Sandbox browser demo handler execution

[mmkal]

Summary

Stacked follow-up on #7. The browser demo no longer runs editable handler source in the main page context:

• adds docs/browser-demo-handler-worker.js, a static dedicated Web Worker for compiling/running handlers
• keeps the no-build GitHub-Pages-friendly demo
• validates handler source through the worker before connecting
• preserves handler logs and existing compile/runtime error paths
• streams handler response chunks back to the main page instead of buffering the whole response
• uses transferable request body streams when the browser supports them, with a buffered fallback

Base PR: #7

Verification

• node --check docs/browser-demo.js
• node --check docs/browser-demo-client.js
• node --check docs/browser-demo-handler-worker.js
• pnpm run check
• pnpm test passed: 29 tests across 3 files
• Browser smoke verified worker normalization for Response, string, Blob, Uint8Array, and ReadableStream
• Browser review-fix smoke verified delayed ReadableStream responses resolve before the first body chunk and deliver later chunks incrementally
• Full local smoke connected the demo to wrangler dev on 127.0.0.1:8788, sent /health, got 200 OK, and confirmed request/handler/response logs

---

Note

Medium Risk
Moderate risk: rewires the browser demo request/response path to cross a Worker boundary (streaming, transferables, error handling), which could introduce subtle runtime/compatibility issues, but it’s limited to static docs/demo assets.

Overview
Moves the browser demo’s editable fetch handler execution out of the page and into a dedicated same-origin Web Worker, so user-provided handler code no longer runs in the DOM context.

The demo now validates/executes handler source by posting serialized requests into the worker, streaming response bodies back in chunks (using transferable ReadableStreams when supported), and propagating handler logs and compile/runtime errors back to the existing UI with a 30s timeout guard. Documentation/UX text is updated to reflect the new trust/isolation model, and a task completion note is added.

^{Reviewed by Cursor Bugbot for commit 0680a72. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/iterate/captun@8

commit: 0680a72