@theia/core 1.74.0-next.9 → 1.74.1

package/src/common/preferences/index.ts

@@ -16,6 +16,7 @@
 
 export * from './defaults-preference-provider';
 export * from './preference-language-override-service';
+export * from './session-preference-provider';
 export * from './preference-provider-impl';
 export * from './preference-provider';
 export * from './preference-schema-service';

package/src/common/preferences/preference-provider.spec.ts

@@ -34,4 +34,21 @@ describe('PreferenceProviderImpl', () => {
         );
         expect(result).deep.equals({ 'configurations': [{ 'name': 'test1', 'request': 'launch' }, { 'name': 'test2' }], 'compounds': [] });
     });
+    it('should ignore reserved keys when merging', () => {
+        const payload = JSON.parse('{"__proto__":{"injected":"yes"}}');
+        const result = PreferenceUtils.merge({ 'safe': true }, payload);
+        // A modified Object.prototype leaks onto every object, so a freshly created `{}`
+        // must not inherit the injected key and the result must stay a plain object.
+        expect(({} as Record<string, unknown>).injected).to.equal(undefined);
+        expect(Object.getPrototypeOf(result)).to.equal(Object.prototype);
+        expect(result).deep.equals({ 'safe': true });
+    });
+    it('should ignore nested reserved keys when merging', () => {
+        const payload = JSON.parse('{"parent":{"__proto__":{"injected":"yes"},"valid":"true"}}');
+        const result = PreferenceUtils.merge({ 'parent': { 'existing': true } }, payload);
+        // The nested reserved key is dropped while the sibling `valid` is still merged, and a
+        // freshly created `{}` must not inherit the injected key.
+        expect(({} as Record<string, unknown>).injected).to.equal(undefined);
+        expect(result).deep.equals({ 'parent': { 'existing': true, 'valid': 'true' } });
+    });
 });

package/src/common/preferences/preference-provider.ts

@@ -133,6 +133,23 @@ export interface PreferenceProvider extends Disposable {
 }
 
 export namespace PreferenceUtils {
+    const RESERVED_MERGE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
+    /**
+     * Recursively merges the values of `target` into `source` and returns the merged result.
+     *
+     * Note the direction: `source` is the accumulator that is mutated and returned, while the
+     * values of `target` take precedence for conflicting primitive values. Nested objects are
+     * merged recursively and arrays are concatenated (`source` entries first, then `target`).
+     * If `source` is not a JSON object, a deep copy of `target` is returned instead.
+     *
+     * Only own properties are considered and reserved keys are ignored, so merged results are
+     * always plain data objects.
+     *
+     * @param source the accumulator to merge into; mutated and returned unless it is not an object
+     * @param target the values that are merged into `source` and take precedence on conflicts
+     * @returns the merged result (the mutated `source`, or a deep copy of `target`)
+     */
     export function merge(source: JSONValue | undefined, target: JSONValue): JSONValue {
         if (source === undefined || !JSONExt.isObject(source)) {
             return JSONExt.deepCopy(target);
@@ -141,7 +158,11 @@ export namespace PreferenceUtils {
             return {};
         }
         for (const [key, value] of Object.entries(target)) {
-            if (key in source) {
+            if (RESERVED_MERGE_KEYS.has(key)) {
+                // Skip reserved object keys so merged results stay plain data objects.
+                continue;
+            }
+            if (Object.prototype.hasOwnProperty.call(source, key)) {
                 const sourceValue = source[key];
                 if (JSONExt.isObject(sourceValue) && JSONExt.isObject(value)) {
                     merge(sourceValue, value);

package/src/common/preferences/preference-scope.spec.ts

@@ -20,11 +20,11 @@ import { PreferenceScope } from './preference-scope';
 describe('PreferenceScope', () => {
 
     it('getScopes() should return numbers from broadest to narrowest', () => {
-        expect(PreferenceScope.getScopes()).deep.equal([0, 1, 2, 3]);
+        expect(PreferenceScope.getScopes()).deep.equal([0, 1, 2, 3, 4]);
     });
 
     it('getReversedScopes() should return numbers from narrowest to broadest', () => {
-        expect(PreferenceScope.getReversedScopes()).deep.equal([3, 2, 1, 0]);
+        expect(PreferenceScope.getReversedScopes()).deep.equal([4, 3, 2, 1, 0]);
     });
 
     it('getScopeNames() should return the names of scopes broader than the current one', () => {
@@ -36,11 +36,13 @@ describe('PreferenceScope', () => {
         expect(PreferenceScope.is(PreferenceScope.User)).to.be.true;
         expect(PreferenceScope.is(PreferenceScope.Workspace)).to.be.true;
         expect(PreferenceScope.is(PreferenceScope.Folder)).to.be.true;
+        expect(PreferenceScope.is(PreferenceScope.Session)).to.be.true;
         expect(PreferenceScope.is(0)).to.be.true;
         expect(PreferenceScope.is(1)).to.be.true;
         expect(PreferenceScope.is(2)).to.be.true;
         expect(PreferenceScope.is(3)).to.be.true;
-        expect(PreferenceScope.is(4)).to.be.false;
+        expect(PreferenceScope.is(4)).to.be.true;
+        expect(PreferenceScope.is(5)).to.be.false;
         expect(PreferenceScope.is(-1)).to.be.false;
         expect(PreferenceScope.is({})).to.be.false;
         expect(PreferenceScope.is('Default')).to.be.false;

package/src/common/preferences/preference-scope.ts

@@ -23,7 +23,12 @@ export enum PreferenceScope {
     Default,
     User,
     Workspace,
-    Folder
+    Folder,
+    /**
+     * Process-lifetime, in-memory scope used by `--session-preference` CLI overrides.
+     * Has the highest precedence and is never persisted to disk.
+     */
+    Session
 }
 
 export namespace PreferenceScope {

package/src/common/preferences/preference-service.ts

@@ -254,6 +254,10 @@ export interface PreferenceInspection<T = JSONValue> {
      * Value in folder scope.
      */
     workspaceFolderValue: T | undefined,
+    /**
+     * Value in session scope (in-memory, set via `--session-preference`).
+     */
+    sessionValue?: T | undefined,
     /**
      * The value that is active, i.e. the value set in the lowest scope available.
      */
@@ -453,11 +457,37 @@ export class PreferenceServiceImpl implements PreferenceService {
         }
         const provider = this.getProvider(resolvedScope);
         if (provider && await provider.setPreference(preferenceName, value, resourceUri)) {
+            await this.evictSessionOverride(preferenceName, resolvedScope);
             return;
         }
         throw new Error(`Unable to write to ${PreferenceScope[resolvedScope]} Settings.`);
     }
 
+    /**
+     * When a preference is written to a persistent scope, drop any in-memory session
+     * override (set via `--session-preference`) for the same key so that the explicit
+     * change takes effect for the remainder of the session. Without this, the session
+     * scope would keep shadowing the user's change because it has higher precedence.
+     *
+     * Note: this fires for any write to a persistent scope, including programmatic
+     * writes from extensions. Extensions that race with startup CLI overrides will
+     * therefore clear them. This is intentional: a programmatic write is "explicit"
+     * from the preference system's point of view, but consumers should be aware.
+     *
+     * Session preferences are global (no per-resource scoping), so `resourceUri` is
+     * not threaded through.
+     */
+    protected async evictSessionOverride(preferenceName: string, writtenScope: PreferenceScope): Promise<void> {
+        if (writtenScope === PreferenceScope.Session || writtenScope === PreferenceScope.Default) {
+            return;
+        }
+        const sessionProvider = this.getProvider(PreferenceScope.Session);
+        if (sessionProvider && sessionProvider.get(preferenceName) !== undefined) {
+            // Passing `undefined` clears the value in the session provider.
+            await sessionProvider.setPreference(preferenceName, undefined as unknown as JSONValue);
+        }
+    }
+
     getBoolean(preferenceName: string): boolean | undefined;
     getBoolean(preferenceName: string, defaultValue: boolean): boolean;
     getBoolean(preferenceName: string, defaultValue: boolean, resourceUri: string): boolean;
@@ -499,10 +529,11 @@ export class PreferenceServiceImpl implements PreferenceService {
         const globalValue = this.inspectInScope<T>(preferenceName, PreferenceScope.User, resourceUri, forceLanguageOverride);
         const workspaceValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Workspace, resourceUri, forceLanguageOverride);
         const workspaceFolderValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Folder, resourceUri, forceLanguageOverride);
+        const sessionValue = this.inspectInScope<T>(preferenceName, PreferenceScope.Session, resourceUri, forceLanguageOverride);
 
-        const valueApplied = workspaceFolderValue ?? workspaceValue ?? globalValue ?? defaultValue;
+        const valueApplied = sessionValue ?? workspaceFolderValue ?? workspaceValue ?? globalValue ?? defaultValue;
 
-        return { preferenceName, defaultValue, globalValue, workspaceValue, workspaceFolderValue, value: valueApplied };
+        return { preferenceName, defaultValue, globalValue, workspaceValue, workspaceFolderValue, sessionValue, value: valueApplied };
     }
 
     inspectInScope<T extends JSONValue>(preferenceName: string, scope: PreferenceScope, resourceUri?: string, forceLanguageOverride?: boolean): T | undefined {
@@ -526,6 +557,8 @@ export class PreferenceServiceImpl implements PreferenceService {
                 return inspection.workspaceValue;
             case PreferenceScope.Folder:
                 return inspection.workspaceFolderValue;
+            case PreferenceScope.Session:
+                return inspection.sessionValue;
         }
         unreachable(scope, 'Not all PreferenceScope enum variants handled.');
     }
@@ -551,9 +584,10 @@ export class PreferenceServiceImpl implements PreferenceService {
         }
 
         // Scopes in ascending order of scope breadth.
-        const allScopes = [...this.schemaService.validScopes].reverse();
-        // Get rid of Default scope. We can't set anything there.
-        allScopes.pop();
+        const allScopes = [...this.schemaService.validScopes].reverse()
+            // Default is read-only, and Session is populated only by `--session-preference`,
+            // so neither is a valid target for a regular user edit.
+            .filter(scope => scope !== PreferenceScope.Default && scope !== PreferenceScope.Session);
 
         const isScopeDefined = (scope: PreferenceScope) => this.getScopedValueFromInspection(inspection, scope) !== undefined;
 

package/src/common/preferences/session-preference-provider.spec.ts

@@ -0,0 +1,78 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { SessionPreferenceProvider } from './session-preference-provider';
+import { PreferenceScope } from './preference-scope';
+
+describe('SessionPreferenceProvider', () => {
+
+    let provider: SessionPreferenceProvider;
+
+    beforeEach(() => {
+        provider = new SessionPreferenceProvider();
+        // PostConstruct emulation
+        (provider as unknown as { init(): void }).init();
+    });
+
+    it('claims only the Session scope', () => {
+        expect(provider.canHandleScope(PreferenceScope.Session)).to.be.true;
+        expect(provider.canHandleScope(PreferenceScope.User)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Workspace)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Folder)).to.be.false;
+        expect(provider.canHandleScope(PreferenceScope.Default)).to.be.false;
+    });
+
+    it('starts empty', () => {
+        expect(provider.getPreferences()).to.deep.equal({});
+    });
+
+    it('stores set values in memory and exposes them via get/resolve', async () => {
+        const ok = await provider.setPreference('editor.fontSize', 18);
+        expect(ok).to.be.true;
+        expect(provider.get('editor.fontSize')).to.equal(18);
+        expect(provider.resolve('editor.fontSize').value).to.equal(18);
+        expect(provider.getPreferences()).to.deep.equal({ 'editor.fontSize': 18 });
+    });
+
+    it('emits a change event on set', async () => {
+        let received: { name: string; newValue: unknown; oldValue: unknown; scope: PreferenceScope } | undefined;
+        provider.onDidPreferencesChanged(changes => {
+            const key = Object.keys(changes)[0];
+            received = {
+                name: changes[key].preferenceName,
+                newValue: changes[key].newValue,
+                oldValue: changes[key].oldValue,
+                scope: changes[key].scope
+            };
+        });
+        await provider.setPreference('foo', 'bar');
+        expect(received).to.deep.equal({ name: 'foo', newValue: 'bar', oldValue: undefined, scope: PreferenceScope.Session });
+    });
+
+    it('removes a value when set to undefined', async () => {
+        await provider.setPreference('foo', 'bar');
+        const removed = await provider.setPreference('foo', undefined as never);
+        expect(removed).to.be.true;
+        expect(provider.get('foo')).to.equal(undefined);
+        expect(provider.getPreferences()).to.deep.equal({});
+    });
+
+    it('returns false when removing a key that was never set', async () => {
+        const removed = await provider.setPreference('missing', undefined as never);
+        expect(removed).to.be.false;
+    });
+});

package/src/common/preferences/session-preference-provider.ts

@@ -0,0 +1,69 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { JSONObject, JSONValue } from '@lumino/coreutils';
+import { injectable, postConstruct } from 'inversify';
+import { PreferenceProvider, PreferenceProviderDataChange } from './preference-provider';
+import { PreferenceProviderImpl } from './preference-provider-impl';
+import { PreferenceScope } from './preference-scope';
+
+/**
+ * In-memory preference provider used for process-lifetime overrides such as those
+ * supplied via the `--session-preference` CLI option. Values live in memory only
+ * and are dropped when the process exits.
+ */
+@injectable()
+export class SessionPreferenceProvider extends PreferenceProviderImpl implements PreferenceProvider {
+
+    protected readonly preferences = new Map<string, JSONValue>();
+
+    @postConstruct()
+    protected init(): void {
+        this._ready.resolve();
+    }
+
+    override canHandleScope(scope: PreferenceScope): boolean {
+        return scope === PreferenceScope.Session;
+    }
+
+    getPreferences(): JSONObject {
+        const result: JSONObject = {};
+        for (const [name, value] of this.preferences) {
+            result[name] = value;
+        }
+        return result;
+    }
+
+    async setPreference(key: string, value: JSONValue | undefined): Promise<boolean> {
+        const oldValue = this.preferences.get(key);
+        if (value === undefined) {
+            if (!this.preferences.has(key)) {
+                return false;
+            }
+            this.preferences.delete(key);
+        } else {
+            this.preferences.set(key, value);
+        }
+        const change: PreferenceProviderDataChange = {
+            preferenceName: key,
+            newValue: value,
+            oldValue,
+            scope: PreferenceScope.Session
+        };
+        await this.emitPreferencesChangedEvent([change]);
+        return true;
+    }
+}

package/src/electron-browser/electron-clipboard-service.ts

@@ -16,17 +16,22 @@
 
 // eslint-disable-next-line import/no-extraneous-dependencies
 import { injectable } from 'inversify';
+import { Emitter, Event } from '../common/event';
 import { ClipboardService } from '../browser/clipboard-service';
 
 @injectable()
 export class ElectronClipboardService implements ClipboardService {
 
+    protected readonly onDidWriteTextEmitter = new Emitter<string>();
+    readonly onDidWriteText: Event<string> = this.onDidWriteTextEmitter.event;
+
     readText(): string {
         return window.electronTheiaCore.readClipboard();
     }
 
     writeText(value: string): void {
         window.electronTheiaCore.writeClipboard(value);
+        this.onDidWriteTextEmitter.fire(value);
     }
 
 }

package/src/electron-browser/menu/electron-menu-contribution.ts

@@ -139,7 +139,7 @@ export class ElectronMenuContribution extends BrowserMenuBarContribution impleme
         const disposeHandler = window.electronTheiaCore.onWindowEvent('focus', () => {
             this.setMenu(app);
         });
-        window.addEventListener('unload', () => disposeHandler.dispose());
+        window.addEventListener('pagehide', () => disposeHandler.dispose());
     }
 
     protected attachMenuBarVisibilityListener(): void {

package/src/electron-browser/menu/electron-menu-style.css

@@ -60,7 +60,9 @@
   position: absolute;
   top: 0;
   right: 0;
-  height: 100%;
+  height: var(--theia-private-menubar-height, 32px);
+  z-index: var(--theia-menu-z-index);
+  background: var(--theia-titleBar-activeBackground);
 }
 
 #window-controls .control-button {

package/src/electron-browser/preload.ts

@@ -27,7 +27,8 @@ import {
     CHANNEL_REQUEST_RELOAD, CHANNEL_APP_STATE_CHANGED, CHANNEL_SHOW_ITEM_IN_FOLDER, CHANNEL_READ_CLIPBOARD, CHANNEL_WRITE_CLIPBOARD,
     CHANNEL_KEYBOARD_LAYOUT_CHANGED, CHANNEL_IPC_CONNECTION, InternalMenuDto, CHANNEL_REQUEST_SECONDARY_CLOSE, CHANNEL_SET_BACKGROUND_COLOR,
     CHANNEL_WC_METADATA, CHANNEL_ABOUT_TO_CLOSE, CHANNEL_OPEN_WITH_SYSTEM_APP,
-    CHANNEL_OPEN_URL, CHANNEL_SET_THEME, CHANNEL_OPEN_DEVTOOLS_FOR_WINDOW
+    CHANNEL_OPEN_URL, CHANNEL_SET_THEME, CHANNEL_OPEN_DEVTOOLS_FOR_WINDOW,
+    CHANNEL_UPDATE_RECENT_WORKSPACES
 } from '../electron-common/electron-api';
 
 // eslint-disable-next-line import/no-extraneous-dependencies
@@ -246,7 +247,9 @@ const api: TheiaCoreAPI = {
     sendData: data => {
         ipcRenderer.send(CHANNEL_IPC_CONNECTION, data);
     },
-    useNativeElements: !('THEIA_ELECTRON_DISABLE_NATIVE_ELEMENTS' in process.env && process.env.THEIA_ELECTRON_DISABLE_NATIVE_ELEMENTS === '1')
+    useNativeElements: !('THEIA_ELECTRON_DISABLE_NATIVE_ELEMENTS' in process.env && process.env.THEIA_ELECTRON_DISABLE_NATIVE_ELEMENTS === '1'),
+
+    updateRecentWorkspaces: (workspaceUris: string[], categoryName: string): void => { ipcRenderer.send(CHANNEL_UPDATE_RECENT_WORKSPACES, workspaceUris, categoryName); }
 };
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/src/electron-browser/window/electron-secondary-window-service.ts

@@ -61,7 +61,7 @@ export class ElectronSecondaryWindowService extends DefaultSecondaryWindowServic
             for (let i = this.secondaryWindows.length - 1; i >= 0; i--) {
                 const windowClosed = new Deferred<void>();
                 const win = this.secondaryWindows[i];
-                win.addEventListener('unload', () => {
+                win.addEventListener('pagehide', () => {
                     windowClosed.resolve();
                 });
                 promises.push(windowClosed.promise);

package/src/electron-browser/window/electron-window-service.ts

@@ -89,9 +89,9 @@ export class ElectronWindowService extends DefaultWindowService {
             }
             return willShutDown;
         });
-        window.addEventListener('unload', () => {
-            this.onUnloadEmitter.fire();
-        });
+        // Intentionally not calling `super`: in Electron the close request handler above takes the role of
+        // `beforeunload`, and there is no back/forward cache, so only the `pagehide` listener is shared.
+        this.registerPageHideListener();
     }
 
     /**

package/src/electron-common/electron-api.ts

@@ -104,6 +104,8 @@ export interface TheiaCoreAPI {
     sendData(data: Uint8Array): void;
     onData(handler: (data: Uint8Array) => void): Disposable;
     useNativeElements: boolean;
+
+    updateRecentWorkspaces(workspaceUris: string[], categoryName: string): void;
 }
 
 declare global {
@@ -162,3 +164,5 @@ export const CHANNEL_WRITE_CLIPBOARD = 'WriteClipboard';
 
 export const CHANNEL_KEYBOARD_LAYOUT_CHANGED = 'KeyboardLayoutChanged';
 export const CHANNEL_IPC_CONNECTION = 'IpcConnection';
+
+export const CHANNEL_UPDATE_RECENT_WORKSPACES = 'UpdateRecentWorkspaces';

package/src/electron-main/electron-api-main.ts

@@ -15,7 +15,8 @@
 // *****************************************************************************
 
 import {
-    ipcMain, BrowserWindow, Menu, MenuItemConstructorOptions, webContents, WebContents, session, shell, clipboard, IpcMainEvent
+    ipcMain, BrowserWindow, Menu, MenuItemConstructorOptions, webContents, WebContents, session, shell, clipboard, IpcMainEvent,
+    app, JumpListCategory, JumpListItem
 } from '@theia/electron/shared/electron';
 import * as nativeKeymap from '@theia/electron/shared/native-keymap';
 
@@ -57,11 +58,14 @@ import {
     CHANNEL_OPEN_WITH_SYSTEM_APP,
     CHANNEL_OPEN_URL,
     CHANNEL_SET_THEME,
-    CHANNEL_OPEN_DEVTOOLS_FOR_WINDOW
+    CHANNEL_OPEN_DEVTOOLS_FOR_WINDOW,
+    CHANNEL_UPDATE_RECENT_WORKSPACES
 } from '../electron-common/electron-api';
 import { ElectronMainApplication, ElectronMainApplicationContribution } from './electron-main-application';
-import { Disposable, DisposableCollection, isOSX, MaybePromise } from '../common';
+import { Disposable, DisposableCollection, isOSX, isWindows, MaybePromise, URI } from '../common';
+import { FileUri } from '../node';
 import { createDisposableListener } from './event-utils';
+import * as path from 'node:path';
 
 @injectable()
 export class TheiaMainApi implements ElectronMainApplicationContribution {
@@ -265,6 +269,55 @@ export class TheiaMainApi implements ElectronMainApplicationContribution {
                 webContent.send('keyboardLayoutChanged', newLayout);
             }
         });
+
+        ipcMain.on(CHANNEL_UPDATE_RECENT_WORKSPACES, (_event, workspaces: string[], categoryName: string) => {
+            if (!isWindows) {
+                return;
+            }
+
+            const jumpListSettings = app.getJumpListSettings();
+            const isDev = !app.isPackaged;
+            const appPath = app.getAppPath();
+
+            const items: JumpListItem[] = workspaces
+                .filter(w => new URI(w).scheme === 'file')
+                .map(workspace => {
+                    const uri = new URI(workspace);
+                    const wspathPretty = uri.path.fsPath();
+                    const wspath = FileUri.fsPath(uri);
+                    const item: JumpListItem = {
+                        type: 'task',
+                        // Windows is picky about the length of some attributes. See: https://github.com/microsoft/vscode/issues/111177#issuecomment-739942612
+                        title: uri.path.base.substring(0, 255),
+                        description: wspathPretty.substring(0, 255),
+                        program: process.execPath,
+                        args: isDev ? `"${path.resolve(appPath, 'theia-electron-main.js')}" "${wspath}"` : `"${wspath}"`,
+                        iconPath: process.execPath,
+                        iconIndex: 0
+                    };
+
+                    // We need to remove items that the user has explicitly removed from the jump list. Otherwise
+                    // Windows will not show our custom category at all.
+                    if (jumpListSettings.removedItems.some(removedItem => removedItem.args === item.args)) {
+                        return undefined;
+                    }
+
+                    return item;
+                })
+                .filter(item => !!item);
+
+            const jumpList: JumpListCategory[] = [{
+                type: 'custom',
+                name: categoryName || 'Recent Workspaces',
+                items
+            }];
+
+            const result = app.setJumpList(jumpList);
+
+            if (result !== 'ok') {
+                console.warn(`Could not set Jump List with recent workspaces (result = "${result}")`);
+            }
+        });
     }
 
     private isASCI(accelerator: string | undefined): boolean {

package/src/electron-main/electron-main-application.ts

@@ -238,6 +238,9 @@ export class ElectronMainApplication {
                     const startupMeasurement = this.stopwatch.start('electron-main-startup');
                     this.useNativeWindowFrame = this.getTitleBarStyle(config) === 'native';
                     this._config = config;
+                    if (isWindows && !!config.electron.appUserModelId) {
+                        app.setAppUserModelId(config.electron.appUserModelId);
+                    }
                     this.hookApplicationEvents();
                     this.showInitialWindow(argv.includes('--open-url') ? argv[argv.length - 1] : undefined);
                     const port = await this.stopwatch.startAsync('electron-main-start-backend', 'Starting backend', () => this.startBackend());

package/src/electron-node/hosting/electron-backend-hosting-module.spec.ts

@@ -0,0 +1,42 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { Container } from 'inversify';
+import electronBackendHostingModule from './electron-backend-hosting-module';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
+
+describe('electron-backend-hosting-module', () => {
+
+    it('should bind a no-op HttpConnectionValidator that calls next() unconditionally', () => {
+        const container = new Container();
+        container.load(electronBackendHostingModule);
+        const validator = container.get<HttpConnectionValidator>(HttpConnectionValidator);
+
+        let nextCalled = false;
+        let sentStatus: number | undefined;
+        // No cookie provided: the no-op validator must still call next() and never send a status.
+        const req = { headers: {} as Record<string, string | undefined> };
+        const res = { sendStatus: (status: number) => { sentStatus = status; } };
+        const next = (): void => { nextCalled = true; };
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator.validateRequest(req as any, res as any, next as any);
+
+        expect(nextCalled).to.be.true;
+        expect(sentStatus).to.be.undefined;
+    });
+});

package/src/electron-node/hosting/electron-backend-hosting-module.ts

@@ -16,9 +16,17 @@
 
 import { ContainerModule } from 'inversify';
 import { WsRequestValidatorContribution } from '../../node/ws-request-validators';
+import { HttpConnectionValidator } from '../../node/hosting/browser-connection-token';
 import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(ElectronWsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(ElectronWsOriginValidator);
+
+    // Electron uses its own `ElectronSecurityToken`, so the connection-token cookie is not used.
+    // Bind a no-op validator so consumers can inject it uniformly.
+    const noopValidator: HttpConnectionValidator = {
+        validateRequest: (_req, _res, next) => next()
+    };
+    bind(HttpConnectionValidator).toConstantValue(noopValidator);
 });

package/src/node/hosting/backend-hosting-module.ts

@@ -19,7 +19,7 @@ import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
 import {
-    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, HttpConnectionValidator, createBrowserConnectionToken
 } from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
@@ -28,9 +28,12 @@ export default new ContainerModule(bind => {
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
 
-    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    // Cookie-based connection token. It is validated on WebSocket upgrades and bootstrapped
+    // (set as a cookie) on every HTTP request; HTTP enforcement is opt-in per route via
+    // `HttpConnectionValidator`.
     bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
     bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
     bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
     bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(HttpConnectionValidator).toService(BrowserConnectionTokenBackendContribution);
 });