@extension.dev/mcp 6.6.0 → 9.0.0

package/dist/module.js

@@ -6,16 +6,16 @@ import node_fs, { existsSync, promises, readdirSync, statSync } from "node:fs";
 import node_path, { join } from "node:path";
 import { extensionCreate } from "extension-create";
 import node_os from "node:os";
-import cross_spawn from "cross-spawn";
 import node_crypto, { createHash } from "node:crypto";
+import cross_spawn from "cross-spawn";
 import { fileURLToPath } from "node:url";
 import { execFile, execFileSync } from "node:child_process";
 import ws_0 from "ws";
 import node_http from "node:http";
 import { filterKeysForThisBrowser } from "browser-extension-manifest-fields";
 import node_net from "node:net";
-import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { promisify } from "node:util";
+import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 __webpack_require__.add({
     "./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/origins.cjs" (__unused_rspack_module, exports) {
         var __nested_rspack_require_18_37__ = {};
@@ -410,6 +410,24 @@ __webpack_require__.d(add_feature_namespaceObject, {
     handler: ()=>add_feature_handler,
     schema: ()=>add_feature_schema
 });
+var analyze_namespaceObject = {};
+__webpack_require__.r(analyze_namespaceObject);
+__webpack_require__.d(analyze_namespaceObject, {
+    handler: ()=>analyze_handler,
+    schema: ()=>analyze_schema
+});
+var auth_namespaceObject = {};
+__webpack_require__.r(auth_namespaceObject);
+__webpack_require__.d(auth_namespaceObject, {
+    handler: ()=>auth_handler,
+    schema: ()=>auth_schema
+});
+var browsers_namespaceObject = {};
+__webpack_require__.r(browsers_namespaceObject);
+__webpack_require__.d(browsers_namespaceObject, {
+    handler: ()=>browsers_handler,
+    schema: ()=>browsers_schema
+});
 var build_namespaceObject = {};
 __webpack_require__.r(build_namespaceObject);
 __webpack_require__.d(build_namespaceObject, {
@@ -422,19 +440,6 @@ __webpack_require__.d(create_namespaceObject, {
     handler: ()=>create_handler,
     schema: ()=>create_schema
 });
-var deploy_namespaceObject = {};
-__webpack_require__.r(deploy_namespaceObject);
-__webpack_require__.d(deploy_namespaceObject, {
-    handler: ()=>deploy_handler,
-    schema: ()=>deploy_schema,
-    storeMdWarnings: ()=>storeMdWarnings
-});
-var detect_browsers_namespaceObject = {};
-__webpack_require__.r(detect_browsers_namespaceObject);
-__webpack_require__.d(detect_browsers_namespaceObject, {
-    handler: ()=>detect_browsers_handler,
-    schema: ()=>detect_browsers_schema
-});
 var dev_namespaceObject = {};
 __webpack_require__.r(dev_namespaceObject);
 __webpack_require__.d(dev_namespaceObject, {
@@ -448,11 +453,11 @@ __webpack_require__.d(doctor_namespaceObject, {
     recentErrorLogs: ()=>recentErrorLogs,
     schema: ()=>doctor_schema
 });
-var dom_inspect_namespaceObject = {};
-__webpack_require__.r(dom_inspect_namespaceObject);
-__webpack_require__.d(dom_inspect_namespaceObject, {
-    handler: ()=>dom_inspect_handler,
-    schema: ()=>dom_inspect_schema
+var dom_snapshot_namespaceObject = {};
+__webpack_require__.r(dom_snapshot_namespaceObject);
+__webpack_require__.d(dom_snapshot_namespaceObject, {
+    handler: ()=>dom_snapshot_handler,
+    schema: ()=>dom_snapshot_schema
 });
 var eval_namespaceObject = {};
 __webpack_require__.r(eval_namespaceObject);
@@ -461,54 +466,18 @@ __webpack_require__.d(eval_namespaceObject, {
     resolveDefaultEvalContext: ()=>resolveDefaultEvalContext,
     schema: ()=>eval_schema
 });
-var get_template_source_namespaceObject = {};
-__webpack_require__.r(get_template_source_namespaceObject);
-__webpack_require__.d(get_template_source_namespaceObject, {
-    handler: ()=>get_template_source_handler,
-    schema: ()=>get_template_source_schema
-});
 var inspect_namespaceObject = {};
 __webpack_require__.r(inspect_namespaceObject);
 __webpack_require__.d(inspect_namespaceObject, {
     handler: ()=>inspect_handler,
     schema: ()=>inspect_schema
 });
-var install_browser_namespaceObject = {};
-__webpack_require__.r(install_browser_namespaceObject);
-__webpack_require__.d(install_browser_namespaceObject, {
-    handler: ()=>install_browser_handler,
-    schema: ()=>install_browser_schema
-});
-var list_browsers_namespaceObject = {};
-__webpack_require__.r(list_browsers_namespaceObject);
-__webpack_require__.d(list_browsers_namespaceObject, {
-    handler: ()=>list_browsers_handler,
-    schema: ()=>list_browsers_schema
-});
 var list_extensions_namespaceObject = {};
 __webpack_require__.r(list_extensions_namespaceObject);
 __webpack_require__.d(list_extensions_namespaceObject, {
     handler: ()=>list_extensions_handler,
     schema: ()=>list_extensions_schema
 });
-var list_templates_namespaceObject = {};
-__webpack_require__.r(list_templates_namespaceObject);
-__webpack_require__.d(list_templates_namespaceObject, {
-    handler: ()=>list_templates_handler,
-    schema: ()=>list_templates_schema
-});
-var login_namespaceObject = {};
-__webpack_require__.r(login_namespaceObject);
-__webpack_require__.d(login_namespaceObject, {
-    handler: ()=>login_handler,
-    schema: ()=>login_schema
-});
-var logout_namespaceObject = {};
-__webpack_require__.r(logout_namespaceObject);
-__webpack_require__.d(logout_namespaceObject, {
-    handler: ()=>logout_handler,
-    schema: ()=>logout_schema
-});
 var logs_namespaceObject = {};
 __webpack_require__.r(logs_namespaceObject);
 __webpack_require__.d(logs_namespaceObject, {
@@ -536,30 +505,24 @@ __webpack_require__.d(preview_web_namespaceObject, {
     handler: ()=>preview_web_handler,
     schema: ()=>preview_web_schema
 });
-var preview_namespaceObject = {};
-__webpack_require__.r(preview_namespaceObject);
-__webpack_require__.d(preview_namespaceObject, {
-    handler: ()=>preview_handler,
-    schema: ()=>preview_schema
-});
 var tools_publish_namespaceObject = {};
 __webpack_require__.r(tools_publish_namespaceObject);
 __webpack_require__.d(tools_publish_namespaceObject, {
     handler: ()=>publish_handler,
     schema: ()=>publish_schema
 });
-var release_list_namespaceObject = {};
-__webpack_require__.r(release_list_namespaceObject);
-__webpack_require__.d(release_list_namespaceObject, {
-    handler: ()=>release_list_handler,
-    schema: ()=>release_list_schema
-});
 var release_promote_namespaceObject = {};
 __webpack_require__.r(release_promote_namespaceObject);
 __webpack_require__.d(release_promote_namespaceObject, {
     handler: ()=>release_promote_handler,
     schema: ()=>release_promote_schema
 });
+var release_status_namespaceObject = {};
+__webpack_require__.r(release_status_namespaceObject);
+__webpack_require__.d(release_status_namespaceObject, {
+    handler: ()=>release_status_handler,
+    schema: ()=>release_status_schema
+});
 var reload_namespaceObject = {};
 __webpack_require__.r(reload_namespaceObject);
 __webpack_require__.d(reload_namespaceObject, {
@@ -572,12 +535,6 @@ __webpack_require__.d(shares_namespaceObject, {
     handler: ()=>shares_handler,
     schema: ()=>shares_schema
 });
-var source_inspect_namespaceObject = {};
-__webpack_require__.r(source_inspect_namespaceObject);
-__webpack_require__.d(source_inspect_namespaceObject, {
-    handler: ()=>source_inspect_handler,
-    schema: ()=>source_inspect_schema
-});
 var start_namespaceObject = {};
 __webpack_require__.r(start_namespaceObject);
 __webpack_require__.d(start_namespaceObject, {
@@ -597,13 +554,18 @@ __webpack_require__.d(storage_namespaceObject, {
     handler: ()=>storage_handler,
     schema: ()=>storage_schema
 });
-var store_status_namespaceObject = {};
-__webpack_require__.r(store_status_namespaceObject);
-__webpack_require__.d(store_status_namespaceObject, {
-    handler: ()=>store_status_handler,
-    latestSubmissionsByStore: ()=>latestSubmissionsByStore,
-    normalizeStoresStatus: ()=>normalizeStoresStatus,
-    schema: ()=>store_status_schema
+var submit_namespaceObject = {};
+__webpack_require__.r(submit_namespaceObject);
+__webpack_require__.d(submit_namespaceObject, {
+    handler: ()=>submit_handler,
+    schema: ()=>submit_schema,
+    storeMdWarnings: ()=>storeMdWarnings
+});
+var templates_namespaceObject = {};
+__webpack_require__.r(templates_namespaceObject);
+__webpack_require__.d(templates_namespaceObject, {
+    handler: ()=>templates_handler,
+    schema: ()=>templates_schema
 });
 var theme_verify_namespaceObject = {};
 __webpack_require__.r(theme_verify_namespaceObject);
@@ -611,25 +573,13 @@ __webpack_require__.d(theme_verify_namespaceObject, {
     handler: ()=>theme_verify_handler,
     schema: ()=>theme_verify_schema
 });
-var uninstall_browser_namespaceObject = {};
-__webpack_require__.r(uninstall_browser_namespaceObject);
-__webpack_require__.d(uninstall_browser_namespaceObject, {
-    handler: ()=>uninstall_browser_handler,
-    schema: ()=>uninstall_browser_schema
-});
 var wait_namespaceObject = {};
 __webpack_require__.r(wait_namespaceObject);
 __webpack_require__.d(wait_namespaceObject, {
     handler: ()=>wait_handler,
     schema: ()=>wait_schema
 });
-var whoami_namespaceObject = {};
-__webpack_require__.r(whoami_namespaceObject);
-__webpack_require__.d(whoami_namespaceObject, {
-    handler: ()=>whoami_handler,
-    schema: ()=>whoami_schema
-});
-var package_namespaceObject = JSON.parse('{"rE":"6.5.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+var package_namespaceObject = JSON.parse('{"rE":"9.0.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
 function credentialsPath() {
     if ("win32" === process.platform) {
         const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
@@ -647,7 +597,7 @@ function readCredentials() {
         if (1 !== data.version) return null;
         const token = String(data.token || "").trim();
         if (!token) return null;
-        const provider = "extensiondev" === data.provider || "github" === data.provider ? data.provider : void 0;
+        const provider = "extensiondev" === data.provider ? data.provider : void 0;
         return {
             version: 1,
             token,
@@ -735,15 +685,6 @@ function safeApiBase(raw) {
     };
 }
 async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        provider: "github",
-        clientId: override,
-        scope: "read:user",
-        deviceCodeUrl: "/api/cli/device/code",
-        deviceTokenUrl: "/api/cli/device/token",
-        verificationUri: "https://github.com/login/device"
-    };
     const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
         headers: {
             accept: "application/json"
@@ -751,16 +692,10 @@ async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
     });
     if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
     const data = await res.json().catch(()=>({}));
-    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
-    const clientId = String(data.githubClientId || "").trim();
-    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
     return {
-        provider,
-        clientId,
-        scope: String(data.scope || "read:user"),
         deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
         deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
-        verificationUri: String(data.verificationUri || "https://github.com/login/device")
+        verificationUri: String(data.verificationUri || `${apiBase.replace(/\/+$/, "")}/device`)
     };
 }
 function persistTokenResponse(args) {
@@ -773,39 +708,115 @@ function persistTokenResponse(args) {
         projectSlug: String(args.data.projectSlug || ""),
         expiresAt: Number(args.data.expiresAt || 0),
         api: args.apiBase,
-        provider: args.provider
+        provider: "extensiondev"
     };
     writeCredentials(creds);
     return creds;
 }
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
+const INSTALL_HEADER = "x-extensiondev-install";
+const SESSION_HEADER = "x-extensiondev-session";
+const TOOL_HEADER = "x-extensiondev-tool";
+const ROTATE_AFTER_MS = 2592000000;
+function installIdentityDir() {
+    if ("win32" === process.platform) {
+        const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
+        return node_path.join(base, "extension-dev");
+    }
+    const xdg = String(process.env.XDG_CONFIG_HOME || "").trim();
+    const base = xdg || node_path.join(node_os.homedir(), ".config");
+    return node_path.join(base, "extension-dev");
+}
+function installIdentityPath() {
+    return node_path.join(installIdentityDir(), "install.json");
+}
+function telemetryDisabled() {
+    const off = (value)=>{
+        const raw = String(value || "").trim().toLowerCase();
+        return "" !== raw && "0" !== raw && "false" !== raw;
+    };
+    return off(process.env.EXTENSION_DEV_NO_TELEMETRY) || off(process.env.DO_NOT_TRACK);
+}
+function randomId() {
+    return node_crypto.randomBytes(16).toString("hex");
+}
+function readStoredInstallIdentity() {
     try {
-        data = JSON.parse(text);
+        const raw = node_fs.readFileSync(installIdentityPath(), "utf8");
+        const data = JSON.parse(raw);
+        if (!data || "object" != typeof data) return null;
+        if (1 !== data.version) return null;
+        const installId = String(data.installId || "").trim();
+        if (!/^[0-9a-f]{32}$/.test(installId)) return null;
+        const rotatedAt = Number(data.rotatedAt || 0);
+        if (!Number.isFinite(rotatedAt) || rotatedAt <= 0) return null;
+        return {
+            version: 1,
+            installId,
+            rotatedAt
+        };
     } catch  {
-        data = {
-            message: text
+        return null;
+    }
+}
+function writeStoredInstallIdentity(identity) {
+    const file = installIdentityPath();
+    try {
+        node_fs.mkdirSync(node_path.dirname(file), {
+            recursive: true,
+            mode: 448
+        });
+        node_fs.writeFileSync(file, JSON.stringify(identity, null, 2) + "\n", {
+            mode: 384
+        });
+        return true;
+    } catch  {
+        return false;
+    }
+}
+let ephemeralInstallId = "";
+function resolveInstallId(now = Date.now()) {
+    if (telemetryDisabled()) return "";
+    try {
+        installIdentityPath();
+    } catch  {
+        return "";
+    }
+    const stored = readStoredInstallIdentity();
+    if (stored && now - stored.rotatedAt < ROTATE_AFTER_MS) return stored.installId;
+    const rotated = {
+        version: 1,
+        installId: randomId(),
+        rotatedAt: now
+    };
+    if (writeStoredInstallIdentity(rotated)) {
+        ephemeralInstallId = "";
+        return rotated.installId;
+    }
+    if (!ephemeralInstallId) ephemeralInstallId = rotated.installId;
+    return ephemeralInstallId;
+}
+let processSessionId = "";
+function session_identity_sessionId() {
+    if (telemetryDisabled()) return "";
+    if (!processSessionId) processSessionId = randomId();
+    return processSessionId;
+}
+function identityHeaders(tool) {
+    try {
+        if (telemetryDisabled()) return {};
+        const name = String(tool || "").trim().toLowerCase();
+        if (!/^[a-z0-9_]{1,64}$/.test(name)) return {};
+        const install = resolveInstallId();
+        const session = session_identity_sessionId();
+        if (!install || !session) return {};
+        return {
+            [INSTALL_HEADER]: install,
+            [SESSION_HEADER]: session,
+            [TOOL_HEADER]: name
         };
+    } catch  {
+        return {};
     }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    return persistTokenResponse({
-        apiBase: args.apiBase,
-        data,
-        provider: "github"
-    });
 }
 function _define_property(obj, key, value) {
     if (key in obj) Object.defineProperty(obj, key, {
@@ -874,7 +885,8 @@ class RegistryAccessTokens {
                 method: "POST",
                 headers: {
                     authorization: `Bearer ${token}`,
-                    "content-type": "application/json"
+                    "content-type": "application/json",
+                    ...identityHeaders("extension_registry_access")
                 },
                 body: JSON.stringify({
                     workspaceSlug: ref.workspace,
@@ -1028,7 +1040,7 @@ async function fetchRegistryJson(url, fetchImpl = fetch, options) {
     };
     const grant = await tokens.get(ref, options?.api);
     if ("ok" !== grant.status) {
-        const detail = "no-credential" === grant.status ? "This project is private. Run extension_login for it, or set EXTENSION_DEV_TOKEN." : "public" === grant.status ? "The platform reports this project is public, but the registry refused the read." : grant.message;
+        const detail = "no-credential" === grant.status ? "This project is private. Run extension_auth (action: login) for it, or set EXTENSION_DEV_TOKEN." : "public" === grant.status ? "The platform reports this project is public, but the registry refused the read." : grant.message;
         return {
             ok: false,
             status: res.status,
@@ -1134,7 +1146,7 @@ function detectPackageManager(projectPath) {
 }
 const create_schema = {
     name: "extension_create",
-    description: "Create a new browser extension project from a template in the extension.dev template catalog. Use extension_list_templates to see available options. The scaffolder may initialize a git repository in the new project; the result's defaultsApplied block reports whether it did, along with every other decision made without being asked.",
+    description: "Create a new browser extension project from a template in the extension.dev catalog. extension_templates lists what is available. The scaffolder may initialize a git repository in the new project; the result's defaultsApplied block reports whether it did, along with every other decision made without being asked.",
     inputSchema: {
         type: "object",
         properties: {
@@ -1144,12 +1156,12 @@ const create_schema = {
             },
             parentDir: {
                 type: "string",
-                description: "Directory to create the project inside. Defaults to the MCP server process cwd (NOT the caller's cwd), which may not be where you expect; pass this explicitly when you care where the project lands. Aliases: parent, into."
+                description: "Directory to create the project inside. Defaults to the MCP server process cwd, NOT the caller's cwd, so pass it whenever you care where the project lands. Aliases: parent, into."
             },
             template: {
                 type: "string",
                 default: "typescript",
-                description: "Template slug from the extension.dev template catalog (e.g. 'react', 'ai-claude', 'content-vue'). Use extension_list_templates to discover options."
+                description: "Template slug from the extension.dev catalog (e.g. 'react', 'ai-claude', 'content-vue'). extension_templates discovers them."
             },
             install: {
                 type: "boolean",
@@ -1248,7 +1260,7 @@ async function create_handler(args) {
         defaultsApplied: {
             parentDir: args.parentDir ? `${resolvedParent} (explicit)` : `${resolvedParent} (default: the MCP server process cwd, not yours; pass parentDir to choose)`,
             ...void 0 === args.template ? {
-                template: "typescript (default; run extension_list_templates to pick another, e.g. javascript for plain JS)"
+                template: "typescript (default; call extension_templates to pick another, e.g. javascript for plain JS)"
             } : {},
             packageManager: `${packageManager} (auto-detected by the scaffolder, not asked)`,
             browser: "chrome (default: extension_dev and extension_build target chrome unless you pass browser)",
@@ -1452,12 +1464,99 @@ async function getTemplateBySlug(slug) {
     const meta = await fetchTemplatesMeta();
     return meta.templates.find((t)=>t.slug === slug);
 }
-const list_templates_schema = {
-    name: "extension_list_templates",
-    description: "List available extension templates from the extension.dev template catalog. Filter by surface, framework, or tags. Returns structured metadata from templates-meta.json. Note: 'framework' is the UI framework only (react/vue/svelte/preact/vanilla) - it is not the language. TypeScript and JavaScript templates live under slugs (e.g. 'typescript', 'content-typescript'); shadcn is a React variant ('sidebar-shadcn') and provider AIs are tagged 'ai' ('ai-chatgpt', 'ai-claude'). Reach those with query/tags/slug, not framework.",
+async function searchTemplates(args) {
+    const templates = await listTemplates(args);
+    const results = templates.map((t)=>({
+            slug: t.slug,
+            description: t.description,
+            uiFramework: t.uiFramework,
+            frameworkLabel: t.uiFramework || "vanilla",
+            surfaces: t.surfaces,
+            tags: t.tags,
+            difficulty: t.difficulty,
+            featured: t.featured,
+            useCases: t.useCases,
+            repositoryUrl: t.repositoryUrl,
+            downloads: t.downloads
+        }));
+    return JSON.stringify({
+        count: results.length,
+        templates: results
+    });
+}
+async function readTemplateSource(args) {
+    const template = await getTemplateBySlug(args.slug);
+    if (!template) return JSON.stringify({
+        error: `Template '${args.slug}' not found in the catalog`,
+        hint: 'Use extension_templates with action: "list" to see available templates.'
+    });
+    const meta = {
+        slug: template.slug,
+        description: template.description,
+        uiFramework: template.uiFramework || "vanilla",
+        surfaces: template.surfaces,
+        permissions: template.permissions,
+        patternExplanation: template.patternExplanation,
+        keyFiles: template.keyFiles,
+        repositoryUrl: template.repositoryUrl
+    };
+    if (!args.files?.length) return JSON.stringify({
+        ...meta,
+        files: template.files.map((f)=>stripTemplatePathPrefix(template.slug, f)),
+        hint: "Pass specific file paths in the files parameter to read their contents."
+    });
+    const fileContents = {};
+    const errors = [];
+    await Promise.all(args.files.map(async (filePath)=>{
+        const urls = await templateFileUrls(args.slug, filePath);
+        let lastStatus = 0;
+        for (const url of urls)try {
+            const response = await fetch(url);
+            if (response.ok) {
+                fileContents[filePath] = await response.text();
+                return;
+            }
+            lastStatus = response.status;
+        } catch  {}
+        errors.push(`${filePath}: ${lastStatus || "fetch failed"}`);
+    }));
+    return JSON.stringify({
+        ...meta,
+        fileContents,
+        ...errors.length ? {
+            errors
+        } : {}
+    });
+}
+const templates_schema = {
+    name: "extension_templates",
+    description: "Browse the extension.dev template catalog. action:'list' (default) searches and filters it and returns metadata per template; action:'source' reads one template's files by `slug`, for learning a pattern before building something similar. `framework` is the UI framework ONLY, never the language: TypeScript and JavaScript templates live under slugs ('typescript', 'content-typescript'), shadcn is a React variant ('sidebar-shadcn'), and provider AIs are tagged 'ai' ('ai-chatgpt', 'ai-claude'). Reach those with query/tags/slug.",
     inputSchema: {
         type: "object",
         properties: {
+            action: {
+                type: "string",
+                enum: [
+                    "list",
+                    "source"
+                ],
+                default: "list"
+            },
+            slug: {
+                type: "string",
+                description: "source: which template to read (e.g. 'ai-claude', 'content-react'). Required for source."
+            },
+            files: {
+                type: "array",
+                items: {
+                    type: "string"
+                },
+                description: "source: paths to read (e.g. ['src/manifest.json']). Omit for the file listing."
+            },
+            query: {
+                type: "string",
+                description: "list: keyword search over slug, description, tags and useCases. Ranks by word matches, so a natural phrase works."
+            },
             surface: {
                 type: "string",
                 enum: [
@@ -1466,7 +1565,7 @@ const list_templates_schema = {
                     "newtab",
                     "background"
                 ],
-                description: "Filter by extension surface type. For a popup/action starter use the 'action' slug (query:'action'), not a surface filter."
+                description: "list: filter by surface. For a popup/action starter use query:'action', not a surface."
             },
             framework: {
                 type: "string",
@@ -1477,46 +1576,104 @@ const list_templates_schema = {
                     "preact",
                     ""
                 ],
-                description: "Filter by UI framework only (empty string = vanilla JS). Not a language filter - for TypeScript/JavaScript use query or slug."
+                description: "list: UI framework filter (empty string = vanilla JS)."
             },
             tags: {
                 type: "array",
                 items: {
                     type: "string"
                 },
-                description: "Filter by tags (e.g. ['ai', 'chat'])"
+                description: "list: filter by tags, e.g. ['ai', 'chat']."
             },
             featured: {
                 type: "boolean",
-                description: "Only show featured templates"
-            },
-            query: {
-                type: "string",
-                description: "Keyword search across slug, description, tags, and useCases. Ranks by how many query words match, so a natural phrase works; single keywords are fine too."
+                description: "list: only featured templates."
             }
-        }
+        },
+        required: []
     }
 };
-async function list_templates_handler(args) {
-    const templates = await listTemplates(args);
-    const results = templates.map((t)=>({
-            slug: t.slug,
-            description: t.description,
-            uiFramework: t.uiFramework,
-            frameworkLabel: t.uiFramework || "vanilla",
-            surfaces: t.surfaces,
-            tags: t.tags,
-            difficulty: t.difficulty,
-            featured: t.featured,
-            useCases: t.useCases,
-            repositoryUrl: t.repositoryUrl,
-            downloads: t.downloads
-        }));
-    return JSON.stringify({
-        count: results.length,
-        templates: results
+async function templates_handler(args) {
+    if ((args.action ?? "list") === "source" || !args.action && args.slug) {
+        if (!args.slug) return JSON.stringify({
+            ok: false,
+            error: "action 'source' needs a slug.",
+            hint: 'Call extension_templates with action: "list" to find one.'
+        });
+        return readTemplateSource({
+            slug: args.slug,
+            files: args.files
+        });
+    }
+    return searchTemplates({
+        surface: args.surface,
+        framework: args.framework,
+        tags: args.tags,
+        featured: args.featured,
+        query: args.query
     });
 }
+const LAUNCHABLE_BROWSERS = [
+    "chrome",
+    "chromium",
+    "edge",
+    "brave",
+    "opera",
+    "vivaldi",
+    "yandex",
+    "firefox",
+    "waterfox",
+    "librewolf",
+    "safari",
+    "chromium-based",
+    "gecko-based",
+    "firefox-based",
+    "webkit-based"
+];
+const REAL_BROWSERS = [
+    "chrome",
+    "chromium",
+    "edge",
+    "brave",
+    "opera",
+    "vivaldi",
+    "yandex",
+    "firefox",
+    "waterfox",
+    "librewolf",
+    "safari"
+];
+const MANAGED_BROWSERS = [
+    "chrome",
+    "chromium",
+    "edge",
+    "firefox"
+];
+const PROJECT_PATH = {
+    type: "string",
+    description: "Extension project root"
+};
+const SESSION_PROJECT_PATH = {
+    type: "string",
+    description: "Extension project root (needs a live dev session)"
+};
+const SESSION_BROWSER = {
+    type: "string",
+    description: "Session browser; defaults to this project's live session"
+};
+const CALL_TIMEOUT = {
+    type: "number",
+    description: "Command timeout in ms (default 5000)"
+};
+const API_BASE = {
+    type: "string",
+    description: "Platform base URL (default EXTENSION_DEV_API_URL, else https://www.extension.dev)"
+};
+const LAUNCH_BROWSER = {
+    type: "string",
+    enum: LAUNCHABLE_BROWSERS,
+    default: "chrome"
+};
 const PINNED_CLI_VERSION = String(package_namespaceObject.El.OP ?? "latest").replace(/^[\^~]/, "");
 function pinnedCliVersion() {
     const override = String(process.env.EXTENSION_MCP_CLI_VERSION || "").trim();
@@ -2006,17 +2163,17 @@ function materializeCarrier(projectPath, browser) {
             ...ignored ? {
                 gitignored: ignored
             } : {},
-            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://inspect.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
+            note: "Live-preview carrier placed in ./extensions; Extension.js loads it as a companion beside your extension. Open https://preview.extension.dev/?session=live in the dev browser (any http://localhost origin works too) to watch the session's real-lane chrome.* trace on the Trace tab. It is a debug companion, never part of a release: extension_stop and extension_build remove it again" + (ignored ? `, and ${ignored} was added to .gitignore.` : "."),
             limitations: [
                 "The trace shows calls a PAGE bridges to the carrier. Your extension's own chrome.* calls run directly in its contexts and never cross the carrier, so they do not appear.",
                 "Bridged calls run under the CARRIER's identity, not your extension's. The preview assumes a single active guest and does not namespace per-extension state, so storage, action/badge state, messaging delivery, offscreen documents and relative script paths belong to the carrier. Rows affected are badged carrier-scoped in the Trace tab.",
                 "Chromium-family only: Firefox has no externally_connectable channel for web pages."
             ],
-            graduation: "The carrier lane is the SHARED real lane: bridged calls run as the carrier, by design (see limitations). Your guest is already loaded as ITSELF in this same session, so for its own storage, identity, badge and messaging (the isolated real thing), drive the guest directly instead of the carrier bridge: extension_storage, extension_eval and extension_dom_inspect against this projectPath all operate on the guest as itself. Start (or replace) this session with allowControl: true (or allowEval: true) to unlock them. Use the carrier bridge for the shared real-lane TRACE; use the control verbs for the guest's OWN state.",
+            graduation: "The carrier lane is the SHARED real lane: bridged calls run as the carrier, by design (see limitations). Your guest is already loaded as ITSELF in this same session, so for its own storage, identity, badge and messaging (the isolated real thing), drive the guest directly instead of the carrier bridge: extension_storage, extension_eval and extension_dom_snapshot against this projectPath all operate on the guest as itself. Start (or replace) this session with allowControl: true (or allowEval: true) to unlock them. Use the carrier bridge for the shared real-lane TRACE; use the control verbs for the guest's OWN state.",
             ...carrierId ? {
                 bridgeProtocol: {
                     carrierExtensionId: carrierId,
-                    allowedOrigins: "https://inspect.extension.dev, https://intelligence.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
+                    allowedOrigins: "https://preview.extension.dev, https://code.extension.dev, https://themes.extension.dev, http://localhost/*, http://127.0.0.1/*",
                     howTo: "From a page on an allowed origin, register your guest once with a 'session' message (it declares the permissions the carrier enforces), then send 'bridge' messages to run chrome.* for real; each one streams into the Trace tab. Use the EXACT dotted wire names the bridge dispatcher accepts: storage is storage.get/set/remove/clear with the AREA AS AN ARGUMENT, NOT storage.local.get.",
                     example: [
                         `const id = '${carrierId}'`,
@@ -2136,32 +2293,8 @@ const build_schema = {
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari",
-                    "chromium-based",
-                    "gecko-based",
-                    "firefox-based",
-                    "webkit-based"
-                ],
-                default: "chrome",
-                description: "Target browser"
-            },
+            projectPath: PROJECT_PATH,
+            browser: LAUNCH_BROWSER,
             zip: {
                 type: "boolean",
                 default: false,
@@ -2199,7 +2332,7 @@ const build_schema = {
             skipValidation: {
                 type: "boolean",
                 default: false,
-                description: "Build even when extension_manifest_validate reports build-blocking errors. The build normally refuses, because a manifest error means the bundle it produces is broken in ways the bundler itself does not report."
+                description: "Build even when extension_manifest_validate reports build-blocking errors. The build normally refuses: a manifest error yields a broken bundle the bundler itself never flags."
             }
         },
         required: [
@@ -2421,22 +2554,19 @@ async function build_handler(args) {
 }
 const stop_schema = {
     name: "extension_stop",
-    description: "Stop a running dev, start, or preview session: terminates the dev server and the browser it launched, and removes the live-preview carrier if extension_dev placed one. Counterpart to extension_dev/extension_start. Call it when you are done verifying so sessions do not accumulate.",
+    description: "Stop a session that extension_dev or extension_start is running: terminates the server and the browser it launched, and removes the live-preview carrier if extension_dev placed one. Covers extension_start build:false too, which the registry still records as a preview session. Call it when you are done verifying so sessions do not accumulate.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
+            projectPath: PROJECT_PATH,
             browser: {
                 type: "string",
-                description: "Browser of the session to stop (matches the browser passed to extension_dev/extension_start). Defaults to the one live session for this project when omitted, instead of assuming chrome."
+                description: "Browser of the session to stop. Defaults to the single live session for this project rather than assuming chrome."
             },
             all: {
                 type: "boolean",
                 default: false,
-                description: "Stop every known session, across projects and browsers. Discovers sessions from this server's registry AND the on-disk session markers earlier runs left, so it still finds sessions after an MCP restart or after a dev child exited out from under the registry. When true, projectPath/browser are ignored."
+                description: "Stop every known session across projects and browsers, found from this server's registry AND the on-disk markers earlier runs left, so it still works after an MCP restart. projectPath/browser are then ignored."
             }
         },
         required: []
@@ -2588,7 +2718,7 @@ async function stop_handler(args) {
 const LAUNCH_FLAG_SCHEMA = {
     profile: {
         type: "string",
-        description: 'Browser profile path, or "false" to reuse the default user profile. Omit for a fresh throwaway profile.'
+        description: 'Profile path, or "false" to reuse the real user profile. Omit for a throwaway one.'
     },
     startingUrl: {
         type: "string",
@@ -2596,26 +2726,26 @@ const LAUNCH_FLAG_SCHEMA = {
     },
     chromiumBinary: {
         type: "string",
-        description: "Path to a custom Chromium-based binary (overrides browser)"
+        description: "Custom Chromium-based binary (overrides browser)"
     },
     geckoBinary: {
         type: "string",
-        description: "Path to a custom Gecko/Firefox binary (overrides browser)"
+        description: "Custom Gecko/Firefox binary (overrides browser)"
     },
     host: {
         type: "string",
-        description: "Dev server bind host. Use 0.0.0.0 for Docker or devcontainers. Defaults to 127.0.0.1"
+        description: "Bind host, default 127.0.0.1. Use 0.0.0.0 in Docker or devcontainers."
     },
     publicHost: {
         type: "string",
-        description: "Connectable host the browser dials for HMR and reload when it differs from the bind host"
+        description: "Host the browser dials for HMR and reload when it differs from the bind host"
     },
     extensions: {
         type: "array",
         items: {
             type: "string"
         },
-        description: "Companion extension paths or store URLs to load alongside the project"
+        description: "Extra extension paths or store URLs to load alongside the project"
     }
 };
 function launchFlagArgs(args) {
@@ -2631,35 +2761,12 @@ function launchFlagArgs(args) {
 }
 const dev_schema = {
     name: "extension_dev",
-    description: "Start the extension development server with hot module replacement. Launches a browser with the extension loaded. Returns process info for use with extension_wait and extension_source_inspect.",
+    description: "Run the extension WHILE YOU EDIT IT: dev build, hot module replacement, and a browser with it loaded. The default answer to \"run my extension\". Only this tool can unlock the control channel that extension_storage/reload/open/dom_snapshot need (allowControl) and that extension_eval needs (allowEval). For the production build in a browser instead, use extension_start. Returns process info for extension_wait and extension_inspect.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari",
-                    "chromium-based",
-                    "gecko-based",
-                    "firefox-based",
-                    "webkit-based"
-                ],
-                default: "chrome"
-            },
+            projectPath: PROJECT_PATH,
+            browser: LAUNCH_BROWSER,
             port: {
                 type: "number",
                 description: "Dev server port (0 for auto-assign)"
@@ -2667,7 +2774,7 @@ const dev_schema = {
             noBrowser: {
                 type: "boolean",
                 default: false,
-                description: "Start dev server without launching browser"
+                description: "Start the dev server without launching a browser"
             },
             polyfill: {
                 type: "boolean",
@@ -2678,22 +2785,22 @@ const dev_schema = {
             replace: {
                 type: "boolean",
                 default: false,
-                description: "Stop any live session already running for this projectPath before starting; the result then reports it as replacedSession. Without it, extension_dev refuses to start over a live session instead of silently forking it (two sessions fight over the browser profile and the newer browser dies on the profile lock)."
+                description: "Stop the live session for this projectPath first, reported as replacedSession. Without it a second call is refused rather than forking: two sessions fight over one profile and the newer browser dies on the lock."
             },
             allowControl: {
                 type: "boolean",
                 default: false,
-                description: "Enable the agent-bridge control channel so extension_storage/reload/open/dom_inspect work against this session"
+                description: "Enable the agent-bridge control channel that extension_storage/reload/open/dom_snapshot need"
             },
             allowEval: {
                 type: "boolean",
                 default: false,
-                description: "Enable extension_eval (runs code in a context; writes a 0600 session token). Implies allowControl, so a single allowEval: true also unlocks storage/reload/open/dom_inspect. You do not need to pass both."
+                description: "Enable extension_eval (runs code in a context; writes a 0600 session token). Implies allowControl, so you never need to pass both."
             },
             carrier: {
                 type: "boolean",
                 default: false,
-                description: "Load the bundled Extension.dev Live Preview carrier beside your extension (Chromium-family browsers only). It is placed in the project's ./extensions folder, which Extension.js auto-loads; allowlisted pages (inspect.extension.dev, localhost) can then pair with the session and stream its real-lane chrome.* trace. Writes extensions/extension-dev-live-preview/ into the project, gitignores it, and takes it back out on extension_stop or extension_build: it is a debug companion, never part of a release."
+                description: "Load the bundled Live Preview carrier beside your extension (Chromium only) so allowlisted pages (preview.extension.dev, localhost) can pair with the session and stream its real-lane chrome.* trace. Written into the auto-loaded ./extensions folder, gitignored, and removed on extension_stop or extension_build: never part of a release."
             }
         },
         required: [
@@ -2806,11 +2913,11 @@ async function dev_handler(args) {
             hint: `A locked profile means another session's browser still holds it: call extension_stop with this projectPath to kill that session, then start extension_dev again. If the lock survives a crash, remove ${profileDir} manually before retrying.`
         });
     }
-    const controlVerbs = "storage, reload, open, dom_inspect";
+    const controlVerbs = "storage, reload, open, dom_snapshot";
     const capabilities = {
         allowControl,
         allowEval: Boolean(args.allowEval),
-        unlocked: allowControl ? args.allowEval ? `${controlVerbs}, eval` : controlVerbs : "none (read-only: logs, source_inspect, wait, doctor)"
+        unlocked: allowControl ? args.allowEval ? `${controlVerbs}, eval` : controlVerbs : "none (read-only: logs, inspect, wait, doctor)"
     };
     const boundPort = contractBoundPort(args.projectPath, browser, spawnedAt);
     if (null !== boundPort && boundPort !== args.port) registerSession({
@@ -2848,7 +2955,7 @@ async function dev_handler(args) {
             } : {}
         } : {},
         capabilities,
-        hint: args.noBrowser ? "Build-only session (noBrowser: true): no browser will launch, so no runtime will ever attach. extension_wait returns as soon as the first compile lands (compiled: true, browserAttached: false) instead of waiting out its budget; do not wait for a browser. The control verbs (storage/reload/open/dom_inspect/eval) need a live browser and will not work against this session. When you are done, call extension_stop to shut down the dev server." : "Use extension_wait to check when the extension is fully loaded, then extension_source_inspect to inspect the live state. " + (allowControl ? `Control channel is ON: extension_${controlVerbs.split(", ").join("/extension_")}${args.allowEval ? "/extension_eval" : ""} will work against this session.` : "Control channel is OFF: extension_storage/reload/open/dom_inspect need allowControl: true, and extension_eval needs allowEval: true (which also implies allowControl). To unlock them, call extension_dev again with the flag you need plus replace: true (it stops this session first); a plain second call is refused so the session does not fork.") + " When you are done, call extension_stop to shut down the dev server and browser.",
+        hint: args.noBrowser ? "Build-only session (noBrowser: true): no browser will launch, so no runtime will ever attach. extension_wait returns as soon as the first compile lands (compiled: true, browserAttached: false) instead of waiting out its budget; do not wait for a browser. The control verbs (storage/reload/open/dom_snapshot/eval) need a live browser and will not work against this session. When you are done, call extension_stop to shut down the dev server." : "Use extension_wait to check when the extension is fully loaded, then extension_inspect to inspect the live state. " + (allowControl ? `Control channel is ON: extension_${controlVerbs.split(", ").join("/extension_")}${args.allowEval ? "/extension_eval" : ""} will work against this session.` : "Control channel is OFF: extension_storage/reload/open/dom_snapshot need allowControl: true, and extension_eval needs allowEval: true (which also implies allowControl). To unlock them, call extension_dev again with the flag you need plus replace: true (it stops this session first); a plain second call is refused so the session does not fork.") + " When you are done, call extension_stop to shut down the dev server and browser.",
         earlyOutput: cleanOutput.slice(0, 500),
         logPath
     });
@@ -2871,39 +2978,21 @@ function denoiseEarlyOutput(raw) {
 }
 const start_schema = {
     name: "extension_start",
-    description: "Build the extension for production and immediately preview it in a browser. Combines build + preview in one step. No hot reload.",
+    description: "Run the PRODUCTION build in a browser: builds the project, then serves it and launches. No hot module replacement and no control channel, so your edits are not picked up and extension_eval/storage/reload/open/dom_snapshot cannot attach to this session. Use extension_dev while writing code; use this to check what actually ships. Pass build:false to launch on an existing dist/<browser> without rebuilding.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari",
-                    "chromium-based",
-                    "gecko-based",
-                    "firefox-based",
-                    "webkit-based"
-                ],
-                default: "chrome"
+            projectPath: PROJECT_PATH,
+            browser: LAUNCH_BROWSER,
+            build: {
+                type: "boolean",
+                default: true,
+                description: "Build before serving. false serves the existing dist/<browser> as-is and fails when there is none."
             },
             polyfill: {
                 type: "boolean",
                 default: true,
-                description: "Apply cross-browser polyfill"
+                description: "Apply cross-browser polyfill (build only)"
             },
             port: {
                 type: "number",
@@ -2912,7 +3001,7 @@ const start_schema = {
             noBrowser: {
                 type: "boolean",
                 default: false,
-                description: "Build and serve without launching a browser"
+                description: "Serve without launching a browser"
             },
             ...LAUNCH_FLAG_SCHEMA
         },
@@ -2923,127 +3012,15 @@ const start_schema = {
 };
 async function start_handler(args) {
     const browser = args.browser ?? "chrome";
+    const building = false !== args.build;
+    const command = building ? "start" : "preview";
     const cliArgs = [
-        "start",
-        args.projectPath,
-        "--browser",
-        browser
-    ];
-    if (false === args.polyfill) cliArgs.push("--polyfill", "false");
-    if (void 0 !== args.port) cliArgs.push("--port", String(args.port));
-    if (args.noBrowser) cliArgs.push("--no-browser");
-    cliArgs.push(...launchFlagArgs(args));
-    const spawnedAt = Date.now();
-    const spawned = spawnExtensionCli(cliArgs, {
-        projectDir: args.projectPath
-    });
-    const { child, logPath } = spawned;
-    const pid = child.pid;
-    registerSession({
-        pid,
-        browser,
-        projectPath: args.projectPath,
-        command: "start"
-    });
-    child.on("exit", ()=>removeSession(args.projectPath, browser));
-    await new Promise((resolve)=>setTimeout(resolve, 5000));
-    const earlyOutput = spawned.readOutput();
-    if (null !== child.exitCode || null !== child.signalCode) {
-        const code = child.exitCode;
-        const signal = child.signalCode;
-        return JSON.stringify({
-            ok: false,
-            status: "exited",
-            projectPath: args.projectPath,
-            browser,
-            pid,
-            exitCode: code,
-            signal,
-            error: `The preview server exited during startup (${signal ? `signal ${signal}` : `exit code ${code}`}). No session is running.`,
-            output: earlyOutput.slice(0, 2000),
-            logPath,
-            hint: "Read `output` above for the cause: a failed production build, a port already in use, or a missing browser binary are the common ones. extension_build will surface a build error on its own."
-        });
-    }
-    const exitStamp = browserExitStamp(args.projectPath, browser, spawnedAt);
-    if (exitStamp) return JSON.stringify({
-        ok: false,
-        status: "browser-exited",
-        projectPath: args.projectPath,
-        browser,
-        pid,
-        ...exitStamp,
-        error: "The preview process is running but the browser it launched has exited (the extension may have been rejected or the browser crashed). The session cannot be driven.",
-        output: earlyOutput.slice(0, 2000),
-        logPath,
-        hint: "Read `output` above and extension_logs for the cause, then call extension_stop to clean up before retrying."
-    });
-    return JSON.stringify({
-        ok: true,
-        pid,
-        browser,
-        projectPath: args.projectPath,
-        status: "started",
-        hint: "Use extension_wait to check when the build and browser launch are complete. When you are done, call extension_stop to shut down the session.",
-        earlyOutput: earlyOutput.slice(0, 500),
-        logPath
-    });
-}
-const preview_schema = {
-    name: "extension_preview",
-    description: "Preview a production-built extension in a browser. Uses dist/ output directly. The extension must be built first with extension_build.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari",
-                    "chromium-based",
-                    "gecko-based",
-                    "firefox-based",
-                    "webkit-based"
-                ],
-                default: "chrome"
-            },
-            port: {
-                type: "number",
-                description: "Server port (0 for auto-assign)"
-            },
-            noBrowser: {
-                type: "boolean",
-                default: false,
-                description: "Serve the preview without launching a browser"
-            },
-            ...LAUNCH_FLAG_SCHEMA
-        },
-        required: [
-            "projectPath"
-        ]
-    }
-};
-async function preview_handler(args) {
-    const browser = args.browser ?? "chrome";
-    const cliArgs = [
-        "preview",
+        command,
         args.projectPath,
         "--browser",
         browser
     ];
+    if (building && false === args.polyfill) cliArgs.push("--polyfill", "false");
     if (void 0 !== args.port) cliArgs.push("--port", String(args.port));
     if (args.noBrowser) cliArgs.push("--no-browser");
     cliArgs.push(...launchFlagArgs(args));
@@ -3057,7 +3034,7 @@ async function preview_handler(args) {
         pid,
         browser,
         projectPath: args.projectPath,
-        command: "preview"
+        command
     });
     child.on("exit", ()=>removeSession(args.projectPath, browser));
     await new Promise((resolve)=>setTimeout(resolve, 5000));
@@ -3073,10 +3050,10 @@ async function preview_handler(args) {
             pid,
             exitCode: code,
             signal,
-            error: `The preview process exited during startup (${signal ? `signal ${signal}` : `exit code ${code}`}). Nothing is running.`,
+            error: `The ${command} process exited during startup (${signal ? `signal ${signal}` : `exit code ${code}`}). No session is running.`,
             output: earlyOutput.slice(0, 2000),
             logPath,
-            hint: "Read `output` above for the cause: a missing or broken dist/ (run extension_build first), or a missing browser binary are the common ones."
+            hint: building ? "Read `output` above for the cause: a failed production build, a port already in use, or a missing browser binary are the common ones. extension_build will surface a build error on its own." : "Read `output` above for the cause: a missing or broken dist/ (run extension_build first, or drop build:false), or a missing browser binary are the common ones."
         });
     }
     const exitStamp = browserExitStamp(args.projectPath, browser, spawnedAt);
@@ -3087,7 +3064,7 @@ async function preview_handler(args) {
         browser,
         pid,
         ...exitStamp,
-        error: "The preview process is running but the browser it launched has exited (the extension may have been rejected or the browser crashed). The session cannot be driven.",
+        error: `The ${command} process is running but the browser it launched has exited (the extension may have been rejected or the browser crashed). The session cannot be driven.`,
         output: earlyOutput.slice(0, 2000),
         logPath,
         hint: "Read `output` above and extension_logs for the cause, then call extension_stop to clean up before retrying."
@@ -3097,8 +3074,8 @@ async function preview_handler(args) {
         pid,
         browser,
         projectPath: args.projectPath,
-        status: "launched",
-        hint: "Call extension_stop when you are done to close the preview browser.",
+        status: building ? "started" : "launched",
+        hint: building ? "Use extension_wait to check when the build and browser launch are complete. When you are done, call extension_stop to shut down the session." : "Call extension_stop when you are done to close the preview browser.",
         earlyOutput: earlyOutput.slice(0, 500),
         logPath
     });
@@ -3716,7 +3693,7 @@ async function navigateToUrlViaBridge(projectPath, browser, url, timeout) {
             name: "NavigateFailed",
             message: `Navigation to ${url} did not produce a tab reporting that URL. The URL may not exist, or the browser refused the navigation (Firefox rejects privileged about:/chrome: URLs and other extensions' moz-extension: pages).`
         },
-        hint: "Confirm the URL, or discover open tabs with extension_dom_inspect listTabs: true. For an extension page, the path must match the BUILT manifest."
+        hint: "Confirm the URL, or discover open tabs with extension_dom_snapshot listTabs: true. For an extension page, the path must match the BUILT manifest."
     });
     return JSON.stringify({
         ok: true,
@@ -3726,7 +3703,7 @@ async function navigateToUrlViaBridge(projectPath, browser, url, timeout) {
             url: settled.url,
             title: settled.title
         },
-        hint: "Inspect it with extension_dom_inspect or extension_eval using url or this numeric tab id (context: 'page'/'content')."
+        hint: "Inspect it with extension_dom_snapshot or extension_eval using url or this numeric tab id (context: 'page'/'content')."
     });
 }
 async function resolveBridgeBaseUrl(projectPath, browser, timeout) {
@@ -3825,7 +3802,7 @@ async function navigateToUrl(projectPath, browser, url, timeout) {
                     name: "NavigateFailed",
                     message: `Navigation to ${url} did not produce a live page target. ${isExtensionPage ? "The URL may not exist in the extension bundle, or Chrome refused the navigation." : "The page may have failed to load, or the browser refused the navigation."}`
                 },
-                hint: isExtensionPage ? "Confirm the path exists in the built dist (extension_build / extension_inspect list entrypoints). For an extension page, the path must match the BUILT manifest, which may differ from your source layout." : "Confirm the URL loads in a normal browser and that the dev session's browser has network access. Nothing about your extension bundle is implicated in a failed http(s) navigation."
+                hint: isExtensionPage ? "Confirm the path exists in the built dist (extension_build / extension_analyze list entrypoints). For an extension page, the path must match the BUILT manifest, which may differ from your source layout." : "Confirm the URL loads in a normal browser and that the dev session's browser has network access. Nothing about your extension bundle is implicated in a failed http(s) navigation."
             });
         }
         return JSON.stringify({
@@ -3845,7 +3822,7 @@ async function navigateToUrl(projectPath, browser, url, timeout) {
                 title: settled.title,
                 url: settled.url
             },
-            hint: "Inspect it with extension_dom_inspect or extension_source_inspect using url (context: 'page'), they resolve the tab themselves. `target.targetId` is a CDP target id, NOT a chrome.tabs id: do not pass it as `tab`. If you need a numeric tab id, call extension_dom_inspect with listTabs: true."
+            hint: "Inspect it with extension_dom_snapshot or extension_inspect using url (context: 'page'), they resolve the tab themselves. `target.targetId` is a CDP target id, NOT a chrome.tabs id: do not pass it as `tab`. If you need a numeric tab id, call extension_dom_snapshot with listTabs: true."
         });
     } catch (e) {
         return JSON.stringify({
@@ -4086,7 +4063,7 @@ async function openSurfaceAsTab(projectPath, browser, surface) {
                 popupBounds = await applyPopupBounds(projectPath, browser, parsed.target.targetId);
                 if (popupBounds) parsed.renderedAsTab.popupBounds = popupBounds;
             }
-            parsed.hint = `Rendered the ${surface} document in a real tab, which is how you inspect a surface headlessly. ` + (popupBounds ? `The window was resized to the popup's content size (${popupBounds.width}x${popupBounds.height}${popupBounds.clamped ? ", clamped to Chrome's 25x25-800x600 popup bounds" : ""}), approximating real popup rendering. This resizes the WHOLE browser window for the session. It is the same page with the same extension APIs, but window.close() closes the tab. ` : "It is the same page with the same extension APIs, but it is NOT hosted in a popup window: no popup sizing, and window.close() closes the tab. ") + `Inspect it with extension_dom_inspect context: '${surface}' (include: ['html']), or extension_source_inspect with this url. ` + "Do NOT pass this extension-page url to extension_dom_inspect or extension_eval as a tab target: script injection cannot reach extension pages, only the surface context or CDP can.";
+            parsed.hint = `Rendered the ${surface} document in a real tab, which is how you inspect a surface headlessly. ` + (popupBounds ? `The window was resized to the popup's content size (${popupBounds.width}x${popupBounds.height}${popupBounds.clamped ? ", clamped to Chrome's 25x25-800x600 popup bounds" : ""}), approximating real popup rendering. This resizes the WHOLE browser window for the session. It is the same page with the same extension APIs, but window.close() closes the tab. ` : "It is the same page with the same extension APIs, but it is NOT hosted in a popup window: no popup sizing, and window.close() closes the tab. ") + `Inspect it with extension_dom_snapshot context: '${surface}' (include: ['html']), or extension_inspect with this url. ` + "Do NOT pass this extension-page url to extension_dom_snapshot or extension_eval as a tab target: script injection cannot reach extension pages, only the surface context or CDP can.";
             return JSON.stringify(parsed);
         }
     } catch  {}
@@ -4127,14 +4104,11 @@ async function confirmSurfaceTarget(projectPath, browser, surface, raw) {
 }
 const open_schema = {
     name: "extension_open",
-    description: "Open an extension surface or replay an event in a running session. 'popup'/'options'/'sidebar' open UI surfaces; 'newtab'/'history'/'bookmarks' open the extension's chrome_url_overrides page in a tab. 'action' triggers the toolbar action: opens the action's popup, or (no popup) replays chrome.action.onClicked. 'command' replays a chrome.commands.onCommand keyboard shortcut (pass `name`). NOTE: action/command replay invokes your listener WITHOUT a user gesture, so the gesture-derived activeTab grant does not apply (the result includes gesture:false and a warning when activeTab is declared). Requires the dev session to be started with allowControl: true (extension_dev). Wraps `extension open`.",
+    description: "Open an extension surface or replay an event in a running session. popup/options/sidebar open UI surfaces; newtab/history/bookmarks open the matching chrome_url_overrides page in a tab. 'action' triggers the toolbar action, opening its popup or replaying chrome.action.onClicked when there is none; 'command' replays a chrome.commands.onCommand shortcut (pass `name`). NOTE: action/command replay invokes your listener WITHOUT a user gesture, so the gesture-derived activeTab grant does not apply (the result reports gesture:false and warns when activeTab is declared). Requires the session to have been started with allowControl: true (extension_dev).",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             surface: {
                 type: "string",
                 enum: [
@@ -4147,7 +4121,7 @@ const open_schema = {
                     "action",
                     "command"
                 ],
-                description: "Which surface to open or event to replay. 'newtab'/'history'/'bookmarks' open the matching chrome_url_overrides page. 'action' triggers the toolbar action; 'command' replays a keyboard-shortcut command (requires `name`)."
+                description: "Which surface to open or event to replay."
             },
             name: {
                 type: "string",
@@ -4155,21 +4129,15 @@ const open_schema = {
             },
             url: {
                 type: "string",
-                description: "Navigate a real tab to this URL instead of opening a surface (Chromium via CDP; Firefox via the agent bridge, which needs allowEval: true). Use for content-script/webNavigation test pages, or the popup as a page: chrome-extension://<id>/popup.html. Alternative to `surface`."
+                description: "Navigate a real tab here instead of opening a surface (Firefox needs allowEval: true). Use for content-script test pages, or a surface as a page: chrome-extension://<id>/popup.html."
             },
             asTab: {
                 type: "boolean",
                 default: false,
-                description: "For surface popup/options/sidebar: render the surface's document in a real tab (chrome-extension://<id>/<doc>) instead of opening a real popup window. This is how you inspect a surface HEADLESSLY, where no window exists to host a popup. Applied automatically as a fallback when a headless session refuses to open the surface. Same page and APIs, but no popup sizing and window.close() closes the tab."
-            },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
+                description: "popup/options/sidebar: render the surface's document in a real tab instead of a popup window. This is how you inspect a surface HEADLESSLY, and it is applied automatically when a headless session refuses to open one. Same page and APIs, but no popup sizing and window.close() closes the tab."
             },
-            timeout: {
-                type: "number",
-                description: "Command timeout in ms (default 5000)"
-            }
+            browser: SESSION_BROWSER,
+            timeout: CALL_TIMEOUT
         },
         required: [
             "projectPath"
@@ -4284,7 +4252,8 @@ async function publish(options = {}) {
             method: "POST",
             headers: {
                 authorization: `Bearer ${token}`,
-                "content-type": "application/json"
+                "content-type": "application/json",
+                ...identityHeaders("extension_publish")
             },
             body: JSON.stringify(body)
         });
@@ -4360,7 +4329,7 @@ async function uploadPreview(options) {
         ok: false,
         error: {
             name: "PreviewAuthError",
-            message: "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+            message: "No token. Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
         }
     };
     const apiCheck = safeApiBase(resolveApiBase(options.api));
@@ -4414,7 +4383,8 @@ async function uploadPreview(options) {
             method: "POST",
             headers: {
                 authorization: `Bearer ${token}`,
-                "content-type": "application/json"
+                "content-type": "application/json",
+                ...identityHeaders("extension_preview_web")
             },
             body: JSON.stringify({
                 kind: "dist",
@@ -4573,23 +4543,13 @@ function recordSharedPreview(projectPath, entry) {
         } : {}
     };
 }
-const DEFAULT_INSPECT_URL = "http://localhost:3106";
 const DEFAULT_PREVIEW_DEV_URL = "http://localhost:3110";
-const SURFACES = {
-    preview: {
-        defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
-        scheme: (encoded)=>`preview://build/${encoded}`,
-        fetchPath: "/__preview/fetch",
-        devCommand: "pnpm --filter preview.extension.dev dev",
-        label: "preview.extension.dev"
-    },
-    inspect: {
-        defaultOrigin: DEFAULT_INSPECT_URL,
-        scheme: (encoded)=>`inspect://path/${encoded}`,
-        fetchPath: "/__inspect/fetch",
-        devCommand: "pnpm --filter inspect.extension.dev dev",
-        label: "inspect.extension.dev"
-    }
+const SURFACE = {
+    defaultOrigin: DEFAULT_PREVIEW_DEV_URL,
+    scheme: (encoded)=>`preview://build/${encoded}`,
+    fetchPath: "/__preview/fetch",
+    devCommand: "pnpm --filter preview.extension.dev dev",
+    label: "preview.extension.dev"
 };
 async function buildShare(projectPath, distDir, manifest, browser) {
     const result = await uploadPreview({
@@ -4606,7 +4566,7 @@ async function buildShare(projectPath, distDir, manifest, browser) {
             errorName: result.error.name,
             reason: result.error.message,
             ...isAuth ? {
-                loginHint: "Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+                loginHint: "Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
             } : {}
         };
     }
@@ -4674,89 +4634,49 @@ function detectSurfaces(manifest) {
 }
 const preview_web_schema = {
     name: "extension_preview_web",
-    description: "Preview an in-progress extension in the web emulator (no real browser). Builds the project (unless build:false), points preview.extension.dev at the dist directory over the dev-only preview://build scheme, and returns a deep link plus a loadability check against its dev server. preview is the author's front door: it renders YOUR build and carries the Emulated/Real lane toggle and the Trace tab. Pass surface:\"inspect\" to render in inspect.extension.dev instead (the evaluator's door, for fixture and forensic work). Pass share:true to UPLOAD the dist you just built and get back a public link (share.previewUrl) that renders those exact bytes for anyone who opens it, with no install and no dev server, and that also serves the whole build as a downloadable zip. Sharing needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days), so a local folder with no project on the platform cannot share. Use share:true whenever the build has to reach someone who is not at this machine, since the plain deepLink only resolves locally. Shared links do not disappear when this response scrolls away: extension_shares lists every link this token has shared and revokes any of them.",
+    description: "Preview an in-progress extension in the web emulator, with no real browser. Builds the project (unless build:false), points preview.extension.dev at dist/<browser> over the dev-only preview://build scheme, and returns a deep link plus a loadability check. This is the author's door for a LOCAL build: it renders your build and carries the Emulated/Real lane toggle and the Trace tab, but the deep link only resolves on this machine. To reach anyone who is not at this machine, pass share:true and hand out the public link it returns. extension_shares lists and revokes every link shared this way, so one does not vanish with this response.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
+            projectPath: PROJECT_PATH,
             browser: {
                 type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari"
-                ],
+                enum: REAL_BROWSERS,
                 default: "chrome",
-                description: "Which dist/<browser> output to preview. inspect renders it in the mocked-Chrome emulator regardless."
+                description: "Which dist/<browser> output to preview. The emulator renders it as mocked Chrome either way."
             },
             build: {
                 type: "boolean",
                 default: true,
-                description: "Build the project before previewing. Set false to preview the existing dist/<browser> as-is."
+                description: "Build first. false previews the existing dist/<browser> as-is."
             },
             distPath: {
                 type: "string",
-                description: "Preview this built directory directly instead of resolving dist/<browser> under projectPath. Implies build:false."
-            },
-            surface: {
-                type: "string",
-                enum: [
-                    "preview",
-                    "inspect"
-                ],
-                default: "preview",
-                description: "Which front door renders the build. \"preview\" (default) is preview.extension.dev, the author's door: your own in-progress build, with the Emulated/Real lane toggle and the Trace tab. \"inspect\" is inspect.extension.dev, the evaluator's door."
+                description: "Preview this built directory instead of dist/<browser> under projectPath. Implies build:false."
             },
             hostUrl: {
                 type: "string",
-                description: "Origin of the running dev server for the chosen surface (defaults: http://localhost:3110 for preview, http://localhost:3106 for inspect)."
-            },
-            inspectUrl: {
-                type: "string",
-                description: "Deprecated alias for hostUrl, kept for callers written before the preview surface existed. Only consulted when surface is \"inspect\"."
+                description: "Origin of the running preview.extension.dev dev server (default http://localhost:3110)."
             },
             probe: {
                 type: "boolean",
                 default: true,
-                description: "Confirm the surface can load the artifact by fetching its dev middleware before returning."
+                description: "Fetch the surface's dev middleware first to confirm the artifact loads."
             },
             open: {
                 type: "boolean",
                 default: false,
-                description: "Open the deep link in a running dev session's browser (a new background tab, focus-safe) instead of only returning the link. Requires a live extension_dev/extension_preview session for the project."
+                description: "Also open the deep link in a running session's browser, in a focus-safe background tab. Needs a live extension_dev/extension_start session."
             },
             openIn: {
                 type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "brave",
-                    "opera",
-                    "vivaldi",
-                    "yandex",
-                    "firefox",
-                    "waterfox",
-                    "librewolf",
-                    "safari"
-                ],
-                description: "Which running dev session's browser to open the preview in. Defaults to the `browser` value."
+                enum: REAL_BROWSERS,
+                description: "Which session's browser to open it in. Defaults to `browser`."
             },
             share: {
                 type: "boolean",
                 default: false,
-                description: "Upload the built dist and return a public link (share.previewUrl) that renders those exact bytes in the emulator for anyone who opens it: no install, no sign-in, no dev server. The link also serves the whole build as a downloadable zip (share.zipUrl), so sharing it hands over the built code. Needs a token scoped to an existing extension.dev workspace and project (extension_login or EXTENSION_DEV_TOKEN, valid up to 7 days); without one this returns a login hint and never fails the local preview. The link stays live until share.expiresAt, and DELETEing share.revokeUrl with the same token kills it sooner; a revoked link stays dead, and re-sharing the same build returns a new link. Because re-sharing never reproduces the old link, every successful share is also appended to .extension.dev/shared-previews.json in the project (gitignored) so the revoke handle survives losing this response, and extension_shares lists what is actually live on the platform and revokes any of it by id or by URL."
+                description: "Upload the built dist and return a public link (share.previewUrl) that renders those exact bytes for anyone: no install, sign-in or dev server. It also serves the build as a zip (share.zipUrl), so sharing hands over the code. Needs a token scoped to an extension.dev project (extension_auth or EXTENSION_DEV_TOKEN); without one you get a login hint and the local preview still succeeds. Live until share.expiresAt; DELETE share.revokeUrl to kill it sooner. Revocation is permanent and re-sharing mints a different link, so each share is also appended to the project's gitignored .extension.dev/shared-previews.json."
             }
         },
         required: [
@@ -4766,9 +4686,7 @@ const preview_web_schema = {
 };
 async function preview_web_handler(args) {
     const browser = args.browser ?? "chrome";
-    const surfaceKey = "inspect" === args.surface ? "inspect" : "preview";
-    const surface = SURFACES[surfaceKey];
-    const hostBase = (args.hostUrl ?? ("inspect" === surfaceKey ? args.inspectUrl : void 0) ?? surface.defaultOrigin).replace(/\/+$/, "");
+    const hostBase = (args.hostUrl ?? SURFACE.defaultOrigin).replace(/\/+$/, "");
     const shouldBuild = args.distPath ? false : false !== args.build;
     let buildResult = null;
     if (shouldBuild) {
@@ -4811,12 +4729,11 @@ async function preview_web_handler(args) {
         });
     }
     const encoded = Buffer.from(distDir).toString("base64url");
-    const internalUrl = surface.scheme(encoded);
+    const internalUrl = SURFACE.scheme(encoded);
     const deepLink = `${hostBase}/?url=${encodeURIComponent(internalUrl)}`;
     const result = {
         ok: true,
         deepLink,
-        surface: surfaceKey,
         distDir,
         manifest: {
             name: manifest.name ?? node_path.basename(distDir),
@@ -4829,7 +4746,7 @@ async function preview_web_handler(args) {
         } : {
             built: false
         },
-        hint: `Open deepLink in a browser to see the extension render in ${surface.label}'s emulator. It must be running (${surface.devCommand}).${"preview" === surfaceKey ? " Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser." : ""}`
+        hint: `Open deepLink in a browser to see the extension render in ${SURFACE.label}'s emulator. It must be running (${SURFACE.devCommand}). Once it renders, the Trace tab shows every chrome.* call it makes, and the lane toggle switches between the emulated backend and a real carrier-equipped browser.`
     };
     if (args.open) {
         const sessionBrowser = args.openIn ?? browser;
@@ -4849,7 +4766,7 @@ async function preview_web_handler(args) {
     }
     if (args.share) result.share = await buildShare(args.projectPath, distDir, manifest, browser);
     if (false === args.probe) return JSON.stringify(result);
-    const probeUrl = `${hostBase}${surface.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
+    const probeUrl = `${hostBase}${SURFACE.fetchPath}?url=${encodeURIComponent(internalUrl)}`;
     try {
         const res = await fetch(probeUrl, {
             headers: {
@@ -4864,7 +4781,7 @@ async function preview_web_handler(args) {
             probe: {
                 status: res.status,
                 contentType,
-                note: `${surface.label} answered but not with a preview payload. On the deployed host ${surface.fetchPath} does not exist (dev-only); run a local dev server (${surface.devCommand}) to use web preview.`
+                note: `${SURFACE.label} answered but not with a preview payload. On the deployed host ${SURFACE.fetchPath} does not exist (dev-only); run a local dev server (${SURFACE.devCommand}) to use web preview.`
             }
         });
         const payload = await res.json();
@@ -4886,7 +4803,7 @@ async function preview_web_handler(args) {
             previewLoadable: false,
             probe: {
                 error: err instanceof Error ? err.message : String(err),
-                note: `Could not reach ${surface.label} at ${hostBase}. Start it with '${surface.devCommand}', then open deepLink.`
+                note: `Could not reach ${SURFACE.label} at ${hostBase}. Start it with '${SURFACE.devCommand}', then open deepLink.`
             }
         });
     }
@@ -4920,7 +4837,7 @@ function authError(name) {
         ok: false,
         error: {
             name,
-            message: "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
+            message: "No token. Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard)."
         }
     };
 }
@@ -4954,7 +4871,8 @@ async function listArtifacts(options = {}) {
         res = await doFetch(url.toString(), {
             headers: {
                 authorization: `Bearer ${token}`,
-                accept: "application/json"
+                accept: "application/json",
+                ...identityHeaders("extension_shares")
             }
         });
     } catch (err) {
@@ -5009,7 +4927,8 @@ async function revokeArtifact(options) {
             method: "DELETE",
             headers: {
                 authorization: `Bearer ${token}`,
-                accept: "application/json"
+                accept: "application/json",
+                ...identityHeaders("extension_shares")
             }
         });
     } catch (err) {
@@ -5050,10 +4969,10 @@ async function revokeArtifact(options) {
         }
     };
 }
-const LOGIN_HINT = "Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).";
+const LOGIN_HINT = "Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).";
 const shares_schema = {
     name: "extension_shares",
-    description: "List and revoke the public preview links this token has shared (the links extension_preview_web share:true hands out). action:\"list\" (default) asks the platform for every artifact owned by the logged-in project and returns each one's artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, and its previewUrl, zipUrl and revokeUrl, so a link you lost the response for is findable again. Every row also carries owner and sharedBy as the platform returned them, plus an attribution block: attribution.ownership is \"project\" when the owning workspace holds the share and any member can revoke it, \"personal\" when one person holds it alone and nobody else can, and \"unknown\" when the platform disclosed no owner. attribution.credit names the publisher for credit only and never decides access; it reads \"CLI token <id>\" when the token's issuer could not be resolved and \"not recorded\" for a share made before attribution existed, and neither is a person's name. action:\"revoke\" kills one by artifactId or by pasting any of its URLs; revocation is PERMANENT (the id is burned and re-sharing mints a different link), so it cannot be undone. Pass projectPath to reconcile the platform's answer with .extension.dev/shared-previews.json, the project's own append-only record: a share made on another machine shows up as remoteOnly, and a record with no live artifact behind it shows up under localOnly. Needs the same token as sharing (extension_login or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint instead of failing. Read-only for the local file: this tool never rewrites shared-previews.json.",
+    description: "List and revoke the public preview links this token has shared (what extension_preview_web share:true hands out). action:'list' (default) returns every artifact the logged-in project owns with its artifactId, name, version, live/dead state, createdAt, expiresAt, revokedAt, size, previewUrl, zipUrl and revokeUrl, so a link whose response you lost is findable again. Each row carries owner and sharedBy as the platform returned them plus an attribution block: attribution.ownership is 'project' when the workspace holds the share and any member can revoke it, 'personal' when one person holds it alone, 'unknown' when no owner was disclosed; attribution.credit names the publisher for credit only, never access, and reads 'CLI token <id>' or 'not recorded' when no person can be named. action:'revoke' kills one by artifactId or by pasting any of its URLs, and is PERMANENT. Pass projectPath to reconcile against the project's own append-only .extension.dev/shared-previews.json (read-only, never rewritten): a share made on another machine shows as remoteOnly, a record with no live artifact as localOnly. Needs the same token as sharing (extension_auth or EXTENSION_DEV_TOKEN); without one, listing still returns the local record with a login hint.",
     inputSchema: {
         type: "object",
         properties: {
@@ -5091,10 +5010,7 @@ const shares_schema = {
                 type: "number",
                 description: "How many shares to return, 1 to 200 (platform default 100). A cut list comes back with truncated:true."
             },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)."
-            }
+            api: API_BASE
         },
         required: []
     }
@@ -5343,73 +5259,6 @@ async function shares_handler(args) {
         } : {}
     });
 }
-const get_template_source_schema = {
-    name: "extension_get_template_source",
-    description: "Read source files from a template in the extension.dev template catalog. Use this to learn implementation patterns before building something similar.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            slug: {
-                type: "string",
-                description: "Template slug (e.g. 'ai-claude', 'content-react')"
-            },
-            files: {
-                type: "array",
-                items: {
-                    type: "string"
-                },
-                description: "Specific files to read (e.g. ['src/manifest.json', 'src/background.ts']). If omitted, returns the file listing from templates-meta.json."
-            }
-        },
-        required: [
-            "slug"
-        ]
-    }
-};
-async function get_template_source_handler(args) {
-    const template = await getTemplateBySlug(args.slug);
-    if (!template) return JSON.stringify({
-        error: `Template '${args.slug}' not found in the catalog`,
-        hint: "Use extension_list_templates to see available templates."
-    });
-    const meta = {
-        slug: template.slug,
-        description: template.description,
-        uiFramework: template.uiFramework || "vanilla",
-        surfaces: template.surfaces,
-        permissions: template.permissions,
-        patternExplanation: template.patternExplanation,
-        keyFiles: template.keyFiles,
-        repositoryUrl: template.repositoryUrl
-    };
-    if (!args.files?.length) return JSON.stringify({
-        ...meta,
-        files: template.files.map((f)=>stripTemplatePathPrefix(template.slug, f)),
-        hint: "Pass specific file paths in the files parameter to read their contents."
-    });
-    const fileContents = {};
-    const errors = [];
-    await Promise.all(args.files.map(async (filePath)=>{
-        const urls = await templateFileUrls(args.slug, filePath);
-        let lastStatus = 0;
-        for (const url of urls)try {
-            const response = await fetch(url);
-            if (response.ok) {
-                fileContents[filePath] = await response.text();
-                return;
-            }
-            lastStatus = response.status;
-        } catch  {}
-        errors.push(`${filePath}: ${lastStatus || "fetch failed"}`);
-    }));
-    return JSON.stringify({
-        ...meta,
-        fileContents,
-        ...errors.length ? {
-            errors
-        } : {}
-    });
-}
 const CHROME_DESKTOP_ONLY_KEYS = [
     "file_browser_handlers",
     "file_system_provider_capabilities",
@@ -6457,7 +6306,7 @@ function resolveChromeTheme(theme) {
 }
 const theme_verify_schema = {
     name: "extension_theme_verify",
-    description: "Verify a Chrome theme manifest before it ships. Settles the four-leg WYSIWYG contract (app-shows == manifest-says == chrome-paints, plus chrome-accepts) as far as is possible headless: it derives every color current Chrome would paint from the manifest (the transcribed Chromium resolver) and reports the divergence class of any problem - D1 fabrication, D3 parity gap, D4 acceptance gap (keys Chrome silently discards: dead legacy keys, incognito keys, unknown keys, out-of-range values). Verification is the product; this verb does not author or mutate a theme. The app-rendered leg [1] and the real-pixel paint leg [3] need a browser and are returned as needsAttended with a pointer to the assert:theme and install-parity harnesses, never reported as passed.",
+    description: "Verify a Chrome theme manifest before it ships. Settles the four-leg WYSIWYG contract (app-shows == manifest-says == chrome-paints, plus chrome-accepts) as far as is possible headless: it derives every color current Chrome would paint from the manifest (the transcribed Chromium resolver) and classifies any problem as D1 fabrication, D3 parity gap, or D4 acceptance gap (keys Chrome silently discards: dead legacy, incognito, unknown, out-of-range). Verification only: it never authors or mutates a theme. The app-rendered and real-pixel legs need a browser and come back as needsAttended pointing at the assert:theme and install-parity harnesses, never as passed.",
     inputSchema: {
         type: "object",
         properties: {
@@ -6720,20 +6569,17 @@ async function theme_verify_handler(args) {
         attended
     });
 }
-const inspect_schema = {
-    name: "extension_inspect",
-    description: "Inspect a built extension: file sizes, entry points, permissions used, and structure analysis. The extension must be built first.",
+const analyze_schema = {
+    name: "extension_analyze",
+    description: "Analyze a BUILT extension on disk: file sizes, declared entry points, permissions, bundle composition, and store-readiness checks. Static only, reads dist/<browser> from the filesystem and never touches a browser. The extension must be built first (extension_build). For a RUNNING extension's live DOM and console use extension_inspect.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
+            projectPath: PROJECT_PATH,
             browser: {
                 type: "string",
                 default: "chrome",
-                description: "Browser build to inspect"
+                description: "Browser build to analyze"
             },
             format: {
                 type: "string",
@@ -6814,7 +6660,7 @@ function formatBytes(bytes) {
     if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)} KB`;
     return `${(bytes / 1048576).toFixed(1)} MB`;
 }
-async function inspect_handler(args) {
+async function analyze_handler(args) {
     const browser = args.browser ?? "chrome";
     const distPath = node_path.resolve(args.projectPath, "dist", browser);
     if (!node_fs.existsSync(distPath)) return JSON.stringify({
@@ -7392,26 +7238,23 @@ async function inspectViaBridge(args, browser, include, maxBytes) {
     if (notes.length) result.notes = notes;
     return JSON.stringify(result);
 }
-const source_inspect_schema = {
-    name: "extension_source_inspect",
-    description: "Inspect a running extension's live state: full HTML (with shadow DOM), DOM structure, content script injection, console messages, and CSS selector queries. Chromium sessions ride Chrome DevTools Protocol. Firefox sessions are fully paired: summary/meta/html/dom_snapshot/extension_roots/probes ride the agent bridge (needs allowEval: true), console rides the RDP watcher replay (engine 4.0.15+), and deepDom walks closed shadow roots via a content-script eval (MV2 sessions with host permissions for the target url; Firefox MV3 background CSP blocks bridge evals entirely). Requires an active dev or start session.",
+const inspect_schema = {
+    name: "extension_inspect",
+    description: "DEEP inspection of a RUNNING extension over the browser's debugger protocol: full HTML including shadow DOM, DOM structure, content-script injection, console messages, and CSS selector queries (`probe`). The ONLY tool that pierces CLOSED shadow roots (`deepDom`), runs selector probes, and NAVIGATES a tab to `url` before reading it. It reads a web or override page and picks the first inspectable target (or the first whose url contains `url`); it cannot address an extension surface by name and takes no chrome.tabs id. To choose WHICH tab or which OPEN surface (popup/options/sidebar/devtools) to read, or to enumerate what is open, use extension_dom_snapshot. For a built extension's files and sizes on disk use extension_analyze. Chromium rides Chrome DevTools Protocol (needs the session's debug port, not allowControl). Firefox is fully paired: summary/meta/html/dom_snapshot/extension_roots/probes ride the agent bridge (needs allowEval: true), console rides the RDP watcher replay (engine 4.0.15+), and deepDom needs an MV2 session with host permissions for the target url (Firefox MV3 background CSP blocks bridge evals). Requires an active dev or start session.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             url: {
                 type: "string",
-                description: "URL to inspect (navigates the browser tab to this URL first)"
+                description: "URL to inspect; the tab is navigated there first"
             },
             probe: {
                 type: "array",
                 items: {
                     type: "string"
                 },
-                description: "CSS selectors to query, returns element counts and samples for each"
+                description: "CSS selectors to query; returns counts and samples for each"
             },
             include: {
                 type: "array",
@@ -7431,12 +7274,9 @@ const source_inspect_schema = {
                     "meta",
                     "console"
                 ],
-                description: "What data to include in the response"
-            },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
+                description: "What to include"
             },
+            browser: SESSION_BROWSER,
             maxBytes: {
                 type: "number",
                 default: 262144,
@@ -7445,7 +7285,7 @@ const source_inspect_schema = {
             deepDom: {
                 type: "boolean",
                 default: false,
-                description: "Pierce CLOSED shadow roots. The default path reads open shadow roots; closed ones need this escape hatch. Chromium: CDP DOM pierce. Firefox: a content-script walk via tabs.executeScript (MV2 sessions; the extension needs host permissions for the target url)."
+                description: "Pierce CLOSED shadow roots; open ones are read anyway. Chromium: CDP DOM pierce. Firefox: a content-script walk via tabs.executeScript (MV2 only, needs host permissions for the target url)."
             }
         },
         required: [
@@ -7453,7 +7293,7 @@ const source_inspect_schema = {
         ]
     }
 };
-async function source_inspect_handler(args) {
+async function inspect_handler(args) {
     const { browser } = resolveSessionBrowser(args.projectPath, args.browser, "chrome");
     const include = new Set(args.include ?? [
         "summary",
@@ -7565,18 +7405,12 @@ async function source_inspect_handler(args) {
 }
 const list_extensions_schema = {
     name: "extension_list_extensions",
-    description: "List the extensions in the running dev browser. Returns each extension's id, name, version, and (on Chromium) live contexts. The entry for THIS dev session's extension (the project being served) is flagged ownExtension: true, with name and version resolved from the session's ready contract even when the browser exposes no identity. On Chromium this rides the Chrome DevTools Protocol: entries are extensions with at least one live context (a dormant MV3 service worker with no open page may be absent until it wakes), and other extensions resolve via the read-only Extensions domain when available. On Firefox this rides the Remote Debugging Protocol root actor (listAddons, engine 4.0.15+): entries are INSTALLED add-ons regardless of live contexts, with temporarilyInstalled marking temporary loads, and carry no contexts. Either way other extensions' contexts are never attached to or evaluated in. Requires an active dev or start session.",
+    description: "List the extensions in the running dev browser: id, name, version, and (on Chromium) live contexts. THIS session's own extension is flagged ownExtension: true, with name and version from the ready contract even when the browser exposes no identity. Chromium rides the Chrome DevTools Protocol, so an entry needs at least one live context (a dormant MV3 service worker may be absent until it wakes). Firefox rides the RDP root actor (listAddons, engine 4.0.15+), so entries are INSTALLED add-ons regardless of contexts, marked temporarilyInstalled where relevant, and carry none. Either way other extensions' contexts are never attached to or evaluated in. Requires an active dev or start session.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
-            }
+            projectPath: SESSION_PROJECT_PATH,
+            browser: SESSION_BROWSER
         },
         required: [
             "projectPath"
@@ -7842,13 +7676,10 @@ const logs_schema_schema = {
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             browser: {
                 type: "string",
-                description: "Which dist/extension-js/<browser>/ to read. Defaults to the active dev session's browser for this project (falls back to chromium)."
+                description: "Which dist/extension-js/<browser>/ to read. Defaults to this project's live session, else chromium."
             },
             level: {
                 type: "string",
@@ -7862,7 +7693,7 @@ const logs_schema_schema = {
                     "all"
                 ],
                 default: "all",
-                description: "Minimum severity to include; selecting a level includes it plus everything more severe."
+                description: "Minimum severity; a level includes everything more severe."
             },
             context: {
                 type: "array",
@@ -7883,15 +7714,15 @@ const logs_schema_schema = {
             signalsOnly: {
                 type: "boolean",
                 default: false,
-                description: "Only structured dx.signal diagnostics (which carry code/status/remediation), skipping plain console lines."
+                description: "Only structured dx.signal diagnostics (code/status/remediation), no plain console lines."
             },
             since: {
                 type: "number",
-                description: "Only return events with seq greater than this (cursor for polling forward)."
+                description: "Only events with seq greater than this; the cursor for polling forward."
             },
             url: {
                 type: "string",
-                description: "Only events whose url/hostname matches (glob with * or plain substring), e.g. https://shop.example/*."
+                description: "Only events whose url/hostname matches (glob or substring), e.g. https://shop.example/*."
             },
             tab: {
                 type: "number",
@@ -7900,7 +7731,7 @@ const logs_schema_schema = {
             follow: {
                 type: "boolean",
                 default: false,
-                description: "Collect from the live control channel for a bounded window instead of reading the file. Use with followMs."
+                description: "Collect from the live control channel for a bounded window instead of reading the file."
             },
             followMs: {
                 type: "number",
@@ -7910,7 +7741,7 @@ const logs_schema_schema = {
             limit: {
                 type: "number",
                 default: 200,
-                description: "Maximum number of (most recent) events to return."
+                description: "How many of the most recent events to return."
             }
         },
         required: [
@@ -8109,14 +7940,11 @@ async function logs_handler(args) {
 }
 const eval_schema = {
     name: "extension_eval",
-    description: "Evaluate an expression in a running extension context. Requires the dev session to be started with allowEval: true (extension_dev; writes a 0600 session token the CLI reads). Context default: on a Chromium session whose manifest is MV3 (the default template) the default is `page` (the active tab), because the MV3 background is a service worker whose CSP blocks eval, so a background default would fail on the most common path; on Firefox/MV2 sessions the default stays `background`. Pass `context: \"background\"` explicitly to target the worker anyway (on Chromium MV3 that returns the CSP explanation). Targeting for context content/page: pass `url` to pick the matching tab, or omit both `url` and `tab` to use the ACTIVE tab; a numeric `tab` id is only needed to disambiguate. Extension surfaces (popup/options/sidebar/devtools) and override pages (newtab/history/bookmarks) evaluate over the in-bundle relay and need NO tab id; the surface must be OPEN (extension_open first; a closed surface returns an explicit error). Use extension_dom_inspect with listTabs: true to enumerate {tabId,url,title}. Wraps `extension eval`.",
+    description: "Evaluate an expression in a running extension context. Requires the session to have been started with allowEval: true (extension_dev; writes a 0600 session token). Context defaults to `background`, EXCEPT on a Chromium MV3 session (the default template) where it is `page`, the active tab, because the MV3 service worker CSP blocks eval; pass context:'background' to target the worker anyway and get that explanation back. For content/page, pass `url` to pick the tab or omit both `url` and `tab` for the ACTIVE tab; a numeric `tab` only disambiguates. Extension surfaces (popup/options/sidebar/devtools) and override pages evaluate over the in-bundle relay and need NO tab id, but must be OPEN (extension_open first; a closed one returns an explicit error). extension_dom_snapshot with listTabs: true enumerates {tabId,url,title}.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             expression: {
                 type: "string",
                 description: "JavaScript expression to evaluate in the target context"
@@ -8135,24 +7963,18 @@ const eval_schema = {
                     "content",
                     "page"
                 ],
-                description: "Which extension surface to evaluate in. Default: `background`, EXCEPT on Chromium sessions whose manifest is MV3, where the default is `page` (the active tab) because the MV3 service worker CSP blocks eval; pass `context: \"background\"` explicitly to target the worker anyway."
+                description: "Where to evaluate. Default background, except Chromium MV3 sessions default to page (the active tab)."
             },
             url: {
                 type: "string",
-                description: "For content/page: selects the target tab by url (match pattern, then substring fallback). Preferred over `tab`. You do not need a numeric id."
+                description: "content/page: pick the tab by url (match pattern, then substring). Preferred over `tab`."
             },
             tab: {
                 type: "number",
-                description: "Numeric chrome.tabs id, for disambiguating when several tabs match. Optional: with neither `tab` nor `url`, content/page target the active tab."
-            },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
+                description: "Numeric chrome.tabs id, only to disambiguate when several tabs match."
             },
-            timeout: {
-                type: "number",
-                description: "Command timeout in ms (default 5000)"
-            }
+            browser: SESSION_BROWSER,
+            timeout: CALL_TIMEOUT
         },
         required: [
             "projectPath",
@@ -8207,7 +8029,7 @@ async function eval_handler(args) {
         if (parsed && "object" == typeof parsed) {
             parsed.defaultedContext = "page";
             parsed.contextNote = 'No context given: defaulted to "page" (the active tab) because this Chromium session\'s MV3 background is a service worker whose CSP blocks eval. Pass context: "background" explicitly to target the worker (works on Firefox/MV2 builds).';
-            if (false === parsed.ok && /cannot access|chrome-extension:\/\/|chrome:\/\//i.test(JSON.stringify(parsed.error ?? ""))) parsed.hint = "The active tab is a browser or extension page that eval cannot reach. Navigate the dev browser to a regular web page, or pass url (match pattern) or tab to pick one; extension_dom_inspect with listTabs: true lists open tabs.";
+            if (false === parsed.ok && /cannot access|chrome-extension:\/\/|chrome:\/\//i.test(JSON.stringify(parsed.error ?? ""))) parsed.hint = "The active tab is a browser or extension page that eval cannot reach. Navigate the dev browser to a regular web page, or pass url (match pattern) or tab to pick one; extension_dom_snapshot with listTabs: true lists open tabs.";
             return JSON.stringify(parsed);
         }
     } catch  {}
@@ -8215,14 +8037,11 @@ async function eval_handler(args) {
 }
 const storage_schema = {
     name: "extension_storage",
-    description: "Read or write chrome.storage in a running extension. Requires the dev session to be started with allowControl: true (extension_dev). Wraps `extension storage get|set`.",
+    description: "Read or write chrome.storage in a running extension. Requires the session to have been started with allowControl: true (extension_dev).",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             action: {
                 type: "string",
                 enum: [
@@ -8259,14 +8078,8 @@ const storage_schema = {
                 ],
                 default: "background"
             },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
-            },
-            timeout: {
-                type: "number",
-                description: "Command timeout in ms (default 5000)"
-            }
+            browser: SESSION_BROWSER,
+            timeout: CALL_TIMEOUT
         },
         required: [
             "projectPath",
@@ -8307,14 +8120,11 @@ async function storage_handler(args) {
 }
 const reload_schema = {
     name: "extension_reload",
-    description: "Reload a running extension (background) or a tab. Requires the dev session to be started with allowControl: true (extension_dev). Wraps `extension reload`.",
+    description: "Reload a running extension (background) or a tab. Requires the session to have been started with allowControl: true (extension_dev).",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             context: {
                 type: "string",
                 enum: [
@@ -8328,14 +8138,8 @@ const reload_schema = {
                 type: "number",
                 description: "For content/page: a specific tab id"
             },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
-            },
-            timeout: {
-                type: "number",
-                description: "Command timeout in ms (default 5000)"
-            }
+            browser: SESSION_BROWSER,
+            timeout: CALL_TIMEOUT
         },
         required: [
             "projectPath"
@@ -8353,7 +8157,7 @@ async function reload_handler(args) {
         })
     ], args.projectPath, args.timeout);
 }
-const TARGET_ID_NOTE = "targetId is a CDP target id, NOT a chrome.tabs id: do not pass it as `tab`. Target a tab with `tabUrl` (URL substring) or `url`; if you need a numeric tab id, call extension_dom_inspect with listTabs: true.";
+const TARGET_ID_NOTE = "targetId is a CDP target id, NOT a chrome.tabs id: do not pass it as `tab`. Target a tab with `tabUrl` (URL substring) or `url`; if you need a numeric tab id, call extension_dom_snapshot with listTabs: true.";
 function filterPageTargets(raw) {
     return raw.filter((t)=>"page" === t.type && !String(t.url ?? "").startsWith("devtools://")).map((t)=>({
             targetId: String(t.id),
@@ -8371,38 +8175,35 @@ function matchTargetsByUrl(targets, needle) {
     if (byUrl.length > 0) return byUrl;
     return targets.filter((t)=>t.title.toLowerCase().includes(wanted));
 }
-const RDP_ACTOR_NOTE = "actor is an RDP tab descriptor actor id, NOT a chrome.tabs id: do not pass it as `tab`. Target a tab with `tabUrl` (URL substring) or `url`; if you need a numeric tab id, call extension_dom_inspect with listTabs: true.";
-const dom_inspect_schema = {
-    name: "extension_dom_inspect",
-    description: "Inspect a page/content-script DOM via the agent bridge (CDP-free, localhost). Returns a structured snapshot (counts, extension roots, open shadow roots, optional capped HTML). Target a tab by `tabUrl` (case-insensitive URL substring resolved against the browser's live page targets; zero or several matches return the candidates instead of guessing), by `url`, or by numeric `tab`. Discover what is open with listTargets: true (Chromium CDP targetIds; Firefox RDP tab actors) or listTabs: true (numeric chrome.tabs ids). Requires the dev session to be started with allowControl: true (extension_dev). For closed shadow roots or deep CDP inspection use extension_source_inspect. Wraps `extension inspect`.",
+const RDP_ACTOR_NOTE = "actor is an RDP tab descriptor actor id, NOT a chrome.tabs id: do not pass it as `tab`. Target a tab with `tabUrl` (URL substring) or `url`; if you need a numeric tab id, call extension_dom_snapshot with listTabs: true.";
+const dom_snapshot_schema = {
+    name: "extension_dom_snapshot",
+    description: "Take a SHALLOW structured DOM snapshot of ONE CHOSEN surface through the agent bridge (CDP-free, localhost): element counts, extension roots, OPEN shadow roots, optional byte-capped HTML, optional recent console lines. This is the SURFACE PICKER: the only tool that reads an OPEN extension surface by name (`context`: popup/options/sidebar/devtools) or an override page, the only one that takes a numeric chrome.tabs id, and the only one that enumerates what is open (listTargets for CDP targetIds and RDP tab actors, listTabs for numeric tab ids). An ambiguous `tabUrl` returns the candidates instead of guessing. It does NOT pierce closed shadow roots, run selector probes, or navigate: for those, and for a deep read of an already-open web page, use extension_inspect. Requires the session to have been started with allowControl: true (extension_dev).",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root (must have an active dev session)"
-            },
+            projectPath: SESSION_PROJECT_PATH,
             tab: {
                 type: "number",
-                description: "Numeric chrome.tabs id, for disambiguating when several tabs match. Optional: with neither `tab` nor `url`, content/page target the active tab."
+                description: "Numeric chrome.tabs id, only to disambiguate when several tabs match. With neither `tab` nor `url`, content/page target the active tab."
             },
             url: {
                 type: "string",
-                description: "For content/page: selects the target tab by url (match pattern, then substring fallback). Preferred over `tab`."
+                description: "content/page: pick the tab by url (match pattern, then substring). Preferred over `tab`."
             },
             tabUrl: {
                 type: "string",
-                description: "Target the tab whose URL contains this substring (case-insensitive; titles are checked only when no url matches). Resolved against the live browser BEFORE inspecting (Chromium: CDP page targets; Firefox: the agent bridge tab list): exactly one match proceeds; zero or several matches return the candidates so you can narrow, never a guess. Alternative to `url`."
+                description: "Target the tab whose URL contains this substring (case-insensitive; titles checked only when no url matches). Resolved against the live browser first: exactly one match proceeds, zero or several return the candidates instead of a guess. Alternative to `url`."
             },
             listTargets: {
                 type: "boolean",
                 default: false,
-                description: "Enumerate the browser's live page targets and return, ignoring the other args. The discovery path for `tabUrl`. Chromium: CDP page targets as {targetId,url,title,type}. Firefox: RDP tab descriptors as {actor,url,title,type} (engine 4.0.15+). Neither id is a numeric chrome.tabs id (for those use listTabs)."
+                description: "Enumerate live page targets and return, ignoring the other args. The discovery path for `tabUrl`. Chromium: {targetId,url,title,type}. Firefox: RDP tab descriptors {actor,url,title,type}. Neither id is a numeric chrome.tabs id; for those use listTabs."
             },
             listTabs: {
                 type: "boolean",
                 default: false,
-                description: "Enumerate open tabs as {tabId,url,title} and return, ignoring the other args. The discovery path when you need an explicit numeric tab id."
+                description: "Enumerate open tabs as {tabId,url,title} and return, ignoring the other args. Use when you need a numeric tab id."
             },
             context: {
                 type: "string",
@@ -8418,7 +8219,7 @@ const dom_inspect_schema = {
                     "bookmarks"
                 ],
                 default: "content",
-                description: "content/page (targets `url`, else the active tab), an OPEN extension surface (popup/options/sidebar/devtools), or an override page (newtab/history/bookmarks)"
+                description: "content/page targets `url`, else the active tab; the rest must already be OPEN"
             },
             include: {
                 type: "array",
@@ -8443,16 +8244,10 @@ const dom_inspect_schema = {
                     "number",
                     "boolean"
                 ],
-                description: "Also include recent console lines for the target (DOM + console in one call). A number is how many lines; true means 50."
-            },
-            browser: {
-                type: "string",
-                description: "Browser session to target. Defaults to the active dev session's browser for this project."
+                description: "Also include recent console lines. A number is how many; true means 50."
             },
-            timeout: {
-                type: "number",
-                description: "Command timeout in ms (default 5000)"
-            }
+            browser: SESSION_BROWSER,
+            timeout: CALL_TIMEOUT
         },
         required: [
             "projectPath"
@@ -8483,7 +8278,7 @@ async function cdpPortOrError(projectPath, browser, feature) {
         port: resolved.port
     };
 }
-async function dom_inspect_handler(args) {
+async function dom_snapshot_handler(args) {
     const withConsole = true === args.withConsole ? 50 : false === args.withConsole ? void 0 : args.withConsole;
     if (args.listTargets) {
         const { browser } = resolveSessionBrowser(args.projectPath, args.browser);
@@ -8663,7 +8458,7 @@ async function dom_inspect_handler(args) {
 }
 const publish_schema = {
     name: "extension_publish",
-    description: "Publish the project your stored token is scoped to (from extension_login, or EXTENSION_DEV_TOKEN) to extension.dev and return its shareable URL. The publish target is the token's project -- there is no projectPath, the local files are not uploaded. For a PUBLIC project the URL is the canonical public page and ttlHours does not apply; for a PRIVATE project it is a fresh time-limited share link (?share=) whose lifetime is ttlHours. Posts to the platform's CLI publish endpoint. Besides extension_login this is the only tool that talks to the hosted platform.",
+    description: "Publish the project your stored token is scoped to (extension_auth, or EXTENSION_DEV_TOKEN) to extension.dev and return its shareable URL. This is what \"deploy\" or \"ship\" an extension usually means; extension_submit is the separate store-review path. The target is the token's project: there is no projectPath and no local file is uploaded. For a PUBLIC project the URL is the canonical public page and ttlHours does not apply; for a PRIVATE one it is a fresh time-limited share link (?share=) whose lifetime is ttlHours.",
     inputSchema: {
         type: "object",
         properties: {
@@ -8673,12 +8468,9 @@ const publish_schema = {
             },
             buildSha: {
                 type: "string",
-                description: "Pin the share URL to a specific build sha (7-40 hex chars). The platform verifies the build exists in the project's build index and rejects an unknown sha, so the returned URL always points at a real build."
+                description: "Pin the URL to a build sha (7-40 hex chars). An unknown sha is rejected, so the returned URL always points at a real build."
             },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
-            }
+            api: API_BASE
         },
         required: []
     }
@@ -8694,7 +8486,7 @@ function fail(name, message) {
 }
 async function publish_handler(args) {
     const token = resolveToken();
-    if (!token) return fail("PublishAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
+    if (!token) return fail("PublishAuthError", "No token. Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard).");
     if (null != args.ttlHours) {
         const t = Number(args.ttlHours);
         if (!Number.isInteger(t) || t < 1 || t > 168) return fail("PublishBadRequest", "ttlHours must be an integer between 1 and 168.");
@@ -8740,7 +8532,7 @@ async function publish_handler(args) {
 }
 const release_promote_schema = {
     name: "extension_release_promote",
-    description: "Promote a built extension to a release channel (e.g. stable, preview, beta) on extension.dev, headless. Auth-gated: uses your stored login (extension_login) or a release token in EXTENSION_DEV_TOKEN (mint and revoke it in the dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry). Posts to the platform's CLI release endpoint; the project is identified by the token. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
+    description: "Promote a built extension to a release channel (stable, preview, beta, ...) on extension.dev, headless. This WRITES: it is the only verb that changes what a channel points at. Auth-gated by your stored login (extension_auth) or a release token in EXTENSION_DEV_TOKEN, minted and revoked under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry. The project comes from the token. Use extension_release_status to find a valid buildId. Cutting a version-bump PR is not available headlessly (it writes to your source repo and needs an interactive login).",
     inputSchema: {
         type: "object",
         properties: {
@@ -8771,10 +8563,7 @@ const release_promote_schema = {
                 type: "string",
                 description: "Release notes markdown (optional)"
             },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
-            }
+            api: API_BASE
         },
         required: [
             "buildId",
@@ -8793,7 +8582,7 @@ function release_promote_fail(name, message) {
 }
 async function release_promote_handler(args) {
     const token = resolveToken();
-    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry), or run extension_login.");
+    if (!token) return release_promote_fail("ReleaseAuthError", "No token. Set EXTENSION_DEV_TOKEN to a release token (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry), or run extension_auth (action: login).");
     const buildId = String(args.buildId || "").trim();
     const channel = String(args.channel || "").trim();
     if (!buildId || !channel) return release_promote_fail("ReleaseInputError", "buildId and channel are required.");
@@ -8836,7 +8625,7 @@ async function release_promote_handler(args) {
         const ref = resolveProjectRef();
         if (404 === res.status || "UNKNOWN_BUILD" === code) {
             enrich.buildsPageUrl = consoleProjectUrl(ref, "builds", args.api);
-            enrich.hint = "Run extension_release_list to see this project's channels, their promoted shas, and recent builds.";
+            enrich.hint = "Run extension_release_status to see this project's channels, their promoted shas, and recent builds.";
             if (ref) {
                 const channelsUrl = registryFileUrl(ref, "channels.json");
                 const channelsRes = await fetchRegistryJson(channelsUrl, fetch, {
@@ -8879,28 +8668,6 @@ async function release_promote_handler(args) {
     } : data;
     return JSON.stringify(enriched);
 }
-const release_list_schema = {
-    name: "extension_release_list",
-    description: "List the project's release channels (channel -> promoted build sha) and recent builds from the registry (registry.extension.land), so you can pick a valid buildSha for extension_release_promote, extension_deploy, or extension_publish. Read-only, no dispatch. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another project. Works for PRIVATE projects too when your stored login covers them. Returns the registry URLs it read, the console Builds page URL (needs a login), and a publicUrl per channel and build on the public viewer (no login needed for a public project).",
-    inputSchema: {
-        type: "object",
-        properties: {
-            workspace: {
-                type: "string",
-                description: "Workspace slug override (defaults to the stored login's workspace)."
-            },
-            project: {
-                type: "string",
-                description: "Project slug override (defaults to the stored login's project)."
-            },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). Used to resolve link origins and, for a private project, to mint a short-lived read token."
-            }
-        },
-        required: []
-    }
-};
 function release_list_fail(name, message, extra) {
     return JSON.stringify({
         ok: false,
@@ -8911,9 +8678,9 @@ function release_list_fail(name, message, extra) {
         ...extra ?? {}
     });
 }
-async function release_list_handler(args) {
+async function readReleases(args) {
     const ref = resolveProjectRef(args);
-    if (!ref) return release_list_fail("ReleaseListInputError", "No project to list. Run extension_login (the stored login names the project), or pass workspace + project explicitly.");
+    if (!ref) return release_list_fail("ReleaseListInputError", "No project to list. Run extension_auth (action: login), which names the project, or pass workspace + project explicitly.");
     const channelsUrl = registryFileUrl(ref, "channels.json");
     const metaUrl = registryFileUrl(ref, "meta.json");
     const buildsUrl = registryFileUrl(ref, "builds/index.json");
@@ -8932,7 +8699,7 @@ async function release_list_handler(args) {
         })
     ]);
     const buildsPageUrl = consoleProjectUrl(ref, "builds", args.api);
-    if (!channelsRes.ok && !metaRes.ok && !buildsRes.ok) return release_list_fail("ReleaseListNotFound", `No registry data for ${ref.workspace}/${ref.project} (${channelsUrl} returned ${channelsRes.status ?? "no response"}). The project may have no builds yet, or the workspace/project slugs may be wrong. If it is private, make sure extension_login covers this exact project (a token scoped elsewhere cannot read it). The console Builds page is the authoritative view: ${buildsPageUrl}`, {
+    if (!channelsRes.ok && !metaRes.ok && !buildsRes.ok) return release_list_fail("ReleaseListNotFound", `No registry data for ${ref.workspace}/${ref.project} (${channelsUrl} returned ${channelsRes.status ?? "no response"}). The project may have no builds yet, or the workspace/project slugs may be wrong. If it is private, make sure extension_auth covers this exact project (a token scoped elsewhere cannot read it). The console Builds page is the authoritative view: ${buildsPageUrl}`, {
         workspace: ref.workspace,
         project: ref.project,
         registryUrl: channelsUrl,
@@ -8979,246 +8746,12 @@ async function release_list_handler(args) {
     if (!buildsRes.ok) result.buildsUnavailable = `builds/index.json unreadable: ${buildsRes.message}`;
     return JSON.stringify(result);
 }
-function storeMdWarnings(browsers, cwd) {
-    const wantsFirefox = browsers.includes("firefox");
-    const wantsEdge = browsers.includes("edge");
-    if (!wantsFirefox && !wantsEdge) return [];
-    let content;
-    try {
-        content = node_fs.readFileSync(node_path.join(cwd, "STORE.md"), "utf8");
-    } catch  {
-        return [
-            "No STORE.md found in the current working directory. Platform submissions read STORE.md from the project's source repository, so this may not apply here; make sure STORE.md exists there for Firefox reviewer notes and Edge certification notes. See the extension-dev skill's store-md reference."
-        ];
-    }
-    const hasField = (section, field)=>{
-        const parts = content.split(/^## +/m);
-        const match = parts.find((p)=>section.test(p.split("\n", 1)[0] ?? ""));
-        if (!match) return false;
-        const sub = match.split(/^### +/m).find((p)=>field.test(p.split("\n", 1)[0] ?? ""));
-        if (!sub) return false;
-        const body = sub.split("\n").slice(1).join("\n");
-        return body.replace(/<!--[\s\S]*?-->/g, "").trim().length > 0;
-    };
-    const warnings = [];
-    if (wantsFirefox && !hasField(/firefox|amo/i, /reviewer notes/i)) warnings.push("STORE.md has no Firefox reviewer notes; AMO reviews go faster with test credentials and steps.");
-    if (wantsEdge && !hasField(/edge/i, /certification notes/i)) warnings.push("STORE.md has no Edge certification notes; the certification team gets no testing guidance.");
-    return warnings;
-}
-const deploy_schema = {
-    name: "extension_deploy",
-    description: "Submit a built extension to the Chrome Web Store, Firefox AMO, Edge Add-ons, and/or the App Store (Safari) THROUGH extension.dev, which holds your store credentials and dispatches the release from your project's mirror CI. DEFAULTS TO A DRY RUN (preflight - dispatches nothing): the platform side verifies auth, the project, that the build exists, and the store workflow, and this tool then adds the per-store verdict from each store's public credential-health record; trust the per-store rows in the result over the platform's bare preflight line, which does not check store health. Pass dryRun:false to actually submit, which is irreversible and enters store review. The target project is identified by your token (extension_login or a release token in EXTENSION_DEV_TOKEN; tokens live at most 7 days, so CI must re-mint from the console's Access tokens page). Store credentials are never tool arguments and local files are not uploaded. Pass browsers + buildSha (extension_release_list lists valid shas); after a real submission, extension_store_status reads the recorded outcome and review state. Posts to the platform's CLI store-submission endpoint.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            browsers: {
-                type: "array",
-                items: {
-                    type: "string",
-                    enum: [
-                        "chrome",
-                        "firefox",
-                        "edge",
-                        "safari"
-                    ]
-                },
-                description: "Stores to submit to."
-            },
-            buildSha: {
-                type: "string",
-                description: "The built commit SHA to submit. It must have a completed build in the project's build index; an unknown sha is rejected."
-            },
-            channel: {
-                type: "string",
-                description: "Release channel to submit from (default stable)."
-            },
-            version: {
-                type: "string",
-                description: "Version label for the submission record (optional)."
-            },
-            dryRun: {
-                type: "boolean",
-                default: true,
-                description: "Preflight only (verify auth, project, build, and store workflow). Pass false to actually dispatch the submission (irreversible, enters store review)."
-            },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
-            }
-        },
-        required: [
-            "browsers",
-            "buildSha"
-        ]
-    }
-};
-function deploy_fail(name, message) {
-    return JSON.stringify({
-        ok: false,
-        error: {
-            name,
-            message
-        }
-    });
-}
-async function deploy_handler(args) {
-    const token = resolveToken();
-    if (!token) return deploy_fail("DeployAuthError", "No token. Run extension_login, or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry).");
-    const browsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim().toLowerCase()).filter(Boolean);
-    if (0 === browsers.length) return deploy_fail("DeployInputError", 'browsers is required (e.g. ["chrome","firefox","edge","safari"]).');
-    const buildSha = String(args.buildSha || "").trim();
-    if (!buildSha) return deploy_fail("DeployInputError", "buildSha is required (the built commit to submit).");
-    const apiCheck = safeApiBase(resolveApiBase(args.api));
-    if (!apiCheck.ok) return deploy_fail("DeployConfigError", apiCheck.message);
-    const url = `${apiCheck.base}/api/cli/stores/submit`;
-    const dryRun = false !== args.dryRun;
-    const body = {
-        browsers,
-        buildSha,
-        dryRun
-    };
-    if (args.channel) body.channel = String(args.channel).trim();
-    if (args.version) body.version = String(args.version).trim();
-    let res;
-    try {
-        res = await fetch(url, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${token}`,
-                "content-type": "application/json"
-            },
-            body: JSON.stringify(body)
-        });
-    } catch (err) {
-        return deploy_fail("DeployNetworkError", `Could not reach ${url}: ${err?.message || err}`);
-    }
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) return deploy_fail("DeployError", `${dryRun ? "preflight" : "submit"} failed (${res.status}): ${data?.message || text || "unknown error"}`);
-    const warnings = Array.isArray(data?.warnings) ? [
-        ...data.warnings
-    ] : [];
-    warnings.push(...storeMdWarnings(browsers, process.cwd()));
-    const result = {
-        mode: "platform",
-        dryRun,
-        ...data
-    };
-    if (dryRun) {
-        const ref = resolveProjectRef();
-        const consoleStoresUrl = consoleProjectUrl(ref, "stores", args.api);
-        const storeModeNote = `Store publish mode (draft / skip-publish / live) is not readable with the CLI token, so it cannot be verified from here; check per-store settings at ${consoleStoresUrl}.`;
-        let health = null;
-        let healthUnreadable = null;
-        let channelRows = null;
-        if (ref) {
-            const [healthRes, channelsRes] = await Promise.all([
-                fetchRegistryJson(registryFileUrl(ref, "stores/health.json"), fetch, {
-                    ref,
-                    api: args.api
-                }),
-                fetchRegistryJson(registryFileUrl(ref, "channels.json"), fetch, {
-                    ref,
-                    api: args.api
-                })
-            ]);
-            if (healthRes.ok) {
-                const stores = healthRes.json?.stores;
-                health = stores && "object" == typeof stores ? stores : null;
-                if (!health) healthUnreadable = "stores/health.json had no stores map";
-            } else healthUnreadable = healthRes.message;
-            if (channelsRes.ok) channelRows = parseChannels(channelsRes.json);
-        } else healthUnreadable = "no stored workspace/project to look up (run extension_login)";
-        const preflight = browsers.map((browser)=>{
-            if (!health) return {
-                browser,
-                ok: false,
-                configured: "unknown",
-                publishMode: "unknown",
-                reason: `Store configuration could not be read (${healthUnreadable}); verify the ${browser} store in the console before submitting.`
-            };
-            const row = health[browser];
-            if (!row) return {
-                browser,
-                ok: false,
-                configured: false,
-                publishMode: "unknown",
-                reason: `No ${browser} store is configured on this project; a real submission for ${browser} would fail. Configure it at ${consoleStoresUrl}.`
-            };
-            if (true !== row.ok) return {
-                browser,
-                ok: false,
-                configured: false,
-                publishMode: "unknown",
-                reason: String(row.message || "").trim() || `The ${browser} store failed its last credential health check.`
-            };
-            return {
-                browser,
-                ok: true,
-                configured: true,
-                publishMode: "unknown"
-            };
-        });
-        const actionable = preflight.filter((p)=>p.ok).map((p)=>p.browser);
-        const blocked = preflight.filter((p)=>!p.ok);
-        const channelDefaulted = !String(args.channel || "").trim();
-        const resolvedChannel = String(data?.channel || "").trim() || (channelDefaulted ? "stable" : String(args.channel).trim());
-        if (channelRows) {
-            const exists = channelRows.some((r)=>r.channel === resolvedChannel || r.channel.endsWith(`-${resolvedChannel}`));
-            if (!exists) warnings.push(`Channel "${resolvedChannel}"${channelDefaulted ? " (the default)" : ""} does not exist in this project's channels.json (existing: ${channelRows.map((r)=>r.channel).join(", ") || "none"}), so a real submission from it has no promoted build to serve. Promote a build there first (extension_release_promote) or pass an existing channel.`);
-        }
-        const summaryParts = [];
-        if (actionable.length > 0) summaryParts.push(`Preflight passed for ${actionable.join(", ")}: the platform verified auth, the project, build ${data?.buildId ?? buildSha}, and the store workflow, and the store credentials passed their last health check.`);
-        for (const p of blocked)summaryParts.push(`${p.browser}: ${"unknown" === p.configured ? "cannot be verified" : "NOT actionable"} - ${p.reason}`);
-        summaryParts.push(storeModeNote);
-        result.ok = actionable.length > 0;
-        result.preflight = preflight;
-        result.channel = resolvedChannel;
-        result.channelDefaulted = channelDefaulted;
-        if (channelDefaulted) result.channelNote = `channel: ${resolvedChannel} (default)`;
-        result.consoleStoresUrl = consoleStoresUrl;
-        if ("string" == typeof data?.message) result.platformMessage = data.message;
-        result.message = summaryParts.join(" ");
-    }
-    if (!dryRun) result.statusNote = "Track this submission with extension_store_status: it reads the recorded outcome, per-store credential health, and review state from the public registry.";
-    if (warnings.length > 0) result.warnings = warnings;
-    return JSON.stringify(result);
-}
 const KNOWN_STORES = [
     "chrome",
     "firefox",
     "edge",
     "safari"
 ];
-const store_status_schema = {
-    name: "extension_store_status",
-    description: "Report the project's browser-store state after an extension_deploy submission: per store (chrome, firefox, edge, safari) whether it is configured, its latest credential health check, the last recorded submission (version, status, store URL, submitted-at), and the latest review status. Reads the project's public registry (registry.extension.land: stores/health.json, stores/status.json, stores/submissions.json) - read-only, dispatches nothing, no auth needed for public projects. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another public project. Registry state can lag the store dashboards by up to a polling interval.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            workspace: {
-                type: "string",
-                description: "Workspace slug override (defaults to the stored login's workspace)."
-            },
-            project: {
-                type: "string",
-                description: "Project slug override (defaults to the stored login's project)."
-            },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). Used to resolve link origins and, for a private project, to mint a short-lived read token."
-            }
-        },
-        required: []
-    }
-};
 function isPlainObject(value) {
     return Boolean(value) && "object" == typeof value && !Array.isArray(value);
 }
@@ -9307,9 +8840,9 @@ function store_status_fail(name, message, extra) {
         ...extra ?? {}
     });
 }
-async function store_status_handler(args) {
+async function readStores(args) {
     const ref = resolveProjectRef(args);
-    if (!ref) return store_status_fail("StoreStatusInputError", "No project to inspect. Run extension_login (the stored login names the project), or pass workspace + project explicitly.");
+    if (!ref) return store_status_fail("StoreStatusInputError", "No project to inspect. Run extension_auth (action: login), which names the project, or pass workspace + project explicitly.");
     const healthUrl = registryFileUrl(ref, "stores/health.json");
     const statusUrl = registryFileUrl(ref, "stores/status.json");
     const submissionsUrl = registryFileUrl(ref, "stores/submissions.json");
@@ -9403,9 +8936,294 @@ async function store_status_handler(args) {
         consoleStoresUrl,
         message: `${summaryParts.join(". ")}. This is the registry's recorded state (submissions and the review poller write it); the store dashboards are authoritative and may be ahead of it.`
     };
-    if (!healthRes.ok) result.healthUnavailable = `stores/health.json unreadable: ${healthRes.message}`;
-    if (!statusRes.ok) result.statusUnavailable = `stores/status.json unreadable: ${statusRes.message}`;
-    if (!submissionsRes.ok && 404 !== submissionsRes.status) result.submissionsUnavailable = `stores/submissions.json unreadable: ${submissionsRes.message}`;
+    if (!healthRes.ok) result.healthUnavailable = `stores/health.json unreadable: ${healthRes.message}`;
+    if (!statusRes.ok) result.statusUnavailable = `stores/status.json unreadable: ${statusRes.message}`;
+    if (!submissionsRes.ok && 404 !== submissionsRes.status) result.submissionsUnavailable = `stores/submissions.json unreadable: ${submissionsRes.message}`;
+    return JSON.stringify(result);
+}
+const release_status_schema = {
+    name: "extension_release_status",
+    description: "Read where a project stands on extension.dev, from the public registry (registry.extension.land). Read-only: it dispatches nothing and promotes nothing. include:'releases' returns the release channels (channel -> promoted build sha), recent builds, and a public build-page URL for each, which is how you find a valid sha for extension_release_promote, extension_submit, or extension_publish. include:'stores' returns the per-store picture after an extension_submit (chrome, firefox, edge, safari): configured or not, the last credential health check, the last recorded submission, and the latest review status, read from stores/health.json, stores/status.json and stores/submissions.json. Both are included by default. Defaults to the logged-in project (extension_auth); pass workspace + project to read another. Private projects work when your stored login covers them. Registry state can lag the store dashboards by up to a polling interval.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            include: {
+                type: "array",
+                items: {
+                    type: "string",
+                    enum: [
+                        "releases",
+                        "stores"
+                    ]
+                },
+                default: [
+                    "releases",
+                    "stores"
+                ],
+                description: "Which sections to read. Both by default."
+            },
+            workspace: {
+                type: "string",
+                description: "Workspace slug override (default: the stored login's)."
+            },
+            project: {
+                type: "string",
+                description: "Project slug override (default: the stored login's)."
+            },
+            api: API_BASE
+        },
+        required: []
+    }
+};
+function parse(raw) {
+    try {
+        return JSON.parse(raw);
+    } catch  {
+        return {
+            ok: false,
+            error: {
+                name: "ParseError",
+                message: raw
+            }
+        };
+    }
+}
+async function release_status_handler(args) {
+    const include = Array.isArray(args.include) && args.include.length ? args.include : [
+        "releases",
+        "stores"
+    ];
+    const scope = {
+        workspace: args.workspace,
+        project: args.project,
+        api: args.api
+    };
+    const [releases, stores] = await Promise.all([
+        include.includes("releases") ? readReleases(scope).then(parse) : null,
+        include.includes("stores") ? readStores(scope).then(parse) : null
+    ]);
+    const sections = [
+        releases,
+        stores
+    ].filter(Boolean);
+    return JSON.stringify({
+        ok: sections.some((section)=>true === section.ok),
+        ...releases ? {
+            releases
+        } : {},
+        ...stores ? {
+            stores
+        } : {}
+    });
+}
+function storeMdWarnings(browsers, cwd) {
+    const wantsFirefox = browsers.includes("firefox");
+    const wantsEdge = browsers.includes("edge");
+    if (!wantsFirefox && !wantsEdge) return [];
+    let content;
+    try {
+        content = node_fs.readFileSync(node_path.join(cwd, "STORE.md"), "utf8");
+    } catch  {
+        return [
+            "No STORE.md found in the current working directory. Platform submissions read STORE.md from the project's source repository, so this may not apply here; make sure STORE.md exists there for Firefox reviewer notes and Edge certification notes. See the extension-dev skill's store-md reference."
+        ];
+    }
+    const hasField = (section, field)=>{
+        const parts = content.split(/^## +/m);
+        const match = parts.find((p)=>section.test(p.split("\n", 1)[0] ?? ""));
+        if (!match) return false;
+        const sub = match.split(/^### +/m).find((p)=>field.test(p.split("\n", 1)[0] ?? ""));
+        if (!sub) return false;
+        const body = sub.split("\n").slice(1).join("\n");
+        return body.replace(/<!--[\s\S]*?-->/g, "").trim().length > 0;
+    };
+    const warnings = [];
+    if (wantsFirefox && !hasField(/firefox|amo/i, /reviewer notes/i)) warnings.push("STORE.md has no Firefox reviewer notes; AMO reviews go faster with test credentials and steps.");
+    if (wantsEdge && !hasField(/edge/i, /certification notes/i)) warnings.push("STORE.md has no Edge certification notes; the certification team gets no testing guidance.");
+    return warnings;
+}
+const submit_schema = {
+    name: "extension_submit",
+    description: "SUBMIT FOR REVIEW: send a built extension to the Chrome Web Store, Firefox AMO, Edge Add-ons and/or the App Store (Safari) THROUGH extension.dev, which holds your store credentials and dispatches from your project's mirror CI. Store review only. It does NOT push a build to the extension.dev platform and does NOT make a shareable link: that is extension_publish, which is what \"deploy\" or \"ship\" an extension almost always means. Reach for this only when the ask is explicitly a store submission. DEFAULTS TO A DRY RUN that dispatches nothing: the platform verifies auth, project, build and store workflow, and this tool adds each store's credential-health verdict; trust those per-store rows over the platform's bare preflight line, which does not check store health. dryRun:false actually submits, which is irreversible and enters store review. The project comes from your token (extension_auth or EXTENSION_DEV_TOKEN; tokens live at most 7 days, so CI must re-mint from the console's Access tokens page). Store credentials are never arguments and no local file is uploaded. extension_release_status lists valid shas and, after a real submission, reads the recorded outcome and review state.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            browsers: {
+                type: "array",
+                items: {
+                    type: "string",
+                    enum: [
+                        "chrome",
+                        "firefox",
+                        "edge",
+                        "safari"
+                    ]
+                },
+                description: "Stores to submit to."
+            },
+            buildSha: {
+                type: "string",
+                description: "The built commit SHA to submit. It needs a completed build in the project's build index; an unknown sha is rejected."
+            },
+            channel: {
+                type: "string",
+                description: "Release channel to submit from (default stable)."
+            },
+            version: {
+                type: "string",
+                description: "Version label for the submission record (optional)."
+            },
+            dryRun: {
+                type: "boolean",
+                default: true,
+                description: "Preflight only. Pass false to actually dispatch (irreversible, enters store review)."
+            },
+            api: API_BASE
+        },
+        required: [
+            "browsers",
+            "buildSha"
+        ]
+    }
+};
+function submit_fail(name, message) {
+    return JSON.stringify({
+        ok: false,
+        error: {
+            name,
+            message
+        }
+    });
+}
+async function submit_handler(args) {
+    const token = resolveToken();
+    if (!token) return submit_fail("SubmitAuthError", "No token. Run extension_auth (action: login), or set EXTENSION_DEV_TOKEN (create one in the extension.dev dashboard under project settings -> Access tokens; tokens live at most 7 days, so CI must re-mint before expiry).");
+    const browsers = (Array.isArray(args.browsers) ? args.browsers : []).map((b)=>String(b).trim().toLowerCase()).filter(Boolean);
+    if (0 === browsers.length) return submit_fail("SubmitInputError", 'browsers is required (e.g. ["chrome","firefox","edge","safari"]).');
+    const buildSha = String(args.buildSha || "").trim();
+    if (!buildSha) return submit_fail("SubmitInputError", "buildSha is required (the built commit to submit).");
+    const apiCheck = safeApiBase(resolveApiBase(args.api));
+    if (!apiCheck.ok) return submit_fail("SubmitConfigError", apiCheck.message);
+    const url = `${apiCheck.base}/api/cli/stores/submit`;
+    const dryRun = false !== args.dryRun;
+    const body = {
+        browsers,
+        buildSha,
+        dryRun
+    };
+    if (args.channel) body.channel = String(args.channel).trim();
+    if (args.version) body.version = String(args.version).trim();
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "content-type": "application/json",
+                ...identityHeaders("extension_submit")
+            },
+            body: JSON.stringify(body)
+        });
+    } catch (err) {
+        return submit_fail("SubmitNetworkError", `Could not reach ${url}: ${err?.message || err}`);
+    }
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) return submit_fail("SubmitError", `${dryRun ? "preflight" : "submit"} failed (${res.status}): ${data?.message || text || "unknown error"}`);
+    const warnings = Array.isArray(data?.warnings) ? [
+        ...data.warnings
+    ] : [];
+    warnings.push(...storeMdWarnings(browsers, process.cwd()));
+    const result = {
+        mode: "platform",
+        dryRun,
+        ...data
+    };
+    if (dryRun) {
+        const ref = resolveProjectRef();
+        const consoleStoresUrl = consoleProjectUrl(ref, "stores", args.api);
+        const storeModeNote = `Store publish mode (draft / skip-publish / live) is not readable with the CLI token, so it cannot be verified from here; check per-store settings at ${consoleStoresUrl}.`;
+        let health = null;
+        let healthUnreadable = null;
+        let channelRows = null;
+        if (ref) {
+            const [healthRes, channelsRes] = await Promise.all([
+                fetchRegistryJson(registryFileUrl(ref, "stores/health.json"), fetch, {
+                    ref,
+                    api: args.api
+                }),
+                fetchRegistryJson(registryFileUrl(ref, "channels.json"), fetch, {
+                    ref,
+                    api: args.api
+                })
+            ]);
+            if (healthRes.ok) {
+                const stores = healthRes.json?.stores;
+                health = stores && "object" == typeof stores ? stores : null;
+                if (!health) healthUnreadable = "stores/health.json had no stores map";
+            } else healthUnreadable = healthRes.message;
+            if (channelsRes.ok) channelRows = parseChannels(channelsRes.json);
+        } else healthUnreadable = "no stored workspace/project to look up (run extension_auth)";
+        const preflight = browsers.map((browser)=>{
+            if (!health) return {
+                browser,
+                ok: false,
+                configured: "unknown",
+                publishMode: "unknown",
+                reason: `Store configuration could not be read (${healthUnreadable}); verify the ${browser} store in the console before submitting.`
+            };
+            const row = health[browser];
+            if (!row) return {
+                browser,
+                ok: false,
+                configured: false,
+                publishMode: "unknown",
+                reason: `No ${browser} store is configured on this project; a real submission for ${browser} would fail. Configure it at ${consoleStoresUrl}.`
+            };
+            if (true !== row.ok) return {
+                browser,
+                ok: false,
+                configured: false,
+                publishMode: "unknown",
+                reason: String(row.message || "").trim() || `The ${browser} store failed its last credential health check.`
+            };
+            return {
+                browser,
+                ok: true,
+                configured: true,
+                publishMode: "unknown"
+            };
+        });
+        const actionable = preflight.filter((p)=>p.ok).map((p)=>p.browser);
+        const blocked = preflight.filter((p)=>!p.ok);
+        const channelDefaulted = !String(args.channel || "").trim();
+        const resolvedChannel = String(data?.channel || "").trim() || (channelDefaulted ? "stable" : String(args.channel).trim());
+        if (channelRows) {
+            const exists = channelRows.some((r)=>r.channel === resolvedChannel || r.channel.endsWith(`-${resolvedChannel}`));
+            if (!exists) warnings.push(`Channel "${resolvedChannel}"${channelDefaulted ? " (the default)" : ""} does not exist in this project's channels.json (existing: ${channelRows.map((r)=>r.channel).join(", ") || "none"}), so a real submission from it has no promoted build to serve. Promote a build there first (extension_release_promote) or pass an existing channel.`);
+        }
+        const summaryParts = [];
+        if (actionable.length > 0) summaryParts.push(`Preflight passed for ${actionable.join(", ")}: the platform verified auth, the project, build ${data?.buildId ?? buildSha}, and the store workflow, and the store credentials passed their last health check.`);
+        for (const p of blocked)summaryParts.push(`${p.browser}: ${"unknown" === p.configured ? "cannot be verified" : "NOT actionable"} - ${p.reason}`);
+        summaryParts.push(storeModeNote);
+        result.ok = actionable.length > 0;
+        result.preflight = preflight;
+        result.channel = resolvedChannel;
+        result.channelDefaulted = channelDefaulted;
+        if (channelDefaulted) result.channelNote = `channel: ${resolvedChannel} (default)`;
+        result.consoleStoresUrl = consoleStoresUrl;
+        if ("string" == typeof data?.message) result.platformMessage = data.message;
+        result.message = summaryParts.join(" ");
+    }
+    if (!dryRun) result.statusNote = "Track this submission with extension_release_status: it reads the recorded outcome, per-store credential health, and review state from the public registry.";
+    if (warnings.length > 0) result.warnings = warnings;
     return JSON.stringify(result);
 }
 const ENGINE_COMPANION_IDS = new Set([
@@ -9475,7 +9293,7 @@ function doctor_readReadyContract(projectPath, browser) {
 }
 const doctor_schema = {
     name: "extension_doctor",
-    description: "Diagnose a dev session end-to-end: ready contract, dev-server process, control-port agreement, control channel, eval token, executor, and browser liveness. Returns one {check, status, detail, remediation?} entry per leg in dependency order, a 'skip' names the check that blocked it and is NOT a pass. Run this first when any act tool (storage/reload/eval/open) errors unexpectedly. Wraps `extension doctor`. Call with no projectPath for a pre-flight environment check (node, extension CLI, template cache) before any project exists.",
+    description: "Diagnose a dev session end-to-end: ready contract, dev-server process, control-port agreement, control channel, eval token, executor, browser liveness. Returns one {check, status, detail, remediation?} per leg in dependency order; a 'skip' names the check that blocked it and is NOT a pass. Run this first when any act tool (storage/reload/eval/open) errors unexpectedly. Call with no projectPath for a pre-flight environment check (node, extension CLI, template cache) before any project exists.",
     inputSchema: {
         type: "object",
         properties: {
@@ -9516,7 +9334,7 @@ async function environmentPreflight() {
     checks.push({
         check: "template-cache",
         status: cacheExists ? "pass" : "warn",
-        detail: cacheExists ? `Template catalog cached at ${cacheFile}` : "Template catalog not cached yet (first extension_list_templates will fetch it)"
+        detail: cacheExists ? `Template catalog cached at ${cacheFile}` : "Template catalog not cached yet (extension_templates will fetch it)"
     });
     const healthy = checks.every((c)=>"fail" !== c.status);
     return JSON.stringify({
@@ -9660,26 +9478,20 @@ function wait_isAlive(pid) {
 }
 const wait_schema = {
     name: "extension_wait",
-    description: "Wait for a running dev or start session to be ready. Polls the ready.json contract file and returns structured status with these facts: compiled (the compiler finished), browserAttached (the engine's runtime executor connected), and for a browser session guestLoaded (the browser's OWN target list actually shows your extension). guestLoaded is the trustworthy load signal: it catches a silently rejected --load-extension that leaves ready.json stamped attached with empty logs (extension.js BUGS_TO_FIX §83); it is null when it could not be checked (no CDP port, e.g. a gecko session). Every result reports budgetMs (this call's wait budget) and elapsedMs; on status:'timeout' call again to keep waiting (polling resumes on the same contract). In a noBrowser (build-only) session it returns as soon as the compile lands instead of waiting for a browser that will never attach. Ports in the result come from the ready contract, so they always match what the dev server actually bound.",
+    description: "Wait for a running dev or start session to be ready. Polls the ready.json contract and reports compiled (the compiler finished), browserAttached (the runtime executor connected), and guestLoaded (the browser's OWN target list shows your extension). guestLoaded is the trustworthy load signal: it catches a silently rejected --load-extension that leaves ready.json stamped attached with empty logs; it is null when it could not be checked (no CDP port, e.g. a gecko session). Every result reports budgetMs and elapsedMs; on status:'timeout' call again to keep waiting on the same contract. In a noBrowser session it returns as soon as the compile lands instead of waiting for a browser that will never attach. Ports come from the contract, so they match what the server actually bound.",
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
-            browser: {
-                type: "string",
-                description: "Browser to check readiness for. Defaults to the active dev session's browser for this project."
-            },
+            projectPath: PROJECT_PATH,
+            browser: SESSION_BROWSER,
             timeoutMs: {
                 type: "number",
                 default: DEFAULT_TIMEOUT_MS,
-                description: `Wait budget in milliseconds for this call. Default ${DEFAULT_TIMEOUT_MS}; clamped to ${MIN_TIMEOUT_MS}-${SAFE_CEILING_MS} (the ceiling keeps one call under the MCP client's 60s request timeout). On timeout the result reports elapsedMs plus what was observed (compiled, browserAttached); call again to keep waiting, polling resumes on the same contract.`
+                description: `Wait budget for this call. Default ${DEFAULT_TIMEOUT_MS}, clamped to ${MIN_TIMEOUT_MS}-${SAFE_CEILING_MS} so one call stays under the client's 60s request timeout. On timeout, call again to keep waiting.`
             },
             timeout: {
                 type: "number",
-                description: "Deprecated alias of timeoutMs, kept for callers that already pass it. timeoutMs wins when both are given."
+                description: "Deprecated alias of timeoutMs, which wins when both are given."
             }
         },
         required: [
@@ -9718,7 +9530,7 @@ async function wait_handler(args) {
                     buildOnly: true,
                     compiled: true,
                     browserAttached: false,
-                    message: "Build-only session (noBrowser): the extension compiled and the dev server is live, but no browser was launched, so browserAttached will never become true. Do not call extension_wait again to wait for a browser. The control verbs (storage/reload/open/dom_inspect/eval) need a live browser and will not work against this session.",
+                    message: "Build-only session (noBrowser): the extension compiled and the dev server is live, but no browser was launched, so browserAttached will never become true. Do not call extension_wait again to wait for a browser. The control verbs (storage/reload/open/dom_snapshot/eval) need a live browser and will not work against this session.",
                     command: contract.command,
                     browser: contract.browser,
                     port: contract.port,
@@ -9809,10 +9621,7 @@ const add_feature_schema = {
     inputSchema: {
         type: "object",
         properties: {
-            projectPath: {
-                type: "string",
-                description: "Path to the extension project root"
-            },
+            projectPath: PROJECT_PATH,
             feature: {
                 type: "string",
                 enum: [
@@ -10066,78 +9875,6 @@ async function add_feature_handler(args) {
         hint: conflicts.length ? `Warning: ${conflicts.length} file(s) already exist and would be overwritten.` : "No conflicts detected. Safe to create all files."
     });
 }
-const GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
-const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const defaultSleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
-async function startDeviceCode(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(GITHUB_DEVICE_CODE_URL, {
-        method: "POST",
-        headers: {
-            accept: "application/json",
-            "content-type": "application/json"
-        },
-        body: JSON.stringify({
-            client_id: args.clientId,
-            scope: args.scope || "read:user"
-        })
-    });
-    const data = await res.json().catch(()=>({}));
-    if (!res.ok || data.error) throw new Error(`GitHub device-code request failed: ${data.error_description || data.error || res.status}`);
-    return {
-        deviceCode: String(data.device_code || ""),
-        userCode: String(data.user_code || ""),
-        verificationUri: String(data.verification_uri || "https://github.com/login/device"),
-        interval: Number(data.interval || 5),
-        expiresIn: Number(data.expires_in || 900)
-    };
-}
-async function pollForToken(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const sleep = args.sleepImpl ?? defaultSleep;
-    let intervalMs = 1000 * Math.max(1, args.interval);
-    const deadline = Date.now() + Math.max(0, args.budgetMs);
-    while(Date.now() < deadline){
-        await sleep(intervalMs);
-        const res = await doFetch(GITHUB_TOKEN_URL, {
-            method: "POST",
-            headers: {
-                accept: "application/json",
-                "content-type": "application/json"
-            },
-            body: JSON.stringify({
-                client_id: args.clientId,
-                device_code: args.deviceCode,
-                grant_type: DEVICE_GRANT_TYPE
-            })
-        });
-        const data = await res.json().catch(()=>({}));
-        const token = String(data.access_token || "").trim();
-        if (token) return {
-            ok: true,
-            githubToken: token
-        };
-        const error = String(data.error || "");
-        if ("authorization_pending" === error) continue;
-        if ("slow_down" === error) {
-            intervalMs = Math.max(intervalMs + 5000, 1000 * Number(data.interval || 0));
-            continue;
-        }
-        if ("expired_token" === error) return {
-            ok: false,
-            reason: "expired"
-        };
-        if ("access_denied" === error) return {
-            ok: false,
-            reason: "denied"
-        };
-    }
-    return {
-        ok: false,
-        reason: "pending"
-    };
-}
 async function requestDeviceCode(args) {
     const doFetch = args.fetchImpl ?? fetch;
     const res = await doFetch(`${args.apiBase}${args.path}`, {
@@ -10201,8 +9938,7 @@ async function pollDeviceToken(args) {
         if (res.ok && data.token) {
             const creds = persistTokenResponse({
                 apiBase: args.apiBase,
-                data,
-                provider: "extensiondev"
+                data
             });
             return {
                 ok: true,
@@ -10231,30 +9967,6 @@ async function pollDeviceToken(args) {
         await new Promise((r)=>setTimeout(r, 1000 * interval));
     }
 }
-const login_schema = {
-    name: "extension_login",
-    description: "Authenticate to extension.dev and store a project-scoped access token locally so extension_publish can use it. Two-phase: call with `project` to get a code + URL for the user to authorize, then call again with the returned `deviceCode` to finish. The server picks the flow: the extension.dev-gated device flow (you authorize at extension.dev/device; GitHub federation happens server-side, no GitHub token on this machine) or, as a fallback, the legacy GitHub device flow. Never returns the token. Minted tokens live at most 7 days (server-enforced), so CI pipelines must re-mint before expiry on the console's Access tokens page (project settings -> Access tokens). This is the only tool besides extension_publish that talks to the hosted platform.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            project: {
-                type: "string",
-                description: "Target project as '<workspace>/<project>' (the token is scoped to it)"
-            },
-            deviceCode: {
-                type: "string",
-                description: "Resume token from a prior call's `deviceCode`; omit on the first call"
-            },
-            api: {
-                type: "string",
-                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL)"
-            }
-        },
-        required: [
-            "project"
-        ]
-    }
-};
 const FIRST_CALL_BUDGET_MS = 8000;
 const RESUME_BUDGET_MS = 22000;
 function login_fail(name, message) {
@@ -10281,7 +9993,7 @@ function success(creds) {
 function login_pending(start) {
     const complete = String(start.verificationUriComplete || "").trim();
     const hasCompleteLink = complete.length > 0 && complete !== start.verificationUri;
-    const message = hasCompleteLink ? `Open ${complete} and approve (code ${start.userCode} is pre-filled), then call extension_login again with this deviceCode (and the same project). If the page asks for a code, enter ${start.userCode} at ${start.verificationUri}.` : `Open ${start.verificationUri} and enter code ${start.userCode}, then call extension_login again with this deviceCode (and the same project).`;
+    const message = hasCompleteLink ? `Open ${complete} and approve (code ${start.userCode} is pre-filled), then call extension_auth (action: login) again with this deviceCode and the same project. If the page asks for a code, enter ${start.userCode} at ${start.verificationUri}.` : `Open ${start.verificationUri} and enter code ${start.userCode}, then call extension_auth (action: login) again with this deviceCode and the same project.`;
     return JSON.stringify({
         ok: false,
         status: "authorization_pending",
@@ -10302,10 +10014,10 @@ function resumePending(deviceCode, verificationUri) {
         verificationUri,
         deviceCode,
         tokenTtlNote: "Once authorized, the minted token lives at most 7 days (server-enforced); CI must re-mint before expiry (console: project settings -> Access tokens).",
-        message: `Still waiting for authorization. The one-click link and code from the previous response are still valid: open that link (or enter the code at ${verificationUri}), then call extension_login again with this same deviceCode (and the same project).`
+        message: `Still waiting for authorization. The one-click link and code from the previous response are still valid: open that link (or enter the code at ${verificationUri}), then call extension_auth (action: login) again with this same deviceCode and the same project.`
     });
 }
-async function login_handler(args) {
+async function loginToProject(args) {
     const project = String(args.project || "").trim();
     if (!/^[^/]+\/[^/]+$/.test(project)) return login_fail("BadRequest", "project must be in the form '<workspace>/<project>'.");
     const apiBase = resolveApiBase(args.api);
@@ -10315,114 +10027,54 @@ async function login_handler(args) {
     } catch (err) {
         return login_fail("LoginConfigError", err?.message || "Could not load login config.");
     }
-    if ("extensiondev" === config.provider) {
-        if (args.deviceCode) {
-            const poll = await pollDeviceToken({
-                apiBase,
-                path: config.deviceTokenUrl,
-                project,
-                deviceCode: String(args.deviceCode),
-                interval: 5,
-                budgetMs: RESUME_BUDGET_MS
-            });
-            if (poll.ok) return success(poll.creds);
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-            if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
-            return resumePending(String(args.deviceCode), config.verificationUri);
-        }
-        let start;
-        try {
-            start = await requestDeviceCode({
-                apiBase,
-                path: config.deviceCodeUrl,
-                project
-            });
-        } catch (err) {
-            return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
-        }
+    if (args.deviceCode) {
         const poll = await pollDeviceToken({
             apiBase,
             path: config.deviceTokenUrl,
             project,
-            deviceCode: start.deviceCode,
-            interval: start.interval,
-            budgetMs: FIRST_CALL_BUDGET_MS
-        });
-        if (poll.ok) return success(poll.creds);
-        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
-        return login_pending({
-            deviceCode: start.deviceCode,
-            userCode: start.userCode,
-            verificationUri: start.verificationUri,
-            verificationUriComplete: start.verificationUriComplete
-        });
-    }
-    if (args.deviceCode) {
-        const poll = await pollForToken({
-            clientId: config.clientId,
             deviceCode: String(args.deviceCode),
             interval: 5,
             budgetMs: RESUME_BUDGET_MS
         });
-        if (!poll.ok) {
-            if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_login again to restart.");
-            if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-            return resumePending(String(args.deviceCode), "https://github.com/login/device");
-        }
-        try {
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            return success(creds);
-        } catch (err) {
-            return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-        }
+        if (poll.ok) return success(poll.creds);
+        if ("expired" === poll.reason) return login_fail("LoginExpired", "The device code expired. Run extension_auth (action: login) again to restart.");
+        if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+        if ("error" === poll.reason) return login_fail("LoginError", poll.message || "Device login failed.");
+        return resumePending(String(args.deviceCode), config.verificationUri);
     }
     let start;
     try {
-        start = await startDeviceCode({
-            clientId: config.clientId,
-            scope: config.scope
+        start = await requestDeviceCode({
+            apiBase,
+            path: config.deviceCodeUrl,
+            project
         });
     } catch (err) {
-        return login_fail("LoginStartError", err?.message || "Could not start device flow.");
+        return login_fail("LoginStartError", err?.message || "Could not start the device flow.");
     }
-    const poll = await pollForToken({
-        clientId: config.clientId,
+    const poll = await pollDeviceToken({
+        apiBase,
+        path: config.deviceTokenUrl,
+        project,
         deviceCode: start.deviceCode,
         interval: start.interval,
         budgetMs: FIRST_CALL_BUDGET_MS
     });
-    if (poll.ok) try {
-        const creds = await exchangeAndPersist({
-            apiBase,
-            githubToken: poll.githubToken,
-            project
-        });
-        return success(creds);
-    } catch (err) {
-        return login_fail("LoginExchangeError", err?.message || "Token exchange failed.");
-    }
-    if (!poll.ok && "denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied on GitHub.");
-    return login_pending(start);
+    if (poll.ok) return success(poll.creds);
+    if ("denied" === poll.reason) return login_fail("LoginDenied", "Authorization was denied at extension.dev/device.");
+    return login_pending({
+        deviceCode: start.deviceCode,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete
+    });
 }
-const whoami_schema = {
-    name: "extension_whoami",
-    description: "Report the identity carried by the locally stored extension.dev token that extension_login minted (workspace/project scoped), plus its expiry, without revealing the token. The identity comes from that stored token alone; it does not change with the current working directory or whichever project folder you are in. The result records where the login was minted (apiRecordedAtLogin) without asserting a platform base URL: authenticated tools target their own api argument, EXTENSION_DEV_API_URL, or the production default. Returns logged-out status when no credentials are stored.",
-    inputSchema: {
-        type: "object",
-        properties: {}
-    }
-};
-async function whoami_handler() {
+async function readIdentity() {
     const creds = readCredentials();
     if (!creds) return JSON.stringify({
         ok: true,
         status: "logged-out",
-        message: "No stored credentials. Run extension_login to authenticate."
+        message: "No stored credentials. Run extension_auth (action: login) to authenticate."
     });
     const now = Math.floor(Date.now() / 1000);
     const expired = Boolean(creds.expiresAt && creds.expiresAt <= now);
@@ -10431,7 +10083,7 @@ async function whoami_handler() {
     const apiDiverges = Boolean(recordedApi) && recordedApi !== effectiveDefaultApi;
     const envTokenSet = Boolean(String(process.env.EXTENSION_DEV_TOKEN || "").trim());
     const messageParts = [];
-    messageParts.push(expired ? "The stored token has expired. Run extension_login to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_login stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`);
+    messageParts.push(expired ? "The stored token has expired. Run extension_auth (action: login) to refresh it." : `Logged in as ${creds.workspaceSlug}/${creds.projectSlug}, per the token extension_auth stored on this machine. That token is what scopes the identity: it does not follow the current working directory or project folder.`);
     if (apiDiverges) messageParts.push(`This login was minted via ${recordedApi}, but authenticated tools do not read that recorded value: they target ${effectiveDefaultApi} unless given an api argument.`);
     if (envTokenSet) messageParts.push("EXTENSION_DEV_TOKEN is set and takes precedence over this stored login for authenticated tools; this report describes only the stored login.");
     return JSON.stringify({
@@ -10443,7 +10095,7 @@ async function whoami_handler() {
             apiRecordedAtLogin: recordedApi
         } : {},
         apiDefault: effectiveDefaultApi,
-        provider: creds.provider ?? "github",
+        provider: creds.provider ?? "extensiondev",
         expiresAt: creds.expiresAt ? new Date(1000 * creds.expiresAt).toISOString() : null,
         expiresInSeconds: creds.expiresAt ? creds.expiresAt - now : null,
         expired,
@@ -10454,213 +10106,61 @@ async function whoami_handler() {
         message: messageParts.join(" ")
     });
 }
-const logout_schema = {
-    name: "extension_logout",
-    description: "Delete the locally stored extension.dev credentials. Does not revoke the token server-side (the response includes the dashboard URL where the token can be revoked); only removes it from this machine.",
-    inputSchema: {
-        type: "object",
-        properties: {}
-    }
-};
-async function logout_handler() {
-    const creds = readCredentials();
-    const revokeUrl = creds?.workspaceSlug && creds?.projectSlug ? consoleProjectUrl({
-        workspace: creds.workspaceSlug,
-        project: creds.projectSlug
-    }, "settings/access-tokens") : null;
-    const result = clearCredentials();
-    return JSON.stringify({
-        ok: true,
-        cleared: result.cleared,
-        ...result.cleared && revokeUrl ? {
-            revokeUrl
-        } : {},
-        message: result.cleared ? revokeUrl ? `Local credentials removed. The token stays valid server-side until it expires; revoke it now at ${revokeUrl} (takes about a minute to propagate).` : "Local credentials removed. The token stays valid server-side until it expires; revoke it from the project's access-tokens page if needed." : "No stored credentials to remove."
-    });
-}
-const install_browser_schema = {
-    name: "extension_install_browser",
-    description: "Install a managed browser binary for extension testing. Useful in CI, Docker, or fresh environments where browsers are not pre-installed. This downloads ~580-625 MB in a single blocking call (30s+ on a fast link); on a slow network it can exceed a client's default request timeout, so allow a generous timeout when calling it.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            browser: {
-                type: "string",
-                enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "firefox"
-                ],
-                description: "Browser to install"
-            }
-        },
-        required: [
-            "browser"
-        ]
-    }
-};
-async function install_browser_handler(args) {
-    const start = Date.now();
-    try {
-        await extensionInstall({
-            browser: args.browser
-        });
-        return JSON.stringify({
-            status: "installed",
-            browser: args.browser,
-            duration: Date.now() - start,
-            hint: `Browser "${args.browser}" is now available. Use extension_dev or extension_start with browser: "${args.browser}".`
-        });
-    } catch (err) {
-        return JSON.stringify({
-            status: "error",
-            browser: args.browser,
-            message: err instanceof Error ? err.message : String(err),
-            duration: Date.now() - start,
-            hint: "edge" === args.browser ? "Edge installation on Linux may require elevated privileges. Try using Chrome or Chromium instead." : "Check network connectivity and disk space. You can also install browsers manually."
-        });
-    }
+async function clearLocalCredentials() {
+    const creds = readCredentials();
+    const revokeUrl = creds?.workspaceSlug && creds?.projectSlug ? consoleProjectUrl({
+        workspace: creds.workspaceSlug,
+        project: creds.projectSlug
+    }, "settings/access-tokens") : null;
+    const result = clearCredentials();
+    return JSON.stringify({
+        ok: true,
+        cleared: result.cleared,
+        ...result.cleared && revokeUrl ? {
+            revokeUrl
+        } : {},
+        message: result.cleared ? revokeUrl ? `Local credentials removed. The token stays valid server-side until it expires; revoke it now at ${revokeUrl} (takes about a minute to propagate).` : "Local credentials removed. The token stays valid server-side until it expires; revoke it from the project's access-tokens page if needed." : "No stored credentials to remove."
+    });
 }
-const uninstall_browser_schema = {
-    name: "extension_uninstall_browser",
-    description: "Remove a managed browser binary from the Extension.js cache. Only touches the managed cache, never system-installed browsers.",
+const auth_schema = {
+    name: "extension_auth",
+    description: "Sign this machine in to extension.dev, report that login, or clear it. action:'status' (default) names the workspace/project the stored token is scoped to and when it expires, never the token itself; that identity comes from the stored token alone and does not change with the current working directory or whichever project folder you are in. action:'login' is two-phase: call with `project` to get a code plus a URL the user authorizes at extension.dev/device, then call again with the returned `deviceCode`. GitHub federation happens server-side, so no GitHub token lands on this machine. Minted tokens live at most 7 days (server-enforced), so CI must re-mint before expiry on the console's project settings -> Access tokens page. action:'logout' deletes the local credentials only; the token stays valid server-side until revoked at the URL the response returns.",
     inputSchema: {
         type: "object",
         properties: {
-            browser: {
+            action: {
                 type: "string",
                 enum: [
-                    "chrome",
-                    "chromium",
-                    "edge",
-                    "firefox"
+                    "status",
+                    "login",
+                    "logout"
                 ],
-                description: "Managed browser to remove"
+                default: "status"
             },
-            all: {
-                type: "boolean",
-                default: false,
-                description: "Remove every managed browser binary"
-            }
+            project: {
+                type: "string",
+                description: "login: target project as '<workspace>/<project>'; the token is scoped to it."
+            },
+            deviceCode: {
+                type: "string",
+                description: "login: resume token from the prior call's `deviceCode`; omit on the first call."
+            },
+            api: API_BASE
         },
         required: []
     }
 };
-async function uninstall_browser_handler(args) {
-    const start = Date.now();
-    if (!args.browser && !args.all) return JSON.stringify({
-        status: "error",
-        message: "Provide a browser to remove, or set all: true."
-    });
-    try {
-        await extensionUninstall({
-            browser: args.browser,
-            all: args.all
-        });
-        return JSON.stringify({
-            status: "uninstalled",
-            target: args.all ? "all" : args.browser,
-            duration: Date.now() - start,
-            hint: "Use extension_list_browsers to confirm what remains in the managed cache."
-        });
-    } catch (err) {
-        return JSON.stringify({
-            status: "error",
-            target: args.all ? "all" : args.browser,
-            message: err instanceof Error ? err.message : String(err),
-            duration: Date.now() - start
-        });
-    }
-}
-const list_browsers_schema = {
-    name: "extension_list_browsers",
-    description: "List managed browser binaries installed by the extension.dev platform. Shows what browsers are available in the managed cache without checking system-installed browsers.",
-    inputSchema: {
-        type: "object",
-        properties: {}
-    }
-};
-const BROWSER_NAMES = [
-    "chrome",
-    "chromium",
-    "edge",
-    "firefox"
-];
-function getDirSize(dir) {
-    let total = 0;
-    try {
-        for (const entry of readdirSync(dir, {
-            withFileTypes: true
-        })){
-            const full = join(dir, entry.name);
-            if (entry.isDirectory()) total += getDirSize(full);
-            else try {
-                total += statSync(full).size;
-            } catch  {}
-        }
-    } catch  {}
-    return total;
-}
-function list_browsers_formatBytes(bytes) {
-    if (bytes < 1024) return `${bytes} B`;
-    if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)} KB`;
-    return `${(bytes / 1048576).toFixed(1)} MB`;
-}
-async function list_browsers_handler() {
-    const cacheRoot = getManagedBrowsersCacheRoot();
-    const installed = [];
-    for (const browser of BROWSER_NAMES){
-        const browserDir = join(cacheRoot, browser);
-        if (existsSync(browserDir)) {
-            const size = getDirSize(browserDir);
-            installed.push({
-                browser,
-                path: browserDir,
-                size,
-                sizeFormatted: list_browsers_formatBytes(size),
-                engine: "firefox" === browser ? "gecko" : "chromium"
-            });
-        }
-    }
-    return JSON.stringify({
-        cacheRoot,
-        cacheExists: existsSync(cacheRoot),
-        installed,
-        availableToInstall: BROWSER_NAMES.filter((b)=>!installed.some((i)=>i.browser === b)),
-        hint: 0 === installed.length ? "No managed browsers found. Use extension_install_browser to install one, or use a system-installed browser." : `${installed.length} managed browser(s) found. Use extension_detect_browsers for a full system scan.`
+async function auth_handler(args) {
+    const action = args.action ?? "status";
+    if ("logout" === action) return clearLocalCredentials();
+    if ("login" === action) return loginToProject({
+        project: String(args.project ?? ""),
+        deviceCode: args.deviceCode,
+        api: args.api
     });
+    return readIdentity();
 }
 const execFileAsync = promisify(execFile);
-const detect_browsers_schema = {
-    name: "extension_detect_browsers",
-    description: "Detect which browsers are available for extension development. Checks both system-installed and managed browsers, returning paths and capabilities for each.",
-    inputSchema: {
-        type: "object",
-        properties: {
-            browsers: {
-                type: "array",
-                items: {
-                    type: "string",
-                    enum: [
-                        "chrome",
-                        "chromium",
-                        "edge",
-                        "brave",
-                        "opera",
-                        "vivaldi",
-                        "yandex",
-                        "firefox",
-                        "waterfox",
-                        "librewolf",
-                        "safari"
-                    ]
-                },
-                description: "Browsers to check. If omitted, checks all."
-            }
-        }
-    }
-};
 const ALL_BROWSERS = [
     "chrome",
     "chromium",
@@ -10908,8 +10408,8 @@ async function getVersion(binaryPath, browser) {
         return null;
     }
 }
-async function detect_browsers_handler(args) {
-    const browsersToCheck = args.browsers ?? [
+async function detectBrowsers(browsers) {
+    const browsersToCheck = browsers ?? [
         ...ALL_BROWSERS
     ];
     const detected = [];
@@ -10951,8 +10451,161 @@ async function detect_browsers_handler(args) {
             available: available.map((d)=>d.browser),
             missing: missing.map((d)=>d.browser)
         },
-        hint: missing.length ? `Missing browser(s): ${missing.map((d)=>d.browser).join(", ")}.${missing.some((d)=>MANAGED_INSTALLABLE.has(d.browser)) ? ` Use extension_install_browser to install ${missing.filter((d)=>MANAGED_INSTALLABLE.has(d.browser)).map((d)=>d.browser).join(", ")}.` : ""}` : "All requested browsers are available."
+        hint: missing.length ? `Missing browser(s): ${missing.map((d)=>d.browser).join(", ")}.${missing.some((d)=>MANAGED_INSTALLABLE.has(d.browser)) ? ` Use extension_browsers with action: "install" to install ${missing.filter((d)=>MANAGED_INSTALLABLE.has(d.browser)).map((d)=>d.browser).join(", ")}.` : ""}` : "All requested browsers are available."
+    });
+}
+const BROWSER_NAMES = [
+    "chrome",
+    "chromium",
+    "edge",
+    "firefox"
+];
+function getDirSize(dir) {
+    let total = 0;
+    try {
+        for (const entry of readdirSync(dir, {
+            withFileTypes: true
+        })){
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) total += getDirSize(full);
+            else try {
+                total += statSync(full).size;
+            } catch  {}
+        }
+    } catch  {}
+    return total;
+}
+function list_browsers_formatBytes(bytes) {
+    if (bytes < 1024) return `${bytes} B`;
+    if (bytes < 1048576) return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / 1048576).toFixed(1)} MB`;
+}
+async function listManagedBrowsers() {
+    const cacheRoot = getManagedBrowsersCacheRoot();
+    const installed = [];
+    for (const browser of BROWSER_NAMES){
+        const browserDir = join(cacheRoot, browser);
+        if (existsSync(browserDir)) {
+            const size = getDirSize(browserDir);
+            installed.push({
+                browser,
+                path: browserDir,
+                size,
+                sizeFormatted: list_browsers_formatBytes(size),
+                engine: "firefox" === browser ? "gecko" : "chromium"
+            });
+        }
+    }
+    return JSON.stringify({
+        cacheRoot,
+        cacheExists: existsSync(cacheRoot),
+        installed,
+        availableToInstall: BROWSER_NAMES.filter((b)=>!installed.some((i)=>i.browser === b)),
+        hint: 0 === installed.length ? "No managed browsers found. Use extension_browsers with action: \"install\" to install one, or use a system-installed browser." : `${installed.length} managed browser(s) found. Use extension_browsers with action: "detect" for a full system scan.`
+    });
+}
+async function installManagedBrowser(browser) {
+    const start = Date.now();
+    try {
+        await extensionInstall({
+            browser
+        });
+        return JSON.stringify({
+            status: "installed",
+            browser,
+            duration: Date.now() - start,
+            hint: `Browser "${browser}" is now available. Use extension_dev or extension_start with browser: "${browser}".`
+        });
+    } catch (err) {
+        return JSON.stringify({
+            status: "error",
+            browser,
+            message: err instanceof Error ? err.message : String(err),
+            duration: Date.now() - start,
+            hint: "edge" === browser ? "Edge installation on Linux may require elevated privileges. Try using Chrome or Chromium instead." : "Check network connectivity and disk space. You can also install browsers manually."
+        });
+    }
+}
+async function uninstallManagedBrowser(args) {
+    const start = Date.now();
+    if (!args.browser && !args.all) return JSON.stringify({
+        status: "error",
+        message: "Provide a browser to remove, or set all: true."
+    });
+    try {
+        await extensionUninstall({
+            browser: args.browser,
+            all: args.all
+        });
+        return JSON.stringify({
+            status: "uninstalled",
+            target: args.all ? "all" : args.browser,
+            duration: Date.now() - start,
+            hint: 'Use extension_browsers with action: "list" to confirm what remains in the managed cache.'
+        });
+    } catch (err) {
+        return JSON.stringify({
+            status: "error",
+            target: args.all ? "all" : args.browser,
+            message: err instanceof Error ? err.message : String(err),
+            duration: Date.now() - start
+        });
+    }
+}
+const browsers_schema = {
+    name: "extension_browsers",
+    description: "Find, install, and remove the browsers extension tooling can launch. action:'detect' (default) scans BOTH system-installed and managed browsers and reports each one's binary path, version, engine, and debugger support. action:'list' reports only the managed cache this tool downloads into, with sizes on disk. action:'install' downloads a managed binary: ~580-625 MB in one blocking call, so allow a generous client timeout. action:'uninstall' removes managed binaries and never touches a system install.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            action: {
+                type: "string",
+                enum: [
+                    "detect",
+                    "list",
+                    "install",
+                    "uninstall"
+                ],
+                default: "detect"
+            },
+            browsers: {
+                type: "array",
+                items: {
+                    type: "string",
+                    enum: REAL_BROWSERS
+                },
+                description: "detect: limit the scan to these. Omit to check all."
+            },
+            browser: {
+                type: "string",
+                enum: MANAGED_BROWSERS,
+                description: "install/uninstall: which managed binary. Required for install."
+            },
+            all: {
+                type: "boolean",
+                default: false,
+                description: "uninstall: remove every managed binary."
+            }
+        },
+        required: []
+    }
+};
+async function browsers_handler(args) {
+    const action = args.action ?? "detect";
+    if ("list" === action) return listManagedBrowsers();
+    if ("install" === action) {
+        if (!args.browser) return JSON.stringify({
+            ok: false,
+            status: "error",
+            message: "action 'install' needs a browser: one of chrome, chromium, edge, firefox."
+        });
+        return installManagedBrowser(args.browser);
+    }
+    if ("uninstall" === action) return uninstallManagedBrowser({
+        browser: args.browser,
+        all: args.all
     });
+    return detectBrowsers(args.browsers);
 }
 function typeOf(value) {
     if (Array.isArray(value)) return "array";
@@ -11120,40 +10773,32 @@ function inputValidationError(toolName, issues, inputSchema) {
 }
 const tools = [
     create_namespaceObject,
-    list_templates_namespaceObject,
+    templates_namespaceObject,
     build_namespaceObject,
     dev_namespaceObject,
     start_namespaceObject,
-    preview_namespaceObject,
     preview_web_namespaceObject,
     shares_namespaceObject,
     stop_namespaceObject,
-    get_template_source_namespaceObject,
     manifest_validate_namespaceObject,
     theme_verify_namespaceObject,
+    analyze_namespaceObject,
     inspect_namespaceObject,
-    source_inspect_namespaceObject,
     list_extensions_namespaceObject,
     logs_namespaceObject,
     eval_namespaceObject,
     storage_namespaceObject,
     reload_namespaceObject,
     open_namespaceObject,
-    dom_inspect_namespaceObject,
+    dom_snapshot_namespaceObject,
     tools_publish_namespaceObject,
-    release_list_namespaceObject,
+    release_status_namespaceObject,
     release_promote_namespaceObject,
-    deploy_namespaceObject,
-    store_status_namespaceObject,
+    submit_namespaceObject,
     wait_namespaceObject,
     add_feature_namespaceObject,
-    login_namespaceObject,
-    whoami_namespaceObject,
-    logout_namespaceObject,
-    install_browser_namespaceObject,
-    uninstall_browser_namespaceObject,
-    list_browsers_namespaceObject,
-    detect_browsers_namespaceObject,
+    auth_namespaceObject,
+    browsers_namespaceObject,
     doctor_namespaceObject
 ];
 const toolMap = new Map();
@@ -11235,7 +10880,7 @@ async function runCli(cmd, args) {
         return i >= 0 ? args[i + 1] : void 0;
     };
     if ("whoami" === cmd) {
-        log(await whoami_handler());
+        log(await readIdentity());
         return 0;
     }
     if ("release" === cmd) {
@@ -11267,7 +10912,7 @@ async function runCli(cmd, args) {
         return 1;
     }
     if ("logout" === cmd) {
-        log(await logout_handler());
+        log(await clearLocalCredentials());
         return 0;
     }
     if ("login" === cmd) {
@@ -11279,55 +10924,28 @@ async function runCli(cmd, args) {
         const apiBase = resolveApiBase(flag("api"));
         try {
             const config = await fetchLoginConfig(apiBase);
-            if ("extensiondev" === config.provider) {
-                const start = await requestDeviceCode({
-                    apiBase,
-                    path: config.deviceCodeUrl,
-                    project
-                });
-                log("");
-                log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
-                log("");
-                log("  Waiting for authorization...");
-                const poll = await pollDeviceToken({
-                    apiBase,
-                    path: config.deviceTokenUrl,
-                    project,
-                    deviceCode: start.deviceCode,
-                    interval: start.interval,
-                    budgetMs: 1000 * start.expiresIn
-                });
-                if (!poll.ok) {
-                    log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
-                    return 1;
-                }
-                log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
-                return 0;
-            }
-            const start = await startDeviceCode({
-                clientId: config.clientId,
-                scope: config.scope
+            const start = await requestDeviceCode({
+                apiBase,
+                path: config.deviceCodeUrl,
+                project
             });
             log("");
             log(`  Open ${start.verificationUri} and enter code: ${start.userCode}`);
             log("");
             log("  Waiting for authorization...");
-            const poll = await pollForToken({
-                clientId: config.clientId,
+            const poll = await pollDeviceToken({
+                apiBase,
+                path: config.deviceTokenUrl,
+                project,
                 deviceCode: start.deviceCode,
                 interval: start.interval,
                 budgetMs: 1000 * start.expiresIn
             });
             if (!poll.ok) {
-                log("denied" === poll.reason ? "Authorization was denied on GitHub." : "Timed out waiting for authorization. Run login again.");
+                log("denied" === poll.reason ? "Authorization was denied at extension.dev/device." : "expired" === poll.reason ? "The device code expired. Run login again." : "Timed out waiting for authorization. Run login again.");
                 return 1;
             }
-            const creds = await exchangeAndPersist({
-                apiBase,
-                githubToken: poll.githubToken,
-                project
-            });
-            log(`Logged in to ${creds.workspaceSlug}/${creds.projectSlug}.`);
+            log(`Logged in to ${poll.creds.workspaceSlug}/${poll.creds.projectSlug}.`);
             return 0;
         } catch (err) {
             log(err instanceof Error ? err.message : String(err));