@extension.dev/mcp 6.5.0 → 7.0.0

package/dist/module.js

@@ -629,7 +629,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"6.5.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+var package_namespaceObject = JSON.parse('{"rE":"7.0.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
 function credentialsPath() {
     if ("win32" === process.platform) {
         const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
@@ -647,7 +647,7 @@ function readCredentials() {
         if (1 !== data.version) return null;
         const token = String(data.token || "").trim();
         if (!token) return null;
-        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
+        const provider = "extensiondev" === data.provider ? data.provider : void 0;
         return {
             version: 1,
             token,
@@ -735,15 +735,6 @@ function safeApiBase(raw) {
     };
 }
 async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        provider: "github",
-        clientId: override,
-        scope: "read:user",
-        deviceCodeUrl: "/api/cli/device/code",
-        deviceTokenUrl: "/api/cli/device/token",
-        verificationUri: "https://github.com/login/device"
-    };
     const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
         headers: {
             accept: "application/json"
@@ -751,16 +742,10 @@ async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
     });
     if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
     const data = await res.json().catch(()=>({}));
-    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
-    const clientId = String(data.githubClientId || "").trim();
-    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
     return {
-        provider,
-        clientId,
-        scope: String(data.scope || "read:user"),
         deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
         deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
-        verificationUri: String(data.verificationUri || "https://github.com/login/device")
+        verificationUri: String(data.verificationUri || `${apiBase.replace(/\/+$/, "")}/device`)
     };
 }
 function persistTokenResponse(args) {
@@ -773,40 +758,11 @@ function persistTokenResponse(args) {
         projectSlug: String(args.data.projectSlug || ""),
         expiresAt: Number(args.data.expiresAt || 0),
         api: args.apiBase,
-        provider: args.provider
+        provider: "extensiondev"
     };
     writeCredentials(creds);
     return creds;
 }
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    return persistTokenResponse({
-        apiBase: args.apiBase,
-        data,
-        provider: "github"
-    });
-}
 function _define_property(obj, key, value) {
     if (key in obj) Object.defineProperty(obj, key, {
         value: value,
@@ -2006,7 +1962,7 @@ function materializeCarrier(projectPath, browser) {
             ...ignored ? {
                 gitignored: ignored
             } : {},
-            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://inspect.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
+            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://preview.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
             limitations: [
                 "The trace shows calls a PAGE bridges to the carrier. Your extension's own chrome.* calls run directly in its contexts and never cross the carrier, so they do not appear.",
                 "Bridged calls run under the CARRIER's identity, not your extension's. The preview assumes a single active guest and does not namespace per-extension state, so storage, action/badge state, messaging delivery, offscreen documents and relative script paths belong to the carrier. Rows affected are badged carrier-scoped in the Trace tab.",
@@ -2016,7 +1972,7 @@ function materializeCarrier(projectPath, browser) {
             ...carrierId ? {
                 bridgeProtocol: {
                     carrierExtensionId: carrierId,
-                    allowedOrigins: "https://inspect.extension.dev, https://intelligence.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
+                    allowedOrigins: "https://preview.extension.dev, https://intelligence.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
                     howTo: "From a page on an allowed origin, register your guest once with a 'session' message (it declares the permissions the carrier enforces), then send 'bridge' messages to run chrome.* for real; each one streams into the Trace tab. Use the EXACT dotted wire names the bridge dispatcher accepts: storage is storage.get/set/remove/clear with the AREA AS AN ARGUMENT, NOT storage.local.get.",
                     example: [
                         `const id = '${carrierId}'`,
@@ -2693,7 +2649,7 @@ const dev_schema = {
             carrier: {
                 type: "boolean",
                 default: false,
-                description: "Load the bundled Extension.dev Live Preview carrier beside your extension (Chromium-family browsers only). It is placed in the project's ./extensions folder, which Extension.js auto-loads; allowlisted pages (inspect.extension.dev, localhost) can then pair with the session and stream its real-lane chrome.* trace. Writes extensions/extension-dev-live-preview/ into the project, gitignores it, and takes it back out on extension_stop or extension_build: it is a debug companion, never part of a release."
+                description: "Load the bundled Extension.dev Live Preview carrier beside your extension (Chromium-family browsers only). It is placed in the project's ./extensions folder, which Extension.js auto-loads; allowlisted pages (preview.extension.dev, localhost) can then pair with the session and stream its real-lane chrome.* trace. Writes extensions/extension-dev-live-preview/ into the project, gitignores it, and takes it back out on extension_stop or extension_build: it is a debug companion, never part of a release."
             }
         },
         required: [
@@ -4573,23 +4529,13 @@ function recordSharedPreview(projectPath, entry) {
         } : {}
     };
 }
-const DEFAULT_INSPECT_URL = "http://localhost:3106";
 const DEFAULT_PREVIEW_DEV_URL = "http://localhost:3110";
-const SURFACES = {
-    preview: {
-        defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
-        scheme: (encoded)=>`preview://build/${encoded}`,
-        fetchPath: "/__preview/fetch",
-        devCommand: "pnpm --filter preview.extension.dev dev",
-        label: "preview.extension.dev"
-    },
-    inspect: {
-        defaultOrigin: DEFAULT_INSPECT_URL,
-        scheme: (encoded)=>`inspect://path/${encoded}`,
-        fetchPath: "/__inspect/fetch",
-        devCommand: "pnpm --filter inspect.extension.dev dev",
-        label: "inspect.extension.dev"
-    }
+const SURFACE = {
+    defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
+    scheme: (encoded)=>`preview://build/${encoded}`,
+    fetchPath: "/__preview/fetch",
+    devCommand: "pnpm --filter preview.extension.dev dev",
+    label: "preview.extension.dev"
 };
 async function buildShare(projectPath, distDir, manifest, browser) {
     const result = await uploadPreview({
@@ -4674,7 +4620,7 @@ function detectSurfaces(manifest) {
 }
 const preview_web_schema = {
     name: "extension_preview_web",
-    description: "Preview an in-progress extension in the web emulator (no real browser). Builds the project (unless build:false), points preview.extension.dev at the dist directory over the dev-only preview://build scheme, and returns a deep link plus a loadability check against its dev server. preview is the author's front door: it renders YOUR build and carries the Emulated/Real lane toggle and the Trace tab. Pass surface:\"inspect\" to render in inspect.extension.dev instead (the evaluator's door, for fixture and forensic work). Pass share:true to UPLOAD the dist you just built and get back a public link (share.previewUrl) that renders those exact bytes for anyone who opens it, with no install and no dev server, and that also serves the whole build as a downloadable zip. Sharing needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days), so a local folder with no project on the platform cannot share. Use share:true whenever the build has to reach someone who is not at this machine, since the plain deepLink only resolves locally. Shared links do not disappear when this response scrolls away: extension_shares lists every link this token has shared and revokes any of them.",
+    description: "Preview an in-progress extension in the web emulator (no real browser). Builds the project (unless build:false), points preview.extension.dev at the dist directory over the dev-only preview://build scheme, and returns a deep link plus a loadability check against its dev server. preview.extension.dev is the author's door for a local build: it renders YOUR build and carries the Emulated/Real lane toggle and the Trace tab. Pass share:true to UPLOAD the dist you just built and get back a public link (share.previewUrl) that renders those exact bytes for anyone who opens it, with no install and no dev server, and that also serves the whole build as a downloadable zip. Sharing needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days), so a local folder with no project on the platform cannot share. Use share:true whenever the build has to reach someone who is not at this machine, since the plain deepLink only resolves locally. Shared links do not disappear when this response scrolls away: extension_shares lists every link this token has shared and revokes any of them.",
     inputSchema: {
         type: "object",
         properties: {
@@ -4698,7 +4644,7 @@ const preview_web_schema = {
                     "safari"
                 ],
                 default: "chrome",
-                description: "Which dist/<browser> output to preview. inspect renders it in the mocked-Chrome emulator regardless."
+                description: "Which dist/<browser> output to preview. The emulator renders it as mocked Chrome regardless."
             },
             build: {
                 type: "boolean",
@@ -4709,22 +4655,9 @@ const preview_web_schema = {
                 type: "string",
                 description: "Preview this built directory directly instead of resolving dist/<browser> under projectPath. Implies build:false."
             },
-            surface: {
-                type: "string",
-                enum: [
-                    "preview",
-                    "inspect"
-                ],
-                default: "preview",
-                description: "Which front door renders the build. \"preview\" (default) is preview.extension.dev, the author's door: your own in-progress build, with the Emulated/Real lane toggle and the Trace tab. \"inspect\" is inspect.extension.dev, the evaluator's door."
-            },
             hostUrl: {
                 type: "string",
-                description: "Origin of the running dev server for the chosen surface (defaults: http://localhost:3110 for preview, http://localhost:3106 for inspect)."
-            },
-            inspectUrl: {
-                type: "string",
-                description: "Deprecated alias for hostUrl, kept for callers written before the preview surface existed. Only consulted when surface is \"inspect\"."
+                description: "Origin of the running preview.extension.dev dev server (default http://localhost:3110)."
             },
             probe: {
                 type: "boolean",
@@ -4766,9 +4699,7 @@ const preview_web_schema = {
 };
 async function preview_web_handler(args) {
     const browser = args.browser ?? "chrome";
-    const surfaceKey = "inspect" === args.surface ? "inspect" : "preview";
-    const surface = SURFACES[surfaceKey];
-    const hostBase = (args.hostUrl ?? ("inspect" === surfaceKey ? args.inspectUrl : void 0) ?? surface.defaultOrigin).replace(/\/+$/, "");
+    const hostBase = (args.hostUrl ?? SURFACE.defaultOrigin).replace(/\/+$/, "");
     const shouldBuild = args.distPath ? false : false !== args.build;
     let buildResult = null;
     if (shouldBuild) {
@@ -4811,12 +4742,11 @@ async function preview_web_handler(args) {
         });
     }
     const encoded = Buffer.from(distDir).toString("base64url");
-    const internalUrl = surface.scheme(encoded);
+    const internalUrl = SURFACE.scheme(encoded);
     const deepLink = `${hostBase}/?url=${encodeURIComponent(internalUrl)}`;
     const result = {
         ok: true,
         deepLink,
-        surface: surfaceKey,
         distDir,
         manifest: {
             name: manifest.name ?? node_path.basename(distDir),
@@ -4829,7 +4759,7 @@ async function preview_web_handler(args) {
         } : {
             built: false
         },
-        hint: `Open deepLink in a browser to see the extension render in ${surface.label}'s emulator. It must be running (${surface.devCommand}).${"preview" === surfaceKey ? " Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser." : ""}`
+        hint: `Open deepLink in a browser to see the extension render in ${SURFACE.label}'s emulator. It must be running (${SURFACE.devCommand}). Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser.`
     };
     if (args.open) {
         const sessionBrowser = args.openIn ?? browser;
@@ -4849,7 +4779,7 @@ async function preview_web_handler(args) {
     }
     if (args.share) result.share = await buildShare(args.projectPath, distDir, manifest, browser);
     if (false === args.probe) return JSON.stringify(result);
-    const probeUrl = `${hostBase}${surface.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
+    const probeUrl = `${hostBase}${SURFACE.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
     try {
         const res = await fetch(probeUrl, {
             headers: {
@@ -4864,7 +4794,7 @@ async function preview_web_handler(args) {
             probe: {
                 status: res.status,
                 contentType,
-                note: `${surface.label} answered but not with a preview payload. On the deployed host ${surface.fetchPath} does not exist (dev-only); run a local dev server (${surface.devCommand}) to use web preview.`
+                note: `${SURFACE.label} answered but not with a preview payload. On the deployed host ${SURFACE.fetchPath} does not exist (dev-only); run a local dev server (${SURFACE.devCommand}) to use web preview.`
             }
         });
         const payload = await res.json();
@@ -4886,7 +4816,7 @@ async function preview_web_handler(args) {
             previewLoadable: false,
             probe: {
                 error: err instanceof Error ? err.message : String(err),
-                note: `Could not reach ${surface.label} at ${hostBase}. Start it with '${surface.devCommand}', then open deepLink.`
+                note: `Could not reach ${SURFACE.label} at ${hostBase}. Start it with '${SURFACE.devCommand}', then open deepLink.`
             }
         });
     }
@@ -5028,7 +4958,7 @@ async function revokeArtifact(options) {
         error: {
             name: "SharesNotFoundError",
             status: 404,
-            message: `The platform has no live share ${options.artifactId} for this token. It may already be revoked, already expired, or owned by a different project than the one this token is scoped to.`
+            message: `The platform has no live share ${options.artifactId} for this token. It may already be revoked, already expired, owned by a different project than the one this token is scoped to, or a teammate's personal share, which belongs to that person alone and no project token can revoke.`
         }
     };
     if (!res.ok) return {
@@ -5053,7 +4983,7 @@ async function revokeArtifact(options) {
 const LOGIN_HINT = "Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).";
 const shares_schema = {
     name: "extension_shares",
-    description: "List and revoke the public preview links this token has shared (the links extension_preview_web share:true hands out). action:\"list\" (default) asks the platform for every artifact owned by the logged-in project and returns each one's artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, and its previewUrl, zipUrl and revokeUrl, so a link you lost the response for is findable again. action:\"revoke\" kills one by artifactId or by pasting any of its URLs; revocation is PERMANENT (the id is burned and re-sharing mints a different link), so it cannot be undone. Pass projectPath to reconcile the platform's answer with .extension.dev/shared-previews.json, the project's own append-only record: a share made on another machine shows up as remoteOnly, and a record with no live artifact behind it shows up under localOnly. Needs the same token as sharing (extension_login or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint instead of failing. Read-only for the local file: this tool never rewrites shared-previews.json.",
+    description: "List and revoke the public preview links this token has shared (the links extension_preview_web share:true hands out). action:\"list\" (default) asks the platform for every artifact owned by the logged-in project and returns each one's artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, and its previewUrl, zipUrl and revokeUrl, so a link you lost the response for is findable again. Every row also carries owner and sharedBy as the platform returned them, plus an attribution block: attribution.ownership is \"project\" when the owning workspace holds the share and any member can revoke it, \"personal\" when one person holds it alone and nobody else can, and \"unknown\" when the platform disclosed no owner. attribution.credit names the publisher for credit only and never decides access; it reads \"CLI token <id>\" when the token's issuer could not be resolved and \"not recorded\" for a share made before attribution existed, and neither is a person's name. action:\"revoke\" kills one by artifactId or by pasting any of its URLs; revocation is PERMANENT (the id is burned and re-sharing mints a different link), so it cannot be undone. Pass projectPath to reconcile the platform's answer with .extension.dev/shared-previews.json, the project's own append-only record: a share made on another machine shows up as remoteOnly, and a record with no live artifact behind it shows up under localOnly. Needs the same token as sharing (extension_login or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint instead of failing. Read-only for the local file: this tool never rewrites shared-previews.json.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5099,6 +5029,52 @@ const shares_schema = {
         required: []
     }
 };
+const REVOCABLE_BY = {
+    project: "Any member of the owning workspace, and any token scoped to the owning project, can revoke this share.",
+    personal: "This is one person's personal share. Only that person can see it and revoke it, so a project token cannot pull it back.",
+    unknown: "The platform did not disclose an owner for this share, so who may revoke it cannot be stated here."
+};
+function shares_text(value) {
+    return "string" == typeof value ? value.trim() : "";
+}
+function ownershipOf(owner) {
+    const kind = shares_text(owner?.kind);
+    if ("project" === kind) return "project";
+    if ("user" === kind) return "personal";
+    return "unknown";
+}
+function creditOf(sharedBy) {
+    const login = shares_text(sharedBy?.login);
+    if (login) return {
+        credit: login,
+        creditSource: "login"
+    };
+    const tokenId = shares_text(sharedBy?.tokenId);
+    if (tokenId) return {
+        credit: `CLI token ${tokenId}`,
+        creditSource: "tokenId"
+    };
+    return {
+        credit: sharedBy ? "not recorded: the platform could not resolve who published this share" : "not recorded: this share predates publisher attribution",
+        creditSource: "none"
+    };
+}
+function attributionOf(artifact) {
+    const ownership = ownershipOf(artifact.owner);
+    const owner = artifact.owner;
+    const ownerPath = "project" === ownership && owner && "project" === owner.kind ? [
+        shares_text(owner.workspace),
+        shares_text(owner.project)
+    ].filter(Boolean).join("/") : "";
+    return {
+        ownership,
+        ...ownerPath ? {
+            ownerPath
+        } : {},
+        ...creditOf(artifact.sharedBy),
+        revocableBy: REVOCABLE_BY[ownership]
+    };
+}
 function localIndex(entries) {
     const index = new Map();
     for (const entry of entries){
@@ -5164,6 +5140,9 @@ async function listShares(args) {
         const entry = byId.get(artifact.artifactId);
         return {
             ...artifact,
+            owner: artifact.owner ?? null,
+            sharedBy: artifact.sharedBy ?? null,
+            attribution: attributionOf(artifact),
             recordedLocally: Boolean(entry),
             ...entry ? {
                 sharedAt: entry.sharedAt,
@@ -5183,6 +5162,11 @@ async function listShares(args) {
             status: localOnlyStatus(entry, listing.data.truncated, now)
         }));
     const liveCount = shares.filter((share)=>share.live).length;
+    const ownership = {
+        project: shares.filter((s)=>"project" === s.attribution.ownership).length,
+        personal: shares.filter((s)=>"personal" === s.attribution.ownership).length,
+        unknown: shares.filter((s)=>"unknown" === s.attribution.ownership).length
+    };
     return JSON.stringify({
         ok: true,
         action: "list",
@@ -5193,8 +5177,9 @@ async function listShares(args) {
             limit: listing.data.limit,
             truncated: listing.data.truncated,
             scanned: listing.data.scanned,
+            ownership,
             ...listing.data.truncated ? {
-                truncatedNote: `This is not the whole set: ${listing.data.count} of ${listing.data.matched} matched shares came back at limit ${listing.data.limit}. Raise limit (max 200) or pass status:"live" to narrow it, and do not read a missing share as revoked.`
+                truncatedNote: `This is not the whole set: ${listing.data.count} of ${listing.data.matched} matched shares came back at limit ${listing.data.limit}. truncated also goes true when the server spent its budget working out which shares you are entitled to see, so matched is a floor and not a total. Raise limit (max 200) or pass status:"live" to narrow it, and do not read a missing share as revoked.`
             } : {}
         },
         shares,
@@ -5203,7 +5188,8 @@ async function listShares(args) {
         } : {},
         localRecord,
         message: `${liveCount} of ${shares.length} listed shares still resolve${local ? `; ${localOnly.length} local record ${1 === localOnly.length ? "entry has" : "entries have"} no artifact behind them` : ""}. Revoke one with action:"revoke" and its artifactId or any of its URLs.`,
-        note: "previewUrl and zipUrl are null for a share that is no longer live, because a revoked or expired link cannot resolve for anyone. revokeUrl stays on every row. Revocation is permanent: a revoked id is burned and re-sharing the same build mints a different link."
+        note: "previewUrl and zipUrl are null for a share that is no longer live, because a revoked or expired link cannot resolve for anyone. revokeUrl stays on every row. Revocation is permanent: a revoked id is burned and re-sharing the same build mints a different link.",
+        attributionNote: "attribution.ownership says who the share belongs to and therefore who may revoke it: project means the owning workspace holds it and any member can pull it back, personal means one person holds it alone. attribution.credit names the publisher and is attribution only, granting and restricting nothing. A credit of \"CLI token ...\" means the platform could not resolve which human minted that token, and a credit of \"not recorded\" means it never knew; neither is a name, and neither should be reported as one."
     });
 }
 async function revokeShare(args) {
@@ -10010,78 +9996,6 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
-async function startDeviceCode(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/json"
-        },
-        body: JSON.stringify({
-            client_id: args.clientId,
-            scope: args.scope || "read:user"
-        })
-    });
-    const data = await res.json().catch(()=>({}));
-    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
-    return {
-        deviceCode: String(data.device_code || ""),
-        userCode: String(data.user_code || ""),
-        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
-        interval: Number(data.interval || 5),
-        expiresIn: Number(data.expires_in || 900)
-    };
-}
-async function pollForToken(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const sleep = args.sleepImpl ?? defaultSleep;
-    let intervalMs = 1000 * Math.max(1, args.interval);
-    const deadline = Date.now() + Math.max(0, args.budgetMs);
-    while(Date.now() < deadline){
-        await sleep(intervalMs);
-        const res = await doFetch(GITHUB_TOKEN_URL, {
-            method: "POST",
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json"
-            },
-            body: JSON.stringify({
-                client_id: args.clientId,
-                device_code: args.deviceCode,
-                grant_type: DEVICE_GRANT_TYPE
-            })
-        });
-        const data = await res.json().catch(()=>({}));
-        const token = String(data.access_token || "").trim();
-        if (token) return {
-            ok: true,
-            githubToken: token
-        };
-        const error = String(data.error || "");
-        if ("authorization_pending" === error) continue;
-        if ("slow_down" === error) {
-            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
-            continue;
-        }
-        if ("expired_token" === error) return {
-            ok: false,
-            reason: "expired"
-        };
-        if ("access_denied" === error) return {
-            ok: false,
-            reason: "denied"
-        };
-    }
-    return {
-        ok: false,
-        reason: "pending"
-    };
-}
 async function requestDeviceCode(args) {
     const doFetch = args.fetchImpl ?? fetch;
     const res = await doFetch(`${args.apiBase}${args.path}`, {
@@ -10145,8 +10059,7 @@ async function pollDeviceToken(args) {
         if (res.ok && data.token) {
             const creds = persistTokenResponse({
                 apiBase: args.apiBase,
-                data,
-                provider: "extensiondev"
+                data
             });
             return {
                 ok: true,
@@ -10177,7 +10090,7 @@ async function pollDeviceToken(args) {
 }
 const login_schema = {
     name: "extension_login",
-    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
+    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. You authorize at extension.dev/device; GitHub federation happens server-side, so no GitHub token ever lands on this machine. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
@@ -10259,99 +10172,47 @@ async function login_handler(args) {
     } catch (err) {
         return login_fail("LoginConfigError", err?.message || "Could not load login config.");
     }
-    if ("extensiondev" === config.provider) {
-        if (args.deviceCode) {
-            const poll = await pollDeviceToken({
-                apiBase,
-                path: config.deviceTokenUrl,
-                project,
-                deviceCode: String(args.deviceCode),
-                interval: 5,
-                budgetMs: RESUME_BUDGET_MS
-            });
-            if (poll.ok) return success(poll.creds);
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-            if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
-            return resumePending(String(args.deviceCode), config.verificationUri);
-        }
-        let start;
-        try {
-            start = await requestDeviceCode({
-                apiBase,
-                path: config.deviceCodeUrl,
-                project
-            });
-        } catch (err) {
-            return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
-        }
+    if (args.deviceCode) {
         const poll = await pollDeviceToken({
             apiBase,
             path: config.deviceTokenUrl,
             project,
-            deviceCode: start.deviceCode,
-            interval: start.interval,
-            budgetMs: FIRST_CALL_BUDGET_MS
-        });
-        if (poll.ok) return success(poll.creds);
-        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-        return login_pending({
-            deviceCode: start.deviceCode,
-            userCode: start.userCode,
-            verificationUri: start.verificationUri,
-            verificationUriComplete: start.verificationUriComplete
-        });
-    }
-    if (args.deviceCode) {
-        const poll = await pollForToken({
-            clientId: config.clientId,
             deviceCode: String(args.deviceCode),
             interval: 5,
             budgetMs: RESUME_BUDGET_MS
         });
-        if (!poll.ok) {
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-            return resumePending(String(args.deviceCode), "https://github.com/login/device");
-        }
-        try {
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            return success(creds);
-        } catch (err) {
-            return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-        }
+        if (poll.ok) return success(poll.creds);
+        if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
+        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+        if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
+        return resumePending(String(args.deviceCode), config.verificationUri);
     }
     let start;
     try {
-        start = await startDeviceCode({
-            clientId: config.clientId,
-            scope: config.scope
+        start = await requestDeviceCode({
+            apiBase,
+            path: config.deviceCodeUrl,
+            project
         });
     } catch (err) {
-        return login_fail("LoginStartError", err?.message || "Could not start device flow.");
+        return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
     }
-    const poll = await pollForToken({
-        clientId: config.clientId,
+    const poll = await pollDeviceToken({
+        apiBase,
+        path: config.deviceTokenUrl,
+        project,
         deviceCode: start.deviceCode,
         interval: start.interval,
         budgetMs: FIRST_CALL_BUDGET_MS
     });
-    if (poll.ok) try {
-        const creds = await exchangeAndPersist({
-            apiBase,
-            githubToken: poll.githubToken,
-            project
-        });
-        return success(creds);
-    } catch (err) {
-        return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-    }
-    if (!poll.ok && "denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-    return login_pending(start);
+    if (poll.ok) return success(poll.creds);
+    if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+    return login_pending({
+        deviceCode: start.deviceCode,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete
+    });
 }
 const whoami_schema = {
     name: "extension_whoami",
@@ -10387,7 +10248,7 @@ async function whoami_handler() {
             apiRecordedAtLogin: recordedApi
         } : {},
         apiDefault: effectiveDefaultApi,
-        provider: creds.provider ?? "github",
+        provider: creds.provider ?? "extensiondev",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
@@ -11223,55 +11084,28 @@ async function runCli(cmd, args) {
         const apiBase = resolveApiBase(flag("api"));
         try {
             const config = await fetchLoginConfig(apiBase);
-            if ("extensiondev" === config.provider) {
-                const start = await requestDeviceCode({
-                    apiBase,
-                    path: config.deviceCodeUrl,
-                    project
-                });
-                log("");
-                log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
-                log("");
-                log("  Waiting for authorization...");
-                const poll = await pollDeviceToken({
-                    apiBase,
-                    path: config.deviceTokenUrl,
-                    project,
-                    deviceCode: start.deviceCode,
-                    interval: start.interval,
-                    budgetMs: 1000 * start.expiresIn
-                });
-                if (!poll.ok) {
-                    log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
-                    return 1;
-                }
-                log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
-                return 0;
-            }
-            const start = await startDeviceCode({
-                clientId: config.clientId,
-                scope: config.scope
+            const start = await requestDeviceCode({
+                apiBase,
+                path: config.deviceCodeUrl,
+                project
             });
             log("");
             log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
             log("");
             log("  Waiting for authorization...");
-            const poll = await pollForToken({
-                clientId: config.clientId,
+            const poll = await pollDeviceToken({
+                apiBase,
+                path: config.deviceTokenUrl,
+                project,
                 deviceCode: start.deviceCode,
                 interval: start.interval,
                 budgetMs: 1000 * start.expiresIn
             });
             if (!poll.ok) {
-                log("denied" === poll.reason ? "Authorization was denied on GitHub." : "Timed out waiting for authorization. Run login again.");
+                log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
                 return 1;
             }
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            log(`Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`);
+            log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
             return 0;
         } catch (err) {
             log(err instanceof Error ? err.message : String(err));