From bf31564ab3c1be2761f6e7d6dd7ce311c4847d20 Mon Sep 17 00:00:00 2001
From: Alexey Karimov <krassx@gmail.com>
Date: Fri, 18 Sep 2026 18:15:47 +0500
Subject: [PATCH 1/4] feat(sourcemaps): refuse to inject into a build that pins
 its own script hashes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Injecting appends bytes to every `.js`, so a Subresource Integrity hash the HTML already carries
stops matching and the browser refuses to run the script. Measured on a real webpack +
webpack-subresource-integrity build in Chromium 151: before injecting the app ran clean; after it,
`window.__ran` was false and the console carried "Failed to find a valid digest in the 'integrity'
attribute … The resource has been blocked." The page loads and executes NOTHING — strictly worse
than shipping no debug-ids at all.

`@bugsee/bundler-plugin-core` already refuses this, but it only wires vite and rollup. Angular 17+,
esbuild and Deno users drive this binary directly, and Angular's `subresourceIntegrity: true` is
exactly the config that breaks — an adversarial review of the JS-side guard is what surfaced the
gap. So the check belongs here too.

`inject` now scans the HTML under the paths it was given, before writing anything, and exits 20 with
the page, the pinned script and what to do about it. Verified on that same webpack build: exit 20,
`md5` of both bundles unchanged; `--allow-sri` proceeds and both change.

Detected: `<script integrity src=…>` and `<link rel=modulepreload|preload integrity href=…>`, quoted
or bare, in any attribute order, with a whitespace-padded URL (browsers strip it). Deliberately NOT
flagged, because each would be a silent loss of symbolication for a build we were never going to
break: a CDN script, a non-JS target, a path outside the output directory (containment is compared
by path COMPONENT, so `dist-2` is not inside `dist`), an empty `integrity`, `data-integrity` /
`data-src`, an inline script, a commented-out tag, and `rel=prefetch` — a failed prefetch is
discarded, not fatal. An `--exclude`d file does not count either: one we will not touch cannot have
its hash invalidated, and `--exclude` and the guard now share one matcher so they cannot disagree.

Six mutants caught (guard bypassed, exclusions ignored, containment dropped, empty integrity
counted, comments scanned, rel filter dropped). The tests also caught a real bug in the first draft:
the dot-directory filter was applied to the walk ROOT, so pointing `inject` at `.next`, `.nuxt` or
`.output` scanned nothing at all.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 CHANGELOG.md          |  15 ++
 README.md             |  13 +-
 src/cli/sourcemaps.rs |  13 +-
 src/inject/mod.rs     | 232 +++++++++++++++++++++-----
 src/inject/sri.rs     | 372 ++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 604 insertions(+), 41 deletions(-)
 create mode 100644 src/inject/sri.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 785d770..c18aeec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,21 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 
 ### Added
+- **`sourcemaps inject` refuses a build that pins its own script hashes** (Subresource Integrity),
+  exit 20. Injecting appends bytes to every `.js`, so a hash the HTML already carries stops matching
+  and the browser refuses to run the script: measured on a real webpack +
+  `webpack-subresource-integrity` build in Chromium 151, the page loaded and executed **nothing**
+  after injecting, where before it ran clean. Angular's `subresourceIntegrity: true` is the same
+  mechanism, and Angular/esbuild/Deno users drive this binary directly — the JS bundler plugins
+  carry their own copy of this guard, but they only cover vite and rollup.
+
+  Detected: `<script integrity src=…>` and `<link rel=modulepreload|preload integrity href=…>` in
+  any `.html` under the given paths. Deliberately NOT flagged: a CDN script, a non-JS target, a path
+  outside the output directory, an empty `integrity`, `data-integrity`/`data-src`, a commented-out
+  tag, and `rel=prefetch` (a failed prefetch is discarded, not fatal). `--exclude`d files do not
+  count either — a file we will not touch cannot have its hash invalidated.
+
+  `--allow-sri` proceeds anyway, for a build that recomputes its hashes afterwards.
 - **`sourcemaps inject --exclude <glob>`** (repeatable) — leave part of a build output alone. A
   stock `next build` with browser source maps on has 39 JS files and 12 maps, and a Nuxt
   `.output/server/node_modules` holds 22 vendored `.mjs`; `--exclude '**/node_modules/**'` keeps
diff --git a/README.md b/README.md
index 4614b6e..71b08bf 100644
--- a/README.md
+++ b/README.md
@@ -239,8 +239,19 @@ unsymbolicated instead. Measured on a stock `next build` with browser source map
 12 maps, so 27 bundles are stamped without one; that is the case that produces the prompt. Use
 `--exclude` when you would rather those files were not touched at all.
 
+**A build that pins its own script hashes is REFUSED** (exit 20). Injecting appends bytes to every
+`.js`, so a Subresource Integrity hash the HTML already carries stops matching and the browser
+refuses to run the script — measured on a real webpack + `webpack-subresource-integrity` build in
+Chromium 151: before injecting the app ran, after it the entry script was blocked and the page
+executed nothing. `inject` looks for `<script integrity src=…>` and
+`<link rel=modulepreload|preload integrity href=…>` in the HTML under the paths it was given, and
+stops before writing anything. Angular's `subresourceIntegrity: true` is the same mechanism.
+
+Fix it by stamping BEFORE the hashes are computed, by `--exclude`-ing the pinned files, or — if your
+build recomputes hashes after this runs — with `--allow-sri`.
+
 ```
-bugsee-cli sourcemaps inject <paths>... [--exclude <glob>]... [--dry-run]
+bugsee-cli sourcemaps inject <paths>... [--exclude <glob>]... [--allow-sri] [--dry-run]
 bugsee-cli debug-files upload --type sourcemaps <paths>... --version <v> --build <b> \
     [--concurrency N] [--allow-empty]
 ```
diff --git a/src/cli/sourcemaps.rs b/src/cli/sourcemaps.rs
index 6b4e208..87ba55f 100644
--- a/src/cli/sourcemaps.rs
+++ b/src/cli/sourcemaps.rs
@@ -31,6 +31,16 @@ pub enum SourcemapsCommand {
         #[arg(long)]
         exclude: Vec<String>,
 
+        /// Inject even when the build pins its own script hashes (Subresource Integrity).
+        ///
+        /// Injecting appends bytes to every `.js`, so a hash the HTML already pins stops matching
+        /// and the browser refuses to run the script — the page loads and nothing executes
+        /// (measured in Chromium 151 on a real webpack + webpack-subresource-integrity build).
+        /// That is refused by default. Pass this only if your build recomputes the hashes AFTER
+        /// this runs; otherwise stamp earlier, or `--exclude` the pinned files.
+        #[arg(long)]
+        allow_sri: bool,
+
         /// Dry-run — report what would change without writing.
         #[arg(long)]
         dry_run: bool,
@@ -46,9 +56,10 @@ pub async fn dispatch(
         SourcemapsCommand::Inject {
             paths,
             exclude,
+            allow_sri,
             dry_run,
         } => {
-            let stats = inject::inject_paths(&paths, &exclude, dry_run)?;
+            let stats = inject::inject_paths(&paths, &exclude, allow_sri, dry_run)?;
             tracing::info!(
                 js_injected = stats.js_injected,
                 js_already_injected = stats.js_already,
diff --git a/src/inject/mod.rs b/src/inject/mod.rs
index 3513cfe..07f5155 100644
--- a/src/inject/mod.rs
+++ b/src/inject/mod.rs
@@ -23,6 +23,8 @@ use uuid::Uuid;
 
 use crate::error::{Error, Result};
 
+pub mod sri;
+
 /// Fixed namespace for Bugsee sourcemap debug-ids — keeps UUIDv5 generation
 /// stable across runs and machines (deterministic from the bundle's content and
 /// its paired map's).
@@ -128,11 +130,71 @@ fn exclude_matcher(patterns: &[String]) -> Result<Option<globset::GlobSet>> {
     Ok(Some(set))
 }
 
+/// Whether `path` matches the `--exclude` set, tried whole AND relative to each root, so `vendor/**`
+/// and an absolute pattern both work — and so the SRI guard and the walk agree on what is excluded.
+fn is_excluded(matcher: Option<&globset::GlobSet>, roots: &[PathBuf], path: &Path) -> bool {
+    let Some(matcher) = matcher else {
+        return false;
+    };
+    if matcher.is_match(path) {
+        return true;
+    }
+    roots.iter().any(|root| {
+        let base = if root.is_file() {
+            root.parent().unwrap_or(Path::new("."))
+        } else {
+            root.as_path()
+        };
+        path.strip_prefix(base)
+            .is_ok_and(|rel| matcher.is_match(rel))
+    })
+}
+
 /// Inject debug-ids across all `.js`/`.cjs`/`.mjs` under `paths`, skipping any file matching one of
 /// `exclude` (globs, matched against the path relative to the walked root AND against the full
 /// path, so both `node_modules/**` and an absolute pattern work).
-pub fn inject_paths(paths: &[PathBuf], exclude: &[String], dry_run: bool) -> Result<InjectStats> {
+///
+///
+/// Stamping appends bytes to every `.js`, so a hash the HTML already pins stops matching and the
+/// browser refuses to run the script: the page loads and NOTHING executes (measured in Chromium 151
+/// on a real webpack + webpack-subresource-integrity build). That is strictly worse than having no
+/// debug-ids, so it is an error by default. `allow_sri` is for a build that recomputes its hashes
+/// after this runs.
+pub fn inject_paths(
+    paths: &[PathBuf],
+    exclude: &[String],
+    allow_sri: bool,
+    dry_run: bool,
+) -> Result<InjectStats> {
     let matcher = exclude_matcher(exclude)?;
+    if !allow_sri {
+        // A file we are not going to touch cannot have its hash invalidated, so the exclusions
+        // apply here too.
+        let pinned: Vec<_> = sri::find_pinned_scripts(paths)
+            .into_iter()
+            .filter(|p| !is_excluded(matcher.as_ref(), paths, &p.script))
+            .collect();
+        if let Some(first) = pinned.first() {
+            let more = if pinned.len() > 1 {
+                format!(" (and {} more)", pinned.len() - 1)
+            } else {
+                String::new()
+            };
+            // Concatenated, NOT one wrapped literal: rustfmt re-indents a wrapped string and bakes
+            // the indentation into the message. Neither fmt nor clippy looks inside a string
+            // literal, and it has already shipped once in this repo.
+            let message = format!(
+                "refusing to inject: this build uses Subresource Integrity — {} pins a hash of {}{}. ",
+                first.html.display(),
+                first.script.display(),
+                more
+            ) + "Injecting a debug-id rewrites that file, so the browser would refuse to run it and "
+                + "the page would load nothing. Stamp before the hashes are computed, exclude the "
+                + "pinned files (--exclude), or pass --allow-sri if your build recomputes them "
+                + "after this runs";
+            return Err(Error::ConfigInvalid(message));
+        }
+    }
     let mut stats = InjectStats::default();
     for root in paths {
         // Sorted, so a run is the same on every file system (it decides, e.g.,
@@ -151,11 +213,7 @@ pub fn inject_paths(paths: &[PathBuf], exclude: &[String], dry_run: bool) -> Res
                 Some("js") | Some("cjs") | Some("mjs")
             );
             if is_js {
-                let relative = p.strip_prefix(root).unwrap_or(p);
-                let excluded = matcher
-                    .as_ref()
-                    .is_some_and(|m| m.is_match(relative) || m.is_match(p));
-                if excluded {
+                if is_excluded(matcher.as_ref(), std::slice::from_ref(root), p) {
                     stats.js_excluded += 1;
                     tracing::info!(path = %p.display(), "excluded");
                     continue;
@@ -452,6 +510,97 @@ mod tests {
         assert!(!is_contained_relative("/etc/passwd"));
     }
 
+    /// Stamping a build that pins its own script hashes ships a page that loads and runs NOTHING —
+    /// measured in Chromium 151 on a real webpack + webpack-subresource-integrity build. The JS
+    /// bundler plugins refuse before they ever spawn this binary, but Angular 17+, esbuild and Deno
+    /// users drive it directly, and Angular's `subresourceIntegrity: true` is exactly this config.
+    #[test]
+    fn a_build_that_pins_its_script_hashes_is_refused() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("main.js"), "console.log(1)\n").unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="main.js" integrity="sha384-KUBb"></script>"#,
+        )
+        .unwrap();
+
+        let err = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap_err();
+        let message = format!("{err:#}");
+        assert!(message.contains("Subresource Integrity"), "{message}");
+        assert!(message.contains("index.html"), "{message}");
+        assert!(message.contains("--allow-sri"), "{message}");
+        assert_eq!(
+            crate::error::classify(&anyhow::Error::new(err)),
+            crate::exit_code::ExitCode::ConfigInvalid
+        );
+        // Nothing was written: the refusal leaves the build exactly as the bundler emitted it.
+        assert_eq!(
+            std::fs::read_to_string(dir.path().join("main.js")).unwrap(),
+            "console.log(1)\n"
+        );
+    }
+
+    /// The escape hatch, for a build that recomputes its hashes after this runs.
+    #[test]
+    fn allow_sri_proceeds_anyway() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("main.js"), "console.log(1)\n").unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="main.js" integrity="sha384-KUBb"></script>"#,
+        )
+        .unwrap();
+
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], true, false).unwrap();
+        assert_eq!(stats.js_injected, 1);
+        assert!(std::fs::read_to_string(dir.path().join("main.js"))
+            .unwrap()
+            .contains("debugId="));
+    }
+
+    /// A pinned file we were never going to touch is not a reason to refuse: `--exclude` already
+    /// takes it out of the run, so the hash it pins still matches.
+    #[test]
+    fn a_pinned_script_that_is_excluded_does_not_refuse_the_run() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(dir.path().join("vendor")).unwrap();
+        std::fs::write(dir.path().join("vendor/pinned.js"), "console.log(1)\n").unwrap();
+        std::fs::write(dir.path().join("app.js"), "console.log(2)\n").unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="vendor/pinned.js" integrity="sha384-KUBb"></script>"#,
+        )
+        .unwrap();
+
+        let stats = inject_paths(
+            &[dir.path().to_path_buf()],
+            &["vendor/**".to_string()],
+            false,
+            false,
+        )
+        .unwrap();
+        assert_eq!((stats.js_injected, stats.js_excluded), (1, 1));
+        assert!(
+            !std::fs::read_to_string(dir.path().join("vendor/pinned.js"))
+                .unwrap()
+                .contains("debugId=")
+        );
+    }
+
+    /// A dry run reports the refusal too — it is the diagnostic that explains WHY nothing happens.
+    #[test]
+    fn a_dry_run_refuses_a_pinned_build_as_well() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("main.js"), "console.log(1)\n").unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="main.js" integrity="sha384-KUBb"></script>"#,
+        )
+        .unwrap();
+
+        assert!(inject_paths(&[dir.path().to_path_buf()], &[], false, true).is_err());
+    }
+
     /// `--exclude` keeps `inject` out of parts of a build output it should not rewrite. Measured
     /// need: a stock `next build` with browser source maps on has 39 JS files and 12 maps, and a
     /// Nuxt `.output/server/node_modules` holds 22 `.mjs` — vendored third-party code inside the
@@ -476,6 +625,7 @@ mod tests {
             &[dir.path().to_path_buf()],
             &["**/node_modules/**".to_string()],
             false,
+            false,
         )
         .unwrap();
 
@@ -507,6 +657,7 @@ mod tests {
             &[dir.path().to_path_buf()],
             &["polyfills.js".to_string(), "**/legacy-*.js".to_string()],
             false,
+            false,
         )
         .unwrap();
 
@@ -529,6 +680,7 @@ mod tests {
             &[dir.path().to_path_buf()],
             &["nothing/**".to_string()],
             false,
+            false,
         )
         .unwrap();
         assert_eq!(stats.js_injected, 1);
@@ -538,6 +690,7 @@ mod tests {
             &[dir.path().to_path_buf()],
             &["[unclosed".to_string()],
             false,
+            false,
         )
         .unwrap_err();
         assert!(
@@ -557,6 +710,7 @@ mod tests {
         let stats = inject_paths(
             &[dir.path().to_path_buf()],
             &["vendor/**".to_string()],
+            false,
             true,
         )
         .unwrap();
@@ -587,7 +741,7 @@ mod tests {
             let dir = tempfile::tempdir().unwrap();
             std::fs::write(dir.path().join("app.js"), "console.log(1)\n").unwrap();
             std::fs::write(dir.path().join("app.js.map"), map).unwrap();
-            inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+            inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
             read_debug_id(&dir.path().join("app.js.map"))
                 .unwrap()
                 .unwrap()
@@ -633,11 +787,11 @@ mod tests {
             r#"{"version":3,"sources":["a.ts"],"mappings":"AAAA"}"#,
         )
         .unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
 
         // The bundler re-emits the JS (no stub) but leaves the stamped map.
         std::fs::write(&js, "console.log(1)\n").unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
 
         let bundle_id = existing_debug_id(&std::fs::read_to_string(&js).unwrap()).unwrap();
         let map_json: serde_json::Value =
@@ -664,7 +818,7 @@ mod tests {
             eprintln!("skipping: running with permission to read a 000 file");
             return;
         }
-        let result = inject_paths(&[dir.path().to_path_buf()], &[], false);
+        let result = inject_paths(&[dir.path().to_path_buf()], &[], false, false);
         std::fs::set_permissions(&map, std::fs::Permissions::from_mode(0o644)).unwrap();
         assert!(result.is_err());
         assert_eq!(std::fs::read_to_string(&js).unwrap(), "console.log(1)\n");
@@ -721,13 +875,13 @@ mod tests {
         )
         .unwrap();
 
-        let first = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let first = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let map_json: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&map).unwrap()).unwrap();
         assert_eq!(first.maps_updated, 1);
         assert_eq!(map_json["debug_id"], id);
         assert_eq!(map_json["debugId"], id);
-        let second = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let second = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(second.maps_updated, 0);
     }
 
@@ -746,10 +900,10 @@ mod tests {
         let map = dir.path().join("shared.map");
         std::fs::write(&map, r#"{"version":3,"mappings":""}"#).unwrap();
 
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let after_first = std::fs::read(&map).unwrap();
         for _ in 0..2 {
-            let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+            let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
             assert_eq!(stats.maps_updated, 0);
             assert_eq!(std::fs::read(&map).unwrap(), after_first);
         }
@@ -772,13 +926,13 @@ mod tests {
             r#"{"version":3,"sources":["a.ts"],"mappings":"AAEA"}"#,
         )
         .unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let first = read_debug_id(&map).unwrap().unwrap();
 
         // Rebuild: JS untouched on disk, map re-emitted with shifted mappings and no id.
         let moved = r#"{"version":3,"sources":["a.ts"],"mappings":"AAKA"}"#;
         std::fs::write(&map, moved).unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
 
         let expected =
             compute_debug_id_with_map(bundle.as_bytes(), Some(moved.as_bytes())).to_string();
@@ -791,7 +945,7 @@ mod tests {
         assert_eq!(stats.maps_updated, 1);
 
         // And it settles: nothing changes on the next run.
-        let again = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let again = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!((again.js_restamped, again.maps_updated), (0, 0));
         assert_eq!(std::fs::read_to_string(&js).unwrap(), js_after);
     }
@@ -805,12 +959,12 @@ mod tests {
         let original_map = r#"{"version":3,"sources":["a.ts"],"mappings":"AAEA"}"#;
         std::fs::write(&js, "console.log(1)\n").unwrap();
         std::fs::write(&map, original_map).unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let js_stamped = std::fs::read_to_string(&js).unwrap();
         let id = read_debug_id(&map).unwrap().unwrap();
 
         std::fs::write(&map, original_map).unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(stats.js_restamped, 0);
         assert_eq!(std::fs::read_to_string(&js).unwrap(), js_stamped);
         assert_eq!(read_debug_id(&map).unwrap().unwrap(), id);
@@ -831,7 +985,7 @@ mod tests {
             r#"{"version":3,"mappings":"AAKA"}"#,
         )
         .unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(stats.js_restamped, 0);
         // Never re-keyed: the id stays; only our runtime registration is added.
         assert_eq!(
@@ -853,11 +1007,11 @@ mod tests {
         let map = dir.path().join("app.js.map");
         std::fs::write(&js, "console.log(1)\n").unwrap();
         std::fs::write(&map, r#"{"version":3,"mappings":"AAEA"}"#).unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let js_stamped = std::fs::read_to_string(&js).unwrap();
 
         std::fs::write(&map, "not json").unwrap();
-        assert!(inject_paths(&[dir.path().to_path_buf()], &[], false).is_err());
+        assert!(inject_paths(&[dir.path().to_path_buf()], &[], false, false).is_err());
         assert_eq!(std::fs::read_to_string(&js).unwrap(), js_stamped);
     }
 
@@ -871,7 +1025,7 @@ mod tests {
         let map = dir.path().join("app.js.map");
         std::fs::write(&js, "console.log(1)\n").unwrap();
         std::fs::write(&map, r#"{"version":3,"mappings":"AAEA"}"#).unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let js_stamped = std::fs::read_to_string(&js).unwrap();
         let id = read_debug_id(&map).unwrap().unwrap();
 
@@ -880,7 +1034,7 @@ mod tests {
             format!(r#"{{"version":3,"mappings":"AAEA","debugId":"{id}"}}"#),
         )
         .unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(stats.js_restamped, 0);
         assert_eq!(std::fs::read_to_string(&js).unwrap(), js_stamped);
         assert_eq!(read_debug_id(&map).unwrap().unwrap(), id);
@@ -893,11 +1047,11 @@ mod tests {
         let map = dir.path().join("app.js.map");
         std::fs::write(&js, "console.log(1)\n").unwrap();
         std::fs::write(&map, r#"{"version":3,"mappings":"AAEA"}"#).unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let js_stamped = std::fs::read_to_string(&js).unwrap();
         std::fs::write(&map, r#"{"version":3,"mappings":"AAKA"}"#).unwrap();
 
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], true).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, true).unwrap();
         assert_eq!((stats.js_restamped, stats.maps_updated), (1, 1));
         assert_eq!(std::fs::read_to_string(&js).unwrap(), js_stamped);
         assert_eq!(read_debug_id(&map).unwrap(), None);
@@ -917,7 +1071,7 @@ mod tests {
             r#"{"version":3,"mappings":"","debug_id":"11111111-1111-5111-8111-111111111111","debugId":"11111111-1111-5111-8111-111111111111"}"#,
         )
         .unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], true).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, true).unwrap();
         assert_eq!((stats.js_injected, stats.maps_updated), (1, 1));
     }
 
@@ -936,7 +1090,7 @@ mod tests {
         }
         let map = dir.path().join("shared.map");
         std::fs::write(&map, r#"{"version":3,"mappings":""}"#).unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let z =
             existing_debug_id(&std::fs::read_to_string(dir.path().join("z.js")).unwrap()).unwrap();
         assert_eq!(read_debug_id(&map).unwrap().unwrap(), z);
@@ -975,7 +1129,7 @@ mod tests {
         let (js, map, id) = rollup_bundle(dir.path());
         let before = std::fs::read_to_string(&js).unwrap();
 
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
 
         let after = std::fs::read_to_string(&js).unwrap();
         assert_eq!(after, format!("{before}{}", runtime_registration(&id)));
@@ -993,7 +1147,7 @@ mod tests {
         );
 
         // Idempotent: the registration is found, nothing is appended again.
-        let again = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let again = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(std::fs::read_to_string(&js).unwrap(), after);
         assert_eq!(
             (again.js_registered, again.js_already, again.maps_updated),
@@ -1006,7 +1160,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let (js, _map, _id) = rollup_bundle(dir.path());
         let before = std::fs::read_to_string(&js).unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], true).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, true).unwrap();
         assert_eq!(stats.js_registered, 1);
         assert_eq!(std::fs::read_to_string(&js).unwrap(), before);
     }
@@ -1018,10 +1172,10 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let js = dir.path().join("app.js");
         std::fs::write(&js, "console.log(1)\n").unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let stamped = std::fs::read_to_string(&js).unwrap();
         for _ in 0..2 {
-            let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+            let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
             assert_eq!(stats.js_registered, 0);
         }
         assert_eq!(std::fs::read_to_string(&js).unwrap(), stamped);
@@ -1034,11 +1188,11 @@ mod tests {
     fn a_registered_foreign_id_is_not_rekeyed_when_its_map_comes_back_without_one() {
         let dir = tempfile::tempdir().unwrap();
         let (js, map, id) = rollup_bundle(dir.path());
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let registered = std::fs::read_to_string(&js).unwrap();
 
         std::fs::write(&map, r#"{"version":3,"mappings":"AAKA"}"#).unwrap();
-        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let stats = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!((stats.js_restamped, stats.js_registered), (0, 0));
         assert_eq!(std::fs::read_to_string(&js).unwrap(), registered);
         assert_eq!(read_debug_id(&map).unwrap().unwrap(), id);
@@ -1073,7 +1227,7 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let js = dir.path().join("app.js");
         std::fs::write(&js, "console.log(1)\n").unwrap();
-        inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         let injected = std::fs::read_to_string(&js).unwrap();
         assert_eq!(
             existing_debug_id(&injected).unwrap(),
@@ -1108,7 +1262,7 @@ mod tests {
         std::fs::write(&js, "console.log('hi')\n//# sourceMappingURL=app.js.map\n").unwrap();
         std::fs::write(&map, r#"{"version":3,"sources":[],"mappings":""}"#).unwrap();
 
-        let s1 = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let s1 = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(s1.js_injected, 1);
         assert_eq!(s1.maps_updated, 1);
 
@@ -1129,7 +1283,7 @@ mod tests {
         );
 
         // Re-running is a no-op (idempotent).
-        let s2 = inject_paths(&[dir.path().to_path_buf()], &[], false).unwrap();
+        let s2 = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
         assert_eq!(s2.js_injected, 0, "already injected");
         assert_eq!(s2.js_already, 1);
         assert_eq!(
@@ -1156,7 +1310,7 @@ mod tests {
         let js_before = std::fs::read_to_string(&js).unwrap();
         let map_before = std::fs::read_to_string(&map).unwrap();
 
-        let s = inject_paths(&[dir.path().to_path_buf()], &[], true).unwrap();
+        let s = inject_paths(&[dir.path().to_path_buf()], &[], false, true).unwrap();
         assert_eq!(s.js_injected, 1);
         // The map WOULD have changed (no debug_id yet), so the intent is tallied
         // even though nothing is written to disk in dry-run.
diff --git a/src/inject/sri.rs b/src/inject/sri.rs
new file mode 100644
index 0000000..f6706c9
--- /dev/null
+++ b/src/inject/sri.rs
@@ -0,0 +1,372 @@
+//! Refuse to stamp a build that pins its own script hashes (Subresource Integrity).
+//!
+//! `inject` appends the debug-id comment and the runtime registration to every `.js` it finds. A
+//! build that computed SRI hashes during emit — `webpack-subresource-integrity`, Angular's
+//! `subresourceIntegrity: true` — has already written a hash of the PRE-stamp bytes into its HTML,
+//! so the browser refuses the script and the page runs NOTHING.
+//!
+//! Measured (bugsee-javascript, 2026-09-18) on a real webpack 5.111 build served over HTTP and
+//! loaded in Chromium 151: before inject the app ran clean; after it, `window.__ran` was false and
+//! the console carried "Failed to find a valid digest in the 'integrity' attribute for resource
+//! '…/main.<hash>.js' … The resource has been blocked." `index.html` was byte-identical; only the
+//! JS grew, 114 → 472 bytes.
+//!
+//! The JS bundler plugins carry the same guard, but they only cover vite and rollup: Angular 17+,
+//! esbuild and Deno users drive this binary directly, and Angular is exactly the config this
+//! protects against.
+
+use std::collections::BTreeSet;
+use std::path::{Component, Path, PathBuf};
+
+use std::sync::LazyLock;
+
+use regex::Regex;
+
+/// One `<script>`/`<link>` whose `integrity` pins a file we would stamp.
+#[derive(Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct PinnedScript {
+    /// The HTML page carrying the attribute.
+    pub html: PathBuf,
+    /// The script it pins.
+    pub script: PathBuf,
+}
+
+static SCRIPT_TAG: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?is)<script\b[^>]*>").unwrap());
+static LINK_TAG: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?is)<link\b[^>]*>").unwrap());
+static HTML_COMMENT: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?s)<!--.*?-->").unwrap());
+// A failed `modulepreload` poisons the module map, so the later `import()` of that chunk fails with
+// it. `prefetch` is deliberately absent: a failed prefetch is discarded, not fatal.
+static PRELOADS_SCRIPT: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r#"(?i)\brel\s*=\s*["']?(modulepreload|preload)"#).unwrap());
+// `[\s"'<]` rather than `\b`, so `data-integrity` / `data-src` (a framework's own bookkeeping,
+// pinning nothing) do not count.
+static INTEGRITY_ATTR: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?i)[\s"'<]integrity\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)"#).unwrap()
+});
+static SRC_ATTR: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r#"(?i)[\s"'<]src\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)"#).unwrap());
+static HREF_ATTR: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r#"(?i)[\s"'<]href\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)"#).unwrap());
+static ABSOLUTE_URL: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^[a-zA-Z][a-zA-Z0-9+.-]*:").unwrap());
+
+fn unquote(value: &str) -> &str {
+    let bytes = value.as_bytes();
+    if bytes.len() >= 2
+        && ((value.starts_with('"') && value.ends_with('"'))
+            || (value.starts_with('\'') && value.ends_with('\'')))
+    {
+        &value[1..value.len() - 1]
+    } else {
+        value
+    }
+}
+
+/// The file a `src`/`href` names, when it is one we could stamp: same-origin, and inside `root`.
+fn resolve_local_script(root: &Path, html_dir: &Path, url: &str) -> Option<PathBuf> {
+    // A URL with a scheme, or protocol-relative, is somebody else's file (a CDN): its bytes are not
+    // ours to change, so stamping cannot invalidate its hash.
+    if url.starts_with("//") || ABSOLUTE_URL.is_match(url) {
+        return None;
+    }
+    // Browsers strip surrounding whitespace from a URL attribute, so `src=" main.js "` loads it.
+    let path_part = url.split(['?', '#']).next().unwrap_or("").trim();
+    if path_part.is_empty() {
+        return None;
+    }
+    let candidate = if let Some(rooted) = path_part.strip_prefix('/') {
+        // A root-relative `/assets/app.js` is served from the output root.
+        root.join(rooted)
+    } else {
+        html_dir.join(path_part)
+    };
+    let full = normalize(&candidate);
+    let base = normalize(root);
+    // `starts_with` on COMPONENTS, so `dist-2` is not read as inside `dist`.
+    full.starts_with(&base).then_some(full)
+}
+
+/// Lexical `..`/`.` resolution — the file may not exist yet, so `canonicalize` is not an option.
+fn normalize(path: &Path) -> PathBuf {
+    let mut out = PathBuf::new();
+    for component in path.components() {
+        match component {
+            Component::CurDir => {}
+            Component::ParentDir => {
+                out.pop();
+            }
+            other => out.push(other.as_os_str()),
+        }
+    }
+    out
+}
+
+fn is_js(path: &Path) -> bool {
+    matches!(
+        path.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref(),
+        Some("js") | Some("cjs") | Some("mjs")
+    )
+}
+
+/// Every script under `roots` whose hash an HTML page there pins.
+///
+/// Empty means stamping is safe as far as SRI is concerned. Never fails on a path problem: that is
+/// the caller's to report.
+pub fn find_pinned_scripts(roots: &[PathBuf]) -> Vec<PinnedScript> {
+    let mut found = BTreeSet::new();
+    for root in roots {
+        // A file argument (`inject dist/app.js`) has no HTML of its own; scan its directory.
+        let base = if root.is_file() {
+            root.parent().unwrap_or(Path::new(".")).to_path_buf()
+        } else {
+            root.clone()
+        };
+        for entry in walkdir::WalkDir::new(&base)
+            .max_depth(8)
+            .sort_by_file_name()
+            .into_iter()
+            .filter_entry(|e| {
+                // `e.depth() > 0`: the filter must not judge the ROOT the caller named. A build
+                // output legitimately lives in a dot-directory (`.next`, `.nuxt`, `.output`, and a
+                // `tempfile` fixture), and excluding it would silently scan nothing at all.
+                let name = e.file_name().to_string_lossy();
+                !(e.depth() > 0
+                    && e.file_type().is_dir()
+                    && (name == "node_modules" || name.starts_with('.')))
+            })
+            .filter_map(Result::ok)
+        {
+            let page = entry.path();
+            if !entry.file_type().is_file() {
+                continue;
+            }
+            let is_html = matches!(
+                page.extension()
+                    .and_then(|e| e.to_str())
+                    .map(str::to_ascii_lowercase)
+                    .as_deref(),
+                Some("html") | Some("htm") | Some("xhtml")
+            );
+            if !is_html {
+                continue;
+            }
+            let Ok(source) = std::fs::read_to_string(page) else {
+                continue; // a page we cannot read is not ours to fail the run over
+            };
+            let markup = HTML_COMMENT.replace_all(&source, "");
+            let html_dir = page.parent().unwrap_or(Path::new("."));
+            let tags = SCRIPT_TAG
+                .find_iter(&markup)
+                .map(|m| (m.as_str(), &*SRC_ATTR))
+                .chain(
+                    LINK_TAG
+                        .find_iter(&markup)
+                        .filter(|m| PRELOADS_SCRIPT.is_match(m.as_str()))
+                        .map(|m| (m.as_str(), &*HREF_ATTR)),
+                );
+            for (tag, url_attr) in tags {
+                let integrity = INTEGRITY_ATTR
+                    .captures(tag)
+                    .and_then(|c| c.get(1))
+                    .map(|m| unquote(m.as_str()).trim().to_string());
+                // An empty `integrity` pins nothing — browsers treat it as no check at all.
+                if integrity.as_deref().unwrap_or("").is_empty() {
+                    continue;
+                }
+                let Some(url) = url_attr.captures(tag).and_then(|c| c.get(1)) else {
+                    continue;
+                };
+                let Some(script) = resolve_local_script(&base, html_dir, unquote(url.as_str()))
+                else {
+                    continue;
+                };
+                if is_js(&script) {
+                    found.insert(PinnedScript {
+                        html: page.to_path_buf(),
+                        script,
+                    });
+                }
+            }
+        }
+    }
+    found.into_iter().collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn write(dir: &Path, rel: &str, body: &str) -> PathBuf {
+        let full = dir.join(rel);
+        std::fs::create_dir_all(full.parent().unwrap()).unwrap();
+        std::fs::write(&full, body).unwrap();
+        full
+    }
+
+    fn pinned(dir: &Path) -> Vec<PathBuf> {
+        find_pinned_scripts(&[dir.to_path_buf()])
+            .into_iter()
+            .map(|p| p.script)
+            .collect()
+    }
+
+    /// The shape that breaks: webpack-subresource-integrity + html-webpack-plugin.
+    #[test]
+    fn a_pinned_entry_script_is_found() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.abc123.js", "console.log(1)");
+        write(
+            dir.path(),
+            "index.html",
+            "<!doctype html><script defer src=main.abc123.js integrity=sha384-KUBb crossorigin=anonymous></script>",
+        );
+
+        let found = find_pinned_scripts(&[dir.path().to_path_buf()]);
+        assert_eq!(found.len(), 1);
+        assert_eq!(found[0].script, dir.path().join("main.abc123.js"));
+        assert_eq!(found[0].html, dir.path().join("index.html"));
+    }
+
+    /// A failed `modulepreload` poisons the module map, so the later `import()` fails with it.
+    /// Angular's builder and the Vite SRI plugins emit these.
+    #[test]
+    fn a_pinned_modulepreload_counts_but_a_prefetch_does_not() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "chunk.js", "1");
+        write(dir.path(), "later.js", "2");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<link rel="modulepreload" href="chunk.js" integrity="sha384-P">
+               <link rel="prefetch" href="later.js" integrity="sha384-Q">"#,
+        );
+
+        assert_eq!(pinned(dir.path()), vec![dir.path().join("chunk.js")]);
+    }
+
+    /// Quoting, attribute order, root-relative paths, `.mjs`/`.cjs`, nested pages — one pass over
+    /// the shapes bundlers actually emit.
+    #[test]
+    fn it_reads_the_shapes_bundlers_emit() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "a.mjs", "1");
+        write(dir.path(), "assets/b.cjs", "2");
+        write(dir.path(), "assets/c.js", "3");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script integrity="sha512-A" type="module" src='a.mjs'></script>
+               <script src="/assets/b.cjs" integrity=sha256-B></script>"#,
+        );
+        write(
+            dir.path(),
+            "nested/page.html",
+            r#"<script src="  ../assets/c.js  " INTEGRITY = "sha384-C"></script>"#,
+        );
+
+        let mut found = pinned(dir.path());
+        found.sort();
+        let mut want = vec![
+            dir.path().join("a.mjs"),
+            dir.path().join("assets/b.cjs"),
+            dir.path().join("assets/c.js"),
+        ];
+        want.sort();
+        assert_eq!(found, want);
+    }
+
+    /// Everything that must NOT stop a build. Each one would be a silent loss of symbolication for
+    /// a user we were never going to break.
+    #[test]
+    fn it_does_not_fire_on_anything_we_would_not_break() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.js", "1");
+        write(dir.path(), "app.css", "body{}");
+        write(dir.path(), "app.wasm", "\0asm");
+        write(dir.path(), "../sibling.js", "1");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="main.js"></script>
+               <script src="https://cdn.example/lib.js" integrity="sha384-X"></script>
+               <script src="//cdn.example/lib2.js" integrity="sha384-Y"></script>
+               <script src="main.js" integrity=""></script>
+               <script data-integrity="sha384-Z" data-src="main.js"></script>
+               <script integrity="sha384-I">console.log('inline')</script>
+               <script src="app.wasm" integrity="sha384-W"></script>
+               <link rel="stylesheet" href="app.css" integrity="sha384-S">
+               <!-- <script src="main.js" integrity="sha384-C"></script> -->"#,
+        );
+
+        assert_eq!(pinned(dir.path()), Vec::<PathBuf>::new());
+    }
+
+    /// A sibling directory sharing a prefix is NOT inside the output, and neither is a parent.
+    #[test]
+    fn containment_is_by_path_component_not_by_prefix() {
+        let root = tempfile::tempdir().unwrap();
+        let out = root.path().join("dist");
+        write(root.path(), "dist-2/main.js", "1");
+        write(root.path(), "vendor.js", "2");
+        write(
+            &out,
+            "index.html",
+            r#"<script src="../dist-2/main.js" integrity="sha384-N"></script>
+               <script src="../vendor.js" integrity="sha384-V"></script>"#,
+        );
+
+        assert_eq!(find_pinned_scripts(&[out]), Vec::new());
+    }
+
+    /// Pointed at a FILE (`inject dist/app.js`), the scan still sees the page beside it — that is
+    /// the invocation a hand-written build script uses.
+    #[test]
+    fn a_file_argument_still_scans_its_directory() {
+        let dir = tempfile::tempdir().unwrap();
+        let js = write(dir.path(), "app.js", "1");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="app.js" integrity="sha384-F"></script>"#,
+        );
+
+        let found = find_pinned_scripts(&[js]);
+        assert_eq!(found.len(), 1, "{found:?}");
+        assert_eq!(found[0].script, dir.path().join("app.js"));
+    }
+
+    /// No HTML, an unreadable page, and a missing directory are all "nothing to report" — this
+    /// guard must never be the thing that fails a run.
+    #[test]
+    fn it_is_silent_when_there_is_nothing_to_find() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "index.js", "1");
+        assert_eq!(pinned(dir.path()), Vec::<PathBuf>::new());
+        assert_eq!(
+            find_pinned_scripts(&[dir.path().join("does-not-exist")]),
+            Vec::new()
+        );
+    }
+
+    /// `node_modules` and dot-directories inside a build output are not the app's pages.
+    #[test]
+    fn it_skips_node_modules_and_dot_directories() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.js", "1");
+        write(
+            dir.path(),
+            "node_modules/pkg/demo.html",
+            r#"<script src="/main.js" integrity="sha384-M"></script>"#,
+        );
+        write(
+            dir.path(),
+            ".cache/page.html",
+            r#"<script src="/main.js" integrity="sha384-C"></script>"#,
+        );
+
+        assert_eq!(pinned(dir.path()), Vec::<PathBuf>::new());
+    }
+}

From 1a158e562b4e586e6239c2ae73ffa36a1e182308 Mon Sep 17 00:00:00 2001
From: Alexey Karimov <krassx@gmail.com>
Date: Fri, 18 Sep 2026 18:39:26 +0500
Subject: [PATCH 2/4] fix(sourcemaps): the guard and the walk must share one
 list of what gets stamped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An adversarial review of #45 and #46 found two SEV1s and six SEV2/3s, and they all came from one
mistake: the SRI guard computed its own idea of which files were at risk while the walk computed its
own idea of which files to stamp, so the two disagreed in both directions.

**SEV1 — a CDN `publicPath` build shipped blank.** `output.publicPath: 'https://cdn…/'` with
webpack-subresource-integrity is the CANONICAL SRI deployment: hash the local bytes, serve them from
a CDN. The HTML then carries an absolute URL, which the guard dropped as "somebody else's file" —
while the very bytes it pinned sat in `dist/` and were stamped. A URL is now matched literally
first, then by file name, so the origin prefix (or `/static/`, `/_next/`) no longer hides it.
Verified on a real webpack build with a CDN publicPath: exit 20, both bundles byte-identical.

**SEV1 — a page under a dot-directory or `node_modules` was skipped by the guard but its target was
stamped by the walk.** A VitePress build (`docs/.vitepress/dist/index.html`) had its entry stamped
and went blank. Worse, a test asserted that skip as desired behaviour. The guard now walks exactly
what the stamping walks — no directory filter, no depth cap. Verified on the VitePress shape.

The restructure: one `collect_targets` list is built once, used for stamping, and handed to the
guard, which refuses only over a file in it. That closes, by construction:

- a `./dist` or `../dist` root turning a correctly `--exclude`d pinned file into a refusal (the
  README's own `--exclude 'polyfills*.js'` example),
- `inject dist/polyfills.js` being refused because some OTHER file is pinned,
- a refusal naming a path that does not exist (`dist/static/main.js` under a `/static/` publicPath),
- a stale page pinning a deleted bundle, or a symlinked directory, refusing the run,
- overlapping roots (`inject a a/b`) disagreeing about an excluded file — the walk stamped what the
  guard had excluded.

Also from the review: roots are absolutized, so an absolute `--exclude` pattern works with a relative
root; a pattern is tried relative to the current directory too (`dist/vendor/**`); an EMPTY pattern
is now a configuration error rather than a silent match-nothing; `.htm`/`.xhtml` count as pages; and
six surviving mutants got tests (`preload` vs `modulepreload`, `.htm`/`.xhtml`, multi-line comments,
absolute exclude patterns, deep pages, root-relative resolution). Ten mutants caught now; the three
tests that chdir take a lock, because `set_current_dir` is process-global and the harness threads.

Docs say plainly what the guard cannot see: SRI that never reaches the emitted HTML — a manifest
consumed by a server template, a page rendered at request time (Next.js `experimental.sri`), or HTML
written outside the directory it was pointed at.

Regression checked against origin/main: a plain build with no SRI and no --exclude stamps exactly as
before.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 CHANGELOG.md      |  23 +++-
 README.md         |  24 +++-
 src/inject/mod.rs | 247 ++++++++++++++++++++++++++++++++---
 src/inject/sri.rs | 324 +++++++++++++++++++++++++++++++++++++---------
 4 files changed, 532 insertions(+), 86 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c18aeec..29d8cc4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,17 +16,30 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   carry their own copy of this guard, but they only cover vite and rollup.
 
   Detected: `<script integrity src=…>` and `<link rel=modulepreload|preload integrity href=…>` in
-  any `.html` under the given paths. Deliberately NOT flagged: a CDN script, a non-JS target, a path
-  outside the output directory, an empty `integrity`, `data-integrity`/`data-src`, a commented-out
-  tag, and `rel=prefetch` (a failed prefetch is discarded, not fatal). `--exclude`d files do not
-  count either — a file we will not touch cannot have its hash invalidated.
+  any `.html`/`.htm`/`.xhtml` under the given paths. The URL is resolved literally first and then by
+  file name, so a `publicPath` — a CDN origin, `/static/`, `/_next/` — still resolves to the local
+  bytes it names; that is the canonical SRI deployment (hash locally, serve from a CDN) and treating
+  every absolute URL as somebody else's file would have missed it entirely.
+
+  The guard refuses only over a file this run would really stamp, sharing one list with the walk
+  that does the stamping: an `--exclude`d file, a stale page pinning a deleted bundle, a pin on
+  something outside the output, and a file argument naming an unpinned bundle all proceed. Also not
+  flagged: a genuine third-party CDN script, a non-JS target, an empty `integrity`,
+  `data-integrity`/`data-src`, an inline script, a commented-out tag, and `rel=prefetch` (a failed
+  prefetch is discarded, not fatal).
+
+  It cannot see SRI that never reaches the emitted HTML — a manifest consumed by a server template,
+  a page rendered at request time (Next.js `experimental.sri`), or HTML written outside the directory
+  it was pointed at.
 
   `--allow-sri` proceeds anyway, for a build that recomputes its hashes afterwards.
 - **`sourcemaps inject --exclude <glob>`** (repeatable) — leave part of a build output alone. A
   stock `next build` with browser source maps on has 39 JS files and 12 maps, and a Nuxt
   `.output/server/node_modules` holds 22 vendored `.mjs`; `--exclude '**/node_modules/**'` keeps
   `inject` out of third-party code inside the build output. Matched against the path relative to
-  each walked root and against the full path. An unparseable pattern is a configuration error
+  the absolute path, the path relative to the current directory, and the path relative to each
+  walked root, so `dist/vendor/**`, `vendor/**` and an absolute path all work whether the root is
+  passed as `dist`, `./dist` or absolute. An unparseable OR EMPTY pattern is a configuration error
   (exit 20), never a silent "matches nothing" that would rewrite the files you meant to protect.
   `js_excluded` is reported in the completion log.
 
diff --git a/README.md b/README.md
index 71b08bf..5506988 100644
--- a/README.md
+++ b/README.md
@@ -228,9 +228,16 @@ other type rather than accepted and ignored.
 
 `--exclude <glob>` (repeatable) keeps `inject` out of part of a build output — `--exclude
 '**/node_modules/**'` leaves vendored third-party code inside a server bundle untouched, `--exclude
-'polyfills*.js'` skips one file by name. Globs are matched against the path relative to each walked
-root and against the full path; an unparseable pattern is a configuration error (exit 20) rather
-than a silent "matches nothing", which would rewrite exactly the files you meant to protect.
+'polyfills*.js'` skips one file by name.
+
+A pattern is tried against the absolute path, the path relative to the current directory, and the
+path relative to each walked root, so `dist/vendor/**`, `vendor/**` and an absolute path all work
+whether you pass `dist`, `./dist` or the absolute directory. `*` crosses `/` (globset's default), so
+`*.js` matches `vendor/v.js` too — anchor with a leading `/` or a directory prefix if you do not want
+that. An unparseable or empty pattern is a configuration error (exit 20) rather than a silent
+"matches nothing", which would rewrite exactly the files you meant to protect. Patterns select
+BUNDLES: an excluded bundle's `.map` is left alone with it, but a pattern matching only `.map` files
+excludes nothing.
 
 **A bundle with no source map is still stamped, on purpose.** It looks like waste — the id cannot
 resolve to a symbol — but a crash frame carrying a debug-id whose map was never uploaded marks the
@@ -250,6 +257,17 @@ stops before writing anything. Angular's `subresourceIntegrity: true` is the sam
 Fix it by stamping BEFORE the hashes are computed, by `--exclude`-ing the pinned files, or — if your
 build recomputes hashes after this runs — with `--allow-sri`.
 
+The guard only ever refuses over a file this run would really stamp, so an excluded file, a stale
+page pinning a bundle that no longer exists, or a page pinning something outside the output does not
+stop it. A URL is matched literally first and then by file name, so a `publicPath` — a CDN origin,
+`/static/`, `/_next/` — still resolves to the local bytes it names; the cost of that fallback is that
+a third-party script sharing a file name with one of your bundles would be treated as yours.
+
+**It cannot see SRI that is not in the emitted HTML**: a manifest consumed by a server template
+(`webpack-assets-manifest` with `integrity: true`), a page rendered at request time (Next.js
+`experimental.sri`), or HTML your build writes outside the directory you point this at. Those builds
+still break, so keep `--allow-sri` off and check a deploy before trusting it.
+
 ```
 bugsee-cli sourcemaps inject <paths>... [--exclude <glob>]... [--allow-sri] [--dry-run]
 bugsee-cli debug-files upload --type sourcemaps <paths>... --version <v> --build <b> \
diff --git a/src/inject/mod.rs b/src/inject/mod.rs
index 07f5155..d0eacb0 100644
--- a/src/inject/mod.rs
+++ b/src/inject/mod.rs
@@ -120,6 +120,13 @@ fn exclude_matcher(patterns: &[String]) -> Result<Option<globset::GlobSet>> {
     }
     let mut builder = globset::GlobSetBuilder::new();
     for pattern in patterns {
+        // An empty pattern matches nothing at all. Accepting it silently is the same failure as a
+        // bad glob: the caller believes they protected a file they did not.
+        if pattern.trim().is_empty() {
+            return Err(Error::ConfigInvalid(
+                "--exclude was given an empty pattern; it would match nothing".to_string(),
+            ));
+        }
         let glob = globset::Glob::new(pattern)
             .map_err(|e| Error::ConfigInvalid(format!("--exclude {pattern:?}: {e}")))?;
         builder.add(glob);
@@ -139,6 +146,17 @@ fn is_excluded(matcher: Option<&globset::GlobSet>, roots: &[PathBuf], path: &Pat
     if matcher.is_match(path) {
         return true;
     }
+    // Relative to the CURRENT DIRECTORY as well: `--exclude 'dist/vendor/**'` is how a user thinks
+    // about their own build, and the roots are absolutized before the walk, so without this the
+    // pattern would match nothing at all.
+    if let Ok(cwd) = std::env::current_dir() {
+        if path
+            .strip_prefix(sri::lexical_normalize(&cwd))
+            .is_ok_and(|rel| matcher.is_match(rel))
+        {
+            return true;
+        }
+    }
     roots.iter().any(|root| {
         let base = if root.is_file() {
             root.parent().unwrap_or(Path::new("."))
@@ -167,13 +185,18 @@ pub fn inject_paths(
     dry_run: bool,
 ) -> Result<InjectStats> {
     let matcher = exclude_matcher(exclude)?;
+    // ONE list decides everything: which files get stamped, and therefore which pinned hashes could
+    // possibly be invalidated. A review of the first draft found six ways the guard and the walk
+    // could disagree when each computed its own answer — a pinned file the guard refused over but
+    // the walk would never have touched, and (worse) a page the guard skipped while the walk stamped
+    // what it pinned. They cannot disagree about a list they share.
+    let roots: Vec<PathBuf> = paths.iter().map(|p| absolutize(p)).collect();
+    let mut stats = InjectStats::default();
+    let targets = collect_targets(&roots, matcher.as_ref(), &mut stats);
+
     if !allow_sri {
-        // A file we are not going to touch cannot have its hash invalidated, so the exclusions
-        // apply here too.
-        let pinned: Vec<_> = sri::find_pinned_scripts(paths)
-            .into_iter()
-            .filter(|p| !is_excluded(matcher.as_ref(), paths, &p.script))
-            .collect();
+        let index: std::collections::BTreeSet<PathBuf> = targets.iter().cloned().collect();
+        let pinned = sri::find_pinned_scripts(&roots, &index);
         if let Some(first) = pinned.first() {
             let more = if pinned.len() > 1 {
                 format!(" (and {} more)", pinned.len() - 1)
@@ -195,10 +218,41 @@ pub fn inject_paths(
             return Err(Error::ConfigInvalid(message));
         }
     }
-    let mut stats = InjectStats::default();
-    for root in paths {
-        // Sorted, so a run is the same on every file system (it decides, e.g.,
-        // which bundle first stamps a map two bundles share).
+
+    for target in &targets {
+        inject_one(target, dry_run, &mut stats)?;
+    }
+    Ok(stats)
+}
+
+/// Absolute, `.`/`..` resolved lexically. NOT `canonicalize`: that requires the path to exist and
+/// resolves symlinks, and `inject dist` on a symlinked `dist` should still report `dist/...`.
+fn absolutize(path: &Path) -> PathBuf {
+    let joined = if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        std::env::current_dir()
+            .unwrap_or_else(|_| PathBuf::from("."))
+            .join(path)
+    };
+    sri::lexical_normalize(&joined)
+}
+
+/// Every `.js`/`.cjs`/`.mjs` under `roots` that this run would stamp, in walk order, de-duplicated
+/// (overlapping roots are a supported invocation: `inject a a/b`).
+///
+/// Counts the excluded ones into `stats` as it goes, so `--exclude` is reported exactly once per
+/// file even when two roots reach it.
+fn collect_targets(
+    roots: &[PathBuf],
+    matcher: Option<&globset::GlobSet>,
+    stats: &mut InjectStats,
+) -> Vec<PathBuf> {
+    let mut targets = Vec::new();
+    let mut seen = std::collections::BTreeSet::new();
+    for root in roots {
+        // Sorted, so a run is the same on every file system (it decides, e.g., which bundle first
+        // stamps a map two bundles share).
         for entry in walkdir::WalkDir::new(root)
             .sort_by_file_name()
             .into_iter()
@@ -209,20 +263,24 @@ pub fn inject_paths(
                 continue;
             }
             let is_js = matches!(
-                p.extension().and_then(|e| e.to_str()),
+                p.extension()
+                    .and_then(|e| e.to_str())
+                    .map(str::to_ascii_lowercase)
+                    .as_deref(),
                 Some("js") | Some("cjs") | Some("mjs")
             );
-            if is_js {
-                if is_excluded(matcher.as_ref(), std::slice::from_ref(root), p) {
-                    stats.js_excluded += 1;
-                    tracing::info!(path = %p.display(), "excluded");
-                    continue;
-                }
-                inject_one(p, dry_run, &mut stats)?;
+            if !is_js || !seen.insert(p.to_path_buf()) {
+                continue;
+            }
+            if is_excluded(matcher, roots, p) {
+                stats.js_excluded += 1;
+                tracing::info!(path = %p.display(), "excluded");
+                continue;
             }
+            targets.push(p.to_path_buf());
         }
     }
-    Ok(stats)
+    targets
 }
 
 fn inject_one(js_path: &Path, dry_run: bool, stats: &mut InjectStats) -> Result<()> {
@@ -497,6 +555,10 @@ pub fn read_debug_id(map_path: &Path) -> Result<Option<String>> {
 mod tests {
     use super::*;
 
+    /// `set_current_dir` is process-global and the test harness is threaded: the tests that check a
+    /// RELATIVE root have to take turns, or they change the directory out from under each other.
+    static CWD_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
     #[test]
     fn is_contained_relative_rejects_traversal_and_absolute() {
         assert!(is_contained_relative("bundle.js.map"));
@@ -601,6 +663,153 @@ mod tests {
         assert!(inject_paths(&[dir.path().to_path_buf()], &[], false, true).is_err());
     }
 
+    /// A relative root (`./dist`, `../dist`) must behave exactly like the absolute one. It did not:
+    /// the guard produced an absolute path while the exclusion matched components of the path as
+    /// typed, so `inject ./dist --exclude 'polyfills*.js'` — the README's own example — refused the
+    /// run instead of excluding the file.
+    #[test]
+    fn a_relative_root_excludes_and_guards_the_same_as_an_absolute_one() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("polyfills.js"), "console.log(1)\n").unwrap();
+        std::fs::write(dir.path().join("app.js"), "console.log(2)\n").unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="polyfills.js" integrity="sha384-P"></script>"#,
+        )
+        .unwrap();
+
+        let _serialized = CWD_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let cwd = std::env::current_dir().unwrap();
+        std::env::set_current_dir(dir.path().parent().unwrap()).unwrap();
+        let name = dir
+            .path()
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .to_string();
+        let result = ["./", ""]
+            .into_iter()
+            .try_fold(Vec::new(), |mut acc, prefix| {
+                let root = PathBuf::from(format!("{prefix}{name}"));
+                inject_paths(&[root], &["polyfills*.js".to_string()], false, true).map(|stats| {
+                    acc.push(stats.js_excluded);
+                    acc
+                })
+            });
+        std::env::set_current_dir(cwd).unwrap();
+
+        assert_eq!(
+            result.unwrap(),
+            vec![1, 1],
+            "both spellings must exclude it"
+        );
+    }
+
+    /// An absolute `--exclude` pattern is documented to work, and did not when the root was
+    /// relative — the matcher only ever saw the path as typed.
+    #[test]
+    fn an_absolute_exclude_pattern_works_whatever_the_root_looks_like() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(dir.path().join("vendor")).unwrap();
+        std::fs::write(dir.path().join("vendor/v.js"), "console.log(1)\n").unwrap();
+        std::fs::write(dir.path().join("app.js"), "console.log(2)\n").unwrap();
+        let _serialized = CWD_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let cwd = std::env::current_dir().unwrap();
+        std::env::set_current_dir(dir.path().parent().unwrap()).unwrap();
+        let name = dir
+            .path()
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .to_string();
+        // Built AFTER the chdir, from the resolved working directory: on macOS the fixture lives
+        // under a `/var` symlink whose real name is `/private/var`, and the absolute path a user in
+        // that directory would type is the resolved one.
+        let absolute = format!(
+            "{}/vendor/**",
+            std::env::current_dir()
+                .unwrap()
+                .join(&name)
+                .to_string_lossy()
+        );
+        let stats = inject_paths(&[PathBuf::from(name)], &[absolute], false, true);
+        std::env::set_current_dir(cwd).unwrap();
+
+        assert_eq!(stats.unwrap().js_excluded, 1);
+    }
+
+    /// A pattern written the way the user sees their own tree — `dist/vendor/**` from the directory
+    /// above — must work. The roots are absolutized before the walk, so nothing would match without
+    /// also trying the path relative to the current directory.
+    #[test]
+    fn an_exclude_pattern_relative_to_the_current_directory_works() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(dir.path().join("vendor")).unwrap();
+        std::fs::write(dir.path().join("vendor/v.js"), "console.log(1)\n").unwrap();
+        std::fs::write(dir.path().join("app.js"), "console.log(2)\n").unwrap();
+
+        let _serialized = CWD_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let cwd = std::env::current_dir().unwrap();
+        std::env::set_current_dir(dir.path().parent().unwrap()).unwrap();
+        let name = dir
+            .path()
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .to_string();
+        let stats = inject_paths(
+            &[PathBuf::from(&name)],
+            &[format!("{name}/vendor/**")],
+            false,
+            true,
+        );
+        std::env::set_current_dir(cwd).unwrap();
+
+        assert_eq!(stats.unwrap().js_excluded, 1);
+    }
+
+    /// An empty pattern matches nothing, which is the same failure mode as a malformed one: the
+    /// caller believes a file is protected when it is not.
+    #[test]
+    fn an_empty_exclude_pattern_is_a_configuration_error() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("app.js"), "console.log(1)\n").unwrap();
+
+        let err =
+            inject_paths(&[dir.path().to_path_buf()], &["".to_string()], false, true).unwrap_err();
+        assert!(format!("{err:#}").contains("empty pattern"), "{err:#}");
+        assert_eq!(
+            crate::error::classify(&anyhow::Error::new(err)),
+            crate::exit_code::ExitCode::ConfigInvalid
+        );
+    }
+
+    /// Overlapping roots are a supported invocation (`inject a a/b`), and the exclusion must hold
+    /// for the file whichever root reached it — the guard and the walk share one list precisely so
+    /// they cannot answer differently.
+    #[test]
+    fn overlapping_roots_agree_about_an_excluded_file() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::create_dir_all(dir.path().join("b")).unwrap();
+        std::fs::write(dir.path().join("b/x.js"), "console.log(1)\n").unwrap();
+
+        let stats = inject_paths(
+            &[dir.path().to_path_buf(), dir.path().join("b")],
+            &["b/**".to_string()],
+            false,
+            false,
+        )
+        .unwrap();
+
+        assert_eq!((stats.js_injected, stats.js_excluded), (0, 1));
+        assert!(!std::fs::read_to_string(dir.path().join("b/x.js"))
+            .unwrap()
+            .contains("debugId="));
+    }
+
     /// `--exclude` keeps `inject` out of parts of a build output it should not rewrite. Measured
     /// need: a stock `next build` with browser source maps on has 39 JS files and 12 maps, and a
     /// Nuxt `.output/server/node_modules` holds 22 `.mjs` — vendored third-party code inside the
diff --git a/src/inject/sri.rs b/src/inject/sri.rs
index f6706c9..5a9a6de 100644
--- a/src/inject/sri.rs
+++ b/src/inject/sri.rs
@@ -47,8 +47,10 @@ static SRC_ATTR: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r#"(?i)[\s"'<]src\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)"#).unwrap());
 static HREF_ATTR: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r#"(?i)[\s"'<]href\s*=\s*("[^"]*"|'[^']*'|[^\s>]+)"#).unwrap());
-static ABSOLUTE_URL: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r"^[a-zA-Z][a-zA-Z0-9+.-]*:").unwrap());
+// `https:`, `//cdn…` — the origin half of a URL, which has no counterpart on disk. What follows it
+// still can: `publicPath` pointing at a CDN is the canonical SRI deployment.
+static ABSOLUTE_URL_PREFIX: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^([a-zA-Z][a-zA-Z0-9+.-]*:)?//").unwrap());
 
 fn unquote(value: &str) -> &str {
     let bytes = value.as_bytes();
@@ -62,32 +64,61 @@ fn unquote(value: &str) -> &str {
     }
 }
 
-/// The file a `src`/`href` names, when it is one we could stamp: same-origin, and inside `root`.
-fn resolve_local_script(root: &Path, html_dir: &Path, url: &str) -> Option<PathBuf> {
-    // A URL with a scheme, or protocol-relative, is somebody else's file (a CDN): its bytes are not
-    // ours to change, so stamping cannot invalidate its hash.
-    if url.starts_with("//") || ABSOLUTE_URL.is_match(url) {
-        return None;
-    }
+/// The file a `src`/`href` names, resolved against the files this run would actually stamp.
+///
+/// `targets` is the whole point: the only hash we can invalidate is one belonging to a file we are
+/// going to rewrite. Matching against the file system instead produced both kinds of error — a stale
+/// page pinning a deleted bundle refused the run, while a page whose URL did not resolve literally
+/// (a CDN `publicPath`) sailed through and the build shipped blank.
+fn resolve_pinned_target(
+    roots: &[PathBuf],
+    targets: &BTreeSet<PathBuf>,
+    html_dir: &Path,
+    url: &str,
+) -> Option<PathBuf> {
     // Browsers strip surrounding whitespace from a URL attribute, so `src=" main.js "` loads it.
-    let path_part = url.split(['?', '#']).next().unwrap_or("").trim();
+    let trimmed = url.trim();
+    let path_part = if let Some(rest) = ABSOLUTE_URL_PREFIX.find(trimmed) {
+        // `https://cdn.example.com/assets/main.abc.js` — webpack's `output.publicPath` pointing at a
+        // CDN is the CANONICAL SRI deployment (hash the local bytes, serve them from the CDN), and
+        // those bytes are the ones sitting in the output directory. Keep the path, drop the origin.
+        let after_scheme = &trimmed[rest.end()..];
+        after_scheme.split_once('/').map(|(_, p)| p).unwrap_or("")
+    } else {
+        trimmed
+    };
+    let path_part = path_part.split(['?', '#']).next().unwrap_or("").trim();
     if path_part.is_empty() {
         return None;
     }
-    let candidate = if let Some(rooted) = path_part.strip_prefix('/') {
-        // A root-relative `/assets/app.js` is served from the output root.
-        root.join(rooted)
+
+    // 1. Where the URL literally points, relative to the page (or to the root when root-relative).
+    let literal = if let Some(rooted) = path_part.strip_prefix('/') {
+        roots
+            .iter()
+            .map(|r| lexical_normalize(&r.join(rooted)))
+            .collect::<Vec<_>>()
     } else {
-        html_dir.join(path_part)
+        vec![lexical_normalize(&html_dir.join(path_part))]
     };
-    let full = normalize(&candidate);
-    let base = normalize(root);
-    // `starts_with` on COMPONENTS, so `dist-2` is not read as inside `dist`.
-    full.starts_with(&base).then_some(full)
+    if let Some(hit) = literal.into_iter().find(|p| targets.contains(p)) {
+        return Some(hit);
+    }
+
+    // 2. Otherwise by file name. A `publicPath` — `/static/`, `/_next/`, a CDN origin — puts a
+    //    prefix in the URL that has no counterpart on disk, so the literal path resolves to nothing
+    //    while the pinned bytes are very much in the output. Bundler file names carry a content
+    //    hash, so a collision is unlikely; and refusing a build we would not have broken costs
+    //    symbolication, while missing one ships a page that loads nothing.
+    let name = Path::new(path_part).file_name()?;
+    targets
+        .iter()
+        .find(|t| t.file_name() == Some(name))
+        .cloned()
 }
 
-/// Lexical `..`/`.` resolution — the file may not exist yet, so `canonicalize` is not an option.
-fn normalize(path: &Path) -> PathBuf {
+/// Lexical `..`/`.` resolution — the path may not exist, so `canonicalize` is not an option.
+pub fn lexical_normalize(path: &Path) -> PathBuf {
     let mut out = PathBuf::new();
     for component in path.components() {
         match component {
@@ -101,21 +132,14 @@ fn normalize(path: &Path) -> PathBuf {
     out
 }
 
-fn is_js(path: &Path) -> bool {
-    matches!(
-        path.extension()
-            .and_then(|e| e.to_str())
-            .map(str::to_ascii_lowercase)
-            .as_deref(),
-        Some("js") | Some("cjs") | Some("mjs")
-    )
-}
-
-/// Every script under `roots` whose hash an HTML page there pins.
+/// Every file this run would stamp whose hash an HTML page under `roots` pins.
 ///
 /// Empty means stamping is safe as far as SRI is concerned. Never fails on a path problem: that is
 /// the caller's to report.
-pub fn find_pinned_scripts(roots: &[PathBuf]) -> Vec<PinnedScript> {
+pub fn find_pinned_scripts(roots: &[PathBuf], targets: &BTreeSet<PathBuf>) -> Vec<PinnedScript> {
+    if targets.is_empty() {
+        return Vec::new();
+    }
     let mut found = BTreeSet::new();
     for root in roots {
         // A file argument (`inject dist/app.js`) has no HTML of its own; scan its directory.
@@ -124,19 +148,12 @@ pub fn find_pinned_scripts(roots: &[PathBuf]) -> Vec<PinnedScript> {
         } else {
             root.clone()
         };
+        // No directory filter and no depth cap: the WALK has none either, so a page under
+        // `.vitepress/dist` or `node_modules` pins a file we really are going to stamp. (Skipping
+        // them was a false negative the first draft shipped — it stamped what such a page pinned.)
         for entry in walkdir::WalkDir::new(&base)
-            .max_depth(8)
             .sort_by_file_name()
             .into_iter()
-            .filter_entry(|e| {
-                // `e.depth() > 0`: the filter must not judge the ROOT the caller named. A build
-                // output legitimately lives in a dot-directory (`.next`, `.nuxt`, `.output`, and a
-                // `tempfile` fixture), and excluding it would silently scan nothing at all.
-                let name = e.file_name().to_string_lossy();
-                !(e.depth() > 0
-                    && e.file_type().is_dir()
-                    && (name == "node_modules" || name.starts_with('.')))
-            })
             .filter_map(Result::ok)
         {
             let page = entry.path();
@@ -179,11 +196,9 @@ pub fn find_pinned_scripts(roots: &[PathBuf]) -> Vec<PinnedScript> {
                 let Some(url) = url_attr.captures(tag).and_then(|c| c.get(1)) else {
                     continue;
                 };
-                let Some(script) = resolve_local_script(&base, html_dir, unquote(url.as_str()))
-                else {
-                    continue;
-                };
-                if is_js(&script) {
+                if let Some(script) =
+                    resolve_pinned_target(roots, targets, html_dir, unquote(url.as_str()))
+                {
                     found.insert(PinnedScript {
                         html: page.to_path_buf(),
                         script,
@@ -206,13 +221,38 @@ mod tests {
         full
     }
 
-    fn pinned(dir: &Path) -> Vec<PathBuf> {
-        find_pinned_scripts(&[dir.to_path_buf()])
+    /// The files an `inject` over `dir` would stamp — every `.js`/`.cjs`/`.mjs` under it. In
+    /// production this list comes from the same walk that does the stamping, which is the point:
+    /// the guard can only refuse over a file that is really going to be rewritten.
+    fn targets_of(dirs: &[&Path]) -> BTreeSet<PathBuf> {
+        dirs.iter()
+            .flat_map(|dir| {
+                walkdir::WalkDir::new(dir)
+                    .into_iter()
+                    .filter_map(Result::ok)
+                    .filter(|e| e.file_type().is_file())
+                    .map(|e| e.path().to_path_buf())
+            })
+            .filter(|p| {
+                matches!(
+                    p.extension().and_then(|e| e.to_str()),
+                    Some("js") | Some("cjs") | Some("mjs")
+                )
+            })
+            .collect()
+    }
+
+    fn pinned_in(dir: &Path, targets: &BTreeSet<PathBuf>) -> Vec<PathBuf> {
+        find_pinned_scripts(&[dir.to_path_buf()], targets)
             .into_iter()
             .map(|p| p.script)
             .collect()
     }
 
+    fn pinned(dir: &Path) -> Vec<PathBuf> {
+        pinned_in(dir, &targets_of(&[dir]))
+    }
+
     /// The shape that breaks: webpack-subresource-integrity + html-webpack-plugin.
     #[test]
     fn a_pinned_entry_script_is_found() {
@@ -224,7 +264,7 @@ mod tests {
             "<!doctype html><script defer src=main.abc123.js integrity=sha384-KUBb crossorigin=anonymous></script>",
         );
 
-        let found = find_pinned_scripts(&[dir.path().to_path_buf()]);
+        let found = find_pinned_scripts(&[dir.path().to_path_buf()], &targets_of(&[dir.path()]));
         assert_eq!(found.len(), 1);
         assert_eq!(found[0].script, dir.path().join("main.abc123.js"));
         assert_eq!(found[0].html, dir.path().join("index.html"));
@@ -318,7 +358,10 @@ mod tests {
                <script src="../vendor.js" integrity="sha384-V"></script>"#,
         );
 
-        assert_eq!(find_pinned_scripts(&[out]), Vec::new());
+        assert_eq!(
+            find_pinned_scripts(std::slice::from_ref(&out), &targets_of(&[&out])),
+            Vec::new()
+        );
     }
 
     /// Pointed at a FILE (`inject dist/app.js`), the scan still sees the page beside it — that is
@@ -333,7 +376,7 @@ mod tests {
             r#"<script src="app.js" integrity="sha384-F"></script>"#,
         );
 
-        let found = find_pinned_scripts(&[js]);
+        let found = find_pinned_scripts(std::slice::from_ref(&js), &targets_of(&[dir.path()]));
         assert_eq!(found.len(), 1, "{found:?}");
         assert_eq!(found[0].script, dir.path().join("app.js"));
     }
@@ -346,27 +389,190 @@ mod tests {
         write(dir.path(), "index.js", "1");
         assert_eq!(pinned(dir.path()), Vec::<PathBuf>::new());
         assert_eq!(
-            find_pinned_scripts(&[dir.path().join("does-not-exist")]),
+            find_pinned_scripts(
+                &[dir.path().join("does-not-exist")],
+                &targets_of(&[dir.path()])
+            ),
             Vec::new()
         );
     }
 
-    /// `node_modules` and dot-directories inside a build output are not the app's pages.
+    /// A page under a dot-directory or `node_modules` still pins a file the walk WILL stamp — and
+    /// the walk descends both. The first draft skipped them here and shipped that false negative:
+    /// a VitePress build (`docs/.vitepress/dist/index.html`) had its entry stamped and went blank.
+    #[test]
+    fn a_page_under_a_dot_directory_or_node_modules_still_counts() {
+        for nested in [".vitepress/dist/index.html", "node_modules/pkg/index.html"] {
+            let dir = tempfile::tempdir().unwrap();
+            write(dir.path(), "main.js", "1");
+            write(
+                dir.path(),
+                nested,
+                r#"<script src="/main.js" integrity="sha384-M"></script>"#,
+            );
+
+            assert_eq!(
+                pinned(dir.path()),
+                vec![dir.path().join("main.js")],
+                "page at {nested} was not seen"
+            );
+        }
+    }
+
+    /// `output.publicPath` pointing at a CDN is the CANONICAL SRI deployment — hash the local bytes,
+    /// serve them from the CDN — so the URL carries an origin that exists nowhere on disk while the
+    /// pinned bytes are the ones in the output directory. Dropping every absolute URL as "somebody
+    /// else's file" shipped a blank page for exactly the setup SRI exists for.
+    #[test]
+    fn a_cdn_public_path_still_resolves_to_the_local_file() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.abc123.js", "1");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="https://cdn.example.com/assets/main.abc123.js" integrity="sha384-C"></script>"#,
+        );
+
+        assert_eq!(pinned(dir.path()), vec![dir.path().join("main.abc123.js")]);
+    }
+
+    /// The same shape one level down: a root-relative `publicPath` (`/static/`, `/_next/`) prefixes
+    /// the URL with a directory that does not exist under the output root.
     #[test]
-    fn it_skips_node_modules_and_dot_directories() {
+    fn a_root_relative_public_path_resolves_by_file_name() {
         let dir = tempfile::tempdir().unwrap();
         write(dir.path(), "main.js", "1");
         write(
             dir.path(),
-            "node_modules/pkg/demo.html",
-            r#"<script src="/main.js" integrity="sha384-M"></script>"#,
+            "index.html",
+            r#"<script src="/static/main.js" integrity="sha384-S"></script>"#,
         );
+
+        assert_eq!(pinned(dir.path()), vec![dir.path().join("main.js")]);
+    }
+
+    /// The literal path wins over the file-name fallback: a build with `app.js` in two directories
+    /// must resolve to the one the page actually points at, or the refusal names the wrong file and
+    /// `--exclude`ing that file would not lift it.
+    #[test]
+    fn the_literal_path_decides_when_two_bundles_share_a_name() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "en/app.js", "1");
+        write(dir.path(), "fr/app.js", "2");
         write(
             dir.path(),
-            ".cache/page.html",
-            r#"<script src="/main.js" integrity="sha384-C"></script>"#,
+            "fr/index.html",
+            r#"<script src="app.js" integrity="sha384-F"></script>"#,
+        );
+
+        assert_eq!(pinned(dir.path()), vec![dir.path().join("fr/app.js")]);
+    }
+
+    /// …but a CDN script that is NOT part of this build stays ignored: nothing we stamp bears that
+    /// name, so nothing we do can invalidate its hash.
+    #[test]
+    fn a_third_party_cdn_script_is_still_ignored() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.js", "1");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="https://cdn.example.com/jquery-3.7.1.min.js" integrity="sha384-J"></script>"#,
         );
 
         assert_eq!(pinned(dir.path()), Vec::<PathBuf>::new());
     }
+
+    /// Only a file this run would STAMP can have its hash invalidated. A page pinning a bundle that
+    /// no longer exists (a stale `index.html` from an earlier build), or one the caller excluded, or
+    /// one outside the output entirely, must not stop the run.
+    #[test]
+    fn a_pin_on_something_we_will_not_stamp_is_ignored() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "main.js", "1");
+        write(dir.path(), "vendor/pinned.js", "2");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="gone.OLD.js" integrity="sha384-G"></script>
+               <script src="vendor/pinned.js" integrity="sha384-V"></script>"#,
+        );
+
+        // `vendor/pinned.js` is real but NOT in the target list — the caller excluded it.
+        let targets: BTreeSet<PathBuf> = [dir.path().join("main.js")].into_iter().collect();
+        assert_eq!(pinned_in(dir.path(), &targets), Vec::<PathBuf>::new());
+    }
+
+    /// A file argument stamps ONE file, so only a pin on that file can matter. Passing the unpinned
+    /// bundle explicitly is the most direct way to follow the error's own advice.
+    #[test]
+    fn a_file_argument_only_counts_pins_on_that_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let app = write(dir.path(), "app.js", "1");
+        write(dir.path(), "main.js", "2");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="main.js" integrity="sha384-M"></script>"#,
+        );
+
+        let targets: BTreeSet<PathBuf> = [app.clone()].into_iter().collect();
+        assert_eq!(
+            find_pinned_scripts(std::slice::from_ref(&app), &targets),
+            Vec::new(),
+            "only main.js is pinned, and only app.js would be stamped"
+        );
+
+        // …and a pin on the file we ARE stamping still counts.
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="app.js" integrity="sha384-A"></script>"#,
+        );
+        assert_eq!(
+            find_pinned_scripts(std::slice::from_ref(&app), &targets).len(),
+            1
+        );
+    }
+
+    /// `.htm` and `.xhtml` are pages too, and a deep page is still a page: the walk that stamps has
+    /// no depth limit, so neither can this.
+    #[test]
+    fn it_reads_htm_and_xhtml_and_deep_pages() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "a.js", "1");
+        write(dir.path(), "b.js", "2");
+        write(
+            dir.path(),
+            "legacy.htm",
+            r#"<script src="/a.js" integrity="sha384-A"></script>"#,
+        );
+        write(
+            dir.path(),
+            "a/b/c/d/e/f/g/h/i/deep.xhtml",
+            r#"<script src="/b.js" integrity="sha384-B"/>"#,
+        );
+
+        let mut found = pinned(dir.path());
+        found.sort();
+        let mut want = vec![dir.path().join("a.js"), dir.path().join("b.js")];
+        want.sort();
+        assert_eq!(found, want);
+    }
+
+    /// A comment spanning lines is still a comment (the `(?s)` flag), and `preload` counts as well
+    /// as `modulepreload`.
+    #[test]
+    fn multiline_comments_and_both_preload_rels() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "commented.js", "1");
+        write(dir.path(), "preloaded.js", "2");
+        write(
+            dir.path(),
+            "index.html",
+            "<!--\n<script src=\"commented.js\" integrity=\"sha384-C\"></script>\n-->\n             <link rel=\"preload\" as=\"script\" href=\"preloaded.js\" integrity=\"sha384-P\">",
+        );
+
+        assert_eq!(pinned(dir.path()), vec![dir.path().join("preloaded.js")]);
+    }
 }

From ca116b253f34f483bb553796ceddeb6490e22188 Mon Sep 17 00:00:00 2001
From: Alexey Karimov <krassx@gmail.com>
Date: Fri, 18 Sep 2026 20:27:41 +0500
Subject: [PATCH 3/4] fix(sourcemaps): re-running inject on an already-stamped
 SRI build must stay a no-op
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A review of the whole 0.7.11 delta found the guard refusing over files it would never rewrite.

`--help` promises "re-running on already-injected files is a no-op", and the documented workflow for
a build that pins its hashes is `--allow-sri` once, then let the build recompute them. Any later run
without the flag — a second CI job, an upload step that re-injects, a retry after a flaky step —
then failed with exit 20 while changing nothing. A 0.7.10 user with that pipeline would break on
upgrade.

The guard now filters the pinned scripts through `would_rewrite`, which mirrors `inject_one`'s
decision: a fresh bundle, a re-key (regenerated map), or a foreign id still missing our registration
all count; an already-stamped bundle with an unchanged map does not. A test drives both functions
over the same fixtures and asserts they agree, so they cannot drift apart — which is the exact class
of bug the shared-target-list design exists to prevent.

Also from the same review:

- **The guard was blind to a page one level ABOVE the given path.** The standard Vite/webpack layout
  is `dist/index.html` beside `dist/assets/*.js`, so `inject dist/assets` (or one bundle by path)
  stamped the pinned file and exited 0. Pages directly in the parent are now read too — only when
  the given path holds no pages of its own, and bounded to 2000 entries, because that parent can be
  a directory nobody meant us to read. (`/tmp` with thousands of entries: the unbounded first
  attempt took the inject tests from 0.07 s to 23 s.)
- **The "exit 20 for a bad `--exclude` glob" contract was asserted nowhere** — the test checked only
  that the message named the flag, so the classification a CI script actually reads was left to
  chance. Same for the dry-run refusal, which asserted a bare `is_err()`.
- Docs: `--exclude`'s `--help` did not mention the cwd-relative match, the CHANGELOG line about it
  was garbled ("relative to the absolute path"), and neither said that a CDN script sharing a file
  name with one of your bundles IS refused, or that `--dry-run` refuses.

Five mutants caught (filter removed, filter always-on, registration case dropped, parent scan
removed, parent scan emptied).

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 README.md             |  12 +++-
 src/cli/sourcemaps.rs |   6 +-
 src/inject/mod.rs     | 155 +++++++++++++++++++++++++++++++++++++++++-
 src/inject/sri.rs     | 104 ++++++++++++++++++++++------
 4 files changed, 251 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index 5506988..2bf54b3 100644
--- a/README.md
+++ b/README.md
@@ -257,9 +257,15 @@ stops before writing anything. Angular's `subresourceIntegrity: true` is the sam
 Fix it by stamping BEFORE the hashes are computed, by `--exclude`-ing the pinned files, or — if your
 build recomputes hashes after this runs — with `--allow-sri`.
 
-The guard only ever refuses over a file this run would really stamp, so an excluded file, a stale
-page pinning a bundle that no longer exists, or a page pinning something outside the output does not
-stop it. A URL is matched literally first and then by file name, so a `publicPath` — a CDN origin,
+The guard only ever refuses over a file this run would really REWRITE, so a re-run that changes
+nothing is still a no-op — including on a build stamped once with `--allow-sri` — and an excluded
+file, a stale page pinning a bundle that no longer exists, or a page pinning something outside the
+output does not stop it either.
+
+Pages are read from anywhere under the path you give it, plus any sitting directly in that path's
+parent — the usual layout is `dist/index.html` beside `dist/assets/*.js`, so `inject dist/assets`
+still sees the page that pins those bundles. `--dry-run` refuses too: the preview of a run that
+would refuse is a refusal, and it tells you why. A URL is matched literally first and then by file name, so a `publicPath` — a CDN origin,
 `/static/`, `/_next/` — still resolves to the local bytes it names; the cost of that fallback is that
 a third-party script sharing a file name with one of your bundles would be treated as yours.
 
diff --git a/src/cli/sourcemaps.rs b/src/cli/sourcemaps.rs
index 87ba55f..de0c4de 100644
--- a/src/cli/sourcemaps.rs
+++ b/src/cli/sourcemaps.rs
@@ -20,8 +20,10 @@ pub enum SourcemapsCommand {
         #[arg(required = true)]
         paths: Vec<PathBuf>,
 
-        /// Glob of files NOT to touch; repeatable. Matched against the path relative to each
-        /// walked root and against the full path, so `--exclude '**/node_modules/**'` keeps
+        /// Glob of files NOT to touch; repeatable. Matched against the absolute path, the path
+        /// relative to the current directory, and the path relative to each walked root, so
+        /// `dist/vendor/**`, `vendor/**` and an absolute path all work whatever the root looks
+        /// like. `*` crosses `/`. So `--exclude '**/node_modules/**'` keeps
         /// `inject` out of vendored code inside a build output (a Nuxt `.output/server` carries
         /// 22 such `.mjs`), and `--exclude 'polyfills*.js'` skips one file by name.
         ///
diff --git a/src/inject/mod.rs b/src/inject/mod.rs
index d0eacb0..1486ad6 100644
--- a/src/inject/mod.rs
+++ b/src/inject/mod.rs
@@ -196,7 +196,12 @@ pub fn inject_paths(
 
     if !allow_sri {
         let index: std::collections::BTreeSet<PathBuf> = targets.iter().cloned().collect();
-        let pinned = sri::find_pinned_scripts(&roots, &index);
+        let pinned: Vec<_> = sri::find_pinned_scripts(&roots, &index)
+            .into_iter()
+            // A bundle this run would leave byte-identical cannot invalidate the hash that pins it.
+            // An unreadable one is reported as at-risk; `inject_one` is about to fail on it anyway.
+            .filter(|p| would_rewrite(&p.script).unwrap_or(true))
+            .collect();
         if let Some(first) = pinned.first() {
             let more = if pinned.len() > 1 {
                 format!(" (and {} more)", pinned.len() - 1)
@@ -283,6 +288,27 @@ fn collect_targets(
     targets
 }
 
+/// Would [`inject_one`] rewrite this bundle's BYTES?
+///
+/// The SRI guard refuses only over files this answers `true` for: a run that changes nothing cannot
+/// invalidate a hash, and re-running `inject` is documented as a no-op — including on a build that
+/// pins its hashes and was stamped once with `--allow-sri`.
+///
+/// Mirrors `inject_one`'s decision, and `would_rewrite_agrees_with_what_inject_actually_writes`
+/// pins the two together so they cannot drift.
+fn would_rewrite(js_path: &Path) -> Result<bool> {
+    let content = std::fs::read_to_string(js_path)?;
+    let map_path = paired_map(js_path, &content);
+    Ok(match existing_debug_id(&content) {
+        // A regenerated map re-keys the bundle; a foreign id still needs our runtime registration.
+        Some(id) => {
+            restamp_id(&content, &id, map_path.as_deref())?.is_some()
+                || !content.contains(&runtime_registration(&id))
+        }
+        None => true,
+    })
+}
+
 fn inject_one(js_path: &Path, dry_run: bool, stats: &mut InjectStats) -> Result<()> {
     let content = std::fs::read_to_string(js_path)?;
     let map_path = paired_map(js_path, &content);
@@ -660,7 +686,126 @@ mod tests {
         )
         .unwrap();
 
-        assert!(inject_paths(&[dir.path().to_path_buf()], &[], false, true).is_err());
+        let err = inject_paths(&[dir.path().to_path_buf()], &[], false, true).unwrap_err();
+        assert!(
+            format!("{err:#}").contains("Subresource Integrity"),
+            "{err:#}"
+        );
+        assert_eq!(
+            crate::error::classify(&anyhow::Error::new(err)),
+            crate::exit_code::ExitCode::ConfigInvalid
+        );
+        // A preview of a run that would refuse IS a refusal — and nothing is written either way.
+        assert_eq!(
+            std::fs::read_to_string(dir.path().join("main.js")).unwrap(),
+            "console.log(1)\n"
+        );
+    }
+
+    /// Re-running `inject` is documented as a no-op, and that has to stay true on a build that
+    /// pins its hashes: the supported workflow for such a build is `--allow-sri` once (the build
+    /// then recomputes them), and any later run — a second CI job, an upload step that re-injects,
+    /// a retry — must not start failing. The guard refuses only over a bundle it would REWRITE.
+    #[test]
+    fn a_second_run_over_an_already_stamped_pinned_build_is_still_a_no_op() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("main.js"), "console.log(1)\n").unwrap();
+        std::fs::write(
+            dir.path().join("main.js.map"),
+            br#"{"version":3,"sources":["a.ts"],"names":[],"mappings":"AAAA"}"#,
+        )
+        .unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="main.js" integrity="sha384-P"></script>"#,
+        )
+        .unwrap();
+
+        // First run: the caller accepts the breakage and recomputes hashes afterwards.
+        let first = inject_paths(&[dir.path().to_path_buf()], &[], true, false).unwrap();
+        assert_eq!(first.js_injected, 1);
+        let after_first = std::fs::read(dir.path().join("main.js")).unwrap();
+
+        // Second run, WITHOUT --allow-sri: nothing to rewrite, so nothing to break.
+        let second = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap();
+        assert_eq!((second.js_injected, second.js_already), (0, 1));
+        assert_eq!(
+            std::fs::read(dir.path().join("main.js")).unwrap(),
+            after_first,
+            "a no-op run must not touch the bundle"
+        );
+    }
+
+    /// …and it still refuses when the re-run WOULD rewrite: a regenerated map re-keys the bundle,
+    /// which changes its bytes and breaks the pinned hash exactly as a first stamp would.
+    #[test]
+    fn a_re_run_that_would_restamp_is_still_refused() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(dir.path().join("main.js"), "console.log(1)\n").unwrap();
+        std::fs::write(
+            dir.path().join("main.js.map"),
+            br#"{"version":3,"sources":["a.ts"],"names":[],"mappings":"AAAA"}"#,
+        )
+        .unwrap();
+        std::fs::write(
+            dir.path().join("index.html"),
+            r#"<script src="main.js" integrity="sha384-P"></script>"#,
+        )
+        .unwrap();
+        inject_paths(&[dir.path().to_path_buf()], &[], true, false).unwrap();
+
+        // The bundler re-emits the map with different content and no id (webpack `[contenthash]`
+        // keeps the JS file it considers unchanged) — the next run re-keys the bundle.
+        std::fs::write(
+            dir.path().join("main.js.map"),
+            br#"{"version":3,"sources":["a.ts"],"names":[],"mappings":"AACA"}"#,
+        )
+        .unwrap();
+
+        let err = inject_paths(&[dir.path().to_path_buf()], &[], false, false).unwrap_err();
+        assert!(
+            format!("{err:#}").contains("Subresource Integrity"),
+            "{err:#}"
+        );
+    }
+
+    /// The guard's "would this be rewritten?" answer must match what `inject_one` actually does, or
+    /// the two drift apart again — which is the whole class of bug this design exists to prevent.
+    #[test]
+    fn would_rewrite_agrees_with_what_inject_actually_writes() {
+        let cases: [(&str, &str, &[u8]); 4] = [
+            ("fresh", "console.log(1)\n", br#"{"version":3,"mappings":"AAAA"}"#),
+            (
+                "foreign id",
+                "console.log(1)\n//# debugId=11111111-1111-1111-1111-111111111111\n",
+                br#"{"version":3,"debug_id":"11111111-1111-1111-1111-111111111111","mappings":"AAAA"}"#,
+            ),
+            ("no map", "console.log(2)\n", b""),
+            ("empty", "", br#"{"version":3,"mappings":"AAAA"}"#),
+        ];
+        for (label, js, map) in cases {
+            for second_pass in [false, true] {
+                let dir = tempfile::tempdir().unwrap();
+                let js_path = dir.path().join("a.js");
+                std::fs::write(&js_path, js).unwrap();
+                if !map.is_empty() {
+                    std::fs::write(dir.path().join("a.js.map"), map).unwrap();
+                }
+                if second_pass {
+                    inject_paths(&[dir.path().to_path_buf()], &[], true, false).unwrap();
+                }
+
+                let predicted = would_rewrite(&js_path).unwrap();
+                let before = std::fs::read(&js_path).unwrap();
+                inject_paths(&[dir.path().to_path_buf()], &[], true, false).unwrap();
+                let actually = std::fs::read(&js_path).unwrap() != before;
+
+                assert_eq!(
+                    predicted, actually,
+                    "{label} (second_pass={second_pass}): guard said {predicted}, inject did {actually}"
+                );
+            }
+        }
     }
 
     /// A relative root (`./dist`, `../dist`) must behave exactly like the absolute one. It did not:
@@ -906,6 +1051,12 @@ mod tests {
             format!("{err:#}").contains("--exclude"),
             "the message must name the flag: {err:#}"
         );
+        // …with the exit code integrators are documented not to fall back on. Asserting only the
+        // message left the contract to chance: the classification is what a CI script reads.
+        assert_eq!(
+            crate::error::classify(&anyhow::Error::new(err)),
+            crate::exit_code::ExitCode::ConfigInvalid
+        );
     }
 
     /// The dry run reports what it WOULD skip without writing anything.
diff --git a/src/inject/sri.rs b/src/inject/sri.rs
index 5a9a6de..24e8539 100644
--- a/src/inject/sri.rs
+++ b/src/inject/sri.rs
@@ -132,6 +132,41 @@ pub fn lexical_normalize(path: &Path) -> PathBuf {
     out
 }
 
+/// Pages sitting DIRECTLY in `dir` (not recursive, and bounded).
+///
+/// Only consulted when the path we were given holds no pages of its own: the standard Vite/webpack
+/// layout is `dist/index.html` + `dist/assets/*.js`, so `inject dist/assets` (or one bundle by path)
+/// would otherwise stamp a file whose hash the page one level up pins. The bound matters because
+/// that parent can be a directory nobody meant us to read — `/tmp` with a hundred thousand entries.
+fn pages_directly_in(dir: Option<&Path>) -> Vec<PathBuf> {
+    const MAX_ENTRIES: usize = 2_000;
+    let Some(dir) = dir else {
+        return Vec::new();
+    };
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return Vec::new();
+    };
+    let mut pages: Vec<PathBuf> = entries
+        .take(MAX_ENTRIES)
+        .filter_map(Result::ok)
+        .filter(|e| e.file_type().is_ok_and(|t| t.is_file()) && is_html(&e.path()))
+        .map(|e| e.path())
+        .collect();
+    pages.sort();
+    pages
+}
+
+/// A file name a browser would load as a page.
+fn is_html(path: &Path) -> bool {
+    matches!(
+        path.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref(),
+        Some("html") | Some("htm") | Some("xhtml")
+    )
+}
+
 /// Every file this run would stamp whose hash an HTML page under `roots` pins.
 ///
 /// Empty means stamping is safe as far as SRI is concerned. Never fails on a path problem: that is
@@ -148,28 +183,27 @@ pub fn find_pinned_scripts(roots: &[PathBuf], targets: &BTreeSet<PathBuf>) -> Ve
         } else {
             root.clone()
         };
-        // No directory filter and no depth cap: the WALK has none either, so a page under
-        // `.vitepress/dist` or `node_modules` pins a file we really are going to stamp. (Skipping
-        // them was a false negative the first draft shipped — it stamped what such a page pinned.)
-        for entry in walkdir::WalkDir::new(&base)
+        // Everything under the root, plus the pages sitting DIRECTLY in its parent. The standard
+        // Vite/webpack layout is `dist/index.html` + `dist/assets/*.js`, so `inject dist/assets`
+        // (or a single bundle by path) would otherwise stamp a file whose hash the page one level
+        // up pins — a build we break while reporting success. One level, not recursive: enough for
+        // that layout without wandering off into a parent tree we were not pointed at.
+        //
+        // No directory filter and no depth cap below the root: the WALK has none either, so a page
+        // under `.vitepress/dist` or `node_modules` pins a file we really are going to stamp.
+        // (Skipping those was a false negative the first draft shipped.)
+        let mut pages: Vec<PathBuf> = walkdir::WalkDir::new(&base)
             .sort_by_file_name()
             .into_iter()
             .filter_map(Result::ok)
-        {
-            let page = entry.path();
-            if !entry.file_type().is_file() {
-                continue;
-            }
-            let is_html = matches!(
-                page.extension()
-                    .and_then(|e| e.to_str())
-                    .map(str::to_ascii_lowercase)
-                    .as_deref(),
-                Some("html") | Some("htm") | Some("xhtml")
-            );
-            if !is_html {
-                continue;
-            }
+            .filter(|e| e.file_type().is_file() && is_html(e.path()))
+            .map(|e| e.path().to_path_buf())
+            .collect();
+        if pages.is_empty() {
+            pages = pages_directly_in(base.parent());
+        }
+        for page in pages {
+            let page = page.as_path();
             let Ok(source) = std::fs::read_to_string(page) else {
                 continue; // a page we cannot read is not ours to fail the run over
             };
@@ -419,6 +453,38 @@ mod tests {
         }
     }
 
+    /// The standard Vite/webpack layout keeps the page one level ABOVE the bundles
+    /// (`dist/index.html` + `dist/assets/*.js`), so pointing `inject` at the assets directory — or
+    /// at one bundle by path — used to miss the pin entirely and stamp the file anyway.
+    #[test]
+    fn a_page_one_level_above_the_given_path_still_counts() {
+        let dir = tempfile::tempdir().unwrap();
+        write(dir.path(), "assets/main.abc.js", "1");
+        write(
+            dir.path(),
+            "index.html",
+            r#"<script src="/assets/main.abc.js" integrity="sha384-V"></script>"#,
+        );
+
+        let assets = dir.path().join("assets");
+        let targets = targets_of(&[&assets]);
+        assert_eq!(
+            find_pinned_scripts(std::slice::from_ref(&assets), &targets)
+                .into_iter()
+                .map(|p| p.script)
+                .collect::<Vec<_>>(),
+            vec![dir.path().join("assets/main.abc.js")],
+            "a page in the parent directory pins a file we would stamp"
+        );
+
+        // …and the same when a single bundle is named by path.
+        let one = dir.path().join("assets/main.abc.js");
+        assert_eq!(
+            find_pinned_scripts(std::slice::from_ref(&one), &targets).len(),
+            1
+        );
+    }
+
     /// `output.publicPath` pointing at a CDN is the CANONICAL SRI deployment — hash the local bytes,
     /// serve them from the CDN — so the URL carries an origin that exists nowhere on disk while the
     /// pinned bytes are the ones in the output directory. Dropping every absolute URL as "somebody

From 9727cd17177af33f90157683362dfdc9c20574cf Mon Sep 17 00:00:00 2001
From: Alexey Karimov <krassx@gmail.com>
Date: Fri, 18 Sep 2026 20:28:04 +0500
Subject: [PATCH 4/4] docs(changelog): the exclude-matching line was garbled,
 and three claims had drifted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The review of the 0.7.11 delta caught all four: "Matched against the path relative to the absolute
path" (nonsense — README had it right), "refuses only over a file this run would really stamp"
(now: would REWRITE, which is what makes a re-run a no-op), "not flagged: a genuine third-party CDN
script" (unqualified — one sharing a file name with your bundle IS refused), and nothing saying
where pages are read from or that --dry-run refuses.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
---
 CHANGELOG.md | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29d8cc4..bf6383e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,13 +21,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   bytes it names; that is the canonical SRI deployment (hash locally, serve from a CDN) and treating
   every absolute URL as somebody else's file would have missed it entirely.
 
-  The guard refuses only over a file this run would really stamp, sharing one list with the walk
+  The guard refuses only over a file this run would really REWRITE — so re-running `inject` stays a
+  no-op, including on a build stamped once with `--allow-sri` — and it shares one list with the walk
   that does the stamping: an `--exclude`d file, a stale page pinning a deleted bundle, a pin on
   something outside the output, and a file argument naming an unpinned bundle all proceed. Also not
-  flagged: a genuine third-party CDN script, a non-JS target, an empty `integrity`,
+  flagged: a third-party CDN script (unless it shares a file name with one of your bundles, in
+  which case it is treated as yours — the safer error), a non-JS target, an empty `integrity`,
   `data-integrity`/`data-src`, an inline script, a commented-out tag, and `rel=prefetch` (a failed
   prefetch is discarded, not fatal).
 
+  Pages are read from anywhere under the given paths, plus any sitting directly in a given path's
+  parent (the usual layout is `dist/index.html` beside `dist/assets/*.js`). `--dry-run` refuses too:
+  the preview of a run that would refuse is a refusal, and it says why.
+
   It cannot see SRI that never reaches the emitted HTML — a manifest consumed by a server template,
   a page rendered at request time (Next.js `experimental.sri`), or HTML written outside the directory
   it was pointed at.
@@ -36,10 +42,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - **`sourcemaps inject --exclude <glob>`** (repeatable) — leave part of a build output alone. A
   stock `next build` with browser source maps on has 39 JS files and 12 maps, and a Nuxt
   `.output/server/node_modules` holds 22 vendored `.mjs`; `--exclude '**/node_modules/**'` keeps
-  `inject` out of third-party code inside the build output. Matched against the path relative to
-  the absolute path, the path relative to the current directory, and the path relative to each
-  walked root, so `dist/vendor/**`, `vendor/**` and an absolute path all work whether the root is
-  passed as `dist`, `./dist` or absolute. An unparseable OR EMPTY pattern is a configuration error
+  `inject` out of third-party code inside the build output. Matched against the absolute path, the path
+  relative to the current directory, and the path relative to each walked root, so
+  `dist/vendor/**`, `vendor/**` and an absolute path all work whether the root is passed as `dist`,
+  `./dist` or absolute. `*` crosses `/` (globset's default). An unparseable OR EMPTY pattern is a configuration error
   (exit 20), never a silent "matches nothing" that would rewrite the files you meant to protect.
   `js_excluded` is reported in the completion log.