Extension Store Readiness Auditor

Add permission-version diffs, declared-versus-observed namespace evidence, policy-age checklists and CRX/XPI container fixtures.

extension-store-audit ./extension --policy policy.json --as-of 2026-09-07 --baseline previous.json --format json --output review.json

Reports inventory required/optional API and host permissions. Baselines with permission inventories show added/removed declarations; older baselines explicitly report comparison unavailable. JavaScript namespace text patterns include file/line evidence but may match comments or miss dynamic code: absence is not proof of unused permission, and a namespace match is not proof that its permission is needed. --as-of and --policy-max-age (default 90 days) classify the operator-authored policy review date and list sources requiring manual recheck; no policy sources are fetched or refreshed. CRX2/CRX3 header bounds and ZIP payload offsets are validated, with generated CRX/XPI fixtures. Signatures, package authenticity and marketplace acceptance are not verified. Unpacked size limits and symlink rejection preserve bounded local inspection.

python -m pip install .
extension-store-audit path/to/extension.zip
extension-store-audit path/to/unpacked --target chrome --target edge --format json --output audit.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --format json --output current.json
extension-store-audit path/to/extension.zip --policy examples/policy-profile.json --baseline previous.json

Exit code 0 means no static errors, 1 means the report contains errors requiring correction, and 2 means the package or command could not be analyzed. Existing reports are never overwritten.