@extension.dev/mcp 6.3.0 → 6.5.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.3.0",
+      "version": "6.5.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.3.0",
+  "version": "6.5.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,28 +1,115 @@
 # Changelog
 
-## 6.4.0
+## 6.5.0
+
+A link you shared is no longer only as findable as the response that created
+it. The shares you have made are now listable, and revocable, from the tool
+that made them.
+
+### Added
 
-A build on your machine can now become a link someone else can open.
+- **`extension_shares` lists and revokes the links you have shared.**
+  `share:true` hands back a public link, an `expiresAt` and a `revokeUrl`, and
+  until now the only copy of that `revokeUrl` was the tool response and the
+  project's own `.extension.dev/shared-previews.json`. Neither could say what
+  was actually still live, and neither existed at all for a link shared from
+  another machine. `action:"list"` (the default) asks the platform for every
+  artifact the logged-in project owns and returns each one's `artifactId`,
+  name, version, live or dead state, `createdAt`, `expiresAt`, `revokedAt`,
+  size, and its `previewUrl`, `zipUrl` and `revokeUrl`. `previewUrl` and
+  `zipUrl` come back null for anything no longer live, because a revoked or
+  expired address resolves for nobody and echoing it back would invite passing
+  on a dead link; `revokeUrl` stays on every row.
+- **`action:"revoke"` kills a link from where it was made.** It takes an
+  `artifactId` or, just as well, any URL of the share (`previewUrl`, `zipUrl`,
+  `viewUrl`, or `revokeUrl`), so the link you sent someone is enough to pull it
+  back without going to find a `curl` command. Revocation is permanent: the zip
+  is deleted and the id is burned, so a revoked link can never resolve again
+  and sharing the same build later mints a different one. The response says so
+  rather than reading like an undoable delete.
+- **The platform's answer is reconciled with the project's record.** Pass
+  `projectPath` and every listed share is matched against
+  `.extension.dev/shared-previews.json`: a share the project recorded carries
+  its local `sharedAt`, `browser` and `distDir`, a share the platform knows
+  about but the project does not is flagged `remoteOnly` (shared from another
+  machine or another checkout), and a local record with no artifact behind it
+  is reported under `localOnly`. The tool only ever reads that file, never
+  rewrites it, so its append-only history stays intact.
+- **A cut list is never passed off as the whole set.** When the platform
+  answers `truncated:true`, the response carries the count that came back
+  against the count that matched, says to raise `limit` or narrow with
+  `status:"live"`, and refuses to call a `localOnly` record dead, because a
+  share missing from a truncated list has not been shown to be gone.
 
 ### Changed
 
-- **`extension_preview_web` with `share:true` uploads the build you just
-  made.** It used to route sharing through `extension_publish`, which takes no
-  project path and uploads nothing: it flips a share link on whatever build the
-  token's project last pushed from its own CI. So the link rendered a different
-  build than the one on disk, and said so in a caveat. It now POSTs the resolved
-  `dist/<browser>` to the platform's artifact store and returns a
+- **A successful share now says where to find the link again.** The `share`
+  note and the `extension_preview_web` tool description both point at
+  `extension_shares`, at the moment the link exists and the question of how to
+  reach it later is about to come up.
+
+## 6.4.0
+
+A build on your machine can now become a link someone else can open, and the
+bundled Live Preview carrier finally allows the origin that opens it.
+
+### Added
+
+- **`extension_preview_web` renders an in-progress build in the web emulator.**
+  It builds the project, points `preview.extension.dev` at `dist/<browser>` over
+  the dev-only `preview://build` scheme, and returns a deep link plus a
+  loadability check against the preview dev server. `surface:"inspect"` renders
+  in `inspect.extension.dev` instead, for fixture and forensic work. This tool
+  reaches npm for the first time in this release.
+- **`share:true` uploads the build you just made.** It POSTs the resolved
+  `dist/<browser>` to the platform's artifact store and returns a public
   `preview.extension.dev` link that renders those exact bytes, for a recipient
-  with no install, no sign-in, and no dev server. `share.serves` reports
-  `uploaded-local-build`; the `requiredBackend` spec that described this as
-  missing is gone because it is built.
-- `share` now returns `expiresAt` and `revokeUrl`. Shared builds expire, and
-  `DELETE`ing `revokeUrl` with the same token kills the link immediately, which
-  is the part a TTL alone cannot do when a link reaches the wrong person.
-- The `channel` argument is removed from `extension_preview_web`. It only ever
-  selected which promoted CI build to render, and this tool no longer renders
-  promoted builds. `extension_publish` and `extension_release_promote` are
-  unchanged and remain the path for released, channel-scoped builds.
+  with no install, no sign-in, and no dev server. That link also serves the
+  whole build as a downloadable zip (`share.zipUrl`), so sharing it hands over
+  the built code. `share.serves` reports `uploaded-local-build`. Sharing needs a
+  token scoped to an existing extension.dev workspace and project
+  (`extension_login` or `EXTENSION_DEV_TOKEN`, valid up to 7 days), degrades to
+  a login hint when there is no token, and never fails the local preview.
+  `share` also returns `expiresAt` and `revokeUrl`: shared builds expire, and
+  `DELETE`ing `revokeUrl` with the same token kills the link for good, which is
+  the part a TTL alone cannot do when a link reaches the wrong person.
+- **A shared link's revoke handle survives losing the tool output.** Revocation
+  is permanent and re-sharing mints a new artifact id, so `share.revokeUrl` is
+  the only handle that can ever pull a given link, and losing it used to mean
+  waiting out the 30-day TTL. Every successful share is now appended to
+  `.extension.dev/shared-previews.json` in the project, next to the carrier's
+  own project-local state and gitignored the same way: one entry per share with
+  `previewUrl`, `artifactId`, `revokeUrl`, `expiresAt`, `zipUrl` and the time it
+  was shared. The list is only ever appended to, an unreadable file is kept
+  aside instead of overwritten, a write that fails never fails the share, and
+  the returned `share.record` and note say where the handle went. If the entry
+  cannot be added to `.gitignore`, the response says so.
+- **`extension_theme_verify` settles a Chrome theme manifest before it ships.**
+  It derives every color current Chrome would paint from the manifest with a
+  transcribed Chromium resolver and reports the divergence class of any problem:
+  D1 fabrication, D3 parity gap, D4 acceptance gap (keys Chrome silently
+  discards, such as dead legacy keys, incognito keys, unknown keys and
+  out-of-range values). The legs that need a real browser come back as
+  `needsAttended` with a pointer to the attended harnesses, never as passed.
+
+### Fixed
+
+- **The bundled Live Preview carrier reaches `preview.extension.dev`.** This
+  package ships the carrier prebuilt and `extension_dev` materializes it into
+  the project's `./extensions`, so the carrier only changes when the package
+  does. Its `externally_connectable` allowlist had no web preview origin, so a
+  page on `preview.extension.dev` could not talk to the carrier at all. 6.3.0
+  shipped without the fix.
+- The carrier popup requested `icons/icon.png` while the carrier build ships
+  `images/icon.png`, so the popup icon was broken.
+
+### Changed
+
+- `extension_preview_web` takes no `channel` argument. It renders the build on
+  disk, not a promoted CI build. `extension_publish` and
+  `extension_release_promote` are unchanged and remain the path for released,
+  channel-scoped builds.
+- The server advertises 35 tools, up from 33.
 
 ## 6.3.0
 

package/README.md

@@ -5,9 +5,11 @@
 [discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=26FFB8
 [discord-url]: https://discord.gg/v9h2RgeTSN
 
+<img alt="@extension.dev/mcp" src="https://media.extension.land/brand/repos/mcp/github-banner.png" />
+
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 33 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 35 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -118,6 +120,7 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | see | `extension_list_extensions` | List loaded extensions (Chromium) |
 | see | `extension_logs` | Stream logs from every context |
 | see | `extension_doctor` | Diagnose the dev session leg by leg (ready contract, ports, token, executor, browser) |
+| see | `extension_theme_verify` | Verify a Chrome theme manifest against the colors Chrome actually paints |
 | act | `extension_eval` | Evaluate in a context (needs `allowEval: true` on `extension_dev`) |
 | act | `extension_storage` | Read/write `chrome.storage` |
 | act | `extension_reload` | Reload extension or tab |
@@ -129,15 +132,25 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | platform | `extension_login` | GitHub device-code login, stored token |
 | platform | `extension_whoami` | Show the stored login (never the token) |
 | platform | `extension_logout` | Remove stored credentials |
+| platform | `extension_preview_web` | Render a build in the web emulator, and share it as a link |
+| platform | `extension_shares` | List every link you have shared, and revoke one permanently |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
 | platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores through extension.dev |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI, the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
+## Sharing a build in progress
+
+An unpacked extension is unusually hard to hand to someone: the only way to look at a colleague's work-in-progress has been to take their zip and run untrusted code with real browser permissions on your own machine. `extension_preview_web` with `share: true` uploads the `dist/` it just built and returns a link that renders those exact bytes in the emulator. Whoever opens it installs nothing and signs in to nothing, which is what lets a designer, a PM, or a reviewer into the loop at all. Sharing needs auth (`extension_login` or `EXTENSION_DEV_TOKEN`), the link expires, and `DELETE`ing the returned `revokeUrl` with the same token kills it early. Revocation is permanent and re-sharing mints a new link, so that `revokeUrl` is the only handle to the link you just made; every share is also appended to `.extension.dev/shared-previews.json` in the project (gitignored) so it survives losing the tool output. Without `share`, the tool returns a local-only deep link and uploads nothing.
+
+`extension_shares` is the other half of that: it lists every link the token has shared, live and dead, with the `previewUrl` and `revokeUrl` of each, and revokes one by `artifactId` or by pasting any of its URLs. Pass `projectPath` and it reconciles the platform's answer with the project's own record, so a link shared from another machine shows up as `remoteOnly` and a record with nothing behind it any more shows up under `localOnly`. It never rewrites the local file.
+
+That is a different job from shipping. Use `share` for the build you are holding right now; use `extension_publish` and `extension_release_promote` below for builds your CI has released.
+
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build into a shareable preview URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build your project has already published into a shareable URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
 
 ## The extension.dev stack
 

package/bin/extension-mcp.js

@@ -6,6 +6,7 @@
 // ██║ ╚═╝ ██║╚██████╗██║
 // ╚═╝     ╚═╝ ╚═════╝╚═╝
 // Apache License 2.0 (c) 2026 Cezar Augusto and the extension.dev collaborators
+
 import {startServer, runCli} from '../dist/module.js'
 
 const [, , cmd, ...rest] = process.argv