Extension authoring notes

Prefer workspaceFolders over rootPath

workspace.rootPath is deprecated. Use workspace.workspaceFolders (and workspace.getWorkspaceFolder) so multi-root workspaces work correctly.

const folder = vscode.workspace.workspaceFolders?.[0]?.uri.fsPath;

If you still read rootPath, the extension host logs a deprecation warning that points here.

navigator is a Node.js global

Recent Node.js versions define navigator as a global. Many older extensions used typeof navigator !== 'undefined' to detect a browser. In the Gyaanmitra extension host, that check is no longer reliable.

Prefer an explicit check (for example process.versions.node, or an API your extension already uses). When the host spots this pitfall, it raises a migration error that links to this section.

Use webview.asWebviewUri

Do not embed vscode-resource: URLs in webview HTML. Convert local resources with webview.asWebviewUri:

const scriptUri = webview.asWebviewUri(
  vscode.Uri.joinPath(extensionUri, "media", "main.js"),
);

Old vscode-resource: rewriting still works for now. The host logs a deprecation warning when it sees those URLs.

Always set a Content Security Policy

Every webview should include a Content-Security-Policy meta tag (or header) that allows only the scripts, styles, and frames your UI needs. If CSP is missing, the host logs a warning, because the webview is less isolated from the rest of the workbench.

<meta
  http-equiv="Content-Security-Policy"
  content="default-src 'none'; style-src ${webview.cspSource}; script-src 'nonce-…';"
/>

Use webview.cspSource for local resources loaded with asWebviewUri. For inline scripts, prefer nonces or hashes.

Related

• Extensions & Open VSX: installing and managing extensions
• Open VSX: publishing and browsing the gallery