For developer-platform teams who ship their platform's own editor extension
VSIX ReadyWill this extension hold the contract - and is this version ready to publish?
Paste your VS Code extension's package.json, its publish workflow and the previous version's manifest, and get the extension contract, registries, auth, telemetry and versioning checked, then the go/no-go plan per job or the release-gate plan for this version. Your browser reads both manifests and the workflow and flags activation on *, a credential in a setting, a telemetry switch the host cannot overrule, Open VSX never published, two different files to two registries, a personal access token in CI, workspace trust widened, an even minor marked pre-release and a published ID that changed, then writes a fixed package.json and a fixed publish workflow.
The extension, its workflow and the previous version free
Read with JSON.parse; a paste that does not parse is named by its line and column. Read: name, publisher, displayName, version, engines.vscode, main, browser, activationEvents, contributes (commands, configuration, views, walkthroughs, authentication, jsonValidation, languages, debuggers, mcpServerDefinitionProviders), capabilities, extensionKind, extensionDependencies, extensionPack, scripts, dependencies, repository, icon and keywords. Nothing is run or installed.
Scanned as text, line by line: vsce package, vsce publish (-p, --pat or VSCE_PAT against --azure-credential or --oidc, and --packagePath), ovsx publish (-p or OVSX_PAT against --trusted-publishing), id-token: write, a secret scan, tests and the Plugin Verifier. A token written into the file is never echoed back.
The interview - each answer moves a check, a ladder or a gate free
The checks free
What the page flags
The manifest as read
The publish workflow, signal by signal
Every check, rule by rule
The manifest diff - what each change does to users
The ladders - jobs, editor families and auth
The release gates
The version and the compatibility matrix
Do the verdicts agree with the checks?
The fixed package.json, the fixed workflow and the exports free
The fixed package.json
"*" leaves activationEvents only when other events remain; a missing workspace-trust declaration becomes "limited" with a description when the extension runs the CLI; credential settings move out of contributes.configuration into a note. Every other field is copied as pasted - no command, ID, event or version is invented.
The fixed publish workflow
Package once, scan the packed file, publish that same file to both registries with federated credentials, print its hash - built from your package's own name and version, and your own scanner when the workflow names one.
The deprecation notice
From the skill's template, when the interview says this extension is being deprecated: your replacement and date, or a placeholder - never an invented date.
The go/no-go plan metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved extensions
How it works - and what is sourced
The checks follow the skill's extension contract (six rules), its architecture, auth, sync, publishing, telemetry and release sections, and its Gates list, plus its references on registry publishing, plan templates and vendor patterns. Both manifests are read with JSON.parse; a paste that does not parse is named by its line and column. The workflow and the plugin.xml are scanned as text with a fixed set of signal kinds - nothing is run, installed or fetched. A manifest change is one of twelve fixed kinds, identified by its kind and its subject (a setting by its key, a command by its ID), each with what it does to users and the skill's safe alternative: deprecate, never remove; narrow, never widen; a published ID never changes.
The job ladder runs JSON schema, language server, MCP server, CLI command, thin shell, shell plus launch configurations, rich extension: a schema for a config file, an MCP server for agents, a CLI command for a local process, a thin shell over the CLI or language server for jobs that need editor UI; a sales ask alone is go later, no owner is no-go, and the rich extension needs a staffed owner. The family ladder starts from one VS Code-API extension on both registries; JetBrains is promoted only when its users are the second-largest group and a Kotlin or Java owner fits. The auth ladder reuses the CLI login by default and promotes the AuthenticationProvider when the product issues OAuth to desktop clients. Every verdict is checked against every check that argues about the same thing. A saved extension keeps a snapshot of its checks, so reopening it shows what changed since you saved it.
Every registry figure carries a dagger: an extension listed for 6+ months† and a domain registered 6+ months† for the verified-publisher badge, about 5 business days† of review; three platform majors† a year on JetBrains; global Azure DevOps PATs end on 2026-12-01†; the pre-release channel needs engines.vscode 1.63.0† or above; vsce publish --oidc needs Node 22+†; a PNG icon of at least 128 px†; at most 30 keywords†; the JetBrains LSP API needs 2023.2+† and runs in the free tier of unified PyCharm since 2025.1†. The page never knows a VS Code fork's Code-OSS base version and never guesses one.
† verify against the current registry documentation (VS Code Marketplace, Open VSX, JetBrains Marketplace) before quoting it.