webstore-lint 1.0.33 → 1.0.35

package/README.md

@@ -68,14 +68,35 @@ Pass one extension directory per command. If you maintain several extensions,
 run the command separately for each one. Multiple directories, including those
 expanded from a shell wildcard, are rejected before any checks run.
 
+Symbolic links inside the selected directory are listed as unread and produce a
+scan coverage warning. The scanner does not follow linked files or directories.
+Run it on a copy of the built extension containing regular files to check that
+code. A linked `manifest.json` makes the package unreadable. The Action fails on
+that case at every threshold; other skipped links trigger `fail-on: warn`.
+
+The tool also warns when `content_scripts` names an unsupported JavaScript or
+stylesheet file type. Chrome skips the entire entry, including its other files.
+Use built `.js` or `.mjs` scripts and `.css` stylesheets, then reload the unpacked
+extension to verify it runs. `.user.js` is supported, and Chrome accepts `.scss`
+for compatibility without compiling Sass. This loading warning has no policy
+codename and triggers the Action's `fail-on: warn` threshold. See
+[Chromium's file-type validation](https://chromium.googlesource.com/chromium/src/+/main/extensions/common/utils/content_script_utils.cc).
+
 ## In GitHub Actions
 
 ```yaml
-- uses: Circadian-agent/chrome-extension-rejection-lint@v1
+- uses: Circadian-agent/chrome-extension-rejection-lint@v1.0.33
   with:
     path: ./extension
 ```
 
+This example pins [v1.0.33](https://github.com/Circadian-agent/chrome-extension-rejection-lint/releases/tag/v1.0.33),
+which includes the privacy-page timeout fix and refreshed Google policy citations.
+The floating `v1` tag still points to v1.0.30 as of 10 October 2026. If your workflow
+uses `@v1`, change it to `@v1.0.33` to include these fixes. Check the
+[release notes](https://github.com/Circadian-agent/chrome-extension-rejection-lint/releases)
+before updating the pin in future.
+
 Findings land on the offending line of the pull request diff, and the verdict
 goes on the checks tab, so a policy violation is visible where the review already
 is rather than in a build log nobody opens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webstore-lint",
-  "version": "1.0.33",
+  "version": "1.0.35",
   "description": "Check an unpacked Chrome extension against the Chrome Web Store program policies before you submit it. Every finding cites Google's own notification ID and verbatim policy text. Covers the 1 August 2026 policy updates.",
   "keywords": [
     "chrome-extension",
@@ -38,7 +38,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs"
+    "test": "node test/lint.test.mjs && node test/action.test.mjs && node --test test/permissions-output.test.mjs test/cli-modes.test.mjs test/privacy-timeout.test.mjs test/symlinks.test.mjs test/content-script-types.test.mjs"
   },
   "repository": {
     "type": "git",

package/src/rules.mjs

@@ -18,7 +18,7 @@
 // is worth less than none. When in doubt a rule warns and says what a human
 // must check.
 
-import { grep, grepAcross, grepLarge, largeWindows, isCode, isMarkup, codeView, excerptAround, htmlCommentRanges, insideHtmlComment, offsetOf } from "./scan.mjs";
+import { grep, grepAcross, grepLarge, largeWindows, isCode, isMarkup, codeView, excerptAround, htmlCommentRanges, insideHtmlComment, offsetOf, skippedPath } from "./scan.mjs";
 import {
   MANIFEST_EVIDENCE, PERMISSION_API, NO_NAMESPACE_PERMISSIONS,
   namespaceUsed, looksMinified, looksMinifiedLarge, bareImports,
@@ -128,6 +128,30 @@ function bareOf(files) {
 // reads text files, so an icon that is present would be invisible to the check
 // and would report as missing on every package in the world.
 const norm = (p) => String(p).split(/[\\/]/).join("/").replace(/^\.\//, "").replace(/[?#].*$/, "");
+
+// Chromium validates content-script types from the filename, before reading
+// the resource. A bad type causes the whole content_scripts entry to be skipped.
+// SCSS is explicitly allowed for compatibility; this does not compile Sass.
+// Verified against extensions/common/utils/content_script_utils.cc and
+// net/base/mime_util.cc in Chromium, plus browser probes on 10 October 2026.
+const supportedContentFile = (path, type) =>
+  (type === "js" ? /\.(?:js|mjs)$/i : /\.(?:css|scss)$/i).test(path);
+
+function invalidContentFiles(manifest) {
+  const out = [];
+  const scripts = Array.isArray(manifest?.content_scripts) ? manifest.content_scripts : [];
+  for (const [index, script] of scripts.entries()) {
+    for (const type of ["js", "css"]) {
+      for (const path of Array.isArray(script?.[type]) ? script[type] : []) {
+        if (typeof path === "string" && !supportedContentFile(path, type)) {
+          out.push({ path, key: `content_scripts[${index}].${type}` });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 function declaredFiles(manifest) {
   const m = manifest || {};
   const out = [];
@@ -136,8 +160,10 @@ function declaredFiles(manifest) {
   add(m.background?.page, "background.page");
   for (const s of m.background?.scripts || []) add(s, "background.scripts");
   for (const cs of m.content_scripts || []) {
-    for (const j of cs.js || []) add(j, "content_scripts[].js");
-    for (const c of cs.css || []) add(c, "content_scripts[].css");
+    // Unsupported types get their own loading warning. They may exist even
+    // when the scanner does not read that suffix, so do not call them missing.
+    for (const j of cs.js || []) if (supportedContentFile(j, "js")) add(j, "content_scripts[].js");
+    for (const c of cs.css || []) if (supportedContentFile(c, "css")) add(c, "content_scripts[].css");
   }
   add(m.action?.default_popup, "action.default_popup");
   add(m.browser_action?.default_popup, "browser_action.default_popup");
@@ -157,8 +183,8 @@ function declaredFiles(manifest) {
 const missingCache = new WeakMap();
 function missingDeclaredOf(manifest, files, skipped = []) {
   if (missingCache.has(files)) return missingCache.get(files);
-  const present = new Set([...files.map((f) => norm(f.path)), ...skipped.map((s) => norm(s.path))]);
-  const v = declaredFiles(manifest).filter((d) => !present.has(d.path));
+  const present = new Set(files.map((f) => norm(f.path)));
+  const v = declaredFiles(manifest).filter((d) => !present.has(d.path) && !skippedPath(d.path, skipped));
   missingCache.set(files, v);
   return v;
 }
@@ -167,7 +193,40 @@ function missingDeclaredOf(manifest, files, skipped = []) {
 
 export const RULES = [
 
-  // FIRST, BECAUSE IT CHANGES HOW YOU READ EVERY OTHER FINDING. If this fires,
+  {
+    id: "content-script-file-types",
+    run({ manifest }) {
+      const invalid = invalidContentFiles(manifest);
+      if (!invalid.length) return [];
+      return [finding({
+        severity: "warn",
+        title: `${invalid.length} content-script resource(s) have an unsupported file type`,
+        detail: "Chrome skips an entire content_scripts entry when any of its js or css filenames has an unsupported file type. "
+          + "Point js at built .js or .mjs files, and css at .css files, then reload the unpacked extension to verify it runs. "
+          + "The .user.js suffix is supported. Chrome also accepts .scss for compatibility, but does not compile Sass. "
+          + "This is a loading check, not a Chrome Web Store policy violation or a reason to delete permissions.",
+        evidence: invalid.map(d => ({ file: "manifest.json", line: 1, text: `${d.key}: ${d.path}` })),
+      })];
+    },
+  },
+
+  {
+    id: "symbolic-links",
+    run({ skipped = [] }) {
+      const links = skipped.filter(s => s.kind === "symlink");
+      if (!links.length) return [];
+      return [finding({
+        severity: "warn",
+        title: `${links.length} symbolic link(s) were not read; scan coverage is incomplete`,
+        detail: "Linked files and directories are not followed. Their targets may be outside this package or form a cycle. "
+          + "Scan a copy of the built extension containing regular files, then run the checks again. "
+          + "This warning describes a limit of this scan, not a Chrome Web Store policy violation.",
+        evidence: links.map(s => ({ file: s.path, text: s.why })),
+      })];
+    },
+  },
+
+  // This changes how you read every policy finding. If this fires,
   // the directory is not the thing Chrome would review, and every rule that
   // reasons from the ABSENCE of something is unreliable against it.
   //
@@ -1094,7 +1153,7 @@ export const RULES = [
       // someone to go looking by hand for a site the tool already found.
       const streamed = new Set(oversized.filter(isCode).map((o) => o.path));
       const unreadCode = skipped.filter((s) =>
-        /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
+        s.kind !== "symlink" && /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
       if (unreadCode.length) {
         out.push(finding({
           severity: "warn",
@@ -1194,7 +1253,7 @@ export const RULES = [
       // read.
       const streamed = new Set(largeCode.map((o) => o.path));
       const unread = skipped.filter((s) =>
-        /\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path));
+        s.kind === "symlink" || (/\.(js|mjs|cjs|ts|jsx|tsx|html?)$/i.test(s.path || "") && !streamed.has(s.path)));
       // AND THE ONES WE DID READ STILL COUNT TOWARD (2), which is the half that
       // matters. Having read the bytes of a bundle is not having seen the name:
       // over the 82 cached release packages, dropping the unread caveat without
@@ -1211,8 +1270,11 @@ export const RULES = [
       // names dist/background.js and we were linting a folder of seven JSON
       // files - "never used" there is a claim about nothing at all.
       const gone = missingDeclaredOf(manifest, files, skipped);
-      if (unread.length || minified.length || bare.length || gone.length) {
-        const why = gone.length
+      const invalidTypes = invalidContentFiles(manifest);
+      if (unread.length || minified.length || bare.length || gone.length || invalidTypes.length) {
+        const why = invalidTypes.length
+          ? `a content_scripts entry has an unsupported file type (${invalidTypes[0].path}); fix that loading error before deciding whether these permissions are unused`
+          : gone.length
           ? `manifest.json names ${gone.length} file(s) that are not in this directory (${gone[0].key}: ${gone[0].path}), so the code that uses these permissions is not here to be read`
           : unread.length
           ? `${unread.length} code file(s) in this package were not read (${unread[0].path}: ${unread[0].why}), so this scan did not see all of your code`

package/src/scan.mjs

@@ -100,9 +100,19 @@ export function buildHint(root, exists = existsSync) {
 const MAX_BYTES = 2 * 1024 * 1024;
 const TEXT_EXT = new Set([
   ".js", ".mjs", ".cjs", ".ts", ".jsx", ".tsx", ".json", ".html", ".htm",
-  ".css", ".txt", ".md", ".webmanifest",
+  ".css", ".scss", ".txt", ".md", ".webmanifest",
 ]);
 
+// A link may name a file or a whole directory. Its descendants are unknown,
+// not proven absent. Do not resolve the target just to make that distinction.
+export function skippedPath(path, skipped) {
+  const normalized = path.split(/[\\/]/).join("/");
+  return skipped.some(s => {
+    const entry = s.path.split(/[\\/]/).join("/");
+    return normalized === entry || (s.kind === "symlink" && normalized.startsWith(entry + "/"));
+  });
+}
+
 export function scan(root) {
   const files = [];
   const skipped = [];
@@ -123,6 +133,10 @@ export function scan(root) {
     for (const e of entries) {
       const full = join(dir, e.name);
       const rel = relative(root, full);
+      if (e.isSymbolicLink()) {
+        skipped.push({ path: rel, kind: "symlink", why: "symbolic link; target was not read" });
+        continue;
+      }
       if (e.isDirectory()) {
         if (SKIP_DIRS.has(e.name)) { skipped.push({ path: rel, why: "not part of a submitted package" }); continue; }
         walk(full);
@@ -153,7 +167,9 @@ export function scan(root) {
   let manifest = null;
   let manifestError = null;
   let manifestHint = null;
-  if (!existsSync(manifestPath)) {
+  if (skipped.some(s => s.path === "manifest.json" && s.kind === "symlink")) {
+    manifestError = "manifest.json is a symbolic link; its target was not read. Scan a package containing regular files.";
+  } else if (!existsSync(manifestPath)) {
     // NAME THE ACTUAL PROBLEM. "no manifest.json in this directory" was printed
     // for a path that is not a directory and for a path that does not exist at
     // all, which sends someone to look for a file in a folder that was never
@@ -233,7 +249,7 @@ export function resolveI18n(manifest, files, skipped = []) {
   // A locale file the scanner refused to read (over the size limit, unreadable)
   // is NOT evidence that a message is missing. Staying quiet there is the same
   // fail-safe direction as everything else in this file.
-  const wasSkipped = wanted ? skipped.some((s) => s.path.split(/[\\/]/).join("/") === wanted) : false;
+  const wasSkipped = wanted ? skippedPath(wanted, skipped) : false;
 
   let messages = null;
   if (file) {