@extenshi/cli 0.23.1 → 0.25.0

package/dist/review-checks.js

@@ -14,6 +14,12 @@
  * Chrome for Developers documentation so the user can verify the rule at the
  * source. (We do not cite third-party books in product output.)
  *
+ * The suite predicts ONE store's review per run (`store`, default Chrome Web
+ * Store). Findings that describe a store's review process — the in-depth review
+ * of broad host access, re-review on listing edits, the Privacy practices form —
+ * exist only for the store whose documentation describes them; see
+ * review-stores.ts for the wording that differs.
+ *
  * This module is PURE (no I/O) so the rules are unit-testable against fixtures.
  * Archive extraction lives in review-archive.ts; the network manifest fetch in
  * review-catalog.ts; rendering in review-render.ts. The store-listing rules
@@ -21,7 +27,9 @@
  * caller gets one findings list regardless of which surface produced it.
  */
 import { policyForCheck } from './cws-policies.js';
+import { readLocaleMessages } from './listing.js';
 import { runListingChecks } from './listing-checks.js';
+import { storeRules } from './review-stores.js';
 // ── ch.10 permission → Chrome warning dialog ─────────────────────────────────
 //
 // The auto-disable-on-update behaviour (check 3) hinges on ONE thing: does
@@ -68,6 +76,64 @@ export const PERMISSION_WARNINGS = {
     webAuthenticationProxy: 'Read and change all your data on all websites',
     webNavigation: 'Read your browsing history',
 };
+// ── Firefox: permission → update prompt ──────────────────────────────────────
+//
+// Firefox does not disable anything when an update adds a permission. Extension
+// Workshop, "Request the right permissions"
+// (https://extensionworkshop.com/documentation/develop/request-the-right-permissions/):
+// the user is "prompted to approve the permissions before the updated version is
+// installed", and if they cancel, "the previous version remains installed".
+//
+// Host permissions of a Manifest V3 extension are the exception. MDN,
+// manifest.json/host_permissions
+// (https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions):
+// since Firefox 127 they are in the install prompt, but new ones requested by an
+// update "are not shown to the user" (bug 1893232, still NEW on 2026-10-11).
+// The bug's comment 2 (Mozilla, 2025-05-29) says what happens instead: "the
+// extension is updated without adding the requested host permission", while an
+// MV2 extension is not updated until the user approves.
+//
+// Which API permissions prompt is Firefox's own list, not Chrome's:
+// PERMISSIONS_WITH_MESSAGE in toolkit/components/extensions/ExtensionPermissionMessages.sys.mjs,
+// with the messages from toolkit/locales/en-US/toolkit/global/extensionPermissions.ftl
+// (mozilla-firefox/firefox, main, 2026-10-11). Neither has identity or
+// unlimitedStorage. Left out: userScripts and trialML, which Firefox's
+// manifest schema declares OptionalOnlyPermission (schemas/user_scripts.json,
+// schemas/trial_ml.json) — in `permissions` they are dropped with a warning,
+// so an update never prompts for them. Every key here can be moved to
+// optional_permissions (MDN, manifest.json/optional_permissions). Keep in sync
+// with shared-types/permission-warnings.ts (`firefoxWarningByPermission`) —
+// pinned by permission-warnings-sync.test.ts.
+//
+// `devtools` is also implied: Extension.sys.mjs getRequiredPermissions() adds
+// it whenever the manifest has a devtools_page and does not list devtools in
+// optional_permissions — see firefoxRequiredApiPermissions().
+export const FIREFOX_PERMISSION_MESSAGES = {
+    bookmarks: 'Read and modify bookmarks',
+    browserSettings: 'Read and modify browser settings',
+    browsingData: 'Clear recent browsing history, cookies, and related data',
+    clipboardRead: 'Get data from the clipboard',
+    clipboardWrite: 'Input data to the clipboard',
+    declarativeNetRequest: 'Block content on any page',
+    declarativeNetRequestFeedback: 'Read your browsing history',
+    devtools: 'Extend developer tools to access your data in open tabs',
+    downloads: 'Download files and read and modify the browser’s download history',
+    'downloads.open': 'Open files downloaded to your computer',
+    find: 'Read the text of all open tabs',
+    geolocation: 'Access your location',
+    history: 'Access browsing history',
+    management: 'Monitor extension usage and manage themes',
+    nativeMessaging: 'Exchange messages with programs other than Firefox',
+    notifications: 'Display notifications to you',
+    pkcs11: 'Provide cryptographic authentication services',
+    privacy: 'Read and modify privacy settings',
+    proxy: 'Control browser proxy settings',
+    sessions: 'Access recently closed tabs',
+    tabs: 'Access browser tabs',
+    tabHide: 'Hide and show browser tabs',
+    topSites: 'Access browsing history',
+    webNavigation: 'Access browser activity during navigation',
+};
 // Official Chrome documentation backing each check (shown as the finding source).
 const DOC_REMOTE_CODE = 'https://developer.chrome.com/docs/webstore/program-policies/code-readability';
 const DOC_REVIEW = 'https://developer.chrome.com/docs/webstore/review-process';
@@ -75,6 +141,9 @@ const DOC_PERMISSION_WARNINGS = 'https://developer.chrome.com/docs/extensions/de
 const DOC_CSP = 'https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy';
 const DOC_SERVICE_WORKER = 'https://developer.chrome.com/docs/extensions/develop/concepts/service-workers/lifecycle';
 const DOC_PERMISSIONS = 'https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions';
+const DOC_EDGE_UPDATE = 'https://learn.microsoft.com/en-us/microsoft-edge/extensions/update/update-extension';
+const DOC_FIREFOX_PERMISSIONS = 'https://extensionworkshop.com/documentation/develop/request-the-right-permissions/';
+const DOC_FIREFOX_HOST_PERMISSIONS = 'https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions';
 // ── Host-permission helpers ──────────────────────────────────────────────────
 /**
  * The four spellings of "every host" from ch.10 "Global Host Permission" — all
@@ -140,20 +209,58 @@ export function htmlEntrypoints(m) {
     return [...new Set(out)];
 }
 // ── Check 1: slow-review-queue predictor (ch.10) ─────────────────────────────
-export function checkSlowReviewQueue(m) {
-    const global = requiredHostPermissions(m).filter(isGlobalHost);
-    if (global.length === 0)
+/**
+ * Content scripts that inject into every site, as `content_scripts[i].matches: <pattern>`.
+ *
+ * Chrome grants a content script's match patterns the same host access as
+ * `host_permissions` and shows the same warning for them, so an extension that
+ * reaches every site only through `content_scripts` has broad host access all
+ * the same — and is the common shape for page-styling extensions.
+ */
+function globalContentScriptMatches(m) {
+    const out = [];
+    for (const [i, cs] of (m.content_scripts ?? []).entries()) {
+        for (const pattern of asStringArray(cs?.matches).filter(isGlobalHost)) {
+            out.push(`content_scripts[${i}].matches: ${pattern}`);
+        }
+    }
+    return out;
+}
+/**
+ * Chrome Web Store only. Its review-process page says reviews "may take longer
+ * for extensions that request broad host permissions". Edge certifies every
+ * submission the same way (up to 7 business days) and AMO publishes after
+ * automated checks; neither documents a longer path for broad host access, so
+ * this finding would be invented there.
+ */
+export function checkSlowReviewQueue(m, store = 'CHROME') {
+    if (store !== 'CHROME')
         return [];
+    const global = [...new Set(requiredHostPermissions(m).filter(isGlobalHost))];
+    const viaContentScripts = globalContentScriptMatches(m);
+    if (global.length === 0 && viaContentScripts.length === 0)
+        return [];
+    const onlyContentScripts = global.length === 0;
     return [
         {
             verdict: 'SLOW',
             check: 'global-host-permissions',
-            title: 'Global host permissions put the extension in the slow manual review queue',
+            title: onlyContentScripts
+                ? 'Content scripts on every site put the extension in the slow manual review queue'
+                : 'Global host permissions put the extension in the slow manual review queue',
             detail: 'Requesting access to every host (any of <all_urls>, *://*/*, http://*/*, https://*/*) ' +
-                'forces a manual review, which typically raises review time from under 24 hours to several days.',
-            evidence: [...new Set(global)].join(', '),
-            recommendation: 'Narrow to the specific hosts you actually call (e.g. https://api.example.com/*), or drop host ' +
-                'permissions entirely in favour of activeTab — see the activeTab recommendation below.',
+                'forces a manual review, which typically raises review time from under 24 hours to several days.' +
+                (viaContentScripts.length > 0
+                    ? ' Content scripts count: their match patterns grant the same access as host permissions, and ' +
+                        'Chrome shows the same "Read and change all your data on all websites" warning for them.'
+                    : ''),
+            evidence: [...global, ...viaContentScripts].join(', '),
+            recommendation: onlyContentScripts
+                ? 'Narrow content_scripts.matches to the sites the extension is for, or inject on demand with ' +
+                    'activeTab + scripting.executeScript() after a click. If it genuinely works on every page, keep ' +
+                    'it and plan for the longer review.'
+                : 'Narrow to the specific hosts you actually call (e.g. https://api.example.com/*), or drop host ' +
+                    'permissions entirely in favour of activeTab — see the activeTab recommendation below.',
             citation: `Chrome Web Store: review process — ${DOC_REVIEW}`,
         },
     ];
@@ -162,8 +269,29 @@ export function checkSlowReviewQueue(m) {
 /**
  * Static advisory — there is nothing in the package to inspect; it's a
  * publishing-process fact developers routinely get burned by. Emitted once.
+ *
+ * Per store, because the process differs: Edge restarts certification for a
+ * metadata-only update too, and AMO documents nothing about listing-only edits
+ * (so nothing is said there).
  */
-export function checkListingChangeReReview() {
+export function checkListingChangeReReview(store = 'CHROME') {
+    if (store === 'FIREFOX')
+        return [];
+    if (store === 'EDGE') {
+        return [
+            {
+                verdict: 'SLOW',
+                check: 'listing-change-rereview',
+                title: 'Editing the Edge Add-ons listing sends the extension through certification again',
+                detail: 'In Partner Center an update to the store listing alone (description, screenshots, search terms) ' +
+                    'starts the same certification as a new package, which can take up to 7 business days — and ' +
+                    'editing a submission that is already in review stops that review and starts a new one.',
+                recommendation: 'Batch listing edits with a code release, and finish editing before you click Publish rather than ' +
+                    'while the submission is in review.',
+                citation: `Microsoft Edge Add-ons: update an extension — ${DOC_EDGE_UPDATE}`,
+            },
+        ];
+    }
     return [
         {
             verdict: 'SLOW',
@@ -177,63 +305,144 @@ export function checkListingChangeReReview() {
         },
     ];
 }
-// ── Check 3: auto-disable-on-update guard (ch.10 / ch.13) — manifest diff ─────
+/**
+ * Chromium (Chrome, Edge): a new required permission that warns disables the
+ * extension until the user accepts it. Microsoft publishes no page of its own on
+ * this, so Edge findings cite Chrome's and name Microsoft Edge in the text.
+ */
+function chromiumNewPermission(perm, warning, store) {
+    const edge = store === 'EDGE';
+    return {
+        title: `Adding required "${perm}" silently disables the extension${edge ? ' in Microsoft Edge' : ''} for existing users`,
+        detail: `"${perm}" shows the warning "${warning}". When an update adds a required permission that warns, ` +
+            `${edge ? 'Microsoft Edge' : 'the browser'} silently disables the extension for everyone who already has it ` +
+            'installed and shows only a small toolbar icon — most users never re-enable, so you lose them.',
+        recommendation: `Move "${perm}" into optional_permissions and request it at runtime with chrome.permissions.request(), ` +
+            'so existing users keep the extension enabled.',
+        citation: chromiumUpdateCitation(edge),
+    };
+}
+function chromiumUpdateCitation(edge) {
+    return edge
+        ? `Chrome for Developers (Microsoft Edge runs the same Chromium behaviour): permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`
+        : `Chrome: permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`;
+}
+function chromiumNewHost(host, store) {
+    const edge = store === 'EDGE';
+    const global = isGlobalHost(host);
+    return {
+        title: `Adding host access "${host}" silently disables the extension${edge ? ' in Microsoft Edge' : ''} for existing users`,
+        detail: `Host permissions show a "Read and change ${global ? 'all your data on all websites' : `your data on ${host}`}" ` +
+            `warning. Adding one in an update silently disables the extension${edge ? ' in Microsoft Edge' : ''} for ` +
+            'the installed base until each user re-accepts — only a small toolbar icon signals it.',
+        recommendation: 'Move it to optional_host_permissions and request it on a user gesture, or use activeTab if you only ' +
+            'need the active tab.',
+        citation: chromiumUpdateCitation(edge),
+    };
+}
+/** Firefox: the update waits for the user's approval; nothing is disabled. */
+function firefoxNewPermission(perm, message) {
+    return {
+        title: `Adding required "${perm}" holds the update for existing Firefox users until they approve it`,
+        detail: `Firefox shows "${perm}" as "${message}". When an update adds a permission with a message, Firefox asks ` +
+            'each existing user to approve it before it installs the update. Until they do — and for good, if they ' +
+            'decline — they stay on your previous version.',
+        recommendation: `Move "${perm}" into optional_permissions and request it with browser.permissions.request() from a user ` +
+            'action (a toolbar button or menu item click), so the update installs without a prompt.',
+        citation: `Firefox Extension Workshop: Request the right permissions — ${DOC_FIREFOX_PERMISSIONS}`,
+    };
+}
+/**
+ * Firefox host access. MV2 hosts sit in `permissions` and hold the update like
+ * any other permission; MV3 `host_permissions` added by an update are neither
+ * shown nor granted, so the update installs and the new access is just missing.
+ */
+function firefoxNewHost(host, mv3) {
+    const target = isGlobalHost(host) ? 'every website' : host;
+    if (!mv3) {
+        return {
+            title: `Adding host access "${host}" holds the update for existing Firefox users until they approve it`,
+            detail: `Firefox asks each existing user to approve access to ${target} before it installs the update. ` +
+                'Until they do — and for good, if they decline — they stay on your previous version.',
+            recommendation: 'Move it to optional_permissions (where Manifest V2 lists optional hosts) and request it with ' +
+                'browser.permissions.request() from a user action, or use activeTab if you only need the active tab.',
+            citation: `Firefox Extension Workshop: Request the right permissions — ${DOC_FIREFOX_PERMISSIONS}`,
+        };
+    }
+    return {
+        title: `Adding host access "${host}" leaves existing Firefox users without it after the update`,
+        detail: 'Firefox installs the update but neither shows nor grants host permissions an update adds to a Manifest V3 ' +
+            `extension (Firefox bug 1893232). Whatever needs access to ${target} stops working for existing users ` +
+            'until each of them grants it in the Firefox Add-ons Manager; only new installs are asked for it.',
+        recommendation: 'Move it to optional_host_permissions, check it with browser.permissions.contains(), and request it with ' +
+            'browser.permissions.request() from a user action so existing users are asked — or use activeTab if you ' +
+            'only need the active tab.',
+        citation: `MDN: host_permissions — host permissions added by an update are not shown to the user — ${DOC_FIREFOX_HOST_PERMISSIONS}`,
+    };
+}
+/** Firefox's required API permissions: the declared ones plus `devtools`, implied by a devtools_page. */
+function firefoxRequiredApiPermissions(m) {
+    const out = requiredApiPermissions(m);
+    if (m.devtools_page &&
+        !out.includes('devtools') &&
+        !asStringArray(m.optional_permissions).includes('devtools')) {
+        out.push('devtools');
+    }
+    return out;
+}
 /**
  * Diff the local manifest against the last-published one. A newly-added
- * *required* permission that shows a warning silently disables the extension for
- * the whole installed base on update (only a small toolbar icon appears) →
- * silent attrition. Newly-added permissions of any kind also re-trip the slow
- * review queue (ch.10).
+ * *required* permission that prompts costs the installed base on update →
+ * attrition. How depends on the browser: Chromium (Chrome, Edge) silently
+ * disables the extension until the user re-accepts (only a small toolbar icon
+ * appears); Firefox keeps users on the previous version until they approve, and
+ * installs an MV3 update without the host access it adds (see
+ * FIREFOX_PERMISSION_MESSAGES). On the Chrome Web Store, newly-added permissions
+ * of any kind also re-trip the slow review queue (ch.10).
  *
  * `prior` is the manifest fetched from the catalog's last snapshot; pass null
  * when it could not be fetched (the caller surfaces why and this returns []).
  */
-export function checkAutoDisableOnUpdate(local, prior) {
+export function checkAutoDisableOnUpdate(local, prior, store = 'CHROME') {
     if (!prior)
         return [];
     const findings = [];
-    const priorApi = new Set(requiredApiPermissions(prior));
+    const firefox = store === 'FIREFOX';
+    const apiPermissions = firefox ? firefoxRequiredApiPermissions : requiredApiPermissions;
+    const priorApi = new Set(apiPermissions(prior));
     const priorHosts = new Set(requiredHostPermissions(prior));
-    const newApi = requiredApiPermissions(local).filter((p) => !priorApi.has(p));
+    const newApi = apiPermissions(local).filter((p) => !priorApi.has(p));
     const newHosts = requiredHostPermissions(local).filter((h) => !priorHosts.has(h));
-    // Newly-added required API permissions that show a warning → auto-disable.
+    const declaredApi = new Set(requiredApiPermissions(local));
+    // Newly-added required API permissions that prompt → attrition. Each browser
+    // has its own list of which ones prompt.
     for (const perm of newApi) {
-        const warning = PERMISSION_WARNINGS[perm];
+        const warning = firefox ? FIREFOX_PERMISSION_MESSAGES[perm] : PERMISSION_WARNINGS[perm];
         if (!warning)
             continue; // silently-granted permission — safe to add in an update
         findings.push({
             verdict: 'ATTRITION',
             check: 'auto-disable-new-permission',
-            title: `Adding required "${perm}" silently disables the extension for existing users`,
-            detail: `"${perm}" shows the warning "${warning}". When an update adds a required permission that warns, ` +
-                'the browser silently disables the extension for everyone who already has it installed and shows only ' +
-                'a small toolbar icon — most users never re-enable, so you lose them.',
-            evidence: `new required permission "${perm}" (absent from the last published manifest)`,
-            recommendation: `Move "${perm}" into optional_permissions and request it at runtime with chrome.permissions.request(), ` +
-                'so existing users keep the extension enabled.',
-            citation: `Chrome: permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`,
+            ...(firefox ? firefoxNewPermission(perm, warning) : chromiumNewPermission(perm, warning, store)),
+            evidence: declaredApi.has(perm)
+                ? `new required permission "${perm}" (absent from the last published manifest)`
+                : `new devtools_page — Firefox grants "${perm}" with it (absent from the last published manifest)`,
         });
     }
     // Newly-added host permissions always warn ("Read and change your data on …")
-    // → same auto-disable behaviour.
+    // → same attrition, except that Firefox grants none of them to an MV3 update.
     for (const host of newHosts) {
-        const global = isGlobalHost(host);
         findings.push({
             verdict: 'ATTRITION',
             check: 'auto-disable-new-host',
-            title: `Adding host access "${host}" silently disables the extension for existing users`,
-            detail: `Host permissions show a "Read and change ${global ? 'all your data on all websites' : `your data on ${host}`}" ` +
-                'warning. Adding one in an update silently disables the extension for the installed base until each user ' +
-                're-accepts — only a small toolbar icon signals it.',
+            ...(firefox ? firefoxNewHost(host, local.manifest_version === 3) : chromiumNewHost(host, store)),
             evidence: `new host permission "${host}" (absent from the last published manifest)`,
-            recommendation: 'Move it to optional_host_permissions and request it on a user gesture, or use activeTab if you only ' +
-                'need the active tab.',
-            citation: `Chrome: permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`,
         });
     }
     // Any new permission also re-trips the slow review queue (ch.10), independent
-    // of whether it warns. One consolidated note.
-    if (newApi.length + newHosts.length > 0) {
+    // of whether it warns. One consolidated note. A Chrome Web Store process
+    // fact: Edge certifies every update the same way, AMO documents no such queue.
+    if (store === 'CHROME' && newApi.length + newHosts.length > 0) {
         findings.push({
             verdict: 'SLOW',
             check: 'update-adds-permissions',
@@ -533,13 +742,16 @@ export function checkServiceWorker(m, files) {
 // ── Check 5: activeTab advisor (ch.10) ───────────────────────────────────────
 /** True when a content script auto-injects into all pages (then activeTab can't replace its host perms). */
 function hasBroadContentScript(m) {
-    for (const cs of m.content_scripts ?? []) {
-        if (asStringArray(cs.matches).some(isGlobalHost))
-            return true;
-    }
-    return false;
+    return globalContentScriptMatches(m).length > 0;
 }
-export function checkActiveTabAdvisor(m) {
+/**
+ * Chrome Web Store only: the advice holds everywhere, but the verdict it is
+ * filed under — skipping the slow review queue — is a Chrome Web Store process
+ * fact (see `checkSlowReviewQueue`).
+ */
+export function checkActiveTabAdvisor(m, store = 'CHROME') {
+    if (store !== 'CHROME')
+        return [];
     const global = requiredHostPermissions(m).filter(isGlobalHost);
     if (global.length === 0)
         return [];
@@ -785,7 +997,10 @@ const PERMISSION_DISCLOSURES = [
  * Optional permissions count: the declaration covers what the extension can
  * request, and an optional permission ships in the package and is grantable.
  */
-export function checkPrivacyDisclosure(manifest) {
+export function checkPrivacyDisclosure(manifest, store = 'CHROME') {
+    // The questions it predicts are the Chrome Web Store dashboard's form.
+    if (store !== 'CHROME')
+        return [];
     const held = new Set();
     for (const key of ['permissions', 'optional_permissions']) {
         const raw = manifest[key];
@@ -855,6 +1070,92 @@ export function privacyPracticesForManifest(manifest) {
     }
     return out;
 }
+// ── Check: manifest field lengths, per locale ────────────────────────────────
+//
+// The store shows `name`, `short_name` and `description` as each locale
+// resolves them, and documents a maximum for each — so the limit binds every
+// `_locales/<lang>/messages.json`, not only the default one. Translations run
+// longer than English (German, Russian), which is exactly where a field that
+// fits in `en` stops fitting.
+//
+// Advisory (SLOW) like the listing rules: the stores document the numbers but
+// not what they do with a longer value, and a false REJECTED fails a release.
+const LENGTH_FIELDS = ['name', 'short_name', 'description'];
+const MSG_KEY_RE = /^__MSG_([A-Za-z0-9_@]+)__$/;
+/**
+ * The text a store shows for one message: `$name$` placeholders replaced by
+ * their `content`, `$$` by `$`. Message names are case-insensitive in the
+ * WebExtensions i18n format, both the key and the placeholder name.
+ */
+export function resolveMessage(messages, key) {
+    const found = Object.entries(messages).find(([k]) => k.toLowerCase() === key.toLowerCase())?.[1];
+    if (!found || typeof found !== 'object')
+        return undefined;
+    const { message, placeholders } = found;
+    if (typeof message !== 'string' || !message.trim())
+        return undefined;
+    const named = placeholders && typeof placeholders === 'object' ? placeholders : {};
+    return message.replace(/\$\$|\$([A-Za-z0-9_@]+)\$/g, (token, name) => {
+        if (token === '$$')
+            return '$';
+        const entry = Object.entries(named).find(([k]) => k.toLowerCase() === name?.toLowerCase())?.[1];
+        const content = entry && typeof entry === 'object' ? entry.content : undefined;
+        return typeof content === 'string' ? content : token;
+    });
+}
+export function checkManifestFieldLengths(manifest, files, store = 'CHROME') {
+    const rules = storeRules(store);
+    const messagesByLocale = readLocaleMessages(files);
+    const out = [];
+    for (const field of LENGTH_FIELDS) {
+        const limit = rules.fieldLimits[field];
+        const raw = manifest[field];
+        if (!limit || typeof raw !== 'string' || !raw.trim())
+            continue;
+        const key = MSG_KEY_RE.exec(raw.trim())?.[1];
+        const values = [];
+        if (!key)
+            values.push({ text: raw });
+        // Code-point order, as Python's sorted() in the replay mirror: the per-check
+        // cap keeps the first ten, so both sides must agree which ten.
+        else
+            for (const [locale, messages] of [...messagesByLocale].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+                const text = resolveMessage(messages, key);
+                if (text)
+                    values.push({ locale, text });
+            }
+        for (const { locale, text } of values) {
+            // Code points, as the store counters show them — `.length` would count
+            // an emoji or a CJK extension character twice.
+            const length = [...text].length;
+            if (length <= limit.max)
+                continue;
+            const place = locale ? `_locales/${locale}/messages.json` : 'manifest.json';
+            const recommended = field === 'short_name';
+            out.push({
+                verdict: 'SLOW',
+                check: 'manifest-field-length',
+                title: `${field} is ${length} characters${locale ? ` in [${locale}]` : ''} — ${rules.label} ${recommended ? 'recommends at most' : 'allows'} ${limit.max}`,
+                detail: recommended
+                    ? `${rules.label} recommends at most ${limit.max} characters for short_name and truncates a longer one ` +
+                        'where space is limited. The limit applies to every locale as that locale resolves it.'
+                    : `${rules.label} allows at most ${limit.max} characters in the manifest ${field}` +
+                        (store === 'FIREFOX' && field === 'description'
+                            ? ', which AMO shows as the add-on summary'
+                            : '') +
+                        ', and the limit applies to every locale as that locale resolves it. What happens to a longer ' +
+                        'value is not documented — it may be refused at upload or cut off where it is shown — so shorten ' +
+                        'it before submitting.',
+                evidence: `[${locale ?? 'manifest'}] ${field}: ${length} characters — "${[...text].slice(0, 60).join('')}${length > 60 ? '…' : ''}"`,
+                recommendation: key
+                    ? `Shorten "${key}" in ${place} to ${limit.max} characters or fewer.`
+                    : `Shorten ${field} in manifest.json to ${limit.max} characters or fewer.`,
+                citation: `${rules.label}: ${field} length limit — ${limit.source}`,
+            });
+        }
+    }
+    return out;
+}
 /**
  * Drop exact duplicates (same check + same evidence — a single bundled pattern
  * copied across N entry chunks would otherwise become N "REJECTED" rows) and cap
@@ -893,18 +1194,20 @@ function dedupeAndCap(findings) {
     return out;
 }
 export function runChecks(input) {
+    const store = input.store ?? 'CHROME';
     return withPolicies(dedupeAndCap([
         ...checkRemoteCode(input.files),
         ...checkHtmlCsp(input.manifest, input.files),
         ...checkServiceWorker(input.manifest, input.files),
-        ...checkAutoDisableOnUpdate(input.manifest, input.priorManifest),
-        ...checkSlowReviewQueue(input.manifest),
-        ...checkActiveTabAdvisor(input.manifest),
+        ...checkAutoDisableOnUpdate(input.manifest, input.priorManifest, store),
+        ...checkSlowReviewQueue(input.manifest, store),
+        ...checkActiveTabAdvisor(input.manifest, store),
         ...checkUnusedPermissions(input.manifest, input.files),
-        ...checkPrivacyDisclosure(input.manifest),
-        ...runListingChecks(input.listing ?? null),
-        ...checkListingChangeReReview(),
-    ]));
+        ...checkPrivacyDisclosure(input.manifest, store),
+        ...checkManifestFieldLengths(input.manifest, input.files, store),
+        ...runListingChecks(input.listing ?? null, storeRules(store)),
+        ...checkListingChangeReReview(store),
+    ]), store);
 }
 /**
  * The store-listing rules alone — deduped, capped and policy-stamped exactly as
@@ -928,8 +1231,8 @@ export function runChecks(input) {
  * ever reuses an id across the two sets breaks that, and would make `scan` and
  * `review-risk` disagree on counts.
  */
-export function runListingOnlyChecks(listing) {
-    return withPolicies(dedupeAndCap(runListingChecks(listing)));
+export function runListingOnlyChecks(listing, store = 'CHROME') {
+    return withPolicies(dedupeAndCap(runListingChecks(listing, storeRules(store))), store);
 }
 /**
  * Stamp each finding with the store policy its check is registered against.
@@ -939,8 +1242,13 @@ export function runListingOnlyChecks(listing) {
  * pass because it only sees the registry. An unregistered check id is left
  * without a policy rather than guessed at — the test catches it, and until then
  * the report says nothing instead of saying something wrong.
+ *
+ * The registry is the Chrome Web Store's, so findings for another store carry
+ * no `policy`: their `citation` names that store's own rule.
  */
-function withPolicies(findings) {
+function withPolicies(findings, store = 'CHROME') {
+    if (store !== 'CHROME')
+        return findings;
     return findings.map((f) => {
         const policy = policyForCheck(f.check);
         return policy === undefined ? f : { ...f, policy };
@@ -951,8 +1259,11 @@ const VERDICT_ORDER = { REJECTED: 0, ATTRITION: 1, SLOW: 2 };
  * Ruleset version stamped on a persisted `review_risk` prediction.
  * Bump when a check is added, removed, or its verdict changes — otherwise
  * iteration 4 averages incompatible rules into one precision number.
+ *
+ * '2' (2026-10-10): `global-host-permissions` also reads content_scripts
+ * matches, and `manifest-field-length` is new.
  */
-export const REVIEW_RISK_RULES_VERSION = '1';
+export const REVIEW_RISK_RULES_VERSION = '2';
 export function summarize(findings) {
     const sorted = [...findings].sort((a, b) => VERDICT_ORDER[a.verdict] - VERDICT_ORDER[b.verdict]);
     const counts = { REJECTED: 0, ATTRITION: 0, SLOW: 0 };