Remote extension fails to activate in web worker extension host

[jeanp413]

• VS Code Version: stable and insiders

For this release 1.65 work was done to make it possible to run an extension installed in the remote inside the web worker extension host #141322

This works when running from sources because the web worker runs of the same origin, but the extension fails to activate both in gitpod and codespaces as the web worker runs on a different origin

It fails when fetching the extension entry point here due to a CORS error in the case of codespaces

webWorkerExtensionHostIframe.html:1 Access to fetch at 'https://jeanp413-gitpod-io-openvscode-server-5rvpx565c4qjx.github.dev/assets/0E16C542C4693E3A109F688CFA203819C5AE/38169/vscode-remote-resource?path=%2Fhome%2Fnode%2F.vscode-remote%2Fextensions%2Fvscodevim.vim-1.22.2%2Fout%2FextensionWeb.js&tkn=0804c611-3408-48a8-a35e-e48ca74f3288' from origin 'https://ef3f0b9f-43aa-4956-a381-e7dbd064af43.vscode-webview.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[jeanp413]

Created a PR #144515 fixing this.
cc @alexdima

[connor4312]

Are there verification steps for this?

[alexdima]

@jeanp413 Could you please verify?

[jeanp413]

@alexdima not working

[alexdima]

I have debugged this and the root cause is that these requests are not caught by the service worker installed on the main thread's origin. The only reasonable solution would be the one proposed in #144515 where we would go to the main thread to make the request, but we would need to do this only for embedders like Codespaces.

[fxpw]

hello
I received a similar error
Access to fetch at 'https://api.openai.com/v1/chat/completions' from origin 'vscode-file://vscode-app' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.