VS Code companion WebShell transcript: artifact blob CSP
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 28k
- Forks
- 3.1k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 714
Description
Summary
PR #9719 widens the VS Code companion webview CSP only for Shiki WASM (script-src 'wasm-unsafe-eval', flag-on only). Artifact blob preview is left unchanged.
Gap
If the companion ACP stream ever produces artifacts that render as blob URLs, the webview CSP's img-src / frame-src / media-src do not currently allow blob:, so blob previews would be blocked.
Note
WebShellTranscript is read-only (it renders projected blocks and provides no artifact panel), so blob artifact preview is likely N/A today. This issue is a placeholder to revisit if the companion grows artifact rendering.
Acceptance
- Confirm whether the companion ACP flow can produce artifacts.
- If so, add
blob:to the relevant CSP directives (flag-on only) and verify preview rendering.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the companion ACP flow and reviewing WebShellTranscript to determine whether artifacts can be produced and rendered as blob URLs. If artifacts are possible, identify the relevant flag-on CSP directives and verify preview rendering; otherwise document that artifact preview is not currently applicable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript, vscode
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100