@theia/plugin-ext 1.76.0-next.7 → 1.76.0

package/src/common/plugin-protocol.ts

@@ -30,6 +30,7 @@ import {
 } from '@theia/plugin-utils/lib/common/plugin-model';
 import {
     PLUGIN_HOST_BACKEND,
+    PLUGIN_HOST_FRONTEND,
     PluginEntryPoint,
     PluginLifecycle,
     PluginManifest,
@@ -116,6 +117,7 @@ export { getPluginId };
 export { toPluginUrlFromUtils as toPluginUrl };
 export {
     PLUGIN_HOST_BACKEND,
+    PLUGIN_HOST_FRONTEND,
     PluginEntryPoint,
     PluginLifecycle,
     PluginManifest,

package/src/hosted/browser/hosted-plugin.ts

@@ -24,7 +24,7 @@
 import { generateUuid } from '@theia/core/lib/common/uuid';
 import { injectable, inject, postConstruct, named } from '@theia/core/shared/inversify';
 import { PluginWorker } from './plugin-worker';
-import { getPluginId, DeployedPlugin, HostedPluginServer } from '../../common/plugin-protocol';
+import { getPluginId, DeployedPlugin, HostedPluginServer, PLUGIN_HOST_FRONTEND } from '../../common/plugin-protocol';
 import { HostedPluginWatcher } from './hosted-plugin-watcher';
 import { ExtensionKind, MAIN_RPC_CONTEXT, PluginManagerExt, UIKind } from '../../common/plugin-api-rpc';
 import { setUpPluginApi } from '../../main/browser/main-context';
@@ -73,6 +73,7 @@ import {
 } from '../common/hosted-plugin';
 import { isRemote } from '@theia/core/lib/browser/browser';
 import { WorkspaceTrustService } from '@theia/workspace/lib/browser/workspace-trust-service';
+import { TelemetryConsentProvider } from '@theia/telemetry/lib/common/telemetry-consent-provider';
 
 export type DebugActivationEvent = 'onDebugResolve' | 'onDebugInitialConfigurations' | 'onDebugAdapterProtocolTracker' | 'onDebugDynamicConfigurations';
 
@@ -183,6 +184,9 @@ export class HostedPluginSupport extends AbstractHostedPluginSupport<PluginManag
     @inject(WorkspaceTrustService)
     protected readonly workspaceTrustService: WorkspaceTrustService;
 
+    @inject(TelemetryConsentProvider)
+    protected readonly telemetryConsentProvider: TelemetryConsentProvider;
+
     @inject(ILogger) @named('plugin-ext:HostedPluginSupport')
     protected override readonly logger: ILogger;
 
@@ -245,7 +249,7 @@ export class HostedPluginSupport extends AbstractHostedPluginSupport<PluginManag
     }
 
     protected createTheiaReadyPromise(): Promise<unknown> {
-        return Promise.all([this.preferenceServiceImpl.ready, this.workspaceService.roots]);
+        return Promise.all([this.preferenceServiceImpl.ready, this.workspaceService.roots, this.telemetryConsentProvider.ready]);
     }
 
     protected override runOperation(operation: () => Promise<void>): Promise<void> {
@@ -364,7 +368,8 @@ export class HostedPluginSupport extends AbstractHostedPluginSupport<PluginManag
                 },
                 jsonValidation,
                 pluginKind: isRemote ? ExtensionKind.Workspace : ExtensionKind.UI,
-                supportedActivationEvents
+                supportedActivationEvents,
+                telemetryLevel: this.telemetryConsentProvider.level
             });
             if (toDisconnect.disposed) {
                 return undefined;
@@ -375,7 +380,7 @@ export class HostedPluginSupport extends AbstractHostedPluginSupport<PluginManag
     }
 
     protected initRpc(host: PluginHost, pluginId: string): RPCProtocol {
-        const rpc = host === 'frontend' ? new PluginWorker().rpc : this.createServerRpc(host);
+        const rpc = host === PLUGIN_HOST_FRONTEND ? new PluginWorker().rpc : this.createServerRpc(host);
         setUpPluginApi(rpc, this.container);
         this.mainPluginApiProviders.getContributions().forEach(p => p.initialize(rpc, this.container));
         return rpc;

package/src/hosted/browser/worker/worker-main.ts

@@ -34,6 +34,7 @@ import { loadManifest } from './plugin-manifest-loader';
 import { EnvExtImpl } from '../../../plugin/env';
 import { DebugExtImpl } from '../../../plugin/debug/debug-ext';
 import { LocalizationExtImpl } from '../../../plugin/localization-ext';
+import { TelemetryExtImpl } from '../../../plugin/telemetry-ext';
 import pluginHostModule from './worker-plugin-module';
 import { PLUGINS_BASE_PATH } from '@theia/plugin-utils/lib/common/constants';
 
@@ -116,20 +117,28 @@ pluginManager.setPluginHost({
                     pluginsModulesNames.set(plugin.lifecycle.frontendModuleName!, plugin);
                     return { target: result, plugin };
                 } else {
-                    return {
-                        target: foreign,
-                        plugin: {
-                            pluginPath: pluginModel.entryPoint.backend,
-                            pluginFolder: pluginModel.packagePath,
-                            pluginUri: pluginModel.packageUri,
-                            model: pluginModel,
-                            lifecycle: pluginLifecycle,
+                    const common = {
+                        pluginPath: pluginModel.entryPoint.backend,
+                        pluginFolder: pluginModel.packagePath,
+                        pluginUri: pluginModel.packageUri,
+                        model: pluginModel,
+                        lifecycle: pluginLifecycle,
+                        isUnderDevelopment: !!plg.isUnderDevelopment
+                    };
+                    const plugin: Plugin = pluginModel.entryPoint.backend
+                        // Runs in another host, so its manifest is that host's problem.
+                        ? {
+                            ...common,
                             get rawModel(): never {
                                 throw new Error('not supported');
-                            },
-                            isUnderDevelopment: !!plg.isUnderDevelopment
+                            }
                         }
-                    };
+                        // No entry point anywhere, so there is nothing to run - it only contributes
+                        // grammars, themes and the like. It does still turn up in `theia.extensions`,
+                        // where reading `packageJSON` must not throw, so give it a real manifest.
+                        // Only browser-only gets here; with a backend these go to the backend host.
+                        : { ...common, rawModel: await loadManifest(pluginModel) };
+                    return { target: foreign, plugin };
                 }
             }));
             // Collect the ordered plugins and insert them in the target array:
@@ -162,6 +171,7 @@ const messageRegistryExt = container.get(MessageRegistryExt);
 const clipboardExt = container.get(ClipboardExt);
 const webviewExt = container.get(WebviewsExtImpl);
 const localizationExt = container.get(LocalizationExtImpl);
+const telemetryExt = container.get(TelemetryExtImpl);
 const storageProxy = container.get(KeyValueStorageProxy);
 
 const apiFactory = createAPIFactory(
@@ -175,7 +185,8 @@ const apiFactory = createAPIFactory(
     messageRegistryExt,
     clipboardExt,
     webviewExt,
-    localizationExt
+    localizationExt,
+    telemetryExt
 );
 let defaultApi: typeof theia;
 

package/src/hosted/browser/worker/worker-plugin-module.ts

@@ -36,6 +36,7 @@ import { WorkerEnvExtImpl } from './worker-env-ext';
 import { DebugExtImpl } from '../../../plugin/debug/debug-ext';
 import { LocalizationExtImpl } from '../../../plugin/localization-ext';
 import { EncodingService } from '@theia/core/lib/common/encoding-service';
+import { TelemetryExtImpl } from '../../../plugin/telemetry-ext';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const ctx = self as any;
@@ -79,4 +80,5 @@ export default new ContainerModule(bind => {
     bind(WebviewsExtImpl).toSelf().inSingletonScope();
     bind(TerminalServiceExtImpl).toSelf().inSingletonScope();
     bind(MinimalTerminalServiceExt).toService(TerminalServiceExtImpl);
+    bind(TelemetryExtImpl).toSelf().inSingletonScope();
 });

package/src/hosted/browser-only/browser-only-hosted-plugin-server.spec.ts

@@ -0,0 +1,133 @@
+// *****************************************************************************
+// Copyright (C) 2026 Robert Jandow
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '@theia/core/lib/browser/test/jsdom';
+// `BrowserOnlyHostedPluginServer` transitively imports `Endpoint` via `@theia/core/lib/browser`,
+// which touches `document` at load time, so JSDOM is enabled before it for that import.
+let disableJSDOM = enableJSDOM();
+
+import { expect } from 'chai';
+import { Container } from '@theia/core/shared/inversify';
+import { DeployedPlugin, PluginType } from '../../common';
+import { BrowserOnlyHostedPluginServer, BrowserOnlyPluginOptions } from './browser-only-hosted-plugin-server';
+
+disableJSDOM();
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+function plugin(name: string, version = '1.0.0'): DeployedPlugin {
+    return {
+        type: PluginType.System,
+        metadata: {
+            host: 'main',
+            model: { publisher: 'theia', name, version } as any,
+            lifecycle: {} as any
+        }
+    } as DeployedPlugin;
+}
+
+describe('BrowserOnlyHostedPluginServer', () => {
+
+    // `fetchDeployedPlugins` builds the list URL through `Endpoint`, which reads `self.location`.
+    before(() => { disableJSDOM = enableJSDOM(); });
+    after(() => disableJSDOM());
+
+    const originalFetch = globalThis.fetch;
+    let requestedUrls: string[];
+
+    function stubFetch(respond: () => Response | Promise<Response>): void {
+        requestedUrls = [];
+        globalThis.fetch = (async (url: any) => {
+            requestedUrls.push(String(url));
+            return respond();
+        }) as typeof globalThis.fetch;
+    }
+
+    function createServer(options?: BrowserOnlyPluginOptions): BrowserOnlyHostedPluginServer {
+        const container = new Container();
+        container.bind(BrowserOnlyHostedPluginServer).toSelf().inSingletonScope();
+        if (options) {
+            container.bind(BrowserOnlyPluginOptions).toConstantValue(options);
+        }
+        return container.get(BrowserOnlyHostedPluginServer);
+    }
+
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+
+    it('serves the plugins listed by the build', async () => {
+        stubFetch(() => Response.json([plugin('a'), plugin('b')]));
+        const server = createServer();
+
+        expect(await server.getDeployedPluginIds()).to.deep.equal(['theia.a@1.0.0', 'theia.b@1.0.0']);
+        expect(requestedUrls).to.deep.equal(['http://localhost/hostedPlugin/list.json']);
+    });
+
+    it('fetches the list only once', async () => {
+        stubFetch(() => Response.json([plugin('a')]));
+        const server = createServer();
+
+        await server.getDeployedPluginIds();
+        await server.getDeployedPluginIds();
+
+        expect(requestedUrls).to.have.lengthOf(1);
+    });
+
+    it('prefers the metadata supplied by an adopter over the list', async () => {
+        stubFetch(() => Response.json([plugin('from-list')]));
+        const server = createServer({ pluginMetadata: [plugin('from-options')] });
+
+        expect(await server.getDeployedPluginIds()).to.deep.equal(['theia.from-options@1.0.0']);
+        expect(requestedUrls).to.be.empty;
+    });
+
+    it('returns only the requested plugins', async () => {
+        stubFetch(() => Response.json([plugin('a'), plugin('b'), plugin('c')]));
+        const server = createServer();
+
+        const deployed = await server.getDeployedPlugins(['theia.a@1.0.0', 'theia.c@1.0.0']);
+        expect(deployed.map(p => p.metadata.model.name)).to.deep.equal(['a', 'c']);
+    });
+
+    it('reports where the list could not be loaded from', async () => {
+        stubFetch(() => new Response('', { status: 404, statusText: 'Not Found' }));
+        const server = createServer();
+
+        await server.getDeployedPluginIds().then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.message).to.contain('http://localhost/hostedPlugin/list.json').and.to.contain('404'));
+    });
+
+    it('fetches the list again after a failed attempt', async () => {
+        let attempt = 0;
+        stubFetch(() => ++attempt === 1 ? new Response('', { status: 503 }) : Response.json([plugin('a')]));
+        const server = createServer();
+
+        await server.getDeployedPluginIds().catch(() => undefined);
+        expect(await server.getDeployedPluginIds()).to.deep.equal(['theia.a@1.0.0']);
+        expect(requestedUrls).to.have.lengthOf(2);
+    });
+
+    it('rejects a list that is not an array', async () => {
+        stubFetch(() => Response.json({ plugins: [] }));
+        const server = createServer();
+
+        await server.getDeployedPluginIds().then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.message).to.contain('expected an array'));
+    });
+});

package/src/hosted/browser-only/browser-only-hosted-plugin-server.ts

@@ -0,0 +1,122 @@
+// *****************************************************************************
+// Copyright (C) 2026 Robert Jandow
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { injectable, inject, optional } from '@theia/core/shared/inversify';
+import { LIST_JSON, PLUGINS_BASE_PATH } from '@theia/plugin-utils/lib/common/constants';
+import { DeployedPlugin, ExtPluginApi, HostedPluginClient, HostedPluginServer, PluginIdentifiers } from '../../common';
+import { Event, RpcConnectionEventEmitter } from '@theia/core';
+import { Endpoint } from '@theia/core/lib/browser';
+
+export const BrowserOnlyPluginOptions = Symbol('BrowserOnlyPluginOptions');
+/**
+ * Optional override for the statically deployed plugins of a browser-only application. By
+ * default we use whatever the build prepared, i.e. `lib/frontend/hostedPlugin/list.json`. Bind
+ * this to supply the metadata by hand instead, e.g. if the plugins are hosted somewhere the
+ * build can't see.
+ */
+export interface BrowserOnlyPluginOptions {
+    pluginMetadata: DeployedPlugin[];
+}
+
+/**
+ * Serves the plugins statically deployed into the frontend bundle. There's no backend in a
+ * browser-only application, so nothing can be deployed or undeployed at runtime.
+ */
+@injectable()
+export class BrowserOnlyHostedPluginServer implements HostedPluginServer, RpcConnectionEventEmitter {
+    readonly onDidOpenConnection: Event<void> = Event.None;
+    readonly onDidCloseConnection: Event<void> = Event.None;
+
+    @inject(BrowserOnlyPluginOptions) @optional()
+    protected readonly options?: BrowserOnlyPluginOptions;
+
+    protected client: HostedPluginClient | undefined;
+
+    protected plugins: Promise<DeployedPlugin[]> | undefined;
+
+    /** The statically deployed plugins, from {@link BrowserOnlyPluginOptions} if bound, otherwise from the list the build wrote. */
+    protected getPlugins(): Promise<DeployedPlugin[]> {
+        if (!this.plugins) {
+            this.plugins = this.options ? Promise.resolve(this.options.pluginMetadata) : this.fetchDeployedPlugins();
+            // don't keep a failed fetch around, otherwise the tab has no plugins until it's reloaded
+            this.plugins.catch(() => this.plugins = undefined);
+        }
+        return this.plugins;
+    }
+
+    protected async fetchDeployedPlugins(): Promise<DeployedPlugin[]> {
+        // Built through `Endpoint`, like `PluginIconService#toPluginUrl`, so this keeps working
+        // when the application is deployed under a sub-path.
+        const url = new Endpoint({ path: `${PLUGINS_BASE_PATH}/${LIST_JSON}` }).getRestUrl().toString();
+        try {
+            const response = await fetch(url);
+            if (!response.ok) {
+                throw new Error(`${response.status} ${response.statusText}`);
+            }
+            const plugins = await response.json();
+            if (!Array.isArray(plugins)) {
+                throw new Error(`expected an array but got ${typeof plugins}`);
+            }
+            return plugins;
+        } catch (error) {
+            throw new Error(`Failed to load the deployed plugins from '${url}': ${error.message}`);
+        }
+    }
+
+    async getDeployedPluginIds(): Promise<PluginIdentifiers.VersionedId[]> {
+        const plugins = await this.getPlugins();
+        return plugins.map(p => PluginIdentifiers.componentsToVersionedId(p.metadata.model));
+    }
+
+    getInstalledPluginIds(): Promise<PluginIdentifiers.VersionedId[]> {
+        // the statically deployed plugins are the only ones that could ever be "installed"
+        return this.getDeployedPluginIds();
+    }
+
+    async getUninstalledPluginIds(): Promise<readonly PluginIdentifiers.VersionedId[]> {
+        return [];
+    }
+
+    async getDisabledPluginIds(): Promise<readonly PluginIdentifiers.UnversionedId[]> {
+        return [];
+    }
+
+    async getDeployedPlugins(ids: PluginIdentifiers.VersionedId[]): Promise<DeployedPlugin[]> {
+        const plugins = await this.getPlugins();
+        const requested = new Set(ids);
+        return plugins.filter(p => requested.has(PluginIdentifiers.componentsToVersionedId(p.metadata.model)));
+    }
+
+    async getExtPluginAPI(): Promise<ExtPluginApi[]> {
+        return [];
+    }
+
+    async onMessage(targetHost: string, message: Uint8Array): Promise<void> {
+        // the frontend delivers messages to the plugin host directly, not through here
+    }
+
+    setClient(client: HostedPluginClient | undefined): void {
+        this.client = client;
+    }
+
+    getClient(): HostedPluginClient | undefined {
+        return this.client;
+    }
+
+    dispose(): void {
+        this.client = undefined;
+    }
+}

package/src/hosted/browser-only/browser-only-plugin-file-system-provider.spec.ts

@@ -0,0 +1,178 @@
+// *****************************************************************************
+// Copyright (C) 2026 Robert Jandow
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { enableJSDOM } from '@theia/core/lib/browser/test/jsdom';
+// `BrowserOnlyPluginFileSystemProvider` transitively imports `Endpoint` via `@theia/core/lib/browser`,
+// which touches `document` at load time, so JSDOM is enabled before it for that import.
+let disableJSDOM = enableJSDOM();
+
+import { expect } from 'chai';
+import { URI } from '@theia/core';
+import { FileSystemProviderErrorCode } from '@theia/filesystem/lib/common/files';
+import { PLUGINS_SCHEME } from '@theia/plugin-utils/lib/common/constants';
+import { BrowserOnlyPluginFileSystemProvider } from './browser-only-plugin-file-system-provider';
+
+disableJSDOM();
+
+describe('BrowserOnlyPluginFileSystemProvider', () => {
+
+    // The provider builds asset URLs through `Endpoint`, which reads `self.location`.
+    before(() => { disableJSDOM = enableJSDOM(); });
+    after(() => disableJSDOM());
+
+    const originalFetch = globalThis.fetch;
+    let requests: Array<{ url: string, method: string | undefined }>;
+
+    function stubFetch(respond: () => Response | Promise<Response>): void {
+        requests = [];
+        globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+            requests.push({ url: String(url), method: init?.method });
+            return respond();
+        }) as typeof globalThis.fetch;
+    }
+
+    function stubFetchFailure(error: Error): void {
+        requests = [];
+        globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+            requests.push({ url: String(url), method: init?.method });
+            throw error;
+        }) as typeof globalThis.fetch;
+    }
+
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+
+    function assetUri(path: string): URI {
+        return new URI(`${PLUGINS_SCHEME}:/`).resolve(path);
+    }
+
+    function createProvider(): BrowserOnlyPluginFileSystemProvider {
+        return new BrowserOnlyPluginFileSystemProvider();
+    }
+
+    it('rejects a resource whose scheme is not the plugin asset scheme', async () => {
+        const provider = createProvider();
+
+        await provider.stat(new URI('file:///theia.foo/1.0.0/package.json')).then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.code).to.equal(FileSystemProviderErrorCode.FileNotFound));
+    });
+
+    it('maps content-length and last-modified into size and mtime', async () => {
+        const modified = new Date('2020-01-01T00:00:00.000Z');
+        stubFetch(() => new Response(undefined, {
+            status: 200,
+            headers: { 'content-length': '42', 'last-modified': modified.toUTCString() }
+        }));
+        const provider = createProvider();
+
+        const stat = await provider.stat(assetUri('theia.foo/1.0.0/icon.svg'));
+
+        expect(stat.size).to.equal(42);
+        expect(stat.mtime).to.equal(modified.getTime());
+        expect(stat.ctime).to.equal(modified.getTime());
+        expect(requests).to.deep.equal([{ url: 'http://localhost/hostedPlugin/theia.foo/1.0.0/icon.svg', method: 'HEAD' }]);
+    });
+
+    it('falls back to 0 when content-length/last-modified are absent', async () => {
+        stubFetch(() => new Response(undefined, { status: 200 }));
+        const provider = createProvider();
+
+        const stat = await provider.stat(assetUri('theia.foo/1.0.0/icon.svg'));
+
+        expect(stat.size).to.equal(0);
+        expect(stat.mtime).to.equal(0);
+        expect(stat.ctime).to.equal(0);
+    });
+
+    it('falls back to 0 when content-length/last-modified cannot be parsed', async () => {
+        stubFetch(() => new Response(undefined, {
+            status: 200,
+            headers: { 'content-length': 'not-a-number', 'last-modified': 'not-a-date' }
+        }));
+        const provider = createProvider();
+
+        const stat = await provider.stat(assetUri('theia.foo/1.0.0/icon.svg'));
+
+        expect(stat.size).to.equal(0);
+        expect(stat.mtime).to.equal(0);
+        expect(stat.ctime).to.equal(0);
+    });
+
+    it('returns the response body as bytes', async () => {
+        const bytes = new Uint8Array([1, 2, 3, 4]);
+        stubFetch(() => new Response(bytes, { status: 200 }));
+        const provider = createProvider();
+
+        const result = await provider.readFile(assetUri('theia.foo/1.0.0/icon.svg'));
+
+        expect(Array.from(result)).to.deep.equal(Array.from(bytes));
+        expect(requests).to.deep.equal([{ url: 'http://localhost/hostedPlugin/theia.foo/1.0.0/icon.svg', method: 'GET' }]);
+    });
+
+    it('maps a 404 response to FileNotFound', async () => {
+        stubFetch(() => new Response('', { status: 404, statusText: 'Not Found' }));
+        const provider = createProvider();
+
+        await provider.readFile(assetUri('theia.foo/1.0.0/missing.svg')).then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.code).to.equal(FileSystemProviderErrorCode.FileNotFound));
+    });
+
+    it('maps other non-ok responses to Unknown', async () => {
+        stubFetch(() => new Response('', { status: 500, statusText: 'Internal Server Error' }));
+        const provider = createProvider();
+
+        await provider.readFile(assetUri('theia.foo/1.0.0/icon.svg')).then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.code).to.equal(FileSystemProviderErrorCode.Unknown));
+    });
+
+    it('maps a network failure to Unavailable', async () => {
+        stubFetchFailure(new Error('network down'));
+        const provider = createProvider();
+
+        await provider.readFile(assetUri('theia.foo/1.0.0/icon.svg')).then(
+            () => expect.fail('should have rejected'),
+            error => expect(error.code).to.equal(FileSystemProviderErrorCode.Unavailable));
+    });
+
+    it('rejects mutating operations as read-only', () => {
+        const provider = createProvider();
+        const uri = assetUri('theia.foo/1.0.0/icon.svg');
+
+        expect(() => provider.mkdir(uri)).to.throw().that.has.property('code', FileSystemProviderErrorCode.NoPermissions);
+        expect(() => provider.delete(uri, { recursive: false, useTrash: false })).to.throw()
+            .that.has.property('code', FileSystemProviderErrorCode.NoPermissions);
+        expect(() => provider.rename(uri, uri, { overwrite: false })).to.throw()
+            .that.has.property('code', FileSystemProviderErrorCode.NoPermissions);
+        expect(() => provider.writeFile(uri, new Uint8Array(), { create: true, overwrite: true })).to.throw()
+            .that.has.property('code', FileSystemProviderErrorCode.NoPermissions);
+    });
+
+    it('resolves the request URL through Endpoint, re-encoding # ? % and spaces while keeping / literal', async () => {
+        stubFetch(() => new Response(undefined, { status: 200 }));
+        const provider = createProvider();
+
+        await provider.stat(assetUri('theia.foo/1.0.0/a b#c?d%e.svg'));
+
+        expect(requests).to.deep.equal([{
+            url: 'http://localhost/hostedPlugin/theia.foo/1.0.0/a%20b%23c%3Fd%25e.svg',
+            method: 'HEAD'
+        }]);
+    });
+});