Trust plugin data: URIs in the VS Code renderer

Fixes #490

marimo 0.23.2 (marimo-team/marimo#9196) re-allows plugins to load base64
`data:` URIs, but only once `hasRunAnyCellAtom` is `true`,and that atom
only flips inside marimo's `useRunCells` hook, which our renderer never
calls (cells run through VS Code's NotebookController). Seed it at
`initialize()` so holoviews/bokeh and anywidget-backed outputs like
polars tables stop failing with "Refusing to load … from untrusted URL".

Workspace trust and extension ownership of the kernel are used as the
signal the atom is standing in for.

Author: manzt

.marimo-version

@@ -1 +1 @@
-0.23.1
+0.23.2

extension/src/constants.ts

@@ -55,7 +55,7 @@ export const LanguageId = {
 export const MINIMUM_MARIMO_KERNEL_VERSION = {
   major: 0,
   minor: 23,
-  patch: 1,
+  patch: 2,
 } as const;
 
 export type MarimoContextKey =

extension/src/python/__tests__/EnvironmentValidator.test.ts

@@ -120,7 +120,7 @@ it.layer(EnvironmentValidatorLive)("EnvironmentValidator", (it) => {
       	    "requiredVersion": {
       	      "major": 0,
       	      "minor": 23,
-      	      "patch": 1,
+      	      "patch": 2,
       	    },
       	  },
       	]

extension/src/renderer/marimo-frontend-untyped.js

@@ -37,6 +37,17 @@
  * a clear boundary between typed and untyped code.
  */
 
+// TODO(marimo-team/marimo#TODO): move `hasRunAnyCellAtom` and the anywidget
+// model re-exports back into `marimo-frontend.ts` once marimo extracts the
+// atom into a leaf module. They're forced through this bridge because
+// `plugins/core/trusted-url.ts` (reached via `anywidget/widget-binding.ts`)
+// imports from `useRunCells.ts`, whose transitive closure blows up tsc.
+export { hasRunAnyCellAtom } from "@marimo-team/frontend/unstable_internal/components/editor/cell/useRunCells.ts";
+export {
+  handleWidgetMessage,
+  MODEL_MANAGER,
+} from "@marimo-team/frontend/unstable_internal/plugins/impl/anywidget/model.ts";
+
 export { OutputRenderer } from "@marimo-team/frontend/unstable_internal/components/editor/Output.tsx";
 export { ConsoleOutput } from "@marimo-team/frontend/unstable_internal/components/editor/output/console/ConsoleOutput.tsx";
 export { TooltipProvider } from "@marimo-team/frontend/unstable_internal/components/ui/tooltip.tsx";

extension/src/renderer/marimo-frontend.ts

@@ -22,10 +22,6 @@ import type {
   RunRequests,
 } from "@marimo-team/frontend/unstable_internal/core/network/types.ts";
 import { store } from "@marimo-team/frontend/unstable_internal/core/state/jotai.ts";
-import {
-  handleWidgetMessage,
-  MODEL_MANAGER,
-} from "@marimo-team/frontend/unstable_internal/plugins/impl/anywidget/model.ts";
 import { safeExtractSetUIElementMessageBuffers } from "@marimo-team/frontend/unstable_internal/utils/json/base64.ts";
 
 import type { NotificationOf, CellRuntimeState } from "../types.ts";
@@ -53,6 +49,16 @@ export type { CellRuntimeState, CellId };
 export function initialize(client: RequestClient) {
   store.set(initialModeAtom, "edit");
   store.set(requestClientAtom, client);
+  // Trust data: URIs from plugins without waiting for a run through marimo's
+  // React UI — VS Code gates notebook open on workspace trust, and cell runs
+  // flow through the extension's NotebookController (bypassing useRunCells),
+  // so the atom would otherwise stay false forever.
+  //
+  // TODO: route through the untyped bridge because marimo 0.23.2 defines this
+  // atom in `components/editor/cell/useRunCells.ts`, whose transitive closure
+  // (CodeMirror, cells state, data-table UI, etc.) blows up tsc. Once the atom
+  // moves to a leaf file upstream (marimo-team/marimo#TODO), import directly.
+  store.set(untyped.hasRunAnyCellAtom, true);
 
   untyped.initializePlugins();
   // Start the RuntimeState to listen for UI element value changes
@@ -74,7 +80,11 @@ export function handleSendUiElementMessage(
 }
 
 export function handleModelLifecycle(msg: NotificationOf<"model-lifecycle">) {
-  void handleWidgetMessage(MODEL_MANAGER, msg);
+  // TODO: route through the untyped bridge because
+  // `plugins/impl/anywidget/model.ts` transitively imports `trusted-url.ts`,
+  // which in marimo 0.23.2 pulls in `useRunCells.ts` and its heavy closure.
+  // Drop once the upstream atom move lands (marimo-team/marimo#TODO).
+  void untyped.handleWidgetMessage(untyped.MODEL_MANAGER, msg);
 }
 
 export function handleFunctionCallResult(

pyproject.toml

@@ -8,7 +8,7 @@ authors = [{ name = "Trevor Manz", email = "trevor.j.manz@gmail.com" }]
 dependencies = [
   "jupytext==1.19.1",
   "lsprotocol==2025.0.0",
-  "marimo==0.23.1",
+  "marimo==0.23.2",
   "pygls==2.1.1",
 ]
 
@@ -37,7 +37,7 @@ build-backend = "uv_build"
 # the update-marimo-version cron), while the value below is the compatibility
 # floor we claim to support for user kernels and is bumped manually when we
 # intentionally drop support for an older release.
-minimum-kernel-version = "0.23.1"
+minimum-kernel-version = "0.23.2"
 
 [tool.ty.src]
 exclude = ["extension/**"]

src/marimo_lsp/api.py

@@ -355,6 +355,7 @@ async def export_as_ipynb(
     session_data = serialize_session_view(
         session.session_view,
         cell_ids=session.app_file_manager.app.cell_manager.cell_ids(),
+        drop_virtual_file_outputs=True,
     )
     ipynb.setdefault("metadata", {}).setdefault("marimo", {})["session"] = session_data
     return json.dumps(ipynb)

src/marimo_lsp/kernel_manager.py

@@ -114,7 +114,7 @@ def __init__(
                 app_config=app_file_manager.app.config,
             ),
             redirect_console_to_browser=True,
-            virtual_files_supported=False,
+            virtual_file_storage=None,
         )
         self.executable = executable
         self.connection_info = connection_info