@extension.dev/mcp 6.5.0 → 7.0.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.5.0",
+      "version": "7.0.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.5.0",
+  "version": "7.0.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",
@@ -9,7 +9,7 @@
   },
   "homepage": "https://github.com/extensiondev/mcp",
   "repository": "https://github.com/extensiondev/mcp",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "keywords": [
     "mcp",
     "browser-extension",

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # Changelog
 
+## 7.0.0
+
+`preview.extension.dev` is the only web door this package knows about. The
+inspect door predates it and had stopped being reachable.
+
+### Removed
+
+- **`extension_preview_web` no longer takes `surface` or `inspectUrl`.**
+  `surface:"inspect"` pointed a local build at `inspect.extension.dev` over the
+  `inspect://path` scheme, which is what the tool did before
+  `preview.extension.dev` existed. Only the inspect dev server ever answered it:
+  the deployed origin serves store listings and has no `/__inspect/fetch`, so
+  the door resolved on one machine and nowhere else. Every build now renders in
+  `preview.extension.dev`, which is also the surface that carries the
+  Emulated/Real lane toggle and the Trace tab. The response no longer carries a
+  `surface` field, and `hostUrl` is the only origin override.
+- **The carrier no longer allowlists `inspect.extension.dev`.** Pairing needs a
+  page that opens the bridge, and inspect never did: it traces the emulated lane
+  of the extension it fetched and has no lane toggle. `extension_dev`
+  `carrier: true` and the pairing notes now point at `preview.extension.dev`,
+  and the carrier's `externally_connectable` drops the origin that was never
+  going to connect.
+- **`extension_login` no longer falls back to the GitHub device flow.**
+  extension.dev hosts the device flow itself and federates GitHub server-side, so
+  the only authorization surface is `extension.dev/device` and no GitHub token
+  ever lands on the caller's machine. The legacy path is gone entirely: the
+  GitHub device-code client, the `provider` fork (which existed twice, once in the
+  tool and once in the `extension-mcp login` bin), the
+  `/api/cli/login/exchange` hop, and the `EXTENSION_DEV_GITHUB_CLIENT_ID`
+  override. Stored credentials record `provider: "extensiondev"` and
+  `extension_whoami` reports that instead of defaulting to `"github"`. Nothing
+  changes for a caller who was already on the branded flow, which is every caller
+  the platform has served since it went live; a self-hosted platform pinned to
+  the old exchange endpoint is no longer supported.
+
+## 6.6.0
+
+A shared build belongs to the project that owns it, not to whoever happened to
+press publish. `extension_shares` now says which of the two it is looking at,
+and it names the publisher without ever inventing one.
+
+### Added
+
+- **Every listed share carries its owner and its publisher.** The platform now
+  returns `owner` and `sharedBy` on each row and both come through untouched,
+  alongside an `attribution` block that reads them. `attribution.ownership` is
+  `"project"` when the owning workspace holds the share, `"personal"` when one
+  person holds it alone, and `"unknown"` when the platform disclosed no owner.
+  `attribution.ownerPath` gives the owning `workspace/project` for a project
+  share. Ownership is read off `owner` and never off the publisher, because the
+  owner is what decides who may revoke a share and the publisher is only who
+  made it.
+- **`attribution.revocableBy` says who can actually pull the link back.** A
+  project share is revocable by any member of the owning workspace and by any
+  token scoped to the owning project. A personal share belongs to one person,
+  so nobody else can see it or revoke it and a project token cannot touch it.
+  Knowing which of the two you are holding is the difference between a revoke
+  that will work and a 404 that reads like a bug.
+- **`server.ownership` counts the listed shares by owner.** Project, personal
+  and unknown, so a list can be reasoned about without walking every row.
+
+### Changed
+
+- **A publisher is never guessed.** `attribution.credit` is the GitHub login
+  when the platform resolved one. When a share was made by a CLI token whose
+  issuer could not be resolved it reads `CLI token <id>`, which is exactly what
+  the credential itself proves, and a share made before attribution existed
+  reads as not recorded. The workspace slug, the project slug and the owner are
+  never substituted for a name, because naming a team where a human is expected
+  attributes the share to whoever the reader takes that team to be.
+  `attribution.creditSource` says which of the three it was.
+- **Attribution is stated as attribution.** The response spells out that
+  `sharedBy` records who published a share and grants and restricts nothing, so
+  it is not read as a permission.
+- **A truncated list is more explicit about why.** `truncated` also goes true
+  when the platform spends its budget working out which shares the caller is
+  entitled to see, so the note now says `matched` is a floor rather than a
+  total.
+- **Revoking a share the token does not own explains the personal case.** The
+  404 message already covered a different project and an already dead link; it
+  now also names a teammate's personal share, which no project token can
+  revoke.
+
 ## 6.5.0
 
 A link you shared is no longer only as findable as the response that created

package/README.md

@@ -5,11 +5,9 @@
 [discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=26FFB8
 [discord-url]: https://discord.gg/v9h2RgeTSN
 
-<img alt="@extension.dev/mcp" src="https://media.extension.land/brand/repos/mcp/github-banner.png" />
-
 # @extension.dev/mcp [![Version][npm-version-image]][npm-version-url] [![Downloads][npm-downloads-image]][npm-downloads-url] [![Discord][discord-image]][discord-url]
 
-> Give your AI agent hands for browser extension development. 35 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
+> Give your AI agent hands for browser extension development. 36 MCP tools that scaffold, run, inspect, debug, and publish cross-browser extensions.
 
 <img alt="Logo" align="right" src="https://media.extension.land/brand/extension-dev/logo-dock.png" width="20.7%" />
 
@@ -129,14 +127,16 @@ cp node_modules/@extension.dev/mcp/claude/commands/*.md ~/my-extension/.claude/c
 | browsers | `extension_uninstall_browser` | Remove a managed browser binary |
 | browsers | `extension_list_browsers` | List managed browsers |
 | browsers | `extension_detect_browsers` | Detect system browsers |
-| platform | `extension_login` | GitHub device-code login, stored token |
+| platform | `extension_login` | Device login at extension.dev, stored token |
 | platform | `extension_whoami` | Show the stored login (never the token) |
 | platform | `extension_logout` | Remove stored credentials |
 | platform | `extension_preview_web` | Render a build in the web emulator, and share it as a link |
 | platform | `extension_shares` | List every link you have shared, and revoke one permanently |
 | platform | `extension_publish` | Publish a shareable preview to extension.dev |
 | platform | `extension_release_promote` | Promote a build to a release channel, headless |
+| platform | `extension_release_list` | List release channels and recent builds, to pick a valid build sha |
 | platform | `extension_deploy` | Submit to the Chrome, Firefox, and Edge stores through extension.dev |
+| platform | `extension_store_status` | Read a submission's outcome, credential health, and review state |
 
 Browser-launching tools (`dev`, `start`, `preview`) shell out to the `extension` CLI, the project's own `node_modules/.bin/extension` when present, otherwise `npx extension@<pinned>` at the version this package is verified against; everything else runs in-process.
 
@@ -150,7 +150,7 @@ That is a different job from shipping. Use `share` for the build you are holding
 
 ## From preview to store
 
-The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs a GitHub device-code flow and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build your project has already published into a shareable URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
+The platform tools connect agents to [extension.dev](https://extension.dev): `extension_login` runs extension.dev's own device flow (you approve the code at [extension.dev/device](https://extension.dev/device), and GitHub is federated server-side, so no GitHub token ever reaches your machine) and stores a project-scoped token locally (never returned to the agent), `extension_publish` turns a build your project has already published into a shareable URL, and `extension_release_promote` promotes a tested build to a release channel from CI or an agent session, no browser required. `extension_deploy` submits a built extension to the Chrome Web Store, Edge Add-ons, and Firefox AMO through extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI, it defaults to a dry run and store credentials are never tool arguments. After a real submission, `extension_store_status` reads the recorded outcome, per-store credential health, and review state from the project's public registry, so agents and CI can answer "was it approved?" without a console visit. Access tokens live at most 7 days; CI pipelines re-mint them from the console's Access tokens page.
 
 ## The extension.dev stack