@theia/plugin-ext 1.70.0-next.34 → 1.70.0-next.43

package/src/hosted/common/hosted-plugin.spec.ts

@@ -0,0 +1,377 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { Disposable, DisposableCollection } from '@theia/core/lib/common/disposable';
+import { DeployedPlugin, PluginIdentifiers } from '../../common/plugin-protocol';
+import { AbstractHostedPluginSupport, PluginContributions } from './hosted-plugin';
+import { Measurement } from '@theia/core/lib/common/performance/measurement';
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+function createMockDeployedPlugin(id: string, untrustedWorkspacesSupport?: boolean | 'limited'): DeployedPlugin {
+    return {
+        metadata: {
+            host: 'main',
+            model: {
+                id,
+                name: id.split('.')[1] || id,
+                publisher: id.split('.')[0] || 'test',
+                version: '1.0.0',
+                displayName: id,
+                description: '',
+                engine: { type: 'theiaPlugin' as any, version: '1.0.0' },
+                entryPoint: { backend: 'main.js' },
+                packageUri: '',
+                packagePath: '',
+                untrustedWorkspacesSupport
+            },
+            lifecycle: { startMethod: 'activate', stopMethod: 'deactivate' } as any,
+            outOfSync: false
+        }
+    };
+}
+
+function createNoopMeasurement(): Measurement {
+    return {
+        stop: () => 0,
+        name: 'test',
+        log: () => { },
+        debug: () => { },
+        info: () => { },
+        warn: () => { },
+        error: () => { }
+    };
+}
+
+/**
+ * Minimal concrete subclass of AbstractHostedPluginSupport for testing.
+ * Overrides all abstract methods with no-ops/stubs.
+ */
+class TestHostedPluginSupport extends AbstractHostedPluginSupport<any, any> {
+    constructor() {
+        super('test-client');
+    }
+
+    protected createTheiaReadyPromise(): Promise<unknown> {
+        return Promise.resolve();
+    }
+
+    protected acceptPlugin(_plugin: DeployedPlugin): boolean | DeployedPlugin {
+        return true;
+    }
+
+    protected handleContributions(_plugin: DeployedPlugin): Disposable {
+        return Disposable.NULL;
+    }
+
+    protected async obtainManager(
+        _host: string, _hostContributions: PluginContributions[],
+        _toDisconnect: DisposableCollection
+    ): Promise<undefined> {
+        return undefined;
+    }
+
+    protected async getStoragePath(): Promise<string | undefined> {
+        return undefined;
+    }
+
+    protected async getHostGlobalStoragePath(): Promise<string> {
+        return '';
+    }
+
+    protected override measure(_name: string): Measurement {
+        return createNoopMeasurement();
+    }
+
+    /**
+     * Populate the contributions map with mock deployed plugins in the given state.
+     */
+    addPlugin(plugin: DeployedPlugin, state = PluginContributions.State.INITIALIZING): void {
+        const pluginId = PluginIdentifiers.componentsToUnversionedId(plugin.metadata.model);
+        const contributions = new PluginContributions(plugin);
+        contributions.state = state;
+        this.contributions.set(pluginId, contributions);
+    }
+
+    /**
+     * Expose the protected loadContributions for testing.
+     */
+    testLoadContributions(): Map<string, PluginContributions[]> {
+        const toDisconnect = new DisposableCollection(Disposable.create(() => { }));
+        return this.loadContributions(toDisconnect);
+    }
+
+    setWorkspaceTrusted(trusted: boolean): void {
+        this.workspaceTrusted = trusted;
+    }
+
+    clearDisabledByTrust(): void {
+        this._disabledByTrust.clear();
+    }
+
+    simulateLoadCycle(): Map<string, PluginContributions[]> {
+        this._disabledByTrust.clear();
+        const result = this.testLoadContributions();
+        if (this._disabledByTrust.size > 0) {
+            this.onDidChangePluginsEmitter.fire(undefined);
+        }
+        return result;
+    }
+}
+
+describe('AbstractHostedPluginSupport - workspace trust filtering', () => {
+    let support: TestHostedPluginSupport;
+
+    beforeEach(() => {
+        support = new TestHostedPluginSupport();
+    });
+
+    it('should skip plugin with untrustedWorkspacesSupport: false when workspace is untrusted', () => {
+        support.setWorkspaceTrusted(false);
+        const plugin = createMockDeployedPlugin('test.untrusted-false', false);
+        support.addPlugin(plugin);
+
+        const result = support.testLoadContributions();
+
+        // Plugin should not be in the returned host contributions
+        let pluginFound = false;
+        for (const contributions of result.values()) {
+            for (const c of contributions) {
+                if (c.plugin.metadata.model.id === 'test.untrusted-false') {
+                    pluginFound = true;
+                }
+            }
+        }
+        expect(pluginFound).to.equal(false);
+        expect(support.disabledByTrust.has('test.untrusted-false')).to.equal(true);
+    });
+
+    it('should load plugin with untrustedWorkspacesSupport: true when workspace is untrusted', () => {
+        support.setWorkspaceTrusted(false);
+        const plugin = createMockDeployedPlugin('test.untrusted-true', true);
+        support.addPlugin(plugin);
+
+        const result = support.testLoadContributions();
+
+        let pluginFound = false;
+        for (const contributions of result.values()) {
+            for (const c of contributions) {
+                if (c.plugin.metadata.model.id === 'test.untrusted-true') {
+                    pluginFound = true;
+                }
+            }
+        }
+        expect(pluginFound).to.equal(true);
+        expect(support.disabledByTrust.has('test.untrusted-true')).to.equal(false);
+    });
+
+    it('should load plugin with untrustedWorkspacesSupport: "limited" when workspace is untrusted', () => {
+        support.setWorkspaceTrusted(false);
+        const plugin = createMockDeployedPlugin('test.untrusted-limited', 'limited');
+        support.addPlugin(plugin);
+
+        const result = support.testLoadContributions();
+
+        let pluginFound = false;
+        for (const contributions of result.values()) {
+            for (const c of contributions) {
+                if (c.plugin.metadata.model.id === 'test.untrusted-limited') {
+                    pluginFound = true;
+                }
+            }
+        }
+        expect(pluginFound).to.equal(true);
+        expect(support.disabledByTrust.has('test.untrusted-limited')).to.equal(false);
+    });
+
+    it('should load plugin with untrustedWorkspacesSupport: undefined when workspace is untrusted', () => {
+        support.setWorkspaceTrusted(false);
+        const plugin = createMockDeployedPlugin('test.untrusted-undefined', undefined);
+        support.addPlugin(plugin);
+
+        const result = support.testLoadContributions();
+
+        let pluginFound = false;
+        for (const contributions of result.values()) {
+            for (const c of contributions) {
+                if (c.plugin.metadata.model.id === 'test.untrusted-undefined') {
+                    pluginFound = true;
+                }
+            }
+        }
+        expect(pluginFound).to.equal(true);
+        expect(support.disabledByTrust.has('test.untrusted-undefined')).to.equal(false);
+    });
+
+    it('should load plugin with untrustedWorkspacesSupport: false when workspace is trusted', () => {
+        support.setWorkspaceTrusted(true);
+        const plugin = createMockDeployedPlugin('test.trusted-false', false);
+        support.addPlugin(plugin);
+
+        const result = support.testLoadContributions();
+
+        let pluginFound = false;
+        for (const contributions of result.values()) {
+            for (const c of contributions) {
+                if (c.plugin.metadata.model.id === 'test.trusted-false') {
+                    pluginFound = true;
+                }
+            }
+        }
+        expect(pluginFound).to.equal(true);
+        expect(support.disabledByTrust.has('test.trusted-false')).to.equal(false);
+    });
+
+    it('should clear disabledByTrust when workspace becomes trusted on re-load', () => {
+        // First load: untrusted workspace, plugin should be disabled
+        support.setWorkspaceTrusted(false);
+        const plugin = createMockDeployedPlugin('test.reload-trust', false);
+        support.addPlugin(plugin);
+
+        support.testLoadContributions();
+        expect(support.disabledByTrust.has('test.reload-trust')).to.equal(true);
+        expect(support.disabledByTrust.size).to.equal(1);
+
+        // Second load: simulate doLoad() which clears disabledByTrust before loadContributions
+        support.setWorkspaceTrusted(true);
+        support.clearDisabledByTrust();
+        support.testLoadContributions();
+        expect(support.disabledByTrust.size).to.equal(0);
+    });
+
+    it('should correctly populate disabledByTrust with only filtered plugins', () => {
+        support.setWorkspaceTrusted(false);
+        const blockedPlugin = createMockDeployedPlugin('test.blocked', false);
+        const allowedPlugin = createMockDeployedPlugin('test.allowed', true);
+        support.addPlugin(blockedPlugin);
+        support.addPlugin(allowedPlugin);
+
+        support.testLoadContributions();
+
+        expect(support.disabledByTrust.size).to.equal(1);
+        expect(support.disabledByTrust.has('test.blocked')).to.equal(true);
+        expect(support.disabledByTrust.has('test.allowed')).to.equal(false);
+    });
+
+    describe('plugins deployed after initial load (re-load cycle)', () => {
+        it('should disable a newly deployed plugin with untrustedWorkspacesSupport: false on re-load', () => {
+            support.setWorkspaceTrusted(false);
+
+            const initialPlugin = createMockDeployedPlugin('test.initial', false);
+            support.addPlugin(initialPlugin);
+            support.simulateLoadCycle();
+            expect(support.disabledByTrust.has('test.initial')).to.equal(true);
+
+            const newPlugin = createMockDeployedPlugin('test.new-deploy', false);
+            support.addPlugin(newPlugin);
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.has('test.initial')).to.equal(true);
+            expect(support.disabledByTrust.has('test.new-deploy')).to.equal(true);
+            expect(support.disabledByTrust.size).to.equal(2);
+        });
+
+        it('should re-add previously disabled plugins to disabledByTrust on each re-load cycle', () => {
+            support.setWorkspaceTrusted(false);
+            const plugin = createMockDeployedPlugin('test.persistent', false);
+            support.addPlugin(plugin);
+
+            support.simulateLoadCycle();
+            expect(support.disabledByTrust.has('test.persistent')).to.equal(true);
+
+            support.simulateLoadCycle();
+            expect(support.disabledByTrust.has('test.persistent')).to.equal(true);
+
+            support.simulateLoadCycle();
+            expect(support.disabledByTrust.has('test.persistent')).to.equal(true);
+        });
+
+        it('should not add already-started allowed plugins to disabledByTrust on re-load', () => {
+            support.setWorkspaceTrusted(false);
+            const startedAllowed = createMockDeployedPlugin('test.started-allowed', true);
+            support.addPlugin(startedAllowed, PluginContributions.State.STARTED);
+            const startedUndefined = createMockDeployedPlugin('test.started-undefined', undefined);
+            support.addPlugin(startedUndefined, PluginContributions.State.STARTED);
+
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.has('test.started-allowed')).to.equal(false);
+            expect(support.disabledByTrust.has('test.started-undefined')).to.equal(false);
+            expect(support.disabledByTrust.size).to.equal(0);
+        });
+
+        it('should add already-started plugins with untrustedWorkspacesSupport: false to disabledByTrust on re-load', () => {
+            support.setWorkspaceTrusted(false);
+            const startedBlocked = createMockDeployedPlugin('test.started-blocked', false);
+            support.addPlugin(startedBlocked, PluginContributions.State.STARTED);
+
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.has('test.started-blocked')).to.equal(true);
+        });
+
+        it('should fire onDidChangePlugins after loadContributions when a newly deployed plugin is disabled by trust', () => {
+            support.setWorkspaceTrusted(false);
+            const existingPlugin = createMockDeployedPlugin('test.existing', false);
+            support.addPlugin(existingPlugin);
+            support.simulateLoadCycle();
+
+            const newPlugin = createMockDeployedPlugin('test.late-deploy', false);
+            support.addPlugin(newPlugin);
+
+            let eventFiredCount = 0;
+            support.onDidChangePlugins(() => { eventFiredCount++; });
+
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.has('test.late-deploy')).to.equal(true);
+            expect(eventFiredCount).to.equal(1);
+        });
+
+        it('should not fire onDidChangePlugins when no plugins are disabled by trust', () => {
+            support.setWorkspaceTrusted(false);
+            const allowedPlugin = createMockDeployedPlugin('test.allowed-nodeploy', true);
+            support.addPlugin(allowedPlugin);
+
+            let eventFiredCount = 0;
+            support.onDidChangePlugins(() => { eventFiredCount++; });
+
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.size).to.equal(0);
+            expect(eventFiredCount).to.equal(0);
+        });
+
+        it('should include both initial and newly deployed disabled plugins in disabledByTrust when workspace is untrusted', () => {
+            support.setWorkspaceTrusted(false);
+
+            const builtin = createMockDeployedPlugin('test.builtin', false);
+            support.addPlugin(builtin);
+            support.simulateLoadCycle();
+            expect(support.disabledByTrust.size).to.equal(1);
+
+            const userInstalled = createMockDeployedPlugin('test.user-installed', false);
+            support.addPlugin(userInstalled);
+            support.simulateLoadCycle();
+
+            expect(support.disabledByTrust.size).to.equal(2);
+            expect(support.disabledByTrust.has('test.builtin')).to.equal(true);
+            expect(support.disabledByTrust.has('test.user-installed')).to.equal(true);
+        });
+    });
+
+});

package/src/hosted/common/hosted-plugin.ts

@@ -84,6 +84,14 @@ export abstract class AbstractHostedPluginSupport<PM extends AbstractPluginManag
 
     protected readonly activationEvents = new Set<string>();
 
+    protected workspaceTrusted: boolean = false;
+
+    protected readonly _disabledByTrust = new Set<string>();
+
+    get disabledByTrust(): ReadonlySet<string> {
+        return this._disabledByTrust;
+    }
+
     protected readonly onDidChangePluginsEmitter = new Emitter<void>();
     readonly onDidChangePlugins = this.onDidChangePluginsEmitter.event;
 
@@ -150,6 +158,8 @@ export abstract class AbstractHostedPluginSupport<PM extends AbstractPluginManag
     protected async doLoad(): Promise<void> {
         const toDisconnect = new DisposableCollection(Disposable.create(() => { /* mark as connected */ }));
 
+        this._disabledByTrust.clear();
+
         await this.beforeSyncPlugins(toDisconnect);
 
         // process empty plugins as well in order to properly remove stale plugin widgets
@@ -166,6 +176,9 @@ export abstract class AbstractHostedPluginSupport<PM extends AbstractPluginManag
             return;
         }
         const contributionsByHost = this.loadContributions(toDisconnect);
+        if (this._disabledByTrust.size > 0) {
+            this.onDidChangePluginsEmitter.fire(undefined);
+        }
 
         await this.afterLoadContributions(toDisconnect);
 
@@ -301,9 +314,13 @@ export abstract class AbstractHostedPluginSupport<PM extends AbstractPluginManag
         const hostContributions = new Map<PluginHost, PluginContributions[]>();
         console.log(`[${this.clientId}] Loading plugin contributions`);
         for (const contributions of this.contributions.values()) {
+            if (!this.workspaceTrusted && contributions.plugin.metadata.model.untrustedWorkspacesSupport === false) {
+                this._disabledByTrust.add(PluginIdentifiers.componentsToUnversionedId(contributions.plugin.metadata.model));
+                continue;
+            }
+
             const plugin = contributions.plugin.metadata;
             const pluginId = plugin.model.id;
-
             if (contributions.state === PluginContributions.State.INITIALIZING) {
                 contributions.state = PluginContributions.State.LOADING;
                 contributions.push(Disposable.create(() => console.log(`[${pluginId}]: Unloaded plugin.`)));

package/src/hosted/node/hosted-plugin-process.ts

@@ -22,6 +22,7 @@ import { inject, injectable, named } from '@theia/core/shared/inversify';
 import * as cp from 'child_process';
 import { Duplex } from 'stream';
 import { HostedPluginClient, PLUGIN_HOST_BACKEND, PluginHostEnvironmentVariable, ServerPluginRunner } from '../../common/plugin-protocol';
+import { PluginHostNavigatorState } from '../../main/common/plugin-host-environment-preferences';
 import { HostedPluginCliContribution } from './hosted-plugin-cli-contribution';
 import { HostedPluginLocalizationService } from './hosted-plugin-localization-service';
 import { ProcessTerminateMessage, ProcessTerminatedMessage } from './hosted-plugin-protocol';
@@ -64,6 +65,9 @@ export class HostedPluginProcess implements ServerPluginRunner {
     @inject(ProcessUtils)
     protected readonly processUtils: ProcessUtils;
 
+    @inject(PluginHostNavigatorState)
+    protected readonly navigatorState: PluginHostNavigatorState;
+
     private childProcess: cp.ChildProcess | undefined;
     private messagePipe?: BinaryMessagePipe;
     private client: HostedPluginClient;
@@ -179,6 +183,9 @@ export class HostedPluginProcess implements ServerPluginRunner {
         env['VSCODE_NLS_CONFIG'] = JSON.stringify(this.localizationService.getNlsConfig());
         // apply external env variables
         this.pluginHostEnvironmentVariables.getContributions().forEach(envVar => envVar.process(env));
+        if (this.navigatorState.supportNodeGlobalNavigator) {
+            env['THEIA_SUPPORT_NODE_GLOBAL_NAVIGATOR'] = 'true';
+        }
         if (this.cli.extensionTestsPath) {
             env.extensionTestsPath = this.cli.extensionTestsPath;
         }

package/src/hosted/node/plugin-host-navigator-override.spec.ts

@@ -0,0 +1,53 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { suppressNodeNavigator } from './plugin-host-navigator-override';
+
+describe('suppressNodeNavigator', () => {
+
+    it('should override navigator to return undefined when env var is not set', () => {
+        const target = { navigator: { userAgent: 'test' } } as typeof globalThis;
+        suppressNodeNavigator({}, target);
+        expect(target.navigator).to.be.undefined;
+    });
+
+    it('should override navigator to return undefined when env var is set to a non-true value', () => {
+        const target = { navigator: { userAgent: 'test' } } as typeof globalThis;
+        suppressNodeNavigator({ 'THEIA_SUPPORT_NODE_GLOBAL_NAVIGATOR': 'false' }, target);
+        expect(target.navigator).to.be.undefined;
+    });
+
+    it('should preserve navigator when env var is set to true', () => {
+        const original = { userAgent: 'test' };
+        const target = { navigator: original } as typeof globalThis;
+        suppressNodeNavigator({ 'THEIA_SUPPORT_NODE_GLOBAL_NAVIGATOR': 'true' }, target);
+        expect(target.navigator).to.equal(original);
+    });
+
+    it('should make the override configurable so it can be restored', () => {
+        const target = { navigator: { userAgent: 'test' } } as typeof globalThis;
+        suppressNodeNavigator({}, target);
+        expect(target.navigator).to.be.undefined;
+
+        const restored = { userAgent: 'restored' };
+        Object.defineProperty(target, 'navigator', {
+            value: restored,
+            configurable: true,
+        });
+        expect(target.navigator).to.equal(restored);
+    });
+});

package/src/hosted/node/plugin-host-navigator-override.ts

@@ -0,0 +1,34 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+/**
+ * Workaround: Node 21+ defines `globalThis.navigator`, which breaks VS Code
+ * extensions that use its absence to detect a Node.js environment.
+ * Unless explicitly opted in via `THEIA_SUPPORT_NODE_GLOBAL_NAVIGATOR=true`,
+ * override it with a getter that returns `undefined` to match VS Code behavior.
+ * See https://github.com/eclipse-theia/theia/issues/16233
+ *
+ * @param env the environment variables to read the opt-in flag from
+ * @param target the object on which to override the `navigator` property (defaults to `globalThis`)
+ */
+export function suppressNodeNavigator(env: Record<string, string | undefined> = process.env, target: typeof globalThis = globalThis): void {
+    if (env['THEIA_SUPPORT_NODE_GLOBAL_NAVIGATOR'] !== 'true') {
+        Object.defineProperty(target, 'navigator', {
+            get: () => undefined,
+            configurable: true,
+        });
+    }
+}

package/src/hosted/node/plugin-host.ts

@@ -14,6 +14,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 import '@theia/core/shared/reflect-metadata';
+import { suppressNodeNavigator } from './plugin-host-navigator-override';
 import { Container } from '@theia/core/shared/inversify';
 import { URI as VSCodeURI } from '@theia/core/shared/vscode-uri';
 import { MsgPackExtensionManager } from '@theia/core/lib/common/message-rpc/msg-pack-extension-manager';
@@ -23,6 +24,9 @@ import { PluginHostRPC } from './plugin-host-rpc';
 import pluginHostModule from './plugin-host-module';
 import { URI } from '../../plugin/types-impl';
 
+// Undefine globalThis.navigator unless opted in, see https://github.com/eclipse-theia/theia/issues/16233
+suppressNodeNavigator();
+
 console.log('PLUGIN_HOST(' + process.pid + ') starting instance');
 
 // override exit() function, to do not allow plugin kill this node

package/src/hosted/node/scanners/scanner-theia.spec.ts

@@ -0,0 +1,112 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import { expect } from 'chai';
+import * as os from 'os';
+import * as path from 'path';
+import * as fs from 'fs';
+import { AbstractPluginScanner } from './scanner-theia';
+import { PluginPackage, PluginEntryPoint } from '../../../common/plugin-protocol';
+import URI from '@theia/core/lib/common/uri';
+
+class TestPluginScanner extends AbstractPluginScanner {
+    constructor() {
+        // Use a dummy api type; no backend init path needed
+        super('theiaPlugin' as any);
+    }
+
+    protected getEntryPoint(_plugin: PluginPackage): PluginEntryPoint {
+        return { backend: 'main.js' };
+    }
+}
+
+function createMinimalPluginPackage(
+    capabilities?: PluginPackage['capabilities'],
+    packagePath?: string
+): PluginPackage {
+    return {
+        name: 'test-plugin',
+        publisher: 'test-publisher',
+        version: '1.0.0',
+        engines: { theiaPlugin: '1.0.0' },
+        displayName: 'Test Plugin',
+        description: 'A test plugin',
+        packagePath: packagePath ?? os.tmpdir(),
+        capabilities
+    } as PluginPackage;
+}
+
+describe('AbstractPluginScanner', () => {
+    let scanner: TestPluginScanner;
+    let tmpDir: string;
+
+    before(() => {
+        scanner = new TestPluginScanner();
+        // Inject a mock pluginUriFactory
+        (scanner as any).pluginUriFactory = {
+            createUri: (_pkg: PluginPackage, _relativePath?: string) => new URI('file:///dummy')
+        };
+        // Create a real temp directory so readdirSync in getLicenseUrl/getReadmeUrl works
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'scanner-test-'));
+    });
+
+    after(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+
+    it('should set untrustedWorkspacesSupport to false when capabilities.untrustedWorkspaces.supported is false', () => {
+        const pkg = createMinimalPluginPackage({
+            untrustedWorkspaces: { supported: false }
+        }, tmpDir);
+
+        const model = scanner.getModel(pkg);
+        expect(model.untrustedWorkspacesSupport).to.equal(false);
+    });
+
+    it('should set untrustedWorkspacesSupport to true when capabilities.untrustedWorkspaces.supported is true', () => {
+        const pkg = createMinimalPluginPackage({
+            untrustedWorkspaces: { supported: true }
+        }, tmpDir);
+
+        const model = scanner.getModel(pkg);
+        expect(model.untrustedWorkspacesSupport).to.equal(true);
+    });
+
+    it('should set untrustedWorkspacesSupport to "limited" when capabilities.untrustedWorkspaces.supported is "limited"', () => {
+        const pkg = createMinimalPluginPackage({
+            untrustedWorkspaces: { supported: 'limited' }
+        }, tmpDir);
+
+        const model = scanner.getModel(pkg);
+        expect(model.untrustedWorkspacesSupport).to.equal('limited');
+    });
+
+    it('should leave untrustedWorkspacesSupport undefined when no capabilities field is present', () => {
+        const pkg = createMinimalPluginPackage(undefined, tmpDir);
+
+        const model = scanner.getModel(pkg);
+        expect(model.untrustedWorkspacesSupport).to.equal(undefined);
+    });
+
+    it('should leave untrustedWorkspacesSupport undefined when capabilities has no untrustedWorkspaces', () => {
+        const pkg = createMinimalPluginPackage({} as any, tmpDir);
+
+        const model = scanner.getModel(pkg);
+        expect(model.untrustedWorkspacesSupport).to.equal(undefined);
+    });
+});