Extension authoring notes

Prefer workspaceFolders over rootPath

workspace.rootPath is deprecated. Use workspace.workspaceFolders (and workspace.getWorkspaceFolder) so multi-root workspaces work correctly.

const folder = vscode.workspace.workspaceFolders?.[0]?.uri.fsPath;

If you still read rootPath, the extension host logs a deprecation warning pointing here.

navigator is a Node.js global

Recent Node.js versions define navigator as a global. Many older extensions used typeof navigator !== 'undefined' to detect a browser environment. In the Gunamaya extension host that check is no longer reliable.

Prefer explicit environment checks (for example process.versions.node, or APIs your extension already uses) instead of testing for navigator. When the host detects this pitfall it raises a migration error that links to this section.

Use webview.asWebviewUri

Do not embed vscode-resource: URLs in webview HTML. Convert local resources with webview.asWebviewUri:

const scriptUri = webview.asWebviewUri(
  vscode.Uri.joinPath(extensionUri, "media", "main.js"),
);

Legacy vscode-resource: rewriting still works temporarily, but the host emits a deprecation warning when it detects those URLs.

Always set a Content Security Policy

Every webview should include a Content-Security-Policy meta tag (or header) that allows only the scripts, styles, and frames your UI needs. Missing CSP is logged as a warning because it weakens isolation between the webview and the rest of the workbench.

<meta
  http-equiv="Content-Security-Policy"
  content="default-src 'none'; style-src ${webview.cspSource}; script-src 'nonce-…';"
/>

Use webview.cspSource for local resources loaded via asWebviewUri, and prefer nonces or hashes for inline scripts.

Related

• Extensions & Open VSX — installing and managing extensions
• Open VSX — publishing and browsing the gallery