webstore-lint 1.0.31 → 1.0.32

package/README.md

@@ -347,6 +347,10 @@ What it reports:
 It checks *reachability*. It does not judge whether your policy is adequate,
 which is the thing a reviewer actually reads it for.
 
+The request has a ten-second deadline, including downloading the page body.
+A timeout or interrupted download produces a network warning, with no verdict
+on the unread page's content.
+
 ## What it cannot do
 
 It reads your package. It cannot see your store listing, your screenshots or your

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.31",
+  "version": "1.0.32",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs"
   },
   "repository": {
     "type": "git",

package/src/privacy.mjs

@@ -118,6 +118,7 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), timeoutMs);
   let res;
+  let body;
   try {
     res = await fetchImpl(u.href, {
       signal: ctl.signal,
@@ -129,24 +130,30 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
         "user-agent": "webstore-lint (privacy policy reachability check)",
       },
     });
+    // fetch resolves at headers. Keep the deadline active until the body is
+    // complete too, or a stalled page can hang the CLI and Action indefinitely.
+    if (res.ok) body = await res.text();
+    else ctl.abort(); // The status is enough evidence; do not download its body.
   } catch (e) {
-    clearTimeout(timer);
     // COULD NOT LOOK IS NOT THE SAME FACT AS NOT THERE. A DNS failure on the
     // developer's own machine, an offline CI runner or a proxy is not evidence
     // about the URL, so this warns and says which it is rather than failing.
-    const aborted = e.name === "AbortError";
+    const aborted = ctl.signal.aborted || e.name === "AbortError";
     return [...findings, f(
       "warn",
       aborted
-        ? `The privacy policy URL did not answer within ${timeoutMs / 1000}s`
-        : `The privacy policy URL could not be reached from here: ${e.message}`,
+        ? `The privacy policy URL did not finish loading within ${timeoutMs / 1000}s`
+        : res
+          ? `The privacy policy response could not be read from here: ${e.message}`
+          : `The privacy policy URL could not be reached from here: ${e.message}`,
       "This is not the same as the address being broken. It may be your network, a proxy, or an offline " +
         "runner. Open it yourself in a private browser window before you trust either answer. " +
         "A reviewer will be doing exactly that.",
       [{ file: "--privacy-policy", text: url }],
     )];
+  } finally {
+    clearTimeout(timer);
   }
-  clearTimeout(timer);
 
   const finalUrl = res.url || u.href;
   const redirected = finalUrl.replace(/\/$/, "") !== u.href.replace(/\/$/, "");
@@ -163,13 +170,6 @@ export async function checkPolicyUrl(url, { timeoutMs = 10000, fetchImpl = fetch
     )];
   }
 
-  let body = "";
-  try {
-    body = await res.text();
-  } catch {
-    body = "";
-  }
-
   // Strip tags and scripts before counting words, or a single-page app's bundle
   // reads as a wall of text that mentions everything.
   const text = body