bug: service worker registration never runs (inline body inside `<script src=...>` is ignored)

[radumarias]

Summary

p2p-transfer/index.html:120-127 contains a single <script> element that has both a src attribute and an inline body. Per the HTML spec, when src is set the inline contents are ignored — so the navigator.serviceWorker.register('sw.js') call inside it never executes. assets/sw.js's aggressive caching / PWA layer is silently dead in production builds.

Found during a security audit of PR #41 (the bug is pre-existing, not introduced by that PR).

Location

p2p-transfer/index.html:120-127

<script src="https://cdn.jsdelivr.net/npm/webtorrent@latest/webtorrent.min.js">

if ('serviceWorker' in navigator && window.location.hash !== "#dev") {
window.addEventListener('load', function () {
            navigator.serviceWorker.register('sw.js');
        });
    }
</script>

Why this matters

• The service worker (assets/sw.js) is set up to cache the wasm bundle aggressively — this is how the PWA works offline and reloads fast.
• Because the registration call never fires, the SW is never installed in production. The app still works (the browser falls back to normal fetches), but the PWA caching layer that CLAUDE.md documents is effectively turned off.
• Easy to miss because the file looks correct at a glance; the bug is purely structural.

Suggested fix

Split into two separate <script> blocks:

<!-- Either keep webtorrent (pinned with SRI per #42) or remove it -->

<script>
  if ('serviceWorker' in navigator && window.location.hash !== "#dev") {
    window.addEventListener('load', function () {
      navigator.serviceWorker.register('sw.js');
    });
  }
</script>

Verification

After the fix, run trunk serve --release and check DevTools → Application → Service Workers — sw.js should appear as "activated and running". Without the fix, no SW is registered.

Related

• security: pin or remove unpinned webtorrent@latest CDN script in p2p-transfer/index.html (no SRI) #42 — same <script> tag, unrelated CDN/SRI issue. Both should be fixed in the same follow-up PR.