@extension.dev/mcp 5.5.0 → 5.5.2

package/dist/module.js

@@ -193,6 +193,14 @@ __webpack_require__.d(storage_namespaceObject, {
     handler: ()=>storage_handler,
     schema: ()=>storage_schema
 });
+var store_status_namespaceObject = {};
+__webpack_require__.r(store_status_namespaceObject);
+__webpack_require__.d(store_status_namespaceObject, {
+    handler: ()=>store_status_handler,
+    latestSubmissionsByStore: ()=>latestSubmissionsByStore,
+    normalizeStoresStatus: ()=>normalizeStoresStatus,
+    schema: ()=>store_status_schema
+});
 var uninstall_browser_namespaceObject = {};
 __webpack_require__.r(uninstall_browser_namespaceObject);
 __webpack_require__.d(uninstall_browser_namespaceObject, {
@@ -211,7 +219,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"5.5.0","El":{"OP":"^4.0.13"}}');
+var package_namespaceObject = JSON.parse('{"rE":"5.5.2","El":{"OP":"^4.0.13"}}');
 function scaffoldEnginePin(projectPath) {
     try {
         const pkg = JSON.parse(node_fs.readFileSync(node_path.join(projectPath, "package.json"), "utf8"));
@@ -3004,9 +3012,178 @@ function isCdpEndpoint(port) {
         });
     });
 }
+function toMcpSpeak(text) {
+    return text.replace(/`?extension dev(?: [^\s`]*)? --browser[= ]([\w-]+) --allow-control`?/g, 'extension_dev with { browser: "$1", allowControl: true }').replace(/--allow-control/g, "allowControl: true (extension_dev)").replace(/--allow-eval/g, "allowEval: true (extension_dev)").replace(/Use --context page --tab <id>/g, 'Use context: "page" (targets the active tab; pass url or tab to pick another)').replace(/--context[= ](background|popup|options|sidebar|devtools|newtab|history|bookmarks|content|page)\b/g, 'context: "$1"').replace(/--tab[= ](\d+|<[\w-]+>)/g, "tab: $1").replace(/--url[= ]"([^"]+)"/g, 'url: "$1"').replace(/--url[= ](<[\w-]+>|\S*(?:\/\/|\*)\S*)/g, 'url: "$1"').replace(/--browser[= ]([\w]+-based|chrome|chromium|edge|brave|opera|vivaldi|yandex|firefox|waterfox|librewolf|safari)\b/g, 'browser: "$1"').replace(/--timeout[= ](\d+)/g, "timeout: $1").replace(/`extension dev`/g, "extension_dev").replace(/\bextension dev\b/g, "extension_dev").replace(/--tab\b/g, "`tab`").replace(/--url\b/g, "`url`").replace(/--context\b/g, "`context`").replace(/--browser\b/g, "`browser`").replace(/--timeout\b/g, "`timeout`");
+}
+function withSessionContext(message, projectPath) {
+    const isControlError = /no active control channel|control channel refused|\b1006\b|no executor connected|is the session started with allowControl/i.test(message);
+    if (!isControlError) return message;
+    const dead = deadReadySession(projectPath);
+    if (dead) return `${message}\nLikely cause: the dev server has exited, ${dead.browser} ready.json still says ready but its pid ${dead.pid} is dead. Restart with extension_dev (this is not an allowControl problem); extension_doctor confirms.`;
+    const running = knownSessionBrowsers(projectPath);
+    if (0 === running.length) return message;
+    return `${message} Active session browser(s) for this project: ${running.join(", ")}, pass that as \`browser\`, or restart it via extension_dev with allowControl: true if the control channel is off.`;
+}
+function translateFrame(frame, projectPath) {
+    if (!frame || false !== frame.ok) return frame;
+    if (frame.error && "string" == typeof frame.error.message) frame.error.message = withSessionContext(toMcpSpeak(frame.error.message), projectPath);
+    if ("string" == typeof frame.error?.hint) frame.error.hint = toMcpSpeak(frame.error.hint);
+    if ("string" == typeof frame.hint) frame.hint = toMcpSpeak(frame.hint);
+    return frame;
+}
+async function runActVerb(args, projectPath, timeoutMs) {
+    const { code, stdout, stderr } = await runExtensionCli([
+        ...args,
+        "--output",
+        "json"
+    ], {
+        cwd: projectPath,
+        timeoutMs
+    });
+    const out = stdout.trim();
+    if (out) try {
+        const frame = JSON.parse(out);
+        if (frame && false === frame.ok) return JSON.stringify(translateFrame(frame, projectPath));
+        return out;
+    } catch  {}
+    const message = stderr.trim() || `extension exited with code ${code}`;
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name: "CliError",
+            message: withSessionContext(toMcpSpeak(message), projectPath)
+        }
+    });
+}
+function commonFlags(args) {
+    const flags = [];
+    if (args.context) flags.push("--context", args.context);
+    if (args.url) flags.push("--url", args.url);
+    if (null != args.tab) flags.push("--tab", String(args.tab));
+    if (args.browser) flags.push("--browser", args.browser);
+    if (null != args.timeout) flags.push("--timeout", String(args.timeout));
+    return flags;
+}
+async function listBridgeTabs(projectPath, browser, timeout) {
+    const raw = await runActVerb([
+        "inspect",
+        projectPath,
+        "--list-tabs",
+        "--browser",
+        browser,
+        ...null != timeout ? [
+            "--timeout",
+            String(timeout)
+        ] : []
+    ], projectPath, timeout);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return {
+            error: raw
+        };
+    }
+    if (parsed?.ok === false) return {
+        error: raw
+    };
+    const list = Array.isArray(parsed?.tabs) ? parsed.tabs : Array.isArray(parsed?.value) ? parsed.value : Array.isArray(parsed?.value?.tabs) ? parsed.value.tabs : null;
+    if (!list) return {
+        error: raw
+    };
+    return {
+        tabs: list.map((t)=>({
+                tabId: "number" == typeof t?.tabId ? t.tabId : "number" == typeof t?.id ? t.id : null,
+                url: String(t?.url ?? ""),
+                title: String(t?.title ?? "")
+            }))
+    };
+}
+function matchTabsByUrl(tabs, needle) {
+    const wanted = needle.toLowerCase();
+    const byUrl = tabs.filter((t)=>t.url.toLowerCase().includes(wanted));
+    if (byUrl.length > 0) return byUrl;
+    return tabs.filter((t)=>t.title.toLowerCase().includes(wanted));
+}
+async function pollForBridgeTab(projectPath, browser, url, budgetMs) {
+    const deadline = Date.now() + budgetMs;
+    const wanted = url.replace(/#.*$/, "");
+    for(;;){
+        const listed = await listBridgeTabs(projectPath, browser);
+        if ("tabs" in listed) {
+            for (const t of listed.tabs)if (t.url === wanted || t.url.startsWith(wanted)) return t;
+        }
+        if (Date.now() >= deadline) return null;
+        await new Promise((r)=>setTimeout(r, 250));
+    }
+}
+async function navigateToUrlViaBridge(projectPath, browser, url, timeout) {
+    const expression = `(async () => { const api = typeof browser !== "undefined" ? browser : chrome; const tabs = await api.tabs.query({ active: true, currentWindow: true }); const active = tabs && tabs[0]; const tab = active && active.id != null ? await api.tabs.update(active.id, { url: ${JSON.stringify(url)} }) : await api.tabs.create({ url: ${JSON.stringify(url)} }); return { tabId: tab && tab.id != null ? tab.id : null }; })()`;
+    const raw = await runActVerb([
+        "eval",
+        expression,
+        projectPath,
+        "--context",
+        "background",
+        "--browser",
+        browser,
+        ...null != timeout ? [
+            "--timeout",
+            String(timeout)
+        ] : []
+    ], projectPath, timeout);
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed?.ok === false) {
+            if (!parsed.hint) parsed.hint = "On this browser family URL navigation rides the agent bridge (a background eval of tabs.update), so the dev session must be started with allowEval: true (extension_dev).";
+            return JSON.stringify(parsed);
+        }
+    } catch  {
+        return raw;
+    }
+    const settled = await pollForBridgeTab(projectPath, browser, url, null != timeout ? Math.min(timeout, 6000) : 6000);
+    if (!settled) return JSON.stringify({
+        ok: false,
+        error: {
+            name: "NavigateFailed",
+            message: `Navigation to ${url} did not produce a tab reporting that URL. The URL may not exist, or the browser refused the navigation (Firefox rejects privileged about:/chrome: URLs and other extensions' moz-extension: pages).`
+        },
+        hint: "Confirm the URL, or discover open tabs with extension_dom_inspect listTabs: true. For an extension page, the path must match the BUILT manifest."
+    });
+    return JSON.stringify({
+        ok: true,
+        navigated: url,
+        tab: {
+            tabId: settled.tabId,
+            url: settled.url,
+            title: settled.title
+        },
+        hint: "Inspect it with extension_dom_inspect or extension_eval using url or this numeric tab id (context: 'page'/'content')."
+    });
+}
+async function resolveBridgeBaseUrl(projectPath, browser, timeout) {
+    const raw = await runActVerb([
+        "eval",
+        '(typeof browser !== "undefined" ? browser : chrome).runtime.getURL("")',
+        projectPath,
+        "--context",
+        "background",
+        "--browser",
+        browser,
+        ...null != timeout ? [
+            "--timeout",
+            String(timeout)
+        ] : []
+    ], projectPath, timeout);
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed?.ok && "string" == typeof parsed.value && parsed.value) return parsed.value.endsWith("/") ? parsed.value : `${parsed.value}/`;
+    } catch  {}
+    return null;
+}
 const source_inspect_schema = {
     name: "extension_source_inspect",
-    description: "Inspect a running extension's live state via Chrome DevTools Protocol: full HTML (with shadow DOM), DOM structure, content script injection, console messages, and CSS selector queries. Requires an active dev or start session.",
+    description: "Inspect a running extension's live state: full HTML (with shadow DOM), DOM structure, content script injection, console messages, and CSS selector queries. Chromium sessions ride Chrome DevTools Protocol; Firefox sessions ride the agent bridge (needs allowEval: true) and cover summary/meta/html/probes, while dom_snapshot, extension_roots, console, and deepDom stay CDP-only. Requires an active dev or start session.",
     inputSchema: {
         type: "object",
         properties: {
@@ -3073,10 +3250,7 @@ async function source_inspect_handler(args) {
         "console"
     ]);
     const maxBytes = args.maxBytes ?? 262144;
-    if (!isChromiumFamily(browser)) return JSON.stringify({
-        error: `Source inspection reads the live DOM over Chrome DevTools Protocol, which ${browser} (Gecko) does not expose. This is a capability limit, not a missing session.`,
-        hint: `For the ${browser} session, read runtime state with extension_logs, or extension_eval / extension_dom_inspect (content/page, an open surface like popup/options/sidebar, or an override page like newtab) which work against Firefox over the control channel. To get CDP DOM inspection, run a Chromium-family dev session (extension_dev with browser: "chrome") in parallel.`
-    });
+    if (!isChromiumFamily(browser)) return inspectViaBridge(args, browser, include, maxBytes);
     const resolved = await resolveCdpPort(args.projectPath, browser);
     if (!resolved) return JSON.stringify({
         error: "No active dev session found. Cannot connect to Chrome DevTools Protocol.",
@@ -3178,6 +3352,117 @@ async function source_inspect_handler(args) {
         cdp.disconnect();
     }
 }
+function buildBridgeInspectExpression(opts) {
+    const parts = [
+        "const out = {};"
+    ];
+    if (opts.meta) parts.push("try { out.meta = { url: location.href, title: document.title, readyState: document.readyState }; } catch (e) {}");
+    if (opts.summary) parts.push(`try {
+        const roots = document.querySelectorAll('#extension-root,[data-extension-root]:not([data-extension-root="extension-js-devtools"])');
+        out.summary = {
+          htmlLength: document.documentElement.outerHTML.length,
+          scriptCount: document.querySelectorAll('script').length,
+          styleCount: document.querySelectorAll('style').length,
+          linkCount: document.querySelectorAll('link').length,
+          extensionRootCount: roots.length,
+          bodyChildCount: document.body ? document.body.children.length : 0
+        };
+      } catch (e) { out.summary = {}; }`);
+    if (opts.html) parts.push(`try {
+        const html = document.documentElement.outerHTML;
+        const cap = ${JSON.stringify(opts.maxBytes)};
+        out.htmlTruncated = cap > 0 && html.length > cap;
+        out.html = out.htmlTruncated ? html.slice(0, cap) : html;
+      } catch (e) {}`);
+    if (opts.probes.length) parts.push(`out.probes = {};
+      for (const sel of ${JSON.stringify(opts.probes)}) {
+        try {
+          const nodes = document.querySelectorAll(sel);
+          const first = nodes[0];
+          out.probes[sel] = { count: nodes.length, sample: first ? String(first.outerHTML || "").slice(0, 200) : null };
+        } catch (e) { out.probes[sel] = { error: String((e && e.message) || e) }; }
+      }`);
+    parts.push("return out;");
+    return `(() => { ${parts.join("\n")} })()`;
+}
+async function inspectViaBridge(args, browser, include, maxBytes) {
+    const notes = [];
+    const cdpOnly = [
+        "dom_snapshot",
+        "extension_roots"
+    ].filter((k)=>include.has(k));
+    if (cdpOnly.length) notes.push(`${cdpOnly.join(" and ")} require CDP and are Chromium-only; on ${browser}, extension_dom_inspect's summary reports extension roots and open shadow roots.`);
+    if (args.deepDom) notes.push("deepDom (closed shadow roots) requires CDP and is Chromium-only.");
+    if (include.has("console")) notes.push(`Console capture rides CDP; on ${browser} read extension_logs, where the engine streams console output.`);
+    if (args.url) {
+        const listed = await listBridgeTabs(args.projectPath, browser, args.timeout);
+        if ("error" in listed) return listed.error;
+        const already = listed.tabs.some((t)=>t.url.includes(args.url));
+        if (!already) {
+            const nav = await navigateToUrlViaBridge(args.projectPath, browser, args.url, args.timeout);
+            try {
+                if (JSON.parse(nav)?.ok !== true) return nav;
+            } catch  {
+                return nav;
+            }
+        }
+    }
+    const expression = buildBridgeInspectExpression({
+        summary: include.has("summary"),
+        meta: true,
+        html: include.has("html"),
+        probes: args.probe ?? [],
+        maxBytes
+    });
+    const raw = await runActVerb([
+        "eval",
+        expression,
+        args.projectPath,
+        "--context",
+        "page",
+        ...args.url ? [
+            "--url",
+            args.url
+        ] : [],
+        "--browser",
+        browser,
+        ...null != args.timeout ? [
+            "--timeout",
+            String(args.timeout)
+        ] : []
+    ], args.projectPath, args.timeout);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return raw;
+    }
+    if (parsed?.ok !== true) return raw;
+    const value = parsed.value ?? {};
+    const result = {
+        browser,
+        transport: "bridge"
+    };
+    if (value.meta) {
+        result.target = {
+            url: value.meta.url,
+            title: value.meta.title
+        };
+        if (include.has("meta")) result.meta = value.meta;
+    }
+    if (include.has("summary") && value.summary) result.summary = value.summary;
+    if (include.has("html") && "string" == typeof value.html) {
+        result.html = value.html;
+        if (value.htmlTruncated) result.htmlTruncated = true;
+    }
+    if (value.probes) {
+        result.probes = value.probes;
+        const jsLooking = (args.probe ?? []).filter((p)=>/^typeof\s|^(chrome|browser|window|document)\.|\(\)|=>|===/.test(p));
+        if (jsLooking.length) result.probeWarning = `Probes are CSS selectors run through querySelectorAll against the live page, NOT JavaScript expressions. ${jsLooking.map((s)=>`"${s}"`).join(", ")} parsed as selectors and will match nothing. To evaluate JS, use extension_eval.`;
+    }
+    if (notes.length) result.notes = notes;
+    return JSON.stringify(result);
+}
 const list_extensions_schema = {
     name: "extension_list_extensions",
     description: "List the extensions with a live context in the running dev browser via Chrome DevTools Protocol. Returns each extension's id, name, version, and live contexts (service worker, page). The entry for THIS dev session's extension (the project being served) is flagged ownExtension: true, with name and version resolved from the session's ready contract even when the browser exposes no identity. Other extensions resolve via the read-only Extensions domain when available; their contexts are never attached to or evaluated in, so an id that the domain does not describe stays id-only with a note saying why. A dormant MV3 service worker with no open page may be absent until it wakes. Chromium only (Firefox uses RDP, not yet supported). Requires an active dev or start session.",
@@ -3657,58 +3942,6 @@ async function logs_handler(args) {
     if (args.follow) return readFromStream(args, browser, limit);
     return readFromFile(args, browser, limit);
 }
-function toMcpSpeak(text) {
-    return text.replace(/`?extension dev(?: [^\s`]*)? --browser[= ]([\w-]+) --allow-control`?/g, 'extension_dev with { browser: "$1", allowControl: true }').replace(/--allow-control/g, "allowControl: true (extension_dev)").replace(/--allow-eval/g, "allowEval: true (extension_dev)").replace(/Use --context page --tab <id>/g, 'Use context: "page" (targets the active tab; pass url or tab to pick another)').replace(/--context[= ](background|popup|options|sidebar|devtools|newtab|history|bookmarks|content|page)\b/g, 'context: "$1"').replace(/--tab[= ](\d+|<[\w-]+>)/g, "tab: $1").replace(/--url[= ]"([^"]+)"/g, 'url: "$1"').replace(/--url[= ](<[\w-]+>|\S*(?:\/\/|\*)\S*)/g, 'url: "$1"').replace(/--browser[= ]([\w]+-based|chrome|chromium|edge|brave|opera|vivaldi|yandex|firefox|waterfox|librewolf|safari)\b/g, 'browser: "$1"').replace(/--timeout[= ](\d+)/g, "timeout: $1").replace(/`extension dev`/g, "extension_dev").replace(/\bextension dev\b/g, "extension_dev").replace(/--tab\b/g, "`tab`").replace(/--url\b/g, "`url`").replace(/--context\b/g, "`context`").replace(/--browser\b/g, "`browser`").replace(/--timeout\b/g, "`timeout`");
-}
-function withSessionContext(message, projectPath) {
-    const isControlError = /no active control channel|control channel refused|\b1006\b|no executor connected|is the session started with allowControl/i.test(message);
-    if (!isControlError) return message;
-    const dead = deadReadySession(projectPath);
-    if (dead) return `${message}\nLikely cause: the dev server has exited, ${dead.browser} ready.json still says ready but its pid ${dead.pid} is dead. Restart with extension_dev (this is not an allowControl problem); extension_doctor confirms.`;
-    const running = knownSessionBrowsers(projectPath);
-    if (0 === running.length) return message;
-    return `${message} Active session browser(s) for this project: ${running.join(", ")}, pass that as \`browser\`, or restart it via extension_dev with allowControl: true if the control channel is off.`;
-}
-function translateFrame(frame, projectPath) {
-    if (!frame || false !== frame.ok) return frame;
-    if (frame.error && "string" == typeof frame.error.message) frame.error.message = withSessionContext(toMcpSpeak(frame.error.message), projectPath);
-    if ("string" == typeof frame.error?.hint) frame.error.hint = toMcpSpeak(frame.error.hint);
-    if ("string" == typeof frame.hint) frame.hint = toMcpSpeak(frame.hint);
-    return frame;
-}
-async function runActVerb(args, projectPath, timeoutMs) {
-    const { code, stdout, stderr } = await runExtensionCli([
-        ...args,
-        "--output",
-        "json"
-    ], {
-        cwd: projectPath,
-        timeoutMs
-    });
-    const out = stdout.trim();
-    if (out) try {
-        const frame = JSON.parse(out);
-        if (frame && false === frame.ok) return JSON.stringify(translateFrame(frame, projectPath));
-        return out;
-    } catch  {}
-    const message = stderr.trim() || `extension exited with code ${code}`;
-    return JSON.stringify({
-        ok: false,
-        error: {
-            name: "CliError",
-            message: withSessionContext(toMcpSpeak(message), projectPath)
-        }
-    });
-}
-function commonFlags(args) {
-    const flags = [];
-    if (args.context) flags.push("--context", args.context);
-    if (args.url) flags.push("--url", args.url);
-    if (null != args.tab) flags.push("--tab", String(args.tab));
-    if (args.browser) flags.push("--browser", args.browser);
-    if (null != args.timeout) flags.push("--timeout", String(args.timeout));
-    return flags;
-}
 const eval_schema = {
     name: "extension_eval",
     description: "Evaluate an expression in a running extension context. Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Context default: on a Chromium session whose manifest is MV3 (the default template) the default is `page` (the active tab), because the MV3 background is a service worker whose CSP blocks eval, so a background default would fail on the most common path; on Firefox/MV2 sessions the default stays `background`. Pass `context: \"background\"` explicitly to target the worker anyway (on Chromium MV3 that returns the CSP explanation). Targeting for context content/page: pass `url` to pick the matching tab, or omit both `url` and `tab` to use the ACTIVE tab; a numeric `tab` id is only needed to disambiguate. Extension surfaces (popup/options/sidebar/devtools) and override pages (newtab/history/bookmarks) evaluate over the in-bundle relay and need NO tab id; the surface must be OPEN (extension_open first; a closed surface returns an explicit error). Use extension_dom_inspect with listTabs: true to enumerate {tabId,url,title}. Wraps `extension eval`.",
@@ -3976,14 +4209,8 @@ async function pollForTarget(port, url, budgetMs) {
         await new Promise((r)=>setTimeout(r, 250));
     }
 }
-async function navigateToUrl(projectPath, browser, url) {
-    if (!isChromiumFamily(browser)) return JSON.stringify({
-        ok: false,
-        error: {
-            name: "Unsupported",
-            message: `URL navigation drives a tab over Chrome DevTools Protocol, which ${browser} (Gecko) does not expose. On Firefox, drive the page via extension_eval (context: "page"/"content") or read extension_logs.`
-        }
-    });
+async function navigateToUrl(projectPath, browser, url, timeout) {
+    if (!isChromiumFamily(browser)) return navigateToUrlViaBridge(projectPath, browser, url, timeout);
     const resolved = await resolveCdpPort(projectPath, browser);
     if (!resolved) return JSON.stringify({
         ok: false,
@@ -4226,16 +4453,32 @@ async function applyPopupBounds(projectPath, browser, targetId) {
 async function openSurfaceAsTab(projectPath, browser, surface) {
     const doc = surfaceDocument(projectPath, browser, surface);
     if (!doc) return missingSurfaceError(projectPath, browser, surface, "so there is no page to render as a tab");
-    const id = await resolveExtensionId(projectPath, browser);
-    if (!id) return JSON.stringify({
-        ok: false,
-        error: {
-            name: "NoExtensionId",
-            message: "Could not resolve the extension id from the live session's CDP targets."
-        },
-        hint: `Confirm the session is ready (extension_wait). ${CDP_PORT_MISSING_HINT}`
-    });
-    const url = `chrome-extension://${id}/${doc}`;
+    let url;
+    let extensionId = null;
+    if (isChromiumFamily(browser)) {
+        extensionId = await resolveExtensionId(projectPath, browser);
+        if (!extensionId) return JSON.stringify({
+            ok: false,
+            error: {
+                name: "NoExtensionId",
+                message: "Could not resolve the extension id from the live session's CDP targets."
+            },
+            hint: `Confirm the session is ready (extension_wait). ${CDP_PORT_MISSING_HINT}`
+        });
+        url = `chrome-extension://${extensionId}/${doc}`;
+    } else {
+        const base = await resolveBridgeBaseUrl(projectPath, browser);
+        if (!base) return JSON.stringify({
+            ok: false,
+            error: {
+                name: "NoExtensionId",
+                message: "Could not resolve the extension's moz-extension:// base URL from the live session (a background eval of runtime.getURL)."
+            },
+            hint: "Confirm the session is ready (extension_wait) and was started with allowEval: true (extension_dev)."
+        });
+        url = `${base}${doc}`;
+        extensionId = base.replace(/^.*:\/\//, "").replace(/\/$/, "");
+    }
     const raw = await navigateToUrl(projectPath, browser, url);
     try {
         const parsed = JSON.parse(raw);
@@ -4243,14 +4486,14 @@ async function openSurfaceAsTab(projectPath, browser, surface) {
             parsed.renderedAsTab = {
                 surface,
                 document: doc,
-                extensionId: id
+                extensionId
             };
             let popupBounds = null;
             if (("popup" === surface || "action" === surface) && "string" == typeof parsed.target?.targetId) {
                 popupBounds = await applyPopupBounds(projectPath, browser, parsed.target.targetId);
                 if (popupBounds) parsed.renderedAsTab.popupBounds = popupBounds;
             }
-            parsed.hint = `Rendered the ${surface} document in a real tab, which is how you inspect a surface headlessly. ` + (popupBounds ? `The window was resized to the popup's content size (${popupBounds.width}x${popupBounds.height}${popupBounds.clamped ? ", clamped to Chrome's 25x25-800x600 popup bounds" : ""}), approximating real popup rendering. This resizes the WHOLE browser window for the session. It is the same page with the same extension APIs, but window.close() closes the tab. ` : "It is the same page with the same extension APIs, but it is NOT hosted in a popup window: no popup sizing, and window.close() closes the tab. ") + `Inspect it with extension_dom_inspect context: '${surface}' (include: ['html']), or extension_source_inspect with this url. ` + "Do NOT pass this chrome-extension:// url to extension_dom_inspect or extension_eval as a tab target: script injection cannot reach extension pages, only the surface context or CDP can.";
+            parsed.hint = `Rendered the ${surface} document in a real tab, which is how you inspect a surface headlessly. ` + (popupBounds ? `The window was resized to the popup's content size (${popupBounds.width}x${popupBounds.height}${popupBounds.clamped ? ", clamped to Chrome's 25x25-800x600 popup bounds" : ""}), approximating real popup rendering. This resizes the WHOLE browser window for the session. It is the same page with the same extension APIs, but window.close() closes the tab. ` : "It is the same page with the same extension APIs, but it is NOT hosted in a popup window: no popup sizing, and window.close() closes the tab. ") + `Inspect it with extension_dom_inspect context: '${surface}' (include: ['html']), or extension_source_inspect with this url. ` + "Do NOT pass this extension-page url to extension_dom_inspect or extension_eval as a tab target: script injection cannot reach extension pages, only the surface context or CDP can.";
             return JSON.stringify(parsed);
         }
     } catch  {}
@@ -4286,7 +4529,7 @@ const open_schema = {
             },
             url: {
                 type: "string",
-                description: "Navigate a real tab to this URL (Chromium only, via CDP) instead of opening a surface. Use for content-script/webNavigation test pages, or the popup as a page: chrome-extension://<id>/popup.html. Alternative to `surface`."
+                description: "Navigate a real tab to this URL instead of opening a surface (Chromium via CDP; Firefox via the agent bridge, which needs allowEval: true). Use for content-script/webNavigation test pages, or the popup as a page: chrome-extension://<id>/popup.html. Alternative to `surface`."
             },
             asTab: {
                 type: "boolean",
@@ -4309,7 +4552,7 @@ const open_schema = {
 };
 async function open_handler(args) {
     const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
-    if (args.url) return navigateToUrl(args.projectPath, browser, args.url);
+    if (args.url) return navigateToUrl(args.projectPath, browser, args.url, args.timeout);
     const AS_TAB_SURFACES = [
         "popup",
         "options",
@@ -4360,7 +4603,7 @@ async function open_handler(args) {
         const parsed = JSON.parse(raw);
         const msg = String(parsed?.error?.message ?? "");
         if (parsed?.ok === false && /active browser window|no active|headless|user gesture/i.test(msg)) {
-            if (AS_TAB_SURFACES.includes(args.surface) && isChromiumFamily(browser)) {
+            if (AS_TAB_SURFACES.includes(args.surface)) {
                 const fallback = await openSurfaceAsTab(args.projectPath, browser, args.surface);
                 try {
                     const parsedFallback = JSON.parse(fallback);
@@ -4414,7 +4657,7 @@ const dom_inspect_schema = {
             },
             tabUrl: {
                 type: "string",
-                description: "Target the tab whose URL contains this substring (case-insensitive; titles are checked only when no url matches). Resolved against the live browser's CDP page targets BEFORE inspecting: exactly one match proceeds; zero or several matches return the candidate targets (targetId/url/title) so you can narrow, never a guess. Chromium sessions only; on Firefox use `url`/`tab`. Alternative to `url`."
+                description: "Target the tab whose URL contains this substring (case-insensitive; titles are checked only when no url matches). Resolved against the live browser BEFORE inspecting (Chromium: CDP page targets; Firefox: the agent bridge tab list): exactly one match proceeds; zero or several matches return the candidates so you can narrow, never a guess. Alternative to `url`."
             },
             listTargets: {
                 type: "boolean",
@@ -4542,6 +4785,7 @@ async function dom_inspect_handler(args) {
         ] : []
     ], args.projectPath, args.timeout);
     let targetUrl = args.url;
+    let targetTab = args.tab;
     let resolvedTarget = null;
     if (args.tabUrl) {
         if (null != args.tab || args.url) return JSON.stringify({
@@ -4552,48 +4796,79 @@ async function dom_inspect_handler(args) {
             }
         });
         const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
-        const cdp = await cdpPortOrError(args.projectPath, browser, "tabUrl");
-        if ("error" in cdp) return cdp.error;
-        let targets;
-        try {
-            targets = await listPageTargets(cdp.port);
-        } catch (e) {
-            return JSON.stringify({
+        if (isChromiumFamily(browser)) {
+            const cdp = await cdpPortOrError(args.projectPath, browser, "tabUrl");
+            if ("error" in cdp) return cdp.error;
+            let targets;
+            try {
+                targets = await listPageTargets(cdp.port);
+            } catch (e) {
+                return JSON.stringify({
+                    ok: false,
+                    error: {
+                        name: "CdpError",
+                        message: `Could not list page targets to resolve tabUrl: ${e instanceof Error ? e.message : String(e)}`
+                    },
+                    hint: "Confirm the session is ready (extension_wait), then retry, or target with `url`/`tab` instead."
+                });
+            }
+            const matches = matchTargetsByUrl(targets, args.tabUrl);
+            if (0 === matches.length) return JSON.stringify({
                 ok: false,
                 error: {
-                    name: "CdpError",
-                    message: `Could not list page targets to resolve tabUrl: ${e instanceof Error ? e.message : String(e)}`
+                    name: "NoMatchingTarget",
+                    message: `No open page target's url (or title) contains "${args.tabUrl}" (case-insensitive).`
+                },
+                availableTargets: targets,
+                hint: `Pick one from availableTargets and retry with a \`tabUrl\` substring of its url, or open the page first (extension_open with \`url\`). ${TARGET_ID_NOTE}`
+            });
+            if (matches.length > 1) return JSON.stringify({
+                ok: false,
+                error: {
+                    name: "AmbiguousTabUrl",
+                    message: `${matches.length} page targets match "${args.tabUrl}"; refusing to guess which tab you mean.`
+                },
+                matchingTargets: matches,
+                hint: `Narrow \`tabUrl\` to a longer substring that matches exactly one url in matchingTargets. ${TARGET_ID_NOTE}`
+            });
+            resolvedTarget = {
+                ...matches[0]
+            };
+            targetUrl = matches[0].url;
+        } else {
+            const listed = await listBridgeTabs(args.projectPath, browser, args.timeout);
+            if ("error" in listed) return listed.error;
+            const matches = matchTabsByUrl(listed.tabs, args.tabUrl);
+            if (0 === matches.length) return JSON.stringify({
+                ok: false,
+                error: {
+                    name: "NoMatchingTarget",
+                    message: `No open tab's url (or title) contains "${args.tabUrl}" (case-insensitive).`
+                },
+                availableTabs: listed.tabs,
+                hint: "Pick one from availableTabs and retry with a `tabUrl` substring of its url, or open the page first (extension_open with `url`)."
+            });
+            if (matches.length > 1) return JSON.stringify({
+                ok: false,
+                error: {
+                    name: "AmbiguousTabUrl",
+                    message: `${matches.length} tabs match "${args.tabUrl}"; refusing to guess which tab you mean.`
                 },
-                hint: "Confirm the session is ready (extension_wait), then retry, or target with `url`/`tab` instead."
+                matchingTabs: matches,
+                hint: "Narrow `tabUrl` to a longer substring that matches exactly one url in matchingTabs, or pass its numeric tabId as `tab`."
             });
+            resolvedTarget = {
+                ...matches[0]
+            };
+            if (null != matches[0].tabId) targetTab = matches[0].tabId;
+            else targetUrl = matches[0].url;
         }
-        const matches = matchTargetsByUrl(targets, args.tabUrl);
-        if (0 === matches.length) return JSON.stringify({
-            ok: false,
-            error: {
-                name: "NoMatchingTarget",
-                message: `No open page target's url (or title) contains "${args.tabUrl}" (case-insensitive).`
-            },
-            availableTargets: targets,
-            hint: `Pick one from availableTargets and retry with a \`tabUrl\` substring of its url, or open the page first (extension_open with \`url\`). ${TARGET_ID_NOTE}`
-        });
-        if (matches.length > 1) return JSON.stringify({
-            ok: false,
-            error: {
-                name: "AmbiguousTabUrl",
-                message: `${matches.length} page targets match "${args.tabUrl}"; refusing to guess which tab you mean.`
-            },
-            matchingTargets: matches,
-            hint: `Narrow \`tabUrl\` to a longer substring that matches exactly one url in matchingTargets. ${TARGET_ID_NOTE}`
-        });
-        resolvedTarget = matches[0];
-        targetUrl = resolvedTarget.url;
     }
     const cli = [
         "inspect",
         args.projectPath
     ];
-    if (null != args.tab) cli.push("--tab", String(args.tab));
+    if (null != targetTab) cli.push("--tab", String(targetTab));
     if (targetUrl) cli.push("--url", targetUrl);
     if (args.context) cli.push("--context", args.context);
     if (args.include?.length) cli.push("--include", args.include.join(","));
@@ -4686,7 +4961,117 @@ function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
     if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
     return creds;
 }
+const REGISTRY_BASE_DEFAULT = "https://registry.extension.land";
+const CONSOLE_BASE = "https://console.extension.dev";
+function registryBase() {
+    const fromEnv = String(process.env.EXTENSION_DEV_REGISTRY_URL || "").trim();
+    return (fromEnv || REGISTRY_BASE_DEFAULT).replace(/\/+$/, "");
+}
+function resolveProjectRef(overrides) {
+    const workspace = String(overrides?.workspace || "").trim();
+    const project = String(overrides?.project || "").trim();
+    if (workspace && project) return {
+        workspace,
+        project
+    };
+    const creds = readCredentials();
+    const ws = workspace || String(creds?.workspaceSlug || "").trim();
+    const proj = project || String(creds?.projectSlug || "").trim();
+    if (!ws || !proj) return null;
+    return {
+        workspace: ws,
+        project: proj
+    };
+}
+function registryFileUrl(ref, file) {
+    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
+}
+function consoleProjectUrl(ref, page) {
+    if (!ref) return `${CONSOLE_BASE}`;
+    return `${CONSOLE_BASE}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/${page}`;
+}
+async function fetchRegistryJson(url, fetchImpl = fetch) {
+    let res;
+    try {
+        res = await fetchImpl(url);
+    } catch (err) {
+        return {
+            ok: false,
+            message: `Could not reach ${url}: ${err?.message || err}`
+        };
+    }
+    if (!res.ok) return {
+        ok: false,
+        status: res.status,
+        message: `${url} returned ${res.status}`
+    };
+    try {
+        const text = await res.text();
+        return {
+            ok: true,
+            json: JSON.parse(text)
+        };
+    } catch  {
+        return {
+            ok: false,
+            message: `${url} did not return valid JSON`
+        };
+    }
+}
+function parseChannels(json) {
+    if (!json || "object" != typeof json || Array.isArray(json)) return [];
+    const out = [];
+    for (const [channel, raw] of Object.entries(json)){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const description = "string" == typeof row.description ? row.description : void 0;
+        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
+        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
+        const entry = {
+            channel,
+            sha: String(row.sha ?? "")
+        };
+        if (row.buildId) entry.buildId = String(row.buildId);
+        if (row.version) entry.version = String(row.version);
+        const promotedAt = promotedAtField || fromDescription;
+        if (promotedAt) entry.promotedAt = promotedAt;
+        if (description) entry.description = description;
+        out.push(entry);
+    }
+    return out;
+}
+function parseBuildIndex(json) {
+    const items = json?.items;
+    if (!Array.isArray(items)) return [];
+    const out = [];
+    for (const raw of items){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
+        if (!sha) continue;
+        const entry = {
+            sha
+        };
+        if (row.commit) entry.commit = String(row.commit);
+        if (row.channel) entry.channel = String(row.channel);
+        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
+        if (row.status) entry.status = String(row.status);
+        if (row.version) entry.version = String(row.version);
+        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
+        if (row.timestamp) entry.timestamp = String(row.timestamp);
+        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
+        out.push(entry);
+    }
+    return out;
+}
 const DEFAULT_API = "https://www.extension.dev";
+function tokenTtlNote(workspaceSlug, projectSlug) {
+    const tokensUrl = workspaceSlug && projectSlug ? consoleProjectUrl({
+        workspace: workspaceSlug,
+        project: projectSlug
+    }, "settings/access-tokens") : CONSOLE_BASE;
+    return `extension.dev CLI tokens live at most 7 days (server-enforced). CI pipelines must re-mint before expiry on the console's Access tokens page: ${tokensUrl}`;
+}
 function resolveApiBase(api) {
     return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
 }
@@ -4851,109 +5236,6 @@ async function publish(options = {}) {
         data
     };
 }
-const REGISTRY_BASE_DEFAULT = "https://registry.extension.land";
-const CONSOLE_BASE = "https://console.extension.dev";
-function registryBase() {
-    const fromEnv = String(process.env.EXTENSION_DEV_REGISTRY_URL || "").trim();
-    return (fromEnv || REGISTRY_BASE_DEFAULT).replace(/\/+$/, "");
-}
-function resolveProjectRef(overrides) {
-    const workspace = String(overrides?.workspace || "").trim();
-    const project = String(overrides?.project || "").trim();
-    if (workspace && project) return {
-        workspace,
-        project
-    };
-    const creds = readCredentials();
-    const ws = workspace || String(creds?.workspaceSlug || "").trim();
-    const proj = project || String(creds?.projectSlug || "").trim();
-    if (!ws || !proj) return null;
-    return {
-        workspace: ws,
-        project: proj
-    };
-}
-function registryFileUrl(ref, file) {
-    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
-}
-function consoleProjectUrl(ref, page) {
-    if (!ref) return `${CONSOLE_BASE}`;
-    return `${CONSOLE_BASE}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/${page}`;
-}
-async function fetchRegistryJson(url, fetchImpl = fetch) {
-    let res;
-    try {
-        res = await fetchImpl(url);
-    } catch (err) {
-        return {
-            ok: false,
-            message: `Could not reach ${url}: ${err?.message || err}`
-        };
-    }
-    if (!res.ok) return {
-        ok: false,
-        status: res.status,
-        message: `${url} returned ${res.status}`
-    };
-    try {
-        const text = await res.text();
-        return {
-            ok: true,
-            json: JSON.parse(text)
-        };
-    } catch  {
-        return {
-            ok: false,
-            message: `${url} did not return valid JSON`
-        };
-    }
-}
-function parseChannels(json) {
-    if (!json || "object" != typeof json || Array.isArray(json)) return [];
-    const out = [];
-    for (const [channel, raw] of Object.entries(json)){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const description = "string" == typeof row.description ? row.description : void 0;
-        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
-        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
-        const entry = {
-            channel,
-            sha: String(row.sha ?? "")
-        };
-        if (row.buildId) entry.buildId = String(row.buildId);
-        if (row.version) entry.version = String(row.version);
-        const promotedAt = promotedAtField || fromDescription;
-        if (promotedAt) entry.promotedAt = promotedAt;
-        if (description) entry.description = description;
-        out.push(entry);
-    }
-    return out;
-}
-function parseBuildIndex(json) {
-    const items = json?.items;
-    if (!Array.isArray(items)) return [];
-    const out = [];
-    for (const raw of items){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
-        if (!sha) continue;
-        const entry = {
-            sha
-        };
-        if (row.commit) entry.commit = String(row.commit);
-        if (row.channel) entry.channel = String(row.channel);
-        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
-        if (row.status) entry.status = String(row.status);
-        if (row.version) entry.version = String(row.version);
-        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
-        if (row.timestamp) entry.timestamp = String(row.timestamp);
-        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
-        out.push(entry);
-    }
-    return out;
-}
 const publish_schema = {
     name: "extension_publish",
     description: "Publish the project your stored token is scoped to (from extension_login, or EXTENSION_DEV_TOKEN) to extension.dev and return its shareable URL. The publish target is the token's project -- there is no projectPath, the local files are not uploaded. For a PUBLIC project the URL is the canonical public page and ttlHours does not apply; for a PRIVATE project it is a fresh time-limited share link (?share=) whose lifetime is ttlHours. Posts to the platform's CLI publish endpoint. Besides extension_login this is the only tool that talks to the hosted platform.",
@@ -5031,7 +5313,7 @@ async function publish_handler(args) {
 const release_promote_DEFAULT_API = "https://www.extension.dev";
 const release_promote_schema = {
     name: "extension_release_promote",
-    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
+    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
     inputSchema: {
         type: "object",
         properties: {
@@ -5084,7 +5366,7 @@ function release_promote_fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens), or run extension_login.");
+    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry), or run extension_login.");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
     if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
@@ -5236,7 +5518,7 @@ function storeMdWarnings(browsers, cwd) {
         content = node_fs.readFileSync(node_path.join(cwd, "STORE.md"), "utf8");
     } catch  {
         return [
-            "No STORE.md found in the project root. Reviewer notes (Firefox) and certification notes (Edge) will not accompany the submission. See the extension-dev skill's store-md reference."
+            "No STORE.md found in the current working directory. Platform submissions read STORE.md from the project's source repository, so this may not apply here; make sure STORE.md exists there for Firefox reviewer notes and Edge certification notes. See the extension-dev skill's store-md reference."
         ];
     }
     const hasField = (section, field)=>{
@@ -5255,7 +5537,7 @@ function storeMdWarnings(browsers, cwd) {
 }
 const deploy_schema = {
     name: "extension_deploy",
-    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight: verifies auth, the project, that the build exists, and the store workflow - dispatches nothing); pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN); store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha. Posts to the platform's CLI store-submission endpoint.",
+    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, and/or Edge Add-ons THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight - dispatches nothing): the platform side verifies auth, the project, that the build exists, and the store workflow, and this tool then adds the per-store verdict from each store's public credential-health record; trust the per-store rows in the result over the platform's bare preflight line, which does not check store health. Pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN; tokens live at most 7 days, so CI must re-mint from the console's Access tokens page). Store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha (extension_release_list lists valid shas); after a real submission, extension_store_status reads the recorded outcome and review state. Posts to the platform's CLI store-submission endpoint.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5311,7 +5593,7 @@ function deploy_fail(name, message) {
 }
 async function deploy_handler(args) {
     const token = resolveToken();
-    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens).");
+    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry).");
     const browsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim().toLowerCase()).filter(Boolean);
     if (0 === browsers.length) return deploy_fail("DeployInputError", 'browsers is required (e.g. ["chrome","firefox","edge"]).');
     const buildSha = String(args.buildSha || "").trim();
@@ -5429,9 +5711,214 @@ async function deploy_handler(args) {
         if ("string" == typeof data?.message) result.platformMessage = data.message;
         result.message = summaryParts.join(" ");
     }
+    if (!dryRun) result.statusNote = "Track this submission with extension_store_status: it reads the recorded outcome, per-store credential health, and review state from the public registry.";
     if (warnings.length > 0) result.warnings = warnings;
     return JSON.stringify(result);
 }
+const KNOWN_STORES = [
+    "chrome",
+    "firefox",
+    "edge",
+    "safari"
+];
+const store_status_schema = {
+    name: "extension_store_status",
+    description: "Report the project's browser-store state after an extension_deploy submission: per store (chrome, firefox, edge, safari) whether it is configured, its latest credential health check, the last recorded submission (version, status, store URL, submitted-at), and the latest review status. Reads the project's public registry (registry.extension.land: stores/health.json, stores/status.json, stores/submissions.json) - read-only, dispatches nothing, no auth needed for public projects. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another public project. Registry state can lag the store dashboards by up to a polling interval.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            workspace: {
+                type: "string",
+                description: "Workspace slug override (defaults to the stored login's workspace)."
+            },
+            project: {
+                type: "string",
+                description: "Project slug override (defaults to the stored login's project)."
+            }
+        },
+        required: []
+    }
+};
+function isPlainObject(value) {
+    return Boolean(value) && "object" == typeof value && !Array.isArray(value);
+}
+function str(value) {
+    const text = String(value ?? "").trim();
+    return text || void 0;
+}
+function submissionView(row) {
+    const view = {};
+    const version = str(row.version);
+    const status = str(row.status);
+    const storeUrl = str(row.storeUrl);
+    const submittedAt = str(row.submittedAt) || str(row.timestamp);
+    const channel = str(row.channel);
+    const buildSha = str(row.buildSha) || str(row.buildId);
+    const storeSubmissionId = str(row.storeSubmissionId);
+    const failureReason = str(row.failureReason);
+    if (version) view.version = version;
+    if (status) view.status = status;
+    if (storeUrl) view.storeUrl = storeUrl;
+    if (submittedAt) view.submittedAt = submittedAt;
+    if (channel) view.channel = channel;
+    if (buildSha) view.buildSha = buildSha;
+    if (storeSubmissionId) view.storeSubmissionId = storeSubmissionId;
+    if (failureReason) view.failureReason = failureReason;
+    return view;
+}
+function latestSubmissionsByStore(json) {
+    const list = json?.submissions;
+    const out = {};
+    for (const raw of Array.isArray(list) ? list : []){
+        if (!isPlainObject(raw)) continue;
+        const store = str(raw.store);
+        if (!store) continue;
+        const at = Date.parse(String(raw.submittedAt || raw.updatedAt || ""));
+        const stamp = Number.isFinite(at) ? at : 0;
+        if (!out[store] || stamp >= out[store].at) out[store] = {
+            at: stamp,
+            view: submissionView(raw)
+        };
+    }
+    const flat = {};
+    for (const [store, entry] of Object.entries(out))flat[store] = entry.view;
+    return flat;
+}
+function normalizeStoresStatus(json) {
+    const base = isPlainObject(json) ? json : {};
+    const out = {
+        reviews: {}
+    };
+    if (isPlainObject(base.lastSubmission)) out.lastSubmission = base.lastSubmission;
+    if (isPlainObject(base.lastOverride)) out.lastOverride = base.lastOverride;
+    if (isPlainObject(base.reviews)) {
+        for (const [store, raw] of Object.entries(base.reviews))if (isPlainObject(raw)) out.reviews[store] = {
+            status: str(raw.status),
+            version: str(raw.version),
+            buildId: str(raw.buildId),
+            checkedAt: str(raw.checkedAt)
+        };
+    }
+    const lastPoll = isPlainObject(base.lastPoll) ? base.lastPoll : null;
+    const looksLikeLegacyPoll = !lastPoll && ("store_status" === base.kind || Array.isArray(base.updates));
+    if (lastPoll) out.lastPollAt = str(lastPoll.timestamp);
+    else if (looksLikeLegacyPoll) {
+        out.lastPollAt = str(base.updatedAt);
+        for (const raw of Array.isArray(base.updates) ? base.updates : []){
+            if (!isPlainObject(raw)) continue;
+            const store = str(raw.store);
+            if (store && !out.reviews[store]) out.reviews[store] = {
+                status: str(raw.status),
+                version: str(raw.version),
+                buildId: str(raw.buildId),
+                checkedAt: str(base.updatedAt)
+            };
+        }
+    }
+    return out;
+}
+function store_status_fail(name, message, extra) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        },
+        ...extra ?? {}
+    });
+}
+async function store_status_handler(args) {
+    const ref = resolveProjectRef(args);
+    if (!ref) return store_status_fail("StoreStatusInputError", "No project to inspect. Run extension_login (the stored login names the project), or pass workspace + project explicitly.");
+    const healthUrl = registryFileUrl(ref, "stores/health.json");
+    const statusUrl = registryFileUrl(ref, "stores/status.json");
+    const submissionsUrl = registryFileUrl(ref, "stores/submissions.json");
+    const consoleStoresUrl = consoleProjectUrl(ref, "stores");
+    const [healthRes, statusRes, submissionsRes] = await Promise.all([
+        fetchRegistryJson(healthUrl),
+        fetchRegistryJson(statusUrl),
+        fetchRegistryJson(submissionsUrl)
+    ]);
+    if (!healthRes.ok && !statusRes.ok && !submissionsRes.ok) return store_status_fail("StoreStatusNotFound", `No store data on the registry for ${ref.workspace}/${ref.project} (${healthUrl} returned ${healthRes.status ?? "no response"}). The project may have no stores configured yet, be private (private registry data needs a share token), or the workspace/project slugs may be wrong. Configure stores at ${consoleStoresUrl}/new; the console Stores page is the authoritative view: ${consoleStoresUrl}`, {
+        workspace: ref.workspace,
+        project: ref.project,
+        registryUrls: {
+            health: healthUrl,
+            status: statusUrl,
+            submissions: submissionsUrl
+        },
+        consoleStoresUrl
+    });
+    const healthStores = healthRes.ok ? isPlainObject(healthRes.json?.stores) ? healthRes.json.stores ?? null : null : null;
+    const status = normalizeStoresStatus(statusRes.ok ? statusRes.json : null);
+    const submissionsByStore = submissionsRes.ok ? latestSubmissionsByStore(submissionsRes.json) : {};
+    const statusLastStore = str(status.lastSubmission?.store);
+    if (statusLastStore && !submissionsByStore[statusLastStore] && status.lastSubmission) submissionsByStore[statusLastStore] = submissionView(status.lastSubmission);
+    const stores = [
+        ...KNOWN_STORES,
+        ...Object.keys({
+            ...healthStores,
+            ...submissionsByStore,
+            ...status.reviews
+        }).filter((s)=>!KNOWN_STORES.includes(s))
+    ];
+    const rows = stores.map((store)=>{
+        const healthRow = healthStores?.[store];
+        const configured = healthStores ? Boolean(healthRow) : "unknown";
+        const row = {
+            store,
+            configured
+        };
+        if (healthRow) row.health = {
+            ok: true === healthRow.ok,
+            checkedAt: str(healthRow.checkedAt),
+            message: str(healthRow.message)
+        };
+        const submission = submissionsByStore[store];
+        if (submission && Object.keys(submission).length > 0) row.lastSubmission = submission;
+        const review = status.reviews[store];
+        if (review && Object.values(review).some(Boolean)) row.review = review;
+        return row;
+    });
+    const summaryParts = rows.map((row)=>{
+        const store = String(row.store);
+        const health = row.health;
+        const submission = row.lastSubmission;
+        const review = row.review;
+        let head;
+        head = "unknown" === row.configured ? `${store}: configuration unknown (stores/health.json is unreadable)` : false === row.configured ? `${store}: not configured (add it at ${consoleStoresUrl}/new)` : health && !health.ok ? `${store}: configured but its credentials FAILED the last health check (${health.message || "no reason recorded"}) - fix them at ${consoleStoresUrl}/${store}` : `${store}: configured, credentials healthy`;
+        const tail = [];
+        if (submission) {
+            tail.push(`last submission${submission.version ? ` v${submission.version}` : ""} ${submission.status || "recorded"}${submission.submittedAt ? ` at ${submission.submittedAt}` : ""}${submission.failureReason ? ` (${submission.failureReason})` : ""}`);
+            if (submission.storeUrl) tail.push(`listing ${submission.storeUrl}`);
+        } else if (true === row.configured) tail.push("no submissions recorded");
+        if (review?.status) tail.push(`review ${review.status}${review.checkedAt ? ` (checked ${review.checkedAt})` : ""}`);
+        return tail.length > 0 ? `${head}; ${tail.join("; ")}` : head;
+    });
+    const result = {
+        ok: true,
+        workspace: ref.workspace,
+        project: ref.project,
+        stores: rows,
+        ...status.lastSubmission ? {
+            lastSubmission: status.lastSubmission
+        } : {},
+        ...status.lastPollAt ? {
+            lastPollAt: status.lastPollAt
+        } : {},
+        registryUrls: {
+            health: healthUrl,
+            status: statusUrl,
+            submissions: submissionsUrl
+        },
+        consoleStoresUrl,
+        message: `${summaryParts.join(". ")}. This is the registry's recorded state (submissions and the review poller write it); the store dashboards are authoritative and may be ahead of it.`
+    };
+    if (!healthRes.ok) result.healthUnavailable = `stores/health.json unreadable: ${healthRes.message}`;
+    if (!statusRes.ok) result.statusUnavailable = `stores/status.json unreadable: ${statusRes.message}`;
+    if (!submissionsRes.ok && 404 !== submissionsRes.status) result.submissionsUnavailable = `stores/submissions.json unreadable: ${submissionsRes.message}`;
+    return JSON.stringify(result);
+}
 function doctor_readReadyContract(projectPath, browser) {
     try {
         const raw = node_fs.readFileSync(node_path.resolve(projectPath, "dist", "extension-js", browser, "ready.json"), "utf8");
@@ -6187,7 +6674,7 @@ async function pollDeviceToken(args) {
 }
 const login_schema = {
     name: "extension_login",
-    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. This is the only tool besides extension_publish that talks to the hosted platform.",
+    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
@@ -6221,13 +6708,15 @@ function login_fail(name, message) {
     });
 }
 function success(creds) {
+    const expiresAt = creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null;
     return JSON.stringify({
         ok: true,
         status: "logged-in",
         workspaceSlug: creds.workspaceSlug,
         projectSlug: creds.projectSlug,
-        expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
-        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token.`
+        expiresAt,
+        tokenTtlNote: tokenTtlNote(creds.workspaceSlug, creds.projectSlug),
+        message: `Logged in to ${creds.workspaceSlug}/${creds.projectSlug}. extension_publish can now use the stored token. The token expires ${expiresAt ?? "within 7 days"}: extension.dev CLI tokens live at most 7 days, so CI must re-mint before then (console: project settings -> Access tokens).`
     });
 }
 function login_pending(start) {
@@ -6243,6 +6732,7 @@ function login_pending(start) {
             verificationUriComplete: complete
         } : {},
         deviceCode: start.deviceCode,
+        tokenTtlNote: "Once authorized, the minted token lives at most 7 days (server-enforced); CI must re-mint before expiry (console: project settings -> Access tokens).",
         message
     });
 }
@@ -6252,6 +6742,7 @@ function resumePending(deviceCode, verificationUri) {
         status: "authorization_pending",
         verificationUri,
         deviceCode,
+        tokenTtlNote: "Once authorized, the minted token lives at most 7 days (server-enforced); CI must re-mint before expiry (console: project settings -> Access tokens).",
         message: `Still waiting for authorization. The one-click link and code from the previous response are still valid: open that link (or enter the code at ${verificationUri}), then call extension_login again with this same deviceCode (and the same project).`
     });
 }
@@ -6361,7 +6852,7 @@ async function login_handler(args) {
 }
 const whoami_schema = {
     name: "extension_whoami",
-    description: "Report the identity carried by the locally stored extension.dev token that extension_login minted (workspace/project scoped), plus its expiry, without revealing the token. The identity comes from that stored token alone; it does not change with the current working directory or whichever project folder you are in. Returns logged-out status when no credentials are stored.",
+    description: "Report the identity carried by the locally stored extension.dev token that extension_login minted (workspace/project scoped), plus its expiry, without revealing the token. The identity comes from that stored token alone; it does not change with the current working directory or whichever project folder you are in. The result records where the login was minted (apiRecordedAtLogin) without asserting a platform base URL: authenticated tools target their own api argument, EXTENSION_DEV_API_URL, or the production default. Returns logged-out status when no credentials are stored.",
     inputSchema: {
         type: "object",
         properties: {}
@@ -6376,17 +6867,32 @@ async function whoami_handler() {
     });
     const now = Math.floor(Date.now() / 1000);
     const expired = Boolean(creds.expiresAt && creds.expiresAt <= now);
+    const recordedApi = String(creds.api || "").trim();
+    const effectiveDefaultApi = resolveApiBase();
+    const apiDiverges = Boolean(recordedApi) && recordedApi !== effectiveDefaultApi;
+    const envTokenSet = Boolean(String(process.env.EXTENSION_DEV_TOKEN || "").trim());
+    const messageParts = [];
+    messageParts.push(expired ? "The stored token has expired. Run extension_login to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_login stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`);
+    if (apiDiverges) messageParts.push(`This login was minted via ${recordedApi}, but authenticated tools do not read that recorded value: they target ${effectiveDefaultApi} unless given an api argument.`);
+    if (envTokenSet) messageParts.push("EXTENSION_DEV_TOKEN is set and takes precedence over this stored login for authenticated tools; this report describes only the stored login.");
     return JSON.stringify({
         ok: true,
         status: expired ? "expired" : "logged-in",
         workspaceSlug: creds.workspaceSlug,
         projectSlug: creds.projectSlug,
-        api: creds.api,
+        ...recordedApi ? {
+            apiRecordedAtLogin: recordedApi
+        } : {},
+        apiDefault: effectiveDefaultApi,
         provider: creds.provider ?? "github",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
-        message: expired ? "The stored token has expired. Run extension_login to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_login stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`
+        ...envTokenSet ? {
+            envTokenOverride: true
+        } : {},
+        tokenTtlNote: tokenTtlNote(creds.workspaceSlug, creds.projectSlug),
+        message: messageParts.join(" ")
     });
 }
 const logout_schema = {
@@ -7073,6 +7579,7 @@ const tools = [
     release_list_namespaceObject,
     release_promote_namespaceObject,
     deploy_namespaceObject,
+    store_status_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
     login_namespaceObject,