@mnci/cli 4.11.0 → 4.12.1

package/dist/cli.js

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(main_exports);
 var import_commander = require("commander");
 
 // src/project-scaffolding/add-project.use-case.ts
-var import_node_path18 = require("path");
+var import_node_path19 = require("path");
 var import_prompts3 = require("@inquirer/prompts");
 
 // src/nx-workspace/nx.client.ts
@@ -433,11 +433,12 @@ ${feedShortKey}:_password=\${PAT}
 ${feedShortKey}:email=npm-requires-this-and-never-uses-it
 `;
 }
+var VSCODE_EXTENSION_TAG = "type:vscode-extension";
 function releaseConfig(ci) {
   const githubReleases = ci === "github";
   return {
     projectsRelationship: "independent",
-    projects: ["packages/*", "python-packages/*", "!tag:type:go-lib"],
+    projects: ["packages/*", "python-packages/*", `tag:${VSCODE_EXTENSION_TAG}`, "!tag:type:go-lib"],
     releaseTag: { pattern: "{projectName}@{version}" },
     git: { commit: false, tag: true, push: githubReleases },
     version: {
@@ -449,7 +450,7 @@ function releaseConfig(ci) {
       // Set here at `new` time it wins: the generator only fills this in when
       // absent (it spreads the existing release.version over its default). Both
       // globs are listed; `nx run-many` no-ops cleanly when one matches nothing.
-      preVersionCommand: "npx nx run-many -t build --projects=packages/*,python-packages/*",
+      preVersionCommand: `npx nx run-many -t build --projects=packages/*,python-packages/*,tag:${VSCODE_EXTENSION_TAG}`,
       // The lock file resync is OFF, and the reason is that it cannot succeed
       // on the one release where it would matter.
       //
@@ -476,7 +477,12 @@ function releaseConfig(ci) {
     },
     changelog: githubReleases ? {
       workspaceChangelog: false,
-      projectChangelogs: { createRelease: "github", file: false }
+      projectChangelogs: { createRelease: "github", file: false },
+      // A GitHub Release needs a changelog, and a changelog needs a ref to start
+      // from. On the first release of a repository there is no tag to start from,
+      // and nx release dies after versioning (#243, measured). With this set it
+      // starts from the first commit; once a tag exists it is never consulted.
+      automaticFromRef: true
     } : { workspaceChangelog: false }
   };
 }
@@ -1039,7 +1045,7 @@ function pypiReleasePreflight(registryKind) {
 }
 var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
 function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
-  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
+  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const vscodeCount=fs.globSync('apps/*/package.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).nx?.tags||[]).includes('${VSCODE_EXTENSION_TAG}')}catch{return false}}).length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;const hasVscode=vscodeCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart&&!hasVscode){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount+vscodeCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
 }
 var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
 var AZURE_PAT_VARIABLE = "PAT";
@@ -1370,11 +1376,14 @@ ${npmAuthPreflight(registryKind) ? `
   # the run rather than under-bumping silently: clear the variable back to
   # '' once the override is no longer needed.
   - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
-    displayName: Release \u2014 version, tag and publish (npm + Python + C#)
+    displayName: Release \u2014 version, tag and publish (npm + Python + C# + VS Code)
     condition: ${onMain}
     env:
       ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `$(${name})`, " ".repeat(6))}
       RELEASE_SPECIFIER: $(RELEASE_SPECIFIER)
+      # A VS Code extension publishes with it; tools/vscode-extension.cjs skips the
+      # Marketplace when it is unset, including when Azure leaves it as '$(VSCE_PAT)'.
+      VSCE_PAT: $(VSCE_PAT)
 
   # nx release's own git push (release.git.push) is deliberately left off: it
   # only runs when a remote GitHub/GitLab Release is configured, which this
@@ -1626,11 +1635,14 @@ ${npmAuthPreflight(registryKind) ? `
       # releaseConfig's remarks for why that is safe on this Nx version and
       # why every other provider combination keeps the explicit push step below.` : ""}
       - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
-        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C#)
+        name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C# + VS Code)
         if: \${{ ${onMain} }}
         env:
           ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `\${{ secrets.${name} }}`, " ".repeat(10))}
-          RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}${githubReleases ? `
+          RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}
+          # A VS Code extension publishes with it; tools/vscode-extension.cjs
+          # skips the Marketplace when it is unset.
+          VSCE_PAT: \${{ secrets.VSCE_PAT }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
 ${githubReleases ? "" : `
       # nx release's own git push (release.git.push) is deliberately left off: it
@@ -3789,12 +3801,392 @@ function addReactInternalLib(workspaceRoot, name, stack) {
   );
 }
 
+// src/project-scaffolding/vscode-extension.use-case.ts
+var import_node_fs11 = require("fs");
+var import_node_path15 = require("path");
+var VSCODE_EXTENSION_SCRIPT_PATH = "tools/vscode-extension.cjs";
+var VSCODE_SIDECAR_TARGETS = {
+  "win32-x64": "windows-amd64",
+  "win32-arm64": "windows-arm64",
+  "linux-x64": "linux-amd64",
+  "linux-arm64": "linux-arm64",
+  "alpine-x64": "linux-amd64",
+  "alpine-arm64": "linux-arm64",
+  "darwin-x64": "darwin-amd64",
+  "darwin-arm64": "darwin-arm64"
+};
+var VSCODE_EXTENSION_SCRIPT = String.raw`#!/usr/bin/env node
+// Written by mnci: 'mnci add vscode-extension' creates it and 'mnci upgrade'
+// rewrites it, so local edits do not survive an upgrade.
+//
+// Packages and publishes a VS Code extension project. Its Nx targets call it:
+//   node tools/vscode-extension.cjs package apps/<name> [--sidecar <go-app>]
+//   node tools/vscode-extension.cjs publish apps/<name> [--sidecar <go-app>]
+// Without --sidecar: one universal dist/drop/<project>.vsix.
+// With --sidecar: one dist/drop/<project>-<target>.vsix per Marketplace target, each
+// carrying that platform's binary from the Go app's build-all in bin/.
+'use strict'
+const { spawnSync } = require('node:child_process')
+const { cpSync, existsSync, mkdirSync, readFileSync, rmSync } = require('node:fs')
+const { basename, dirname, join, resolve } = require('node:path')
+
+const TARGETS = ${JSON.stringify(VSCODE_SIDECAR_TARGETS)}
+const DROP = resolve('dist/drop')
+const VSCE_FLAGS = ['--no-dependencies', '--skip-license', '--allow-missing-repository']
+
+function fail (message) {
+  console.error(message)
+  process.exit(1)
+}
+
+function bin (packageName, command) {
+  const manifestPath = require.resolve(packageName + '/package.json', { paths: [process.cwd()] })
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  const entry = typeof manifest.bin === 'string' ? manifest.bin : manifest.bin[command]
+
+  return join(dirname(manifestPath), entry)
+}
+
+function run (packageName, command, args, options) {
+  const result = spawnSync(process.execPath, [bin(packageName, command), ...args], { stdio: 'inherit', ...options })
+  if (result.status !== 0) process.exit(result.status ?? 1)
+}
+
+function vsixFiles (name, sidecar) {
+  return sidecar
+    ? Object.keys(TARGETS).map(target => join(DROP, name + '-' + target + '.vsix'))
+    : [join(DROP, name + '.vsix')]
+}
+
+function packageExtension (projectRoot, manifest, sidecar) {
+  mkdirSync(DROP, { recursive: true })
+  if (!sidecar) {
+    run('@vscode/vsce', 'vsce', ['package', ...VSCE_FLAGS, '--out', vsixFiles(project)[0]], { cwd: projectRoot })
+
+    return
+  }
+  run('nx', 'nx', ['run', sidecar + ':build-all'], { env: { ...process.env, VERSION: manifest.version } })
+  const staging = join(projectRoot, 'bin')
+  try {
+    for (const [target, platform] of Object.entries(TARGETS)) {
+      const source = join('dist/platforms', sidecar, platform)
+      if (!existsSync(source)) fail('No ' + platform + ' build of ' + sidecar + ' at ' + source + ' - its build-all target did not write one.')
+      rmSync(staging, { recursive: true, force: true })
+      cpSync(source, staging, { recursive: true })
+      run('@vscode/vsce', 'vsce', ['package', '--target', target, ...VSCE_FLAGS, '--out', join(DROP, project + '-' + target + '.vsix')], { cwd: projectRoot })
+    }
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
+  }
+}
+
+function publishExtension (manifest, sidecar, dryRun) {
+  if (dryRun) {
+    console.log('Dry run - would publish ' + vsixFiles(project, sidecar).join(', ') + ' to the Marketplace.')
+
+    return
+  }
+  const token = process.env.VSCE_PAT ?? ''
+  if (token === '' || /^\$\(.*\)$/.test(token)) {
+    console.log('VSCE_PAT is not set - skipping the Marketplace publish of ' + manifest.name + '. Add it as a CI secret to publish.')
+
+    return
+  }
+  const files = vsixFiles(project, sidecar)
+  const missing = files.filter(file => !existsSync(file))
+  if (missing.length > 0) fail('Nothing to publish: ' + missing.join(', ') + ' not found - run the package target first.')
+  run('@vscode/vsce', 'vsce', ['publish', '--packagePath', ...files, '--skip-duplicate'])
+}
+
+const [command, projectRoot, ...rest] = process.argv.slice(2)
+const sidecarIndex = rest.indexOf('--sidecar')
+const sidecar = sidecarIndex === -1 ? undefined : rest[sidecarIndex + 1]
+if (!projectRoot || !existsSync(join(projectRoot, 'package.json'))) fail('Usage: node tools/vscode-extension.cjs package|publish <project root> [--sidecar <go-app>]')
+const manifest = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'))
+// Packages are named after the project folder, never the manifest name, which is
+// free to change (the Marketplace id need not match the folder).
+const project = basename(resolve(projectRoot))
+// nx release --dry-run hands the publish target --dryRun=true and sets NX_DRY_RUN
+// (measured on Nx 23), so a dry run never reaches the Marketplace, token or not.
+const dryRun = rest.some(argument => /^--dry-?run(=true)?$/i.test(argument)) || process.env.NX_DRY_RUN === 'true'
+if (command === 'package') packageExtension(projectRoot, manifest, sidecar)
+else if (command === 'publish') publishExtension(manifest, sidecar, dryRun)
+else fail('Unknown command ' + command + ' - expected package or publish.')
+`;
+var VSCODE_IGNORE = `src/**
+test/**
+out-tsc/**
+test-output/**
+**/*.map
+**/*.d.ts
+**/*.spec.*
+tsconfig*.json
+jest.config.*
+vitest.config.*
+.spec.swcrc
+node_modules/**
+`;
+function vscodeExtensionMain(name) {
+  return `import * as vscode from 'vscode'
+
+export function activate (context: vscode.ExtensionContext): void {
+  context.subscriptions.push(
+    vscode.commands.registerCommand('${name}.hello', () => {
+      void vscode.window.showInformationMessage('Hello from ${name}')
+    }),
+  )
+}
+
+export function deactivate (): void {}
+`;
+}
+function vscodeExtensionMainSpec(name) {
+  return `import * as vscode from 'vscode'
+import { activate } from './main'
+
+describe('activate', () => {
+  it('registers the ${name}.hello command', async () => {
+    const context = { subscriptions: [] } as unknown as vscode.ExtensionContext
+
+    activate(context)
+
+    expect(context.subscriptions).toHaveLength(1)
+    expect(await vscode.commands.getCommands()).toContain('${name}.hello')
+  })
+})
+`;
+}
+var VSCODE_STUB = `// Stands in for the 'vscode' module in unit tests: that module exists only
+// inside the extension host. Extend it as the extension reaches for more API.
+const registered = new Map<string, (...arguments_: unknown[]) => unknown>()
+
+export const commands = {
+  registerCommand (id: string, handler: (...arguments_: unknown[]) => unknown): { dispose: () => void } {
+    registered.set(id, handler)
+
+    return { dispose: () => { registered.delete(id) } }
+  },
+  getCommands (): Promise<string[]> {
+    return Promise.resolve(registered.keys().toArray())
+  },
+  executeCommand (id: string, ...arguments_: unknown[]): Promise<unknown> {
+    return Promise.resolve(registered.get(id)?.(...arguments_))
+  },
+}
+
+export const window = {
+  showInformationMessage (_message: string): Promise<undefined> {
+    return Promise.resolve(undefined)
+  },
+}
+`;
+var VSCODE_STUB_PATH = "test/vscode.stub.ts";
+function mapVscodeToStub(projectRoot, testRunner) {
+  const [file, anchor, mapping] = testRunner === "jest" ? ["jest.config.cts", "testEnvironment: 'node',", `moduleNameMapper: { '^vscode$': '<rootDir>/${VSCODE_STUB_PATH}' },`] : ["vitest.config.mts", "environment: 'node',", `alias: { vscode: \`\${import.meta.dirname}/${VSCODE_STUB_PATH}\` },`];
+  const path = (0, import_node_path15.join)(projectRoot, file);
+  const content = fileExists(path) ? (0, import_node_fs11.readFileSync)(path, "utf8") : "";
+  const line = content.split("\n").find((candidate) => candidate.trim() === anchor);
+  if (line === void 0) {
+    throw new Error(`${file} has no "${anchor}" line to map the vscode module after; map 'vscode' to ${VSCODE_STUB_PATH} by hand.`);
+  }
+  const indent = line.slice(0, line.indexOf(anchor));
+  writeFileEnsured(path, content.replace(line, () => `${line}
+${indent}${mapping}`));
+}
+function ensureVscodeToolchain(workspaceRoot) {
+  const missing = ["@types/vscode", "@vscode/vsce"].filter((name) => !hasPlugin(workspaceRoot, name));
+  if (missing.length === 0) {
+    return;
+  }
+  logger.step(`Installing the VS Code extension toolchain (${missing.join(", ")})`);
+  if (runShell("npm", ["install", "--save-dev", ...missing, "--no-audit", "--no-fund"], workspaceRoot) !== 0) {
+    throw new Error(`npm install of ${missing.join(", ")} failed`);
+  }
+}
+function defaultPublisher(workspaceRoot) {
+  const { name } = readJson((0, import_node_path15.join)(workspaceRoot, "package.json"));
+  return (name ?? "publisher").replace(/^@/, "").split("/", 1)[0];
+}
+function reshapeManifest(projectRoot, name, publisher, typesVersion) {
+  const manifestPath = (0, import_node_path15.join)(projectRoot, "package.json");
+  const manifest = readJson(manifestPath);
+  const { nx = {}, ...rest } = manifest;
+  const targets = { ...nx.targets };
+  for (const target of ["serve", "prune", "prune-lockfile", "copy-workspace-modules"]) {
+    delete targets[target];
+  }
+  const build = targets.build ?? {};
+  targets.build = {
+    ...build,
+    options: {
+      ...build.options,
+      bundle: true,
+      thirdParty: true,
+      external: ["vscode"],
+      generatePackageJson: false
+    }
+  };
+  writeFileEnsured(
+    manifestPath,
+    toJson({
+      ...rest,
+      name,
+      displayName: name,
+      version: rest.version ?? "0.0.1",
+      publisher,
+      engines: { vscode: `^${typesVersion}` },
+      categories: ["Other"],
+      main: "./dist/main.js",
+      activationEvents: [],
+      contributes: { commands: [{ command: `${name}.hello`, title: `${name}: Hello` }] },
+      nx: { ...nx, name, tags: [.../* @__PURE__ */ new Set([...nx.tags ?? [], VSCODE_EXTENSION_TAG])], targets }
+    })
+  );
+}
+function addVscodeTypes(tsconfigPath) {
+  if (!fileExists(tsconfigPath)) {
+    return;
+  }
+  const tsconfig = readJson(tsconfigPath);
+  const compilerOptions = tsconfig.compilerOptions ?? {};
+  const types = compilerOptions.types ?? [];
+  if (types.includes("vscode")) {
+    return;
+  }
+  writeFileEnsured(tsconfigPath, toJson({ ...tsconfig, compilerOptions: { ...compilerOptions, types: [...types, "vscode"] } }));
+}
+function vscodeExtensionPackageTarget(name, sidecar) {
+  const outputs = sidecar ? Object.keys(VSCODE_SIDECAR_TARGETS).map((target) => `{workspaceRoot}/dist/drop/${name}-${target}.vsix`) : [`{workspaceRoot}/dist/drop/${name}.vsix`];
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["build"],
+    outputs,
+    options: { command: `node ${VSCODE_EXTENSION_SCRIPT_PATH} package apps/${name}${sidecar ? ` --sidecar ${sidecar}` : ""}` }
+  };
+}
+function vscodeExtensionPublishTarget(name, sidecar) {
+  return {
+    executor: "nx:run-commands",
+    dependsOn: ["package"],
+    options: { command: `node ${VSCODE_EXTENSION_SCRIPT_PATH} publish apps/${name}${sidecar ? ` --sidecar ${sidecar}` : ""}` }
+  };
+}
+function addDebugLaunch(workspaceRoot, name) {
+  const file = (0, import_node_fs11.readdirSync)(workspaceRoot).find((entry) => entry.endsWith(".code-workspace"));
+  if (file === void 0) {
+    return;
+  }
+  const path = (0, import_node_path15.join)(workspaceRoot, file);
+  const workspace = readCodeWorkspace(path) ?? {};
+  const folder = `\${workspaceFolder:${workspace.folders?.[0]?.name ?? file.replace(/\.code-workspace$/, "")}}`;
+  const taskLabel = `${name}: build (development)`;
+  const launchName = `${name}: debug`;
+  const tasks = (workspace.tasks?.tasks ?? []).filter((task) => task.label !== taskLabel);
+  const configurations = (workspace.launch?.configurations ?? []).filter((configuration) => configuration.name !== launchName);
+  writeFileEnsured(
+    path,
+    toJson({
+      ...workspace,
+      tasks: {
+        version: workspace.tasks?.version ?? "2.0.0",
+        tasks: [...tasks, { label: taskLabel, type: "shell", command: `npx nx run ${name}:build:development`, problemMatcher: [] }]
+      },
+      launch: {
+        version: workspace.launch?.version ?? "0.2.0",
+        configurations: [
+          ...configurations,
+          {
+            name: launchName,
+            type: "extensionHost",
+            request: "launch",
+            args: [`--extensionDevelopmentPath=${folder}/apps/${name}`],
+            outFiles: [`${folder}/apps/${name}/dist/**/*.js`],
+            preLaunchTask: taskLabel
+          }
+        ]
+      }
+    })
+  );
+}
+function refreshVscodeExtensionScript(workspaceRoot) {
+  const apps = (0, import_node_path15.join)(workspaceRoot, "apps");
+  let entries;
+  try {
+    entries = (0, import_node_fs11.readdirSync)(apps);
+  } catch {
+    return false;
+  }
+  const hasExtension = entries.some((entry) => {
+    const manifestPath = (0, import_node_path15.join)(apps, entry, "package.json");
+    if (!fileExists(manifestPath)) {
+      return false;
+    }
+    const tags = readJson(manifestPath).nx?.tags ?? [];
+    return tags.includes(VSCODE_EXTENSION_TAG);
+  });
+  const path = (0, import_node_path15.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH);
+  if (!hasExtension || fileExists(path) && (0, import_node_fs11.readFileSync)(path, "utf8") === VSCODE_EXTENSION_SCRIPT) {
+    return false;
+  }
+  writeFileEnsured(path, VSCODE_EXTENSION_SCRIPT);
+  return true;
+}
+function pinVscodeExtensionProjectNames(workspaceRoot) {
+  const apps = (0, import_node_path15.join)(workspaceRoot, "apps");
+  let entries;
+  try {
+    entries = (0, import_node_fs11.readdirSync)(apps);
+  } catch {
+    return [];
+  }
+  const updated = [];
+  for (const entry of entries) {
+    const manifestPath = (0, import_node_path15.join)(apps, entry, "package.json");
+    if (!fileExists(manifestPath)) {
+      continue;
+    }
+    const manifest = readJson(manifestPath);
+    if (!manifest.nx?.tags?.includes(VSCODE_EXTENSION_TAG) || manifest.nx.name !== void 0 || manifest.name === void 0) {
+      continue;
+    }
+    writeFileEnsured(manifestPath, toJson({ ...manifest, nx: { ...manifest.nx, name: manifest.name } }));
+    updated.push(`apps/${entry}/package.json`);
+  }
+  return updated;
+}
+function addVscodeExtension(workspaceRoot, name, stack, options = {}) {
+  const { sidecar } = options;
+  if (sidecar !== void 0 && !fileExists((0, import_node_path15.join)(workspaceRoot, "apps", sidecar, "project.json"))) {
+    throw new Error(`--sidecar ${sidecar}: no Go app at apps/${sidecar}. Add it first with \`mnci add go-app ${sidecar}\`.`);
+  }
+  runNodeApp(workspaceRoot, name, stack, "none");
+  ensureVscodeToolchain(workspaceRoot);
+  const projectRoot = (0, import_node_path15.join)(workspaceRoot, "apps", name);
+  const typesVersion = readJson((0, import_node_path15.join)(workspaceRoot, "node_modules/@types/vscode/package.json")).version;
+  reshapeManifest(projectRoot, name, options.publisher ?? defaultPublisher(workspaceRoot), typesVersion);
+  addVscodeTypes((0, import_node_path15.join)(projectRoot, "tsconfig.app.json"));
+  addVscodeTypes((0, import_node_path15.join)(projectRoot, "tsconfig.spec.json"));
+  writeFileEnsured((0, import_node_path15.join)(projectRoot, "src/main.ts"), vscodeExtensionMain(name));
+  writeFileEnsured((0, import_node_path15.join)(projectRoot, "src/main.spec.ts"), vscodeExtensionMainSpec(name));
+  writeFileEnsured((0, import_node_path15.join)(projectRoot, VSCODE_STUB_PATH), VSCODE_STUB);
+  mapVscodeToStub(projectRoot, stack.testRunner);
+  writeFileEnsured((0, import_node_path15.join)(projectRoot, ".vscodeignore"), VSCODE_IGNORE);
+  writeFileEnsured((0, import_node_path15.join)(workspaceRoot, VSCODE_EXTENSION_SCRIPT_PATH), VSCODE_EXTENSION_SCRIPT);
+  addNxTargets((0, import_node_path15.join)(projectRoot, "package.json"), {
+    "package": vscodeExtensionPackageTarget(name, sidecar),
+    "nx-release-publish": vscodeExtensionPublishTarget(name, sidecar)
+  });
+  removeGeneratedEslintConfig(workspaceRoot, `apps/${name}`);
+  registerProjectCommands(workspaceRoot, name, { build: true });
+  addDebugLaunch(workspaceRoot, name);
+}
+
 // src/dependency-management/sync-dependencies.use-case.ts
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 
 // src/dependency-management/manifest.repository.ts
-var import_node_fs11 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path16 = require("path");
 var ECOSYSTEMS = ["npm", "pip", "pub", "nuget", "go"];
 var ROOT_LABEL = "(root)";
 var MANIFEST_GLOBS = {
@@ -3827,23 +4219,23 @@ function projectOf(manifestRelativePath) {
 }
 function hasEcosystem(workspaceRoot, ecosystem) {
   if (ecosystem === "go") {
-    return fileExists((0, import_node_path15.join)(workspaceRoot, "go.mod"));
+    return fileExists((0, import_node_path16.join)(workspaceRoot, "go.mod"));
   }
   if (ecosystem === "nuget") {
-    return (0, import_node_fs11.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
+    return (0, import_node_fs12.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot }).length > 0;
   }
   const rootMarker = {
     npm: "package.json",
     pip: "requirements-dev.txt",
     pub: "pubspec.yaml"
   };
-  return fileExists((0, import_node_path15.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs11.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
+  return fileExists((0, import_node_path16.join)(workspaceRoot, rootMarker[ecosystem])) || (0, import_node_fs12.globSync)(MANIFEST_GLOBS[ecosystem], { cwd: workspaceRoot }).length > 0;
 }
 function collectNpm(workspaceRoot) {
   const sites = [];
-  const relativePaths = ["package.json", ...(0, import_node_fs11.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
+  const relativePaths = ["package.json", ...(0, import_node_fs12.globSync)(MANIFEST_GLOBS.npm, { cwd: workspaceRoot })];
   for (const relativePath of relativePaths) {
-    const manifestPath = (0, import_node_path15.join)(workspaceRoot, relativePath);
+    const manifestPath = (0, import_node_path16.join)(workspaceRoot, relativePath);
     try {
       const manifest = readJson(manifestPath);
       sites.push(...npmManifestSites(manifest, relativePath, manifestPath));
@@ -3904,17 +4296,17 @@ function collectPip(workspaceRoot) {
       name: parsed.name,
       ecosystem: "pip",
       project: projectOf(relativePath),
-      manifestPath: (0, import_node_path15.join)(workspaceRoot, relativePath),
+      manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
       section,
       spec: parsed.spec,
       rewritable: parsed.rewritable && parsed.spec !== ""
     });
   };
-  const pyprojectPaths = (0, import_node_fs11.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
+  const pyprojectPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.pip, { cwd: workspaceRoot });
   for (const relativePath of pyprojectPaths) {
     let content;
     try {
-      content = (0, import_node_fs11.readFileSync)((0, import_node_path15.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -3925,14 +4317,14 @@ function collectPip(workspaceRoot) {
   }
   const requirementsPaths = [
     "requirements-dev.txt",
-    ...(0, import_node_fs11.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
+    ...(0, import_node_fs12.globSync)("apps/*/requirements.txt", { cwd: workspaceRoot })
   ];
   for (const relativePath of requirementsPaths) {
-    if (!fileExists((0, import_node_path15.join)(workspaceRoot, relativePath))) {
+    if (!fileExists((0, import_node_path16.join)(workspaceRoot, relativePath))) {
       continue;
     }
     const section = relativePath === "requirements-dev.txt" ? "devDep" : "dep";
-    const lines = (0, import_node_fs11.readFileSync)((0, import_node_path15.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
+    const lines = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8").split(/\r?\n/);
     for (const line of lines) {
       push(relativePath, section, line);
     }
@@ -3970,11 +4362,11 @@ function pyprojectDependencies(content) {
 }
 function collectPub(workspaceRoot) {
   const sites = [];
-  const pubspecPaths = (0, import_node_fs11.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
+  const pubspecPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.pub, { cwd: workspaceRoot });
   for (const relativePath of pubspecPaths) {
     let content;
     try {
-      content = (0, import_node_fs11.readFileSync)((0, import_node_path15.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -3984,7 +4376,7 @@ function collectPub(workspaceRoot) {
           name: entry.name,
           ecosystem: "pub",
           project: projectOf(relativePath),
-          manifestPath: (0, import_node_path15.join)(workspaceRoot, relativePath),
+          manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
           section: block === "dependencies" ? "dep" : "devDep",
           spec: entry.spec,
           rewritable: entry.spec !== ""
@@ -4034,11 +4426,11 @@ function stripQuotes(value) {
 }
 function collectNuget(workspaceRoot) {
   const sites = [];
-  const csprojPaths = (0, import_node_fs11.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
+  const csprojPaths = (0, import_node_fs12.globSync)(MANIFEST_GLOBS.nuget, { cwd: workspaceRoot });
   for (const relativePath of csprojPaths) {
     let content;
     try {
-      content = (0, import_node_fs11.readFileSync)((0, import_node_path15.join)(workspaceRoot, relativePath), "utf8");
+      content = (0, import_node_fs12.readFileSync)((0, import_node_path16.join)(workspaceRoot, relativePath), "utf8");
     } catch {
       continue;
     }
@@ -4047,7 +4439,7 @@ function collectNuget(workspaceRoot) {
         name: entry.name,
         ecosystem: "nuget",
         project: projectOf(relativePath),
-        manifestPath: (0, import_node_path15.join)(workspaceRoot, relativePath),
+        manifestPath: (0, import_node_path16.join)(workspaceRoot, relativePath),
         section: "dep",
         spec: entry.spec,
         // A plain SemVer string is rewritable; an MSBuild property reference
@@ -4072,13 +4464,13 @@ function csprojPackageReferences(content) {
   return entries;
 }
 function collectGo(workspaceRoot) {
-  const manifestPath = (0, import_node_path15.join)(workspaceRoot, "go.mod");
+  const manifestPath = (0, import_node_path16.join)(workspaceRoot, "go.mod");
   if (!fileExists(manifestPath)) {
     return [];
   }
   let content;
   try {
-    content = (0, import_node_fs11.readFileSync)(manifestPath, "utf8");
+    content = (0, import_node_fs12.readFileSync)(manifestPath, "utf8");
   } catch {
     return [];
   }
@@ -4135,7 +4527,7 @@ function rewriteSpec(site, spec) {
     writeFileEnsured(site.manifestPath, toJson(manifest));
     return true;
   }
-  const before = (0, import_node_fs11.readFileSync)(site.manifestPath, "utf8");
+  const before = (0, import_node_fs12.readFileSync)(site.manifestPath, "utf8");
   const after = (() => {
     switch (site.ecosystem) {
       case "pip": {
@@ -4191,13 +4583,13 @@ function escapeForRegex(value) {
 function isWorkspaceProject(workspaceRoot, name) {
   const short = name.includes("/") ? name.split("/").at(-1) : name;
   return ["apps", "libs", "packages"].some(
-    (directory) => fileExists((0, import_node_path15.join)(workspaceRoot, directory, short ?? name, "package.json"))
+    (directory) => fileExists((0, import_node_path16.join)(workspaceRoot, directory, short ?? name, "package.json"))
   );
 }
 function isAliasedInstall(workspaceRoot, name) {
   try {
     const installed = readJson(
-      (0, import_node_path15.join)(workspaceRoot, "node_modules", name, "package.json")
+      (0, import_node_path16.join)(workspaceRoot, "node_modules", name, "package.json")
     );
     return installed.name !== void 0 && installed.name !== name;
   } catch {
@@ -4208,14 +4600,14 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
   if (ecosystem === "npm") {
     try {
       return readJson(
-        (0, import_node_path15.join)(workspaceRoot, "node_modules", name, "package.json")
+        (0, import_node_path16.join)(workspaceRoot, "node_modules", name, "package.json")
       ).version;
     } catch {
       return void 0;
     }
   }
   if (ecosystem === "pub") {
-    const lockPath = (0, import_node_path15.join)(workspaceRoot, "pubspec.lock");
+    const lockPath = (0, import_node_path16.join)(workspaceRoot, "pubspec.lock");
     if (!fileExists(lockPath)) {
       return void 0;
     }
@@ -4223,7 +4615,7 @@ function resolvedVersion(workspaceRoot, ecosystem, name) {
       const match = new RegExp(
         String.raw`^\s{2}${escapeForRegex(name)}:[^]*?^\s+version:\s*["']?([^"'\s]+)`,
         "m"
-      ).exec((0, import_node_fs11.readFileSync)(lockPath, "utf8"));
+      ).exec((0, import_node_fs12.readFileSync)(lockPath, "utf8"));
       return match?.[1];
     } catch {
       return void 0;
@@ -4415,7 +4807,7 @@ function describe(finding) {
   return `${finding.name} \u2192 ${finding.target} (${finding.reason}); disagreeing: ${sites}`;
 }
 function runSync(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path16.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path17.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci sync' from the workspace root.`
     );
@@ -4465,7 +4857,7 @@ function runSync(workspaceRoot, options) {
 }
 
 // src/dependency-management/update-dependencies.use-case.ts
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 var import_prompts2 = require("@inquirer/prompts");
 
 // src/dependency-management/registry.client.ts
@@ -4748,7 +5140,7 @@ function reinstall(workspaceRoot, ecosystems) {
 function hasPythonInstallScript(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path17.join)(workspaceRoot, "package.json")
+      (0, import_node_path18.join)(workspaceRoot, "package.json")
     );
     return manifest.scripts?.["python:install"] !== void 0;
   } catch {
@@ -4764,7 +5156,7 @@ function applyGoUpdates(workspaceRoot, entries) {
   }
 }
 async function runUp(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path17.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
     throw new Error(`No nx.json found in ${workspaceRoot} \u2014 run 'mnci up' from the workspace root.`);
   }
   const ecosystems = resolveEcosystems(options.ecosystem);
@@ -4835,11 +5227,12 @@ var PROJECT_KINDS = [
   "csharp-app",
   "csharp-function-app",
   "csharp-lib",
-  "csharp-internal-lib"
+  "csharp-internal-lib",
+  "vscode-extension"
 ];
 async function runAdd(kind, name, options) {
   const workspaceRoot = process.cwd();
-  if (!fileExists((0, import_node_path18.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path19.join)(workspaceRoot, "nx.json"))) {
     throw new Error("No nx.json found here. Run `add` from the workspace root.");
   }
   const stack = readWorkspaceStack(workspaceRoot);
@@ -4890,8 +5283,8 @@ async function runAdd(kind, name, options) {
         ],
         workspaceRoot
       );
-      markPrivate((0, import_node_path18.join)(workspaceRoot, "libs", resolvedName, "package.json"));
-      renameScaffoldPlaceholder((0, import_node_path18.join)(workspaceRoot, "libs", resolvedName), resolvedName);
+      markPrivate((0, import_node_path19.join)(workspaceRoot, "libs", resolvedName, "package.json"));
+      renameScaffoldPlaceholder((0, import_node_path19.join)(workspaceRoot, "libs", resolvedName), resolvedName);
       removeGeneratedEslintConfig(workspaceRoot, `libs/${resolvedName}`);
       registerProjectCommands(workspaceRoot, resolvedName, { build: true });
       break;
@@ -4956,6 +5349,13 @@ async function runAdd(kind, name, options) {
       addCsharpInternalLib(workspaceRoot, resolvedName);
       break;
     }
+    case "vscode-extension": {
+      addVscodeExtension(workspaceRoot, resolvedName, stack, {
+        publisher: options.publisher,
+        sidecar: options.sidecar
+      });
+      break;
+    }
     case "python-vendor": {
       await addPythonVendor(workspaceRoot, resolvedName, options, kindProvided);
       syncProjectReferences(workspaceRoot);
@@ -4976,7 +5376,7 @@ async function runAdd(kind, name, options) {
 }
 function readWorkspaceStack(workspaceRoot) {
   const nxJson = readJson(
-    (0, import_node_path18.join)(workspaceRoot, "nx.json")
+    (0, import_node_path19.join)(workspaceRoot, "nx.json")
   );
   const stack = nxJson.mnci?.stack;
   return {
@@ -4985,15 +5385,15 @@ function readWorkspaceStack(workspaceRoot) {
 }
 
 // src/workspace-diagnostics/check-invariants.use-case.ts
-var import_node_fs12 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path20 = require("path");
 var SUPPORTED_ESLINT_MAJOR = ESLINT_VERSION.replace(/^\D*/, "").split(".", 1)[0];
 function toPosix2(path) {
   return path.replaceAll("\\", "/");
 }
 function checkEslintConfigs(workspaceRoot) {
-  const rootConfigs = (0, import_node_fs12.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
-  const projectConfigs = (0, import_node_fs12.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
+  const rootConfigs = (0, import_node_fs13.globSync)("eslint.config.{js,mjs,cjs,ts,mts,cts}", { cwd: workspaceRoot });
+  const projectConfigs = (0, import_node_fs13.globSync)("{apps,libs,packages}/*/eslint.config.{js,mjs,cjs,ts,mts,cts}", {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return [
@@ -5013,10 +5413,10 @@ function checkEslintConfigs(workspaceRoot) {
   ];
 }
 function checkEslintEntryPointReachesTheRules(workspaceRoot) {
-  const rules = (0, import_node_path19.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
-  if (!(0, import_node_fs12.existsSync)(rules)) return [];
-  const entryPoint = (0, import_node_path19.join)(workspaceRoot, ESLINT_USER_FILENAME);
-  const source = (0, import_node_fs12.existsSync)(entryPoint) ? (0, import_node_fs12.readFileSync)(entryPoint, "utf8") : "";
+  const rules = (0, import_node_path20.join)(workspaceRoot, ESLINT_MNCI_FILENAME);
+  if (!(0, import_node_fs13.existsSync)(rules)) return [];
+  const entryPoint = (0, import_node_path20.join)(workspaceRoot, ESLINT_USER_FILENAME);
+  const source = (0, import_node_fs13.existsSync)(entryPoint) ? (0, import_node_fs13.readFileSync)(entryPoint, "utf8") : "";
   return [
     {
       check: `${ESLINT_USER_FILENAME} imports the mnci rules`,
@@ -5029,7 +5429,7 @@ function checkEslintEntryPointReachesTheRules(workspaceRoot) {
 function declaredDevDependencies(workspaceRoot) {
   try {
     const manifest = readJson(
-      (0, import_node_path19.join)(workspaceRoot, "package.json")
+      (0, import_node_path20.join)(workspaceRoot, "package.json")
     );
     return manifest.devDependencies ?? {};
   } catch {
@@ -5037,7 +5437,7 @@ function declaredDevDependencies(workspaceRoot) {
   }
 }
 function checkNoRetiredFormatter(workspaceRoot) {
-  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path19.join)(workspaceRoot, file)));
+  const files = RETIRED_FORMATTER_FILES.filter((file) => fileExists((0, import_node_path20.join)(workspaceRoot, file)));
   const declared = ["prettier", "eslint-config-prettier", "oxlint", "oxfmt", "@mnci/oxlint-config"].filter((name) => declaredDevDependencies(workspaceRoot)[name] !== void 0);
   const stale = [...files, ...declared];
   if (stale.length === 0) {
@@ -5063,7 +5463,7 @@ function checkEslintPlugin(nxJson) {
   };
 }
 function checkResolvedEslint(workspaceRoot) {
-  const manifestPath = (0, import_node_path19.join)(workspaceRoot, "node_modules/eslint/package.json");
+  const manifestPath = (0, import_node_path20.join)(workspaceRoot, "node_modules/eslint/package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -5081,11 +5481,11 @@ function checkResolvedEslint(workspaceRoot) {
   }
 }
 function checkNpmrc(workspaceRoot, registry, scope) {
-  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
   if (!registry || !fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8");
   if (registry.kind === "npm") {
     return {
       check: ".npmrc authenticates the public registry",
@@ -5102,11 +5502,11 @@ function checkNpmrc(workspaceRoot, registry, scope) {
   };
 }
 function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
-  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
+  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
   if (!fileExists(npmrcPath)) {
     return void 0;
   }
-  const npmrc = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8");
+  const npmrc = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8");
   const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
   const referenced = [
     ...new Set(
@@ -5130,13 +5530,13 @@ function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env)
   };
 }
 function checkNpmAuthMatchesPipeline(workspaceRoot, registry) {
-  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
-  const pipelinePath = (0, import_node_path19.join)(workspaceRoot, "azure-pipelines.yml");
+  const npmrcPath = (0, import_node_path20.join)(workspaceRoot, ".npmrc");
+  const pipelinePath = (0, import_node_path20.join)(workspaceRoot, "azure-pipelines.yml");
   if (registry?.kind !== "azure-artifacts" || !fileExists(npmrcPath) || !fileExists(pipelinePath)) {
     return void 0;
   }
-  const holdsCredentials = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
-  const runsTask = (0, import_node_fs12.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
+  const holdsCredentials = (0, import_node_fs13.readFileSync)(npmrcPath, "utf8").split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).some((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const runsTask = (0, import_node_fs13.readFileSync)(pipelinePath, "utf8").includes("npmAuthenticate@0");
   if (!holdsCredentials && !runsTask) {
     return {
       check: "npm auth: .npmrc and azure-pipelines.yml agree",
@@ -5181,13 +5581,13 @@ function npmjsCredentialShape(credentials, environment) {
 }
 function checkVersionActions(workspaceRoot) {
   const candidates = [
-    ...(0, import_node_fs12.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
-    ...(0, import_node_fs12.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
-    ...(0, import_node_fs12.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
+    ...(0, import_node_fs13.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
+    ...(0, import_node_fs13.globSync)("packages/*/*.csproj", { cwd: workspaceRoot }),
+    ...(0, import_node_fs13.globSync)("python-packages/*/pyproject.toml", { cwd: workspaceRoot })
   ].map((manifest) => toPosix2(manifest));
   return candidates.flatMap((manifest) => {
     const projectRoot = manifest.slice(0, manifest.lastIndexOf("/"));
-    const projectJsonPath = (0, import_node_path19.join)(workspaceRoot, projectRoot, "project.json");
+    const projectJsonPath = (0, import_node_path20.join)(workspaceRoot, projectRoot, "project.json");
     let hasOverride = false;
     try {
       const projectJson = readJson(projectJsonPath);
@@ -5216,7 +5616,7 @@ function declaredTargets(workspaceRoot, projectRoot) {
   ]) {
     try {
       const targets = extract(
-        readJson((0, import_node_path19.join)(workspaceRoot, projectRoot, file))
+        readJson((0, import_node_path20.join)(workspaceRoot, projectRoot, file))
       );
       if (targets && typeof targets === "object") {
         sources.push({
@@ -5232,8 +5632,8 @@ function declaredTargets(workspaceRoot, projectRoot) {
 function checkTargetFilesExist(workspaceRoot) {
   const projectRoots = new Set(
     [
-      ...(0, import_node_fs12.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
-      ...(0, import_node_fs12.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
+      ...(0, import_node_fs13.globSync)("{apps,libs,packages}/*/project.json", { cwd: workspaceRoot }),
+      ...(0, import_node_fs13.globSync)("{apps,libs,packages}/*/package.json", { cwd: workspaceRoot })
     ].map((manifest) => toPosix2(manifest).split("/").slice(0, 2).join("/"))
   );
   return [...projectRoots].flatMap(
@@ -5248,7 +5648,7 @@ function checkOneTargetsFiles(workspaceRoot, source, targetName, target) {
   return TARGET_FILE_OPTIONS.flatMap((option) => {
     const value = target?.options?.[option];
     const checkable = typeof value === "string" && !value.includes("{");
-    if (!checkable || fileExists((0, import_node_path19.join)(workspaceRoot, value))) {
+    if (!checkable || fileExists((0, import_node_path20.join)(workspaceRoot, value))) {
       return [];
     }
     return [
@@ -5270,7 +5670,7 @@ function checkSync(workspaceRoot) {
   };
 }
 function checkNoRootRuntimeDependencies(workspaceRoot) {
-  const manifestPath = (0, import_node_path19.join)(workspaceRoot, "package.json");
+  const manifestPath = (0, import_node_path20.join)(workspaceRoot, "package.json");
   if (!fileExists(manifestPath)) {
     return void 0;
   }
@@ -5290,14 +5690,14 @@ function checkNoRootRuntimeDependencies(workspaceRoot) {
   };
 }
 function checkRollupSourceMaps(workspaceRoot) {
-  const configs = (0, import_node_fs12.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs13.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path19.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
     let config;
     try {
-      config = (0, import_node_fs12.readFileSync)(configPath, "utf8");
+      config = (0, import_node_fs13.readFileSync)(configPath, "utf8");
     } catch {
       return [];
     }
@@ -5312,11 +5712,11 @@ function checkRollupSourceMaps(workspaceRoot) {
   });
 }
 function checkDeclarationSpecifiers(workspaceRoot) {
-  const configs = (0, import_node_fs12.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
+  const configs = (0, import_node_fs13.globSync)(["packages/*/rollup.config.cjs", "libs/*/rollup.config.cjs"], {
     cwd: workspaceRoot
   }).map((config) => toPosix2(config));
   return configs.flatMap((relativePath) => {
-    const configPath = (0, import_node_path19.join)(workspaceRoot, relativePath);
+    const configPath = (0, import_node_path20.join)(workspaceRoot, relativePath);
     if (!fileExists(configPath)) {
       return [];
     }
@@ -5350,7 +5750,7 @@ function checkDeclarationSpecifiers(workspaceRoot) {
   });
 }
 function collectFindings(workspaceRoot) {
-  const nxJsonPath = (0, import_node_path19.join)(workspaceRoot, "nx.json");
+  const nxJsonPath = (0, import_node_path20.join)(workspaceRoot, "nx.json");
   if (!fileExists(nxJsonPath)) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 run 'mnci doctor' from the workspace root.`
@@ -5395,8 +5795,8 @@ function runDoctor(workspaceRoot) {
 }
 
 // src/workspace-creation/adopt-directory.use-case.ts
-var import_node_fs13 = require("fs");
-var import_node_path20 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path21 = require("path");
 var NEVER_COPIED = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var AGENT_AND_CI_ENTRIES = [
   "AGENTS.md",
@@ -5427,13 +5827,13 @@ var PREFLIGHT_BLOCKERS = [
   "packages"
 ];
 function assertAdoptableDirectory(target) {
-  if (!(0, import_node_fs13.existsSync)(target)) {
+  if (!(0, import_node_fs14.existsSync)(target)) {
     throw new Error(`--into '${target}' does not exist. Create or clone it first.`);
   }
-  if (!(0, import_node_fs13.statSync)(target).isDirectory()) {
+  if (!(0, import_node_fs14.statSync)(target).isDirectory()) {
     throw new Error(`--into '${target}' is not a directory.`);
   }
-  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs13.existsSync)((0, import_node_path20.join)(target, entry)));
+  const blockers = PREFLIGHT_BLOCKERS.filter((entry) => (0, import_node_fs14.existsSync)((0, import_node_path21.join)(target, entry)));
   if (blockers.length > 0) {
     throw new Error(
       `--into '${target}' already holds ${blockers.join(", ")}, so it is a project already. Use \`mnci upgrade\` to re-apply the overlay to an existing workspace, or point --into at an empty checkout.`
@@ -5441,15 +5841,15 @@ function assertAdoptableDirectory(target) {
   }
 }
 function mergeGitignore(generatedFile, targetFile) {
-  const existing = (0, import_node_fs13.readFileSync)(targetFile, "utf8");
+  const existing = (0, import_node_fs14.readFileSync)(targetFile, "utf8");
   const present = new Set(existing.split("\n").map((line) => line.trim()));
-  const additions = (0, import_node_fs13.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
+  const additions = (0, import_node_fs14.readFileSync)(generatedFile, "utf8").split("\n").map((line) => line.trimEnd()).filter((line) => {
     const trimmed = line.trim();
     return trimmed !== "" && !trimmed.startsWith("#") && !present.has(trimmed);
   });
   if (additions.length === 0) return false;
   const separator = existing.endsWith("\n") ? "" : "\n";
-  (0, import_node_fs13.writeFileSync)(
+  (0, import_node_fs14.writeFileSync)(
     targetFile,
     `${existing}${separator}
 # Added by mnci (Nx workspace)
@@ -5459,9 +5859,9 @@ ${additions.join("\n")}
   return true;
 }
 function adoptGeneratedWorkspace(generatedRoot, target) {
-  const entries = (0, import_node_fs13.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
+  const entries = (0, import_node_fs14.readdirSync)(generatedRoot).filter((entry) => !NEVER_COPIED.has(entry));
   const collisions = entries.filter(
-    (entry) => (0, import_node_fs13.existsSync)((0, import_node_path20.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
+    (entry) => (0, import_node_fs14.existsSync)((0, import_node_path21.join)(target, entry)) && !EXISTING_WINS.has(entry) && entry !== ".gitignore"
   );
   if (collisions.length > 0) {
     throw new Error(
@@ -5470,28 +5870,28 @@ function adoptGeneratedWorkspace(generatedRoot, target) {
   }
   const result = { copied: [], kept: [], mergedGitignore: false };
   for (const entry of entries) {
-    const from = (0, import_node_path20.join)(generatedRoot, entry);
-    const to = (0, import_node_path20.join)(target, entry);
-    if (entry === ".gitignore" && (0, import_node_fs13.existsSync)(to)) {
+    const from = (0, import_node_path21.join)(generatedRoot, entry);
+    const to = (0, import_node_path21.join)(target, entry);
+    if (entry === ".gitignore" && (0, import_node_fs14.existsSync)(to)) {
       result.mergedGitignore = mergeGitignore(from, to);
       result.kept.push(entry);
       continue;
     }
-    if ((0, import_node_fs13.existsSync)(to)) {
+    if ((0, import_node_fs14.existsSync)(to)) {
       result.kept.push(entry);
       continue;
     }
-    (0, import_node_fs13.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs14.cpSync)(from, to, { recursive: true });
     result.copied.push(entry);
   }
-  (0, import_node_fs13.rmSync)(generatedRoot, { recursive: true, force: true });
+  (0, import_node_fs14.rmSync)(generatedRoot, { recursive: true, force: true });
   return result;
 }
 
 // src/workspace-creation/create-workspace.use-case.ts
-var import_node_fs14 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_os = require("os");
-var import_node_path21 = require("path");
+var import_node_path22 = require("path");
 function nxCloudProviderValue(ci) {
   return ci === "azure" ? "azure" : "github";
 }
@@ -5527,9 +5927,9 @@ async function resolveRegistry(options) {
   return await promptRegistry();
 }
 async function runNew(name, options) {
-  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path21.resolve)(process.cwd(), options.into);
+  const adoptTarget = options.into === void 0 ? void 0 : (0, import_node_path22.resolve)(process.cwd(), options.into);
   if (adoptTarget !== void 0) assertAdoptableDirectory(adoptTarget);
-  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path21.basename)(adoptTarget));
+  const workspaceName = name ?? (adoptTarget === void 0 ? await promptText("Workspace name") : (0, import_node_path22.basename)(adoptTarget));
   assertValidProjectName(workspaceName, "Workspace name");
   const scope = options.scope ?? (options.yes ? `@${workspaceName}` : await promptText("npm scope for publishable packages", `@${workspaceName}`));
   const registry = await resolveRegistry(options);
@@ -5542,8 +5942,8 @@ async function runNew(name, options) {
   const npmAuth = resolveNpmAuth(options.npmAuth, registry, ci);
   const stack = await resolveStack(options);
   const nxCloud = options.nxCloud ?? (options.yes ? false : await promptNxCloud());
-  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs14.mkdtempSync)((0, import_node_path21.join)((0, import_node_os.tmpdir)(), "mnci-new-"));
-  let workspaceRoot = (0, import_node_path21.join)(stagingParent, workspaceName);
+  const stagingParent = adoptTarget === void 0 ? process.cwd() : (0, import_node_fs15.mkdtempSync)((0, import_node_path22.join)((0, import_node_os.tmpdir)(), "mnci-new-"));
+  let workspaceRoot = (0, import_node_path22.join)(stagingParent, workspaceName);
   try {
     logger.step(`Creating Nx workspace '${workspaceName}' (preset: ts)`);
     runNpx(
@@ -5566,7 +5966,7 @@ async function runNew(name, options) {
       workspaceRoot = adoptTarget;
     }
   } finally {
-    if (adoptTarget !== void 0) (0, import_node_fs14.rmSync)(stagingParent, { recursive: true, force: true });
+    if (adoptTarget !== void 0) (0, import_node_fs15.rmSync)(stagingParent, { recursive: true, force: true });
   }
   logger.step(
     "Applying MoNecromanCI overlay (VS Code workspace, release config, .npmrc, commitlint, pipeline, stack)"
@@ -5576,8 +5976,8 @@ async function runNew(name, options) {
     { workspaceName, scope, registry, agent, variableGroup, ci, stack, ...npmAuth && { npmAuth } },
     logger.detail
   );
-  (0, import_node_fs14.rmSync)((0, import_node_path21.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
-  (0, import_node_fs14.rmSync)((0, import_node_path21.join)(workspaceRoot, "package-lock.json"), { force: true });
+  (0, import_node_fs15.rmSync)((0, import_node_path22.join)(workspaceRoot, "node_modules"), { recursive: true, force: true });
+  (0, import_node_fs15.rmSync)((0, import_node_path22.join)(workspaceRoot, "package-lock.json"), { force: true });
   logger.step("Installing the toolchain (commitlint + husky + linting/formatting)");
   const installStatus = runShell(
     "npm",
@@ -5601,18 +6001,19 @@ async function runNew(name, options) {
     "                                 #     go-app, go-function-app, go-lib, go-internal-lib,"
   );
   logger.info(
-    "                                 #     flutter-app, flutter-lib, flutter-internal-lib"
+    "                                 #     flutter-app, flutter-lib, flutter-internal-lib,"
   );
+  logger.info("                                 #     vscode-extension");
   logger.info('  git add -A && git commit -m "feat: initial workspace"');
 }
 
 // src/workspace-creation/interactive-wizard.use-case.ts
-var import_node_path23 = require("path");
+var import_node_path24 = require("path");
 var import_prompts4 = require("@inquirer/prompts");
 
 // src/workspace-upgrade/upgrade-workspace.use-case.ts
-var import_node_fs15 = require("fs");
-var import_node_path22 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path23 = require("path");
 function resolveRegistry2(options, persisted) {
   if (options.registry === "azure-artifacts" || options.organization && options.artifactsFeed) {
     const persistedAzure = persisted?.kind === "azure-artifacts" ? persisted : void 0;
@@ -5641,7 +6042,7 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     return persisted.workspaceName;
   }
   try {
-    const existing = (0, import_node_fs15.readdirSync)(workspaceRoot).find(
+    const existing = (0, import_node_fs16.readdirSync)(workspaceRoot).find(
       (file) => file.endsWith(".code-workspace") && file !== "undefined.code-workspace"
     );
     if (existing) {
@@ -5649,11 +6050,11 @@ function resolveWorkspaceName(workspaceRoot, persisted) {
     }
   } catch {
   }
-  return (0, import_node_path22.basename)(workspaceRoot);
+  return (0, import_node_path23.basename)(workspaceRoot);
 }
 function detectNpmAuth(workspaceRoot) {
   try {
-    return (0, import_node_fs15.readFileSync)((0, import_node_path22.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
+    return (0, import_node_fs16.readFileSync)((0, import_node_path23.join)(workspaceRoot, "azure-pipelines.yml"), "utf8").includes("npmAuthenticate@0") ? "build-identity" : void 0;
   } catch {
     return void 0;
   }
@@ -5700,7 +6101,7 @@ function resolveOverlayOptions(workspaceRoot, options, persisted) {
   };
 }
 function runUpgrade(workspaceRoot, options) {
-  if (!fileExists((0, import_node_path22.join)(workspaceRoot, "nx.json"))) {
+  if (!fileExists((0, import_node_path23.join)(workspaceRoot, "nx.json"))) {
     throw new Error(
       `No nx.json found in ${workspaceRoot} \u2014 this does not look like an Nx workspace. Run 'mnci upgrade' from the workspace root.`
     );
@@ -5730,6 +6131,17 @@ function runUpgrade(workspaceRoot, options) {
       logger.detail(`updated ${path}`);
     }
   }
+  const pinnedExtensions = pinVscodeExtensionProjectNames(workspaceRoot);
+  if (pinnedExtensions.length > 0) {
+    logger.step("Pinning the Nx project name of VS Code extensions (nx.name)");
+    for (const path of pinnedExtensions) {
+      logger.detail(`updated ${path}`);
+    }
+  }
+  if (refreshVscodeExtensionScript(workspaceRoot)) {
+    logger.step("Updating the VS Code extension packaging script");
+    logger.detail(`updated ${VSCODE_EXTENSION_SCRIPT_PATH}`);
+  }
   const upgradedDtsPlugins = upgradeDeclarationSpecifierPlugins(workspaceRoot);
   if (upgradedDtsPlugins.length > 0) {
     logger.step("Upgrading declaration specifiers to resolve under nodenext");
@@ -5746,7 +6158,7 @@ function runUpgrade(workspaceRoot, options) {
 
 // src/workspace-creation/interactive-wizard.use-case.ts
 async function runInteractive() {
-  const inWorkspace = fileExists((0, import_node_path23.join)(process.cwd(), "nx.json"));
+  const inWorkspace = fileExists((0, import_node_path24.join)(process.cwd(), "nx.json"));
   const choiceNew = { name: "Create a new monorepo", value: "new" };
   const choiceAdd = { name: "Add a project to this workspace", value: "add" };
   const choiceUpgrade = {
@@ -5767,8 +6179,8 @@ async function runInteractive() {
 }
 
 // src/cli-version/check-for-update.use-case.ts
-var import_node_fs16 = require("fs");
-var import_node_path24 = require("path");
+var import_node_fs17 = require("fs");
+var import_node_path25 = require("path");
 var import_cross_spawn2 = __toESM(require("cross-spawn"));
 var PACKAGE_NAME = "@mnci/cli";
 var REGISTRY_TIMEOUT_MS = 2e3;
@@ -5824,8 +6236,8 @@ function releaseTriple(version) {
 }
 function readCliVersion(packageDirectory) {
   try {
-    const manifestPath = (0, import_node_path24.join)(packageDirectory, "..", "package.json");
-    const manifest = JSON.parse((0, import_node_fs16.readFileSync)(manifestPath, "utf8"));
+    const manifestPath = (0, import_node_path25.join)(packageDirectory, "..", "package.json");
+    const manifest = JSON.parse((0, import_node_fs17.readFileSync)(manifestPath, "utf8"));
     return manifest.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -5880,6 +6292,12 @@ function buildProgram(cliVersion) {
   ).option(
     "--lib <name>",
     "python-vendor only: the internal Python library (libs/<name>) to vendor into <name>"
+  ).option(
+    "--publisher <id>",
+    "vscode-extension only: the Marketplace publisher id (defaults to the workspace scope without @)"
+  ).option(
+    "--sidecar <go-app>",
+    "vscode-extension only: a go-app whose six-platform build ships in the extension, one .vsix per platform"
   ).action(
     async (kind, name, options) => {
       await runAdd(kind, name, options);