webstore-lint 1.0.29 → 1.0.30

package/README.md

@@ -311,6 +311,17 @@ npx webstore-lint ./my-extension \
 This is the only flag that touches the network, and only when you pass a URL.
 Without it the tool opens no sockets at all.
 
+Run the privacy URL check and the permission ledger as separate commands:
+
+```bash
+npx webstore-lint ./my-extension --privacy-policy https://example.com/privacy
+npx webstore-lint ./my-extension --permissions
+```
+
+Combining `--privacy-policy`, `--permissions` or `--policy` is a usage error
+(exit 2). No checks run for that combination. `--json` works with either the
+privacy check or the permission ledger.
+
 It exists because of a real rejection. A developer was rejected under **Purple
 Lithium** and the cause was mundane: the privacy policy URL in their listing
 404'd, because the GitHub repository serving it was private. It looks perfectly

package/bin/webstore-lint.mjs

@@ -88,6 +88,8 @@ if (flags.has("--help") || (!target && !flags.has("--policy"))) {
                                         and only when you pass a url
   webstore-lint --policy                list the policy data this build carries
 
+Use --permissions, --privacy-policy and --policy in separate commands.
+
 The one-liner, no install needed:
   npx webstore-lint <extension-directory>
 
@@ -100,6 +102,19 @@ not affiliated with Google. A clean run is not a promise of approval.`);
   process.exit(flags.has("--help") ? 0 : 2);
 }
 
+// These branches produce different reports and return early. Combining them
+// used to exit successfully after silently skipping an explicitly requested
+// check, including a broken privacy URL. Reject before producing any report.
+const modes = ["--permissions", "--privacy-policy", "--policy"].filter(f => flags.has(f));
+if (modes.length > 1) {
+  console.error(`${modes.join(", ")} cannot be combined. No checks were run.`);
+  console.error("Run each mode separately:");
+  console.error("  webstore-lint <extension-directory> --permissions");
+  console.error("  webstore-lint <extension-directory> --privacy-policy <url>");
+  console.error("  webstore-lint --policy");
+  process.exit(2);
+}
+
 if (flags.has("--policy")) {
   console.log(`${Object.keys(POLICY.categories).length} verified rejection categories, from ${POLICY.generatedFrom}\n`);
   for (const [id, c] of Object.entries(POLICY.categories)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.29",
+  "version": "1.0.30",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs"
   },
   "repository": {
     "type": "git",