From ccb64418f8acccb9dd13d9ddafc70afdbb277b52 Mon Sep 17 00:00:00 2001
From: Viljami Kuosmanen <viljami@viljami.io>
Date: Wed, 26 Aug 2026 10:33:30 +0300
Subject: [PATCH] Remove COI service worker

Co-authored-by: Claude <noreply@anthropic.com>
---
 docusaurus.config.js              |   6 --
 src/components/Sandbox/Iframe.tsx |   6 +-
 static/coi-serviceworker.js       | 149 ------------------------------
 3 files changed, 1 insertion(+), 160 deletions(-)
 delete mode 100644 static/coi-serviceworker.js

diff --git a/docusaurus.config.js b/docusaurus.config.js
index c77a5f1b..1e97606f 100644
--- a/docusaurus.config.js
+++ b/docusaurus.config.js
@@ -40,12 +40,6 @@ const config = {
   deploymentBranch: 'gh-pages',
   trailingSlash: true,
 
-  // GitHub Pages can't set COOP/COEP response headers, which the embedded
-  // StackBlitz sandbox (WebContainers) requires for cross-origin isolation.
-  // This service worker shim injects them client-side.
-  // https://developer.stackblitz.com/platform/webcontainers/browser-support#embedding
-  scripts: ['/coi-serviceworker.js'],
-
   onBrokenLinks: 'throw',
   onBrokenMarkdownLinks: 'warn',
 
diff --git a/src/components/Sandbox/Iframe.tsx b/src/components/Sandbox/Iframe.tsx
index cd861737..3afe21a5 100644
--- a/src/components/Sandbox/Iframe.tsx
+++ b/src/components/Sandbox/Iframe.tsx
@@ -8,10 +8,6 @@ export const Iframe = (
   return (
     <iframe
       loading="lazy"
-      // the page is cross-origin isolated (COEP) for the StackBlitz sandbox,
-      // which blocks cross-origin frames that don't serve COEP themselves;
-      // the credentialless attribute (Chromium) exempts this frame from that check
-      {...{ credentialless: 'true' }}
       {...props}
       onLoad={() => {
         setLoaded(true);
@@ -22,4 +18,4 @@ export const Iframe = (
       )}
     />
   );
-};
\ No newline at end of file
+};
diff --git a/static/coi-serviceworker.js b/static/coi-serviceworker.js
deleted file mode 100644
index 82761cfc..00000000
--- a/static/coi-serviceworker.js
+++ /dev/null
@@ -1,149 +0,0 @@
-/*! coi-serviceworker v0.1.7 - Guido Zuidhof and contributors, licensed under MIT */
-// patched: default to credentialless so the first controlled document load
-// already gets COEP: credentialless (require-corp would block cross-origin
-// logo images, since opaque responses can't be given a CORP header)
-let coepCredentialless = true;
-if (typeof window === 'undefined') {
-    self.addEventListener("install", () => self.skipWaiting());
-    self.addEventListener("activate", (event) => event.waitUntil(self.clients.claim()));
-
-    self.addEventListener("message", (ev) => {
-        if (!ev.data) {
-            return;
-        } else if (ev.data.type === "deregister") {
-            self.registration
-                .unregister()
-                .then(() => {
-                    return self.clients.matchAll();
-                })
-                .then(clients => {
-                    clients.forEach((client) => client.navigate(client.url));
-                });
-        } else if (ev.data.type === "coepCredentialless") {
-            coepCredentialless = ev.data.value;
-        }
-    });
-
-    self.addEventListener("fetch", function (event) {
-        const r = event.request;
-        if (r.cache === "only-if-cached" && r.mode !== "same-origin") {
-            return;
-        }
-
-        const request = (coepCredentialless && r.mode === "no-cors")
-            ? new Request(r, {
-                credentials: "omit",
-            })
-            : r;
-        event.respondWith(
-            fetch(request)
-                .then((response) => {
-                    if (response.status === 0) {
-                        return response;
-                    }
-
-                    const newHeaders = new Headers(response.headers);
-                    newHeaders.set("Cross-Origin-Embedder-Policy",
-                        coepCredentialless ? "credentialless" : "require-corp"
-                    );
-                    if (!coepCredentialless) {
-                        newHeaders.set("Cross-Origin-Resource-Policy", "cross-origin");
-                    }
-                    newHeaders.set("Cross-Origin-Opener-Policy", "same-origin");
-
-                    return new Response(response.body, {
-                        status: response.status,
-                        statusText: response.statusText,
-                        headers: newHeaders,
-                    });
-                })
-                .catch((e) => console.error(e))
-        );
-    });
-
-} else {
-    (() => {
-        const reloadedBySelf = window.sessionStorage.getItem("coiReloadedBySelf");
-        window.sessionStorage.removeItem("coiReloadedBySelf");
-        const coepDegrading = (reloadedBySelf == "coepdegrade");
-
-        // You can customize the behavior of this script through a global `coi` variable.
-        const coi = {
-            shouldRegister: () => !reloadedBySelf,
-            shouldDeregister: () => false,
-            coepCredentialless: () => true,
-            coepDegrade: () => true,
-            doReload: () => window.location.reload(),
-            quiet: false,
-            ...window.coi
-        };
-
-        const n = navigator;
-        const controlling = n.serviceWorker && n.serviceWorker.controller;
-
-        // Record the failure if the page is served by serviceWorker.
-        if (controlling && !window.crossOriginIsolated) {
-            window.sessionStorage.setItem("coiCoepHasFailed", "true");
-        }
-        const coepHasFailed = window.sessionStorage.getItem("coiCoepHasFailed");
-
-        if (controlling) {
-            // Reload only on the first failure.
-            const reloadToDegrade = coi.coepDegrade() && !(
-                coepDegrading || window.crossOriginIsolated
-            );
-            n.serviceWorker.controller.postMessage({
-                type: "coepCredentialless",
-                value: (reloadToDegrade || coepHasFailed && coi.coepDegrade())
-                    ? false
-                    : coi.coepCredentialless(),
-            });
-            if (reloadToDegrade) {
-                !coi.quiet && console.log("Reloading page to degrade COEP.");
-                window.sessionStorage.setItem("coiReloadedBySelf", "coepdegrade");
-                coi.doReload("coepdegrade");
-            }
-
-            if (coi.shouldDeregister()) {
-                n.serviceWorker.controller.postMessage({ type: "deregister" });
-            }
-        }
-
-        // If we're already coi: do nothing. Perhaps it's due to this script doing its job, or COOP/COEP are
-        // already set from the origin server. Also if the browser has no notion of crossOriginIsolated, just give up here.
-        if (window.crossOriginIsolated !== false || !coi.shouldRegister()) return;
-
-        if (!window.isSecureContext) {
-            !coi.quiet && console.log("COOP/COEP Service Worker not registered, a secure context is required.");
-            return;
-        }
-
-        // In some environments (e.g. Firefox private mode) this won't be available
-        if (!n.serviceWorker) {
-            !coi.quiet && console.error("COOP/COEP Service Worker not registered, perhaps due to private mode.");
-            return;
-        }
-
-        n.serviceWorker.register(window.document.currentScript.src).then(
-            (registration) => {
-                !coi.quiet && console.log("COOP/COEP Service Worker registered", registration.scope);
-
-                registration.addEventListener("updatefound", () => {
-                    !coi.quiet && console.log("Reloading page to make use of updated COOP/COEP Service Worker.");
-                    window.sessionStorage.setItem("coiReloadedBySelf", "updatefound");
-                    coi.doReload();
-                });
-
-                // If the registration is active, but it's not controlling the page
-                if (registration.active && !n.serviceWorker.controller) {
-                    !coi.quiet && console.log("Reloading page to make use of COOP/COEP Service Worker.");
-                    window.sessionStorage.setItem("coiReloadedBySelf", "notcontrolling");
-                    coi.doReload();
-                }
-            },
-            (err) => {
-                !coi.quiet && console.error("COOP/COEP Service Worker failed to register:", err);
-            }
-        );
-    })();
-}