v1.4.0 — pre-launch deep audit

Pre-launch deep audit: a 4-dimension adversarial review (cross-framework
breakage, dependency drift, validator correctness, security/cross-platform)
that fixed 16 verified findings — including a publish-guard gap — and added CI
guardrails so each fixed class is regression-protected.

Added

• CI regression guardrails. Three jobs in .github/workflows/validate.yml:
  an adversarial validator-fixture suite (known-bad manifests must be caught,
  known-good must pass), a dependency-drift check (fails if a fast-moving
  package un-pins), and a WXT scaffold→install→build→validate matrix (the exact
  path the wxt/sandbox break failed on). The drift check immediately caught a
  stray wxt@latest in the vanilla template README.
• Agent capability matrix in the README. A table now shows each specialist
  agent's tool grants, making the minimal-privilege design (no agent can
  Edit/Write or publish; only the architect plans without shell) verifiable at
  a glance instead of by reading three agent files.
• Note that DNR rule-count limits aren't validated. dnr-conversion.md
  already documented Chrome's ~30k static / ~5k dynamic limits; it now states
  explicitly that the bundled validators don't count rules, so authors track it.
• Icon dimension validation. validate-manifest.py now reads each PNG
  icon's actual pixel dimensions (stdlib only — no Pillow) and warns when they
  don't match the size key the icon is declared under. Wrong-size icons used to
  pass the file-existence check and only fail later at Chrome Web Store upload.
• Host/match-pattern syntax validation. validate-permissions.py now flags
  malformed match patterns in host_permissions, optional_host_permissions,
  and content-script matches (e.g. **invalid**), which Chrome silently drops
  at load time.

Fixed

• Windows requirements documented. The bundled helper scripts assume a
  POSIX shell, and build-zip.sh shells out to zip. README now states that
  Windows users must run the plugin inside WSL or Git Bash. A cross-platform
  port of the helpers is planned post-launch.
• Plasmo scaffold produced a project that wouldn't install (upstream bug).
  pnpm create plasmo (create-plasmo 0.90.x) pins "plasmo": "workspace:*",
  so the next pnpm install fails with ERR_PNPM_WORKSPACE_PKG_NOT_FOUND. The
  plasmo-framework skill and /chrome-ext:new Plasmo path now warn about the
  upstream breakage, document the pnpm pkg set dependencies.plasmo=latest
  workaround, and steer new projects to WXT. (Existing Plasmo projects are
  unaffected — they never re-run the scaffold.)
• Interactive WXT scaffold docs pinned to wxt@~0.20.26. commands/new.md
  and the wxt-framework skill used wxt@latest init; since 0.20.x relocated
  the defineBackground/defineContentScript exports, a floating @latest
  can scaffold a project that no longer imports correctly. Also corrected a doc
  line that wrongly said scaffold-wxt.sh runs wxt init (it writes files
  directly and already pins ~0.20.26).
• validate-csp.sh now honors the exit-code contract. It exited with the
  raw critical count (e.g. 3) instead of 1; now exit 1 on any critical,
  0 otherwise — consistent with the other validators.
• CRXJS scaffold was incomplete and failed to build. The react-ts
  template doesn't include the chrome.* types and the skill didn't create the
  _locales file its manifest references, so a clean scaffold hit TS2304: Cannot find name 'chrome' and shipped unresolved __MSG_*__ placeholders.
  Added @types/chrome, a tsconfig.app.json types: ["chrome"] step, and a
  public/_locales/en/messages.json step. Also moved the recommended plugin
  off @crxjs/vite-plugin@beta (an old 2.0.0-beta.x) to stable @^2.6.

Security

• Publish guard rewritten to block the actual live-publish commands. The
  PreToolUse hook previously blocked --auto-publish, a flag that
  chrome-webstore-upload-cli v4 no longer has — so the real live-publish
  paths (chrome-webstore-upload publish, or a bare chrome-webstore-upload
  that uploads-and-publishes in one shot) bypassed the guard entirely. The
  hook now allows only the explicit upload (draft) subcommand and blocks
  publish/bare invocations unless prefixed with CONFIRM_PUBLISH_LIVE=1.

Changed

• Publishing docs updated to the chrome-webstore-upload-cli v4 CLI.
  v4 removed the --client-id/--client-secret/--refresh-token/--auto-publish
  flags: credentials now come from the CLIENT_ID/CLIENT_SECRET/REFRESH_TOKEN
  environment variables, and live publish uses a separate publish subcommand.
  Updated commands/publish.md, extension-publishing/SKILL.md, the GitHub
  Actions template, and the OAuth setup guide; pinned the dlx invocations to
  chrome-webstore-upload-cli@4 so a future major can't break the flags again.

v1.3.1 — Fix WXT scaffold (wxt/sandbox removed upstream)

[1.3.1] - 2026-06-13

Fixed

• WXT scaffold produced a project that wouldn't install or build. WXT
  0.20.26 removed the wxt/sandbox export, but the scaffold and the
  wxt-framework skill docs still imported defineBackground /
  defineContentScript from wxt/sandbox. On a fresh scaffold, pnpm install (via the wxt prepare postinstall) and pnpm build both failed
  with "./sandbox" is not exported. Fixed across all 8 references
  (scaffold-wxt.sh, wxt-framework/SKILL.md, references/entrypoints.md,
  references/messaging.md, plasmo-framework/references/csui.md) to the
  current subpaths wxt/utils/define-background and
  wxt/utils/define-content-script. Verified end-to-end: scaffold → pnpm install (rc 0) → pnpm build (rc 0) → real .output/chrome-mv3/manifest.json
  → web-ext lint 0 errors.
• Pinned WXT defensively. scaffold-wxt.sh floated "wxt": "^0.20.0"
  (which is how it drifted onto the breaking 0.20.26); changed to
  "wxt": "~0.20.26" (patch-only) so a future minor can't silently break
  the scaffold again. Matches the project's reproducible-builds default.

---

If you scaffolded a WXT project with v1.3.0 or earlier and hit "./sandbox" is not exported on pnpm install/pnpm build, update to v1.3.1 and re-scaffold, or change your entrypoint imports to wxt/utils/define-background and wxt/utils/define-content-script.

Install:

/plugin marketplace add anthropics/claude-plugins-community
/plugin install chrome-extension-builder@claude-community

v1.3.0 — Pre-launch growth pass

[1.3.0] - 2026-06-03

Added

• Scaffold attribution footer. Generated project READMEs (WXT scaffold
  and the vanilla template) now end with a single, clearly-removable
  attribution line linking back to the plugin. README-footer only — never
  in extension UI, manifests, or store listings.
• Issue templates (.github/ISSUE_TEMPLATE/): bug-report and
  feature-request forms with framework/command checkboxes — the plugin's
  telemetry-free way of learning which paths people actually use. Plus a
  config routing security reports to the private advisory form and
  questions to Discussions.
• GitHub Discussions enabled with a public
  Roadmap
  and three starter issues (icon-dimension validation, headless smoke-test
  docs, vue/svelte/solid popup templates).
• README badge row (CI, license, plugin, release) and a repo social
  preview card at .github/social-preview.png.

Changed

• Eight new GitHub topics for discoverability (chrome-web-store, mv3,
  cli, developer-tools, scaffolding, firefox, edge, vite).

---

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

v1.2.3 — Drop version field from marketplace.json

---

This is a metadata-only fix to unblock the upstream auto-bump CI on
claude-plugins-community. Plugin behavior is unchanged from v1.2.2.
Reinstall is not required.

v1.2.2 — Fix hooks.json schema

---

If you already installed v1.2.0 or v1.2.1, the doctor will show:

Hook load failed: expected record at path "hooks", received undefined

Update with:

/plugin marketplace update chrome-extension-builder-marketplace
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

If the install caches the old version, clear with:

rm -rf ~/.claude/plugins/marketplaces/chrome-extension-builder-marketplace
rm -rf ~/.claude/plugins/cache/temp_local_*

Then re-run /plugin marketplace add harry-harish/chrome-extension-builder.

v1.2.1 — Clean demo GIF

---

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

v1.2.0 — Real demo GIF

---

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

If you previously hit Validation errors: userConfig.default_framework: Unrecognized key: "enum" on v1.0.0 or v1.1.0, this release (1.1.1+) has the fix.

v1.1.1 — Fix userConfig schema rejection

---

This patch unblocks installation. If you tried /plugin install and got
Validation errors: userConfig.default_framework: Unrecognized key: "enum",
re-run the install on this version (1.1.1 or later) and it will succeed.

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

v1.1.0 — Launch-readiness pass

---

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace

Submission for the official Claude Code community marketplace is in flight at
clau.de/plugin-directory-submission.

v1.0.0 — Initial release

---

Install:

/plugin marketplace add harry-harish/chrome-extension-builder
/plugin install chrome-extension-builder@chrome-extension-builder-marketplace