eslint-plugin-chrome-extensions 2.2.0 → 2.4.0

package/docs/LICENSE.md

@@ -1,4 +1,4 @@
-# 🏛️ MIT License
+# MIT License
 
 **Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui)**
 

package/package.json

@@ -1,22 +1,24 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "ESLint rules for Chrome extensions",
-  "type": "module",
-  "engines": {
-    "node": ">=18.18.0"
-  },
-  "author": {
-    "name": "Adam Lui",
-    "email": "adam@kudoai.org",
-    "url": "https://codeberg.org/adamlui"
-  },
+  "keywords": [
+    "eslint",
+    "eslint-plugin",
+    "eslintplugin",
+    "chrome-extensions",
+    "chromium",
+    "security"
+  ],
   "homepage": "https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/#readme",
   "bugs": {
     "url": "https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/issues",
     "email": "support@adamlui.com"
   },
-  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
+  },
   "funding": [
     {
       "type": "ko-fi",
@@ -27,44 +29,46 @@
       "url": "https://paypal.me/adamlui"
     }
   ],
-  "main": "src/index.js",
+  "license": "MIT",
+  "author": {
+    "name": "Adam Lui",
+    "email": "adam@kudoai.org",
+    "url": "https://codeberg.org/adamlui"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
   "files": [
     "docs/",
     "src/"
   ],
-  "types": "src/index.d.ts",
   "scripts": {
+    "bump:feat": "npm run bump:minor",
+    "bump:major": "bash utils/bump.sh major",
+    "bump:minor": "bash utils/bump.sh minor",
+    "bump:patch": "bash utils/bump.sh patch",
+    "demo": "node demo/run.js",
     "lint": "eslint . --cache && yamllint .",
     "lint:all": "eslint . && yamllint .",
     "lint:fix": "eslint . --fix --cache && yamllint .",
     "lint:fix-all": "eslint . --fix && yamllint .",
-    "test": "node tests/run.js",
-    "demo": "node demo/run.js",
-    "bump:patch": "bash utils/bump.sh patch",
-    "bump:minor": "bash utils/bump.sh minor",
-    "bump:feat": "npm run bump:minor",
-    "bump:major": "bash utils/bump.sh major"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
+    "test": "node tests/run.js"
   },
-  "keywords": [
-    "eslint",
-    "eslint-plugin",
-    "eslintplugin",
-    "chrome-extensions",
-    "chromium"
-  ],
-  "peerDependencies": {
-    "eslint": ">=9.6.0",
-    "@eslint/json": ">=0.1.0"
+  "dependencies": {
+    "globals": "^17.13.0",
+    "spdx-license-ids": "^3.0.24"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
     "@eslint/js": "^10.0.1",
     "@eslint/json": "^2.1.1",
-    "@eslint/markdown": "^8.0.3",
+    "@eslint/markdown": "^7.5.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
     "eslint-plugin-constructors": "^1.4.2",
@@ -73,12 +77,19 @@
     "eslint-plugin-n": "^18.4.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
+    "eslint-plugin-package-json": "^1.10.1",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
     "eslint-plugin-security": "^4.2.0",
     "yamllint-js": "^0.2.4"
   },
-  "dependencies": {
-    "globals": "^17.13.0"
+  "peerDependencies": {
+    "@eslint/css": ">=0.5.0",
+    "@eslint/json": ">=0.1.0",
+    "@html-eslint/eslint-plugin": ">=0.42.0",
+    "eslint": ">=9.6.0"
+  },
+  "engines": {
+    "node": ">=18.18.0"
   }
 }

package/src/data/apis.js

@@ -1,26 +1,3 @@
-export const deprecatedAPIs = new Map([
-    ['chrome.pageAction.show',             'chrome.action.enable'],
-    ['chrome.pageAction.hide',             'chrome.action.disable'],
-    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
-    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
-    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
-    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
-    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-    ['chrome.browserAction',               'chrome.action'],
-    ['chrome.pageAction',                  'chrome.action'],
-    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
-    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
-    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
-    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
-    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
-    ['chrome.extension.connect',           'chrome.runtime.connect'],
-    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
-    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
-    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
-    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
-    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
-])
-
 export const apiPermissionMap = new Map([
     ['chrome.alarms',                'alarms'],
     ['chrome.bookmarks',             'bookmarks'],
@@ -47,7 +24,32 @@ export const apiPermissionMap = new Map([
     ['chrome.webRequest',            'webRequest']
 ])
 
-export const permissionlessAPIs = new Set([
+export const deprecatedAPIs = new Map([
+    ['chrome.pageAction.show',             'chrome.action.enable'],
+    ['chrome.pageAction.hide',             'chrome.action.disable'],
+    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
+    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
+    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
+    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
+    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
+    ['chrome.browserAction',               'chrome.action'],
+    ['chrome.pageAction',                  'chrome.action'],
+    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
+    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
+    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
+    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
+    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
+    ['chrome.extension.connect',           'chrome.runtime.connect'],
+    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
+    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
+    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
+    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
+    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
+])
+
+export const externalMsgListeners = new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
+
+export const permlessAPIs = new Set([
     // https://developer.chrome.com/docs/extensions/reference/api/management
     'chrome.management.getPermissionWarningsByManifest',
     'chrome.management.getSelf',
@@ -96,9 +98,6 @@ export const permissionlessAPIs = new Set([
     'chrome.tabs.update'
 ])
 
-export const externalMessagingListeners =
-    new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
-
 export function findDeprecated(api) {
     for (const [deprecated, replacement] of deprecatedAPIs)
         if (api == deprecated || api.startsWith(`${deprecated}.`))
@@ -107,11 +106,11 @@ export function findDeprecated(api) {
 }
 
 export function findPermission(api) {
-    if (permissionlessAPIs.has(api)) return null
+    if (permlessAPIs.has(api)) return null
     for (const [prefix, permission] of apiPermissionMap)
         if (api == prefix || api.startsWith(`${prefix}.`))
             return permission
     return null
 }
 
-export function isExternalMessagingListener(api) { return externalMessagingListeners.has(api) }
+export function isExternalMessagingListener(api) { return externalMsgListeners.has(api) }

package/src/data/i18n.js

@@ -0,0 +1,71 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const re = {
+    getMsgLiteral: /\b(?:chrome|browser)\.i18n\.getMessage\(\s*['"]([^'"]+)['"]/g,
+    getMsgTemplate: /\b(?:chrome|browser)\.i18n\.getMessage\(\s*`([^`]*)`/g,
+    msgPlaceholder: /__MSG_([\w@]+)__/g,
+    specialChars: /[.*+?^${}()|[\]\\]/g,
+    templateExpr: /\$\{[^}]*\}/g
+}
+
+export function collectUsedKeys(root, scanExtensions) {
+    const used = new Set(),
+          patterns = [],
+          exts = new Set(scanExtensions),
+          stack = [root]
+    while (stack.length) {
+        const dir = stack.pop()
+        let entries
+        try { entries = fs.readdirSync(dir, { withFileTypes: true }) } catch { continue }
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || entry.name == 'node_modules') continue
+            const full = path.join(dir, entry.name)
+            if (entry.isDirectory()) { stack.push(full) ; continue }
+            const ext = path.extname(entry.name).slice(1).toLowerCase()
+            if (!exts.has(ext)) continue
+            let text
+            try { text = fs.readFileSync(full, 'utf8') } catch { continue }
+            for (const match of text.matchAll(re.msgPlaceholder))
+                if (!isPredefined(match[1])) used.add(match[1])
+            for (const match of text.matchAll(re.getMsgLiteral))
+                used.add(match[1])
+            for (const match of text.matchAll(re.getMsgTemplate)) {
+                const body = match[1]
+                if (body.includes('${')) patterns.push(templateToPattern(body))
+                else used.add(body)
+            }
+        }
+    }
+    return { used, patterns }
+}
+
+export const defaultScanExtensions = [
+    'cjs', 'css', 'htm', 'html', 'js', 'json', 'jsx', 'md', 'mjs', 'svg', 'ts', 'tsx', 'txt']
+
+export function findExtensionRoot(startPath) {
+    let dir = path.dirname(startPath)
+    while (dir != path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
+        dir = path.dirname(dir)
+    }
+}
+
+export function isPredefined(key) { return key.startsWith('@@') }
+
+export function readDefaultLocaleMessages(manifest, root) {
+    const locale = manifest?.default_locale
+    if (typeof locale != 'string') return null
+    const filePath = path.join(root, '_locales', locale, 'messages.json')
+    let messages
+    try { messages = JSON.parse(fs.readFileSync(filePath, 'utf8')) } catch { return null }
+    if (!messages || typeof messages != 'object' || Array.isArray(messages)) return null
+    return { locale, messages }
+}
+
+export function templateToPattern(body) {
+    const parts = body.split(re.templateExpr).map(part => part.replace(re.specialChars, '\\$&'))
+    return new RegExp(`^${parts.join('.*')}$`) // eslint-disable-line security/detect-non-literal-regexp
+}

package/src/data/license.js

@@ -0,0 +1,27 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const re = {
+    licenseFilename: // e.g. LICENSE.md, LICENSE-MIT, MIT-LICENSE.md, COPYING.LESSER, LICENSE-2.0.txt
+        /^(?:[\w.-]*-)?(?:LICEN[SC]E|COPYING)(?:[-.][\w.-]+)?$/i, // eslint-disable-line security/detect-unsafe-regex
+    spdxTag: /SPDX-License-Identifier:\s*([\w.+-]+)/i
+}
+
+export const skipDirs = new Set(['node_modules'])
+
+export function findLicenseFile(root) {
+    const queue = [root]
+    while (queue.length) {
+        const dir = queue.shift(), entries = tryReaddir(dir)
+        if (!entries) continue
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || skipDirs.has(entry.name)) continue
+            if (entry.isFile() && re.licenseFilename.test(entry.name)) return path.join(dir, entry.name)
+            if (entry.isDirectory()) queue.push(path.join(dir, entry.name))
+        }
+    }
+    return null
+}
+
+function tryReaddir(dir) { // eslint-disable-next-line security/detect-non-literal-fs-filename
+    try { return fs.readdirSync(dir, { withFileTypes: true }) } catch { return null }}

package/src/data/manifest.js

@@ -3,6 +3,20 @@ import globals from 'globals'
 const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
 export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
 
+export const ffDataCollectionRequired = new Set([
+    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
+    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffDataCollectionOptional = new Set([
+    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
+    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffMV3bgKeys = new Set(['scripts', 'page'])
+
 export const forbiddenCSPdirectives = [
     `'unsafe-eval'`, `'unsafe-inline'`, `'unsafe-hashes'`, `'wasm-unsafe-eval'`, 'http://', 'https://']
 
@@ -22,19 +36,6 @@ export const manifestKeyOrder = [
     'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
 
-export const ffDataCollectionRequired = new Set([
-    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
-    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
-    'websiteContent'
-])
-
-export const ffDataCollectionOptional = new Set([
-    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
-    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
-    'websiteContent'
-])
-
-export const ffMV3bgKeys = new Set(['scripts', 'page'])
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [

package/src/data/text-parser.js

@@ -0,0 +1,11 @@
+export const textParser = {
+    parse: text => ({
+        type: 'Program',
+        body: [],
+        sourceType: 'module',
+        range: [0, text.length],
+        loc: { start: { line: 1, column: 0 }, end: { line: 1, column: 0 }},
+        tokens: [],
+        comments: []
+    })
+}

package/src/index.js

@@ -1,5 +1,9 @@
 import { bundles as oldBundles } from './data/deprecations.js'
 
+import css from '@eslint/css'
+import html from '@html-eslint/eslint-plugin'
+import json from '@eslint/json'
+
 import manifestKeyOrder from './rules/manifest-key-order.js'
 import manifestSpacing from './rules/manifest-spacing.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
@@ -8,18 +12,27 @@ import noDuplicateManifestKeys from './rules/no-duplicate-manifest-keys.js'
 import noInsecureFetch from './rules/no-insecure-fetch.js'
 import noInsecureMessaging from './rules/no-insecure-messaging.js'
 import noInvalidPermissions from './rules/no-invalid-permissions.js'
+import noMissingDefaultLocale from './rules/no-missing-default-locale.js'
+import noMissingI18nKeys from './rules/no-missing-i18n-keys.js'
 import noMissingPermissions from './rules/no-missing-permissions.js'
 import noMissingWebAccessibleResources from './rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from './rules/no-remote-code.js'
 import noUnrestrictedHostPermissions from './rules/no-unrestricted-host-permissions.js'
+import noUnusedI18nKeys from './rules/no-unused-i18n-keys.js'
 import noUnusedPermissions from './rules/no-unused-permissions.js'
+import requireLicenseFile from './rules/require-license-file.js'
 import requireMV3 from './rules/require-mv3.js'
+import requireShortNameWhenUseful from './rules/require-short-name-when-useful.js'
+import validFilenames from './rules/valid-filenames.js'
+import validLicenseFile from './rules/valid-license-file.js'
 import validManifestIcons from './rules/valid-manifest-icons.js'
 import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
+import validURLfields from './rules/valid-url-fields.js'
 import validVersionField from './rules/valid-version-field.js'
 
 import { bundleRules, initBundleDeprecation } from './utils.js'
+import { textParser } from './data/text-parser.js'
 
 const plugin = {
     rules: {
@@ -31,15 +44,23 @@ const plugin = {
         'no-insecure-fetch': noInsecureFetch,
         'no-insecure-messaging': noInsecureMessaging,
         'no-invalid-permissions': noInvalidPermissions,
+        'no-missing-default-locale': noMissingDefaultLocale,
+        'no-missing-i18n-keys': noMissingI18nKeys,
         'no-missing-permissions': noMissingPermissions,
         'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
         'no-remote-code': noRemoteCode,
         'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
+        'no-unused-i18n-keys': noUnusedI18nKeys,
         'no-unused-permissions': noUnusedPermissions,
         'require-mv3': requireMV3,
+        'require-license-file': requireLicenseFile,
+        'require-short-name-when-useful': requireShortNameWhenUseful,
+        'valid-filenames': validFilenames,
+        'valid-license-file': validLicenseFile,
         'valid-manifest-icons': validManifestIcons,
         'valid-mv3-schema': validMV3schema,
         'valid-service-worker': validServiceWorker,
+        'valid-url-fields': validURLfields,
         'valid-version-field': validVersionField
     }
 }
@@ -65,8 +86,39 @@ plugin.configs = {
         rules: bundleRules(plugin.rules, rule => rule.meta.docs.security, 'chrome-extensions')
     },
     manifest: {
-        plugins: { 'chrome-extensions': plugin },
+        language: 'json/json',
+        plugins: { 'chrome-extensions': plugin, json },
         rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest, 'chrome-extensions')
+    },
+    license: {
+        languageOptions: { parser: textParser },
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.license, 'chrome-extensions')
+    },
+    css: {
+        language: 'css/css',
+        plugins: { 'chrome-extensions': plugin, css },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.css, 'chrome-extensions')
+    },
+    html: {
+        language: 'html/html',
+        plugins: { 'chrome-extensions': plugin, html },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.html, 'chrome-extensions')
+    },
+    json: {
+        language: 'json/json',
+        plugins: { 'chrome-extensions': plugin, json },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.json, 'chrome-extensions')
+    },
+    json5: {
+        language: 'json/json5',
+        plugins: { 'chrome-extensions': plugin, json },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.json, 'chrome-extensions')
+    },
+    jsonc: {
+        language: 'json/jsonc',
+        plugins: { 'chrome-extensions': plugin, json },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.json, 'chrome-extensions')
     }
 }
 

package/src/rules/manifest-key-order.js

@@ -1,5 +1,4 @@
 import { manifestKeyOrder } from '../data/manifest.js'
-
 import { getFilename } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -15,8 +14,7 @@ function findViolation(members, keys) {
               const key = keyOf(member)
               return { member, key, rank: ranks.get(key) }
           }).filter(item => item.rank !== undefined)
-    for (let i = 1; i < known.length; i++)
-        // eslint-disable-next-line security/detect-object-injection
+    for (let i = 1 ; i < known.length ; i++) // eslint-disable-next-line security/detect-object-injection
         if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
 }
 

package/src/rules/manifest-spacing.js

@@ -73,7 +73,7 @@ export default {
                       lineOffsets = [0]
                 for (const line of lines)
                     lineOffsets.push(lineOffsets.at(-1) + line.length +1)
-                let depth = 0, lastLine = 0
+                let depth = 0, lastLine = 0, prevToken = null
                 for (const token of tokens) { // check indentation
                     const startLine = token.loc.start.line
                     if (startLine != lastLine) {
@@ -92,8 +92,15 @@ export default {
                         }
                         lastLine = startLine
                     }
-                    if (brackets.open.has(token.type)) depth += 1
-                    else if (brackets.close.has(token.type)) depth -= 1
+                    const isOpen = brackets.open.has(token.type),
+                          isClose = brackets.close.has(token.type),
+                          wasOpen = prevToken && brackets.open.has(prevToken.type),
+                          wasClose = prevToken && brackets.close.has(prevToken.type),
+                          isSameLine = prevToken && prevToken.loc.end.line == token.loc.start.line,
+                          isContiguous = prevToken && prevToken.range[1] == token.range[0]
+                    if (isOpen && !(wasOpen && isSameLine)) depth += 1
+                    else if (isClose && !(wasClose && isContiguous)) depth -= 1
+                    prevToken = token
                 }
                 for (let t = 0 ; t < tokens.length ; t++) { // check inline spacing
                     const token = tokens[t], // eslint-disable-line security/detect-object-injection
@@ -131,7 +138,8 @@ export default {
                     if (prev) {
                         const between = text.slice(prev.range[1], token.range[0]),
                               inline = !between.includes('\n'),
-                              isColon = type == 'Colon', isComma = type == 'Comma'
+                              isColon = type == 'Colon',
+                              isComma = type == 'Comma'
                         if (checkColons && isColon && inline && between != '')
                             context.report({
                                 loc: token.loc.start, messageId: 'spaceBeforeColon',

package/src/rules/no-content-style-leak.js

@@ -1,5 +1,7 @@
 import { readManifest, isContentScriptFile } from '../utils.js'
 
+const re = { appendMethod: /^append(?:Child)?$/ }
+
 export default {
     meta: {
         type: 'suggestion',
@@ -41,7 +43,8 @@ export default {
             if (isObjectAssign(node) && isCreateStyle(node.arguments[0])) return true
             if (isObjectAssign(node)
                 && node.arguments[0]?.type == 'Identifier'
-                && styleElems.has(node.arguments[0].name)) return true
+                && styleElems.has(node.arguments[0].name)
+            ) return true
             return false
         }
         return {
@@ -54,7 +57,7 @@ export default {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const method = node.callee.property.name
-                if (method != 'append' && method != 'appendChild') return
+                if (!re.appendMethod.test(method)) return
                 if (!isDocumentMember(node.callee.object)) return
                 for (const arg of node.arguments)
                     if (isStyleTarget(arg))

package/src/rules/no-invalid-permissions.js

@@ -64,10 +64,10 @@ export default {
                 }
             }
         const manifest = readManifest(context) ; if (!manifest) return {}
-        const all = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])]
+        const allPermissions = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])]
         return {
             'Program:exit'() {
-                for (const permission of all) {
+                for (const permission of allPermissions) {
                     if (allowed.has(permission) || isValidPermission(permission, target)) continue
                     context.report({ loc: { line: 1, column: 0 },
                         messageId: 'invalidPermission', data: { permission, target }})

package/src/rules/no-missing-default-locale.js

@@ -0,0 +1,91 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { findExtensionRoot, isPredefined } from '../data/i18n.js'
+import { readManifest } from '../utils.js'
+
+const re = { manifestFile: /manifest\.json$/ }
+
+function readMessages(filePath) {
+    try {
+        const data = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+        return (data && typeof data == 'object' && !Array.isArray(data)) ? data : null
+    } catch { return null }
+}
+
+function readLocaleDirs(localesDir) {
+    try {
+        return fs.readdirSync(localesDir, { withFileTypes: true })
+            .filter(entry => entry.isDirectory())
+            .map(entry => entry.name)
+    } catch { return [] }
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Ensure `default_locale` is valid and all `_locales` keys exist in it',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                ignoreKeys: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Keys to skip when checking the default locale'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ ignoreKeys: [] }],
+        messages: {
+            missingDefaultLocale: '`_locales/` exists but `default_locale` is not declared.',
+            unexpectedDefaultLocale: '`default_locale` is declared but no `_locales/` directory exists.',
+            missingDefaultLocaleFile: '`_locales/{{locale}}/messages.json` does not exist.',
+            missingKeyInDefault: '`{{key}}` exists in `_locales/{{locale}}/messages.json`, '
+                               + 'but not in default locale `{{defaultLocale}}`.'
+        }
+    },
+
+    create(context) {
+        const filename = context.filename
+        if (!filename || !re.manifestFile.test(filename)) return {}
+        const manifest = readManifest(context) ; if (!manifest) return {}
+        const root = findExtensionRoot(filename) ; if (!root) return {}
+        const localesDir = path.join(root, '_locales'),
+              hasLocales = fs.existsSync(localesDir),
+              defaultLocale = manifest.default_locale,
+              opts = context.options[0] || {},
+              ignored = new Set(opts.ignoreKeys || []),
+              loc = { line: 1, column: 1 }
+        if (hasLocales && typeof defaultLocale != 'string') {
+            context.report({ loc, messageId: 'missingDefaultLocale' })
+            return {}
+        }
+        if (typeof defaultLocale == 'string' && !hasLocales) {
+            context.report({ loc, messageId: 'unexpectedDefaultLocale' })
+            return {}
+        }
+        if (typeof defaultLocale != 'string' || !hasLocales) return {}
+        const defaultMsgs = readMessages(path.join(localesDir, defaultLocale, 'messages.json'))
+        if (!defaultMsgs) {
+            context.report({ loc, messageId: 'missingDefaultLocaleFile', data: { locale: defaultLocale }})
+            return {}
+        }
+        for (const locale of readLocaleDirs(localesDir)) {
+            if (locale == defaultLocale) continue
+            const msgs = readMessages(path.join(localesDir, locale, 'messages.json')) ; if (!msgs) continue
+            for (const key of Object.keys(msgs)) {
+                if (isPredefined(key) || ignored.has(key)) continue
+                if (!(key in defaultMsgs))
+                    context.report({ loc, messageId: 'missingKeyInDefault', data: { key, locale, defaultLocale }})
+            }
+        }
+        return {}
+    }
+}