Repository navigation
fix: resolve Vite audit failure and blocked content script loading - #51
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3b4e87187f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| await chrome.scripting.executeScript({ | ||
| target: { tabId }, | ||
| files: ['assets/content-script.ts-loader.js'], | ||
| files: ['src/content/content-script.js'], |
There was a problem hiding this comment.
When the receiver is absent—such as on a tab left open across an extension install or reload—the standalone entry is emitted according to entryFileNames: 'assets/[name].js', making this bundle assets/content-script.js; the build does not create src/content/content-script.js. Consequently, chrome.scripting.executeScript rejects instead of restoring the content script, so subsequent tab operations fail. Reference the actual emitted filename (preferably via the bundler's IIFE/script import mechanism) rather than this source-like path.
Useful? React with 👍 / 👎.
The nightly audit has failed since October 21 because Vite 8.3.2 is affected by newly disclosed security advisories. Upgrade Vite to 8.3.4 and run the audit on dependency and audit-workflow changes in pull requests and on main, while retaining the nightly schedule. This includes the Vite update proposed in #48.
Content scripts now build as standalone IIFEs instead of loading an extension module through dynamic import(), which was blocked on YouTube. Update programmatic injection to use the emitted standalone file and cover missing and existing receivers with tests.
Validation: the full scripts/check.sh gate passed on a clean main checkout (321 unit tests, fixture/security/bridge/MCP smoke checks, typecheck, lint, dead-code scan, shellcheck and production build); coverage thresholds passed; npm audit reports zero vulnerabilities. Browser smoke checks in Brave Nightly passed on live YouTube and strict-CSP fixtures, including iframe injection, snapshots and programmatic injection.
Repository inspection found no open issues or unresolved review threads on the five existing open dependency PRs; their check and CodeQL runs are successful. No open CodeQL or secret-scanning alerts were returned. Dependabot alerts are disabled in repository settings.
Unrelated work in the existing local checkout is excluded.