@extenshi/cli 0.12.0 → 0.14.0

package/dist/review-render.js

@@ -71,6 +71,10 @@ function renderFinding(f) {
         console.log(chalk.dim(`    ${chalk.cyan('found:')} ${f.evidence}`));
     for (const line of wrap(f.recommendation, 84))
         console.log(`    ${chalk.green('→')} ${chalk.green(line)}`);
+    // Naming the policy is what lets the developer check the call and argue it
+    // with a reviewer; the citation below is the page, this is the rule.
+    if (f.policy)
+        console.log(chalk.dim(`    ${chalk.cyan('policy:')} ${f.policy.title} (${f.policy.id})`));
     console.log(chalk.dim(`    ${f.citation}`));
     console.log();
 }

package/dist/review-render.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-render.js","sourceRoot":"","sources":["../src/review-render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,SAAS,KAAK,CAAC,CAAU;IACxB,QAAQ,CAAC,EAAE,CAAC;QACX,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACpD,KAAK,WAAW;YACf,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACtD,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC5D,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAChC,QAAQ,CAAC,EAAE,CAAC;QACX,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,KAAK,WAAW;YACf,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5C,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACxD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE9C,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAA;QACtF,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAM;IACP,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACjG,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,IAAI,WAAW,GAAiB,EAAE,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC/B,WAAW,GAAG,CAAC,CAAC,OAAO,CAAA;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,aAAa,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,GAAG,CAAC,IAAI,CACb,yFAAyF,CACzF,CACD,CAAA;IACF,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,CAAC,qFAAqF,CAAC,CACpG,CAAA;IACF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,CAAC,GAAG,EAAE,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACxC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,IAAI,GAAG,IAAI,CAAA;QACZ,CAAC;aAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;IACF,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,GAAG,CAAA;AACX,CAAC"}
+{"version":3,"file":"review-render.js","sourceRoot":"","sources":["../src/review-render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,SAAS,KAAK,CAAC,CAAU;IACxB,QAAQ,CAAC,EAAE,CAAC;QACX,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACpD,KAAK,WAAW;YACf,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACtD,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC5D,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAChC,QAAQ,CAAC,EAAE,CAAC;QACX,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,KAAK,WAAW;YACf,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5C,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACxD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE9C,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAA;QACtF,OAAO,CAAC,GAAG,EAAE,CAAA;QACb,OAAM;IACP,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC9F,IAAI,MAAM,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACjG,IAAI,MAAM,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAClF,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,IAAI,WAAW,GAAiB,EAAE,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC/B,WAAW,GAAG,CAAC,CAAC,OAAO,CAAA;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9B,CAAC;QACD,aAAa,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,+DAA+D;IAC/D,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,GAAG,CAAC,IAAI,CACb,yFAAyF,CACzF,CACD,CAAA;IACF,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,OAAO,CAAC,qFAAqF,CAAC,CACpG,CAAA;IACF,CAAC;SAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAC5E,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1G,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACvG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,CAAC,GAAG,EAAE,CAAA;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,IAAI,CAAC,IAAY,EAAE,KAAa;IACxC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACd,IAAI,GAAG,IAAI,CAAA;QACZ,CAAC;aAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACvC,CAAC;IACF,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,GAAG,CAAA;AACX,CAAC"}

package/dist/review-risk.d.ts

@@ -8,10 +8,17 @@
  *     → [optional] fetch last-published manifest for --extension-id (review-catalog)
  *     → run checks (review-checks) → render (review-render) or --json
  *
- * Network is only touched for the manifest diff, and only when --extension-id is
- * given. With no id, every other check still runs fully offline — no API key
- * required. Exit code is 1 only when something WILL BE REJECTED, so it gates a
- * publish step in CI without blocking on slow-review / attrition advisories.
+ * The build never leaves the machine — every check reads the artifact locally
+ * and no API key is required. Two things do go out, neither of them the build:
+ * the manifest diff (only with --extension-id, and it sends the id), and the
+ * anonymous telemetry every command emits via runCommand (cli.ts), which the
+ * first interactive run asks about and which reports nothing before an answer.
+ * "Fully offline" is therefore the wrong claim to make in user-facing copy —
+ * see docs/src/app/developers/cli/page.mdx "What leaves your machine" and the
+ * /cli FAQ, which are worded to match.
+ *
+ * Exit code is 1 only when something WILL BE REJECTED, so it gates a publish
+ * step in CI without blocking on slow-review / attrition advisories.
  */
 export interface ReviewRiskOptions {
     artifactPath: string;
@@ -23,6 +30,12 @@ export interface ReviewRiskOptions {
     apiKey?: string;
     /** Store to diff the manifest against (default CHROME — this tool is CWS-centric). */
     store?: 'CHROME' | 'FIREFOX' | 'EDGE';
+    /**
+     * Path to a listing draft (`listing.json`). Optional: the listing rules
+     * already run against the package's own name/description in every locale.
+     * This is what adds the FULL description, which lives only in the dashboard.
+     */
+    listingPath?: string;
     outputJson: boolean;
 }
 export declare function runReviewRisk(opts: ReviewRiskOptions): Promise<void>;

package/dist/review-risk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-risk.d.ts","sourceRoot":"","sources":["../src/review-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,MAAM,WAAW,iBAAiB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sFAAsF;IACtF,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;IACrC,UAAU,EAAE,OAAO,CAAA;CACnB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE1E"}
+{"version":3,"file":"review-risk.d.ts","sourceRoot":"","sources":["../src/review-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,MAAM,WAAW,iBAAiB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sFAAsF;IACtF,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;CACnB;AAuDD,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6E1E"}

package/dist/review-risk.js

@@ -8,18 +8,77 @@
  *     → [optional] fetch last-published manifest for --extension-id (review-catalog)
  *     → run checks (review-checks) → render (review-render) or --json
  *
- * Network is only touched for the manifest diff, and only when --extension-id is
- * given. With no id, every other check still runs fully offline — no API key
- * required. Exit code is 1 only when something WILL BE REJECTED, so it gates a
- * publish step in CI without blocking on slow-review / attrition advisories.
+ * The build never leaves the machine — every check reads the artifact locally
+ * and no API key is required. Two things do go out, neither of them the build:
+ * the manifest diff (only with --extension-id, and it sends the id), and the
+ * anonymous telemetry every command emits via runCommand (cli.ts), which the
+ * first interactive run asks about and which reports nothing before an answer.
+ * "Fully offline" is therefore the wrong claim to make in user-facing copy —
+ * see docs/src/app/developers/cli/page.mdx "What leaves your machine" and the
+ * /cli FAQ, which are worded to match.
+ *
+ * Exit code is 1 only when something WILL BE REJECTED, so it gates a publish
+ * step in CI without blocking on slow-review / attrition advisories.
  */
 import fs from 'node:fs';
 import ora from 'ora';
+import { listingFromArtifact, mergeListings, parseListingFile } from './listing.js';
 import { loadArtifact } from './review-archive.js';
 import { fetchPriorManifest } from './review-catalog.js';
 import { runChecks, summarize } from './review-checks.js';
 import { renderReviewReport } from './review-render.js';
 const MAX_SIZE = 50 * 1024 * 1024; // 50 MB, matches `scan`
+/**
+ * Assemble the listing to check: the package's localized name/description,
+ * overlaid with the draft file when one was passed.
+ *
+ * A bad `--listing` file THROWS rather than resolving to "no listing": the user
+ * pointed at it explicitly, so silently checking nothing would look like the
+ * listing passed. A package with no listing text at all resolves to null and
+ * the listing rules simply do not run.
+ */
+function assembleListing(manifest, files, listingPath) {
+    const fromArtifact = listingFromArtifact(manifest, files);
+    if (!listingPath)
+        return fromArtifact;
+    if (!fs.existsSync(listingPath)) {
+        throw new Error(`Listing file not found: ${listingPath}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(listingPath, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Listing file is not valid JSON: ${err.message}`);
+    }
+    try {
+        return mergeListings(fromArtifact, parseListingFile(parsed));
+    }
+    catch (err) {
+        throw new Error(`${listingPath}: ${err.message}`);
+    }
+}
+/**
+ * What the listing rules covered, stated plainly.
+ *
+ * A clean listing section means nothing unless the reader knows WHICH text was
+ * read: the package carries the name and short description in every locale, but
+ * never the full dashboard description, and that is where keyword spam
+ * overwhelmingly lives. Saying so is the difference between "your listing is
+ * fine" and "the half of your listing we could see is fine".
+ */
+function listingNotes(listing, listingPath) {
+    if (!listing) {
+        return ['no listing text found in the package — pass --listing <file> to check name and descriptions'];
+    }
+    const notes = [
+        `listing checked in ${listing.locales.length} locale(s): ${listing.locales.map((l) => l.locale).join(', ')}`,
+    ];
+    if (!listingPath && !listing.locales.some((l) => l.description)) {
+        notes.push('the full store description is not in the package — pass --listing <file> with it to check for keyword spam');
+    }
+    return notes;
+}
 export async function runReviewRisk(opts) {
     if (!fs.existsSync(opts.artifactPath)) {
         throw new Error(`Artifact file not found: ${opts.artifactPath}`);
@@ -57,7 +116,8 @@ export async function runReviewRisk(opts) {
         diffNote =
             'pass --extension-id <numeric catalog id> to diff against your last published manifest (auto-disable check)';
     }
-    const summary = summarize(runChecks({ manifest, files, priorManifest }));
+    const listing = assembleListing(manifest, files, opts.listingPath);
+    const summary = summarize(runChecks({ manifest, files, priorManifest, listing }));
     if (opts.outputJson) {
         process.stdout.write(`${JSON.stringify({
             artifact: opts.artifactPath,
@@ -67,6 +127,15 @@ export async function runReviewRisk(opts) {
             counts: summary.counts,
             blocking: summary.blocking,
             findings: summary.findings,
+            // What the listing rules actually saw, so a --json consumer can tell
+            // "no listing findings" from "no listing was checked".
+            listing: listing
+                ? {
+                    source: listing.source,
+                    defaultLocale: listing.defaultLocale,
+                    locales: listing.locales.map((l) => l.locale),
+                }
+                : null,
             diffSkippedReason: priorManifest ? undefined : diffNote,
             archiveWarnings: warnings,
         }, null, 2)}\n`);
@@ -77,6 +146,8 @@ export async function runReviewRisk(opts) {
         renderReviewReport(summary);
         if (diffNote)
             process.stderr.write(`note: ${diffNote}\n`);
+        for (const note of listingNotes(listing, opts.listingPath))
+            process.stderr.write(`note: ${note}\n`);
     }
     // Block a publish pipeline only on a definite rejection.
     if (summary.blocking)

package/dist/review-risk.js.map

@@ -1 +1 @@
-{"version":3,"file":"review-risk.js","sourceRoot":"","sources":["../src/review-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAiB,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,wBAAwB;AAe1D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IAE5F,4EAA4E;IAC5E,IAAI,aAAa,GAAoB,IAAI,CAAA;IACzC,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QAClG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,aAAa,GAAG,KAAK,CAAC,QAAoB,CAAA;YAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YAC1E,OAAO,CAAC,OAAO,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;QACpE,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1D,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,qCAAqC,CAAA;QACjE,CAAC;IACF,CAAC;SAAM,CAAC;QACP,QAAQ;YACP,4GAA4G,CAAA;IAC9G,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,CAAC,SAAS,CAChB;YACC,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,eAAe,EAAE,QAAQ,CAAC,gBAAgB;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,eAAe,EAAE,QAAQ;SACzB,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;IACF,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAA;IAC1D,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AAC3C,CAAC"}
+{"version":3,"file":"review-risk.js","sourceRoot":"","sources":["../src/review-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAgB,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAA+B,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,wBAAwB;AAqB1D;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,KAAc,EAAE,WAAoB;IAChF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,CAAC,WAAW;QAAE,OAAO,YAAY,CAAA;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAC7D,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,OAAuB,EAAE,WAAoB;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,CAAC,6FAA6F,CAAC,CAAA;IACvG,CAAC;IACD,MAAM,KAAK,GAAG;QACb,sBAAsB,OAAO,CAAC,OAAO,CAAC,MAAM,eAAe,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC5G,CAAA;IACD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CACT,4GAA4G,CAC5G,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC9F,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IAE5F,4EAA4E;IAC5E,IAAI,aAAa,GAAoB,IAAI,CAAA;IACzC,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;QAClG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,aAAa,GAAG,KAAK,CAAC,QAAoB,CAAA;YAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;YAC1E,OAAO,CAAC,OAAO,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;QACpE,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1D,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,qCAAqC,CAAA;QACjE,CAAC;IACF,CAAC;SAAM,CAAC;QACP,QAAQ;YACP,4GAA4G,CAAA;IAC9G,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAEjF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,CAAC,SAAS,CAChB;YACC,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,eAAe,EAAE,QAAQ,CAAC,gBAAgB;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,qEAAqE;YACrE,uDAAuD;YACvD,OAAO,EAAE,OAAO;gBACf,CAAC,CAAC;oBACA,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;iBAC7C;gBACF,CAAC,CAAC,IAAI;YACP,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,eAAe,EAAE,QAAQ;SACzB,EACD,IAAI,EACJ,CAAC,CACD,IAAI,CACL,CAAA;IACF,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9D,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,QAAQ,IAAI,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;IACpG,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AAC3C,CAAC"}

package/dist/telemetry-consent.d.ts

@@ -0,0 +1,62 @@
+/**
+ * First-run telemetry question.
+ *
+ * Telemetry itself lives in telemetry.ts, which is vendored byte-identical into
+ * @extenshi/mcp — the MCP server runs headless and can never prompt, so the
+ * asking lives here, in the CLI only, and the answer is persisted to the shared
+ * `~/.extenshi/config.json` (`telemetry: true|false`) that both packages read.
+ *
+ * It is asked ONCE, before the first event of the first interactive run, and
+ * never again: `readTelemetryPreference()` returning a boolean is the record of
+ * having asked. Everything else is a reason NOT to ask —
+ *
+ *   - not a TTY on both stdin and stderr (piped, redirected, or a daemon):
+ *     a prompt would hang a build forever;
+ *   - CI is set: same, and the answer would belong to nobody;
+ *   - DO_NOT_TRACK / EXTENSHI_TELEMETRY is set: the user has already answered
+ *     with the environment, and re-asking would be nagging;
+ *   - EXTENSHI_POSTHOG_KEY is set but empty: the build ships dark, so there is
+ *     nothing to consent to.
+ *
+ * Declining is recorded, not just obeyed: a `false` in the config is what makes
+ * the decision stick across runs and machines-per-home-dir. When the config
+ * cannot be written, the answer is still enforced for the current run through
+ * the environment, and the question comes back next time.
+ *
+ * Fail-soft like the rest of the telemetry path — an unwritable home directory
+ * or a closed stdin must never break the command the user actually typed.
+ */
+export declare const TELEMETRY_PROMPT_TEXT: string;
+export interface ConsentDeps {
+    env: NodeJS.ProcessEnv;
+    /** True only when a human can actually see and answer the question. */
+    isInteractive: () => boolean;
+    readPreference: () => boolean | undefined;
+    savePreference: (enabled: boolean) => void;
+    /** Resolves to the raw answer, or null when nothing was answered in time. */
+    ask: (question: string) => Promise<string | null>;
+    log: (message: string) => void;
+}
+/**
+ * Which environment variable, if any, has already answered the question.
+ *
+ * Exported because `extenshi telemetry status` has to name the variable that is
+ * overriding the saved answer, and a second copy of this list there would drift
+ * from the one that actually suppresses the prompt. Any non-empty value counts
+ * as an answer — including `DO_NOT_TRACK=0`, which telemetry.ts reads as falsy
+ * and so leaves reporting on. Not asking is still right there: the user has
+ * said something about telemetry with the environment, and re-asking would
+ * override a deliberate setting with a prompt.
+ */
+export declare function envAnswerSource(env: NodeJS.ProcessEnv): 'DO_NOT_TRACK' | 'EXTENSHI_TELEMETRY' | null;
+/** Should the question be put to the user at all? */
+export declare function shouldAskForConsent(deps: ConsentDeps): boolean;
+/**
+ * Ask once, persist the answer, and return it. Returns `undefined` when the
+ * question was skipped or went unanswered — the caller carries on either way,
+ * and an unanswered question is simply asked again on the next interactive run.
+ */
+export declare function maybeAskForTelemetryConsent(deps: ConsentDeps): Promise<boolean | undefined>;
+/** The real dependencies: a TTY prompt on stderr so stdout stays pipeable. */
+export declare function defaultConsentDeps(): ConsentDeps;
+//# sourceMappingURL=telemetry-consent.d.ts.map

package/dist/telemetry-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-consent.d.ts","sourceRoot":"","sources":["../src/telemetry-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAYH,eAAO,MAAM,qBAAqB,QAIiC,CAAA;AAEnE,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,uEAAuE;IACvE,aAAa,EAAE,MAAM,OAAO,CAAA;IAC5B,cAAc,EAAE,MAAM,OAAO,GAAG,SAAS,CAAA;IACzC,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;IAC1C,6EAA6E;IAC7E,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACjD,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,GAAG,oBAAoB,GAAG,IAAI,CAIpG;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAS9D;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA2CjG;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,WAAW,CAoBhD"}

package/dist/telemetry-consent.js

@@ -0,0 +1,144 @@
+/**
+ * First-run telemetry question.
+ *
+ * Telemetry itself lives in telemetry.ts, which is vendored byte-identical into
+ * @extenshi/mcp — the MCP server runs headless and can never prompt, so the
+ * asking lives here, in the CLI only, and the answer is persisted to the shared
+ * `~/.extenshi/config.json` (`telemetry: true|false`) that both packages read.
+ *
+ * It is asked ONCE, before the first event of the first interactive run, and
+ * never again: `readTelemetryPreference()` returning a boolean is the record of
+ * having asked. Everything else is a reason NOT to ask —
+ *
+ *   - not a TTY on both stdin and stderr (piped, redirected, or a daemon):
+ *     a prompt would hang a build forever;
+ *   - CI is set: same, and the answer would belong to nobody;
+ *   - DO_NOT_TRACK / EXTENSHI_TELEMETRY is set: the user has already answered
+ *     with the environment, and re-asking would be nagging;
+ *   - EXTENSHI_POSTHOG_KEY is set but empty: the build ships dark, so there is
+ *     nothing to consent to.
+ *
+ * Declining is recorded, not just obeyed: a `false` in the config is what makes
+ * the decision stick across runs and machines-per-home-dir. When the config
+ * cannot be written, the answer is still enforced for the current run through
+ * the environment, and the question comes back next time.
+ *
+ * Fail-soft like the rest of the telemetry path — an unwritable home directory
+ * or a closed stdin must never break the command the user actually typed.
+ */
+import * as readline from 'node:readline/promises';
+import { readTelemetryPreference, saveTelemetryPreference } from './config.js';
+/**
+ * How long to wait for an answer before giving up and asking again next run.
+ * Kept short because this blocks the command the user actually typed: a TTY
+ * that nobody is watching (a pty in a script) should not look like a hang.
+ */
+const ANSWER_TIMEOUT_MS = 30_000;
+export const TELEMETRY_PROMPT_TEXT = 'Extenshi can report anonymous usage — which command ran, its flag names,\n' +
+    'versions, and a coarse error kind. Never file paths, artifact contents,\n' +
+    'manifest data, or flag values. It helps us fix what actually breaks.\n' +
+    'You can change this any time with `extenshi telemetry on|off`.\n';
+/**
+ * Which environment variable, if any, has already answered the question.
+ *
+ * Exported because `extenshi telemetry status` has to name the variable that is
+ * overriding the saved answer, and a second copy of this list there would drift
+ * from the one that actually suppresses the prompt. Any non-empty value counts
+ * as an answer — including `DO_NOT_TRACK=0`, which telemetry.ts reads as falsy
+ * and so leaves reporting on. Not asking is still right there: the user has
+ * said something about telemetry with the environment, and re-asking would
+ * override a deliberate setting with a prompt.
+ */
+export function envAnswerSource(env) {
+    if ((env.DO_NOT_TRACK ?? '').trim() !== '')
+        return 'DO_NOT_TRACK';
+    if ((env.EXTENSHI_TELEMETRY ?? '').trim() !== '')
+        return 'EXTENSHI_TELEMETRY';
+    return null;
+}
+/** Should the question be put to the user at all? */
+export function shouldAskForConsent(deps) {
+    if (deps.readPreference() !== undefined)
+        return false;
+    if (envAnswerSource(deps.env) !== null)
+        return false;
+    if ((deps.env.CI ?? '') !== '')
+        return false;
+    // Set-but-empty means the build ships dark; unset means the embedded key.
+    if (deps.env.EXTENSHI_POSTHOG_KEY !== undefined && deps.env.EXTENSHI_POSTHOG_KEY.trim() === '') {
+        return false;
+    }
+    return deps.isInteractive();
+}
+/**
+ * Ask once, persist the answer, and return it. Returns `undefined` when the
+ * question was skipped or went unanswered — the caller carries on either way,
+ * and an unanswered question is simply asked again on the next interactive run.
+ */
+export async function maybeAskForTelemetryConsent(deps) {
+    try {
+        if (!shouldAskForConsent(deps))
+            return undefined;
+        deps.log(`\n${TELEMETRY_PROMPT_TEXT}`);
+        const answer = await deps.ask('Share anonymous usage data? [Y/n] ');
+        // No answer at all (timeout, closed stdin) is not consent, and is not a
+        // refusal either — record nothing and ask again next time.
+        if (answer === null)
+            return undefined;
+        const normalized = answer.trim().toLowerCase();
+        const enabled = !(normalized === 'n' || normalized === 'no');
+        // Apply the answer to THIS process before trying to persist it. A decline
+        // that cannot be written (read-only $HOME) must still hold for the run
+        // that made it — otherwise the user says no, the write fails silently, and
+        // the very next captureEvent reports anyway. telemetry.ts reads this
+        // variable on its first event, which has not happened yet: runCommand()
+        // asks before it captures anything. Accepting needs no variable, since
+        // reporting is what happens without one.
+        if (!enabled)
+            deps.env.EXTENSHI_TELEMETRY = '0';
+        let persisted = true;
+        try {
+            deps.savePreference(enabled);
+        }
+        catch {
+            persisted = false;
+        }
+        deps.log(enabled
+            ? '✓ Thanks — anonymous usage reporting is on. Turn it off any time with `extenshi telemetry off`.\n'
+            : '✓ Anonymous usage reporting is off. Nothing but your explicit commands leaves this machine.\n');
+        if (!persisted) {
+            deps.log('(The choice could not be saved, so this run honours it but the next one will ask again.)\n');
+        }
+        return enabled;
+    }
+    catch {
+        // Unwritable config, closed stdin, anything at all — never break the
+        // command the user actually ran.
+        return undefined;
+    }
+}
+/** The real dependencies: a TTY prompt on stderr so stdout stays pipeable. */
+export function defaultConsentDeps() {
+    return {
+        env: process.env,
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stderr.isTTY),
+        readPreference: readTelemetryPreference,
+        savePreference: (enabled) => {
+            saveTelemetryPreference(enabled);
+        },
+        ask: async (question) => {
+            const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+            try {
+                return await rl.question(question, { signal: AbortSignal.timeout(ANSWER_TIMEOUT_MS) });
+            }
+            catch {
+                return null;
+            }
+            finally {
+                rl.close();
+            }
+        },
+        log: (message) => console.error(message),
+    };
+}
+//# sourceMappingURL=telemetry-consent.js.map

package/dist/telemetry-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-consent.js","sourceRoot":"","sources":["../src/telemetry-consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,MAAM,CAAC,MAAM,qBAAqB,GACjC,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE,CAAA;AAanE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB;IACrD,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,cAAc,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,oBAAoB,CAAA;IAC7E,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACpD,IAAI,IAAI,CAAC,cAAc,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5C,0EAA0E;IAC1E,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChG,OAAO,KAAK,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,EAAE,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAiB;IAClE,IAAI,CAAC;QACJ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAEhD,IAAI,CAAC,GAAG,CAAC,KAAK,qBAAqB,EAAE,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAA;QACnE,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAErC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,CAAC,CAAA;QAE5D,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,yCAAyC;QACzC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAA;QAE/C,IAAI,SAAS,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACJ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACR,SAAS,GAAG,KAAK,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,GAAG,CACP,OAAO;YACN,CAAC,CAAC,mGAAmG;YACrG,CAAC,CAAC,+FAA+F,CAClG,CAAA;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;QACrE,iCAAiC;QACjC,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB;IACjC,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzE,cAAc,EAAE,uBAAuB;QACvC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,uBAAuB,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACrF,IAAI,CAAC;gBACJ,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,EAAE,CAAC,KAAK,EAAE,CAAA;YACX,CAAC;QACF,CAAC;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;KACxC,CAAA;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@extenshi/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Pre-publish security scanner for browser extensions",
   "type": "module",
   "publishConfig": {