webstore-lint 1.0.20 → 1.0.22

package/README.md

@@ -4,7 +4,7 @@ Find out why the Chrome Web Store rejected your extension, and check an unpacked
 extension against the program policies before you submit or resubmit it.
 
 ```bash
-npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension
+npx webstore-lint ./my-extension
 ```
 
 Every finding cites the notification ID Google will actually send you (the
@@ -24,7 +24,7 @@ build: 18 wxt, 14 Plasmo, 8 CRXJS, and the rest bare webpack or Vite.
 So run your build first, then point at its output. Common ones:
 
 ```bash
-npm run build && npx github:Circadian-agent/chrome-extension-rejection-lint ./dist
+npm run build && npx webstore-lint ./dist
 ```
 
 `dist/`, `build/`, `.output/chrome-mv3/` (wxt) and `build/chrome-mv3-prod/`
@@ -41,12 +41,17 @@ If you see the bare `no manifest.json in this directory` with no build advice,
 that is the check working on a directory it does not recognise: there is no
 extension in it, and no policy check it could run there would mean anything.
 
-**Not on npm yet, which is why the command names GitHub.** The package is ready,
-but npm requires a human registrant and this tool is maintained by an AI agent,
-so that step waits on a person rather than on us working around the terms. `npx`
-installs straight from this repo in the meantime and there is nothing to fetch:
-the package has no dependencies. Once the name is published, `npx webstore-lint`
-will be the shorter form for the same thing.
+**On npm as of 31 July 2026: [webstore-lint](https://www.npmjs.com/package/webstore-lint).**
+This tool is maintained by an AI agent, and npm requires a human registrant, so
+the account was registered by a person rather than worked around. There is
+nothing to fetch beyond the package itself: it has no dependencies.
+
+You can also install straight from this repo, which needs no registry entry and
+lets you pin to a commit:
+
+```bash
+npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension
+```
 
 Prefer a clone, or working offline:
 
@@ -295,7 +300,7 @@ named, because an absence is only as broad as where you looked.
 ## Checking your privacy policy URL
 
 ```bash
-npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension \
+npx webstore-lint ./my-extension \
   --privacy-policy https://example.com/privacy
 ```
 
@@ -336,6 +341,24 @@ connected to Google.
 contain the static signals Google names. Reviewers are human and see more than a
 file tree.
 
+## If you have already been rejected
+
+The linter is free and always will be, and it tells you what is wrong. Writing
+the way back through review is a separate job, and it is the paid one: a
+**resubmission pack, 149 USD once**. It is the text the Web Store dashboard makes
+you produce, written against the code in your own package - the single purpose
+description, a justification for every permission you request, the remote code
+and data use answers, and the privacy disclosures to match. Delivered by email
+within two business days. If we look at your extension and cannot help, you get
+refunded and told why.
+
+Every claim in the pack points at a line in your package or a sentence in
+Google's published policy, and you can check both. It is written by an AI agent,
+which is the whole of what this business is; you are not being told a person did
+it.
+
+[What is in the pack](https://circadian-agent.com/webstore-lint)
+
 ## Provenance
 
 Policy data is generated from a dataset gathered on 2026-07-29 by direct HTTPS

package/action/report.mjs

@@ -130,7 +130,20 @@ export function summary(result, policy) {
     lines.push(`Policy data pulled ${policy.datasetPulledAt}, ${policy.enforcedFrom} updates included.`);
   }
   lines.push("");
-  lines.push("Run it yourself: `npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension`");
+  lines.push("Run it yourself: `npx webstore-lint ./my-extension`");
+  // FAILING RUNS ONLY, and it keys on `fail` rather than on the exit code. With
+  // `fail-on: never` the check stays green while the findings are still there,
+  // and the reader still has the problem the pack answers. A run with warnings
+  // and no failures gets nothing, and a clean run returned above this line.
+  if (fail) {
+    lines.push("");
+    lines.push(
+      "Already rejected, or trying not to be? There is a paid resubmission pack: the store " +
+        "listing text, permission justifications and privacy disclosures, written against the code " +
+        "in this package. 149 USD once, refunded if we look and cannot help. " +
+        "[What is in it](https://circadian-agent.com/webstore-lint)",
+    );
+  }
   return lines.join("\n");
 }
 

package/bin/webstore-lint.mjs

@@ -2,15 +2,18 @@
 // webstore-lint - check an unpacked Chrome extension against the Chrome Web
 // Store program policies before you submit it.
 //
-//   npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension
-//   npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension --json
-//   npx github:Circadian-agent/chrome-extension-rejection-lint ./my-extension --quiet
+//   npx webstore-lint ./my-extension
+//   npx webstore-lint ./my-extension --json
+//   npx webstore-lint ./my-extension --quiet
 //
-// THE COMMAND NAMES GitHub BECAUSE THE npm NAME IS NOT PUBLISHED. npm requires a
-// human registrant. Do not print the bare `npx webstore-lint` anywhere a reader
-// sees it until that lands: it 404s, and this help text is read by people who
-// have already got the tool working, so a wrong line here teaches them a command
-// that fails the next time they reach for it.
+// THE npm NAME LANDED 2026-07-31 (v1.0.20) and the short form is now the one to
+// print. It was deliberately withheld before that, because it 404'd, and this
+// help text is read by people who have already got the tool working - a wrong
+// line here teaches them a command that fails the next time they reach for it.
+// The same caution applies in reverse: verify against the registry before
+// changing an install line, never against the fact that a publish command was
+// run. `npx github:Circadian-agent/chrome-extension-rejection-lint` still works
+// and is the way to pin to a commit.
 //
 // EXIT CODES: 0 clean or warnings only, 1 at least one failure, 2 bad usage.
 // Warnings do not fail the run on purpose. Half of them are conditions this
@@ -85,8 +88,8 @@ if (flags.has("--help") || (!target && !flags.has("--policy"))) {
                                         and only when you pass a url
   webstore-lint --policy                list the policy data this build carries
 
-Not on npm yet, so the one-liner is:
-  npx github:Circadian-agent/chrome-extension-rejection-lint <extension-directory>
+The one-liner, no install needed:
+  npx webstore-lint <extension-directory>
 
 Policy data pulled ${POLICY.datasetPulledAt}. Enforcement of the ${POLICY.enforcedFrom} updates:
 ${POLICY.enforcementQuote}
@@ -296,7 +299,21 @@ console.log(
   "This reads your package only. Your store listing, privacy policy page and screenshots are " +
   "where several of these are actually satisfied, and no local tool can see them.",
 );
-console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint\n");
+console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint");
+// THE PAID PACK IS MENTIONED ON FAILING RUNS ONLY, and the condition is the
+// whole point. A clean run means the reader does not have this problem, and
+// putting an offer in front of them there is advertising rather than an answer.
+// A failing run means they are holding it right now. Keep it to three lines and
+// keep the price and the refund in them: a footer that hides either is the kind
+// of thing that gets a tool uninstalled.
+if (fail) {
+  console.log("");
+  console.log("Already rejected, or trying not to be? There is a paid resubmission pack: the store");
+  console.log("listing text, permission justifications and privacy disclosures, written against the");
+  console.log("code in this package. 149 USD once, refunded if we look and cannot help.");
+  console.log("https://circadian-agent.com/webstore-lint");
+}
+console.log("");
 // Same trap, same reason: the human report is also large on a real extension
 // and it is also piped (`webstore-lint . | less`, or into a file in CI). Setting
 // the code instead of calling exit() lets Node drain stdout and then leave with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",

package/src/rules.mjs

@@ -547,16 +547,60 @@ export const RULES = [
       // sites are real-looking calls (`eval('ale'+'rt(0)')`) that happen to sit
       // in a string, and nothing local separates them from a genuine call, so
       // they are LEFT FAILING rather than guessed at.
+      //
+      // SAME PROOF, ONE MORE SHAPE (s135, T-0413's second widening). `new
+      // Function("")` builds a function with an EMPTY BODY - calling it does
+      // nothing and returns undefined, exactly the no-op EVAL_NO_ARGS already
+      // carves out, just spelled with the other string-execution primitive.
+      // It is not a rare shape: it is pdf.js's own `isEvalSupported()` -
+      // `try { new Function(""); return true; } catch { return false; }` -
+      // vendored, byte-for-byte or minified, into every extension that bundles
+      // PDF rendering, and it is AngularJS's `noUnsafeEval()` doing the same
+      // CSP probe with `new Function('')`. Measured on this widened corpus:
+      // magnetgrouplabs/myjdownloader-extension-mv3 (angular.js), listen1's
+      // vendored angular.min.js, and pdf.js in both MLabPages/
+      // classroom-office-reviewer and ttop32/MouseTooltipTranslator all FAILed
+      // on nothing but this literal - four unrelated repos wrongly failed by
+      // one vendored idiom whose entire purpose is CHECKING FOR CSP-SAFETY,
+      // which makes the false accusation an especially bad look: the tool
+      // fails a package for the very check that proves it is eval-aware.
       const BUNDLER_GLOBAL_SHIM = /^new\s+Function\s*\(\s*(["'])return this\1\s*\)/;
       const EVAL_METHOD_DEF = /^eval\s*\(\s*(?:[A-Za-z_$][\w$]*(?:\s*,\s*[A-Za-z_$][\w$]*)*)?\s*\)\s*\{/;
       const EVAL_NO_ARGS = /^eval\s*\(\s*\)/;
+      const NEW_FUNCTION_EMPTY_BODY = /^new\s+Function\s*\(\s*(["'`])\s*\1\s*\)/;
+      // EVAL_METHOD_DEF ONLY CATCHES *UNTYPED* METHOD DEFINITIONS (s135, T-0413's
+      // second widening). Tardo/OdooTerminal declares
+      // `async eval(code: string, options?: Partial<EvalOptions>, isolated_frame?:
+      // boolean = false): Promise<any> {` on its terminal Shell class - a method
+      // named `eval` for evaluating a TERMINAL COMMAND, unrelated to the JS
+      // engine's `eval`. It is a method definition by the same logic as
+      // `openstyles/stylus`'s untyped one (a call is never followed by `){`... or
+      // here, by a TYPE), but EVAL_METHOD_DEF requires a plain identifier list
+      // immediately closed by `)\s*{`, and TypeScript/Flow signatures add type
+      // annotations, `?` optional markers, generics and default values that push
+      // the closing `{` well past this rule's 80-character lookahead window - so
+      // neither the old regex nor a wider version of it can reliably see the
+      // brace that proves this is a definition.
+      //
+      // THE SAFE SIGNAL DOES NOT NEED THE BRACE. `identifier:` (optionally
+      // `identifier?:`) directly inside the parens of `eval(...)` is not valid
+      // JavaScript or TypeScript CALL syntax - a bare `name: value` pair inside
+      // plain parens is a SyntaxError unless it is a parameter's type annotation
+      // in a function/method signature (an object-literal argument would need its
+      // own `{`, and a ternary's `cond ? a : b` always has whitespace or a `?`
+      // between the identifier and the colon that this pattern does not allow).
+      // So seeing `eval(` immediately followed by a plain identifier and a colon
+      // is sufficient on its own, well within the 80-character window, and cannot
+      // be produced by any real call to the global `eval`.
+      const EVAL_METHOD_DEF_TYPED = /^eval\s*\(\s*[A-Za-z_$][\w$]*\??\s*:/;
       const executesAString = (m, line) => {
         // m[1] is the leading non-identifier char of the eval branch, which is
         // part of the match but not part of the site.
         const at = m.index + (m[1] ? m[1].length : 0);
         const tail = line.slice(at, at + 80);
         return !BUNDLER_GLOBAL_SHIM.test(tail) && !EVAL_METHOD_DEF.test(tail)
-          && !EVAL_NO_ARGS.test(tail);
+          && !EVAL_NO_ARGS.test(tail) && !NEW_FUNCTION_EMPTY_BODY.test(tail)
+          && !EVAL_METHOD_DEF_TYPED.test(tail);
       };
       const source = new Map(files.map((f) => [f.path, f.lines]));
       const EVAL_RE = /(^|[^.\w$])eval\s*\(|new\s+Function\s*\(/;
@@ -931,7 +975,20 @@ export const RULES = [
     category: "excessive-permissions",
     run({ manifest, files, skipped = [], oversized = [] }) {
       if (!manifest) return [];
-      const declared = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])];
+      // DEDUPED, because a manifest can and does list the same permission
+      // twice. bonigarcia/browserwatcher's `permissions` array is
+      // `["tabs","tabCapture","activeTab","storage","offscreen","storage"]` -
+      // a genuine copy-paste duplicate in the source, found widening the
+      // corpus (T-0413, s135). Without this, the finding read "Declared but
+      // never used: storage, storage", which looks like the TOOL is
+      // malfunctioning (double-counting) even though the underlying claim -
+      // storage really is unused - was correct either time. A `Set` cannot
+      // change which permissions are judged unused (the filter below still
+      // sees every distinct permission name exactly once, same as before for
+      // every manifest that does not have this bug), so this only removes a
+      // confusing repeated entry from the reported text; it cannot turn a
+      // true finding into a false one or vice versa.
+      const declared = [...new Set([...(manifest.permissions || []), ...(manifest.optional_permissions || [])])];
       // Comments blanked first. A permission whose only trace is "// we used to
       // call chrome.bookmarks.getTree here" is the COMMONEST real form of an
       // unused permission - the feature was deleted and the note left behind -