shabbat-gate 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -3,7 +3,37 @@
 All notable changes to this package are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
-## [0.4.0] - Unreleased
+## [0.4.1] - Unreleased
+
+### Fixed
+
+- **`adsbot-google` in the crawler allowlist was cloaking under Google Ads policy - caused a
+  real Ads + Merchant Center account suspension.** Found 2026-08-29 on a consumer site: during
+  a gate closure window, AdsBot-Google (the crawler Google Ads uses to verify what a real ad
+  landing page shows) saw the full real site, while a human clicking the same ad saw the holding
+  page. Google's suspension notice for "עקיפת מערכות: הסוואה" (circumventing systems: cloaking)
+  described exactly this - showing Google's verification bot different content than what users
+  see - almost verbatim.
+
+  Removing the explicit `adsbot-google` term from `BOT_PATTERN`'s alternation alone would **not**
+  have fixed this: the pattern's generic `bot` alternative already matches the substring "Bot" in
+  "AdsBot-Google", so it stayed allowed regardless. `isBot()` now checks a dedicated
+  `AD_VERIFICATION_BOT_PATTERN` first and returns `false` before the broad pattern ever runs, so
+  these crawlers are gated exactly like a human visitor. Every other crawler in `BOT_PATTERN`
+  (Googlebot, Bingbot, GPTBot, ClaudeBot, etc.) is unaffected - organic/AI indexing during a
+  closure window is a different, broadly-tolerated risk category from a dedicated ad-verification
+  bot, which ad-network policy specifically requires to see what humans see.
+
+  Two more crawlers in the same risk category are excluded alongside AdsBot-Google, for the same
+  reason and hitting the same "bot" substring problem: **`Storebot-Google`** (Google
+  Merchant Center/Shopping's product landing-page verifier - directly relevant here, since
+  Merchant Center was the linked account also suspended) and **`adidxbot`** (Microsoft
+  Advertising/Bing Ads' equivalent landing-page verification crawler).
+
+  Regression tests assert `isBot()` returns `false` for AdsBot-Google, AdsBot-Google-Mobile,
+  Storebot-Google, and adidxbot user agents.
+
+## [0.4.0] - 2026-07-28
 
 ### Fixed
 

package/dist/botPattern.d.ts

@@ -1,8 +1,8 @@
 /**
  * Broad, case-insensitive allowlist for search engine and AI crawlers.
  * Matches let a request through unconditionally, before any gate logic runs.
- * Erring toward "let more things through" is the safe direction here, since
- * the whole point of this list is protecting SEO/crawlability.
+ * Erring toward "let more things through" is the safe direction for organic/AI
+ * crawlers, since the whole point of this list is protecting SEO/crawlability.
  */
 export declare const BOT_PATTERN: RegExp;
 export declare function isBot(userAgent: string): boolean;

package/dist/botPattern.js

@@ -1,10 +1,37 @@
 /**
  * Broad, case-insensitive allowlist for search engine and AI crawlers.
  * Matches let a request through unconditionally, before any gate logic runs.
- * Erring toward "let more things through" is the safe direction here, since
- * the whole point of this list is protecting SEO/crawlability.
+ * Erring toward "let more things through" is the safe direction for organic/AI
+ * crawlers, since the whole point of this list is protecting SEO/crawlability.
  */
-export const BOT_PATTERN = /bot|crawl|spider|slurp|googlebot|google-inspectiontool|adsbot-google|bingbot|duckduckbot|baiduspider|yandex|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|discordbot|applebot|gptbot|chatgpt-user|oai-searchbot|ccbot|claudebot|claude-web|anthropic-ai|perplexitybot|google-extended|bytespider|semrushbot|ahrefsbot|mj12bot|petalbot/i;
+export const BOT_PATTERN = /bot|crawl|spider|slurp|googlebot|google-inspectiontool|bingbot|duckduckbot|baiduspider|yandex|facebookexternalhit|twitterbot|linkedinbot|whatsapp|telegrambot|discordbot|applebot|gptbot|chatgpt-user|oai-searchbot|ccbot|claudebot|claude-web|anthropic-ai|perplexitybot|google-extended|bytespider|semrushbot|ahrefsbot|mj12bot|petalbot/i;
+/**
+ * Dedicated ad/shopping-network verification crawlers are deliberately NOT
+ * allowed through the gate, even though their user agents also match the
+ * generic `bot` term above (e.g. "AdsBot-Google" and "Storebot-Google" both
+ * contain the substring "bot", "adidxbot" ends in it) - excluding them from
+ * BOT_PATTERN's alternation alone would do nothing, since that bare substring
+ * still matches.
+ *
+ * Unlike organic/AI indexing crawlers, these bots exist specifically to
+ * verify that a live ad or shopping listing's destination page matches what a
+ * human clicking it sees - Google Ads, Google Merchant Center/Shopping, and
+ * Microsoft Advertising all require exactly that. Letting one bypass the gate
+ * means it sees the real site during a closure window while a human visitor
+ * sees the holding page - a textbook cloaking pattern, and the exact
+ * violation Google's policy team cited when it suspended a consumer's Ads +
+ * Merchant Center accounts over this (2026-08-29).
+ *
+ * - `adsbot-google` - AdsBot-Google / AdsBot-Google-Mobile, verifies Google
+ *   Ads landing pages.
+ * - `storebot-google` - verifies Google Shopping / Merchant Center product
+ *   landing pages against the submitted feed.
+ * - `adidxbot` - Microsoft Advertising's (Bing Ads) equivalent landing-page
+ *   verification crawler.
+ */
+const AD_VERIFICATION_BOT_PATTERN = /adsbot-google|storebot-google|adidxbot/i;
 export function isBot(userAgent) {
+    if (AD_VERIFICATION_BOT_PATTERN.test(userAgent))
+        return false;
     return BOT_PATTERN.test(userAgent);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shabbat-gate",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Cloudflare Pages/Workers middleware that closes a site to human visitors during Shabbat and major Jewish holidays (Israel-observance rules), while always letting search engines and AI crawlers through.",
   "type": "module",
   "main": "./dist/index.js",