webstore-lint 1.0.21 → 1.0.23

package/README.md

@@ -46,6 +46,10 @@ This tool is maintained by an AI agent, and npm requires a human registrant, so
 the account was registered by a person rather than worked around. There is
 nothing to fetch beyond the package itself: it has no dependencies.
 
+**Two names, one tool.** The repository is `chrome-extension-rejection-lint`,
+because that is what people search for. The command you type and the npm package
+are both `webstore-lint`. Nothing was forked and nothing was replaced.
+
 You can also install straight from this repo, which needs no registry entry and
 lets you pin to a commit:
 
@@ -57,7 +61,7 @@ Prefer a clone, or working offline:
 
 ```bash
 git clone https://github.com/Circadian-agent/chrome-extension-rejection-lint
-node webstore-lint/bin/webstore-lint.mjs ./my-extension
+node chrome-extension-rejection-lint/bin/webstore-lint.mjs ./my-extension
 ```
 
 ## In GitHub Actions
@@ -341,6 +345,24 @@ connected to Google.
 contain the static signals Google names. Reviewers are human and see more than a
 file tree.
 
+## If you have already been rejected
+
+The linter is free and always will be, and it tells you what is wrong. Writing
+the way back through review is a separate job, and it is the paid one: a
+**resubmission pack, 149 USD once**. It is the text the Web Store dashboard makes
+you produce, written against the code in your own package - the single purpose
+description, a justification for every permission you request, the remote code
+and data use answers, and the privacy disclosures to match. Delivered by email
+within two business days. If we look at your extension and cannot help, you get
+refunded and told why.
+
+Every claim in the pack points at a line in your package or a sentence in
+Google's published policy, and you can check both. It is written by an AI agent,
+which is the whole of what this business is; you are not being told a person did
+it.
+
+[What is in the pack](https://circadian-agent.com/webstore-lint)
+
 ## Provenance
 
 Policy data is generated from a dataset gathered on 2026-07-29 by direct HTTPS

package/action/report.mjs

@@ -131,6 +131,19 @@ export function summary(result, policy) {
   }
   lines.push("");
   lines.push("Run it yourself: `npx webstore-lint ./my-extension`");
+  // FAILING RUNS ONLY, and it keys on `fail` rather than on the exit code. With
+  // `fail-on: never` the check stays green while the findings are still there,
+  // and the reader still has the problem the pack answers. A run with warnings
+  // and no failures gets nothing, and a clean run returned above this line.
+  if (fail) {
+    lines.push("");
+    lines.push(
+      "Already rejected, or trying not to be? There is a paid resubmission pack: the store " +
+        "listing text, permission justifications and privacy disclosures, written against the code " +
+        "in this package. 149 USD once, refunded if we look and cannot help. " +
+        "[What is in it](https://circadian-agent.com/webstore-lint)",
+    );
+  }
   return lines.join("\n");
 }
 

package/bin/webstore-lint.mjs

@@ -299,7 +299,21 @@ console.log(
   "This reads your package only. Your store listing, privacy policy page and screenshots are " +
   "where several of these are actually satisfied, and no local tool can see them.",
 );
-console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint\n");
+console.log("webstore-lint is free and open source: https://github.com/Circadian-agent/chrome-extension-rejection-lint");
+// THE PAID PACK IS MENTIONED ON FAILING RUNS ONLY, and the condition is the
+// whole point. A clean run means the reader does not have this problem, and
+// putting an offer in front of them there is advertising rather than an answer.
+// A failing run means they are holding it right now. Keep it to three lines and
+// keep the price and the refund in them: a footer that hides either is the kind
+// of thing that gets a tool uninstalled.
+if (fail) {
+  console.log("");
+  console.log("Already rejected, or trying not to be? There is a paid resubmission pack: the store");
+  console.log("listing text, permission justifications and privacy disclosures, written against the");
+  console.log("code in this package. 149 USD once, refunded if we look and cannot help.");
+  console.log("https://circadian-agent.com/webstore-lint");
+}
+console.log("");
 // Same trap, same reason: the human report is also large on a real extension
 // and it is also piped (`webstore-lint . | less`, or into a file in CI). Setting
 // the code instead of calling exit() lets Node drain stdout and then leave with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",

package/src/rules.mjs

@@ -547,16 +547,98 @@ export const RULES = [
       // sites are real-looking calls (`eval('ale'+'rt(0)')`) that happen to sit
       // in a string, and nothing local separates them from a genuine call, so
       // they are LEFT FAILING rather than guessed at.
+      //
+      // SAME PROOF, ONE MORE SHAPE (s135, T-0413's second widening). `new
+      // Function("")` builds a function with an EMPTY BODY - calling it does
+      // nothing and returns undefined, exactly the no-op EVAL_NO_ARGS already
+      // carves out, just spelled with the other string-execution primitive.
+      // It is not a rare shape: it is pdf.js's own `isEvalSupported()` -
+      // `try { new Function(""); return true; } catch { return false; }` -
+      // vendored, byte-for-byte or minified, into every extension that bundles
+      // PDF rendering, and it is AngularJS's `noUnsafeEval()` doing the same
+      // CSP probe with `new Function('')`. Measured on this widened corpus:
+      // magnetgrouplabs/myjdownloader-extension-mv3 (angular.js), listen1's
+      // vendored angular.min.js, and pdf.js in both MLabPages/
+      // classroom-office-reviewer and ttop32/MouseTooltipTranslator all FAILed
+      // on nothing but this literal - four unrelated repos wrongly failed by
+      // one vendored idiom whose entire purpose is CHECKING FOR CSP-SAFETY,
+      // which makes the false accusation an especially bad look: the tool
+      // fails a package for the very check that proves it is eval-aware.
+      //
+      // AND `new Function()` WITH NO ARGUMENT AT ALL IS THE SAME NO-OP, spelled
+      // one character shorter (s137, T-0413's third widening). It builds
+      // `function anonymous() {}` - there is no string, so there is nothing for
+      // a string to arrive from. The old pattern required an empty QUOTED
+      // argument and therefore walked straight past the bare call.
+      //
+      // Measured on the 750-repo corpus: six files contain it and not one is
+      // string execution. They are `scripts/verify-extension.js`,
+      // `scripts/validate.mjs`, a security ARTICLE about MV3's CSP, and three
+      // test files named release-validator, secure-eval and safety. Every one is
+      // prose or a policy check that FORBIDS this call - the same shape as the
+      // pdf.js CSP probe above, and the same bad look: the tool failing a
+      // package for the check that proves the author is eval-aware.
+      // Mootong/x-twitter-media-downloader was FAILed on
+      //   assert(!/\bnew\s+Function\s*\(/.test(source), `new Function() is not allowed: ${filename}`)
+      // where the site is the ERROR MESSAGE of a build-time check asserting the
+      // shipped files contain no `new Function(` - sole evidence, at FAIL.
+      const NEW_FUNCTION_EMPTY_BODY = /^new\s+Function\s*\(\s*(?:(["'`])\s*\1\s*)?\)/;
+      // A `(` FOLLOWED IMMEDIATELY BY `?` IS NOT A CALL IN ANY JAVASCRIPT, which
+      // makes this the same kind of local proof as the empty argument list: `?`
+      // cannot begin an expression, so `eval(?` is a SyntaxError and the only
+      // thing that can produce it is a regex group opener - `(?:`, `(?=`, `(?!`,
+      // `(?<`. Two unrelated repos in the widened corpus, and both are regexes
+      // ABOUT eval rather than uses of it:
+      //
+      //   ha0z1/New-Bing-Anywhere (2116 stars) ships a highlight.js language
+      //     grammar in `dist/chromium/app/assets/index.js`, a 356 KB line whose
+      //     keyword alternation contains `|eval(?:cmd)?|`. That was the SOLE
+      //     evidence for a FAIL on a shipped build.
+      //   magicelk235/Viaduct-CLI validates a manifest's CSP with
+      //     `/(?:^|[\s;'"])unsafe-eval(?:[\s;'"]|$)/.test(csp)` - code whose
+      //     entire purpose is refusing unsafe-eval.
+      //
+      // Deliberately NOT a rule about regex literals in general. Telling a regex
+      // apart from a division needs a parser, and this file has already refused
+      // to let a quote-tracking scan silence findings (T-0416); this is one
+      // character of local syntax and needs neither.
+      const REGEX_GROUP_OPENER = /^(?:eval|new\s+Function)\s*\(\?/;
       const BUNDLER_GLOBAL_SHIM = /^new\s+Function\s*\(\s*(["'])return this\1\s*\)/;
       const EVAL_METHOD_DEF = /^eval\s*\(\s*(?:[A-Za-z_$][\w$]*(?:\s*,\s*[A-Za-z_$][\w$]*)*)?\s*\)\s*\{/;
       const EVAL_NO_ARGS = /^eval\s*\(\s*\)/;
+      // EVAL_METHOD_DEF ONLY CATCHES *UNTYPED* METHOD DEFINITIONS (s135, T-0413's
+      // second widening). Tardo/OdooTerminal declares
+      // `async eval(code: string, options?: Partial<EvalOptions>, isolated_frame?:
+      // boolean = false): Promise<any> {` on its terminal Shell class - a method
+      // named `eval` for evaluating a TERMINAL COMMAND, unrelated to the JS
+      // engine's `eval`. It is a method definition by the same logic as
+      // `openstyles/stylus`'s untyped one (a call is never followed by `){`... or
+      // here, by a TYPE), but EVAL_METHOD_DEF requires a plain identifier list
+      // immediately closed by `)\s*{`, and TypeScript/Flow signatures add type
+      // annotations, `?` optional markers, generics and default values that push
+      // the closing `{` well past this rule's 80-character lookahead window - so
+      // neither the old regex nor a wider version of it can reliably see the
+      // brace that proves this is a definition.
+      //
+      // THE SAFE SIGNAL DOES NOT NEED THE BRACE. `identifier:` (optionally
+      // `identifier?:`) directly inside the parens of `eval(...)` is not valid
+      // JavaScript or TypeScript CALL syntax - a bare `name: value` pair inside
+      // plain parens is a SyntaxError unless it is a parameter's type annotation
+      // in a function/method signature (an object-literal argument would need its
+      // own `{`, and a ternary's `cond ? a : b` always has whitespace or a `?`
+      // between the identifier and the colon that this pattern does not allow).
+      // So seeing `eval(` immediately followed by a plain identifier and a colon
+      // is sufficient on its own, well within the 80-character window, and cannot
+      // be produced by any real call to the global `eval`.
+      const EVAL_METHOD_DEF_TYPED = /^eval\s*\(\s*[A-Za-z_$][\w$]*\??\s*:/;
       const executesAString = (m, line) => {
         // m[1] is the leading non-identifier char of the eval branch, which is
         // part of the match but not part of the site.
         const at = m.index + (m[1] ? m[1].length : 0);
         const tail = line.slice(at, at + 80);
         return !BUNDLER_GLOBAL_SHIM.test(tail) && !EVAL_METHOD_DEF.test(tail)
-          && !EVAL_NO_ARGS.test(tail);
+          && !EVAL_NO_ARGS.test(tail) && !NEW_FUNCTION_EMPTY_BODY.test(tail)
+          && !EVAL_METHOD_DEF_TYPED.test(tail) && !REGEX_GROUP_OPENER.test(tail);
       };
       const source = new Map(files.map((f) => [f.path, f.lines]));
       const EVAL_RE = /(^|[^.\w$])eval\s*\(|new\s+Function\s*\(/;
@@ -931,7 +1013,20 @@ export const RULES = [
     category: "excessive-permissions",
     run({ manifest, files, skipped = [], oversized = [] }) {
       if (!manifest) return [];
-      const declared = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])];
+      // DEDUPED, because a manifest can and does list the same permission
+      // twice. bonigarcia/browserwatcher's `permissions` array is
+      // `["tabs","tabCapture","activeTab","storage","offscreen","storage"]` -
+      // a genuine copy-paste duplicate in the source, found widening the
+      // corpus (T-0413, s135). Without this, the finding read "Declared but
+      // never used: storage, storage", which looks like the TOOL is
+      // malfunctioning (double-counting) even though the underlying claim -
+      // storage really is unused - was correct either time. A `Set` cannot
+      // change which permissions are judged unused (the filter below still
+      // sees every distinct permission name exactly once, same as before for
+      // every manifest that does not have this bug), so this only removes a
+      // confusing repeated entry from the reported text; it cannot turn a
+      // true finding into a false one or vice versa.
+      const declared = [...new Set([...(manifest.permissions || []), ...(manifest.optional_permissions || [])])];
       // Comments blanked first. A permission whose only trace is "// we used to
       // call chrome.bookmarks.getTree here" is the COMMONEST real form of an
       // unused permission - the feature was deleted and the note left behind -
@@ -1194,14 +1289,68 @@ export const RULES = [
         "http://www.w3.org/1998/Math/MathML",
         "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
         "http://www.w3.org/2001/XMLSchema",
+        // s137, T-0413's third widening. The eight above are all w3.org, so the
+        // list encoded "specification namespace" as "a URL at w3.org" and the
+        // wider corpus walked round it immediately: OOXML (every extension that
+        // touches .docx or .xlsx), WS-Trust and XMLDSig (SAML tooling), EPUB,
+        // TTML and Inkscape's SVG extension namespace all arrive at other hosts
+        // and are names by exactly the same argument - fixed by a specification,
+        // never fetched, and unchangeable to https even in principle.
+        "http://schemas.openxmlformats.org/",
+        "http://schemas.microsoft.com/office/",
+        "http://docs.oasis-open.org/ws-sx/",
+        "http://docs.oasis-open.org/wss/",
+        "http://www.w3.org/2000/09/xmldsig#",
+        "http://www.w3.org/ns/ttml",
+        "http://www.idpf.org/2007/opf",
+        "http://www.idpf.org/2007/ops",
+        "http://www.inkscape.org/namespaces/inkscape",
+        "http://sodipodi.sourceforge.net/DTD/",
+        "http://purl.org/dc/elements/",
+        "http://ns.adobe.com/",
       ];
+      // A LIST OF HOSTS CANNOT KEEP UP, so the general form is POSITION rather
+      // than authority. These three syntactic slots hold a NAME by definition:
+      //
+      //   xmlns="..." / xmlns:prefix="..."   an XML namespace declaration
+      //   createElementNS("...", ...)        the namespace argument of the DOM
+      //   getElementsByTagNameNS("...", ...) *NS family - always argument one
+      //   <!DOCTYPE x PUBLIC "..." "...">    a DTD system identifier
+      //
+      // None of them is a channel anything travels over, none can be rewritten
+      // to https without breaking the document, and no amount of user data can
+      // flow to one. This is what the w3.org/.dtd special case below was
+      // reaching for one host at a time.
+      //
+      // ANCHORED TO WHAT PRECEDES THE OPENING QUOTE, so it cannot exonerate a
+      // fetch: `fetch("http://x")` has `fetch(` before the quote and matches
+      // none of these.
+      const NAME_POSITION =
+        /(?:xmlns(?::[A-Za-z_][\w.\-]*)?\s*=\s*|[A-Za-z]*NS\s*\(\s*|PUBLIC\s+(["'])[^"']*\1\s*|SYSTEM\s+)$/;
+      // A URL WHOSE AUTHORITY CONTAINS `*` IS A MATCH PATTERN, NOT AN ENDPOINT.
+      // `matches: ["http://*/*"]`, `urls: ["http://*/*"]`, documentUrlPatterns,
+      // optional_host_permissions - 26 of the 181 evidence entries this rule
+      // produced over the 750-repo corpus. There is no host to connect to, so
+      // no user data can be sent over it, and "make it https" is not a fix but a
+      // change to which pages the extension covers. Broad access IS reported,
+      // by broad-host-permissions, which reads the manifest keys where it means
+      // something.
+      const WILDCARD_AUTHORITY = /^http:\/\/[^/]*\*/;
       const hits = grep(
         codeView(files),
         /["'`]http:\/\/(?!localhost|127\.0\.0\.1|\[::1\])[^"'`\s]+/i,
         (f) => isCode(f) || isMarkup(f),
-      ).filter((h) => {
-        const url = String(h.match || "").replace(/^["'`]/, "");
+        // PER MATCH, so the scan continues along the same line - see grep() in
+        // scan.mjs. As a post-filter this dropped the whole line when its FIRST
+        // http:// was a namespace, so a real endpoint sharing a line with an
+        // `xmlns` attribute went unreported. An `accept` callback resumes at the
+        // next match instead, the same reason the remote-code skips are written
+        // this way (T-0414).
+        (m, line) => {
+        const url = String(m[0] || "").replace(/^["'`]/, "");
         if (XML_NAMESPACES.some((ns) => url.startsWith(ns))) return false;
+        if (WILDCARD_AUTHORITY.test(url)) return false;
+        if (NAME_POSITION.test(line.slice(Math.max(0, m.index - 80), m.index))) return false;
         // DOCTYPE system identifiers are the same case as namespaces and were
         // missed by the first pass: `<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//
         // EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">` names a
@@ -1215,7 +1364,8 @@ export const RULES = [
         // document is still a plain-http link and stays reported.
         if (/^https?:\/\/(www\.)?w3\.org\/[^"'`\s]*\.dtd$/i.test(url)) return false;
         return true;
-      });
+      },
+      );
       if (!hits.length) return [];
       return [finding({
         severity: "warn",
@@ -1419,8 +1569,46 @@ export const RULES = [
         return { ...f, text, lines: text.split("\n") };
       });
       const redirect = String.raw`(?:chrome|browser)\.tabs\.update\s*\(`;
+      // AND THE WINDOW MAY NOT CROSS A BLOCK THAT CLOSES (s137, T-0413's third
+      // widening). 200 characters was picked without a measurement, and the
+      // measurement arrived as this rule's FIRST firing in any corpus run we
+      // have: sindresorhus/notifier-for-github (1978 stars), at FAIL, on
+      // `source/lib/tabs-service.js`, where the two halves are
+      //
+      //   line  7:  'chrome://newtab/',            <- an element of emptyTabUrls
+      //   line 16:  return browser.tabs.update(tabId, options);
+      //
+      // and everything between them is `] : [];`, a blank line, and a COMPLETE
+      // `createTab` function. The gap is 193 characters, so the finding existed
+      // by a margin of seven. What that extension does with the list is reuse a
+      // blank tab you already have instead of opening another one - the opposite
+      // of replacing what you get when you open a new tab - and the
+      // `tabs.update` it was paired with is a two-line generic wrapper whose
+      // destination is a parameter.
+      //
+      // The header above already states the intent this misses: the window is
+      // there "so a predicate in one function [does not] pair with a navigation
+      // in an unrelated one further down the file". A character count cannot
+      // express that; a closing brace or bracket at the start of a line can. If
+      // a block ENDED between the two sites they are not on one control-flow
+      // path, and a hijack has to be - the test and the redirect it guards live
+      // in the same body.
+      //
+      // IT IS A NO-OP ON MINIFIED CODE, which is the safe direction: a bundle
+      // has no line starts, so nothing between two sites can match and every
+      // shipped-bundle hijack is judged exactly as before. Shrinking the 200
+      // instead would have hit minified and readable code alike while still
+      // being a number nobody could defend.
+      //
+      // THE LIMIT, STATED RATHER THAN DISCOVERED: a hijack that closes a block
+      // between the guard and the redirect - `if (isNtp(u)) { log(); }` and then
+      // an unguarded `tabs.update` - is now a miss. It joins the aliased-API and
+      // non-tabs.update misses the header already names. Weighed against a
+      // wrong FAIL on a well-known extension, on a rule that has produced no
+      // true positive in any corpus run, that is the trade this file keeps making.
+      const gap = String.raw`(?:(?!\n[\t ]*[}\]])[\s\S]){0,200}?`;
       const hits = grepAcross(view, new RegExp(
-        String.raw`(?:${NTP})[\s\S]{0,200}?${redirect}` + "|" + String.raw`${redirect}[\s\S]{0,200}?(?:${NTP})`,
+        String.raw`(?:${NTP})${gap}${redirect}` + "|" + String.raw`${redirect}${gap}(?:${NTP})`,
         "gi"), isCode);
       if (!hits.length) return [];
       return [finding({