webstore-lint 1.0.24 → 1.0.26

package/README.md

@@ -345,7 +345,7 @@ connected to Google.
 contain the static signals Google names. Reviewers are human and see more than a
 file tree.
 
-## If you have already been rejected
+## If you have been rejected, or warned
 
 The linter is free and always will be, and it tells you what is wrong. Writing
 the way back through review is a separate job, and it is the paid one: a
@@ -356,6 +356,17 @@ and data use answers, and the privacy disclosures to match. Delivered by email
 within two business days. If we look at your extension and cannot help, you get
 refunded and told why.
 
+**Two of Google's enforcement paths land here and only one of them has a
+deadline.** A rejected submission leaves your published listing completely
+unaffected and your users are never notified, so nothing is at risk while you
+work. An extension that is *already published* and found in minor violation is
+the other path: Google emails the publisher, who is
+["typically given 7 to 30 days to address the issue(s)"](https://developer.chrome.com/docs/webstore/review-process),
+and if it is not addressed the extension is taken down. The same page states
+that a violation found in a submission may trigger a review of the published
+version, so shipping an update is one way to start that clock. Two business days
+fits inside the shortest of those windows.
+
 Every claim in the pack points at a line in your package or a sentence in
 Google's published policy, and you can check both. It is written by an AI agent,
 which is the whole of what this business is; you are not being told a person did

package/action/report.mjs

@@ -138,11 +138,22 @@ export function summary(result, policy) {
   if (fail) {
     lines.push("");
     lines.push(
-      "Already rejected, or trying not to be? There is a paid resubmission pack: the store " +
+      "Rejected, warned, or trying not to be? There is a paid resubmission pack: the store " +
         "listing text, permission justifications and privacy disclosures, written against the code " +
         "in this package. 149 USD once, refunded if we look and cannot help. " +
         "[What is in it](https://circadian-agent.com/webstore-lint)",
     );
+    // THE DEADLINE SENTENCE, added s145 (T-0639). Same reasoning as the CLI
+    // footer: of Google's two enforcement paths only one has a clock, and this
+    // reader is running the linter in CI on a published extension, so they are
+    // the likelier of the two to be holding a dated email. Verbatim quote.
+    lines.push("");
+    lines.push(
+      "If the extension is already published and Google has emailed you about a policy, that " +
+        "notice is [\"typically given 7 to 30 days to address the issue(s)\"]" +
+        "(https://developer.chrome.com/docs/webstore/review-process) before the extension is " +
+        "taken down. The pack is delivered in two business days.",
+    );
   }
   return lines.join("\n");
 }

package/bin/webstore-lint.mjs

@@ -308,9 +308,19 @@ console.log("webstore-lint is free and open source: https://github.com/Circadian
 // of thing that gets a tool uninstalled.
 if (fail) {
   console.log("");
-  console.log("Already rejected, or trying not to be? There is a paid resubmission pack: the store");
+  console.log("Rejected, warned, or trying not to be? There is a paid resubmission pack: the store");
   console.log("listing text, permission justifications and privacy disclosures, written against the");
   console.log("code in this package. 149 USD once, refunded if we look and cannot help.");
+  // THE SECOND SENTENCE IS THE ONE WITH A CLOCK IN IT, added s145 (T-0639).
+  // Google's review-process page documents two enforcement paths and only one of
+  // them has a deadline. A rejected submission leaves the published listing
+  // untouched and never notifies a single user, so that reader can take a month.
+  // A published item found in minor violation is emailed and "typically given 7
+  // to 30 days to address the issue(s)", then taken down. Quoted rather than
+  // paraphrased because the number is the whole reason anybody hurries.
+  console.log("If your extension is already published and Google has emailed you about a policy,");
+  console.log("that notice is typically 7 to 30 days before the extension is taken down. The pack");
+  console.log("is delivered in two business days, which fits inside the shortest of those windows.");
   console.log("https://circadian-agent.com/webstore-lint");
 }
 console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.24",
+  "version": "1.0.26",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",

package/src/rules.mjs

@@ -665,7 +665,72 @@ export const RULES = [
         // separately so a 4 MB content script produces the same FAIL as a 4 KB
         // one; the size of the file is the tool's problem, not the developer's.
         .concat(grepLarge(oversized, EVAL_RE, { filter: isCode, code: true, accept: executesAString }));
-      split(evals, (shipped, tests) => shipped.length
+      // A DECLARED SANDBOX PAGE IS WHERE CHROME TELLS YOU TO PUT eval, and until
+      // s147 this rule FAILed the developers who followed that advice. Found by
+      // running the corpus against the new code-search index: vladlavrik/netify
+      // declares `"sandbox": {"pages": ["sandbox.html"]}` with a sandbox CSP of
+      // `... 'unsafe-inline' 'unsafe-eval'`, and its one eval site is
+      // `services/sandbox/executor/SandboxExecutor.ts` - the executor that RUNS
+      // in that page. That is the documented, sanctioned escape hatch, and we
+      // were reporting it at the top severity.
+      //
+      // This is the worst direction for a linter to be wrong in, and it is worse
+      // than the usual wrong FAIL: it fires hardest on the developer who read
+      // the policy and did the compliant thing, which is precisely the developer
+      // whose trust the tool needs.
+      //
+      // A SANDBOX DOES NOT LAUNDER THE WHOLE PACKAGE, so this is a partition and
+      // not an exemption. The manifest itself names the files that can never be
+      // sandboxed - the service worker and every declared content script - and
+      // eval in one of those is a violation whatever else the package declares.
+      // Those keep FAILing. Everything else becomes a warn that says plainly
+      // that the tool cannot tell which side of the boundary the call sits on,
+      // because from the file alone it genuinely cannot.
+      //
+      // AN EMPTY `sandbox.pages` IS NOT A SANDBOX, and a custom sandbox CSP that
+      // REMOVES 'unsafe-eval' is not one either - Chrome's default sandbox CSP
+      // grants it, so absence of a custom CSP means granted, but an explicit one
+      // that drops the token means the page cannot eval and the finding stands.
+      const sandboxPages = (manifest?.sandbox?.pages || []).filter(Boolean);
+      const sandboxCsp = manifest?.content_security_policy?.sandbox;
+      const sandboxAllowsEval = sandboxPages.length > 0
+        && (typeof sandboxCsp !== "string" || /'unsafe-eval'/.test(sandboxCsp));
+
+      // Named by the manifest, so this is not a guess about the file's role.
+      const norm = (p) => String(p).replace(/^\.?\//, "").toLowerCase();
+      const neverSandboxable = new Set();
+      if (manifest?.background?.service_worker) neverSandboxable.add(norm(manifest.background.service_worker));
+      for (const s of manifest?.background?.scripts || []) neverSandboxable.add(norm(s));
+      for (const cs of manifest?.content_scripts || []) {
+        for (const j of cs?.js || []) neverSandboxable.add(norm(j));
+      }
+
+      let evalsForSplit = evals;
+      if (sandboxAllowsEval) {
+        const hard = evals.filter((h) => neverSandboxable.has(norm(h.file)));
+        const soft = evals.filter((h) => !neverSandboxable.has(norm(h.file)));
+        evalsForSplit = hard;
+        // Emitted whenever there are any, never gated on the FAIL being absent -
+        // the same reasoning as the website partition above. A package with one
+        // service-worker eval and four sandbox-plausible ones must report all
+        // five, or the partition has quietly become a deletion.
+        if (soft.length) {
+          out.push(finding({
+            severity: "warn",
+            title: `eval() or new Function(), in a package that declares a sandboxed page (${soft.length} site(s))`,
+            detail:
+              "Your manifest declares sandbox.pages, and Chrome permits eval inside a sandboxed page - it is the "
+              + "documented way to execute a string in an extension. None of these sites is in your service worker "
+              + "or in a declared content script, so this tool cannot tell from the file alone whether they run "
+              + "inside the sandbox. If they do, they are allowed and you can ignore this. If any of them is "
+              + "reached from an ordinary extension page instead, it is still the violation Google names."
+              + ` Sandboxed page(s) declared: ${sandboxPages.join(", ")}.`,
+            evidence: soft,
+          }));
+        }
+      }
+
+      split(evalsForSplit, (shipped, tests) => shipped.length
         ? finding({
             severity: "fail",
             title: "eval() or new Function() executes a string as code",