Make the notebook site cross-origin isolated on GitHub Pages (KOKKOS works deployed)#90
Merged
Conversation
The KOKKOS multithreaded wasm was shipped to the notebook site but never usable there: SharedArrayBuffer needs COOP/COEP headers, static hosting can't send them, and the usual coi-serviceworker shim can't be installed because JupyterLite's own service worker owns the scope (the contents API — and our DriveFS mount — depend on it). Fold the coi-serviceworker logic into JupyterLite's service worker instead: build.sh now runs coi_patch.py, which wraps maybeFromCache (the function serving every plain GET the worker intercepts) so responses carry COOP/COEP/CORP, and injects a bootstrap into the app pages that reloads once when the worker takes control so the document itself gets the headers. A sessionStorage guard prevents reload loops; without isolation everything falls back to single-threaded as before. The patch asserts on the pinned jupyterlite-core's service-worker internals so a version bump fails the build loudly (upstream feature request: jupyterlite/jupyterlite#1409). Verified headlessly against a plain http.server with no headers: crossOriginIsolated flips to true after one reload; basics/04 reports the KOKKOS build available and benchmarks 6.3 M atom-steps/s vs 2.6 M single-threaded (~2.4x at t 4); the DriveFS file workflows (basics/02, basics/05, md-basics/05), piplite, matplotlib and the pyodide CDN all work under require-corp; md-basics/02's "go big" cell now runs its 10k-atom KOKKOS path. Docs and the two notebooks that described the old limitation updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
basics/04on the deployed site printscross-origin isolated: Falseand falls back to the single-threaded build — even though the Pages workflow builds and ships the real KOKKOS wasm. GitHub Pages can't send COOP/COEP, and the plain coi-serviceworker shim can't be used under/notebook/because JupyterLite's own service worker must own the scope (the contents API — and our DriveFS mount — ride on it).How
Fold the coi-serviceworker logic into JupyterLite's own service worker (the approach proposed upstream in jupyterlite#1409, implemented site-side until a supported flag exists):
coi_patch.py(run bybuild.shafterjupyter lite build) wrapsmaybeFromCache— the function that answers every plain GET the worker intercepts (documents, assets, cross-origin fetches) — so responses carryCross-Origin-Embedder-Policy: require-corp,Cross-Origin-Opener-Policy: same-origin, andCross-Origin-Resource-Policy: cross-origin.sessionStorageguard makes a reload loop impossible; if isolation still fails, notebooks fall back to single-threaded exactly as before. Returning visitors with the old worker get the update + one reload automatically (the worker usesskipWaiting+clients.claim).jupyterlite-core0.8.0 service-worker internals — a version bump fails the build loudly instead of silently shipping a non-isolated site.Verified (headless browser against a plain
http.server, no headers)crossOriginIsolatedflips totrueafter exactly one reload;SharedArrayBufferavailable.basics/04: "cross-origin isolated: True, KOKKOS package available: True", benchmark 6.3 M atom-steps/s vs 2.6 M single-threaded (~2.4× att 4).md-basics/02's "go big" cell runs its 10,000-atom KOKKOS path.index,basics/02,basics/05,md-basics/05all pass (contents API through the patched worker, piplite, matplotlib, pyodide CDN underrequire-corp).Docs (
README,examples/notebook/README,NOTEBOOK_TUTORIALS) and the two notebooks that described the old limitation are updated.🤖 Generated with Claude Code