@extension.dev/mcp 6.0.0 → 6.2.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.0.0",
+      "version": "6.2.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.0.0",
+  "version": "6.2.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 6.2.0
+
+The URL layer stops being a copy. This server used to carry byte-identical
+vendored mirrors of the fleet's origin resolver and path builders, kept honest
+by a drift guard; it now depends on the published package instead.
+
+### Changed
+
+- **Depends on `@extension.dev/urls` instead of vendoring it.** The mirrors at
+  `lib/urls-origins.ts` and `lib/urls-paths.ts` are gone, and `registry.ts`,
+  `login-flow.ts`, and `create.ts` import the package directly. It is bundled
+  into `dist`, so the install footprint is unchanged: no new runtime
+  dependency, same standalone server.
+- **`preview.extension.dev` resolves like every other fleet origin.** `preview`
+  is now a first-class origin in the shared resolver, so `EXTENSION_DEV_PREVIEW_URL`
+  is honored and an unset preview host follows the same local-vs-prod signal as
+  console, inspect, and registry rather than defaulting to production.
+
+## 6.1.0
+
+The create flow stops dead-ending at `run dev` and points you to the web to
+host, template source resolves whichever path the catalog listed, and the
+links the server hands back ride the exact corpus commit it built from.
+
+### Added
+
+- **`extension_create` signposts the web deploy.** The result now carries a
+  `deployUrl` and a closing next step that says the scaffold runs locally and
+  where to open the template on the web to host it, so the local scaffold no
+  longer stops at `run dev` with nowhere to ship.
+- **`extension_create` names the template it chose.** When no `template` is
+  passed the response now discloses the silent default instead of quietly
+  scaffolding TypeScript, and points at `extension_list_templates` to pick
+  another.
+
+### Fixed
+
+- **`extension_get_template_source` resolves listed paths.** A file listed
+  with a leading `public/<slug>/` or `examples/<slug>/` prefix now strips to
+  the slug relative path both hosts actually serve, so passing back a listed
+  path no longer 404s.
+- **`extension_list_templates` keeps the vanilla template filterable.** The
+  relabel no longer drops the framework key the filter reads.
+- **`extension_add_feature` links ride the pinned corpus.** Feature links now
+  point at the pinned corpus commit instead of floating on `main`.
+
 ## 6.0.0
 
 The server moves to Apache-2.0, and the live-preview carrier stops living

package/dist/module.js

@@ -16,6 +16,223 @@ import node_http from "node:http";
 import node_net from "node:net";
 import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { promisify } from "node:util";
+__webpack_require__.add({
+    "./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/origins.cjs" (__unused_rspack_module, exports) {
+        var __nested_rspack_require_18_37__ = {};
+        (()=>{
+            __nested_rspack_require_18_37__.d = (exports1, definition)=>{
+                for(var key in definition)if (__nested_rspack_require_18_37__.o(definition, key) && !__nested_rspack_require_18_37__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                    enumerable: true,
+                    get: definition[key]
+                });
+            };
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.r = (exports1)=>{
+                if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+                    value: 'Module'
+                });
+                Object.defineProperty(exports1, '__esModule', {
+                    value: true
+                });
+            };
+        })();
+        var __nested_rspack_exports__ = {};
+        __nested_rspack_require_18_37__.r(__nested_rspack_exports__);
+        __nested_rspack_require_18_37__.d(__nested_rspack_exports__, {
+            DEV_LOCALHOST_ORIGINS: ()=>DEV_LOCALHOST_ORIGINS,
+            PROD_ORIGINS: ()=>PROD_ORIGINS,
+            isLocalOrigin: ()=>isLocalOrigin,
+            resolveOrigins: ()=>resolveOrigins
+        });
+        const PROD_ORIGINS = {
+            www: "https://www.extension.dev",
+            console: "https://console.extension.dev",
+            inspect: "https://inspect.extension.dev",
+            preview: "https://preview.extension.dev",
+            templates: "https://templates.extension.dev",
+            intelligence: "https://intelligence.extension.dev",
+            registry: "https://registry.extension.land",
+            media: "https://media.extension.land"
+        };
+        const DEV_LOCALHOST_ORIGINS = {
+            www: "http://localhost:3100",
+            console: "http://console.extension.localhost",
+            inspect: "http://inspect.extension.localhost",
+            preview: "http://preview.extension.localhost",
+            templates: "http://templates.extension.localhost",
+            intelligence: "http://intelligence.extension.localhost",
+            registry: "https://registry.extension.land",
+            media: "https://media.extension.land"
+        };
+        function strip(value) {
+            return String(value ?? "").trim().replace(/\/+$/, "");
+        }
+        function isLocalOrigin(url) {
+            const raw = strip(url);
+            if (!raw) return false;
+            let host;
+            try {
+                host = new URL(raw).hostname;
+            } catch  {
+                return false;
+            }
+            return "localhost" === host || "127.0.0.1" === host || "::1" === host || "[::1]" === host || "extension.localhost" === host || host.endsWith(".extension.localhost");
+        }
+        function resolveOrigins(overrides = {}, opts = {}) {
+            const devLike = isLocalOrigin(overrides.www) || isLocalOrigin(overrides.console) || isLocalOrigin(opts.hint);
+            const base = devLike ? DEV_LOCALHOST_ORIGINS : PROD_ORIGINS;
+            const pick = (key)=>strip(overrides[key]) || base[key];
+            return {
+                www: pick("www"),
+                console: pick("console"),
+                inspect: pick("inspect"),
+                preview: pick("preview"),
+                templates: pick("templates"),
+                intelligence: pick("intelligence"),
+                registry: pick("registry"),
+                media: pick("media")
+            };
+        }
+        exports.DEV_LOCALHOST_ORIGINS = __nested_rspack_exports__.DEV_LOCALHOST_ORIGINS;
+        exports.PROD_ORIGINS = __nested_rspack_exports__.PROD_ORIGINS;
+        exports.isLocalOrigin = __nested_rspack_exports__.isLocalOrigin;
+        exports.resolveOrigins = __nested_rspack_exports__.resolveOrigins;
+        for(var __webpack_i__ in __nested_rspack_exports__)if (-1 === [
+            "DEV_LOCALHOST_ORIGINS",
+            "PROD_ORIGINS",
+            "isLocalOrigin",
+            "resolveOrigins"
+        ].indexOf(__webpack_i__)) exports[__webpack_i__] = __nested_rspack_exports__[__webpack_i__];
+        Object.defineProperty(exports, "__esModule", {
+            value: true
+        });
+    },
+    "./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/paths.cjs" (__unused_rspack_module, exports) {
+        var __nested_rspack_require_18_37__ = {};
+        (()=>{
+            __nested_rspack_require_18_37__.d = (exports1, definition)=>{
+                for(var key in definition)if (__nested_rspack_require_18_37__.o(definition, key) && !__nested_rspack_require_18_37__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                    enumerable: true,
+                    get: definition[key]
+                });
+            };
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.r = (exports1)=>{
+                if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+                    value: 'Module'
+                });
+                Object.defineProperty(exports1, '__esModule', {
+                    value: true
+                });
+            };
+        })();
+        var __nested_rspack_exports__ = {};
+        __nested_rspack_require_18_37__.r(__nested_rspack_exports__);
+        __nested_rspack_require_18_37__.d(__nested_rspack_exports__, {
+            ConsoleProjectPage: ()=>ConsoleProjectPage,
+            consoleProjectPath: ()=>consoleProjectPath,
+            consoleWorkspacePath: ()=>consoleWorkspacePath,
+            inspectTabPath: ()=>inspectTabPath,
+            previewSharePath: ()=>previewSharePath,
+            templateTabPath: ()=>templateTabPath,
+            wwwDevicePath: ()=>wwwDevicePath,
+            wwwImportPath: ()=>wwwImportPath,
+            wwwNewPath: ()=>wwwNewPath,
+            wwwTemplatesPath: ()=>wwwTemplatesPath
+        });
+        const seg = (value)=>encodeURIComponent(String(value));
+        function join(base, sub) {
+            if (!sub) return base;
+            return `${base}/${sub.replace(/^\/+/, "")}`;
+        }
+        function consoleWorkspacePath(workspace, page = "") {
+            return join(`/${seg(workspace)}`, page);
+        }
+        function consoleProjectPath(ref, page = "") {
+            return join(`/${seg(ref.workspace)}/${seg(ref.project)}`, page);
+        }
+        const ConsoleProjectPage = {
+            overview: "",
+            onboard: "onboard",
+            activity: "activity",
+            builds: "builds",
+            build: (buildId, browser)=>browser ? `builds/${seg(buildId)}/${seg(browser)}` : `builds/${seg(buildId)}`,
+            releases: "releases",
+            releasesNew: "releases/new",
+            release: (releaseId)=>`releases/${seg(releaseId)}`,
+            stores: "stores",
+            storesNew: "stores/new",
+            store: (store)=>`stores/${seg(store)}`,
+            storeSubmissions: (store)=>`stores/${seg(store)}/submissions`,
+            storeSubmissionNew: (store)=>`stores/${seg(store)}/submissions/new`,
+            storeSubmission: (store, submissionId)=>`stores/${seg(store)}/submissions/${seg(submissionId)}`,
+            projectSettings: "project-settings",
+            projectSettingsSection: (section)=>`project-settings/${seg(section)}`,
+            accessTokens: "settings/access-tokens"
+        };
+        function withQuery(path, query) {
+            if (!query) return path;
+            const params = new URLSearchParams();
+            for (const [key, value] of Object.entries(query))if (null != value && "" !== value) params.set(key, String(value));
+            const qs = params.toString();
+            return qs ? `${path}?${qs}` : path;
+        }
+        function wwwNewPath(query) {
+            return withQuery("/new", query);
+        }
+        function wwwImportPath(query) {
+            return withQuery("/import", query);
+        }
+        function wwwDevicePath() {
+            return "/device";
+        }
+        function wwwTemplatesPath(slug) {
+            return slug ? `/templates/${seg(slug)}` : "/templates";
+        }
+        function templateTabPath(slug, tab = "preview") {
+            return "preview" === tab ? `/${seg(slug)}` : `/${seg(slug)}/${tab}`;
+        }
+        function inspectTabPath(tab = "preview") {
+            return "preview" === tab ? "/" : `/${tab}`;
+        }
+        function previewSharePath(previewId) {
+            return `/?preview=${seg(previewId)}`;
+        }
+        exports.ConsoleProjectPage = __nested_rspack_exports__.ConsoleProjectPage;
+        exports.consoleProjectPath = __nested_rspack_exports__.consoleProjectPath;
+        exports.consoleWorkspacePath = __nested_rspack_exports__.consoleWorkspacePath;
+        exports.inspectTabPath = __nested_rspack_exports__.inspectTabPath;
+        exports.previewSharePath = __nested_rspack_exports__.previewSharePath;
+        exports.templateTabPath = __nested_rspack_exports__.templateTabPath;
+        exports.wwwDevicePath = __nested_rspack_exports__.wwwDevicePath;
+        exports.wwwImportPath = __nested_rspack_exports__.wwwImportPath;
+        exports.wwwNewPath = __nested_rspack_exports__.wwwNewPath;
+        exports.wwwTemplatesPath = __nested_rspack_exports__.wwwTemplatesPath;
+        for(var __webpack_i__ in __nested_rspack_exports__)if (-1 === [
+            "ConsoleProjectPage",
+            "consoleProjectPath",
+            "consoleWorkspacePath",
+            "inspectTabPath",
+            "previewSharePath",
+            "templateTabPath",
+            "wwwDevicePath",
+            "wwwImportPath",
+            "wwwNewPath",
+            "wwwTemplatesPath"
+        ].indexOf(__webpack_i__)) exports[__webpack_i__] = __nested_rspack_exports__[__webpack_i__];
+        Object.defineProperty(exports, "__esModule", {
+            value: true
+        });
+    }
+});
 var add_feature_namespaceObject = {};
 __webpack_require__.r(add_feature_namespaceObject);
 __webpack_require__.d(add_feature_namespaceObject, {
@@ -222,7 +439,199 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"5.7.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+var package_namespaceObject = JSON.parse('{"rE":"6.1.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+function credentialsPath() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev", "auth.json");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev", "auth.json");
+}
+function readCredentials() {
+    try {
+        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const token = String(data.token || "").trim();
+        if (!token) return null;
+        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
+        return {
+            version: 1,
+            token,
+            workspaceSlug: String(data.workspaceSlug || ""),
+            projectSlug: String(data.projectSlug || ""),
+            expiresAt: Number(data.expiresAt || 0),
+            api: String(data.api || ""),
+            ...provider ? {
+                provider
+            } : {}
+        };
+    } catch  {
+        return null;
+    }
+}
+function writeCredentials(creds) {
+    const file = credentialsPath();
+    const dir = node_path.dirname(file);
+    node_fs.mkdirSync(dir, {
+        recursive: true,
+        mode: 448
+    });
+    try {
+        node_fs.chmodSync(dir, 448);
+    } catch  {}
+    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
+        mode: 384
+    });
+    try {
+        node_fs.chmodSync(file, 384);
+    } catch  {}
+    return file;
+}
+function clearCredentials() {
+    const file = credentialsPath();
+    try {
+        node_fs.unlinkSync(file);
+        return {
+            cleared: true,
+            path: file
+        };
+    } catch  {
+        return {
+            cleared: false,
+            path: file
+        };
+    }
+}
+function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
+    const creds = readCredentials();
+    if (!creds) return null;
+    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
+    return creds;
+}
+const origins = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/origins.cjs");
+const paths_0 = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/paths.cjs");
+origins.PROD_ORIGINS.registry;
+function mcpOrigins(apiHint) {
+    const www = String(apiHint || process.env.EXTENSION_DEV_API_URL || "").trim() || void 0;
+    return (0, origins.resolveOrigins)({
+        www,
+        console: process.env.EXTENSION_DEV_CONSOLE_URL,
+        inspect: process.env.EXTENSION_DEV_INSPECT_URL,
+        preview: process.env.EXTENSION_DEV_PREVIEW_URL,
+        registry: process.env.EXTENSION_DEV_REGISTRY_URL,
+        media: process.env.EXTENSION_MEDIA_ORIGIN
+    }, {
+        hint: www
+    });
+}
+function consoleBase(apiHint) {
+    return mcpOrigins(apiHint).console;
+}
+function registryBase() {
+    return mcpOrigins().registry;
+}
+function resolveProjectRef(overrides) {
+    const workspace = String(overrides?.workspace || "").trim();
+    const project = String(overrides?.project || "").trim();
+    if (workspace && project) return {
+        workspace,
+        project
+    };
+    const creds = readCredentials();
+    const ws = workspace || String(creds?.workspaceSlug || "").trim();
+    const proj = project || String(creds?.projectSlug || "").trim();
+    if (!ws || !proj) return null;
+    return {
+        workspace: ws,
+        project: proj
+    };
+}
+function registryFileUrl(ref, file) {
+    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
+}
+function consoleProjectUrl(ref, page, apiHint) {
+    const base = consoleBase(apiHint);
+    if (!ref) return base;
+    return `${base}${(0, paths_0.consoleProjectPath)(ref, page)}`;
+}
+async function fetchRegistryJson(url, fetchImpl = fetch) {
+    let res;
+    try {
+        res = await fetchImpl(url);
+    } catch (err) {
+        return {
+            ok: false,
+            message: `Could not reach ${url}: ${err?.message || err}`
+        };
+    }
+    if (!res.ok) return {
+        ok: false,
+        status: res.status,
+        message: `${url} returned ${res.status}`
+    };
+    try {
+        const text = await res.text();
+        return {
+            ok: true,
+            json: JSON.parse(text)
+        };
+    } catch  {
+        return {
+            ok: false,
+            message: `${url} did not return valid JSON`
+        };
+    }
+}
+function parseChannels(json) {
+    if (!json || "object" != typeof json || Array.isArray(json)) return [];
+    const out = [];
+    for (const [channel, raw] of Object.entries(json)){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const description = "string" == typeof row.description ? row.description : void 0;
+        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
+        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
+        const entry = {
+            channel,
+            sha: String(row.sha ?? "")
+        };
+        if (row.buildId) entry.buildId = String(row.buildId);
+        if (row.version) entry.version = String(row.version);
+        const promotedAt = promotedAtField || fromDescription;
+        if (promotedAt) entry.promotedAt = promotedAt;
+        if (description) entry.description = description;
+        out.push(entry);
+    }
+    return out;
+}
+function parseBuildIndex(json) {
+    const items = json?.items;
+    if (!Array.isArray(items)) return [];
+    const out = [];
+    for (const raw of items){
+        if (!raw || "object" != typeof raw) continue;
+        const row = raw;
+        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
+        if (!sha) continue;
+        const entry = {
+            sha
+        };
+        if (row.commit) entry.commit = String(row.commit);
+        if (row.channel) entry.channel = String(row.channel);
+        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
+        if (row.status) entry.status = String(row.status);
+        if (row.version) entry.version = String(row.version);
+        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
+        if (row.timestamp) entry.timestamp = String(row.timestamp);
+        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
+        out.push(entry);
+    }
+    return out;
+}
 function scaffoldEnginePin(projectPath) {
     try {
         const pkg = JSON.parse(node_fs.readFileSync(node_path.join(projectPath, "package.json"), "utf8"));
@@ -359,6 +768,10 @@ async function create_handler(args) {
     const engineWarning = pin && "latest" !== pin && !pinMatches ? `The scaffold pins "extension": "${scaffoldPin ?? "unknown"}"; the project-local engine wins over EXTENSION_MCP_CLI_VERSION=${pin}. Run \`(cd ${result.projectPath} && ${addDev(`extension@${pin}`)})\` to match the pinned engine.` : void 0;
     const resolvedParent = args.parentDir ? node_path.resolve(args.parentDir) : process.cwd();
     const gitInit = node_fs.existsSync(node_path.join(result.projectPath, ".git"));
+    const wwwOrigin = mcpOrigins().www;
+    const deployUrl = `${wwwOrigin}${(0, paths_0.wwwNewPath)({
+        template: result.template
+    })}`;
     return JSON.stringify({
         resolvedPath: result.projectPath,
         projectPath: result.projectPath,
@@ -366,20 +779,27 @@ async function create_handler(args) {
         template: result.template,
         depsInstalled: result.depsInstalled,
         packageManager: result.depsInstalled ? packageManager : null,
+        deployUrl,
         defaultsApplied: {
             parentDir: args.parentDir ? `${resolvedParent} (explicit)` : `${resolvedParent} (default: the MCP server process cwd, not yours; pass parentDir to choose)`,
+            ...void 0 === args.template ? {
+                template: "typescript (default; run extension_list_templates to pick another, e.g. javascript for plain JS)"
+            } : {},
             packageManager: `${packageManager} (auto-detected by the scaffolder, not asked)`,
             browser: "chrome (default: extension_dev and extension_build target chrome unless you pass browser)",
             gitInit
         },
         duration: Date.now() - start,
-        nextSteps: result.depsInstalled ? [
-            `cd ${result.projectPath}`,
-            runDev
-        ] : [
-            `cd ${result.projectPath}`,
-            `${packageManager} install`,
-            runDev
+        nextSteps: [
+            ...result.depsInstalled ? [
+                `cd ${result.projectPath}`,
+                runDev
+            ] : [
+                `cd ${result.projectPath}`,
+                `${packageManager} install`,
+                runDev
+            ],
+            `To ship: extension_create scaffolds and runs locally, it does not host. Open ${deployUrl} to deploy this template to the web.`
         ],
         ...engineWarning ? {
             engineWarning
@@ -458,11 +878,22 @@ async function templateMetaUrls() {
     urls.push(`${rawBaseForCommit(PINNED_COMMIT)}/templates-meta.json`);
     return urls;
 }
+function stripTemplatePathPrefix(slug, relativePath) {
+    for (const dir of [
+        "public",
+        "examples"
+    ]){
+        const prefix = `${dir}/${slug}/`;
+        if (relativePath.startsWith(prefix)) return relativePath.slice(prefix.length);
+    }
+    return relativePath;
+}
 async function templateFileUrls(slug, relativePath) {
+    const relative = stripTemplatePathPrefix(slug, relativePath);
     const urls = [];
     const release = await resolveRelease();
-    if (release) urls.push(`${release.filesBaseUrl}/${slug}/${relativePath}`);
-    urls.push(`${rawBaseForCommit(PINNED_COMMIT)}/examples/${slug}/${relativePath}`);
+    if (release) urls.push(`${release.filesBaseUrl}/${slug}/${relative}`);
+    urls.push(`${rawBaseForCommit(PINNED_COMMIT)}/examples/${slug}/${relative}`);
     return urls;
 }
 const CACHE_DIR = node_path.join(node_os.homedir(), ".cache", "extension-js");
@@ -606,7 +1037,8 @@ async function list_templates_handler(args) {
     const results = templates.map((t)=>({
             slug: t.slug,
             description: t.description,
-            uiFramework: t.uiFramework || "vanilla",
+            uiFramework: t.uiFramework,
+            frameworkLabel: t.uiFramework || "vanilla",
             surfaces: t.surfaces,
             tags: t.tags,
             difficulty: t.difficulty,
@@ -2219,7 +2651,7 @@ async function get_template_source_handler(args) {
     };
     if (!args.files?.length) return JSON.stringify({
         ...meta,
-        files: template.files,
+        files: template.files.map((f)=>stripTemplatePathPrefix(template.slug, f)),
         hint: "Pass specific file paths in the files parameter to read their contents."
     });
     const fileContents = {};
@@ -5773,250 +6205,7 @@ async function dom_inspect_handler(args) {
         return raw;
     }
 }
-function credentialsPath() {
-    if ("win32" === process.platform) {
-        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
-        return node_path.join(base, "extension-dev", "auth.json");
-    }
-    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
-    const base = xdg || node_path.join(node_os.homedir(), ".config");
-    return node_path.join(base, "extension-dev", "auth.json");
-}
-function readCredentials() {
-    try {
-        const raw = node_fs.readFileSync(credentialsPath(), "utf8");
-        const data = JSON.parse(raw);
-        if (!data || "object" != typeof data) return null;
-        if (1 !== data.version) return null;
-        const token = String(data.token || "").trim();
-        if (!token) return null;
-        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
-        return {
-            version: 1,
-            token,
-            workspaceSlug: String(data.workspaceSlug || ""),
-            projectSlug: String(data.projectSlug || ""),
-            expiresAt: Number(data.expiresAt || 0),
-            api: String(data.api || ""),
-            ...provider ? {
-                provider
-            } : {}
-        };
-    } catch  {
-        return null;
-    }
-}
-function writeCredentials(creds) {
-    const file = credentialsPath();
-    const dir = node_path.dirname(file);
-    node_fs.mkdirSync(dir, {
-        recursive: true,
-        mode: 448
-    });
-    try {
-        node_fs.chmodSync(dir, 448);
-    } catch  {}
-    node_fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", {
-        mode: 384
-    });
-    try {
-        node_fs.chmodSync(file, 384);
-    } catch  {}
-    return file;
-}
-function clearCredentials() {
-    const file = credentialsPath();
-    try {
-        node_fs.unlinkSync(file);
-        return {
-            cleared: true,
-            path: file
-        };
-    } catch  {
-        return {
-            cleared: false,
-            path: file
-        };
-    }
-}
-function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
-    const creds = readCredentials();
-    if (!creds) return null;
-    if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
-    return creds;
-}
-const PROD_ORIGINS = {
-    www: "https://www.extension.dev",
-    console: "https://console.extension.dev",
-    inspect: "https://inspect.extension.dev",
-    templates: "https://templates.extension.dev",
-    intelligence: "https://intelligence.extension.dev",
-    registry: "https://registry.extension.land",
-    media: "https://media.extension.land"
-};
-const DEV_LOCALHOST_ORIGINS = {
-    www: "http://localhost:3100",
-    console: "http://console.extension.localhost",
-    inspect: "http://inspect.extension.localhost",
-    templates: "http://templates.extension.localhost",
-    intelligence: "http://intelligence.extension.localhost",
-    registry: "https://registry.extension.land",
-    media: "https://media.extension.land"
-};
-function strip(value) {
-    return String(value ?? "").trim().replace(/\/+$/, "");
-}
-function isLocalOrigin(url) {
-    const raw = strip(url);
-    if (!raw) return false;
-    let host;
-    try {
-        host = new URL(raw).hostname;
-    } catch  {
-        return false;
-    }
-    return "localhost" === host || "127.0.0.1" === host || "::1" === host || "[::1]" === host || "extension.localhost" === host || host.endsWith(".extension.localhost");
-}
-function resolveOrigins(overrides = {}, opts = {}) {
-    const devLike = isLocalOrigin(overrides.www) || isLocalOrigin(overrides.console) || isLocalOrigin(opts.hint);
-    const base = devLike ? DEV_LOCALHOST_ORIGINS : PROD_ORIGINS;
-    const pick = (key)=>strip(overrides[key]) || base[key];
-    return {
-        www: pick("www"),
-        console: pick("console"),
-        inspect: pick("inspect"),
-        templates: pick("templates"),
-        intelligence: pick("intelligence"),
-        registry: pick("registry"),
-        media: pick("media")
-    };
-}
-const seg = (value)=>encodeURIComponent(String(value));
-function urls_paths_join(base, sub) {
-    if (!sub) return base;
-    return `${base}/${sub.replace(/^\/+/, "")}`;
-}
-function consoleProjectPath(ref, page = "") {
-    return urls_paths_join(`/${seg(ref.workspace)}/${seg(ref.project)}`, page);
-}
-PROD_ORIGINS.registry;
-function mcpOrigins(apiHint) {
-    const www = String(apiHint || process.env.EXTENSION_DEV_API_URL || "").trim() || void 0;
-    return resolveOrigins({
-        www,
-        console: process.env.EXTENSION_DEV_CONSOLE_URL,
-        inspect: process.env.EXTENSION_DEV_INSPECT_URL,
-        registry: process.env.EXTENSION_DEV_REGISTRY_URL,
-        media: process.env.EXTENSION_MEDIA_ORIGIN
-    }, {
-        hint: www
-    });
-}
-function consoleBase(apiHint) {
-    return mcpOrigins(apiHint).console;
-}
-function registryBase() {
-    return mcpOrigins().registry;
-}
-function resolveProjectRef(overrides) {
-    const workspace = String(overrides?.workspace || "").trim();
-    const project = String(overrides?.project || "").trim();
-    if (workspace && project) return {
-        workspace,
-        project
-    };
-    const creds = readCredentials();
-    const ws = workspace || String(creds?.workspaceSlug || "").trim();
-    const proj = project || String(creds?.projectSlug || "").trim();
-    if (!ws || !proj) return null;
-    return {
-        workspace: ws,
-        project: proj
-    };
-}
-function registryFileUrl(ref, file) {
-    return `${registryBase()}/${encodeURIComponent(ref.workspace)}/${encodeURIComponent(ref.project)}/_extension-dev/${file}`;
-}
-function consoleProjectUrl(ref, page, apiHint) {
-    const base = consoleBase(apiHint);
-    if (!ref) return base;
-    return `${base}${consoleProjectPath(ref, page)}`;
-}
-async function fetchRegistryJson(url, fetchImpl = fetch) {
-    let res;
-    try {
-        res = await fetchImpl(url);
-    } catch (err) {
-        return {
-            ok: false,
-            message: `Could not reach ${url}: ${err?.message || err}`
-        };
-    }
-    if (!res.ok) return {
-        ok: false,
-        status: res.status,
-        message: `${url} returned ${res.status}`
-    };
-    try {
-        const text = await res.text();
-        return {
-            ok: true,
-            json: JSON.parse(text)
-        };
-    } catch  {
-        return {
-            ok: false,
-            message: `${url} did not return valid JSON`
-        };
-    }
-}
-function parseChannels(json) {
-    if (!json || "object" != typeof json || Array.isArray(json)) return [];
-    const out = [];
-    for (const [channel, raw] of Object.entries(json)){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const description = "string" == typeof row.description ? row.description : void 0;
-        const promotedAtField = "string" == typeof row.promotedAt && row.promotedAt ? row.promotedAt : void 0;
-        const fromDescription = description?.match(/\bon (\d{4}-\d{2}-\d{2}T[0-9:.]+Z?)/)?.[1];
-        const entry = {
-            channel,
-            sha: String(row.sha ?? "")
-        };
-        if (row.buildId) entry.buildId = String(row.buildId);
-        if (row.version) entry.version = String(row.version);
-        const promotedAt = promotedAtField || fromDescription;
-        if (promotedAt) entry.promotedAt = promotedAt;
-        if (description) entry.description = description;
-        out.push(entry);
-    }
-    return out;
-}
-function parseBuildIndex(json) {
-    const items = json?.items;
-    if (!Array.isArray(items)) return [];
-    const out = [];
-    for (const raw of items){
-        if (!raw || "object" != typeof raw) continue;
-        const row = raw;
-        const sha = String(row.shortSha ?? row.sha ?? row.id ?? row.buildId ?? "").trim();
-        if (!sha) continue;
-        const entry = {
-            sha
-        };
-        if (row.commit) entry.commit = String(row.commit);
-        if (row.channel) entry.channel = String(row.channel);
-        if (row.buildEnv) entry.buildEnv = String(row.buildEnv);
-        if (row.status) entry.status = String(row.status);
-        if (row.version) entry.version = String(row.version);
-        if ("string" == typeof row.message) entry.message = row.message.split("\n", 1)[0];
-        if (row.timestamp) entry.timestamp = String(row.timestamp);
-        if (Array.isArray(row.browsers)) entry.browsers = row.browsers.map((b)=>String(b)).filter(Boolean);
-        out.push(entry);
-    }
-    return out;
-}
-const DEFAULT_API = PROD_ORIGINS.www;
+const DEFAULT_API = origins.PROD_ORIGINS.www;
 function tokenTtlNote(workspaceSlug, projectSlug) {
     const tokensUrl = workspaceSlug && projectSlug ? consoleProjectUrl({
         workspace: workspaceSlug,
@@ -7263,6 +7452,7 @@ async function wait_handler(args) {
         hint: "Still building, call extension_wait again to keep waiting (it resumes polling the same contract). If it never readies, check the dev process with extension_doctor."
     });
 }
+const EXAMPLES_TREE_BASE = `https://github.com/extension-js/examples/tree/${PINNED_COMMIT}/examples`;
 const add_feature_schema = {
     name: "extension_add_feature",
     description: "Plan a new feature surface for an existing extension. Returns step-by-step instructions, the manifest additions to make, and reference templates from the extension.dev catalog. Does not modify files; apply the returned plan yourself.",
@@ -7506,7 +7696,7 @@ async function add_feature_handler(args) {
         framework,
         referenceTemplate: {
             slug: templateSlug,
-            repositoryUrl: `https://github.com/extension-js/examples/tree/main/examples/${templateSlug}`,
+            repositoryUrl: `${EXAMPLES_TREE_BASE}/${templateSlug}`,
             referenceFiles: referenceFiles.filter((f)=>f.includes(featureDir) || f.includes("manifest"))
         },
         manifestUpdates,
@@ -7520,7 +7710,7 @@ async function add_feature_handler(args) {
             "2. Create the following files in your project:",
             ...filesToCreate.map((f)=>`   - ${f.path} (${f.hint})`),
             "sidebar" === args.feature ? "3. Add background.ts to handle sidebar open: chromium uses chrome.sidePanel.setPanelBehavior, firefox uses browser.sidebarAction.open()" : "",
-            `4. Reference template source: https://github.com/extension-js/examples/tree/main/examples/${templateSlug}/src`,
+            `4. Reference template source: ${EXAMPLES_TREE_BASE}/${templateSlug}/src`,
             "5. Run npm run dev to test"
         ].filter(Boolean),
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."

package/dist/rslib-runtime.js

@@ -1,3 +1,4 @@
+var __webpack_modules__ = {};
 var __webpack_module_cache__ = {};
 function __webpack_require__(moduleId) {
     var cachedModule = __webpack_module_cache__[moduleId];
@@ -8,6 +9,7 @@ function __webpack_require__(moduleId) {
     __webpack_modules__[moduleId](module, module.exports, __webpack_require__);
     return module.exports;
 }
+__webpack_require__.m = __webpack_modules__;
 (()=>{
     __webpack_require__.add = function(modules) {
         Object.assign(__webpack_require__.m, modules);

package/dist/src/lib/registry.d.ts

@@ -1,4 +1,4 @@
-import { type Origins } from "./urls-origins";
+import { type Origins } from "@extension.dev/urls/origins";
 export declare const REGISTRY_BASE_DEFAULT: string;
 /**
  * Resolve the fleet origins from the MCP's env vars, once per call. Console,
@@ -7,7 +7,7 @@ export declare const REGISTRY_BASE_DEFAULT: string;
  * MCP hands back follows to the dev host (`console.extension.localhost`) instead
  * of silently pointing at prod. Explicit per-host env vars still win. Falls back
  * to production when nothing is set. The dev-derivation lives in
- * `@extensiondev/urls` so it stays identical to what the apps resolve.
+ * `@extension.dev/urls` so it stays identical to what the apps resolve.
  */
 export declare function mcpOrigins(apiHint?: string): Origins;
 /** Base origin of the console dashboard, dev-aware (no trailing slash). */

package/dist/src/lib/template-artifact-source.d.ts

@@ -1,2 +1,4 @@
+export declare const PINNED_COMMIT = "2d2ed9668cca002148d9eecd953a08b54d0bad9d";
 export declare function templateMetaUrls(): Promise<string[]>;
+export declare function stripTemplatePathPrefix(slug: string, relativePath: string): string;
 export declare function templateFileUrls(slug: string, relativePath: string): Promise<string[]>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "6.0.0",
+  "version": "6.2.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 33 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",
@@ -97,6 +97,7 @@
     "ws": "^8.20.0"
   },
   "devDependencies": {
+    "@extension.dev/urls": "^0.2.0",
     "@rslib/core": "^0.19.4",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^25.2.0",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "6.0.0",
+  "version": "6.2.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "6.0.0",
+      "version": "6.2.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/dist/src/lib/urls-origins.d.ts

@@ -1,34 +0,0 @@
-/** The set of app/service origins the fleet links between. */
-export interface Origins {
-    www: string;
-    console: string;
-    inspect: string;
-    templates: string;
-    intelligence: string;
-    /** Public release-state JSON host (registry.extension.land). */
-    registry: string;
-    /** Content-addressed template corpus host (media.extension.land). */
-    media: string;
-}
-/** Production origins. The prod fallback for every resolver in the fleet. */
-export declare const PROD_ORIGINS: Origins;
-export declare const DEV_LOCALHOST_ORIGINS: Origins;
-/**
- * True for `localhost`, `127.0.0.1`, `[::1]`, or any `*.extension.localhost`
- * host -- the shapes the dev proxy serves. Anything unparseable is treated as
- * not-local so an odd value falls back to prod rather than leaking a dev host.
- */
-export declare function isLocalOrigin(url: string | undefined | null): boolean;
-/**
- * Resolve the full origin set from a caller's overrides.
- *
- * Precedence per origin: explicit override -> derived base (dev vs prod) ->
- * prod. The base is chosen by whether the environment looks local: if any of
- * `www`/`console`/`hint` points at a local host, unset origins derive from the
- * Caddy dev map instead of prod. This is what lets an operator set only
- * `EXTENSION_DEV_API_URL=http://localhost:3100` and still get a console link at
- * `console.extension.localhost` rather than one that silently points at prod.
- */
-export declare function resolveOrigins(overrides?: Partial<Origins>, opts?: {
-    hint?: string;
-}): Origins;

package/dist/src/lib/urls-paths.d.ts

@@ -1,56 +0,0 @@
-/** A project is addressed by its workspace slug + project slug across the fleet. */
-export interface ProjectRef {
-    workspace: string;
-    project: string;
-}
-/** `/:workspace` (or a sub-page like `settings` / `settings/:section`). */
-export declare function consoleWorkspacePath(workspace: string, page?: string): string;
-/**
- * `/:workspace/:project/<page>`. Pass a page tail from `ConsoleProjectPage`
- * (e.g. `ConsoleProjectPage.builds`) rather than hand-typing it, so a route
- * rename is a one-line change here instead of a scattered string edit.
- */
-export declare function consoleProjectPath(ref: ProjectRef, page?: string): string;
-/**
- * Named project-page tails. Values are the exact segments under
- * `/:username/:reponame/` in console's route table; deep pages take ids.
- */
-export declare const ConsoleProjectPage: {
-    readonly overview: "";
-    readonly onboard: "onboard";
-    readonly activity: "activity";
-    readonly builds: "builds";
-    readonly build: (buildId: string, browser?: string) => string;
-    readonly releases: "releases";
-    readonly releasesNew: "releases/new";
-    readonly release: (releaseId: string) => string;
-    readonly stores: "stores";
-    readonly storesNew: "stores/new";
-    readonly store: (store: string) => string;
-    readonly storeSubmissions: (store: string) => string;
-    readonly storeSubmissionNew: (store: string) => string;
-    readonly storeSubmission: (store: string, submissionId: string) => string;
-    readonly projectSettings: "project-settings";
-    readonly projectSettingsSection: (section: string) => string;
-    /** Where CLI/MCP tokens are minted and revoked. */
-    readonly accessTokens: "settings/access-tokens";
-};
-export type QueryValue = string | number | boolean | null | undefined;
-/**
- * `/new?...` -- project creation. The public deep-link contract: external
- * READMEs use `extension.dev/new?template=<slug>`, which www normalizes to
- * `/import` preserving every param. Do not change the `template` key.
- */
-export declare function wwwNewPath(query?: Record<string, QueryValue>): string;
-/** `/import?...` -- the ported import/deploy flow templates' Deploy buttons target. */
-export declare function wwwImportPath(query?: Record<string, QueryValue>): string;
-/** `/device` -- CLI/MCP device-code consent. Lives on www, never console. */
-export declare function wwwDevicePath(): string;
-/** `/templates` and `/templates/:slug` -- externally linkable gallery entry on www. */
-export declare function wwwTemplatesPath(slug?: string): string;
-export type TemplateTab = "preview" | "instructions" | "source";
-/** `/:slug` for the default `preview` tab, else `/:slug/<tab>`. */
-export declare function templateTabPath(slug: string, tab?: TemplateTab): string;
-export type InspectTab = "preview" | "details" | "source" | "trace";
-/** `/` for the default `preview` tab, else `/details` / `/source` / `/trace`. */
-export declare function inspectTabPath(tab?: InspectTab): string;