@theia/core 1.74.0-next.9 → 1.74.0

package/lib/node/hosting/browser-connection-token.d.ts

@@ -8,6 +8,24 @@ export declare const BROWSER_TOKEN_COOKIE_NAME = "theia-connection-token";
 export interface BrowserConnectionToken {
     value: string;
 }
+export declare const HttpConnectionValidator: unique symbol;
+/**
+ * Express middleware provider that rejects HTTP requests lacking a valid connection token.
+ *
+ * The connection-token cookie is only *bootstrapped* globally (see
+ * {@link BrowserConnectionTokenBackendContribution}); enforcement is opt-in per route.
+ * Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
+ * inject this and apply {@link validateRequest} as route middleware. Non-sensitive routes
+ * (the initial HTML page, static assets) must not use it, as they legitimately have no
+ * cookie yet on the very first page load.
+ */
+export interface HttpConnectionValidator {
+    /**
+     * Express middleware that calls `next()` when the request carries a valid connection-token
+     * cookie (or when running in Electron) and responds with `403` otherwise.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
+}
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -15,12 +33,17 @@ export interface BrowserConnectionToken {
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
  * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
  */
-export declare class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+export declare class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution, HttpConnectionValidator {
     protected readonly browserConnectionToken: BrowserConnectionToken;
     protected readonly earlyMiddleware: EarlyExpressMiddleware;
     /**
@@ -35,6 +58,11 @@ export declare class BrowserConnectionTokenBackendContribution implements Backen
      * cannot provide the `SameSite=Strict` cookie either, so they are rejected.
      */
     allowWsUpgrade(request: http.IncomingMessage): MaybePromise<boolean>;
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
     protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void;
     protected getTokenFromCookie(req: http.IncomingMessage): string | undefined;
     protected isTokenValid(token: string): boolean;

package/lib/node/hosting/browser-connection-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,OAAO,GAAG,QAAQ,SAAS,CAAC,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,qBACa,yCAA0C,YAAW,8BAA8B,EAAE,8BAA8B;IAG5H,SAAS,CAAC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IAGlE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IAE3D;;;;OAIG;IACH,UAAU,IAAI,IAAI;IAOlB;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC;IAapE,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAc1G,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,SAAS;IAQ3E,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAUjD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAErE"}
+{"version":3,"file":"browser-connection-token.d.ts","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,OAAO,GAAG,QAAQ,SAAS,CAAC,CAAC;AAGpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACpC;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAClG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,yCAA0C,YAAW,8BAA8B,EAAE,8BAA8B,EAAE,uBAAuB;IAGrJ,SAAS,CAAC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IAGlE,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IAE3D;;;;OAIG;IACH,UAAU,IAAI,IAAI;IAOlB;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC;IAapE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAe9F,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,GAAG,IAAI;IAc1G,SAAS,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,GAAG,SAAS;IAQ3E,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAUjD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,IAAI,sBAAsB,CAErE"}

package/lib/node/hosting/browser-connection-token.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserConnectionTokenBackendContribution = exports.BROWSER_TOKEN_COOKIE_NAME = exports.BrowserConnectionToken = void 0;
+exports.BrowserConnectionTokenBackendContribution = exports.HttpConnectionValidator = exports.BROWSER_TOKEN_COOKIE_NAME = exports.BrowserConnectionToken = void 0;
 exports.createBrowserConnectionToken = createBrowserConnectionToken;
 const tslib_1 = require("tslib");
 const cookie = require("cookie");
@@ -26,6 +26,7 @@ const backend_application_1 = require("../backend-application");
 const uuid_1 = require("../../common/uuid");
 exports.BrowserConnectionToken = Symbol('BrowserConnectionToken');
 exports.BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
+exports.HttpConnectionValidator = Symbol('HttpConnectionValidator');
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -33,6 +34,11 @@ exports.BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
@@ -67,6 +73,24 @@ let BrowserConnectionTokenBackendContribution = class BrowserConnectionTokenBack
         // because it is set on the initial page load.
         return false;
     }
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req, res, next) {
+        if (index_1.environment.electron.is()) {
+            next();
+            return;
+        }
+        const token = this.getTokenFromCookie(req);
+        if (token && this.isTokenValid(token)) {
+            next();
+            return;
+        }
+        // No cookie or stale/invalid token: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load, and same-origin requests send it automatically.
+        res.sendStatus(403);
+    }
     expressMiddleware(req, res, next) {
         const existing = this.getTokenFromCookie(req);
         if (!existing || !this.isTokenValid(existing)) {

package/lib/node/hosting/browser-connection-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;AA6GhF,oEAEC;;AA7GD,iCAAiC;AACjC,iCAAiC;AAGjC,yCAA+C;AAC/C,8CAAiD;AAEjD,gEAAgG;AAEhG,4CAAiD;AAEpC,QAAA,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAE1D,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAMlE;;;;;;;;;;;GAWG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAQlD;;;;OAIG;IACH,UAAU;QACN,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA6B;QACxC,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IAES,iBAAiB,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,iCAAyB,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE;gBACrE,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;aACZ,CAAC,CAAC;QACP,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC;IAES,kBAAkB,CAAC,GAAyB;QAClD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,IAAI,YAAY,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,iCAAyB,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,YAAY,CAAC,KAAa;QAChC,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAtEY,8FAAyC;AAG/B;IADlB,IAAA,kBAAM,EAAC,8BAAsB,CAAC;;yFACmC;AAG/C;IADlB,IAAA,kBAAM,EAAC,4CAAsB,CAAC;sCACK,4CAAsB;kFAAC;oDANlD,yCAAyC;IADrD,IAAA,sBAAU,GAAE;GACA,yCAAyC,CAsErD;AAED;;GAEG;AACH,SAAgB,4BAA4B;IACxC,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,GAAE,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"browser-connection-token.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;AAyJhF,oEAEC;;AAzJD,iCAAiC;AACjC,iCAAiC;AAGjC,yCAA+C;AAC/C,8CAAiD;AAEjD,gEAAgG;AAEhG,4CAAiD;AAEpC,QAAA,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAE1D,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAMrD,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAoBzE;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,yCAAyC,GAA/C,MAAM,yCAAyC;IAQlD;;;;OAIG;IACH,UAAU;QACN,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA6B;QACxC,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,gEAAgE;QAChE,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QACnF,IAAI,mBAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,uFAAuF;QACvF,8FAA8F;QAC9F,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAES,iBAAiB,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,0EAA0E;YAC1E,+DAA+D;YAC/D,GAAG,CAAC,MAAM,CAAC,iCAAyB,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE;gBACrE,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;aACZ,CAAC,CAAC;QACP,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC;IAES,kBAAkB,CAAC,GAAyB;QAClD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QACxC,IAAI,YAAY,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,iCAAyB,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,YAAY,CAAC,KAAa;QAChC,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAzFY,8FAAyC;AAG/B;IADlB,IAAA,kBAAM,EAAC,8BAAsB,CAAC;;yFACmC;AAG/C;IADlB,IAAA,kBAAM,EAAC,4CAAsB,CAAC;sCACK,4CAAsB;kFAAC;oDANlD,yCAAyC;IADrD,IAAA,sBAAU,GAAE;GACA,yCAAyC,CAyFrD;AAED;;GAEG;AACH,SAAgB,4BAA4B;IACxC,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,GAAE,EAAE,CAAC;AACrC,CAAC"}

package/lib/node/hosting/browser-connection-token.spec.js

@@ -16,6 +16,7 @@
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
 const chai_1 = require("chai");
+const common_1 = require("../../common");
 const browser_connection_token_1 = require("./browser-connection-token");
 describe('BrowserConnectionToken', () => {
     it('should generate unique tokens', () => {
@@ -124,5 +125,74 @@ describe('BrowserConnectionTokenBackendContribution', () => {
             (0, chai_1.expect)(result.cookieCalls[0].value).to.equal(token.value);
         });
     });
+    describe('validateRequest (HTTP token enforcement)', () => {
+        function callValidate(cookieValue) {
+            const contribution = createContribution();
+            const result = { nextCalled: false };
+            const req = { headers: {} };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${browser_connection_token_1.BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+            const res = {
+                sendStatus: (status) => { result.sentStatus = status; }
+            };
+            const next = () => { result.nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            contribution.validateRequest(req, res, next);
+            return result;
+        }
+        it('should allow request with valid token cookie', () => {
+            const result = callValidate(token.value);
+            (0, chai_1.expect)(result.nextCalled).to.be.true;
+            (0, chai_1.expect)(result.sentStatus).to.be.undefined;
+        });
+        it('should reject request with no cookie', () => {
+            const result = callValidate();
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with invalid token', () => {
+            const result = callValidate('wrong-token');
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with stale token from previous server', () => {
+            const staleToken = (0, browser_connection_token_1.createBrowserConnectionToken)().value;
+            const result = callValidate(staleToken);
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+        it('should reject request with empty token', () => {
+            const result = callValidate('');
+            (0, chai_1.expect)(result.nextCalled).to.be.false;
+            (0, chai_1.expect)(result.sentStatus).to.equal(403);
+        });
+    });
+    describe('Electron deployment (no-op)', () => {
+        let originalIsElectron;
+        beforeEach(() => {
+            originalIsElectron = common_1.environment.electron.is;
+            common_1.environment.electron.is = () => true;
+        });
+        afterEach(() => {
+            common_1.environment.electron.is = originalIsElectron;
+        });
+        it('validateRequest should call next() without a cookie', () => {
+            const contribution = createContribution();
+            let nextCalled = false;
+            let sentStatus;
+            const req = { headers: {} };
+            const res = { sendStatus: (status) => { sentStatus = status; } };
+            const next = () => { nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            contribution.validateRequest(req, res, next);
+            (0, chai_1.expect)(nextCalled).to.be.true;
+            (0, chai_1.expect)(sentStatus).to.be.undefined;
+        });
+        it('allowWsUpgrade should return true without a cookie', () => {
+            const contribution = createContribution();
+            (0, chai_1.expect)(contribution.allowWsUpgrade(createRequest())).to.be.true;
+        });
+    });
 });
 //# sourceMappingURL=browser-connection-token.spec.js.map

package/lib/node/hosting/browser-connection-token.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-connection-token.spec.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,yEAKoC;AAEpC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAEpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,IAAA,aAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC7C,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAEvD,MAAM,KAAK,GAA2B,IAAA,uDAA4B,GAAE,CAAC;IAErE,SAAS,kBAAkB;QACvB,MAAM,YAAY,GAAG,IAAI,oEAAyC,EAAE,CAAC;QACrE,8DAA8D;QAC7D,YAAoB,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,SAAS,aAAa,CAAC,WAAoB;QACvC,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAEnD,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YAClD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACrE,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE;oBACL,MAAM,EAAE,qBAAqB,oDAAyB,IAAI,KAAK,CAAC,KAAK,eAAe;iBAC3D;aACR,CAAC;YAC1B,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAalD,SAAS,cAAc,CAAC,WAAoB;YACxC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEpE,MAAM,GAAG,GAAG;gBACR,OAAO,EAAE,EAAwC;gBACjD,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;aACzC,CAAC;YACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,MAAM,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;oBACtE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC;aACJ,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,oDAAyB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACjC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,CAAC,CAAC;YAC7D,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"browser-connection-token.spec.js","sourceRoot":"","sources":["../../../src/node/hosting/browser-connection-token.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,yCAA2C;AAC3C,yEAKoC;AAEpC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAEpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC9C,IAAA,aAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,IAAA,uDAA4B,GAAE,CAAC;QAC7C,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAEvD,MAAM,KAAK,GAA2B,IAAA,uDAA4B,GAAE,CAAC;IAErE,SAAS,kBAAkB;QACvB,MAAM,YAAY,GAAG,IAAI,oEAAyC,EAAE,CAAC;QACrE,8DAA8D;QAC7D,YAAoB,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,SAAS,aAAa,CAAC,WAAoB;QACvC,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAEnD,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YAClD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACrE,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE;oBACL,MAAM,EAAE,qBAAqB,oDAAyB,IAAI,KAAK,CAAC,KAAK,eAAe;iBAC3D;aACR,CAAC;YAC1B,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAalD,SAAS,cAAc,CAAC,WAAoB;YACxC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAiB,EAAE,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEpE,MAAM,GAAG,GAAG;gBACR,OAAO,EAAE,EAAwC;gBACjD,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE;aACzC,CAAC;YACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,MAAM,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;oBACtE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtD,CAAC;aACJ,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,oDAAyB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACjC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,cAAc,CAAC,6BAA6B,CAAC,CAAC;YAC7D,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAA,aAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAOtD,SAAS,YAAY,CAAC,WAAoB;YACtC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAqB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YAEvD,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAwC,EAAE,CAAC;YAClE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,oDAAyB,IAAI,WAAW,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,GAAG,GAAG;gBACR,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;aAClE,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvD,8DAA8D;YAC7D,YAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YACrC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC5C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;YAC9B,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACnE,MAAM,UAAU,GAAG,IAAA,uDAA4B,GAAE,CAAC,KAAK,CAAC;YACxD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACxC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YAChC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;YACtC,IAAA,aAAM,EAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAEzC,IAAI,kBAAiC,CAAC;QAEtC,UAAU,CAAC,GAAG,EAAE;YACZ,kBAAkB,GAAG,oBAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,oBAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACX,oBAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,kBAAkB,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC3D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,UAA8B,CAAC;YACnC,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,EAAwC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAChD,8DAA8D;YAC7D,YAAoB,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACtD,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC9B,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC1D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;YAC1C,IAAA,aAAM,EAAC,YAAY,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/lib/node/index.d.ts

@@ -7,4 +7,5 @@ export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
 export { BackendRequestAllowedContribution } from './request/backend-request-facade';
+export { HttpConnectionValidator } from './hosting/browser-connection-token';
 //# sourceMappingURL=index.d.ts.map

package/lib/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC"}

package/lib/node/index.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
+exports.HttpConnectionValidator = exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./backend-application"), exports);
 tslib_1.__exportStar(require("./backend-global"), exports);
@@ -28,4 +28,6 @@ var filesystem_locking_1 = require("./filesystem-locking");
 Object.defineProperty(exports, "FileSystemLocking", { enumerable: true, get: function () { return filesystem_locking_1.FileSystemLocking; } });
 var backend_request_facade_1 = require("./request/backend-request-facade");
 Object.defineProperty(exports, "BackendRequestAllowedContribution", { enumerable: true, get: function () { return backend_request_facade_1.BackendRequestAllowedContribution; } });
+var browser_connection_token_1 = require("./hosting/browser-connection-token");
+Object.defineProperty(exports, "HttpConnectionValidator", { enumerable: true, get: function () { return browser_connection_token_1.HttpConnectionValidator; } });
 //# sourceMappingURL=index.js.map

package/lib/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA;AAC1C,+EAA6E;AAApE,mIAAA,uBAAuB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theia/core",
-  "version": "1.74.0-next.9+f24bc8b12",
+  "version": "1.74.0",
   "description": "Theia is a cloud & desktop IDE framework implemented in TypeScript.",
   "main": "lib/common/index.js",
   "typings": "lib/common/index.d.ts",
@@ -17,8 +17,8 @@
     "@lumino/virtualdom": "^2.0.4",
     "@lumino/widgets": "2.7.5",
     "@parcel/watcher": "^2.5.6",
-    "@theia/application-package": "1.74.0-next.9+f24bc8b12",
-    "@theia/request": "1.74.0-next.9+f24bc8b12",
+    "@theia/application-package": "1.74.0",
+    "@theia/request": "1.74.0",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^4.17.25",
     "@types/fs-extra": "^4.0.15",
@@ -35,7 +35,7 @@
     "async-mutex": "^0.4.1",
     "body-parser": "^1.20.5",
     "cookie": "^1.1.1",
-    "dompurify": "^3.4.7",
+    "dompurify": "^3.4.11",
     "drivelist": "^12.0.2",
     "express": "^4.22.2",
     "fast-json-stable-stringify": "^2.1.0",
@@ -51,10 +51,10 @@
     "keytar": "7.9.0",
     "lodash.debounce": "^4.0.8",
     "lodash.throttle": "^4.1.1",
-    "markdown-it": "^14.2.0",
+    "markdown-it": "^14.3.0",
     "markdown-it-anchor": "^9.2.0",
     "markdown-it-emoji": "^3.0.0",
-    "msgpackr": "^1.11.12",
+    "msgpackr": "^1.12.1",
     "p-debounce": "^2.1.0",
     "perfect-scrollbar": "1.5.5",
     "react-tooltip": "^4.5.1",
@@ -69,7 +69,7 @@
     "vscode-languageserver-protocol": "3.17.5",
     "vscode-uri": "3.0.8",
     "ws": "^8.21.0",
-    "yargs": "^17.7.2"
+    "yargs": "^17.7.3"
   },
   "peerDependencies": {
     "@theia/electron": "*",
@@ -218,9 +218,9 @@
     "watch": "theiaext watch"
   },
   "devDependencies": {
-    "@theia/ext-scripts": "1.73.0",
-    "@theia/re-exports": "1.73.0",
-    "@types/react": "^18.3.28",
+    "@theia/ext-scripts": "1.74.0",
+    "@theia/re-exports": "1.74.0",
+    "@types/react": "^18.3.31",
     "@types/react-dom": "^18.3.7",
     "minimist": "^1.2.8",
     "nodejs-file-downloader": "4.13.0",
@@ -230,5 +230,5 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "f24bc8b12e11ee4b054527565df3648c363b7f86"
+  "gitHead": "7b7376225f0825b4f13d296d686cc13db95fdb69"
 }

package/src/browser/browser-clipboard-service.ts

@@ -17,6 +17,7 @@
 import { injectable, inject } from 'inversify';
 import { isFirefox } from './browser';
 import { ClipboardService } from './clipboard-service';
+import { Emitter, Event } from '../common/event';
 import { ILogger } from '../common/logger';
 import { MessageService } from '../common/message-service';
 import { nls } from '../common/nls';
@@ -41,6 +42,9 @@ export class BrowserClipboardService implements ClipboardService {
     @inject(ILogger)
     protected readonly logger: ILogger;
 
+    protected readonly onDidWriteTextEmitter = new Emitter<string>();
+    readonly onDidWriteText: Event<string> = this.onDidWriteTextEmitter.event;
+
     async readText(): Promise<string> {
         let permission;
         try {
@@ -82,6 +86,7 @@ export class BrowserClipboardService implements ClipboardService {
             // in FireFox, Clipboard API isn't gated with the permissions
             try {
                 await this.getClipboardAPI().writeText(value);
+                this.onDidWriteTextEmitter.fire(value);
                 return;
             } catch (e2) {
                 this.logger.error('Failed writing to the clipboard.', e2);
@@ -103,7 +108,8 @@ export class BrowserClipboardService implements ClipboardService {
             ));
             return;
         }
-        return this.getClipboardAPI().writeText(value);
+        await this.getClipboardAPI().writeText(value);
+        this.onDidWriteTextEmitter.fire(value);
     }
 
     protected async queryPermission(name: string): Promise<PermissionStatus> {

package/src/browser/clipboard-service.ts

@@ -14,10 +14,21 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 
+import { Event } from '../common/event';
 import { MaybePromise } from '../common/types';
 
 export const ClipboardService = Symbol('ClipboardService');
+/**
+ * Access to the system clipboard. Reading may require a user permission prompt in browsers.
+ */
 export interface ClipboardService {
+    /** Returns the clipboard text, or an empty string if it cannot be read. */
     readText(): MaybePromise<string>;
+    /** Writes the given text to the clipboard. */
     writeText(value: string): MaybePromise<void>;
+    /**
+     * Emitted with the written text after {@link writeText} updated the clipboard.
+     * Such writes dispatch no DOM `copy` event, so this is the only way to observe them.
+     */
+    readonly onDidWriteText?: Event<string>;
 }

package/src/browser/common-frontend-contribution.ts

@@ -34,7 +34,6 @@ import { OpenerService, open } from '../browser/opener-service';
 import { ApplicationShell } from './shell/application-shell';
 import { SHELL_TABBAR_CONTEXT_CLOSE, SHELL_TABBAR_CONTEXT_COPY, SHELL_TABBAR_CONTEXT_PIN, SHELL_TABBAR_CONTEXT_SPLIT } from './shell/tab-bars';
 import { AboutDialog } from './about-dialog';
-import * as browser from './browser';
 import URI from '../common/uri';
 import { ContextKey, ContextKeyService } from './context-key-service';
 import { OS, isOSX, isWindows, EOL } from '../common/os';
@@ -75,10 +74,12 @@ import { timeout } from '../common/promise-util';
 
 export const supportCut = environment.electron.is() || document.queryCommandSupported('cut');
 export const supportCopy = environment.electron.is() || document.queryCommandSupported('copy');
-// Chrome incorrectly returns true for document.queryCommandSupported('paste')
-// when the paste feature is available but the calling script has insufficient
-// privileges to actually perform the action
-export const supportPaste = environment.electron.is() || (!browser.isChrome && document.queryCommandSupported('paste'));
+// Browsers block programmatic paste (document.execCommand('paste') is a no-op and
+// document.queryCommandSupported('paste') returns false), so supportPaste is effectively
+// electron-only. Keeping it false in browsers is intentional: the ctrlcmd+v keybinding stays
+// unregistered, so native paste events reach widget-level listeners (e.g. the navigator), and
+// menu paste is handled by dedicated handlers using the async clipboard API.
+export const supportPaste = environment.electron.is() || document.queryCommandSupported('paste');
 
 export const RECENT_COMMANDS_STORAGE_KEY = 'commands';
 
@@ -680,7 +681,6 @@ export class CommonFrontendContribution implements FrontendApplicationContributi
             }
         });
         commandRegistry.registerCommand(CommonCommands.TOGGLE_BOTTOM_PANEL, {
-            isEnabled: () => this.shell.getWidgets('bottom').length > 0,
             execute: () => {
                 if (this.shell.isExpanded('bottom')) {
                     this.shell.collapsePanel('bottom');
@@ -1393,7 +1393,7 @@ export class CommonFrontendContribution implements FrontendApplicationContributi
             // list.focusBackground, list.focusForeground, list.inactiveFocusBackground, list.filterMatchBorder,
             // list.dropBackground, listFilterWidget.outline, listFilterWidget.noMatchesOutline
             // list.invalidItemForeground => tree node needs an respective class
-            { id: 'list.activeSelectionBackground', defaults: { dark: '#094771', light: '#0074E8', hcLight: Color.transparent('#0F4A85', 0.1) }, description: 'List/Tree background color for the selected item when the list/tree is active. An active list/tree has keyboard focus, an inactive does not.' },
+            { id: 'list.activeSelectionBackground', defaults: { dark: '#094771', light: '#E8E8E8', hcLight: Color.transparent('#0F4A85', 0.1) }, description: 'List/Tree background color for the selected item when the list/tree is active. An active list/tree has keyboard focus, an inactive does not.' },
             { id: 'list.activeSelectionForeground', defaults: { dark: '#FFF', light: '#FFF' }, description: 'List/Tree foreground color for the selected item when the list/tree is active. An active list/tree has keyboard focus, an inactive does not.' },
             { id: 'list.inactiveSelectionBackground', defaults: { dark: '#37373D', light: '#E4E6F1', hcLight: Color.transparent('#0F4A85', 0.1) }, description: 'List/Tree background color for the selected item when the list/tree is inactive. An active list/tree has keyboard focus, an inactive does not.' },
             { id: 'list.inactiveSelectionForeground', description: 'List/Tree foreground color for the selected item when the list/tree is inactive. An active list/tree has keyboard focus, an inactive does not.' },

package/src/browser/frontend-application-module.ts

@@ -51,7 +51,7 @@ import {
     SidePanelHandler, SidePanelHandlerFactory,
     SidebarMenuWidget, SidebarTopMenuWidgetFactory,
     SplitPositionHandler, DockPanelRendererFactory, ApplicationShellLayoutMigration, ApplicationShellLayoutMigrationError, SidebarBottomMenuWidgetFactory,
-    ShellLayoutTransformer
+    ShellLayoutTransformer, WidgetAreaResolver
 } from './shell';
 import { LabelParser } from './label-parser';
 import { LabelProvider, LabelProviderContribution, DefaultUriLabelProviderContribution } from './label-provider';
@@ -146,6 +146,7 @@ import { WidgetStatusBarContribution, WidgetStatusBarService } from './widget-st
 import { SymbolIconColorContribution } from './symbol-icon-color-contribution';
 import { CorePreferences, bindCorePreferences } from '../common/core-preferences';
 import { bindBadgeDecoration } from './badges';
+import { PerspectiveContribution, PerspectiveService, PerspectiveServiceImpl, PerspectiveServiceInternal, WidgetAreaResolverImpl } from './perspective-service';
 
 export { bindResourceProvider, bindMessageService, bindPreferenceService };
 
@@ -483,6 +484,15 @@ export const frontendApplicationModule = new ContainerModule((bind, _unbind, _is
     bind(DomInputUndoRedoHandler).toSelf().inSingletonScope();
     bind(UndoRedoHandler).toService(DomInputUndoRedoHandler);
 
+    bind(WidgetAreaResolverImpl).toSelf().inSingletonScope();
+    bind(WidgetAreaResolver).toService(WidgetAreaResolverImpl);
+    bind(PerspectiveServiceImpl).toSelf().inSingletonScope();
+    bind(PerspectiveService).toService(PerspectiveServiceImpl);
+    bind(PerspectiveServiceInternal).toService(PerspectiveServiceImpl);
+    bind(FrontendApplicationContribution).toService(PerspectiveServiceImpl);
+    bind(CommandContribution).toService(PerspectiveServiceImpl);
+    bindRootContributionProvider(bind, PerspectiveContribution);
+
     bind(WidgetStatusBarService).toSelf().inSingletonScope();
     bind(FrontendApplicationContribution).toService(WidgetStatusBarService);
     bindRootContributionProvider(bind, WidgetStatusBarContribution);

package/src/browser/frontend-application.ts

@@ -237,8 +237,12 @@ export class FrontendApplication {
     protected async createDefaultLayout(): Promise<void> {
         for (const contribution of this.contributions.getContributions()) {
             if (contribution.initializeLayout) {
-                await this.measureContribution(contribution, 'initializeLayout',
-                    () => contribution.initializeLayout!(this));
+                try {
+                    await this.measureContribution(contribution, 'initializeLayout',
+                        () => contribution.initializeLayout!(this));
+                } catch (error) {
+                    this.logger.error('Could not initialize the layout of contribution', error);
+                }
             }
         }
     }
@@ -246,8 +250,12 @@ export class FrontendApplication {
     protected async fireOnDidInitializeLayout(): Promise<void> {
         for (const contribution of this.contributions.getContributions()) {
             if (contribution.onDidInitializeLayout) {
-                await this.measureContribution(contribution, 'onDidInitializeLayout',
-                    () => contribution.onDidInitializeLayout!(this));
+                try {
+                    await this.measureContribution(contribution, 'onDidInitializeLayout',
+                        () => contribution.onDidInitializeLayout!(this));
+                } catch (error) {
+                    this.logger.error('Could not notify contribution of layout initialization', error);
+                }
             }
         }
     }

package/src/browser/index.ts

@@ -55,3 +55,4 @@ export * from './markdown-rendering/markdown-renderer';
 export * from './markdown-rendering/markdown';
 export * from './markdown-rendering/markdown-link-handler';
 export * from './components';
+export * from './perspective-service';

package/src/browser/keybinding.ts

@@ -610,11 +610,10 @@ export class KeybindingRegistry {
     }
 
     registerEventListeners(win: Window): Disposable {
-        /* vvv HOTFIX begin vvv
-        *
-        * This is a hotfix against issues eclipse/theia#6459 and gitpod-io/gitpod#875 .
-        * It should be reverted after Theia was updated to the newer Monaco.
-        */
+        // IME composition tracking for the textarea-based editor input path,
+        // where compositionstart/compositionend bubble through the DOM.
+        // (For the native EditContext path, these events never reach the DOM;
+        // the keydown handler below uses additional checks for that case.)
         let inComposition = false;
         const compositionStart = () => {
             inComposition = true;
@@ -627,9 +626,15 @@ export class KeybindingRegistry {
         win.document.addEventListener('compositionend', compositionEnd);
 
         const keydown = (event: KeyboardEvent) => {
-            if (inComposition !== true) {
-                this.run(event);
+            // Skip IME-related keydowns. `inComposition` covers the textarea input path;
+            // `isComposing` and `keyCode === 229` cover the native EditContext path where
+            // composition events don't reach the DOM. The keyCode check catches keys that
+            // finalize a composition (e.g. arrow keys) where isComposing is already false.
+            // eslint-disable-next-line deprecation/deprecation
+            if (inComposition || event.isComposing || event.keyCode === 229) {
+                return;
             }
+            this.run(event);
         };
         win.document.addEventListener('keydown', keydown, true);