webstore-lint 1.0.30 → 1.0.32

package/README.md

@@ -64,6 +64,10 @@ git clone https://github.com/Circadian-agent/chrome-extension-rejection-lint
 node chrome-extension-rejection-lint/bin/webstore-lint.mjs ./my-extension
 ```
 
+Pass one extension directory per command. If you maintain several extensions,
+run the command separately for each one. Multiple directories, including those
+expanded from a shell wildcard, are rejected before any checks run.
+
 ## In GitHub Actions
 
 ```yaml
@@ -343,6 +347,10 @@ What it reports:
 It checks *reachability*. It does not judge whether your policy is adequate,
 which is the thing a reviewer actually reads it for.
 
+The request has a ten-second deadline, including downloading the page body.
+A timeout or interrupted download produces a network warning, with no verdict
+on the unread page's content.
+
 ## What it cannot do
 
 It reads your package. It cannot see your store listing, your screenshots or your

package/bin/webstore-lint.mjs

@@ -70,7 +70,8 @@ for (const f of VALUED) {
   const i = args.indexOf(f);
   if (i >= 0 && args[i + 1] && !args[i + 1].startsWith("--")) consumed.add(i + 1);
 }
-const target = args.find((a, i) => !a.startsWith("--") && !consumed.has(i));
+const targets = args.filter((a, i) => !a.startsWith("--") && !consumed.has(i));
+const target = targets[0];
 const policyUrl = valueOf("--privacy-policy");
 
 if (flags.has("--help") || (!target && !flags.has("--policy"))) {
@@ -89,6 +90,7 @@ if (flags.has("--help") || (!target && !flags.has("--policy"))) {
   webstore-lint --policy                list the policy data this build carries
 
 Use --permissions, --privacy-policy and --policy in separate commands.
+Check one extension directory per command.
 
 The one-liner, no install needed:
   npx webstore-lint <extension-directory>
@@ -102,6 +104,14 @@ not affiliated with Google. A clean run is not a promise of approval.`);
   process.exit(flags.has("--help") ? 0 : 2);
 }
 
+// A second directory (including a shell-expanded glob) must not be silently
+// ignored: the first extension can pass while the unexamined one would fail.
+if (targets.length > 1) {
+  console.error("Pass only one extension directory per command. No checks were run.");
+  console.error("Run webstore-lint separately for each extension directory.");
+  process.exit(2);
+}
+
 // These branches produce different reports and return early. Combining them
 // used to exit successfully after silently skipping an explicitly requested
 // check, including a broken privacy URL. Reject before producing any report.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.30",
+  "version": "1.0.32",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs"
   },
   "repository": {
     "type": "git",

package/src/privacy.mjs

@@ -118,6 +118,7 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), timeoutMs);
   let res;
+  let body;
   try {
     res = await fetchImpl(u.href, {
       signal: ctl.signal,
@@ -129,24 +130,30 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
         "user-agent": "webstore-lint (privacy policy reachability check)",
       },
     });
+    // fetch resolves at headers. Keep the deadline active until the body is
+    // complete too, or a stalled page can hang the CLI and Action indefinitely.
+    if (res.ok) body = await res.text();
+    else ctl.abort(); // The status is enough evidence; do not download its body.
   } catch (e) {
-    clearTimeout(timer);
     // COULD NOT LOOK IS NOT THE SAME FACT AS NOT THERE. A DNS failure on the
     // developer's own machine, an offline CI runner or a proxy is not evidence
     // about the URL, so this warns and says which it is rather than failing.
-    const aborted = e.name === "AbortError";
+    const aborted = ctl.signal.aborted || e.name === "AbortError";
     return [...findings, f(
       "warn",
       aborted
-        ? `The privacy policy URL did not answer within ${timeoutMs / 1000}s`
-        : `The privacy policy URL could not be reached from here: ${e.message}`,
+        ? `The privacy policy URL did not finish loading within ${timeoutMs / 1000}s`
+        : res
+          ? `The privacy policy response could not be read from here: ${e.message}`
+          : `The privacy policy URL could not be reached from here: ${e.message}`,
       "This is not the same as the address being broken. It may be your network, a proxy, or an offline " +
         "runner. Open it yourself in a private browser window before you trust either answer. " +
         "A reviewer will be doing exactly that.",
       [{ file: "--privacy-policy", text: url }],
     )];
+  } finally {
+    clearTimeout(timer);
   }
-  clearTimeout(timer);
 
   const finalUrl = res.url || u.href;
   const redirected = finalUrl.replace(/\/$/, "") !== u.href.replace(/\/$/, "");
@@ -163,13 +170,6 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
     )];
   }
 
-  let body = "";
-  try {
-    body = await res.text();
-  } catch {
-    body = "";
-  }
-
   // Strip tags and scripts before counting words, or a single-page app's bundle
   // reads as a wall of text that mentions everything.
   const text = body