build: complete the migration to MCP Bundles

Finishes the toolchain swap started with the 1.3.9 release. The manifest now
declares manifest_version 0.4 — the schema marks dxt_version as deprecated —
and the build emits .mcpb only.

- scripts/build-dxt.sh -> scripts/build-mcpb.sh, npm run build:dxt ->
  build:mcpb
- README and CLAUDE.md describe the bundle rather than the Desktop Extension,
  including why it must be packed from the staging copy: packing the working
  tree bundles every devDependency (~290 packages, 81 MB unpacked)
- .gitignore covers *.mcpb alongside the legacy *.dxt

The v1.3.9 release keeps both files attached, as a one-off, so anyone on a
Claude Desktop build predating the rename is not stranded by a security
release. Later releases carry .mcpb only, and the README says so.

Verified: manifest validates against mcpb 2.1.2, and the rebuilt bundle
unpacks and answers initialize outside the repository.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Stephan Ferraro

.gitignore

@@ -115,6 +115,7 @@ Thumbs.db
 dist/
 build/
 
-# DXT build artifacts
+# Bundle build artifacts
+*.mcpb
 *.dxt
 releases/

CHANGELOG.md

@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - The bundle no longer ships devDependencies. It was packed from the working tree, so it carried vitest, TypeScript, ESLint and the packer itself: ~290 packages, 81 MB unpacked. It is now packed from a staging copy with production dependencies only — 116 packages, 3.7 MB. An extension that reaches SSH credentials should not carry a test runner around.
   - `manifest.json` was on 1.0.4 while the package was on 1.3.9, so a bundle could not be matched to a release. The versions are now kept in step, and the build fails if they drift.
   - The publish workflow no longer fails when a release is created for a version that was already published by hand; it checks npm first and skips.
+  - The manifest now declares `manifest_version: "0.4"`; `dxt_version` is deprecated in the schema. The build script is `scripts/build-mcpb.sh` (`npm run build:mcpb`) and emits `.mcpb` only — v1.3.9 carries both extensions as a one-off so users on older Claude Desktop builds are not stranded.
 - **Ported to TypeScript.** The single self-contained `server.mjs` is now seven typed modules under `src/`, compiled to `dist/` by `tsc`: `server.ts` (MCP wiring and `main()`), `tools.ts` (tool schemas and dispatch), `ssh-client.ts`, `ssh-config-parser.ts`, `config-values.ts`, `platform.ts` (everything with module-load side effects) and `types.ts`. `bin/mcp-ssh.js` and the DXT package load `dist/server.js`; `dist/` is generated, not tracked in git, and built by the `prepare` script on install.
   - `tsconfig.json` runs `strict` plus `noUncheckedIndexedAccess`, `exactOptionalPropertyTypes`, `noImplicitOverride`, `noFallthroughCasesInSwitch`, `noPropertyAccessFromIndexSignature` and `verbatimModuleSyntax`. Test files are checked under a lighter config (`tsconfig.test.json`).
   - Added ESLint with `typescript-eslint` type-aware rules (`strictTypeChecked` + `stylisticTypeChecked`). Relaxations are documented in place; notably `prefer-nullish-coalescing` exempts strings and numbers, because `??` is *not* equivalent to `||` for a stripped launcher environment (an empty `%ProgramData%` must fall through, see #10) or for `timeout || DEFAULT`.

CLAUDE.md

@@ -34,14 +34,14 @@ directly and needs no build).
 - `npm publish` - Publish to npm (see PUBLISHING.md for details)
 - `npm pack` - Create tarball for testing
 
-### DXT Package Building
-- `npm run build:dxt` - Build Desktop Extension (.dxt) package
-- `./scripts/build-dxt.sh` - Direct build script execution
+### MCP Bundle Building
+- `npm run build:mcpb` - Build the installable MCP Bundle (`.mcpb`) into `build/`
+- `./scripts/build-mcpb.sh` - Direct build script execution
 
 ## Architecture
 
 TypeScript under `src/`, compiled to `dist/` by `tsc`. `dist/` is generated and not in git;
-`bin/mcp-ssh.js` and the DXT package both load `dist/server.js`.
+`bin/mcp-ssh.js` and the MCP Bundle both load `dist/server.js`.
 
 ### Modules
 - `src/server.ts` - Entry point. Wires the MCP server, registers handlers, exports `main()`
@@ -192,13 +192,15 @@ Configure in Claude Desktop's `claude_desktop_config.json`:
 - `ssh-config` - SSH configuration file parsing
 - Node.js built-ins: `child_process`, `fs/promises`, `os`, `path`
 
-## Desktop Extension Support
+## MCP Bundle Support
 
-The project supports Desktop Extensions (.dxt) for easy installation in Claude Desktop:
+The project ships an installable bundle for Claude Desktop:
 
-- `manifest.json` - DXT package manifest with server configuration
-- `scripts/build-dxt.sh` - Build script that creates .dxt packages in `build/` directory
-- `.dxt` files are ZIP archives containing the manifest and server files
+- `manifest.json` - Bundle manifest. Uses `manifest_version` (the older `dxt_version` is deprecated in the schema), and its `version` must match `package.json` — the build fails on drift
+- `scripts/build-mcpb.sh` - Build script that writes `build/mcp-ssh-<version>.mcpb`
+- `.mcpb` files are ZIP archives containing the manifest, `dist/`, `bin/` and production `node_modules`
+- **Pack from the staging copy, never the working tree.** Packing the tree directly bundles every devDependency (~290 packages, 81 MB unpacked). An extension that reaches SSH credentials should not carry a test runner
+- The format was renamed from Desktop Extension (`.dxt`); `@anthropic-ai/dxt` is deprecated in favour of `@anthropic-ai/mcpb`
 - Built packages are excluded from git via `.gitignore` but can be uploaded to GitHub releases
 
 ## Threat Model
@@ -217,4 +219,4 @@ The LLM driving this MCP server is **not trusted** — its tool arguments can be
 - Production code is TypeScript in `src/`, compiled to `dist/`. Never edit `dist/` — it is regenerated on every build.
 - SSH operations require properly configured SSH keys or `@password` annotations
 - The agent runs over STDIO as an MCP server, not as a standalone application
-- DXT packages provide one-click installation alternative to manual JSON configuration
+- The MCP Bundle provides one-click installation as an alternative to manual JSON configuration

README.md

@@ -10,12 +10,17 @@ This MCP server provides SSH operations through a clean, standardized interface
 
 ## Quick Start
 
-### Desktop Extension Installation (Recommended)
+### MCP Bundle Installation (Recommended)
 
-The easiest way to install MCP SSH Agent is through the Desktop Extension (.dxt) format:
+The easiest way to install MCP SSH Agent is as an MCP Bundle:
 
-1. Download the latest `mcp-ssh-*.dxt` file from the [GitHub releases page](https://github.com/aiondadotcom/mcp-ssh/releases)
-2. Double-click the `.dxt` file to install it in Claude Desktop
+1. Download the latest `mcp-ssh-*.mcpb` file from the [GitHub releases page](https://github.com/aiondadotcom/mcp-ssh/releases)
+2. Double-click the `.mcpb` file to install it in Claude Desktop
+
+> The bundle format was previously called a Desktop Extension and used the `.dxt`
+> extension. v1.3.9 shipped both files during the transition; later releases carry
+> `.mcpb` only. If your Claude Desktop is old enough to reject a `.mcpb` file,
+> update it or use one of the installation methods below.
 3. The SSH tools will be automatically available in your conversations with Claude
 
 ### Alternative Installation Methods
@@ -622,41 +627,35 @@ MCP SSH Agent gives an LLM the ability to drive `ssh` and `scp` on your behalf.
 - **Monitor SSH logs** regularly
 - **Use SSH key forwarding carefully** (disable when not needed)
 
-## Building Desktop Extensions
+## Building the MCP Bundle
 
-For developers who want to build DXT packages locally:
+For developers who want to build the bundle locally:
 
 ### Prerequisites
 
 - Node.js 20 or higher
 - npm
 
-### Building DXT Package
+### Building
 
 ```bash
-# Install dependencies
 npm install
-
-# Build the DXT package
-npm run build:dxt
+npm run build:mcpb
 ```
 
-This creates a `.dxt` file in the `build/` directory that can be installed in Claude Desktop.
+This writes `build/mcp-ssh-<version>.mcpb`, installable in Claude Desktop.
 
-### Publishing DXT Releases
+The bundle is packed from a staging copy containing only production dependencies,
+so it does not carry the test and build toolchain. The build refuses to run if
+`manifest.json` and `package.json` disagree on the version.
 
-To publish a new DXT release:
+### Publishing a release
 
 ```bash
-# Build the DXT package
-npm run build:dxt
-
-# Create a GitHub release with the DXT file
-gh release create v1.0.3 build/mcp-ssh-1.0.3.dxt --title "Release v1.0.3" --notes "MCP SSH Agent v1.0.3"
+npm run build:mcpb
+gh release upload v1.3.9 build/mcp-ssh-1.3.9.mcpb
 ```
 
-The DXT file will be available as a release asset for users to download and install.
-
 ## Contributing
 
 Contributions are welcome! Please feel free to submit a Pull Request.
@@ -712,7 +711,7 @@ mcp-ssh/
 ├── tsconfig.test.json         # Relaxed options for test files
 ├── eslint.config.mjs          # typescript-eslint, type-aware rules
 ├── vitest.config.mjs          # Test and coverage configuration
-├── manifest.json              # DXT package manifest
+├── manifest.json              # MCP Bundle manifest
 ├── package.json               # Dependencies and scripts
 ├── README.md                  # Documentation
 ├── LICENSE                    # MIT License
@@ -722,7 +721,7 @@ mcp-ssh/
 ├── start.sh                   # Development startup script
 ├── start-silent.sh            # Silent startup script
 ├── scripts/
-│   └── build-dxt.sh           # DXT package build script
+│   └── build-mcpb.sh          # MCP Bundle build script
 └── doc/                       # Documentation assets
     ├── example.png            # Usage example screenshot
     └── Claude.png             # Claude Desktop integration example

manifest.json

@@ -1,5 +1,5 @@
 {
-  "dxt_version": "0.1",
+  "manifest_version": "0.4",
   "name": "mcp-ssh",
   "version": "1.3.9",
   "description": "Connect to SSH hosts, run commands, and transfer files securely through Claude Desktop",

package.json

@@ -14,7 +14,6 @@
     "start": "node bin/mcp-ssh.js",
     "dev": "node bin/mcp-ssh.js",
     "build": "tsc -p tsconfig.build.json",
-    "build:dxt": "./scripts/build-dxt.sh",
     "test": "vitest run --coverage",
     "test:watch": "vitest",
     "prepublishOnly": "npm run build && npm test",
@@ -23,7 +22,8 @@
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
     "prepare": "npm run build",
     "lint": "eslint .",
-    "lint:fix": "eslint . --fix"
+    "lint:fix": "eslint . --fix",
+    "build:mcpb": "./scripts/build-mcpb.sh"
   },
   "keywords": [
     "mcp",

scripts/build-dxt.sh scripts/build-mcpb.shscripts/build-dxt.sh renamed to scripts/build-mcpb.sh

@@ -1,13 +1,12 @@
 #!/bin/bash
 
-# Build script for creating the installable bundle for Claude Desktop.
+# Build script for creating the installable MCP Bundle for Claude Desktop.
 #
-# The format was renamed: Anthropic's ".dxt" (Desktop Extension) is now ".mcpb"
-# (MCP Bundle), and @anthropic-ai/dxt is deprecated in favour of
-# @anthropic-ai/mcpb. The manifest format is unchanged and validates against the
-# new tool as-is. We emit BOTH files from the same bundle: .mcpb for current
-# Claude Desktop builds, .dxt as a byte-identical copy for older ones that only
-# recognise the previous extension.
+# Anthropic renamed the format: the ".dxt" Desktop Extension is now the ".mcpb"
+# MCP Bundle, @anthropic-ai/dxt is deprecated in favour of @anthropic-ai/mcpb,
+# and the manifest carries `manifest_version` rather than the deprecated
+# `dxt_version`. v1.3.9 shipped both extensions during the transition; from here
+# on only .mcpb is produced.
 
 set -e
 
@@ -17,7 +16,7 @@ GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m' # No Color
 
-echo -e "${GREEN}Building MCP SSH bundle${NC}"
+echo -e "${GREEN}Building MCP SSH bundle (.mcpb)${NC}"
 
 if ! command -v npx &> /dev/null; then
     echo -e "${RED}Error: npm/npx not found. Please install Node.js${NC}"
@@ -49,7 +48,6 @@ if [ "$PKG_VERSION" != "$MANIFEST_VERSION" ]; then
 fi
 
 MCPB_FILE="mcp-ssh-${PKG_VERSION}.mcpb"
-DXT_FILE="mcp-ssh-${PKG_VERSION}.dxt"
 
 echo -e "${YELLOW}Validating manifest...${NC}"
 npx mcpb validate manifest.json
@@ -75,15 +73,10 @@ mkdir -p "$STAGE/doc" && cp doc/Claude.png "$STAGE/doc/"
 echo -e "${YELLOW}Packing bundle...${NC}"
 npx mcpb pack "$STAGE" "$BUILD_DIR/$MCPB_FILE"
 
-# Same archive under the legacy extension, for Claude Desktop builds predating
-# the rename.
-cp "$BUILD_DIR/$MCPB_FILE" "$BUILD_DIR/$DXT_FILE"
-
 echo -e "${GREEN}✓ Bundle created: $BUILD_DIR/$MCPB_FILE${NC}"
-echo -e "${GREEN}✓ Legacy copy:    $BUILD_DIR/$DXT_FILE${NC}"
 echo -e "${GREEN}✓ Size: $(ls -lh "$BUILD_DIR/$MCPB_FILE" | awk '{print $5}')${NC}"
 
 echo -e "\n${YELLOW}Next steps:${NC}"
 echo "1. Test the bundle locally"
-echo "2. Attach both files to the GitHub release:"
-echo "   gh release upload v${PKG_VERSION} $BUILD_DIR/$MCPB_FILE $BUILD_DIR/$DXT_FILE"
+echo "2. Attach it to the GitHub release:"
+echo "   gh release upload v${PKG_VERSION} $BUILD_DIR/$MCPB_FILE"