Merge branch 'main' into pr2997-integration

packages/vscode/src/DOCUMENTATION.md

@@ -44,6 +44,8 @@ Keep `bridge.ts` as a thin orchestration layer that delegates message handling t
 
 The webview CSP permits `blob:` only for `worker-src` so shared UI parsers can run bounded local decompression off the main thread. Blob scripts remain disallowed by `script-src`.
 
+The webview build emits each worker as one self-contained file. VS Code webviews cannot load workers directly from extension resource URLs or load module imports from inside a worker. The shared Shiki client therefore fetches the built worker, starts it from a `blob:` URL, and relies on the worker CSP allowance above.
+
 - `bridge-localfs-proxy-runtime.ts`
   - Local `/api/fs/read` and `/api/fs/raw` proxy helpers and shared proxy utility helpers.
   - Workspace-contained Markdown gallery images use these local filesystem

packages/vscode/src/viteConfig.test.ts

@@ -0,0 +1,11 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { describe, test } from 'node:test';
+
+const source = readFileSync(new URL('../vite.config.ts', import.meta.url), 'utf8');
+
+describe('VS Code webview worker build', () => {
+  test('bundles worker imports into one file', () => {
+    assert.match(source, /worker:\s*\{[\s\S]*?inlineDynamicImports:\s*true/);
+  });
+});