webstore-lint 1.0.33 → 1.0.34

package/README.md

@@ -68,14 +68,27 @@ Pass one extension directory per command. If you maintain several extensions,
 run the command separately for each one. Multiple directories, including those
 expanded from a shell wildcard, are rejected before any checks run.
 
+Symbolic links inside the selected directory are listed as unread and produce a
+scan coverage warning. The scanner does not follow linked files or directories.
+Run it on a copy of the built extension containing regular files to check that
+code. A linked `manifest.json` makes the package unreadable. The Action fails on
+that case at every threshold; other skipped links trigger `fail-on: warn`.
+
 ## In GitHub Actions
 
 ```yaml
-- uses: Circadian-agent/chrome-extension-rejection-lint@v1
+- uses: Circadian-agent/chrome-extension-rejection-lint@v1.0.33
   with:
     path: ./extension
 ```
 
+This example pins [v1.0.33](https://github.com/Circadian-agent/chrome-extension-rejection-lint/releases/tag/v1.0.33),
+which includes the privacy-page timeout fix and refreshed Google policy citations.
+The floating `v1` tag still points to v1.0.30 as of 10 October 2026. If your workflow
+uses `@v1`, change it to `@v1.0.33` to include these fixes. Check the
+[release notes](https://github.com/Circadian-agent/chrome-extension-rejection-lint/releases)
+before updating the pin in future.
+
 Findings land on the offending line of the pull request diff, and the verdict
 goes on the checks tab, so a policy violation is visible where the review already
 is rather than in a build log nobody opens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.33",
+  "version": "1.0.34",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs test/symlinks.test.mjs"
   },
   "repository": {
     "type": "git",

package/src/rules.mjs

@@ -18,7 +18,7 @@
 // is worth less than none. When in doubt a rule warns and says what a human
 // must check.
 
-import { grep, grepAcross, grepLarge, largeWindows, isCode, isMarkup, codeView, excerptAround, htmlCommentRanges, insideHtmlComment, offsetOf } from "./scan.mjs";
+import { grep, grepAcross, grepLarge, largeWindows, isCode, isMarkup, codeView, excerptAround, htmlCommentRanges, insideHtmlComment, offsetOf, skippedPath } from "./scan.mjs";
 import {
   MANIFEST_EVIDENCE, PERMISSION_API, NO_NAMESPACE_PERMISSIONS,
   namespaceUsed, looksMinified, looksMinifiedLarge, bareImports,
@@ -157,8 +157,8 @@ function declaredFiles(manifest) {
 const missingCache = new WeakMap();
 function missingDeclaredOf(manifest, files, skipped = []) {
   if (missingCache.has(files)) return missingCache.get(files);
-  const present = new Set([...files.map((f) => norm(f.path)), ...skipped.map((s) => norm(s.path))]);
-  const v = declaredFiles(manifest).filter((d) => !present.has(d.path));
+  const present = new Set(files.map((f) => norm(f.path)));
+  const v = declaredFiles(manifest).filter((d) => !present.has(d.path) && !skippedPath(d.path, skipped));
   missingCache.set(files, v);
   return v;
 }
@@ -167,7 +167,23 @@ function missingDeclaredOf(manifest, files, skipped = []) {
 
 export const RULES = [
 
-  // FIRST, BECAUSE IT CHANGES HOW YOU READ EVERY OTHER FINDING. If this fires,
+  {
+    id: "symbolic-links",
+    run({ skipped = [] }) {
+      const links = skipped.filter(s => s.kind === "symlink");
+      if (!links.length) return [];
+      return [finding({
+        severity: "warn",
+        title: `${links.length} symbolic link(s) were not read; scan coverage is incomplete`,
+        detail: "Linked files and directories are not followed. Their targets may be outside this package or form a cycle. "
+          + "Scan a copy of the built extension containing regular files, then run the checks again. "
+          + "This warning describes a limit of this scan, not a Chrome Web Store policy violation.",
+        evidence: links.map(s => ({ file: s.path, text: s.why })),
+      })];
+    },
+  },
+
+  // This changes how you read every policy finding. If this fires,
   // the directory is not the thing Chrome would review, and every rule that
   // reasons from the ABSENCE of something is unreliable against it.
   //
@@ -1094,7 +1110,7 @@ export const RULES = [
       // someone to go looking by hand for a site the tool already found.
       const streamed = new Set(oversized.filter(isCode).map((o) => o.path));
       const unreadCode = skipped.filter((s) =>
-        /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
+        s.kind !== "symlink" && /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
       if (unreadCode.length) {
         out.push(finding({
           severity: "warn",
@@ -1194,7 +1210,7 @@ export const RULES = [
       // read.
       const streamed = new Set(largeCode.map((o) => o.path));
       const unread = skipped.filter((s) =>
-        /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
+        s.kind === "symlink" || (/\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path)));
       // AND THE ONES WE DID READ STILL COUNT TOWARD (2), which is the half that
       // matters. Having read the bytes of a bundle is not having seen the name:
       // over the 82 cached release packages, dropping the unread caveat without

package/src/scan.mjs

@@ -103,6 +103,16 @@ const TEXT_EXT = new Set([
   ".css", ".txt", ".md", ".webmanifest",
 ]);
 
+// A link may name a file or a whole directory. Its descendants are unknown,
+// not proven absent. Do not resolve the target just to make that distinction.
+export function skippedPath(path, skipped) {
+  const normalized = path.split(/[\\/]/).join("/");
+  return skipped.some(s => {
+    const entry = s.path.split(/[\\/]/).join("/");
+    return normalized === entry || (s.kind === "symlink" && normalized.startsWith(entry + "/"));
+  });
+}
+
 export function scan(root) {
   const files = [];
   const skipped = [];
@@ -123,6 +133,10 @@ export function scan(root) {
     for (const e of entries) {
       const full = join(dir, e.name);
       const rel = relative(root, full);
+      if (e.isSymbolicLink()) {
+        skipped.push({ path: rel, kind: "symlink", why: "symbolic link; target was not read" });
+        continue;
+      }
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name)) { skipped.push({ path: rel, why: "not part of a submitted package" }); continue; }
         walk(full);
@@ -153,7 +167,9 @@ export function scan(root) {
   let manifest = null;
   let manifestError = null;
   let manifestHint = null;
-  if (!existsSync(manifestPath)) {
+  if (skipped.some(s => s.path === "manifest.json" && s.kind === "symlink")) {
+    manifestError = "manifest.json is a symbolic link; its target was not read. Scan a package containing regular files.";
+  } else if (!existsSync(manifestPath)) {
     // NAME THE ACTUAL PROBLEM. "no manifest.json in this directory" was printed
     // for a path that is not a directory and for a path that does not exist at
     // all, which sends someone to look for a file in a folder that was never
@@ -233,7 +249,7 @@ export function resolveI18n(manifest, files, skipped = []) {
   // A locale file the scanner refused to read (over the size limit, unreadable)
   // is NOT evidence that a message is missing. Staying quiet there is the same
   // fail-safe direction as everything else in this file.
-  const wasSkipped = wanted ? skipped.some((s) => s.path.split(/[\\/]/).join("/") === wanted) : false;
+  const wasSkipped = wanted ? skippedPath(wanted, skipped) : false;
 
   let messages = null;
   if (file) {