From bb7a9eb35139e4b0a1efc863df042157306822f0 Mon Sep 17 00:00:00 2001
From: ekklesia <ekklesia@ekklesisa.dev.local>
Date: Thu, 27 Aug 2026 16:17:04 -0500
Subject: [PATCH] fix: let the display worker ignore requests it does not
 handle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fetch listener called `respondWith` for every request and re-issued the
unrecognized ones itself. That routes the whole page through the worker,
re-sends request bodies from a different context, and makes the worker's
presence observable on requests it has no interest in.

Classify synchronously and respond only for the shell and artifact URLs this
worker actually owns. Not responding is what leaves the browser doing exactly
what it would have done without a worker at all — which is the property the
allowlist was written to preserve.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 surfaces/shell/src/display/sw.ts | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/surfaces/shell/src/display/sw.ts b/surfaces/shell/src/display/sw.ts
index 364ee27..6385a9a 100644
--- a/surfaces/shell/src/display/sw.ts
+++ b/surfaces/shell/src/display/sw.ts
@@ -1,5 +1,6 @@
 /// <reference lib="webworker" />
 import {
+  classifyDisplayRequest,
   DISPLAY_CACHE_NAMES,
   type DisplayOfflineEnvironment,
   type DisplayOfflineStatus,
@@ -56,14 +57,23 @@ self.addEventListener("activate", (event) => {
 });
 
 self.addEventListener("fetch", (event) => {
-  const handled = handleDisplayFetch(event.request, self.location.origin, environment);
+  // Classified synchronously, and `respondWith` is called **only** for what this worker actually
+  // handles. Answering every request — even by re-issuing it — would route the whole page through
+  // the worker, re-send request bodies from a different context, and make the worker's presence
+  // observable on requests it has no interest in. Not responding leaves the browser doing exactly
+  // what it would have done without a worker at all.
+  if (!classifyDisplayRequest(event.request, self.location.origin)) {
+    return;
+  }
   event.respondWith(
-    handled.then(
-      (response) =>
-        // `undefined` means this worker recognized nothing and must not change what the browser would
-        // have done. Re-issuing the request is the only way to say that from inside `respondWith`.
-        response ?? fetch(event.request),
-    ),
+    handleDisplayFetch(event.request, self.location.origin, environment).then((response) => {
+      if (!response) {
+        // Unreachable: the classification above is the same one `handleDisplayFetch` performs. A
+        // network error is the honest answer if that ever stops being true.
+        throw new TypeError("Ekklesia display request was not handled.");
+      }
+      return response;
+    }),
   );
 });