Does this issue occur when all extensions are disabled?: Yes

• VS Code Version: 1.106.3
• OS Version: Windows 10

Steps to Reproduce:

1. Create an extension project using an npm workspace (or pnpm, Yarn) with multiple packages.
2. Call vscode.window.registerCustomEditorProvider from a secondary package (not the one with the extension entry point).
3. Notice that the custom editor doesn't open correctly, with a 401 error (unauthorized) for all resources.

The WebviewOptions.localResourceRoots says:

Default to ... the extension's install directory.

But this is clearly not respected. Is this an expected behavior? It looks like VS Code is able to infer the editor is registered from another package. Note that this only happens when the code is not bundled (e.g., when running the extension host for development purposes).

The workaround is to explicitly specify localResourceRoots:

resolveCustomEditor(document: MyEditorDocument, webviewPanel: vscode.WebviewPanel, token: vscode.CancellationToken): void {
  // ...
  webviewPanel.webview.options = {
    enableScripts: true,
    localResourceRoots: [webviewBaseUri],
  };
  // ...
}