@extension.dev/mcp 6.6.0 → 7.0.0

package/dist/module.js

@@ -629,7 +629,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"6.5.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+var package_namespaceObject = JSON.parse('{"rE":"7.0.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
 function credentialsPath() {
     if ("win32" === process.platform) {
         const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
@@ -647,7 +647,7 @@ function readCredentials() {
         if (1 !== data.version) return null;
         const token = String(data.token || "").trim();
         if (!token) return null;
-        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
+        const provider = "extensiondev" === data.provider ? data.provider : void 0;
         return {
             version: 1,
             token,
@@ -735,15 +735,6 @@ function safeApiBase(raw) {
     };
 }
 async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        provider: "github",
-        clientId: override,
-        scope: "read:user",
-        deviceCodeUrl: "/api/cli/device/code",
-        deviceTokenUrl: "/api/cli/device/token",
-        verificationUri: "https://github.com/login/device"
-    };
     const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
         headers: {
             accept: "application/json"
@@ -751,16 +742,10 @@ async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
     });
     if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
     const data = await res.json().catch(()=>({}));
-    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
-    const clientId = String(data.githubClientId || "").trim();
-    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
     return {
-        provider,
-        clientId,
-        scope: String(data.scope || "read:user"),
         deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
         deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
-        verificationUri: String(data.verificationUri || "https://github.com/login/device")
+        verificationUri: String(data.verificationUri || `${apiBase.replace(/\/+$/, "")}/device`)
     };
 }
 function persistTokenResponse(args) {
@@ -773,40 +758,11 @@ function persistTokenResponse(args) {
         projectSlug: String(args.data.projectSlug || ""),
         expiresAt: Number(args.data.expiresAt || 0),
         api: args.apiBase,
-        provider: args.provider
+        provider: "extensiondev"
     };
     writeCredentials(creds);
     return creds;
 }
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    return persistTokenResponse({
-        apiBase: args.apiBase,
-        data,
-        provider: "github"
-    });
-}
 function _define_property(obj, key, value) {
     if (key in obj) Object.defineProperty(obj, key, {
         value: value,
@@ -2006,7 +1962,7 @@ function materializeCarrier(projectPath, browser) {
             ...ignored ? {
                 gitignored: ignored
             } : {},
-            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://inspect.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
+            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://preview.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
             limitations: [
                 "The trace shows calls a PAGE bridges to the carrier. Your extension's own chrome.* calls run directly in its contexts and never cross the carrier, so they do not appear.",
                 "Bridged calls run under the CARRIER's identity, not your extension's. The preview assumes a single active guest and does not namespace per-extension state, so storage, action/badge state, messaging delivery, offscreen documents and relative script paths belong to the carrier. Rows affected are badged carrier-scoped in the Trace tab.",
@@ -2016,7 +1972,7 @@ function materializeCarrier(projectPath, browser) {
             ...carrierId ? {
                 bridgeProtocol: {
                     carrierExtensionId: carrierId,
-                    allowedOrigins: "https://inspect.extension.dev, https://intelligence.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
+                    allowedOrigins: "https://preview.extension.dev, https://intelligence.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
                     howTo: "From a page on an allowed origin, register your guest once with a 'session' message (it declares the permissions the carrier enforces), then send 'bridge' messages to run chrome.* for real; each one streams into the Trace tab. Use the EXACT dotted wire names the bridge dispatcher accepts: storage is storage.get/set/remove/clear with the AREA AS AN ARGUMENT, NOT storage.local.get.",
                     example: [
                         `const id = '${carrierId}'`,
@@ -2693,7 +2649,7 @@ const dev_schema = {
             carrier: {
                 type: "boolean",
                 default: false,
-                description: "Load the bundled Extension.dev Live Preview carrier beside your extension (Chromium-family browsers only). It is placed in the project's ./extensions folder, which Extension.js auto-loads; allowlisted pages (inspect.extension.dev, localhost) can then pair with the session and stream its real-lane chrome.* trace. Writes extensions/extension-dev-live-preview/ into the project, gitignores it, and takes it back out on extension_stop or extension_build: it is a debug companion, never part of a release."
+                description: "Load the bundled Extension.dev Live Preview carrier beside your extension (Chromium-family browsers only). It is placed in the project's ./extensions folder, which Extension.js auto-loads; allowlisted pages (preview.extension.dev, localhost) can then pair with the session and stream its real-lane chrome.* trace. Writes extensions/extension-dev-live-preview/ into the project, gitignores it, and takes it back out on extension_stop or extension_build: it is a debug companion, never part of a release."
             }
         },
         required: [
@@ -4573,23 +4529,13 @@ function recordSharedPreview(projectPath, entry) {
         } : {}
     };
 }
-const DEFAULT_INSPECT_URL = "http://localhost:3106";
 const DEFAULT_PREVIEW_DEV_URL = "http://localhost:3110";
-const SURFACES = {
-    preview: {
-        defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
-        scheme: (encoded)=>`preview://build/${encoded}`,
-        fetchPath: "/__preview/fetch",
-        devCommand: "pnpm --filter preview.extension.dev dev",
-        label: "preview.extension.dev"
-    },
-    inspect: {
-        defaultOrigin: DEFAULT_INSPECT_URL,
-        scheme: (encoded)=>`inspect://path/${encoded}`,
-        fetchPath: "/__inspect/fetch",
-        devCommand: "pnpm --filter inspect.extension.dev dev",
-        label: "inspect.extension.dev"
-    }
+const SURFACE = {
+    defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
+    scheme: (encoded)=>`preview://build/${encoded}`,
+    fetchPath: "/__preview/fetch",
+    devCommand: "pnpm --filter preview.extension.dev dev",
+    label: "preview.extension.dev"
 };
 async function buildShare(projectPath, distDir, manifest, browser) {
     const result = await uploadPreview({
@@ -4674,7 +4620,7 @@ function detectSurfaces(manifest) {
 }
 const preview_web_schema = {
     name: "extension_preview_web",
-    description: "Preview an in-progress extension in the web emulator (no real browser). Builds the project (unless build:false), points preview.extension.dev at the dist directory over the dev-only preview://build scheme, and returns a deep link plus a loadability check against its dev server. preview is the author's front door: it renders YOUR build and carries the Emulated/Real lane toggle and the Trace tab. Pass surface:\"inspect\" to render in inspect.extension.dev instead (the evaluator's door, for fixture and forensic work). Pass share:true to UPLOAD the dist you just built and get back a public link (share.previewUrl) that renders those exact bytes for anyone who opens it, with no install and no dev server, and that also serves the whole build as a downloadable zip. Sharing needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days), so a local folder with no project on the platform cannot share. Use share:true whenever the build has to reach someone who is not at this machine, since the plain deepLink only resolves locally. Shared links do not disappear when this response scrolls away: extension_shares lists every link this token has shared and revokes any of them.",
+    description: "Preview an in-progress extension in the web emulator (no real browser). Builds the project (unless build:false), points preview.extension.dev at the dist directory over the dev-only preview://build scheme, and returns a deep link plus a loadability check against its dev server. preview.extension.dev is the author's door for a local build: it renders YOUR build and carries the Emulated/Real lane toggle and the Trace tab. Pass share:true to UPLOAD the dist you just built and get back a public link (share.previewUrl) that renders those exact bytes for anyone who opens it, with no install and no dev server, and that also serves the whole build as a downloadable zip. Sharing needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days), so a local folder with no project on the platform cannot share. Use share:true whenever the build has to reach someone who is not at this machine, since the plain deepLink only resolves locally. Shared links do not disappear when this response scrolls away: extension_shares lists every link this token has shared and revokes any of them.",
     inputSchema: {
         type: "object",
         properties: {
@@ -4698,7 +4644,7 @@ const preview_web_schema = {
                     "safari"
                 ],
                 default: "chrome",
-                description: "Which dist/<browser> output to preview. inspect renders it in the mocked-Chrome emulator regardless."
+                description: "Which dist/<browser> output to preview. The emulator renders it as mocked Chrome regardless."
             },
             build: {
                 type: "boolean",
@@ -4709,22 +4655,9 @@ const preview_web_schema = {
                 type: "string",
                 description: "Preview this built directory directly instead of resolving dist/<browser> under projectPath. Implies build:false."
             },
-            surface: {
-                type: "string",
-                enum: [
-                    "preview",
-                    "inspect"
-                ],
-                default: "preview",
-                description: "Which front door renders the build. \"preview\" (default) is preview.extension.dev, the author's door: your own in-progress build, with the Emulated/Real lane toggle and the Trace tab. \"inspect\" is inspect.extension.dev, the evaluator's door."
-            },
             hostUrl: {
                 type: "string",
-                description: "Origin of the running dev server for the chosen surface (defaults: http://localhost:3110 for preview, http://localhost:3106 for inspect)."
-            },
-            inspectUrl: {
-                type: "string",
-                description: "Deprecated alias for hostUrl, kept for callers written before the preview surface existed. Only consulted when surface is \"inspect\"."
+                description: "Origin of the running preview.extension.dev dev server (default http://localhost:3110)."
             },
             probe: {
                 type: "boolean",
@@ -4766,9 +4699,7 @@ const preview_web_schema = {
 };
 async function preview_web_handler(args) {
     const browser = args.browser ?? "chrome";
-    const surfaceKey = "inspect" === args.surface ? "inspect" : "preview";
-    const surface = SURFACES[surfaceKey];
-    const hostBase = (args.hostUrl ?? ("inspect" === surfaceKey ? args.inspectUrl : void 0) ?? surface.defaultOrigin).replace(/\/+$/, "");
+    const hostBase = (args.hostUrl ?? SURFACE.defaultOrigin).replace(/\/+$/, "");
     const shouldBuild = args.distPath ? false : false !== args.build;
     let buildResult = null;
     if (shouldBuild) {
@@ -4811,12 +4742,11 @@ async function preview_web_handler(args) {
         });
     }
     const encoded = Buffer.from(distDir).toString("base64url");
-    const internalUrl = surface.scheme(encoded);
+    const internalUrl = SURFACE.scheme(encoded);
     const deepLink = `${hostBase}/?url=${encodeURIComponent(internalUrl)}`;
     const result = {
         ok: true,
         deepLink,
-        surface: surfaceKey,
         distDir,
         manifest: {
             name: manifest.name ?? node_path.basename(distDir),
@@ -4829,7 +4759,7 @@ async function preview_web_handler(args) {
         } : {
             built: false
         },
-        hint: `Open deepLink in a browser to see the extension render in ${surface.label}'s emulator. It must be running (${surface.devCommand}).${"preview" === surfaceKey ? " Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser." : ""}`
+        hint: `Open deepLink in a browser to see the extension render in ${SURFACE.label}'s emulator. It must be running (${SURFACE.devCommand}). Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser.`
     };
     if (args.open) {
         const sessionBrowser = args.openIn ?? browser;
@@ -4849,7 +4779,7 @@ async function preview_web_handler(args) {
     }
     if (args.share) result.share = await buildShare(args.projectPath, distDir, manifest, browser);
     if (false === args.probe) return JSON.stringify(result);
-    const probeUrl = `${hostBase}${surface.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
+    const probeUrl = `${hostBase}${SURFACE.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
     try {
         const res = await fetch(probeUrl, {
             headers: {
@@ -4864,7 +4794,7 @@ async function preview_web_handler(args) {
             probe: {
                 status: res.status,
                 contentType,
-                note: `${surface.label} answered but not with a preview payload. On the deployed host ${surface.fetchPath} does not exist (dev-only); run a local dev server (${surface.devCommand}) to use web preview.`
+                note: `${SURFACE.label} answered but not with a preview payload. On the deployed host ${SURFACE.fetchPath} does not exist (dev-only); run a local dev server (${SURFACE.devCommand}) to use web preview.`
             }
         });
         const payload = await res.json();
@@ -4886,7 +4816,7 @@ async function preview_web_handler(args) {
             previewLoadable: false,
             probe: {
                 error: err instanceof Error ? err.message : String(err),
-                note: `Could not reach ${surface.label} at ${hostBase}. Start it with '${surface.devCommand}', then open deepLink.`
+                note: `Could not reach ${SURFACE.label} at ${hostBase}. Start it with '${SURFACE.devCommand}', then open deepLink.`
             }
         });
     }
@@ -10066,78 +9996,6 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
-async function startDeviceCode(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/json"
-        },
-        body: JSON.stringify({
-            client_id: args.clientId,
-            scope: args.scope || "read:user"
-        })
-    });
-    const data = await res.json().catch(()=>({}));
-    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
-    return {
-        deviceCode: String(data.device_code || ""),
-        userCode: String(data.user_code || ""),
-        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
-        interval: Number(data.interval || 5),
-        expiresIn: Number(data.expires_in || 900)
-    };
-}
-async function pollForToken(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const sleep = args.sleepImpl ?? defaultSleep;
-    let intervalMs = 1000 * Math.max(1, args.interval);
-    const deadline = Date.now() + Math.max(0, args.budgetMs);
-    while(Date.now() < deadline){
-        await sleep(intervalMs);
-        const res = await doFetch(GITHUB_TOKEN_URL, {
-            method: "POST",
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json"
-            },
-            body: JSON.stringify({
-                client_id: args.clientId,
-                device_code: args.deviceCode,
-                grant_type: DEVICE_GRANT_TYPE
-            })
-        });
-        const data = await res.json().catch(()=>({}));
-        const token = String(data.access_token || "").trim();
-        if (token) return {
-            ok: true,
-            githubToken: token
-        };
-        const error = String(data.error || "");
-        if ("authorization_pending" === error) continue;
-        if ("slow_down" === error) {
-            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
-            continue;
-        }
-        if ("expired_token" === error) return {
-            ok: false,
-            reason: "expired"
-        };
-        if ("access_denied" === error) return {
-            ok: false,
-            reason: "denied"
-        };
-    }
-    return {
-        ok: false,
-        reason: "pending"
-    };
-}
 async function requestDeviceCode(args) {
     const doFetch = args.fetchImpl ?? fetch;
     const res = await doFetch(`${args.apiBase}${args.path}`, {
@@ -10201,8 +10059,7 @@ async function pollDeviceToken(args) {
         if (res.ok && data.token) {
             const creds = persistTokenResponse({
                 apiBase: args.apiBase,
-                data,
-                provider: "extensiondev"
+                data
             });
             return {
                 ok: true,
@@ -10233,7 +10090,7 @@ async function pollDeviceToken(args) {
 }
 const login_schema = {
     name: "extension_login",
-    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
+    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. You authorize at extension.dev/device; GitHub federation happens server-side, so no GitHub token ever lands on this machine. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
     inputSchema: {
         type: "object",
         properties: {
@@ -10315,99 +10172,47 @@ async function login_handler(args) {
     } catch (err) {
         return login_fail("LoginConfigError", err?.message || "Could not load login config.");
     }
-    if ("extensiondev" === config.provider) {
-        if (args.deviceCode) {
-            const poll = await pollDeviceToken({
-                apiBase,
-                path: config.deviceTokenUrl,
-                project,
-                deviceCode: String(args.deviceCode),
-                interval: 5,
-                budgetMs: RESUME_BUDGET_MS
-            });
-            if (poll.ok) return success(poll.creds);
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-            if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
-            return resumePending(String(args.deviceCode), config.verificationUri);
-        }
-        let start;
-        try {
-            start = await requestDeviceCode({
-                apiBase,
-                path: config.deviceCodeUrl,
-                project
-            });
-        } catch (err) {
-            return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
-        }
+    if (args.deviceCode) {
         const poll = await pollDeviceToken({
             apiBase,
             path: config.deviceTokenUrl,
             project,
-            deviceCode: start.deviceCode,
-            interval: start.interval,
-            budgetMs: FIRST_CALL_BUDGET_MS
-        });
-        if (poll.ok) return success(poll.creds);
-        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-        return login_pending({
-            deviceCode: start.deviceCode,
-            userCode: start.userCode,
-            verificationUri: start.verificationUri,
-            verificationUriComplete: start.verificationUriComplete
-        });
-    }
-    if (args.deviceCode) {
-        const poll = await pollForToken({
-            clientId: config.clientId,
             deviceCode: String(args.deviceCode),
             interval: 5,
             budgetMs: RESUME_BUDGET_MS
         });
-        if (!poll.ok) {
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-            return resumePending(String(args.deviceCode), "https://github.com/login/device");
-        }
-        try {
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            return success(creds);
-        } catch (err) {
-            return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-        }
+        if (poll.ok) return success(poll.creds);
+        if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
+        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+        if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
+        return resumePending(String(args.deviceCode), config.verificationUri);
     }
     let start;
     try {
-        start = await startDeviceCode({
-            clientId: config.clientId,
-            scope: config.scope
+        start = await requestDeviceCode({
+            apiBase,
+            path: config.deviceCodeUrl,
+            project
         });
     } catch (err) {
-        return login_fail("LoginStartError", err?.message || "Could not start device flow.");
+        return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
     }
-    const poll = await pollForToken({
-        clientId: config.clientId,
+    const poll = await pollDeviceToken({
+        apiBase,
+        path: config.deviceTokenUrl,
+        project,
         deviceCode: start.deviceCode,
         interval: start.interval,
         budgetMs: FIRST_CALL_BUDGET_MS
     });
-    if (poll.ok) try {
-        const creds = await exchangeAndPersist({
-            apiBase,
-            githubToken: poll.githubToken,
-            project
-        });
-        return success(creds);
-    } catch (err) {
-        return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-    }
-    if (!poll.ok && "denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-    return login_pending(start);
+    if (poll.ok) return success(poll.creds);
+    if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+    return login_pending({
+        deviceCode: start.deviceCode,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete
+    });
 }
 const whoami_schema = {
     name: "extension_whoami",
@@ -10443,7 +10248,7 @@ async function whoami_handler() {
             apiRecordedAtLogin: recordedApi
         } : {},
         apiDefault: effectiveDefaultApi,
-        provider: creds.provider ?? "github",
+        provider: creds.provider ?? "extensiondev",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
@@ -11279,55 +11084,28 @@ async function runCli(cmd, args) {
         const apiBase = resolveApiBase(flag("api"));
         try {
             const config = await fetchLoginConfig(apiBase);
-            if ("extensiondev" === config.provider) {
-                const start = await requestDeviceCode({
-                    apiBase,
-                    path: config.deviceCodeUrl,
-                    project
-                });
-                log("");
-                log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
-                log("");
-                log("  Waiting for authorization...");
-                const poll = await pollDeviceToken({
-                    apiBase,
-                    path: config.deviceTokenUrl,
-                    project,
-                    deviceCode: start.deviceCode,
-                    interval: start.interval,
-                    budgetMs: 1000 * start.expiresIn
-                });
-                if (!poll.ok) {
-                    log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
-                    return 1;
-                }
-                log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
-                return 0;
-            }
-            const start = await startDeviceCode({
-                clientId: config.clientId,
-                scope: config.scope
+            const start = await requestDeviceCode({
+                apiBase,
+                path: config.deviceCodeUrl,
+                project
             });
             log("");
             log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
             log("");
             log("  Waiting for authorization...");
-            const poll = await pollForToken({
-                clientId: config.clientId,
+            const poll = await pollDeviceToken({
+                apiBase,
+                path: config.deviceTokenUrl,
+                project,
                 deviceCode: start.deviceCode,
                 interval: start.interval,
                 budgetMs: 1000 * start.expiresIn
             });
             if (!poll.ok) {
-                log("denied" === poll.reason ? "Authorization was denied on GitHub." : "Timed out waiting for authorization. Run login again.");
+                log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
                 return 1;
             }
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            log(`Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`);
+            log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
             return 0;
         } catch (err) {
             log(err instanceof Error ? err.message : String(err));

package/dist/src/lib/credentials.d.ts

@@ -5,7 +5,7 @@ export interface StoredCredentials {
     projectSlug: string;
     expiresAt: number;
     api: string;
-    provider?: "extensiondev" | "github";
+    provider?: "extensiondev";
 }
 export declare function credentialsPath(): string;
 export declare function readCredentials(): StoredCredentials | null;

package/dist/src/lib/login-flow.d.ts

@@ -10,9 +10,6 @@ export declare function safeApiBase(raw: string): {
     message: string;
 };
 export interface LoginConfig {
-    provider: "extensiondev" | "github";
-    clientId: string;
-    scope: string;
     deviceCodeUrl: string;
     deviceTokenUrl: string;
     verificationUri: string;
@@ -21,12 +18,5 @@ export declare function fetchLoginConfig(apiBase: string, fetchImpl?: FetchImpl)
 export declare function persistTokenResponse(args: {
     apiBase: string;
     data: Record<string, unknown>;
-    provider: "extensiondev" | "github";
 }): StoredCredentials;
-export declare function exchangeAndPersist(args: {
-    apiBase: string;
-    githubToken: string;
-    project: string;
-    fetchImpl?: FetchImpl;
-}): Promise<StoredCredentials>;
 export {};

package/dist/src/tools/preview-web.d.ts

@@ -23,20 +23,10 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
-            surface: {
-                type: string;
-                enum: string[];
-                default: string;
-                description: string;
-            };
             hostUrl: {
                 type: string;
                 description: string;
             };
-            inspectUrl: {
-                type: string;
-                description: string;
-            };
             probe: {
                 type: string;
                 default: boolean;
@@ -66,9 +56,7 @@ export declare function handler(args: {
     browser?: string;
     build?: boolean;
     distPath?: string;
-    surface?: string;
     hostUrl?: string;
-    inspectUrl?: string;
     probe?: boolean;
     open?: boolean;
     openIn?: string;