Fix Markdown code block editor iframe bootstrap

[Henning Dieterichs (hediet)]

Summary

Fix resource loading in contributed Markdown code block editors by bootstrapping nested iframes through the permitted empty webview page.

• Use /fake.html instead of the outer webview's /index.html, retaining the webview origin and query parameters (including its ID).
• Update @vscode/markdown-editor from 0.0.2-88 to 0.0.2-90 with npm. The published package includes microsoft/vscode-packages#289, which forwards and stores the bootstrap URL all the way to the physical iframe.

Why

The package previously dropped the URL, so frames fell back to srcdoc and the webview service worker could not associate their CSS/JS requests with a webview ID. Once forwarding was fixed, using location.href exposed a second issue: Electron's isAllowedWebviewRequest deliberately blocks nested requests to /index.html (net::ERR_BLOCKED_BY_CLIENT). /fake.html is already the supported empty bootstrap used by the webview wrapper. This change does not relax navigation security restrictions.

Validation

• Verified npm version 0.0.2-90 has gitHead 7e778f85325333474d7b4d000e1ad2382e5a47b3 and inspected the installed published bundle for both constructor forwarding steps.
• npm run compile passed for the Markdown extension, including its webview, notebook, and Markdown editor bundles; extension TypeScript compilation reported zero errors.
• npm run check-markdown-editor-package-json passed (manifests unchanged).
• Precommit hygiene passed.
• Previously verified the same integration change end-to-end in source Code OSS with Team Tools installed and the fixed package linked from source: feedback settings and item controls loaded successfully. The build checks above use the published npm package.

[Copilot]

Copilot review overview

🟡 Changes recommended

The absolute /fake.html path discards vscode.dev’s required webview endpoint prefix.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	extensions/​markdown-language-features/​markdown-editor-src/​editor.ts — This absolute pathname drops the directory prefix used by browser webviews. On vscode.dev,…

What changed in this PR

Fixes nested Markdown code block editor resource loading by using the permitted webview bootstrap page and updating its supporting package.

Changes:

• Updates @vscode/markdown-editor to 0.0.2-90.
• Passes a /fake.html bootstrap URL to nested editors.

File	Description
package.json	Updates the Markdown editor dependency.
package-lock.json	Locks the updated package version.
markdown-editor-src/​editor.ts	Constructs the nested iframe bootstrap URL.

Files not reviewed (1)

• extensions/markdown-language-features/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.