Release v0.51.278 — Release IT (stage-p3g — repair inline PDF preview #3652)

[nesquena-hermes]

Release v0.51.278 — Release IT (stage-p3g)

Phase-3-MEDIUM — #3652 (xx77yy; closes #3649). #3654 (self-update reload race) was dropped from this stage and re-held — its uptime-< readiness gate has a core design flaw (a fresh old process makes the comparison never trip → reload hangs); needs a backend /health boot-id change the contributor should own (full repro + fix direction left on #3654).

Fixed

• fix: PDF inline preview broken due to CSP and script injection bug #3652 (@xx77yy; closes PDF inline preview always shows spinner / falls back to download link #3649) — repair inline PDF preview. The loader created a <script> with both src and textContent (textContent ignored when src present), so PDF.js never initialized. Now loads via a blob module script that sets workerSrc, passes isEvalSupported:false, and revokes the blob URL on load. CSP gains blob: in script-src + a scoped worker-src blob: 'self' https://cdn.jsdelivr.net. (Nathan approved the blob: CSP relaxation.)

Gates

• Pre-Opus gate: merge-markers clean, node -c + ast.parse clean, ruff CLEAN, ESLint runtime CLEAN, browser smoke CLEAN
• Full suite: 7874 passed, 0 failed (an earlier run hit the boot-cascade flake; clean on re-run)
• Codex regression gate: SAFE TO SHIP (verified the blob loader initializes PDF.js + workerSrc; CSP change minimal; no other CSP-consumer affected)
• Opus advisor: Safe to release (CSP relaxation is the minimum needed; blob lifecycle clean; 'unsafe-eval' not introduced). Non-blocking follow-ups noted: add s.onerror revoke for symmetry; add a test pinning 'unsafe-eval' absence.

Closes #3652. Includes a test update widening test_pwa_manifest_csp's CSP capture window (the new directives pushed form-action past the old 600-char window).

[greptile-apps]

Greptile Summary

This release fixes the inline PDF preview by replacing a broken <script src=… textContent=…> element (where textContent is silently ignored when src is set) with a blob module script that correctly imports PDF.js, sets workerSrc, and revokes the blob URL after load. The CSP gains blob: in script-src and a new worker-src blob: 'self' https://cdn.jsdelivr.net directive to permit the approach.

• static/ui.js — Rewrites the PDF.js bootstrap: constructs a blob URL from an ES module string that imports PDF.js and fires pdfjs-ready, sets it as s.src, and revokes on load. Also adds isEvalSupported:false to pdfjsLib.getDocument().
• api/helpers.py — Adds blob: to script-src and a scoped worker-src directive; 'unsafe-eval' is not introduced.
• tests/test_pwa_manifest_csp.py — Widens the CSP substring-capture window from 600 → 1000 chars so the new directives don't push form-action out of the assertion window.

Confidence Score: 4/5

Safe to merge; the blob module script correctly resolves the src+textContent browser spec conflict and the CSP additions are minimal and scoped.

The core fix is correct and the CSP additions are the minimum required. The only gap is a missing s.onerror handler — if the blob script fails to load the blob URL is never revoked and the user waits 15 seconds for the download fallback rather than failing immediately. This is acknowledged in the PR as a follow-up item, not a blocker.

static/ui.js — the onerror gap is worth a follow-up issue; tests/test_pwa_manifest_csp.py uses a fixed-width substring window that will need widening again if more CSP directives are added.

Important Files Changed

Filename	Overview
static/ui.js	Fixes the PDF.js loader by switching from a src+textContent script element (textContent ignored per spec) to a blob module script; also passes isEvalSupported:false. The blob URL is revoked on load but not on error.
api/helpers.py	Adds blob: to script-src and a new worker-src directive to support the PDF.js blob module script; script-src already had 'unsafe-inline' so the blob: addition is a marginal relaxation in practice.
tests/test_pwa_manifest_csp.py	Widens the CSP substring capture window from 600 to 1000 chars to accommodate the new blob:/worker-src directives; the window approach remains fragile but was pre-existing.
CHANGELOG.md	Adds release notes for v0.51.278 describing the PDF.js loader fix and CSP changes; no code concerns.

Sequence Diagram

sequenceDiagram
    participant Page as Browser Page
    participant Blob as Blob URL module
    participant CDN as cdn.jsdelivr.net
    participant Worker as PDF.js Worker

    Page->>Page: URL.createObjectURL(blob script)
    Page->>Blob: "script type=module src=blobUrl"
    Blob->>CDN: import pdf.min.mjs
    CDN-->>Blob: PDF.js module
    Blob->>Blob: set GlobalWorkerOptions.workerSrc
    Blob->>Page: window._pdfjsLib assigned, dispatch pdfjs-ready
    Page->>Page: URL.revokeObjectURL on onload
    Page->>CDN: getDocument with isEvalSupported false
    CDN-->>Worker: spawn pdf.worker.min.mjs
    Worker-->>Page: PDF pages rendered

Loading

_{Reviews (1): Last reviewed commit: "docs(changelog): v0.51.278 — Release IT ..." | Re-trigger Greptile}

[greptile-apps]

Missing onerror handler leaks the blob URL on load failure

If the blob module script fails to load (e.g., the CDN is unreachable, a browser rejects blob: in script-src, or the import of PDF.js itself throws), onload never fires and _pdfBlobUrl is never passed to URL.revokeObjectURL. The blob stays alive in the page's origin until navigation. The user also waits the full 15-second timeout before the download fallback appears, whereas an onerror handler could degrade immediately. The PR description already notes this as a follow-up; surfacing it here so it gets tracked.