[22/36] Release 0.8.0 with packaged PDF.js preview

[cjohnsto-nz]

Summary

• Releases Missio 0.8.0.
• Completes PDF response preview by loading the official Mozilla PDF.js distribution through the webview CSP-safe module path.
• Copies exact pdfjs-dist@5.4.624 build assets during build and packaging; generated media files are not committed.
• Corrects the PDF.js third-party notice and adds 0.8.0 release notes.

Verification

• npm run compile
• npm test -- --run — 23 files / 438 tests
• npm run build
• Generated PDF.js and worker SHA-256 hashes match the exact package files.

---

This is part 1 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54 <-- current
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pdfjs-dist@​5.4.624

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• pdfjs-dist@5.4.624

View full report

[APKiwi]

Verdict: request changes, on scope and dependency classification rather than code correctness (the code changes verified fine).

• Major, scope: this is not a version bump. 388 of 391 added lines are a separate commit ("Package PDF.js preview assets") that introduces a new production dependency, vendors ~1.2MB of minified pdf.js bundles into media/, and reworks the webview CSP and module-loading path. A reviewer scanning a "bump to 0.8.0" PR waves exactly this through. Split it or retitle it.
• Major, per the vendored-blob check: media/pdf.min.mjs and media/pdf.worker.min.mjs are committed minified blobs. Provenance does verify (pdf.js Apache banner, pdfjsVersion 5.4.624 matching the pin, regenerated by esbuild.js copyPdfJsAssets), and vendoring is a legitimate necessity for webviews, so this is a flag not a block. But they're also redundantly committed while being regenerated from node_modules every build, pick one source of truth or at least mark them linguist-generated (the follow-up .gitattributes PR is the right place).
• Minor: pdfjs-dist belongs in devDependencies. It is consumed only by esbuild.js at build time, nothing in src/ imports it (verified via grep). As a runtime dependency it pulls @napi-rs/canvas plus 11 platform-specific native binary packages (~35MB, ~15 lockfile entries) into the production graph and npm audit surface for functionality that needs two static files copied per build. Moving it removes roughly half the entire stack's added dependency footprint.
• Minor: no changelog. There is no CHANGELOG or release-notes file anywhere in the repo, and this PR closes out a 21-PR release (GraphQL, WebSocket, gRPC, runtime scripting, auth/transport, PDF preview) with zero user-facing notes. 0.8.0 deserves a summary.

Verified correct: the frame-src to worker-src CSP replace targets a string that exists verbatim in basePanel.ts:417 so it isn't a silent no-op, and the pdfjsLib ?? await window.missioPdfJsReady fallback correctly handles the async module-load race the old blocking script tags didn't have. The new _getHtml test asserting the module markup and CSP is a good targeted test.

Deps verdict: buying pdf.js for PDF rendering is right, nobody should hand-roll that. The classification and the double-commit of its artifacts are the issues.

[APKiwi]

Re-review (whole-stack pass, per REVIEW_GUIDE.md)

Head unchanged since the first review, no reply. All four prior findings stand.

• (major) Scope. The title is "Bump version to 0.8.0" but the PR also lands the PDF.js packaging, and the body carries no scope disclosure. This is a functional change, not a version bump: media/pdf.js and media/pdf.worker.js never existed in the repo (git log --all is empty for both), so on the base the injected script tags 404 and PDF preview always fell back to "PDF.js not available". This commit is the first working PDF preview plus a license-notice correction (THIRD-PARTY-NOTICES attributed v3.1.81 files that were never in the tree). Retitle so the behavior change is visible.
• (major) Vendored blobs are a double source of truth. media/pdf.min.mjs (424KB) and media/pdf.worker.min.mjs (1.05MB) are committed, while esbuild.js copyPdfJsAssets regenerates both on every build and vscode:prepublish guarantees regeneration before packaging, so the committed copies are never what ships. [23/36] Retire tracked PDF asset normalization #64 adds .gitattributes -text but no linguist-generated and does not resolve the dual source. The in-tree copies can drift from the pin silently.
• (minor) pdfjs-dist is under dependencies, but nothing in src/ imports it, only esbuild.js reads it from node_modules. It belongs in devDependencies. node_modules/** is vscodeignored so VSIX size is unaffected, the cost is install/audit surface.
• (minor) No changelog. No CHANGELOG anywhere, and README has no version string or release notes.

New (low): the Socket bot posted six duplicate high-severity "obfuscated code" warnings on pdfjs-dist@5.4.624 that are false positives on official minified Mozilla dist files (Apache 2.0, pdfjsVersion = 5.4.624 embedded in both blobs, matches the pin). Worth an explicit triage so future lockfile PRs stop re-warning.

Verdict: changes-needed on the scope/retitle and the vendored-blob dual source. The CSP nonce propagation to the dynamic import is verified only by markup assertions, not a runtime webview test.

[cjohnsto-nz]

@SocketSecurity ignore npm/pdfjs-dist@5.4.624

[cjohnsto-nz]

The review findings are accepted and resolved.

• The PR is now titled “[22/36] Release 0.8.0 with packaged PDF.js preview,” and its body explicitly describes the PDF preview, CSP-safe module loading, dependency provenance, release notes, and verification. It is no longer presented as a version-only change.
• Commit 05b20d2 removes the committed media/pdf.min.mjs and media/pdf.worker.min.mjs blobs. They are generated build outputs, ignored by Git, and copied by esbuild.js during build/watch; vscode:prepublish runs that build before packaging. There is now one source of truth.
• pdfjs-dist is now the exact 5.4.624 entry in devDependencies. The lockfile marks it and its optional canvas packages as development-only.
• CHANGELOG.md now records the 0.8.0 user-facing protocol, runtime, transport, import/export, Copilot, and PDF-preview changes.
• The Socket “obfuscated code” alert is triaged in [22/36] Release 0.8.0 with packaged PDF.js preview #54 (comment). This is Mozilla’s official signed v5.4.624 release, the package is Apache-2.0, and the minification is expected distribution output.

I did not add a simulated CSP runtime test. This repository has no VS Code webview integration harness, and JSDOM does not enforce CSP. The application-controlled boundary is covered by the existing _getHtml assertions for the nonce-bearing module markup and worker CSP plus the clean build that materializes both referenced assets. Browser CSP enforcement itself belongs to the VS Code host, not a unit-test substitute.

Validation:

• npm run compile passed.
• Full suite passed 23 files / 438 tests.
• npm run build passed.
• The generated PDF.js and worker SHA-256 hashes exactly match node_modules/pdfjs-dist/build.

Updated PR #56 → PR #54, PR #54 → PR #64, PR #54 → PR #71, and PR #54 → PR #72 all simulate cleanly. GitHub reports PR #54 and immediate child PR #64 as MERGEABLE/CLEAN, with PR #54’s fresh build and security checks passing.

[cjohnsto-nz]

Response to the second review: these findings are addressed on the current head (05b20d2).

• The PR title now discloses both the 0.8.0 release work and the packaged PDF.js preview.
• Generated media/pdf*.mjs files are no longer committed. They are ignored and regenerated during the build from the pinned pdfjs-dist 5.4.624 development dependency.
• The release is recorded in CHANGELOG.md in the final stack.
• The Socket findings are false positives against the official Mozilla-produced, minified generated artifacts; there is no hand-written obfuscation, and those generated files are not treated as source-of-truth files.
• The CSP helper now throws when a required directive cannot be replaced instead of silently emitting an incomplete policy.
• The preview suite contains 14 tests, including runtime JSDOM behavior.

I also validated the complete 37-PR composition with npm run build, npm run compile, all 539 tests, and all 47 demo validations passing.