Use deny list for non-linkable endpoint URLs in extension

[adamint]

Description

Replace the HTTP/HTTPS allow list with a deny list matching the dashboard's KnownUnsupportedUrlSchemes for determining which endpoint URLs are clickable in the VS Code extension tree view and tooltips.

The previous fix (#15514) only made http:// and https:// URLs clickable, but as @JamesNK pointed out, custom schemes like vscode:// should also be clickable since they can hand off to apps registered with the OS. The dashboard uses a deny list approach for this reason.

Changes:

• Added extension/src/utils/urlSchemes.ts with a deny list of 9 unsupported schemes (gopher, ws, wss, news, nntp, telnet, tcp, redis, rediss) mirroring src/Shared/KnownUnsupportedUrlSchemes.cs
• Updated EndpointUrlItem constructor to use isLinkableUrl() instead of HTTP-only check
• Updated buildResourceTooltip to use isLinkableUrl() instead of startsWith('http') check
• Added unit tests for the isLinkableUrl helper

Fixes #15472

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire.dev issue:
      • New issue
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 15894

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 15894"

[Copilot]

Pull request overview

This PR updates the VS Code extension’s logic for determining whether endpoint URLs should be clickable by switching from an HTTP(S) allow-list to a scheme deny-list aligned with the dashboard’s KnownUnsupportedUrlSchemes.

Changes:

• Added isLinkableUrl() helper with a deny list of unsupported URL schemes.
• Updated the tree view endpoint items and resource tooltip generation to use isLinkableUrl() instead of HTTP-only checks.
• Added unit tests covering linkable vs non-linkable schemes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
extension/src/views/AspireAppHostTreeProvider.ts	Uses isLinkableUrl() to decide endpoint clickability and which URLs appear in tooltips.
extension/src/utils/urlSchemes.ts	Introduces the deny-list-based isLinkableUrl() helper.
extension/src/test/urlSchemes.test.ts	Adds unit tests validating isLinkableUrl() behavior across schemes.

Comments suppressed due to low confidence (1)

extension/src/views/AspireAppHostTreeProvider.ts:109

• EndpointUrlItem now assigns contextValue = 'endpointUrl' for any scheme that passes isLinkableUrl(), not just HTTP(S). This will also enable the existing context-menu actions (notably openInSimpleBrowser / "Open in VS Code") for custom schemes like vscode:// or ftp://, which may not be intended or supported by the simple browser. Consider splitting the context value (e.g., endpointUrlHttp vs endpointUrlLinkable) so that only HTTP(S) endpoints offer the simple-browser action while other linkable schemes only offer external open/copy.

        const uri = vscode.Uri.parse(url);
        if (isLinkableUrl(url)) {
            this.iconPath = new vscode.ThemeIcon('link-external');
            this.contextValue = 'endpointUrl';
            this.command = {
                command: 'vscode.open',
                title: url,
                arguments: [uri]
            };
        } else {
            this.iconPath = new vscode.ThemeIcon('radio-tower');
            this.contextValue = 'endpointUrlNonHttp';
        }

[JamesNK]

Also add a comment to KnownUnsupportedUrlSchemes that values are mirrored here. That way someone (aka AI) knows to update both places.