Unable to use extensions that depend on unsafe-eval policy, in code-editor

まず、Code Editor が web/worker host で CommonJS 拡張機能をどのように読み込み、CSP ポリシーがどこで設定されているかを追跡します。vscodevim.vim 拡張機能のアクティベーションを再現し、その後、報告された EvalError なしで意図したポリシーの下で動作することを確認します。

Description:
The change in the security policy from unsafe-eval to wasm-unsafe-eval stops JavaScript from turning strings into runnable code.

• Vim is a CommonJS format extension.
• When Code Editor loads a CommonJS extension in the web/worker host, it wraps the code string in a function and executes it.
• In the Code Editor space, the new CSP policy blocks that step, so it fails.

2026-09-10 16:47:24.991 [error] Activating extension vscodevim.vim failed due to an error: 2026-09-10 16:47:24.991 [error] EvalError: Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'wasm-unsafe-eval' 'sha256-8VDNIuBNbWfgSAsMFpnaas1UmjLKHwTaKfM2t/FPUfc=' https: http://localhost:* blob:".

https://www.w3.org/TR/CSP3/#directive-script-src
Per the CSP spec, new Function() is gated only on 'unsafe-eval'; 'wasm-unsafe-eval' "only permits WebAssembly and does not affect JavaScript." So replacing 'unsafe-eval' with 'wasm-unsafe-eval' removes the exact permission the extension loader needs, and the browser throws EvalError.

Ticket ID: D523182748