webstore-lint 1.0.29 → 1.0.31

package/README.md

@@ -64,6 +64,10 @@ git clone https://github.com/Circadian-agent/chrome-extension-rejection-lint
 node chrome-extension-rejection-lint/bin/webstore-lint.mjs ./my-extension
 ```
 
+Pass one extension directory per command. If you maintain several extensions,
+run the command separately for each one. Multiple directories, including those
+expanded from a shell wildcard, are rejected before any checks run.
+
 ## In GitHub Actions
 
 ```yaml
@@ -311,6 +315,17 @@ npx webstore-lint ./my-extension \
 This is the only flag that touches the network, and only when you pass a URL.
 Without it the tool opens no sockets at all.
 
+Run the privacy URL check and the permission ledger as separate commands:
+
+```bash
+npx webstore-lint ./my-extension --privacy-policy https://example.com/privacy
+npx webstore-lint ./my-extension --permissions
+```
+
+Combining `--privacy-policy`, `--permissions` or `--policy` is a usage error
+(exit 2). No checks run for that combination. `--json` works with either the
+privacy check or the permission ledger.
+
 It exists because of a real rejection. A developer was rejected under **Purple
 Lithium** and the cause was mundane: the privacy policy URL in their listing
 404'd, because the GitHub repository serving it was private. It looks perfectly

package/bin/webstore-lint.mjs

@@ -70,7 +70,8 @@ for (const f of VALUED) {
   const i = args.indexOf(f);
   if (i >= 0 && args[i + 1] && !args[i + 1].startsWith("--")) consumed.add(i + 1);
 }
-const target = args.find((a, i) => !a.startsWith("--") && !consumed.has(i));
+const targets = args.filter((a, i) => !a.startsWith("--") && !consumed.has(i));
+const target = targets[0];
 const policyUrl = valueOf("--privacy-policy");
 
 if (flags.has("--help") || (!target && !flags.has("--policy"))) {
@@ -88,6 +89,9 @@ if (flags.has("--help") || (!target && !flags.has("--policy"))) {
                                         and only when you pass a url
   webstore-lint --policy                list the policy data this build carries
 
+Use --permissions, --privacy-policy and --policy in separate commands.
+Check one extension directory per command.
+
 The one-liner, no install needed:
   npx webstore-lint <extension-directory>
 
@@ -100,6 +104,27 @@ not affiliated with Google. A clean run is not a promise of approval.`);
   process.exit(flags.has("--help") ? 0 : 2);
 }
 
+// A second directory (including a shell-expanded glob) must not be silently
+// ignored: the first extension can pass while the unexamined one would fail.
+if (targets.length > 1) {
+  console.error("Pass only one extension directory per command. No checks were run.");
+  console.error("Run webstore-lint separately for each extension directory.");
+  process.exit(2);
+}
+
+// These branches produce different reports and return early. Combining them
+// used to exit successfully after silently skipping an explicitly requested
+// check, including a broken privacy URL. Reject before producing any report.
+const modes = ["--permissions", "--privacy-policy", "--policy"].filter(f => flags.has(f));
+if (modes.length > 1) {
+  console.error(`${modes.join(", ")} cannot be combined. No checks were run.`);
+  console.error("Run each mode separately:");
+  console.error("  webstore-lint <extension-directory> --permissions");
+  console.error("  webstore-lint <extension-directory> --privacy-policy <url>");
+  console.error("  webstore-lint --policy");
+  process.exit(2);
+}
+
 if (flags.has("--policy")) {
   console.log(`${Object.keys(POLICY.categories).length} verified rejection categories, from ${POLICY.generatedFrom}\n`);
   for (const [id, c] of Object.entries(POLICY.categories)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.29",
+  "version": "1.0.31",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs"
   },
   "repository": {
     "type": "git",