@extension.dev/mcp 5.5.0 → 5.5.2

package/.claude-plugin/marketplace.json

@@ -2,7 +2,7 @@
   "name": "extensiondev-mcp",
   "owner": {
     "name": "Cezar Augusto",
-    "email": "boss@cezaraugusto.net",
+    "email": "hello@extension.dev",
     "url": "https://extension.dev"
   },
   "plugins": [
@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "5.5.0",
+      "version": "5.5.2",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "5.5.0",
+  "version": "5.5.2",
   "author": {
     "name": "Cezar Augusto",
-    "email": "boss@cezaraugusto.net",
+    "email": "hello@extension.dev",
     "url": "https://cezaraugusto.com"
   },
   "homepage": "https://github.com/extensiondev/mcp",

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 5.5.2
+
+Honest browser support wording ahead of the Safari lane landing.
+
+### Changed
+
+- The package description and README now say Safari is coming next
+  instead of listing it alongside the browsers that are store-ready
+  today. Chrome, Edge, Firefox, and every Chromium- or Gecko-based
+  browser remain fully supported; nothing changes functionally.
+
+## 5.5.1
+
+The store journey stops being write-only after submit, and the token
+surfaces start telling the truth about lifetimes and API bases.
+
+### Added
+
+- `extension_store_status` (tool 33): the post-submit sibling of
+  `extension_deploy`. Reads the project's public registry
+  (`stores/health.json`, `stores/status.json`, `stores/submissions.json`)
+  and reports per store whether it is configured, its latest credential
+  health check, the last recorded submission (version, status, store
+  URL, submitted-at), and the latest review status. Normalizes both the
+  v3 merged status schema and legacy v2 poller documents. Defaults to
+  the logged-in project; accepts `workspace` + `project` overrides like
+  `extension_release_list`. A configured store with a failing credential
+  reports `configured: true` with `health.ok: false` (rotate the
+  credential, deep-linked), never "not configured".
+
+### Fixed
+
+- `extension_whoami` no longer asserts a bare `api` field that could
+  misstate the platform base (a login minted via a localhost dev server
+  kept reporting that dead base for a token that authenticates against
+  production). The recorded login base is now labeled
+  `apiRecordedAtLogin`, `apiDefault` reports what authenticated tools
+  actually target, the message flags any divergence, and a set
+  `EXTENSION_DEV_TOKEN` is disclosed as outranking the stored login.
+- The 7-day token TTL (server-enforced) is now stated everywhere a CI
+  author looks: `extension_login`'s description and success/pending
+  results, `extension_whoami`'s `tokenTtlNote` (with the deep console
+  Access tokens URL), and the auth prose of `extension_deploy` and
+  `extension_release_promote` (`extension_publish`'s auth envelope is
+  byte-frozen and unchanged).
+- `extension_deploy`'s description says the per-store rows in the result
+  are the verdict to trust: the platform's bare preflight line does not
+  check store health. A real (non-dry-run) submission now points at
+  `extension_store_status` for tracking.
+
 ## 5.5.0
 
 The debug surfaces learn to point at things: tabs are targetable by
@@ -644,7 +694,7 @@ this release graduates that line to stable and becomes `latest`.
 
 # @extension.dev/mcp, Changelog
 
-## Unreleased, agent-bridge tools
+## 5.5.1, agent-bridge tools
 
 Adds the MCP client surface for the Extension.js **agent bridge** (dev-time
 observe + act + inspect). All new tools shell out to the `extension` CLI verbs
@@ -679,7 +729,7 @@ Internal: `lib/act` (CLI shell-out helper), `lib/exec.runExtensionCli` (capture)
 `lib/cdp.getClosedShadowRoots`. Test infra aligned to the workspace vitest
 catalog.
 
-## Unreleased, login (auth tools)
+## 5.5.1, login (auth tools)
 
 Adds the missing `login` flow so `extension_publish` no longer requires the user
 to mint and export `EXTENSION_DEV_TOKEN` by hand. Auth stays auth-AWARE: the

package/README.md

@@ -7,7 +7,7 @@
 
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 30 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 33 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -26,7 +26,7 @@ Extensions fail silently: content scripts that never inject, panels that never o
 These tools give agents eyes on the live browser, so they debug from evidence instead of guessing:
 
 - **Scaffold** from the 60+ template catalog behind [templates.extension.dev](https://templates.extension.dev), or add a popup, sidebar, or content script to an existing project
-- **Run** the dev server with HMR in Chrome, Edge, Firefox, Safari, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary, no build config
+- **Run** the dev server with HMR in Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary (Safari coming next), no build config
 - **See** the live DOM, unified logs from every extension context, `chrome.storage` contents, and the loaded-extension list
 - **Act**: evaluate code in any context, trigger the action button and commands, reload the extension, replay events
 - **Ship**: validate the manifest cross-browser, build for production, publish a shareable preview, and promote builds to release channels headlessly
@@ -127,7 +127,7 @@ Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension`
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
 
 ## The extension.dev stack