@extension.dev/mcp 6.5.0 → 6.6.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.5.0",
+      "version": "6.6.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 6.6.0
+
+A shared build belongs to the project that owns it, not to whoever happened to
+press publish. `extension_shares` now says which of the two it is looking at,
+and it names the publisher without ever inventing one.
+
+### Added
+
+- **Every listed share carries its owner and its publisher.** The platform now
+  returns `owner` and `sharedBy` on each row and both come through untouched,
+  alongside an `attribution` block that reads them. `attribution.ownership` is
+  `"project"` when the owning workspace holds the share, `"personal"` when one
+  person holds it alone, and `"unknown"` when the platform disclosed no owner.
+  `attribution.ownerPath` gives the owning `workspace/project` for a project
+  share. Ownership is read off `owner` and never off the publisher, because the
+  owner is what decides who may revoke a share and the publisher is only who
+  made it.
+- **`attribution.revocableBy` says who can actually pull the link back.** A
+  project share is revocable by any member of the owning workspace and by any
+  token scoped to the owning project. A personal share belongs to one person,
+  so nobody else can see it or revoke it and a project token cannot touch it.
+  Knowing which of the two you are holding is the difference between a revoke
+  that will work and a 404 that reads like a bug.
+- **`server.ownership` counts the listed shares by owner.** Project, personal
+  and unknown, so a list can be reasoned about without walking every row.
+
+### Changed
+
+- **A publisher is never guessed.** `attribution.credit` is the GitHub login
+  when the platform resolved one. When a share was made by a CLI token whose
+  issuer could not be resolved it reads `CLI token <id>`, which is exactly what
+  the credential itself proves, and a share made before attribution existed
+  reads as not recorded. The workspace slug, the project slug and the owner are
+  never substituted for a name, because naming a team where a human is expected
+  attributes the share to whoever the reader takes that team to be.
+  `attribution.creditSource` says which of the three it was.
+- **Attribution is stated as attribution.** The response spells out that
+  `sharedBy` records who published a share and grants and restricts nothing, so
+  it is not read as a permission.
+- **A truncated list is more explicit about why.** `truncated` also goes true
+  when the platform spends its budget working out which shares the caller is
+  entitled to see, so the note now says `matched` is a floor rather than a
+  total.
+- **Revoking a share the token does not own explains the personal case.** The
+  404 message already covered a different project and an already dead link; it
+  now also names a teammate's personal share, which no project token can
+  revoke.
+
 ## 6.5.0
 
 A link you shared is no longer only as findable as the response that created

package/dist/module.js

@@ -5028,7 +5028,7 @@ async function revokeArtifact(options) {
         error: {
             name: "SharesNotFoundError",
             status: 404,
-            message: `The platform has no live share ${options.artifactId} for this token. It may already be revoked, already expired, or owned by a different project than the one this token is scoped to.`
+            message: `The platform has no live share ${options.artifactId} for this token. It may already be revoked, already expired, owned by a different project than the one this token is scoped to, or a teammate's personal share, which belongs to that person alone and no project token can revoke.`
         }
     };
     if (!res.ok) return {
@@ -5053,7 +5053,7 @@ async function revokeArtifact(options) {
 const LOGIN_HINT = "Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).";
 const shares_schema = {
     name: "extension_shares",
-    description: "List and revoke the public preview links this token has shared (the links extension_preview_web share:true hands out). action:\"list\" (default) asks the platform for every artifact owned by the logged-in project and returns each one's artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, and its previewUrl, zipUrl and revokeUrl, so a link you lost the response for is findable again. action:\"revoke\" kills one by artifactId or by pasting any of its URLs; revocation is PERMANENT (the id is burned and re-sharing mints a different link), so it cannot be undone. Pass projectPath to reconcile the platform's answer with .extension.dev/shared-previews.json, the project's own append-only record: a share made on another machine shows up as remoteOnly, and a record with no live artifact behind it shows up under localOnly. Needs the same token as sharing (extension_login or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint instead of failing. Read-only for the local file: this tool never rewrites shared-previews.json.",
+    description: "List and revoke the public preview links this token has shared (the links extension_preview_web share:true hands out). action:\"list\" (default) asks the platform for every artifact owned by the logged-in project and returns each one's artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, and its previewUrl, zipUrl and revokeUrl, so a link you lost the response for is findable again. Every row also carries owner and sharedBy as the platform returned them, plus an attribution block: attribution.ownership is \"project\" when the owning workspace holds the share and any member can revoke it, \"personal\" when one person holds it alone and nobody else can, and \"unknown\" when the platform disclosed no owner. attribution.credit names the publisher for credit only and never decides access; it reads \"CLI token <id>\" when the token's issuer could not be resolved and \"not recorded\" for a share made before attribution existed, and neither is a person's name. action:\"revoke\" kills one by artifactId or by pasting any of its URLs; revocation is PERMANENT (the id is burned and re-sharing mints a different link), so it cannot be undone. Pass projectPath to reconcile the platform's answer with .extension.dev/shared-previews.json, the project's own append-only record: a share made on another machine shows up as remoteOnly, and a record with no live artifact behind it shows up under localOnly. Needs the same token as sharing (extension_login or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint instead of failing. Read-only for the local file: this tool never rewrites shared-previews.json.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5099,6 +5099,52 @@ const shares_schema = {
         required: []
     }
 };
+const REVOCABLE_BY = {
+    project: "Any member of the owning workspace, and any token scoped to the owning project, can revoke this share.",
+    personal: "This is one person's personal share. Only that person can see it and revoke it, so a project token cannot pull it back.",
+    unknown: "The platform did not disclose an owner for this share, so who may revoke it cannot be stated here."
+};
+function shares_text(value) {
+    return "string" == typeof value ? value.trim() : "";
+}
+function ownershipOf(owner) {
+    const kind = shares_text(owner?.kind);
+    if ("project" === kind) return "project";
+    if ("user" === kind) return "personal";
+    return "unknown";
+}
+function creditOf(sharedBy) {
+    const login = shares_text(sharedBy?.login);
+    if (login) return {
+        credit: login,
+        creditSource: "login"
+    };
+    const tokenId = shares_text(sharedBy?.tokenId);
+    if (tokenId) return {
+        credit: `CLI token ${tokenId}`,
+        creditSource: "tokenId"
+    };
+    return {
+        credit: sharedBy ? "not recorded: the platform could not resolve who published this share" : "not recorded: this share predates publisher attribution",
+        creditSource: "none"
+    };
+}
+function attributionOf(artifact) {
+    const ownership = ownershipOf(artifact.owner);
+    const owner = artifact.owner;
+    const ownerPath = "project" === ownership && owner && "project" === owner.kind ? [
+        shares_text(owner.workspace),
+        shares_text(owner.project)
+    ].filter(Boolean).join("/") : "";
+    return {
+        ownership,
+        ...ownerPath ? {
+            ownerPath
+        } : {},
+        ...creditOf(artifact.sharedBy),
+        revocableBy: REVOCABLE_BY[ownership]
+    };
+}
 function localIndex(entries) {
     const index = new Map();
     for (const entry of entries){
@@ -5164,6 +5210,9 @@ async function listShares(args) {
         const entry = byId.get(artifact.artifactId);
         return {
             ...artifact,
+            owner: artifact.owner ?? null,
+            sharedBy: artifact.sharedBy ?? null,
+            attribution: attributionOf(artifact),
             recordedLocally: Boolean(entry),
             ...entry ? {
                 sharedAt: entry.sharedAt,
@@ -5183,6 +5232,11 @@ async function listShares(args) {
             status: localOnlyStatus(entry, listing.data.truncated, now)
         }));
     const liveCount = shares.filter((share)=>share.live).length;
+    const ownership = {
+        project: shares.filter((s)=>"project" === s.attribution.ownership).length,
+        personal: shares.filter((s)=>"personal" === s.attribution.ownership).length,
+        unknown: shares.filter((s)=>"unknown" === s.attribution.ownership).length
+    };
     return JSON.stringify({
         ok: true,
         action: "list",
@@ -5193,8 +5247,9 @@ async function listShares(args) {
             limit: listing.data.limit,
             truncated: listing.data.truncated,
             scanned: listing.data.scanned,
+            ownership,
             ...listing.data.truncated ? {
-                truncatedNote: `This is not the whole set: ${listing.data.count} of ${listing.data.matched} matched shares came back at limit ${listing.data.limit}. Raise limit (max 200) or pass status:"live" to narrow it, and do not read a missing share as revoked.`
+                truncatedNote: `This is not the whole set: ${listing.data.count} of ${listing.data.matched} matched shares came back at limit ${listing.data.limit}. truncated also goes true when the server spent its budget working out which shares you are entitled to see, so matched is a floor and not a total. Raise limit (max 200) or pass status:"live" to narrow it, and do not read a missing share as revoked.`
             } : {}
         },
         shares,
@@ -5203,7 +5258,8 @@ async function listShares(args) {
         } : {},
         localRecord,
         message: `${liveCount} of ${shares.length} listed shares still resolve${local ? `; ${localOnly.length} local record ${1 === localOnly.length ? "entry has" : "entries have"} no artifact behind them` : ""}. Revoke one with action:"revoke" and its artifactId or any of its URLs.`,
-        note: "previewUrl and zipUrl are null for a share that is no longer live, because a revoked or expired link cannot resolve for anyone. revokeUrl stays on every row. Revocation is permanent: a revoked id is burned and re-sharing the same build mints a different link."
+        note: "previewUrl and zipUrl are null for a share that is no longer live, because a revoked or expired link cannot resolve for anyone. revokeUrl stays on every row. Revocation is permanent: a revoked id is burned and re-sharing the same build mints a different link.",
+        attributionNote: "attribution.ownership says who the share belongs to and therefore who may revoke it: project means the owning workspace holds it and any member can pull it back, personal means one person holds it alone. attribution.credit names the publisher and is attribution only, granting and restricting nothing. A credit of \"CLI token ...\" means the platform could not resolve which human minted that token, and a credit of \"not recorded\" means it never knew; neither is a name, and neither should be reported as one."
     });
 }
 async function revokeShare(args) {

package/dist/src/lib/artifacts-api.d.ts

@@ -1,4 +1,18 @@
 type FetchImpl = typeof fetch;
+export type ArtifactOwner = {
+    kind: "project";
+    workspace: string;
+    project: string;
+} | {
+    kind: "user";
+};
+export interface ArtifactPublisher {
+    via: "token" | "session";
+    login: string | null;
+    workspace: string | null;
+    project: string | null;
+    tokenId: string | null;
+}
 export interface ListedArtifact {
     artifactId: string;
     kind?: string;
@@ -14,6 +28,8 @@ export interface ListedArtifact {
     viewUrl?: string | null;
     zipUrl?: string | null;
     revokeUrl?: string;
+    owner?: ArtifactOwner | null;
+    sharedBy?: ArtifactPublisher | null;
 }
 export interface ArtifactListing {
     artifacts: ListedArtifact[];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 36 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "6.5.0",
+      "version": "6.6.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"