fix(webview): allow service worker via CSP worker-src

[enyst]

What

Add worker-src to the webview Content-Security-Policy so VS Code can register the webview service worker.

Why

Without worker-src, the webview can fail to load with:

Could not register service worker: InvalidStateError: The document is in an invalid state

---

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • Enabled web worker execution in webviews to support service worker functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 396e5d88-b379-4a8a-9940-0395ffe905da

📥 Commits

Reviewing files that changed from the base of the PR and between 43c56dc and 93d2be4.

📒 Files selected for processing (1)

• src/webview/getWebviewHtml.ts

---

📝 Walkthrough

Walkthrough

The CSP configuration in getWebviewHtml has been updated to include a worker-src directive that permits web worker execution from the webview's CSP source, enabling VS Code webview service worker functionality.

Changes

Cohort / File(s)	Summary
CSP Worker Configuration src/webview/getWebviewHtml.ts	Added worker-src ${webview.cspSource} directive to Content Security Policy, explicitly allowing web workers to execute from the webview's CSP source.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 A tiny thread now hops and plays,
Worker threads bloom in CSP's maze,
Service friends dance in webview's light,
One small directive sets things right! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding worker-src CSP directive to enable service worker functionality in the webview.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/webview-worker-src-csp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the Content Security Policy (CSP) in src/webview/getWebviewHtml.ts to explicitly allow service workers by adding the worker-src directive. Feedback indicates that the CSP is currently missing a connect-src directive; since default-src is set to 'none', network operations such as fetch and WebSocket will be blocked unless connect-src is explicitly defined.

[github-actions]

🔧 VSCode Extension Built Successfully

• File: openhands-tab-0.9.3.vsix (548 KB)
• Download: https://github.com/enyst/OpenHands-Tab/actions/runs/24010755386

To install:

1. Download the artifact from the run page above
2. VS Code → Command Palette → "Extensions: Install from VSIX..."
3. Select the downloaded .vsix

Built with Node 22. Commit a28f1c9.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.