From 3b4e87187f51ec0c4702b80744b52f04bd98483d Mon Sep 17 00:00:00 2001
From: KazKozDev <kazkozdev@gmail.com>
Date: Fri, 23 Oct 2026 15:25:05 +0200
Subject: [PATCH] fix: remove content script loader and resolve Vite audit
 failure

---
 .github/workflows/audit.yml    | 12 ++++++++++++
 core/package-lock.json         | 12 ++++++------
 core/package.json              |  2 +-
 core/src/lib/messaging.test.ts | 32 +++++++++++++++++++++++++++++++-
 core/src/lib/messaging.ts      |  2 +-
 core/vite.config.ts            |  6 +++++-
 6 files changed, 56 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 0f1aaf4..d0184c3 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -1,6 +1,18 @@
 name: audit
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - core/package.json
+      - core/package-lock.json
+      - .github/workflows/audit.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - core/package.json
+      - core/package-lock.json
+      - .github/workflows/audit.yml
   schedule:
     # Nightly, so a freshly disclosed advisory surfaces without a push.
     - cron: "14 3 * * *"
diff --git a/core/package-lock.json b/core/package-lock.json
index 376527b..ef403b5 100644
--- a/core/package-lock.json
+++ b/core/package-lock.json
@@ -30,7 +30,7 @@
         "playwright": "^1.63.0",
         "typescript": "^5.5.3",
         "typescript-eslint": "^8.71.0",
-        "vite": "^8.3.2",
+        "vite": "^8.3.4",
         "vitest": "^5.0.3"
       },
       "engines": {
@@ -5848,16 +5848,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.2.tgz",
-      "integrity": "sha512-SQr1x6W5vVSbROg7vsyXIaxK9b0G7zsT68acdWWRmnBUsgDieLCRG+Rep9WdZgcposvv/GSnr4GUUBqB3vXq6w==",
+      "version": "8.3.4",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
+      "integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.33.0",
         "picomatch": "^4.0.7",
-        "postcss": "^8.5.28",
-        "rolldown": "~1.2.11",
+        "postcss": "^8.5.29",
+        "rolldown": "~1.2.12",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
diff --git a/core/package.json b/core/package.json
index bda64bb..72f1143 100644
--- a/core/package.json
+++ b/core/package.json
@@ -46,7 +46,7 @@
     "playwright": "^1.63.0",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.71.0",
-    "vite": "^8.3.2",
+    "vite": "^8.3.4",
     "vitest": "^5.0.3"
   },
   "overrides": {
diff --git a/core/src/lib/messaging.test.ts b/core/src/lib/messaging.test.ts
index 672f29b..0d7e784 100644
--- a/core/src/lib/messaging.test.ts
+++ b/core/src/lib/messaging.test.ts
@@ -1,10 +1,40 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import { sendToContent } from './messaging';
+import { ensureContentScript, sendToContent } from './messaging';
 
 afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+describe('ensureContentScript', () => {
+  it('injects the standalone bundle when the receiver is missing', async () => {
+    const sendMessage = vi.fn()
+      .mockRejectedValueOnce(new Error('Receiving end does not exist'))
+      .mockResolvedValue({ kind: 'ok' });
+    const executeScript = vi.fn().mockResolvedValue([]);
+    vi.stubGlobal('chrome', { tabs: { sendMessage }, scripting: { executeScript } });
+
+    await ensureContentScript(42);
+
+    expect(executeScript).toHaveBeenCalledWith({
+      target: { tabId: 42 },
+      files: ['src/content/content-script.js'],
+    });
+    expect(sendMessage).toHaveBeenCalledTimes(2);
+  });
+
+  it('keeps an already responding receiver', async () => {
+    const executeScript = vi.fn();
+    vi.stubGlobal('chrome', {
+      tabs: { sendMessage: vi.fn().mockResolvedValue({ kind: 'ok' }) },
+      scripting: { executeScript },
+    });
+
+    await ensureContentScript(42);
+
+    expect(executeScript).not.toHaveBeenCalled();
+  });
+});
+
 describe('sendToContent', () => {
   it('addresses the main frame so a hidden service iframe cannot answer first', async () => {
     // Without an explicit frameId, chrome delivers to every frame and resolves with whichever
diff --git a/core/src/lib/messaging.ts b/core/src/lib/messaging.ts
index 3fd1d49..85ef68f 100644
--- a/core/src/lib/messaging.ts
+++ b/core/src/lib/messaging.ts
@@ -91,7 +91,7 @@ export async function ensureContentScript(tabId: number): Promise<void> {
 
   await chrome.scripting.executeScript({
     target: { tabId },
-    files: ['assets/content-script.ts-loader.js'],
+    files: ['src/content/content-script.js'],
   });
 
   const started = Date.now();
diff --git a/core/vite.config.ts b/core/vite.config.ts
index 1cc14f4..5a88dd9 100644
--- a/core/vite.config.ts
+++ b/core/vite.config.ts
@@ -52,7 +52,11 @@ export default defineConfig({
       plugins: [],
     },
   },
-  plugins: [react(), crx({ manifest }), ortRuntime()],
+  plugins: [react(), crx({
+    manifest,
+    // Avoid the module loader's cross-origin import from pages such as YouTube.
+    contentScripts: { standaloneFiles: ['src/content/content-script.ts'] },
+  }), ortRuntime()],
   build: {
     target: 'esnext',
     sourcemap: true,