From 9562ac0f246b8ea3b84658a6caeb3ba301d2400c Mon Sep 17 00:00:00 2001
From: Alex Ross <38270282+alexr00@users.noreply.github.com>
Date: Wed, 10 Sep 2025 11:43:15 +0200
Subject: [PATCH] Only do forwarding for local extension host if there's a
 tunnel provider (#266014)

---
 src/vs/workbench/api/browser/mainThreadTunnelService.ts | 4 ++++
 src/vs/workbench/api/common/extHost.api.impl.ts         | 4 ++--
 src/vs/workbench/api/common/extHost.protocol.ts         | 1 +
 src/vs/workbench/api/common/extHostTunnelService.ts     | 5 +++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/vs/workbench/api/browser/mainThreadTunnelService.ts b/src/vs/workbench/api/browser/mainThreadTunnelService.ts
index 4aa5a7c1d48..54e452dcd42 100644
--- a/src/vs/workbench/api/browser/mainThreadTunnelService.ts
+++ b/src/vs/workbench/api/browser/mainThreadTunnelService.ts
@@ -207,6 +207,10 @@ export class MainThreadTunnelService extends Disposable implements MainThreadTun
 		}
 	}
 
+	async $hasTunnelProvider(): Promise<boolean> {
+		return this.tunnelService.hasTunnelProvider;
+	}
+
 	async $setCandidateFilter(): Promise<void> {
 		this.remoteExplorerService.setCandidateFilter((candidates: CandidatePort[]): Promise<CandidatePort[]> => {
 			return this._proxy.$applyCandidateFilter(candidates);
diff --git a/src/vs/workbench/api/common/extHost.api.impl.ts b/src/vs/workbench/api/common/extHost.api.impl.ts
index 9afd4467b0e..65587b00b7a 100644
--- a/src/vs/workbench/api/common/extHost.api.impl.ts
+++ b/src/vs/workbench/api/common/extHost.api.impl.ts
@@ -422,9 +422,9 @@ export function createApiFactoryAndRegisterActors(accessor: ServicesAccessor): I
 				ExtHostTelemetryLogger.validateSender(sender);
 				return extHostTelemetry.instantiateLogger(extension, sender, options);
 			},
-			openExternal(uri: URI, options?: { allowContributedOpeners?: boolean | string }) {
+			async openExternal(uri: URI, options?: { allowContributedOpeners?: boolean | string }) {
 				return extHostWindow.openUri(uri, {
-					allowTunneling: !!initData.remote.authority,
+					allowTunneling: initData.remote.isRemote ?? (initData.remote.authority ? await extHostTunnelService.hasTunnelProvider() : false),
 					allowContributedOpeners: options?.allowContributedOpeners,
 				});
 			},
diff --git a/src/vs/workbench/api/common/extHost.protocol.ts b/src/vs/workbench/api/common/extHost.protocol.ts
index 88ea921a3fa..84f618ad7e4 100644
--- a/src/vs/workbench/api/common/extHost.protocol.ts
+++ b/src/vs/workbench/api/common/extHost.protocol.ts
@@ -1767,6 +1767,7 @@ export interface MainThreadTunnelServiceShape extends IDisposable {
 	$closeTunnel(remote: { host: string; port: number }): Promise<void>;
 	$getTunnels(): Promise<TunnelDescription[]>;
 	$setTunnelProvider(features: TunnelProviderFeatures | undefined, enablePortsView: boolean): Promise<void>;
+	$hasTunnelProvider(): Promise<boolean>;
 	$setRemoteTunnelService(processId: number): Promise<void>;
 	$setCandidateFilter(): Promise<void>;
 	$onFoundNewCandidates(candidates: CandidatePort[]): Promise<void>;
diff --git a/src/vs/workbench/api/common/extHostTunnelService.ts b/src/vs/workbench/api/common/extHostTunnelService.ts
index 17d8417ea55..ecaf6a847be 100644
--- a/src/vs/workbench/api/common/extHostTunnelService.ts
+++ b/src/vs/workbench/api/common/extHostTunnelService.ts
@@ -57,6 +57,7 @@ export interface IExtHostTunnelService extends ExtHostTunnelServiceShape {
 	setTunnelFactory(provider: vscode.RemoteAuthorityResolver | undefined, managedRemoteAuthority: vscode.ManagedResolvedAuthority | undefined): Promise<IDisposable>;
 	registerPortsAttributesProvider(portSelector: PortAttributesSelector, provider: vscode.PortAttributesProvider): IDisposable;
 	registerTunnelProvider(provider: vscode.TunnelProvider, information: vscode.TunnelInformation): Promise<IDisposable>;
+	hasTunnelProvider(): Promise<boolean>;
 }
 
 export const IExtHostTunnelService = createDecorator<IExtHostTunnelService>('IExtHostTunnelService');
@@ -169,6 +170,10 @@ export class ExtHostTunnelService extends Disposable implements IExtHostTunnelSe
 		}));
 	}
 
+	hasTunnelProvider(): Promise<boolean> {
+		return this._proxy.$hasTunnelProvider();
+	}
+
 	/**
 	 * Applies the tunnel metadata and factory found in the remote authority
 	 * resolver to the tunnel system.