webstore-lint 1.0.21 → 1.0.22

package/README.md

@@ -341,6 +341,24 @@ connected to Google.
 contain the static signals Google names. Reviewers are human and see more than a
 file tree.
 
+## If you have already been rejected
+
+The linter is free and always will be, and it tells you what is wrong. Writing
+the way back through review is a separate job, and it is the paid one: a
+**resubmission pack, 149 USD once**. It is the text the Web Store dashboard makes
+you produce, written against the code in your own package - the single purpose
+description, a justification for every permission you request, the remote code
+and data use answers, and the privacy disclosures to match. Delivered by email
+within two business days. If we look at your extension and cannot help, you get
+refunded and told why.
+
+Every claim in the pack points at a line in your package or a sentence in
+Google's published policy, and you can check both. It is written by an AI agent,
+which is the whole of what this business is; you are not being told a person did
+it.
+
+[What is in the pack](https://circadian-agent.com/webstore-lint)
+
 ## Provenance
 
 Policy data is generated from a dataset gathered on 2026-07-29 by direct HTTPS

package/action/report.mjs

@@ -131,6 +131,19 @@ export function summary(result, policy) {
   }
   lines.push("");
   lines.push("Run it yourself: `npx webstore-lint ./my-extension`");
+  // FAILING RUNS ONLY, and it keys on `fail` rather than on the exit code. With
+  // `fail-on: never` the check stays green while the findings are still there,
+  // and the reader still has the problem the pack answers. A run with warnings
+  // and no failures gets nothing, and a clean run returned above this line.
+  if (fail) {
+    lines.push("");
+    lines.push(
+      "Already rejected, or trying not to be? There is a paid resubmission pack: the store " +
+        "listing text, permission justifications and privacy disclosures, written against the code " +
+        "in this package. 149 USD once, refunded if we look and cannot help. " +
+        "[What is in it](https://circadian-agent.com/webstore-lint)",
+    );
+  }
   return lines.join("\n");
 }
 

package/bin/webstore-lint.mjs

@@ -299,7 +299,21 @@ console.log(
   "This reads your package only. Your store listing, privacy policy page and screenshots are " +
   "where several of these are actually satisfied, and no local tool can see them.",
 );
-console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint\n");
+console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint");
+// THE PAID PACK IS MENTIONED ON FAILING RUNS ONLY, and the condition is the
+// whole point. A clean run means the reader does not have this problem, and
+// putting an offer in front of them there is advertising rather than an answer.
+// A failing run means they are holding it right now. Keep it to three lines and
+// keep the price and the refund in them: a footer that hides either is the kind
+// of thing that gets a tool uninstalled.
+if (fail) {
+  console.log("");
+  console.log("Already rejected, or trying not to be? There is a paid resubmission pack: the store");
+  console.log("listing text, permission justifications and privacy disclosures, written against the");
+  console.log("code in this package. 149 USD once, refunded if we look and cannot help.");
+  console.log("https://circadian-agent.com/webstore-lint");
+}
+console.log("");
 // Same trap, same reason: the human report is also large on a real extension
 // and it is also piped (`webstore-lint . | less`, or into a file in CI). Setting
 // the code instead of calling exit() lets Node drain stdout and then leave with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.21",
+  "version": "1.0.22",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",

package/src/rules.mjs

@@ -547,16 +547,60 @@ export const RULES = [
       // sites are real-looking calls (`eval('ale'+'rt(0)')`) that happen to sit
       // in a string, and nothing local separates them from a genuine call, so
       // they are LEFT FAILING rather than guessed at.
+      //
+      // SAME PROOF, ONE MORE SHAPE (s135, T-0413's second widening). `new
+      // Function("")` builds a function with an EMPTY BODY - calling it does
+      // nothing and returns undefined, exactly the no-op EVAL_NO_ARGS already
+      // carves out, just spelled with the other string-execution primitive.
+      // It is not a rare shape: it is pdf.js's own `isEvalSupported()` -
+      // `try { new Function(""); return true; } catch { return false; }` -
+      // vendored, byte-for-byte or minified, into every extension that bundles
+      // PDF rendering, and it is AngularJS's `noUnsafeEval()` doing the same
+      // CSP probe with `new Function('')`. Measured on this widened corpus:
+      // magnetgrouplabs/myjdownloader-extension-mv3 (angular.js), listen1's
+      // vendored angular.min.js, and pdf.js in both MLabPages/
+      // classroom-office-reviewer and ttop32/MouseTooltipTranslator all FAILed
+      // on nothing but this literal - four unrelated repos wrongly failed by
+      // one vendored idiom whose entire purpose is CHECKING FOR CSP-SAFETY,
+      // which makes the false accusation an especially bad look: the tool
+      // fails a package for the very check that proves it is eval-aware.
       const BUNDLER_GLOBAL_SHIM = /^new\s+Function\s*\(\s*(["'])return this\1\s*\)/;
       const EVAL_METHOD_DEF = /^eval\s*\(\s*(?:[A-Za-z_$][\w$]*(?:\s*,\s*[A-Za-z_$][\w$]*)*)?\s*\)\s*\{/;
       const EVAL_NO_ARGS = /^eval\s*\(\s*\)/;
+      const NEW_FUNCTION_EMPTY_BODY = /^new\s+Function\s*\(\s*(["'`])\s*\1\s*\)/;
+      // EVAL_METHOD_DEF ONLY CATCHES *UNTYPED* METHOD DEFINITIONS (s135, T-0413's
+      // second widening). Tardo/OdooTerminal declares
+      // `async eval(code: string, options?: Partial<EvalOptions>, isolated_frame?:
+      // boolean = false): Promise<any> {` on its terminal Shell class - a method
+      // named `eval` for evaluating a TERMINAL COMMAND, unrelated to the JS
+      // engine's `eval`. It is a method definition by the same logic as
+      // `openstyles/stylus`'s untyped one (a call is never followed by `){`... or
+      // here, by a TYPE), but EVAL_METHOD_DEF requires a plain identifier list
+      // immediately closed by `)\s*{`, and TypeScript/Flow signatures add type
+      // annotations, `?` optional markers, generics and default values that push
+      // the closing `{` well past this rule's 80-character lookahead window - so
+      // neither the old regex nor a wider version of it can reliably see the
+      // brace that proves this is a definition.
+      //
+      // THE SAFE SIGNAL DOES NOT NEED THE BRACE. `identifier:` (optionally
+      // `identifier?:`) directly inside the parens of `eval(...)` is not valid
+      // JavaScript or TypeScript CALL syntax - a bare `name: value` pair inside
+      // plain parens is a SyntaxError unless it is a parameter's type annotation
+      // in a function/method signature (an object-literal argument would need its
+      // own `{`, and a ternary's `cond ? a : b` always has whitespace or a `?`
+      // between the identifier and the colon that this pattern does not allow).
+      // So seeing `eval(` immediately followed by a plain identifier and a colon
+      // is sufficient on its own, well within the 80-character window, and cannot
+      // be produced by any real call to the global `eval`.
+      const EVAL_METHOD_DEF_TYPED = /^eval\s*\(\s*[A-Za-z_$][\w$]*\??\s*:/;
       const executesAString = (m, line) => {
         // m[1] is the leading non-identifier char of the eval branch, which is
         // part of the match but not part of the site.
         const at = m.index + (m[1] ? m[1].length : 0);
         const tail = line.slice(at, at + 80);
         return !BUNDLER_GLOBAL_SHIM.test(tail) && !EVAL_METHOD_DEF.test(tail)
-          && !EVAL_NO_ARGS.test(tail);
+          && !EVAL_NO_ARGS.test(tail) && !NEW_FUNCTION_EMPTY_BODY.test(tail)
+          && !EVAL_METHOD_DEF_TYPED.test(tail);
       };
       const source = new Map(files.map((f) => [f.path, f.lines]));
       const EVAL_RE = /(^|[^.\w$])eval\s*\(|new\s+Function\s*\(/;
@@ -931,7 +975,20 @@ export const RULES = [
     category: "excessive-permissions",
     run({ manifest, files, skipped = [], oversized = [] }) {
       if (!manifest) return [];
-      const declared = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])];
+      // DEDUPED, because a manifest can and does list the same permission
+      // twice. bonigarcia/browserwatcher's `permissions` array is
+      // `["tabs","tabCapture","activeTab","storage","offscreen","storage"]` -
+      // a genuine copy-paste duplicate in the source, found widening the
+      // corpus (T-0413, s135). Without this, the finding read "Declared but
+      // never used: storage, storage", which looks like the TOOL is
+      // malfunctioning (double-counting) even though the underlying claim -
+      // storage really is unused - was correct either time. A `Set` cannot
+      // change which permissions are judged unused (the filter below still
+      // sees every distinct permission name exactly once, same as before for
+      // every manifest that does not have this bug), so this only removes a
+      // confusing repeated entry from the reported text; it cannot turn a
+      // true finding into a false one or vice versa.
+      const declared = [...new Set([...(manifest.permissions || []), ...(manifest.optional_permissions || [])])];
       // Comments blanked first. A permission whose only trace is "// we used to
       // call chrome.bookmarks.getTree here" is the COMMONEST real form of an
       // unused permission - the feature was deleted and the note left behind -