@theia/plugin-ext 1.74.0-next.5 → 1.74.0-next.51

package/src/main/browser/custom-editors/custom-editor-opener.spec.ts

@@ -0,0 +1,104 @@
+// *****************************************************************************
+// Copyright (C) 2026 Safi Seid-Ahmad, K2view and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '@theia/core/lib/browser/test/jsdom';
+let disableJSDOM = enableJSDOM();
+
+import * as chai from 'chai';
+import URI from '@theia/core/lib/common/uri';
+import { CustomEditorOpener } from './custom-editor-opener';
+import { CustomEditor, CustomEditorPriority } from '../../../common';
+
+disableJSDOM();
+
+const expect = chai.expect;
+
+describe('CustomEditorOpener#selectorMatches', () => {
+
+    before(() => {
+        disableJSDOM = enableJSDOM();
+    });
+
+    after(() => {
+        disableJSDOM();
+    });
+
+    // Only selector matching is exercised — none of the collaborators are touched.
+    function createOpener(filenamePattern: string): CustomEditorOpener {
+        const editor: CustomEditor = {
+            viewType: 'test.editor',
+            displayName: 'Test Editor',
+            selector: [{ filenamePattern }],
+            priority: CustomEditorPriority.default
+        };
+        return new CustomEditorOpener(editor, undefined!, undefined!, undefined!, undefined!);
+    }
+
+    function matches(filenamePattern: string, path: string): boolean {
+        const opener = createOpener(filenamePattern);
+        return opener.matches([{ filenamePattern }], new URI(`file://${path}`));
+    }
+
+    function matchesUri(filenamePattern: string, uri: string): boolean {
+        const opener = createOpener(filenamePattern);
+        return opener.matches([{ filenamePattern }], new URI(uri));
+    }
+
+    it('matches a plain extension pattern against the basename', () => {
+        expect(matches('*.custom', '/project/src/file.custom')).true;
+        expect(matches('*.custom', '/project/src/file.other')).false;
+    });
+
+    it('matches a plain filename pattern against the basename anywhere', () => {
+        expect(matches('config.json', '/anywhere/at/all/config.json')).true;
+        expect(matches('config.json', '/anywhere/at/all/other.json')).false;
+    });
+
+    it('matches case-insensitively', () => {
+        expect(matches('*.CUSTOM', '/project/file.custom')).true;
+        expect(matches('*.custom', '/project/FILE.CUSTOM')).true;
+    });
+
+    it('matches a pattern containing a path separator against the full path (VS Code parity)', () => {
+        const pattern = '**/components/*/config.json';
+        expect(matches(pattern, '/project/src/components/button/config.json')).true;
+        expect(matches(pattern, '/project/elsewhere/config.json')).false;
+        expect(matches(pattern, '/project/src/components/button/nested/config.json')).false;
+    });
+
+    it('matches nested path patterns', () => {
+        const pattern = '**/components/*/styles/*.css';
+        expect(matches(pattern, '/project/src/components/button/styles/theme.css')).true;
+        expect(matches(pattern, '/project/src/components/button/config.json')).false;
+        expect(matches(pattern, '/project/src/components/button/styles/dark/theme.css')).false;
+    });
+
+    it('does not let a path pattern match a bare basename', () => {
+        expect(matches('**/components/*/config.json', '/config.json')).false;
+    });
+
+    it('never matches the excluded schemes, mirroring VS Code (globMatchesResource)', () => {
+        // Patterns that would match the basename or full path on a `file:` resource...
+        expect(matchesUri('*.json', 'file:///project/settings.json')).true;
+        expect(matchesUri('**/settings.json', 'file:///project/settings.json')).true;
+        // ...must not match on VS Code's internal schemes.
+        expect(matchesUri('*.json', 'vscode-settings:/settings.json')).false;
+        expect(matchesUri('**/settings.json', 'vscode-settings:/project/settings.json')).false;
+        expect(matchesUri('*.json', 'webview-panel:/panel/config.json')).false;
+        expect(matchesUri('*', 'extension:/some/resource')).false;
+        expect(matchesUri('*', 'vscode-workspace-trust:/trust')).false;
+    });
+});

package/src/main/browser/custom-editors/custom-editor-opener.tsx

@@ -24,6 +24,20 @@ import { PluginCustomEditorRegistry } from './plugin-custom-editor-registry';
 import { generateUuid } from '@theia/core/lib/common/uuid';
 import { DisposableCollection, Emitter, PreferenceService } from '@theia/core';
 import { match } from '@theia/core/lib/common/glob';
+import { Schemes } from '../../../common/uri-components';
+
+/**
+ * Schemes that never match a custom editor's `filenamePattern`, mirroring the
+ * excluded schemes in VS Code's `editorResolverService#globMatchesResource`.
+ * Theia has no scheme constants for `extension` and `vscode-workspace-trust`,
+ * so those are referenced by their literal values.
+ */
+const nonMatchingSchemes = new Set<string>([
+    'extension',
+    Schemes.webviewPanel,
+    'vscode-workspace-trust',
+    Schemes.vscodeSettings
+]);
 
 export class CustomEditorOpener implements OpenHandler {
 
@@ -200,8 +214,19 @@ export class CustomEditorOpener implements OpenHandler {
     }
 
     selectorMatches(selector: CustomEditorSelector, resource: URI): boolean {
+        if (nonMatchingSchemes.has(resource.scheme)) {
+            // These schemes match no glob pattern, mirroring VS Code's `globMatchesResource`.
+            return false;
+        }
         if (selector.filenamePattern) {
-            if (match(selector.filenamePattern.toLowerCase(), resource.path.name.toLowerCase() + resource.path.ext.toLowerCase())) {
+            const filenamePattern = selector.filenamePattern.toLowerCase();
+            // Mirror VS Code's editor-association matching (editorResolverService#globMatchesResource):
+            // a pattern containing a path separator is matched against the full `scheme:path`,
+            // a plain pattern is matched against the basename only.
+            const target = filenamePattern.includes('/')
+                ? `${resource.scheme}:${resource.path.toString()}`.toLowerCase()
+                : resource.path.base.toLowerCase();
+            if (match(filenamePattern, target)) {
                 return true;
             }
         }

package/src/main/browser/custom-editors/custom-editor-widget.ts

@@ -17,8 +17,9 @@
 import { injectable, inject, postConstruct } from '@theia/core/shared/inversify';
 import URI from '@theia/core/lib/common/uri';
 import { FileOperation } from '@theia/filesystem/lib/common/files';
-import { ApplicationShell, DelegatingSaveable, NavigatableWidget, Saveable, SaveableSource } from '@theia/core/lib/browser';
+import { ApplicationShell, DelegatingSaveable, Message, NavigatableWidget, Saveable, SaveableSource } from '@theia/core/lib/browser';
 import { SaveableService } from '@theia/core/lib/browser/saveable-service';
+import { Disposable, SelectionService } from '@theia/core/lib/common';
 import { Reference } from '@theia/core/lib/common/reference';
 import { WebviewWidget } from '../webview/webview';
 import { CustomEditorModel } from './custom-editors-main';
@@ -54,6 +55,9 @@ export class CustomEditorWidget extends WebviewWidget implements CustomEditorWid
     @inject(SaveableService)
     protected readonly saveService: SaveableService;
 
+    @inject(SelectionService)
+    protected readonly selectionService: SelectionService;
+
     @postConstruct()
     protected override init(): void {
         super.init();
@@ -63,6 +67,16 @@ export class CustomEditorWidget extends WebviewWidget implements CustomEditorWid
                 this.doMove(e.target.resource);
             }
         }));
+        this.toDispose.push(Disposable.create(() => {
+            if (this.selectionService.selection === this) {
+                this.selectionService.selection = undefined;
+            }
+        }));
+    }
+
+    protected override onActivateRequest(msg: Message): void {
+        super.onActivateRequest(msg);
+        this.selectionService.selection = this;
     }
 
     updateID(): void {

package/src/main/browser/preference-registry-main.ts

@@ -36,8 +36,16 @@ import { Disposable, DisposableCollection } from '@theia/core/lib/common/disposa
 
 export function getPreferences(preferenceProviderProvider: PreferenceProviderProvider, rootFolders: FileStat[]): PreferenceData {
     const folders = rootFolders.map(root => root.resource.toString());
+    // Session-scoped values are process-lifetime CLI overrides (see PreferenceScope.Session).
+    // The plugin-side `parse()` in `preference-registry.ts` only reads up to Folder, so
+    // shipping session data across would leak potentially security-sensitive overrides
+    // (e.g. AI tool auto-approval) into the plugin host without any consumer on the other
+    // side. Exclude the scope explicitly until plugins can opt in to session values.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return PreferenceScope.getScopes().reduce((result: { [key: number]: any }, scope: PreferenceScope) => {
+        if (scope === PreferenceScope.Session) {
+            return result;
+        }
         result[scope] = {};
         const provider = preferenceProviderProvider(scope);
         if (provider) {

package/src/main/node/plugin-http-resolver.spec.ts

@@ -0,0 +1,41 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import { HttpPluginDeployerResolver } from './plugin-http-resolver';
+import { PluginDeployerResolverContext } from '../../common';
+
+describe('HttpPluginDeployerResolver', () => {
+
+    function createContext(originId: string): PluginDeployerResolverContext {
+        return {
+            getOriginId: () => originId
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as any as PluginDeployerResolverContext;
+    }
+
+    it('should reject a malformed link URI', async () => {
+        const resolver = new HttpPluginDeployerResolver();
+        let error: Error | undefined;
+        try {
+            await resolver.resolve(createContext(':::not a url'));
+        } catch (e) {
+            error = e as Error;
+        }
+        expect(error).to.be.an.instanceOf(Error);
+        expect(error!.message).to.contain('invalid link URI');
+    });
+});

package/src/main/node/plugin-http-resolver.ts

@@ -19,7 +19,6 @@ import { inject, injectable } from '@theia/core/shared/inversify';
 import { Deferred } from '@theia/core/lib/common/promise-util';
 import { promises as fs } from 'fs';
 import * as path from 'path';
-import * as url from 'url';
 import { PluginDeployerResolver, PluginDeployerResolverContext } from '../../common';
 import { getTempDirPathAsync } from './temp-dir-util';
 
@@ -56,8 +55,10 @@ export class HttpPluginDeployerResolver implements PluginDeployerResolver {
         // download the file
         // keep filename of the url
         const urlPath = pluginResolverContext.getOriginId();
-        const link = url.parse(urlPath);
-        if (!link.pathname) {
+        let link: URL;
+        try {
+            link = new URL(urlPath);
+        } catch {
             throw new Error('invalid link URI' + urlPath);
         }
 

package/src/main/node/plugin-service.ts

@@ -16,7 +16,6 @@
 
 import * as http from 'http';
 import * as path from 'path';
-import * as url from 'url';
 const vhost = require('vhost');
 import * as express from '@theia/core/shared/express';
 import { BackendApplicationContribution } from '@theia/core/lib/node/backend-application';
@@ -63,8 +62,13 @@ export class PluginApiContribution implements BackendApplicationContribution, Ws
 
     allowWsUpgrade(request: http.IncomingMessage): MaybePromise<boolean> {
         if (request.headers.origin && !this.serveSameOrigin) {
-            const origin = url.parse(request.headers.origin);
-            if (origin.host && this.webviewExternalEndpointRegExp.test(origin.host)) {
+            let host: string | undefined;
+            try {
+                host = new URL(request.headers.origin).host;
+            } catch {
+                host = undefined;
+            }
+            if (host && this.webviewExternalEndpointRegExp.test(host)) {
                 // If the origin comes from the WebViews, refuse:
                 return false;
             }

package/src/plugin/telemetry-ext.spec.ts

@@ -0,0 +1,61 @@
+// *****************************************************************************
+// Copyright (C) 2026 suzunn and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import * as chai from 'chai';
+import { TelemetryExtImpl } from './telemetry-ext';
+
+const expect = chai.expect;
+
+describe('TelemetryLogger', () => {
+    const sender = {
+        sendEventData: () => { },
+        sendErrorData: () => { }
+    };
+
+    it('reflects the current telemetry enabled state', () => {
+        const telemetry = new TelemetryExtImpl();
+        const logger = telemetry.createTelemetryLogger(sender);
+
+        expect(logger.telemetryEnabled).to.equal(false);
+        expect(logger.isUsageEnabled).to.equal(false);
+        expect(logger.isErrorsEnabled).to.equal(false);
+
+        telemetry.isTelemetryEnabled = true;
+
+        expect(logger.telemetryEnabled).to.equal(true);
+        expect(logger.isUsageEnabled).to.equal(true);
+        expect(logger.isErrorsEnabled).to.equal(true);
+
+        telemetry.isTelemetryEnabled = false;
+
+        expect(logger.telemetryEnabled).to.equal(false);
+        expect(logger.isUsageEnabled).to.equal(false);
+        expect(logger.isErrorsEnabled).to.equal(false);
+    });
+
+    it('emits enable-state changes when telemetry is toggled', () => {
+        const telemetry = new TelemetryExtImpl();
+        const logger = telemetry.createTelemetryLogger(sender);
+        let changes = 0;
+
+        logger.onDidChangeEnableStates(() => changes++);
+
+        telemetry.isTelemetryEnabled = true;
+        telemetry.isTelemetryEnabled = false;
+
+        expect(changes).to.equal(2);
+    });
+});

package/src/plugin/telemetry-ext.ts

@@ -49,7 +49,7 @@ export class TelemetryLogger {
     readonly options: TelemetryLoggerOptions | undefined;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     readonly commonProperties: Record<string, any>;
-    telemetryEnabled: boolean;
+    private _telemetryEnabled: boolean;
 
     private readonly onDidChangeEnableStatesEmitter: Emitter<TelemetryLogger> = new Emitter();
     readonly onDidChangeEnableStates: Event<TelemetryLogger> = this.onDidChangeEnableStatesEmitter.event;
@@ -60,9 +60,20 @@ export class TelemetryLogger {
         this.sender = sender;
         this.options = options;
         this.commonProperties = this.getCommonProperties();
-        this._isErrorsEnabled = true;
-        this._isUsageEnabled = true;
-        this.telemetryEnabled = telemetryEnabled;
+        this._telemetryEnabled = telemetryEnabled;
+        this._isErrorsEnabled = telemetryEnabled;
+        this._isUsageEnabled = telemetryEnabled;
+    }
+
+    get telemetryEnabled(): boolean {
+        return this._telemetryEnabled;
+    }
+
+    set telemetryEnabled(telemetryEnabled: boolean) {
+        if (this._telemetryEnabled !== telemetryEnabled) {
+            this._telemetryEnabled = telemetryEnabled;
+            this.updateEnableStates(telemetryEnabled, telemetryEnabled);
+        }
     }
 
     get isUsageEnabled(): boolean {
@@ -87,6 +98,14 @@ export class TelemetryLogger {
         }
     }
 
+    private updateEnableStates(isUsageEnabled: boolean, isErrorsEnabled: boolean): void {
+        if (this._isUsageEnabled !== isUsageEnabled || this._isErrorsEnabled !== isErrorsEnabled) {
+            this._isUsageEnabled = isUsageEnabled;
+            this._isErrorsEnabled = isErrorsEnabled;
+            this.onDidChangeEnableStatesEmitter.fire(this);
+        }
+    }
+
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     logUsage(eventName: string, data?: Record<string, any | TelemetryTrustedValue<any>>): void {
         if (!this.telemetryEnabled || !this.isUsageEnabled) {