@theia/core 1.73.0-next.40 → 1.73.0-next.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theia/core",
-  "version": "1.73.0-next.40+201e8aea5",
+  "version": "1.73.0-next.51+154e74fa4",
   "description": "Theia is a cloud & desktop IDE framework implemented in TypeScript.",
   "main": "lib/common/index.js",
   "typings": "lib/common/index.d.ts",
@@ -17,8 +17,8 @@
     "@lumino/virtualdom": "^2.0.4",
     "@lumino/widgets": "2.7.5",
     "@parcel/watcher": "^2.5.6",
-    "@theia/application-package": "1.73.0-next.40+201e8aea5",
-    "@theia/request": "1.73.0-next.40+201e8aea5",
+    "@theia/application-package": "1.73.0-next.51+154e74fa4",
+    "@theia/request": "1.73.0-next.51+154e74fa4",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^4.17.25",
     "@types/fs-extra": "^4.0.15",
@@ -28,7 +28,6 @@
     "@types/markdown-it-emoji": "^3.0.1",
     "@types/route-parser": "^0.1.7",
     "@types/safer-buffer": "^2.1.3",
-    "@types/uuid": "^9.0.8",
     "@types/ws": "^8.18.1",
     "@types/yargs": "^17.0.35",
     "@vscode/codicons": "0.0.45",
@@ -66,7 +65,7 @@
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
     "tslib": "^2.8.1",
-    "uuid": "^9.0.1",
+    "uuid": "^11.1.1",
     "vscode-languageserver-protocol": "3.17.5",
     "vscode-uri": "3.0.8",
     "ws": "^8.21.0",
@@ -231,5 +230,5 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "201e8aea5001e76ba316499bc634ae485b97b098"
+  "gitHead": "154e74fa48e7b7427a902630240df88e7865f4b1"
 }

package/src/browser/messaging/ws-connection-source.ts

@@ -208,12 +208,7 @@ export class WebSocketConnectionSource implements ConnectionSource {
             reconnection: true,
             reconnectionDelay: 1000,
             reconnectionDelayMax: 10000,
-            reconnectionAttempts: Infinity,
-            extraHeaders: {
-                // Socket.io strips the `origin` header
-                // We need to provide our own for validation
-                'fix-origin': window.location.origin
-            }
+            reconnectionAttempts: Infinity
         });
     }
 

package/src/browser/shell/tab-bar-toolbar/tab-bar-toolbar-menu-adapters.tsx

@@ -98,7 +98,7 @@ abstract class AbstractToolbarMenuWrapper {
         const className = `${icon} ${ACTION_ITEM}`;
         if (CompoundMenuNode.is(this.menuNode) && !this.menuNode.isEmpty(this.effectiveMenuPath, this.contextKeyService, widget.node, widget)) {
             return <div key={this.id} className={TabBarToolbar.Styles.TAB_BAR_TOOLBAR_ITEM + ' enabled menu'}>
-                <div className={className}
+                <div id={this.id} className={className}
                     title={this.tooltip || this.text}
                     onClick={e => this.executeCommand(widget, e)}
                 />
@@ -108,7 +108,7 @@ abstract class AbstractToolbarMenuWrapper {
             </div>;
         } else {
             return <div key={this.id} className={TabBarToolbar.Styles.TAB_BAR_TOOLBAR_ITEM + ' enabled menu'}>
-                <div className={className}
+                <div id={this.id} className={className}
                     title={this.tooltip || this.text}
                     onClick={e => this.executeCommand(widget, e)}
                 />

package/src/browser/tree/tree-view-welcome-widget.spec.ts

@@ -0,0 +1,80 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '../test/jsdom';
+
+// The widget module transitively imports `@lumino/widgets`, which touches `document` at load time.
+const disableJSDOM = enableJSDOM();
+
+import { Container } from 'inversify';
+import { expect } from 'chai';
+import { ReactElement } from 'react';
+import { CommandService } from '../../common';
+import { LabelParser } from '../label-parser';
+import { codicon } from '../widgets';
+import { TreeViewWelcomeWidget } from './tree-view-welcome-widget';
+
+disableJSDOM();
+
+let labelParser: LabelParser;
+
+before(() => {
+    const container = new Container();
+    container.bind(LabelParser).toSelf().inSingletonScope();
+    container.bind(CommandService).toDynamicValue(() => ({
+        executeCommand<T>(): Promise<T | undefined> {
+            return Promise.resolve(undefined);
+        }
+    })).inSingletonScope();
+    labelParser = container.get(LabelParser);
+});
+
+describe('TreeViewWelcomeWidget#renderLabelWithIcons', () => {
+
+    // Exercise the protected helper without standing up the full TreeWidget DI graph.
+    function render(label: string): ReactElement[] {
+        const widget = Object.create(TreeViewWelcomeWidget.prototype) as {
+            labelParser: LabelParser;
+            renderLabelWithIcons(label: string): ReactElement[];
+        };
+        widget.labelParser = labelParser;
+        return widget.renderLabelWithIcons(label);
+    }
+
+    it('renders a leading $(codicon) as a codicon span and keeps the trailing text', () => {
+        const nodes = render('$(robot) Launch AI Agent');
+        expect(nodes).to.have.lengthOf(2);
+        expect(nodes[0].props.className).to.equal(codicon('robot'));
+        expect(nodes[0].props.children).to.be.undefined;
+        expect(nodes[1].props.className).to.be.undefined;
+        expect(nodes[1].props.children).to.equal(' Launch AI Agent');
+    });
+
+    it('renders a plain label as a single text span with no codicon', () => {
+        const nodes = render('Open Documentation');
+        expect(nodes).to.have.lengthOf(1);
+        expect(nodes[0].props.className).to.be.undefined;
+        expect(nodes[0].props.children).to.equal('Open Documentation');
+    });
+
+    it('renders multiple codicons interleaved with text', () => {
+        const nodes = render('$(package) Import $(gear) Library');
+        const iconNodes = nodes.filter(n => typeof n.props.className === 'string' && n.props.className.includes('codicon-'));
+        expect(iconNodes).to.have.lengthOf(2);
+        expect(iconNodes[0].props.className).to.equal(codicon('package'));
+        expect(iconNodes[1].props.className).to.equal(codicon('gear'));
+    });
+});

package/src/browser/tree/tree-view-welcome-widget.tsx

@@ -209,22 +209,14 @@ export class TreeViewWelcomeWidget extends TreeWidget {
                     className='theia-button theia-WelcomeViewButton'
                     disabled={!this.isEnabledClick(enablement)}
                     onClick={e => this.openLinkOrCommand(e, node.href)}>
-                    {node.label}
+                    {this.renderLabelWithIcons(node.label)}
                 </button>
             </div>
         );
     }
 
     protected renderTextNode(node: string, textKey: string | number): React.ReactNode {
-        return <span key={`text-${textKey}`}>
-            {this.labelParser.parse(node)
-                .map((segment, index) =>
-                    LabelIcon.is(segment)
-                        ? <span
-                            key={index}
-                            className={codicon(segment.name)}
-                        />
-                        : <span key={index}>{segment}</span>)}</span>;
+        return <span key={`text-${textKey}`}>{this.renderLabelWithIcons(node)}</span>;
     }
 
     protected renderLinkNode(node: ILink, linkKey: string | number, enablement: string | undefined): React.ReactNode {
@@ -233,11 +225,18 @@ export class TreeViewWelcomeWidget extends TreeWidget {
                 className={this.getLinkClassName(node.href, enablement)}
                 title={node.title || ''}
                 onClick={e => this.openLinkOrCommand(e, node.href)}>
-                {node.label}
+                {this.renderLabelWithIcons(node.label)}
             </a>
         );
     }
 
+    protected renderLabelWithIcons(label: string): React.ReactNode[] {
+        return this.labelParser.parse(label).map((segment, index) =>
+            LabelIcon.is(segment)
+                ? <span key={index} className={codicon(segment.name)} />
+                : <span key={index}>{segment}</span>);
+    }
+
     protected getLinkClassName(href: string, enablement: string | undefined): string {
         const classNames = ['theia-WelcomeViewCommandLink'];
         // Only command-backed links can be disabled. All other, https:, file: remain enabled

package/src/electron-node/hosting/electron-ws-origin-validator.spec.ts

@@ -0,0 +1,69 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
+import { BackendRemoteService } from '../../node/remote/backend-remote-service';
+
+describe('ElectronWsOriginValidator', () => {
+
+    function createValidator(isRemote = false): ElectronWsOriginValidator {
+        const remoteService = { isRemoteServer: () => isRemote } as BackendRemoteService;
+        const validator = new ElectronWsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['backendRemoteService'] = remoteService;
+        return validator;
+    }
+
+    function createRequest(origin?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        return request;
+    }
+
+    it('should allow file:// origin (standard Electron case)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('file://'))).to.be.true;
+    });
+
+    it('should allow null origin (opaque origin from file:// pages)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('null'))).to.be.true;
+    });
+
+    it('should allow absent origin (same-origin polling requests)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(undefined))).to.be.true;
+    });
+
+    it('should reject cross-origin requests', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://evil.com'))).to.be.false;
+    });
+
+    it('should reject http://localhost origin (not expected in Electron)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://localhost:3000'))).to.be.false;
+    });
+
+    it('should allow empty string origin (treated as absent)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(''))).to.be.true;
+    });
+
+    it('should allow any origin when running as remote server', () => {
+        expect(createValidator(true).allowWsUpgrade(createRequest('http://remote-host.com'))).to.be.true;
+    });
+});

package/src/electron-node/hosting/electron-ws-origin-validator.ts

@@ -30,8 +30,11 @@ export class ElectronWsOriginValidator implements WsRequestValidatorContribution
         if (this.backendRemoteService.isRemoteServer()) {
             return true;
         }
+        const origin = request.headers.origin;
         // On Electron the main page is served from the `file` protocol.
-        // We don't expect the requests to come from anywhere else.
-        return request.headers.origin === 'file://';
+        // Chromium may send "file://" or "null" (opaque origin) or omit the
+        // header entirely depending on the request type (WebSocket upgrade vs
+        // HTTP polling). All three are expected for same-origin Electron requests.
+        return !origin || origin === 'file://' || origin === 'null';
     }
 }

package/src/node/backend-application-module.ts

@@ -36,7 +36,7 @@ import {
 } from '../common';
 import {
     BackendApplication, BackendApplicationContribution, BackendApplicationCliContribution,
-    BackendApplicationServer, BackendApplicationPath, RootContainer
+    BackendApplicationServer, BackendApplicationPath, EarlyExpressMiddleware, RootContainer
 } from './backend-application';
 import { CliManager, CliContribution } from './cli';
 import { IPCConnectionProvider } from './messaging';
@@ -55,7 +55,7 @@ import { ProcessUtils } from './process-utils';
 import { ProxyCliContribution } from './request/proxy-cli-contribution';
 import { bindNodeStopwatch, bindBackendStopwatchServer } from './performance';
 import { OSBackendProviderImpl } from './os-backend-provider';
-import { BackendRequestFacade } from './request/backend-request-facade';
+import { BackendRequestFacade, BackendRequestAllowedContribution } from './request/backend-request-facade';
 import { FileSystemLocking, FileSystemLockingImpl } from './filesystem-locking';
 import { BackendRemoteService } from './remote/backend-remote-service';
 import { RemoteCliContribution } from './remote/remote-cli-contribution';
@@ -89,6 +89,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
     bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
     bind(CliContribution).toService(BackendApplicationCliContribution);
 
+    bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
     bind(BackendApplication).toSelf().inSingletonScope();
     bind(RootContainer).toDynamicValue(({ container }) => {
         let root = container;
@@ -152,6 +153,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
 
     bindRootContributionProvider(bind, RemoteCliContribution);
     bind(BackendRemoteService).toSelf().inSingletonScope();
+    bindRootContributionProvider(bind, BackendRequestAllowedContribution);
     bind(BackendRequestFacade).toSelf().inSingletonScope();
     bind(ConnectionHandler).toDynamicValue(
         ctx => new RpcConnectionHandler(REQUEST_SERVICE_PATH, () => ctx.container.get(BackendRequestFacade))

package/src/node/backend-application.spec.ts

@@ -25,6 +25,7 @@ import {
     BackendApplication,
     BackendApplicationCliContribution,
     BackendApplicationContribution,
+    EarlyExpressMiddleware,
     RootContainer
 } from './backend-application';
 import { CliContribution } from './cli';
@@ -87,6 +88,7 @@ describe('BackendApplication', () => {
         container.bind(ProcessUtils).toSelf().inSingletonScope();
         container.bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
         container.bind(CliContribution).toService(BackendApplicationCliContribution);
+        container.bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
         bindContributionProvider(container, BackendApplicationContribution);
 
         container.bind(TestBackendApplication).toSelf().inSingletonScope();

package/src/node/backend-application.ts

@@ -54,6 +54,16 @@ const DEFAULT_HOST = 'localhost';
 const DEFAULT_SSL = false;
 const DEFAULT_DNS_DEFAULT_RESULT_ORDER: DnsResultOrder = 'ipv4first';
 
+/**
+ * Shared registry for Express middleware that must run before static file handlers.
+ * Contributions push handlers during `initialize()`, and `BackendApplication`
+ * applies them at the start of `configure()`, before gzipped handlers and `express.static()`.
+ */
+@injectable()
+export class EarlyExpressMiddleware {
+    readonly handlers: express.Handler[] = [];
+}
+
 export const BackendApplicationServer = Symbol('BackendApplicationServer');
 /**
  * This service is responsible for serving the frontend files.
@@ -175,6 +185,9 @@ export class BackendApplication {
 
     protected readonly app: express.Application = express();
 
+    @inject(EarlyExpressMiddleware)
+    protected readonly earlyMiddleware: EarlyExpressMiddleware;
+
     @inject(ProcessUtils)
     protected readonly processUtils: ProcessUtils;
 
@@ -244,6 +257,11 @@ export class BackendApplication {
     protected async configure(): Promise<void> {
         await this.initialize();
 
+        // Apply early middleware before static file handlers.
+        for (const handler of this.earlyMiddleware.handlers) {
+            this.app.use(handler);
+        }
+
         this.app.get('*.js', this.serveGzipped.bind(this, 'text/javascript'));
         this.app.get('*.js.map', this.serveGzipped.bind(this, 'application/json'));
         this.app.get('*.css', this.serveGzipped.bind(this, 'text/css'));

package/src/node/hosting/backend-hosting-module.ts

@@ -15,12 +15,22 @@
 // *****************************************************************************
 
 import { ContainerModule } from 'inversify';
+import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
+import {
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+} from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(BackendApplicationHosts).toSelf().inSingletonScope();
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
+
+    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
+    bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
+    bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
 });

package/src/node/hosting/browser-connection-token.spec.ts

@@ -0,0 +1,167 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import {
+    BrowserConnectionToken,
+    BrowserConnectionTokenBackendContribution,
+    BROWSER_TOKEN_COOKIE_NAME,
+    createBrowserConnectionToken
+} from './browser-connection-token';
+
+describe('BrowserConnectionToken', () => {
+
+    it('should generate unique tokens', () => {
+        const token1 = createBrowserConnectionToken();
+        const token2 = createBrowserConnectionToken();
+        expect(token1.value).to.not.equal(token2.value);
+    });
+
+    it('should generate tokens of sufficient length', () => {
+        const token = createBrowserConnectionToken();
+        expect(token.value.length).to.be.greaterThan(16);
+    });
+});
+
+describe('BrowserConnectionTokenBackendContribution', () => {
+
+    const token: BrowserConnectionToken = createBrowserConnectionToken();
+
+    function createContribution(): BrowserConnectionTokenBackendContribution {
+        const contribution = new BrowserConnectionTokenBackendContribution();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (contribution as any)['browserConnectionToken'] = token;
+        return contribution;
+    }
+
+    function createRequest(cookieValue?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (cookieValue !== undefined) {
+            request.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+        }
+        return request;
+    }
+
+    describe('allowWsUpgrade (WebSocket validation)', () => {
+
+        it('should allow WebSocket with valid token cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(token.value))).to.be.true;
+        });
+
+        it('should reject WebSocket with no cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.false;
+        });
+
+        it('should reject WebSocket with invalid token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest('wrong-token'))).to.be.false;
+        });
+
+        it('should reject WebSocket with stale token from previous server', () => {
+            const contribution = createContribution();
+            const staleToken = createBrowserConnectionToken().value;
+            expect(contribution.allowWsUpgrade(createRequest(staleToken))).to.be.false;
+        });
+
+        it('should reject WebSocket with empty token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(''))).to.be.false;
+        });
+
+        it('should handle multiple cookies correctly', () => {
+            const contribution = createContribution();
+            const request = {
+                headers: {
+                    cookie: `other-cookie=foo; ${BROWSER_TOKEN_COOKIE_NAME}=${token.value}; another=bar`
+                } as http.IncomingHttpHeaders
+            } as http.IncomingMessage;
+            expect(contribution.allowWsUpgrade(request)).to.be.true;
+        });
+    });
+
+    describe('expressMiddleware (HTTP cookie flow)', () => {
+
+        interface CookieCall {
+            name: string;
+            value: string;
+            options: Record<string, unknown>;
+        }
+
+        interface MockResponse {
+            cookieCalls: CookieCall[];
+            nextCalled: boolean;
+        }
+
+        function callMiddleware(cookieValue?: string): MockResponse {
+            const contribution = createContribution();
+            const result: MockResponse = { cookieCalls: [], nextCalled: false };
+
+            const req = {
+                headers: {} as Record<string, string | undefined>,
+                socket: { remoteAddress: '127.0.0.1' }
+            };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                cookie: (name: string, value: string, options: Record<string, unknown>) => {
+                    result.cookieCalls.push({ name, value, options });
+                }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).expressMiddleware(req, res, next);
+            return result;
+        }
+
+        it('should set cookie and allow request when no cookie present', () => {
+            const result = callMiddleware();
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].name).to.equal(BROWSER_TOKEN_COOKIE_NAME);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+
+        it('should set cookie with HttpOnly, SameSite=Strict, and path=/', () => {
+            const result = callMiddleware();
+            const opts = result.cookieCalls[0].options;
+            expect(opts.httpOnly).to.be.true;
+            expect(opts.sameSite).to.equal('strict');
+            expect(opts.path).to.equal('/');
+        });
+
+        it('should allow request with valid cookie without re-setting it', () => {
+            const result = callMiddleware(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(0);
+        });
+
+        it('should refresh stale cookie and allow request', () => {
+            const result = callMiddleware('stale-token-from-old-server');
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+    });
+});