } : {},
+        apiDefault: effectiveDefaultApi,
         provider: creds.provider ?? "github",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
-        message: expired ? "The stored token has expired. Run extension_login to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_login stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`
+        ...envTokenSet ? {
+            envTokenOverride: true
+        } : {},
+        tokenTtlNote: tokenTtlNote(creds.workspaceSlug, creds.projectSlug),
+        message: messageParts.join(" ")
     });
 }
 const logout_schema = {
@@ -6847,6 +7312,7 @@ const tools = [
     release_list_namespaceObject,
     release_promote_namespaceObject,
     deploy_namespaceObject,
+    store_status_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
     login_namespaceObject,