@theia/core 1.73.0-next.43 → 1.73.0-next.52

package/lib/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC"}

package/lib/node/index.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileSystemLocking = void 0;
+exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./backend-application"), exports);
 tslib_1.__exportStar(require("./backend-global"), exports);
@@ -26,4 +26,6 @@ tslib_1.__exportStar(require("./cli"), exports);
 tslib_1.__exportStar(require("./setting-service"), exports);
 var filesystem_locking_1 = require("./filesystem-locking");
 Object.defineProperty(exports, "FileSystemLocking", { enumerable: true, get: function () { return filesystem_locking_1.FileSystemLocking; } });
+var backend_request_facade_1 = require("./request/backend-request-facade");
+Object.defineProperty(exports, "BackendRequestAllowedContribution", { enumerable: true, get: function () { return backend_request_facade_1.BackendRequestAllowedContribution; } });
 //# sourceMappingURL=index.js.map

package/lib/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA"}

package/lib/node/messaging/websocket-endpoint.d.ts

@@ -16,6 +16,11 @@ export declare class WebsocketEndpoint implements BackendApplicationContribution
     protected readonly wsHandlers: ConnectionHandlers<Socket<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any>>;
     registerConnectionHandler(spec: string, callback: (params: MessagingService.PathParams, socket: Socket) => void): void;
     onStart(server: http.Server | https.Server): void;
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     protected allowConnect(request: http.IncomingMessage): Promise<boolean>;
     protected handleConnection(socket: Socket): Promise<void>;
 }

package/lib/node/messaging/websocket-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,qBACa,iBAAkB,YAAW,8BAA8B;IAEpE,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAG1D,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAGxD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEnC,SAAS,CAAC,iBAAiB,SAAS;IACpC,SAAS,CAAC,iBAAiB,SAAO;IAElC,SAAS,CAAC,QAAQ,CAAC,UAAU,oJAAoC;IAEjE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAItH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;cAqBjC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;cAQ7D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}
+{"version":3,"file":"websocket-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,qBACa,iBAAkB,YAAW,8BAA8B;IAEpE,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAG1D,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAGxD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEnC,SAAS,CAAC,iBAAiB,SAAS;IACpC,SAAS,CAAC,iBAAiB,SAAO;IAElC,SAAS,CAAC,QAAQ,CAAC,UAAU,oJAAoC;IAEjE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAItH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;IA4BjD;;;;OAIG;cACa,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;cAQ7D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/lib/node/messaging/websocket-endpoint.js

@@ -35,14 +35,18 @@ let WebsocketEndpoint = class WebsocketEndpoint {
         const socketServer = new socket_io_1.Server(server, {
             pingInterval: this.checkAliveTimeout,
             pingTimeout: this.checkAliveTimeout * 2,
-            maxHttpBufferSize: this.maxHttpBufferSize
+            maxHttpBufferSize: this.maxHttpBufferSize,
+            allowRequest: (req, callback) => {
+                // eslint-disable-next-line no-null/no-null
+                const noError = null;
+                this.wsRequestValidator.allowWsUpgrade(req).then(allowed => callback(noError, allowed), error => {
+                    console.error('Error during WebSocket allowRequest validation:', error);
+                    callback(error?.message ?? 'Validation error', false);
+                });
+            }
         });
         // Accept every namespace by using /.*/
         socketServer.of(/.*/).on('connection', async (socket) => {
-            const request = socket.request;
-            // Socket.io strips the `origin` header of the incoming request
-            // We provide a `fix-origin` header in the `WebSocketConnectionProvider`
-            request.headers.origin = request.headers['fix-origin'];
             if (await this.allowConnect(socket.request)) {
                 await this.handleConnection(socket);
                 this.messagingListener.onDidWebSocketUpgrade(socket.request, socket);
@@ -52,6 +56,11 @@ let WebsocketEndpoint = class WebsocketEndpoint {
             }
         });
     }
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     async allowConnect(request) {
         try {
             return this.wsRequestValidator.allowWsUpgrade(request);

package/lib/node/messaging/websocket-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-endpoint.js","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;;;;AAKhF,yCAAsD;AACtD,yCAA2C;AAC3C,oEAA8D;AAC9D,+DAA0D;AAC1D,2EAAiE;AAEjE,gDAA8C;AAGvC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QAUO,sBAAiB,GAAG,KAAK,CAAC,CAAC,aAAa;QACxC,sBAAiB,GAAG,GAAG,CAAC,CAAC,SAAS;QAEzB,eAAU,GAAG,IAAI,8CAAkB,EAAU,CAAC;IAyCrE,CAAC;IAvCG,yBAAyB,CAAC,IAAY,EAAE,QAAuE;QAC3G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAkC;QACtC,MAAM,YAAY,GAAG,IAAI,kBAAM,CAAC,MAAM,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,iBAAiB;YACpC,WAAW,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC5C,CAAC,CAAC;QACH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,+DAA+D;YAC/D,wEAAwE;YACxE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAW,CAAC;YACjE,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,OAA6B;QACtD,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAA;AAtDY,8CAAiB;AAEP;IADlB,IAAA,kBAAM,EAAC,0CAAkB,CAAC;sCACY,0CAAkB;6DAAC;AAGvC;IADlB,IAAA,kBAAM,EAAC,uCAAiB,CAAC;sCACY,uCAAiB;4DAAC;AAGrC;IADlB,IAAA,kBAAM,EAAC,gBAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,wBAAwB,CAAC;;iDACd;4BAR1B,iBAAiB;IAD7B,IAAA,sBAAU,GAAE;GACA,iBAAiB,CAsD7B"}
+{"version":3,"file":"websocket-endpoint.js","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;;;;AAKhF,yCAAsD;AACtD,yCAA2C;AAC3C,oEAA8D;AAC9D,+DAA0D;AAC1D,2EAAiE;AAEjE,gDAA8C;AAGvC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QAUO,sBAAiB,GAAG,KAAK,CAAC,CAAC,aAAa;QACxC,sBAAiB,GAAG,GAAG,CAAC,CAAC,SAAS;QAEzB,eAAU,GAAG,IAAI,8CAAkB,EAAU,CAAC;IAqDrE,CAAC;IAnDG,yBAAyB,CAAC,IAAY,EAAE,QAAuE;QAC3G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAkC;QACtC,MAAM,YAAY,GAAG,IAAI,kBAAM,CAAC,MAAM,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,iBAAiB;YACpC,WAAW,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;gBAC5B,2CAA2C;gBAC3C,MAAM,OAAO,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5C,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACrC,KAAK,CAAC,EAAE;oBACJ,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;oBACxE,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAC1D,CAAC,CACJ,CAAC;YACN,CAAC;SACJ,CAAC,CAAC;QACH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,YAAY,CAAC,OAA6B;QACtD,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAA;AAlEY,8CAAiB;AAEP;IADlB,IAAA,kBAAM,EAAC,0CAAkB,CAAC;sCACY,0CAAkB;6DAAC;AAGvC;IADlB,IAAA,kBAAM,EAAC,uCAAiB,CAAC;sCACY,uCAAiB;4DAAC;AAGrC;IADlB,IAAA,kBAAM,EAAC,gBAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,wBAAwB,CAAC;;iDACd;4BAR1B,iBAAiB;IAD7B,IAAA,sBAAU,GAAE;GACA,iBAAiB,CAkE7B"}

package/lib/node/request/backend-request-facade.d.ts

@@ -14,10 +14,29 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 import { RequestConfiguration, RequestContext, RequestOptions, RequestService } from '@theia/request';
+import { ContributionProvider, MaybePromise } from '../../common';
+export declare const BackendRequestAllowedContribution: unique symbol;
+export interface BackendRequestAllowedContribution {
+    /**
+     * Returns URL patterns that should be allowed through the backend request facade.
+     * Patterns are matched against request URLs.
+     *
+     * Supports:
+     * - Exact base URLs: `https://open-vsx.org` (allows any path under this origin)
+     * - Wildcard subdomains: `https://*.github.com` (allows any subdomain)
+     *
+     * Only `http:` and `https:` schemes are permitted.
+     */
+    getAllowedUrlPatterns(): MaybePromise<string[]>;
+}
+export declare function isUrlAllowed(url: string, allowedPatterns: string[]): boolean;
 export declare class BackendRequestFacade implements RequestService {
     protected readonly requestService: RequestService;
+    protected readonly allowedContributions?: ContributionProvider<BackendRequestAllowedContribution>;
+    protected cachedAllowedPatterns: string[] | undefined;
     configure(config: RequestConfiguration): Promise<void>;
     request(options: RequestOptions): Promise<RequestContext>;
     resolveProxy(url: string): Promise<string | undefined>;
+    protected getAllowedPatterns(): Promise<string[]>;
 }
 //# sourceMappingURL=backend-request-facade.d.ts.map

package/lib/node/request/backend-request-facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-request-facade.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAGlF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEtG,qBACa,oBAAqB,YAAW,cAAc;IAGvD,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAElD,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAK/D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAIzD"}
+{"version":3,"file":"backend-request-facade.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAGlF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGlE,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAC7F,MAAM,WAAW,iCAAiC;IAC9C;;;;;;;;;OASG;IACH,qBAAqB,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E;AA4CD,qBACa,oBAAqB,YAAW,cAAc;IAGvD,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAGlD,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;IAElG,SAAS,CAAC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAEhD,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;cAItC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAc1D"}

package/lib/node/request/backend-request-facade.js

@@ -15,27 +15,117 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackendRequestFacade = void 0;
+exports.BackendRequestFacade = exports.BackendRequestAllowedContribution = void 0;
+exports.isUrlAllowed = isUrlAllowed;
 const tslib_1 = require("tslib");
 const inversify_1 = require("inversify");
 const request_1 = require("@theia/request");
+const common_1 = require("../../common");
+const backend_application_config_provider_1 = require("../backend-application-config-provider");
+exports.BackendRequestAllowedContribution = Symbol('BackendRequestAllowedContribution');
+const ALLOWED_SCHEMES = new Set(['http:', 'https:']);
+function isUrlAllowed(url, allowedPatterns) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+        return false;
+    }
+    for (const pattern of allowedPatterns) {
+        if (matchesPattern(parsed, pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+function matchesPattern(target, pattern) {
+    let patternUrl;
+    try {
+        patternUrl = new URL(pattern);
+    }
+    catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(patternUrl.protocol)) {
+        return false;
+    }
+    if (target.protocol !== patternUrl.protocol) {
+        return false;
+    }
+    const targetPort = getEffectivePort(target);
+    const patternPort = getEffectivePort(patternUrl);
+    if (targetPort !== patternPort) {
+        return false;
+    }
+    return matchesHost(target.hostname, patternUrl.hostname);
+}
+function getEffectivePort(url) {
+    if (url.port) {
+        return url.port;
+    }
+    if (url.protocol === 'https:') {
+        return '443';
+    }
+    if (url.protocol === 'http:') {
+        return '80';
+    }
+    return '';
+}
+function matchesHost(targetHost, patternHost) {
+    if (patternHost.startsWith('*.')) {
+        const suffix = patternHost.substring(1); // e.g. ".example.com"
+        return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+    }
+    return targetHost === patternHost;
+}
 let BackendRequestFacade = class BackendRequestFacade {
-    configure(config) {
-        return this.requestService.configure(config);
+    async configure(config) {
+        if (backend_application_config_provider_1.BackendApplicationConfigProvider.get().configureProxyFromPreferences) {
+            return this.requestService.configure(config);
+        }
     }
     async request(options) {
+        const patterns = await this.getAllowedPatterns();
+        const url = options.url;
+        if (!url || !isUrlAllowed(url, patterns)) {
+            throw new Error(`Request to URL '${url}' is not allowed. The URL does not match any allowed pattern.`);
+        }
         const context = await this.requestService.request(options);
         return request_1.RequestContext.compress(context);
     }
     resolveProxy(url) {
         return this.requestService.resolveProxy(url);
     }
+    async getAllowedPatterns() {
+        if (this.cachedAllowedPatterns) {
+            return this.cachedAllowedPatterns;
+        }
+        const patterns = [];
+        if (this.allowedContributions) {
+            for (const contribution of this.allowedContributions.getContributions()) {
+                const contributed = await contribution.getAllowedUrlPatterns();
+                patterns.push(...contributed);
+            }
+        }
+        this.cachedAllowedPatterns = patterns;
+        return patterns;
+    }
 };
 exports.BackendRequestFacade = BackendRequestFacade;
 tslib_1.__decorate([
     (0, inversify_1.inject)(request_1.RequestService),
     tslib_1.__metadata("design:type", Object)
 ], BackendRequestFacade.prototype, "requestService", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(common_1.ContributionProvider),
+    (0, inversify_1.named)(exports.BackendRequestAllowedContribution),
+    (0, inversify_1.optional)(),
+    tslib_1.__metadata("design:type", Object)
+], BackendRequestFacade.prototype, "allowedContributions", void 0);
 exports.BackendRequestFacade = BackendRequestFacade = tslib_1.__decorate([
     (0, inversify_1.injectable)()
 ], BackendRequestFacade);

package/lib/node/request/backend-request-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-request-facade.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;;AAElF,yCAA+C;AAC/C,4CAAsG;AAG/F,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAK7B,SAAS,CAAC,MAA4B;QAClC,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,wBAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CAEJ,CAAA;AAlBY,oDAAoB;AAGV;IADlB,IAAA,kBAAM,EAAC,wBAAc,CAAC;;4DAC2B;+BAHzC,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,CAkBhC"}
+{"version":3,"file":"backend-request-facade.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;AAwBlF,oCAgBC;;AAtCD,yCAAgE;AAChE,4CAAsG;AACtG,yCAAkE;AAClE,gGAA0F;AAE7E,QAAA,iCAAiC,GAAG,MAAM,CAAC,mCAAmC,CAAC,CAAC;AAe7F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD,SAAgB,YAAY,CAAC,GAAW,EAAE,eAAyB;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAW,EAAE,OAAe;IAChD,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACD,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,WAAmB;IACxD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,KAAK,WAAW,CAAC;AACtC,CAAC;AAGM,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAU7B,KAAK,CAAC,SAAS,CAAC,MAA4B;QACxC,IAAI,sEAAgC,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,+DAA+D,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,wBAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,kBAAkB;QAC9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACtC,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBACtE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,qBAAqB,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC;QACtC,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ,CAAA;AA5CY,oDAAoB;AAGV;IADlB,IAAA,kBAAM,EAAC,wBAAc,CAAC;;4DAC2B;AAG/B;IADlB,IAAA,kBAAM,EAAC,6BAAoB,CAAC;IAAE,IAAA,iBAAK,EAAC,yCAAiC,CAAC;IAAE,IAAA,oBAAQ,GAAE;;kEACe;+BANzF,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,CA4ChC"}

package/lib/node/request/backend-request-facade.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backend-request-facade.spec.d.ts.map

package/lib/node/request/backend-request-facade.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-request-facade.spec.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.spec.ts"],"names":[],"mappings":""}

package/lib/node/request/backend-request-facade.spec.js

@@ -0,0 +1,171 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon = require("sinon");
+const backend_request_facade_1 = require("./backend-request-facade");
+const backend_application_config_provider_1 = require("../backend-application-config-provider");
+describe('isUrlAllowed', () => {
+    it('should allow a URL that matches an exact origin pattern', () => {
+        const patterns = ['https://open-vsx.org'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/extensions', patterns)).to.be.true;
+    });
+    it('should allow a URL with a path when pattern has no path', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/some/deep/path?query=1', patterns)).to.be.true;
+    });
+    it('should allow a URL that exactly matches the origin', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/', patterns)).to.be.true;
+    });
+    it('should reject a URL with a different scheme', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different host', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different port', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.false;
+    });
+    it('should allow a URL when port matches explicitly', () => {
+        const patterns = ['https://example.com:8443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.true;
+    });
+    it('should treat default ports as equivalent', () => {
+        const patterns = ['https://example.com:443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        const httpPatterns = ['http://example.com:80'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', httpPatterns)).to.be.true;
+        const implicitPatterns = ['http://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com:80/path', implicitPatterns)).to.be.true;
+    });
+    it('should match wildcard subdomains', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://foo.example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://bar.baz.example.com/path', patterns)).to.be.true;
+    });
+    it('should not match the bare domain with a wildcard subdomain pattern', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject non-http(s) schemes', () => {
+        const patterns = ['file:///etc/passwd'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+    });
+    it('should reject ftp scheme', () => {
+        const patterns = ['ftp://files.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://files.example.com/data', patterns)).to.be.false;
+    });
+    it('should reject a URL when target uses non-http(s) scheme even if patterns exist', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://example.com/data', patterns)).to.be.false;
+    });
+    it('should reject all URLs when allowlist is empty', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://localhost:3000', [])).to.be.false;
+    });
+    it('should reject invalid URLs', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('not a url', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('', patterns)).to.be.false;
+    });
+    it('should allow private IPs only when explicitly in the allowlist', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', ['https://example.com'])).to.be.false;
+        const patternsWithLoopback = ['http://127.0.0.1:8080'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', patternsWithLoopback)).to.be.true;
+    });
+    it('should reject cloud metadata endpoint by default', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', ['https://example.com'])).to.be.false;
+    });
+    it('should merge multiple patterns correctly', () => {
+        const patterns = [
+            'https://open-vsx.org',
+            'https://marketplace.example.com',
+            'https://*.cdn.example.com'
+        ];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/v2/extensions', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://marketplace.example.com/download', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://files.cdn.example.com/ext.vsix', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/malware', patterns)).to.be.false;
+    });
+    it('should handle patterns with trailing slashes', () => {
+        const patterns = ['https://example.com/'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+    });
+    it('should handle invalid patterns gracefully', () => {
+        const patterns = ['not a valid pattern', 'https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://other.com/path', patterns)).to.be.false;
+    });
+    it('should prevent host spoofing via subdomain prefix', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com.evil.com/path', patterns)).to.be.false;
+    });
+});
+describe('BackendRequestFacade', () => {
+    describe('configure', () => {
+        let configProviderStub;
+        beforeEach(() => {
+            configProviderStub = sinon.stub(backend_application_config_provider_1.BackendApplicationConfigProvider, 'get');
+        });
+        afterEach(() => {
+            configProviderStub.restore();
+        });
+        it('should be a no-op when configureProxyFromPreferences is false', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: false
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            await facade.configure({ proxyUrl: 'http://evil.com', strictSSL: false });
+            (0, chai_1.expect)(configureStub.called).to.be.false;
+        });
+        it('should pass through to the underlying request service when configureProxyFromPreferences is true', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: true
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            const config = { proxyUrl: 'http://my-proxy.com:8080', strictSSL: true, proxyAuthorization: 'Bearer token' };
+            await facade.configure(config);
+            (0, chai_1.expect)(configureStub.calledOnce).to.be.true;
+            (0, chai_1.expect)(configureStub.firstCall.args[0]).to.deep.equal(config);
+        });
+    });
+});
+//# sourceMappingURL=backend-request-facade.spec.js.map

package/lib/node/request/backend-request-facade.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-request-facade.spec.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAC9B,+BAA+B;AAC/B,qEAA8E;AAC9E,gGAA0F;AAE1F,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAE1B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4CAA4C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,QAAQ,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEtE,MAAM,YAAY,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEzE,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC1E,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAE1F,MAAM,oBAAoB,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG;YACb,sBAAsB;YACtB,iCAAiC;YACjC,2BAA2B;SAC9B,CAAC;QACF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACpF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAElC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QAEvB,IAAI,kBAAmC,CAAC;QAExC,UAAU,CAAC,GAAG,EAAE;YACZ,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,sEAAgC,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACX,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC3E,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,KAAK;aACvC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAA,aAAM,EAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;YAC9G,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,IAAI;aACtC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC;YAC7G,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAA,aAAM,EAAC,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC5C,IAAA,aAAM,EAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theia/core",
-  "version": "1.73.0-next.43+39d328622",
+  "version": "1.73.0-next.52+637df8980",
   "description": "Theia is a cloud & desktop IDE framework implemented in TypeScript.",
   "main": "lib/common/index.js",
   "typings": "lib/common/index.d.ts",
@@ -17,8 +17,8 @@
     "@lumino/virtualdom": "^2.0.4",
     "@lumino/widgets": "2.7.5",
     "@parcel/watcher": "^2.5.6",
-    "@theia/application-package": "1.73.0-next.43+39d328622",
-    "@theia/request": "1.73.0-next.43+39d328622",
+    "@theia/application-package": "1.73.0-next.52+637df8980",
+    "@theia/request": "1.73.0-next.52+637df8980",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^4.17.25",
     "@types/fs-extra": "^4.0.15",
@@ -230,5 +230,5 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "39d328622a0c2226daec3d331dfc18dd5c3eebde"
+  "gitHead": "637df89808957b3106f6de26237c250f6d599cdc"
 }

package/src/browser/messaging/ws-connection-source.ts

@@ -208,12 +208,7 @@ export class WebSocketConnectionSource implements ConnectionSource {
             reconnection: true,
             reconnectionDelay: 1000,
             reconnectionDelayMax: 10000,
-            reconnectionAttempts: Infinity,
-            extraHeaders: {
-                // Socket.io strips the `origin` header
-                // We need to provide our own for validation
-                'fix-origin': window.location.origin
-            }
+            reconnectionAttempts: Infinity
         });
     }
 

package/src/browser/tree/tree-view-welcome-widget.spec.ts

@@ -0,0 +1,80 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '../test/jsdom';
+
+// The widget module transitively imports `@lumino/widgets`, which touches `document` at load time.
+const disableJSDOM = enableJSDOM();
+
+import { Container } from 'inversify';
+import { expect } from 'chai';
+import { ReactElement } from 'react';
+import { CommandService } from '../../common';
+import { LabelParser } from '../label-parser';
+import { codicon } from '../widgets';
+import { TreeViewWelcomeWidget } from './tree-view-welcome-widget';
+
+disableJSDOM();
+
+let labelParser: LabelParser;
+
+before(() => {
+    const container = new Container();
+    container.bind(LabelParser).toSelf().inSingletonScope();
+    container.bind(CommandService).toDynamicValue(() => ({
+        executeCommand<T>(): Promise<T | undefined> {
+            return Promise.resolve(undefined);
+        }
+    })).inSingletonScope();
+    labelParser = container.get(LabelParser);
+});
+
+describe('TreeViewWelcomeWidget#renderLabelWithIcons', () => {
+
+    // Exercise the protected helper without standing up the full TreeWidget DI graph.
+    function render(label: string): ReactElement[] {
+        const widget = Object.create(TreeViewWelcomeWidget.prototype) as {
+            labelParser: LabelParser;
+            renderLabelWithIcons(label: string): ReactElement[];
+        };
+        widget.labelParser = labelParser;
+        return widget.renderLabelWithIcons(label);
+    }
+
+    it('renders a leading $(codicon) as a codicon span and keeps the trailing text', () => {
+        const nodes = render('$(robot) Launch AI Agent');
+        expect(nodes).to.have.lengthOf(2);
+        expect(nodes[0].props.className).to.equal(codicon('robot'));
+        expect(nodes[0].props.children).to.be.undefined;
+        expect(nodes[1].props.className).to.be.undefined;
+        expect(nodes[1].props.children).to.equal(' Launch AI Agent');
+    });
+
+    it('renders a plain label as a single text span with no codicon', () => {
+        const nodes = render('Open Documentation');
+        expect(nodes).to.have.lengthOf(1);
+        expect(nodes[0].props.className).to.be.undefined;
+        expect(nodes[0].props.children).to.equal('Open Documentation');
+    });
+
+    it('renders multiple codicons interleaved with text', () => {
+        const nodes = render('$(package) Import $(gear) Library');
+        const iconNodes = nodes.filter(n => typeof n.props.className === 'string' && n.props.className.includes('codicon-'));
+        expect(iconNodes).to.have.lengthOf(2);
+        expect(iconNodes[0].props.className).to.equal(codicon('package'));
+        expect(iconNodes[1].props.className).to.equal(codicon('gear'));
+    });
+});