@extension.dev/mcp 5.7.0 → 6.1.0

package/dist/src/lib/carrier.d.ts

@@ -7,6 +7,7 @@
  * localhost) can then watch the session's real-lane trace and pair with it.
  */
 export declare const CARRIER_DIR_NAME = "extension-dev-live-preview";
+export declare const CARRIER_EXTENSION_ID = "ibppeifnekhjjjmpjfiobccjlicbmgcb";
 /** Where the carrier lands inside a project. */
 export declare function carrierPath(projectPath: string): string;
 /** True only for a directory carrying our marker, i.e. ours to delete. */
@@ -49,6 +50,17 @@ export type CarrierMaterialization = {
      * was written down anywhere the caller would look.
      */
     limitations?: string[];
+    /**
+     * The graduation path, stated next to the shared-identity limitation so the
+     * caller is not left at a dead end. The carrier lane is the SHARED real lane
+     * (calls run as the carrier); but the guest is ALREADY loaded as itself in
+     * this same session, so its OWN storage, identity and messaging are reached by
+     * driving the guest directly with the control verbs, not the carrier bridge.
+     * This is the agent-lane twin of the inspect Trace tab's "load as your own
+     * extension" affordance: here the extension is already loaded, so graduating
+     * means targeting it, not launching it.
+     */
+    graduation?: string;
     /**
      * How to actually DRIVE the real lane. Seven personas reached a
      * permanently empty trace and concluded the feature was broken, because

package/dist/src/lib/guest-load-oracle.d.ts

@@ -0,0 +1,27 @@
+export type GuestTarget = {
+    id: string;
+    type: string;
+    url: string;
+};
+export type GuestLoadCheck = {
+    checked: boolean;
+    loaded: boolean;
+    guestTargets: GuestTarget[];
+    guestIds: string[];
+    cdpPort?: number;
+    reason: string;
+};
+/**
+ * The BUGS_TO_FIX §83 oracle: ask the BROWSER whether the guest actually loaded,
+ * instead of trusting the engine's ready.json. Chrome refusing --load-extension
+ * is invisible to every engine surface (ready.json stamps status:ready, empty
+ * logs), so the only trustworthy "did the guest load" signal is a
+ * chrome-extension:// target in the browser's own CDP /json list. The engine's
+ * devtools companion is always present and is not the guest; a NON-companion
+ * extension target is. Never throws: an unreachable endpoint returns
+ * checked:false so callers can degrade instead of failing.
+ */
+export declare function verifyGuestLoaded(projectPath: string, browser: string, options?: {
+    waitMs?: number;
+    timeoutMs?: number;
+}): Promise<GuestLoadCheck>;

package/dist/src/lib/registry.d.ts

@@ -1,5 +1,17 @@
-export declare const REGISTRY_BASE_DEFAULT = "https://registry.extension.land";
-export declare const CONSOLE_BASE = "https://console.extension.dev";
+import { type Origins } from "./urls-origins";
+export declare const REGISTRY_BASE_DEFAULT: string;
+/**
+ * Resolve the fleet origins from the MCP's env vars, once per call. Console,
+ * registry, and media all DERIVE from the platform base (`EXTENSION_DEV_API_URL`
+ * or a per-tool `api`): point that at a local stack and every dashboard link the
+ * MCP hands back follows to the dev host (`console.extension.localhost`) instead
+ * of silently pointing at prod. Explicit per-host env vars still win. Falls back
+ * to production when nothing is set. The dev-derivation lives in
+ * `@extensiondev/urls` so it stays identical to what the apps resolve.
+ */
+export declare function mcpOrigins(apiHint?: string): Origins;
+/** Base origin of the console dashboard, dev-aware (no trailing slash). */
+export declare function consoleBase(apiHint?: string): string;
 export declare function registryBase(): string;
 export interface ProjectRef {
     workspace: string;
@@ -17,8 +29,14 @@ export declare function resolveProjectRef(overrides?: {
 }): ProjectRef | null;
 /** URL of a file under the project's `_extension-dev/` registry directory. */
 export declare function registryFileUrl(ref: ProjectRef, file: string): string;
-/** Console page URL for the project (builds, releases/new, stores, ...). */
-export declare function consoleProjectUrl(ref: ProjectRef | null, page: string): string;
+/**
+ * Console page URL for the project (builds, releases/new, stores, ...). The
+ * origin is dev-aware; the path comes from the shared route contract so a
+ * console route rename is caught in one place. Pass `apiHint` (a tool's `api`
+ * arg) so the link matches that call's environment; otherwise it follows
+ * `EXTENSION_DEV_API_URL`/`EXTENSION_DEV_CONSOLE_URL`.
+ */
+export declare function consoleProjectUrl(ref: ProjectRef | null, page: string, apiHint?: string): string;
 export type RegistryFetchResult<T> = {
     ok: true;
     json: T;

package/dist/src/lib/template-artifact-source.d.ts

@@ -0,0 +1,4 @@
+export declare const PINNED_COMMIT = "2d2ed9668cca002148d9eecd953a08b54d0bad9d";
+export declare function templateMetaUrls(): Promise<string[]>;
+export declare function stripTemplatePathPrefix(slug: string, relativePath: string): string;
+export declare function templateFileUrls(slug: string, relativePath: string): Promise<string[]>;

package/dist/src/lib/urls-origins.d.ts

@@ -0,0 +1,34 @@
+/** The set of app/service origins the fleet links between. */
+export interface Origins {
+    www: string;
+    console: string;
+    inspect: string;
+    templates: string;
+    intelligence: string;
+    /** Public release-state JSON host (registry.extension.land). */
+    registry: string;
+    /** Content-addressed template corpus host (media.extension.land). */
+    media: string;
+}
+/** Production origins. The prod fallback for every resolver in the fleet. */
+export declare const PROD_ORIGINS: Origins;
+export declare const DEV_LOCALHOST_ORIGINS: Origins;
+/**
+ * True for `localhost`, `127.0.0.1`, `[::1]`, or any `*.extension.localhost`
+ * host -- the shapes the dev proxy serves. Anything unparseable is treated as
+ * not-local so an odd value falls back to prod rather than leaking a dev host.
+ */
+export declare function isLocalOrigin(url: string | undefined | null): boolean;
+/**
+ * Resolve the full origin set from a caller's overrides.
+ *
+ * Precedence per origin: explicit override -> derived base (dev vs prod) ->
+ * prod. The base is chosen by whether the environment looks local: if any of
+ * `www`/`console`/`hint` points at a local host, unset origins derive from the
+ * Caddy dev map instead of prod. This is what lets an operator set only
+ * `EXTENSION_DEV_API_URL=http://localhost:3100` and still get a console link at
+ * `console.extension.localhost` rather than one that silently points at prod.
+ */
+export declare function resolveOrigins(overrides?: Partial<Origins>, opts?: {
+    hint?: string;
+}): Origins;

package/dist/src/lib/urls-paths.d.ts

@@ -0,0 +1,56 @@
+/** A project is addressed by its workspace slug + project slug across the fleet. */
+export interface ProjectRef {
+    workspace: string;
+    project: string;
+}
+/** `/:workspace` (or a sub-page like `settings` / `settings/:section`). */
+export declare function consoleWorkspacePath(workspace: string, page?: string): string;
+/**
+ * `/:workspace/:project/<page>`. Pass a page tail from `ConsoleProjectPage`
+ * (e.g. `ConsoleProjectPage.builds`) rather than hand-typing it, so a route
+ * rename is a one-line change here instead of a scattered string edit.
+ */
+export declare function consoleProjectPath(ref: ProjectRef, page?: string): string;
+/**
+ * Named project-page tails. Values are the exact segments under
+ * `/:username/:reponame/` in console's route table; deep pages take ids.
+ */
+export declare const ConsoleProjectPage: {
+    readonly overview: "";
+    readonly onboard: "onboard";
+    readonly activity: "activity";
+    readonly builds: "builds";
+    readonly build: (buildId: string, browser?: string) => string;
+    readonly releases: "releases";
+    readonly releasesNew: "releases/new";
+    readonly release: (releaseId: string) => string;
+    readonly stores: "stores";
+    readonly storesNew: "stores/new";
+    readonly store: (store: string) => string;
+    readonly storeSubmissions: (store: string) => string;
+    readonly storeSubmissionNew: (store: string) => string;
+    readonly storeSubmission: (store: string, submissionId: string) => string;
+    readonly projectSettings: "project-settings";
+    readonly projectSettingsSection: (section: string) => string;
+    /** Where CLI/MCP tokens are minted and revoked. */
+    readonly accessTokens: "settings/access-tokens";
+};
+export type QueryValue = string | number | boolean | null | undefined;
+/**
+ * `/new?...` -- project creation. The public deep-link contract: external
+ * READMEs use `extension.dev/new?template=<slug>`, which www normalizes to
+ * `/import` preserving every param. Do not change the `template` key.
+ */
+export declare function wwwNewPath(query?: Record<string, QueryValue>): string;
+/** `/import?...` -- the ported import/deploy flow templates' Deploy buttons target. */
+export declare function wwwImportPath(query?: Record<string, QueryValue>): string;
+/** `/device` -- CLI/MCP device-code consent. Lives on www, never console. */
+export declare function wwwDevicePath(): string;
+/** `/templates` and `/templates/:slug` -- externally linkable gallery entry on www. */
+export declare function wwwTemplatesPath(slug?: string): string;
+export type TemplateTab = "preview" | "instructions" | "source";
+/** `/:slug` for the default `preview` tab, else `/:slug/<tab>`. */
+export declare function templateTabPath(slug: string, tab?: TemplateTab): string;
+export type InspectTab = "preview" | "details" | "source" | "trace";
+/** `/` for the default `preview` tab, else `/details` / `/source` / `/trace`. */
+export declare function inspectTabPath(tab?: InspectTab): string;

package/dist/src/tools/open.d.ts

@@ -44,6 +44,7 @@ export declare const schema: {
         required: string[];
     };
 };
+export declare function sessionIsHeadless(): boolean;
 export declare function handler(args: ActArgs & {
     surface?: string;
     name?: string;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "5.7.0",
+  "version": "6.1.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 33 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",
@@ -42,7 +42,9 @@
     "server.json",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE",
+    "TRADEMARK.md"
   ],
   "scripts": {
     "clean": "rm -rf dist",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "5.7.0",
+  "version": "6.1.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "5.7.0",
+      "version": "6.1.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"