@extension.dev/mcp 5.5.1 → 5.6.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "5.5.1",
+      "version": "5.6.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "5.5.1",
+  "version": "5.6.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 5.6.0
+
+Firefox reaches full protocol parity: every formerly Chromium-only
+feature now works on Gecko, over RDP or the agent bridge.
+
+### Added
+
+- `extension_list_extensions` works on Firefox-family sessions. It rides
+  the Remote Debugging Protocol root actor's `listAddons` over the
+  `rdpPort` the engine stamps into ready.json from extension.js 4.0.15
+  on (upstream entry 78). Entries list INSTALLED add-ons regardless of
+  live contexts, `temporarilyInstalled` marks temporary loads, and the
+  dev session's extension is flagged `ownExtension` by matching the
+  ready contract's identity (with a lone temporary install as the
+  fallback signal). Add-on targets are never attached to or evaluated
+  in; system and hidden add-ons are filtered out. Older engines get a
+  hint naming the 4.0.15 requirement instead of a generic failure. A
+  minimal RDP client (`src/lib/rdp.ts`) carries the handshake; legacy
+  RDP was chosen over WebDriver BiDi on purpose, since BiDi is
+  single-session and would block attaching alongside other consumers.
+- `extension_dom_inspect` listTargets works on Firefox: RDP tab
+  descriptors as `{actor,url,title,type}`, with the same two-id-space
+  warning as the CDP path (an actor id is not a chrome.tabs id).
+  Discovery therefore needs no allowControl on Gecko, unlike listTabs.
+- `extension_source_inspect` closes its four Gecko gaps. dom_snapshot
+  and extension_roots ride the bridge eval, embedding the same CDP page
+  scripts Chromium uses (the bridge html path also gained the
+  shadow-aware serializer, so open extension-root shadow content is in
+  the markup now). console rides the RDP watcher's cached-resource
+  replay (`getWatcher` with server target switching, then
+  watchResources; verified live that `getCachedMessages` is a dead end
+  on current Firefox), summarized in the same shape as the CDP console
+  buffer. deepDom walks CLOSED shadow roots through
+  `tabs.executeScript`, where Firefox exposes
+  `Element.openOrClosedShadowRoot` to content scripts, so it needs an
+  MV2 session with host permissions for the target url; a failed walk
+  reports why in `notes` instead of silently dropping the field.
+- MV2 page-eval fallback: the engine's page-context eval needs
+  chrome.scripting, an MV3-only API, so Firefox MV2 sessions reported
+  every bridge inspection as Unsupported. The inspect expression now
+  falls back to compiling in the tab's content-script sandbox via
+  `tabs.executeScript`, which reads the identical DOM; callers see the
+  same result shape on both paths.
+
+### Fixed
+
+- Act-verb CLI output over ~8KB no longer truncates. The engine CLI
+  exits without draining stdout, and the socketpair pipe Node hands a
+  child buffers about 8KB, so any larger `--output json` frame (a DOM
+  snapshot, a big html capture) arrived cut mid-JSON and surfaced as
+  "CliError: extension exited with code 0". The MCP now hands the child
+  file descriptors and reads them after exit, which no pipe buffer can
+  truncate. Filed upstream as extension.js ledger entry 79; the
+  workaround stays until the engine flushes before exiting.
+
+### Known limitation
+
+- Firefox MV3 sessions cannot use the bridge extras: the MV3 event page
+  CSP blocks the eval the control bridge dispatches through the
+  background, exactly like Chromium MV3 service workers. MV2 sessions
+  are fully covered via the executeScript fallback. The RDP paths
+  (list_extensions, listTargets, console) work on both manifest
+  versions.
+
+## 5.5.2
+
+Honest browser support wording ahead of the Safari lane landing.
+
+### Changed
+
+- The package description and README now say Safari is coming next
+  instead of listing it alongside the browsers that are store-ready
+  today. Chrome, Edge, Firefox, and every Chromium- or Gecko-based
+  browser remain fully supported; nothing changes functionally.
+
 ## 5.5.1
 
 The store journey stops being write-only after submit, and the token

package/README.md

@@ -26,7 +26,7 @@ Extensions fail silently: content scripts that never inject, panels that never o
 These tools give agents eyes on the live browser, so they debug from evidence instead of guessing:
 
 - **Scaffold** from the 60+ template catalog behind [templates.extension.dev](https://templates.extension.dev), or add a popup, sidebar, or content script to an existing project
-- **Run** the dev server with HMR in Chrome, Edge, Firefox, Safari, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary, no build config
+- **Run** the dev server with HMR in Chrome, Edge, Firefox, Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf, or any Chromium- or Gecko-based binary (Safari coming next), no build config
 - **See** the live DOM, unified logs from every extension context, `chrome.storage` contents, and the loaded-extension list
 - **Act**: evaluate code in any context, trigger the action button and commands, reload the extension, replay events
 - **Ship**: validate the manifest cross-browser, build for production, publish a shareable preview, and promote builds to release channels headlessly