- Create src/schemas.ts to re-export from schemas/index.ts for test imports
- Update test manifests to use manifest_version "0.2" instead of "1.0" or "1.0.0"
- Fix import sorting and formatting issues in schema files
- Export McpbManifestSchema from schemas/index.ts
- Move schemas.ts and schemas-loose.ts into separate versioned folders
- Create schemas/0.1.ts and schemas/0.2.ts for strict validation
- Create schemas_loose/0.1.ts and schemas_loose/0.2.ts for loose validation
- Add index files to export all historical schema versions
- Update all imports to use schemas/0.2.ts
- Enforce exact version values using z.literal() for both v0.1 and v0.2
- Remove dxt_version support from v0.2 schemas
- Remove all passthrough() from v0.2 strict schemas
- Validate privacy_policies as URLs in v0.2
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add validation to ensure the manifest_version matches the current expected
version (0.2) during the mcpb pack command. This prevents users from
packing extensions with outdated or incorrect manifest versions.
Changes:
- Add CURRENT_MANIFEST_VERSION constant to centralize version management
- Validate manifest version in pack command before creating bundle
- Update init command to use version constant
- Update tests to use version constant
- Fix prettier formatting issues
Add optional privacy_policies array field to manifest.json that allows
developers to declare their data handling practices. This field accepts
an array of privacy policy statements that describe how the extension
collects, uses, and protects user data.
- Update manifest schema to include privacy_policies field
- Add empty privacy_policies array to all example manifests
- Document the new field in MANIFEST.md
- Replace manifest_version with $schema field pointing to official schema URL
- Support backward compatibility with legacy dxt_version field
- Update all examples and tests to use new $schema field
- Mark dxt_version as deprecated but still functional
- Require either $schema or dxt_version (at least one must be present)
* fix: prevent zip slip attacks in DXT unpack function
Add path validation to prevent directory traversal attacks when unpacking DXT files.
The fix validates that extracted file paths remain within the intended output directory
before writing files to disk.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: make zip slip protection cross-platform compatible
Use path.sep instead of hardcoded '/' separator to ensure path validation
works correctly on both Windows and Unix systems. This fixes failing tests
on Windows while maintaining security protection against directory traversal.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add clean command to clean manifest and trip dev deps for node
* fix: lazy import no loop
* Update src/cli/cli.ts
Co-authored-by: Felix Rieseberg <f@anthropic.com>
---------
Co-authored-by: Felix Rieseberg <f@anthropic.com>
- Parse ZIP central directory to extract Unix file permissions
- Restore executable permissions using chmodSync after unpacking files
- Skip permission restoration on Windows (Unix-only feature)
- Add comprehensive test to verify executable and regular file permissions are preserved
- Fix test setup to use npm instead of yarn for consistent build process
Fixes issue where executable files lose their execute permissions after being packed and unpacked, which is critical for extensions containing binary executables or shell scripts.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
