Stream and cache admitted Code OSS webview resources

[wieslawsoltes]

Parent epic: #264. Top-level release epic: #227.

Proven gap

VS Code OSS service-worker.js is the mandatory broker for every webview.asWebviewUri(...) request. It handles FetchEvent, Request/Response/Headers, Client messaging, range requests, ETag/Last-Modified, 401/404/206/304 results, streamed response chunks, CacheStorage, and localhost port mapping. It caps active host-response bodies at 32 and times unresolved requests out after 30 seconds.

WebScene b81f594c has a bounded fetch subset, but the audited native bindings contain no CacheStorage, FetchEvent, ReadableStream, WritableStream, or TransformStream implementation. Current Markdown content references extension CSS/scripts through asWebviewUri; local images and every other webview consumer share this broker.

Scope and dependencies

• Depends on the service-worker control-plane issue and on Implement Worker, transferable MessagePort, and iframe contexts for Code OSS #81 messaging.
• Reuses AppScene#31 packaged URL/origin work and AppScene#34 networking; this issue owns the browser-standard resource plane in WebScene.
• Preserve VS Code's localResourceRoots admission, authority/origin mapping, MIME, conditional/range headers, and streaming protocol. Do not replace it with direct unrestricted filesystem access.
• Establish Chromium/AppScene visual and geometry regression gates for unchanged Code OSS #259 owns the common Chromium visual harness, Qualify all unchanged Code OSS workbench commands, panels, and feature lifecycles #260 the release-wide workbench matrix, and Publish a Code OSS Web API capability ledger and expand WPT coverage #263 the API/WPT ledger; this issue supplies their webview-resource lane.

Acceptance

• Selected Streams and Service Worker/CacheStorage WPTs plus Chromium oracles cover readable/writable/transform behavior, piping/cancel/error/backpressure, response clone/tee/body-use, cache match/put/version replacement, FetchEvent respondWith/waitUntil, and client-message transfer.
• Native top-level + iframe contracts cover 200/206/304/401/404, GET/HEAD/method rejection, MIME, ETag, Last-Modified, byte ranges, aborted/timed-out requests, malformed chunks, stale generations, localResourceRoots traversal rejection, localhost mapping, and offline/cache behavior.
• The broker enforces at most 32 active response bodies, bounded queued bytes, cancellation propagation, single release of every host lease, and zero live streams/cache operations after navigation or shutdown.
• A 64 KiB warm local resource reaches first byte at p95 <= 100 ms; 32 concurrent 1 MiB resources complete with <= 64 MiB aggregate queued payload and no starvation; 100 cache-fill/evict cycles retain <= 8 MiB after warm-up. Publish Chromium/native throughput and peak-memory results.
• Exact Markdown extension CSS/scripts, a local PNG/SVG, an external HTTPS image, a missing asset, and an out-of-root path behave like Chromium. Current vscode-demo/README.md remains the exact primary fixture even though it has no inline image today.
• Representative notebook, custom editor, extension detail, chat/MCP, Mermaid, Simple Browser, and release-notes assets use the same path without consumer-specific bypasses.

Proposed PR stack

1. Web Streams primitives and bounded body ownership;
2. CacheStorage/Cache and Request/Response integration;
3. FetchEvent dispatch and VS Code client broker;
4. range/cache/security/performance gates and unchanged product resources.

[wieslawsoltes]

First unchanged-product resource-plane failure

The stamped exact-head run now clears #265's Service Worker control boundary and reaches webview ready, but the right Markdown pane stays blank. This is the first deterministic #266 product boundary.

Evidence from /private/tmp/webscene-265-stamped-run.A3t8FO:

• current copied vscode-demo/README.md SHA-256: db3dd0a4483949b325f267734c2c58ab3101e04853f2d202e182ecbf51471cb8;
• will update content at 1789653762786;
• webview ready at 1789653764798 (2,012 ms later);
• first loader failure at 1789653765919 (1,121 ms after ready): http://127.0.0.1:58410/http\\:\\/\\/127\\.0\\.0\\.1\\:58410\\/oss-dev\\/vscode-remote-resource\\;
• screenshot preview-stamped.png: unchanged source is visible on the left; the right preview is blank after 15 seconds;
• no old-worker version mismatch remains.

The owning resource path is standards-shaped and already matches this issue: Markdown's generated HTML initially has an empty body and loads extension pre.js/styles through webview.asWebviewUri(...). Code's v6 Service Worker handles those with FetchEvent.respondWith, Clients messaging, Request/Response/Headers, Streams, and CacheStorage. The cumulative #265 branch has no FetchEvent/Streams/CacheStorage implementation by design.

A second proven defect affects the first logged URL: WebScene preserves CSS string escapes into resource resolution, so escaped http\\:\\/\\/... fails scheme detection and gets origin-prefixed. A temporary source-level probe against the unchanged helpers reproduces first_css_url() returning the escaped text. That general CSS Syntax defect will be tracked under #235 and linked here. It is adjacent to this product gate, but it should not be implemented inside #266 unless a reduced broker fixture proves it blocks the broker after FetchEvent/Streams exist.

Initial #266 stack should therefore start with product-neutral Streams/Body ownership and FetchEvent/respondWith dispatch contracts, then CacheStorage and the Code client broker, retaining the issue's range/security/performance gates.

[wieslawsoltes]

The general CSS Syntax owner is now #286: #286. It is a native child of CSS epic #235 and remains related to this resource-plane issue. #266 should only take CSS decoding work if a reduced Streams/FetchEvent broker fixture proves it is required for broker completion.

[wieslawsoltes]

Unchanged-Code API audit and first implementation boundary

The exact 645f29c worker establishes the next runtime boundary more narrowly than the blank pane alone:

• the script constructs four static Response objects at evaluation time and registers a fetch listener;
• each admitted resource fetch requires FetchEvent.request, clientId, respondWith(), and waitUntil() before it can post load-resource to the controlling window;
• the success path then requires a byte ReadableStream, getReader()/read()/cancel(), tee(), Response body ownership/clone/bodyUsed, and CacheStorage;
• when transferable streams are unavailable, unchanged Code deliberately uses the chunk fallback: TransformStream, writable.getWriter(), write/close/abort/closed, and the readable side;
• the worker limits host-response bodies to 32 and the product code already supplies cancellation/teardown hooks.

The cumulative #265 runtime currently has shallow window-oriented Headers, Request, and Response wrappers, but no Web Streams globals. Its Service Worker loop dispatches lifecycle and message events only; there is no controlled-resource request queue, FetchEvent, respondWith, or response handoff. Registration/controller readiness therefore does not imply resource interception.

The first focused #266 PR will be a product-neutral vertical slice:

1. WebIDL-shaped ReadableStream, default controller, and default reader with byte-chunk ownership, pull/enqueue/close/error, read/cancel, lock release, and tee(); upgrade shared Headers/Request/Response Body behavior so a Response can own and expose that stream.
2. WebIDL-shaped FetchEvent with request, clientId, resultingClientId, replacesClientId, preloadResponse, handled, respondWith(), and inherited waitUntil() lifetime rules.
3. Route a same-origin, scope-controlled synthetic subresource through the worker and consume a static streamed Response. Bound pending fetch events and queued body bytes, cancel them on navigation/unregister/shutdown, and reject late/cross-generation results.

This tranche will use selected WPT-derived Streams/FetchEvent assertions plus a Chromium oracle and native top-level/iframe contracts. It will not claim CacheStorage, the Code broker, transferable streams, writable/transform streams, ranges, or full Markdown rendering.

Dependent stack after that slice:

1. A — readable body + static FetchEvent vertical: scope above.
2. B — writable/transform and structured-clone stream path: writer state/backpressure/abort, chunk fallback, and transferable-stream behavior where supported.
3. C — CacheStorage broker: CacheStorage/Cache plus request matching, Response cloning/tee, version replacement, validators, and unchanged Code load-resource exchange.
4. D — resource semantics and cumulative product gate: 200/206/304/401/404, GET/HEAD, range/ETag/Last-Modified, localhost mapping, localResourceRoots/security, 32-body/64-MiB bounds, 100-cycle teardown, and exact Markdown/resources/visual acceptance.

#286 remains the separate general CSS escape-decoding owner. Its escaped-URL fixture will join Stack D after the broker works with an ordinary URL; no CSS-owned files are part of Stack A.

[wieslawsoltes]

#286 fixture/evidence coordination is ready in local commit 7789039e without any Streams or FetchEvent changes. The neutral contract includes the original escaped loopback form alongside ordinary, relative, data, fragment, malformed, decode-once, and blocked escaped-scheme cases. Chromium passes 8/8; native records 0 decoded loopback requests, 4 still-escaped host requests, and 2 forbidden escaped-scheme requests. This fixture can join #266's broker/resource tranche after an ordinary URL works; #286 retains CSS token decoding and integration ownership.

[wieslawsoltes]

Stack A implementation checkpoint

Commit da18607e on feature/readable-fetch-event-266 implements the first dependency-ordered vertical recorded above:

• WebIDL-shaped ReadableStream, default reader/controller, read/cancel/lock/close/error and tee();
• Response body stream ownership, bodyUsed, clone/tee, text/arrayBuffer/blob consumption;
• service-worker ExtendableEvent and FetchEvent with request/client identifiers, waitUntil(), respondWith(), handled, and active-dispatch/duplicate enforcement;
• an internal controlled synthetic dispatch that proves a service worker can return a streamed 206 response;
• installation in main and nested frame realms, including snapshot builds.

Focused native acceptance passes 100 body/clone/cancel cycles with p95 0.208042 ms and unchanged V8 heap (1,144,292 bytes before/after). Existing 100-cycle service-worker lifecycle and client-message gates remain green; the client queue stays capped at 256 and RSS remains below its 64 MiB growth bound. The Chromium 153 oracle passes 3/3 subtests in 99 ms; evidence is at /private/tmp/webscene-266-chrome-final/results.json in the author environment.

This slice deliberately does not claim unchanged Markdown rendering. The exact Code worker's first admitted GET awaits caches.open().match(), then posts load-resource; its non-transferable chunk path requires TransformStream. The next native stack entry therefore owns bounded CacheStorage empty-match/request matching plus controlled request routing and TransformStream fallback. Issue #266 remains open for that work and the later range/cache/security/product gates.

[wieslawsoltes]

Follow-up profile commit 43d08499 promotes the Stack A reduction into the candidate component profile. The exact same contract now passes both runners:

• native snapshot build: 1/1 document, 3/3 subtests, 274 ms (/private/tmp/webscene-266-native-contract/results.json);
• Chromium 153: 1/1 document, 3/3 subtests, 110 ms (/private/tmp/webscene-266-chrome-profile-final/results.json).

The dependent local CacheStorage/request-routing branch has been advanced to exact Stack A head 43d08499; its future GitHub PR will target feature/readable-fetch-event-266 as a native stack entry.

[wieslawsoltes]

Stack A is merged through #298 at main 70a2db4c (source head 823461b3). Before merge, the exact merge ref against current main 116b783d passed Linux build/tests, native Linux document contracts, portable V8 contracts, macOS ARM64, and NativeAOT Avalonia 12. The MSVC raw-literal regression was removed by preserving the exact 27,687-byte bootstrap as bounded compile-time parts with a fail-closed extractor test.

The next GitHub-native child stack is active for CacheStorage empty-match/request routing, WritableStream/TransformStream fallback, and the bounded native worker fetch broker. It will rebase onto merged 70a2db4c before publication and carry WPT/Chromium/native correctness plus 100-cycle latency, memory, retirement, and lifecycle gates. This issue remains open because visible unchanged Markdown Preview rendering is still the cumulative product exit condition.

[wieslawsoltes]

Resource-plane Stack B/C publication

The post-#298 resource work is split into a visible native GitHub stack on merged main 70a2db4c:

1. Add CacheStorage controlled fetch broker #303 — CacheStorage + controlled request broker (22c095f1, base main): bounded worker-local Cache/CacheStorage, empty match and cloned response storage, 32-request asynchronous Window.fetch → worker FetchEvent broker, host fallback, rejected response propagation, generation retirement, unregister/shutdown, and MSVC-safe worker bootstrap literals.
2. Add TransformStream resource fallback #304 — WritableStream/TransformStream fallback (18a19fa2, base feature/cache-storage-fetch-broker-266): ordered writer write/close/abort/closed semantics and the readable response side used by unchanged Code's chunk fallback.

The order differs from the earlier provisional B/C list because the TransformStream product path needs a real controlled request and CacheStorage's initial empty match to be meaningful. The ownership remains unchanged and the upper PR is cumulatively validated.

Cumulative top evidence:

• clean snapshot/native compilation;
• portable raw-literal regression 2/2;
• native 100-cycle controlled resource gate p95 0.196 ms, V8 heap 1,161,272 → 1,161,272 bytes, peak RSS 38,191,104 → 49,463,296 bytes;
• native candidate contract 1/1 documents, 3/3 subtests, 139 ms;
• Google Chrome 153 oracle 1/1 documents, 3/3 subtests, 138 ms;
• isolated Chrome process cleanup confirmed.

#266 remains open. These entries intercept Window fetches and prove the Code-shaped cache/chunk pipeline; parser/image/style request interception, 200/206/304 and range/validator semantics, local-resource security gates, and exact unchanged Markdown rendering remain the next cumulative slices. #286 continues to own general CSS escape decoding.

[wieslawsoltes]

Security-bound follow-up before merge: the lower and upper heads are now 0267d607 / 34cb18b0. Worker response consumption enforces the 64 MiB body ceiling while reading chunks, before allocating the combined result. The native gate feeds 65 logical MiB through repeated 1 MiB chunks, requires QuotaExceededError propagation to the controlled fetch, and retains the same 8 MiB heap / 64 MiB RSS ceilings.

Cumulative top rerun passes: native 100-cycle p95 0.284 ms, heap 1,161,272 → 1,161,272 bytes, peak RSS 38,207,488 → 49,430,528 bytes; native candidate contract 3/3 in 67 ms. The Chrome 153 contract remains 3/3; the browser-side fixture did not change.

[wieslawsoltes]

Rebase/status update for the visible resource-plane stack:

• Add CacheStorage controlled fetch broker #303 lower head bd1b872e is rebased onto exact main 3d143240.
• Add TransformStream resource fallback #304 cumulative head c6c26649 remains based on the lower branch.
• Implement effective CSS property cascade semantics #305 overlaps only the additive component-profile ledger; both rebases were conflict-free and there is no runtime/test semantic overlap.
• Focused cumulative revalidation passes: portable literal tests 2/2, extracted bootstrap syntax under packaged Node 24, snapshot/native incremental build, native WPT contract 3/3 in 69 ms, and 100 broker/stream cycles at p95 0.210 ms with stable V8 heap (1,161,232 -> 1,161,232 bytes) and peak RSS 38,207,488 -> 49,266,688 bytes.
• Chrome 153 parity remains 3/3 in 138 ms; Implement effective CSS property cascade semantics #305 does not change this contract or bootstrap byte surface.

The remaining #266 work stays open: parser/image/style request interception, HTTP 200/206/304 and range/ETag behavior, local-resource security, and exact unchanged Markdown product acceptance.

[wieslawsoltes]

The two-entry resource-plane stack is merged in dependency order:

• Add CacheStorage controlled fetch broker #303 CacheStorage/request broker: merge commit 3a7660a0
• Add TransformStream resource fallback #304 WritableStream/TransformStream cumulative top: merge commit 50443f5b

Before merge, both branches were rebased conflict-free on #305/main 3d143240; the only shared path was the additive component-profile ledger. Focused cumulative gates passed locally (literal 2/2, extracted Node 24 syntax, snapshot/native build, native contract 3/3 in 69 ms, and 100 cycles at p95 0.210 ms with stable V8 heap and bounded RSS). The queued duplicate hosted workflows were canceled under the focused stack policy after the validated top merged.

#266 remains open for parser/image/style request interception, HTTP cache/range semantics, local-resource security, and exact unchanged Markdown product acceptance.

[wieslawsoltes]

Resource-plane progress now on main:

• Intercept connected resources through Service Workers #310 / 723dd48f: controlled dynamic connected script, stylesheet, and image resources.
• Intercept parser and frame resources through service workers #319 promoted by Promote parser and frame service worker interception #321 / d7720a63: initial parser-blocking stylesheet/script and nested-frame hydration resources, including stale-generation retirement and fail-closed handled failures.
• Exact native and Chrome contracts pass; the parser/frame native stress gate completes 100 hydrate/remove cycles within its p95, heap, and RSS bounds.

#266 remains open. The next slice is the first still-missing browser-standard resource-plane contract after an exact-main audit: streams/body ownership and CacheStorage integration, followed by ranges/validators/security/product acceptance. CSS url() interception remains separately scoped.