fix(web): use WASM engine for diff highlighting

[jetersen]

Summary

• switch the web @pierre/diffs worker pool from Shiki's JavaScript RegExp engine to the Oniguruma WASM engine
• allow WebAssembly compilation through Electron's renderer CSP using the narrow 'wasm-unsafe-eval' source
• document why the WASM engine is preferred for TextMate grammars
• leave the iOS and Android native Oniguruma highlighter paths unchanged

Rationale

Issue #3884 reports six Pierre DedicatedWorker threads remaining at 100% CPU. Pierre's worker highlighting is synchronous, and the JavaScript RegExp engine can suffer runaway backtracking for certain TextMate grammar inputs. Selecting shiki-wasm uses Oniguruma's stronger runaway-backtracking protections for the desktop/web worker pool.

The desktop protocol CSP explicitly permits WASM compilation without enabling general JavaScript eval. Mobile remains unchanged because it already uses react-native-shiki-engine with native Oniguruma.

Addresses #3884.

Validation

• pnpm exec vp test apps/desktop/src/electron/ElectronProtocol.test.ts
• pnpm exec vp check
• pnpm exec vp run typecheck
• pnpm exec vp run --filter @t3tools/web build

Note

Use WASM engine for diff highlighting in the web app

• Sets preferredHighlighter: "shiki-wasm" in DiffWorkerPoolProvider.tsx to use the WASM-based Shiki highlighter at runtime.
• Adds 'wasm-unsafe-eval' to the script-src directive in ElectronProtocol.ts so the desktop CSP permits WASM execution.

^{Macroscope summarized ed35e48.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3a49a14a-a5ba-47a9-b9a4-fae137980a40

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ccc0c37. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies Content Security Policy (CSP) settings and changes the highlighting engine from JavaScript regex to WASM-based Oniguruma. CSP changes have security implications and switching highlighting engines affects core runtime behavior, both warranting human review.

^{You can customize Macroscope's approvability policy. Learn more.}