fix: resolve Vite audit failure and blocked content script loading

.github/workflows/audit.yml

@@ -1,6 +1,18 @@
 name: audit
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - core/package.json
+      - core/package-lock.json
+      - .github/workflows/audit.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - core/package.json
+      - core/package-lock.json
+      - .github/workflows/audit.yml
   schedule:
     # Nightly, so a freshly disclosed advisory surfaces without a push.
     - cron: "14 3 * * *"

core/package.json

@@ -46,7 +46,7 @@
     "playwright": "^1.63.0",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.71.0",
-    "vite": "^8.3.2",
+    "vite": "^8.3.4",
     "vitest": "^5.0.3"
   },
   "overrides": {

core/src/lib/messaging.test.ts

@@ -1,10 +1,40 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
-import { sendToContent } from './messaging';
+import { ensureContentScript, sendToContent } from './messaging';
 
 afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+describe('ensureContentScript', () => {
+  it('injects the standalone bundle when the receiver is missing', async () => {
+    const sendMessage = vi.fn()
+      .mockRejectedValueOnce(new Error('Receiving end does not exist'))
+      .mockResolvedValue({ kind: 'ok' });
+    const executeScript = vi.fn().mockResolvedValue([]);
+    vi.stubGlobal('chrome', { tabs: { sendMessage }, scripting: { executeScript } });
+
+    await ensureContentScript(42);
+
+    expect(executeScript).toHaveBeenCalledWith({
+      target: { tabId: 42 },
+      files: ['src/content/content-script.js'],
+    });
+    expect(sendMessage).toHaveBeenCalledTimes(2);
+  });
+
+  it('keeps an already responding receiver', async () => {
+    const executeScript = vi.fn();
+    vi.stubGlobal('chrome', {
+      tabs: { sendMessage: vi.fn().mockResolvedValue({ kind: 'ok' }) },
+      scripting: { executeScript },
+    });
+
+    await ensureContentScript(42);
+
+    expect(executeScript).not.toHaveBeenCalled();
+  });
+});
+
 describe('sendToContent', () => {
   it('addresses the main frame so a hidden service iframe cannot answer first', async () => {
     // Without an explicit frameId, chrome delivers to every frame and resolves with whichever

core/src/lib/messaging.ts

@@ -91,7 +91,7 @@ export async function ensureContentScript(tabId: number): Promise<void> {
 
   await chrome.scripting.executeScript({
     target: { tabId },
-    files: ['assets/content-script.ts-loader.js'],
+    files: ['src/content/content-script.js'],
   });
 
   const started = Date.now();

core/vite.config.ts

@@ -52,7 +52,11 @@ export default defineConfig({
       plugins: [],
     },
   },
-  plugins: [react(), crx({ manifest }), ortRuntime()],
+  plugins: [react(), crx({
+    manifest,
+    // Avoid the module loader's cross-origin import from pages such as YouTube.
+    contentScripts: { standaloneFiles: ['src/content/content-script.ts'] },
+  }), ortRuntime()],
   build: {
     target: 'esnext',
     sourcemap: true,