Implement Worker, transferable MessagePort, and iframe contexts for Code OSS

[wieslawsoltes]

Current worker and messaging checkpoint — 20 September 2026

Exact current source heads are WebScene 98077f23, AppScene 5a0d9a9, and unchanged Code OSS 645f29cc. The latest complete package uses WebScene bd366836 and now proves a real editor Worker $computeLinks request/reply plus the browser extension-host iframe, transferred MessagePort, Ready, and Initialized handshake while UI timers continue.

This removes the prior macOS package blocker. The issue remains open for its stated module-load failure, termination/navigation, forced-GC, sustained throughput/memory, and Linux/Windows package gates; #288 owns the active-port forced-GC matrix. No new Worker implementation is scheduled until those exact gates expose a reduced failure.

Problem

The packaged Code OSS 1.137.0 native smoke renders and passes editor create/type/render/undo through AppScene/WebScene, and its bundled Node extension host connects successfully. Runtime diagnostics still report:

The web worker extension host is started in a same-origin iframe!
Could not create web worker(s). Falling back to loading web worker code in main thread, which might cause UI freezes.

WebScene currently does not provide the iframe/Worker/transferable MessagePort path expected by upstream Code OSS browser extension and Monaco language-worker code. Main-thread fallback reduces responsiveness and does not cover extensions that require worker isolation.

Required design

• Implement dedicated worker execution contexts using the existing V8 task/runtime ownership model.
• Support the Worker constructor, script/module loading through the admitted resource contract, postMessage, MessageChannel, transferable MessagePort, structured clone, termination, error/messageerror events, and shutdown/navigation cancellation.
• Implement the narrow iframe browsing-context behavior required by the Code OSS worker extension-host bootstrap, with same-origin enforcement and explicit rejection for unsupported navigation.
• Keep worker execution off the UI thread and enforce bounded queues, memory accounting, resource size limits, and origin policy.
• Do not emulate successful isolation by running worker code synchronously in the document realm.
• Preserve the bundled Node extension host as the supported native desktop path while browser-worker coverage is developed.

Quality and performance gates

• Add cross-platform native contracts for ordering, transfer ownership, port close, worker termination, module-load failure, and navigation/shutdown races.
• Add bounded queue and sustained message-throughput benchmarks with published budgets and memory/result-pool leak checks.
• Add selected Worker/HTML/structured-clone web-platform tests with explicit exclusions.
• Run a packaged Code OSS test that starts a Monaco language worker and a browser extension worker, verifies a request/response, and confirms the UI thread remains responsive.

Acceptance

• Code OSS no longer logs main-thread language-worker fallback.
• The browser extension-host iframe and transferred ports initialize without application source changes.
• Worker failures remain observable and cannot bypass resource/origin admission.
• Linux, macOS, and Windows package jobs and performance gates pass.

Current dependency status — 18 September 2026

Structural CSS PR #245 merged as 4040058e, so its former collision is retired. #288's first active-listener reachability fix merged through PR #296 as 716aaf82; #288 remains open for dedicated Worker, ServiceWorker, and iframe identity/reachability, transfer/release, inactive-port collection, navigation, termination, and teardown acceptance.

This issue owns Worker, structured clone, transferable MessagePort, and the browser extension-host worker bootstrap. General iframe navigation, realms, CSP, document replacement, and teardown belong solely to #267 under #264. Final unchanged Code OSS Worker/Monaco/browser-extension acceptance consumes #267 rather than duplicating it.

The remote Ready→Initialized scheduler slice merged through #289/PR #347. Its remaining product proof belongs to the next current-package #252 run; do not add another scheduler fix here without a new reduced failure.

[wieslawsoltes]

Packaged-app validation found a narrower remaining blocker after the initial Worker/MessagePort work landed: webWorkerExtensionHostIframe.html ran in a hydrated iframe realm where Worker was absent. Diagnostics showed ReferenceError: Worker is not defined at createWorker, followed by LocalWebWorker termination code 81. The earlier focused WPT only constructed Worker in the top-level realm, so it did not cover this app path.

Draft PR #95 now contains commit cbc4b487 on top of consolidation 96876a98. It installs Worker per iframe realm, preserves realm-local EventTarget identity/base URL behavior, and advances module-worker microtasks for Code OSS's blob module with top-level await import(...).

New acceptance coverage mirrors Code OSS: iframe -> blob module Worker -> dynamic import -> transferred MessagePort bridge. Current validation passes 28/28 graphics native tests, 25/25 non-graphics native tests, and 6/6 Aureon candidate documents with 31/31 assertions. The focused hybrid suite remains below one second while retaining the 10,000-message and bounded-queue gates.

Packaged Code OSS must still be rebuilt with the updated runtime to close the issue acceptance item and verify that the code-81 diagnostic is absent.

[wieslawsoltes]

Packaged AppScene acceptance now passes with this commit.

I copied the validated graphics runtime into a duplicate of the current native-41cf43cc Code OSS AppScene bundle, ad-hoc signed the duplicate, and ran the two-process IndexedDB persistence smoke against it. Write and restart/read both passed in 9.196 seconds on different loopback origins (:55920 then :55976).

Neither native report contains Worker is not defined, LocalWebWorker code 81, unexpected worker termination, or extension-host startup errors. This closes the concrete packaged-app regression that prompted the follow-up.

Evidence:

• summary: artifacts/iframe-worker-appscene-a2c15a5b/smoke/indexeddb-persistence-summary.json — SHA-256 dc8698d903603e3fed4fe36749d4f1bdc26114e188d29cc8b50bde85369cc24a
• write report — SHA-256 408b01d52df36545b6063be9eae62ea04aab4cf08b6f30181121d08c18e10a10
• restart/read report — SHA-256 858173598a7da4261e84d50bca303b20edd63bae4f271cd0372a55e6fbe8a645
• embedded runtime — SHA-256 662a83d65b153a65628c0e4bd1a58d71d71ef3cb350894821ef3dcf2ec470795

[wieslawsoltes]

The iframe Worker fix remains validated after correcting a timing race in the existing detached-frame Inspector regression. The failed Linux package job counted a legal MessagePort delivery before iframe removal as though it ran after context destruction. Focused commit 274bb1db now gates the counter at the synchronous removal boundary; consolidation commit d807f7ab carries the identical patch. Local gates pass: 10 repeated native regressions, full graphics CTest 28/28, and Aureon Worker/iframe WPT 6/6 documents (31/31 subtests). Exact-head CI is running again.

[wieslawsoltes]

Native GitHub Stack #176 is merged atomically at shared commit b6dff40327c9a43562c743b585ca465b4e2f0a7c:

1. Implement Worker, transferable MessagePort, and iframe transport #172 — Worker, transferable MessagePort, structured clone, iframe transport, lifecycle and resource bounds
2. Expose Worker in hydrated iframe realms #173 — Worker in hydrated iframe realms
3. Expose DedicatedWorkerGlobalScope identity #174 — DedicatedWorkerGlobalScope / WorkerGlobalScope identity
4. Pin focused upstream MessagePort contracts #175 — pinned upstream MessagePort WPT cumulative top

Cumulative-top evidence: precompiled/V8 run 35148591616 passed; native document/compiler and installed-SDK run 35148587878 passed. Fresh local hybrid and Inspector-detach filters passed, as did eight focused Worker/iframe/MessagePort documents with 35/35 assertions. Throughput, queue/byte/binding admission, termination, navigation cleanup, and warmed memory bounds are included. Lower-layer and post-merge duplicate jobs were canceled.

The runtime implementation is complete on main. This issue remains open for the deferred packaged Code OSS acceptance: Monaco language-worker request/response, browser-extension iframe → module Worker → transferred bootstrap port, UI responsiveness, visible admission/origin failures, and clean navigation/shutdown without late callbacks.

[wieslawsoltes]

Current exact-main/package audit (WebScene 24db1a2f2c6b1865977eb613598ab6932e61236d):

• Native Stack #176 merged PRs Implement Worker, transferable MessagePort, and iframe transport #172 → Expose Worker in hydrated iframe realms #173 → Expose DedicatedWorkerGlobalScope identity #174 → Pin focused upstream MessagePort contracts #175 atomically at b6dff40327c9a43562c743b585ca465b4e2f0a7c.
• Follow-up PR Share Blob URLs across nested workers #208 merged nested Blob URL ownership at aaf4eae053ab33d889ea2b599988aaf18f1839ee; PR Share authentication cookies with dedicated workers #210 merged authenticated same-origin worker requests at 7c74a02e23fc2fd8a81da3c136227b3ced93c52c.
• The final macOS package built from this main passes smoke in 7.302 seconds with zero LocalWebWorker failure diagnostics. It no longer reports Worker is not defined, authenticated Forbidden./EOF failures, unexpected LocalWebWorker termination, or Monaco's main-thread worker fallback.

The issue remains open because the current packaged smoke edits a plaintext untitled model and does not make a strict Monaco language-worker RPC or explicitly verify the browser extension-host bootstrap response. Those are acceptance-test gaps, not an identified missing WebScene primitive. A focused packaged probe is being added before closure.

[wieslawsoltes]

PR #226 merged the remaining product-neutral editor-worker contract as c979985de705fc0f9ef5898ad29487a6358fd257.

Evidence on the exact PR head df710505a20dbe118cf2bf48c678c7f81db1ace7:

• Chromium 153 passed all 8 assertions across editor-worker-rpc.html and the corrected iframe-worker-extension-host.html oracle. The latter now waits for both iframe bootstrap and module-worker readiness before transferring its port.
• The Linux native package job in run 35192307906, job 105107518343, passed webscene_hybrid_v8_runtime_tests in 1.66s and webscene_worker_object_url_tests in 0.51s.
• The macOS native job 105107518377 independently passed the same two gates in 2.18s and 0.30s.
• Both jobs stayed red only because the unrelated existing webscene_native_engine_tests catalog check failed on HostBridge.Services; the two worker gates directly related to this change passed on both runners.

The contract now covers the Code OSS worker protocol shape: queued pre-ready traffic, vscode-worker-ready, $initialize, $computeStringDiff, exact request/reply correlation, a serialized missing-method rejection, visible role=alert failure UI, and main-document timer progress while the worker computes. Issue #225 closed with the merge.

Keeping #81 open: this proves the reusable WebScene browser/native worker path, but the packaged Code OSS application still needs downstream evidence from its actual IEditorWorkerService and browser extension-worker paths, including the user-visible failure state.

[wieslawsoltes]

Packaged acceptance update — 2026-09-17

The fresh VS Code OSS 1.137.0 payload on AppScene a20cf890 + WebScene 7cd66b3e now reaches the real same-origin browser extension-host iframe and transfers its MessagePort. The query-gated observer records:

{
  "extensionIframeBootstrap": true,
  "extensionPortTransferred": true,
  "extensionPortObserverInstalled": false
}

The observer fails closed because WebScene creates each native port wrapper with an own writable data property:

wrapper->Set(realm, js_string(isolate, "onmessage"), v8::Null(isolate)).Check();

MessagePort.prototype has no browser-compatible onmessage accessor descriptor. This differs from the Web IDL surface and prevents a synchronous observer from wrapping VS Code's later port.onmessage = listener assignment without starting/consuming the port or adding a competing listener.

Proposed focused completion:

• expose onmessage and onmessageerror as accessor properties on MessagePort.prototype with per-instance handler storage;
• retain current queued delivery, transfer ownership, start, close, and EventTarget behavior;
• add descriptor-shape and assignment/reassignment/null tests across the source and transferred wrapper paths;
• rerun the packaged sequence: iframe bootstrap → transferred port → observer installed → Ready byte 2 → Initialized byte 1.

This is independent of the CSS work in #148/#234.

[wieslawsoltes]

Focused iframe/webview prerequisite #253 is now scheduled under release epic #227.

The unchanged Code OSS Markdown preview fails before its webview initializes because webviewElement.ts creates an iframe and synchronously calls element.sandbox.add(...); current WebScene exposes HTMLIFrameElement branding but returns undefined for sandbox. #253 owns the reusable live DOMTokenList, sandbox token/navigation/security semantics, WPT/browser/native/performance coverage, and exact README visual/resource acceptance.

#81 retains Worker, transferable MessagePort, iframe-context lifecycle, extension-host, and packaged Monaco scope. The focused sandbox fix should merge independently, then #81 consumes it in its broader iframe acceptance.

[wieslawsoltes]

The complete Code OSS webview audit is now tracked by child epic #264. This issue remains authoritative for Worker execution, transferable MessagePort/structured-clone behavior, the missing prototype onmessage accessor, and browser extension-host/Monaco acceptance.

#253, #265, #266, #267, and #268 own the separate sandbox, ServiceWorker, resource broker, nested-document security/lifecycle, and webview interaction stages. #81 is consumed by #265–#268; none of those tickets duplicates its port/worker implementation scope.

[wieslawsoltes]

The unchanged Code OSS remote-workspace trace from #280/#252 supplies the remaining packaged extension-host timing evidence for this issue.

Exact candidate inputs: WebScene local 0f92cf47 on main aa786c0e, AppScene 1420e227, Code OSS 645f29cc, Node 24.18.1. The #287 task-source fairness candidate passes its direct 256-frame FileReader gate but does not materially change this product timeline.

Correlating the query-gated workspace observer's performance.now() values with the terminal console timestamp gives:

• workspace observer start: inferred console timestamp 1789655981628.9
• direct IFileService.resolve start: 1789655985605.0
• Code OSS reports “Extension host (Remote) is unresponsive”: 1789655989676
• [AgentHost:remote] Connected: 1789655993265
• exact five-child resolve completes: inferred 1789655993354.9, about 90 ms after AgentHost connected
• first five Explorer rows paint / terminal observer record: 1789655993417, about 152 ms after AgentHost connected

The earlier extension-host socket transport itself opened after 1,247 ms, but the remote AgentHost did not become connected until roughly 16.6 seconds after the socket-create request. Provider/Explorer output becomes ready immediately after that connection boundary.

This makes #81's existing packaged browser extension-host/Worker/MessagePort acceptance the earliest remaining owner boundary for #280/#252. The next focused trace should retain iframe bootstrap, transferred port Ready/Initialized bytes, Worker creation/module import, remote socket open, protocol handshake milestones, and the AgentHost:remote Connected event under a bounded latency/queue/lifecycle gate. It should avoid changing Code OSS behavior and coordinate with #288/PR #245 for MessagePort lifetime ownership.

Product log: /private/tmp/vscode-252-product-navigation-287-candidate.log. Functional output remained exact: selected/root URI, provider registration, five resolved/model children, five rows, and 64 Explorer DOM nodes.

[wieslawsoltes]

The exact packaged phase trace is complete and the distinct remote-handshake latency is now tracked as native subissue #289.

The local iframe/Worker/transferred-port path succeeded in order: iframe document → Worker created 8 ms; Worker → transferred port 130 ms; port → first byte 2 ms; first byte → Ready 1 ms; Ready → Initialized 708 ms. Resource fetch itself was 0.835 ms for the iframe and 2.964 ms for the 1.93 MB worker module.

The remote extension host breached the bound later: connected transport → Ready 1,177 ms and Ready → Initialized 4,379 ms. The separate AgentHost service connected 9,682 ms later; exact five-row Explorer output followed 99 ms afterward. This corrects the earlier inference that the AgentHost log itself marked extension-host readiness.

#288 remains the active-port forced-GC owner. #289 owns product-neutral remote protocol timing and consumes #81. Dependency for workspace requalification is now #289 → #280 → #252.

Local diagnostics only: vscode-demo e6f5c6a (not pushed). Evidence: /private/tmp/vscode-252-product-extension-host-81.log; structured JSON SHA-256 1a53ca07dfa317aa7fdfcd6b598617e8cfd41105770e9ad7fe082dac1172e851. Peak process-group RSS was 845,184 KiB; phase/resource queues were bounded at 21/96 and 8/64 with no dropped phase record. All app/server/helper processes are closed.