🧩 Extension baseline

Pinned baseline (six entries)

id	version	platform	reason
Continue.continue	2.1.0	linux-x64	Primary open-source AI agent/chat/edit/autocomplete extension.
Anthropic.claude-code	2.1.235	linux-x64	First-party Claude Code IDE integration.
ms-python.python	2026.4.0	universal	Python language support expected in this environment.
ms-python.debugpy	2026.6.0	linux-x64	Explicit debugger dependency instead of relying on later bootstrap by the Python extension.
ms-toolsai.jupyter	2025.9.1	universal	Notebook workflow support in the browser IDE.
ms-azuretools.vscode-containers	2.4.5	universal	Current Container Tools extension; its README states it replaces the older Docker extension functionality.

All six come from config/extensions.lock.json (registry: https://open-vsx.org).

Lock file mechanics

config/extensions.lock.json is the single source of truth. Each entry contains id, version, platform, vsix_url, sha256_url, reason, and mode (baseline or optional).

VSIX cache lives in tmp/extensions/ with filenames <id>-<version>@<platform>.vsix.

Install script (scripts/install-extensions.sh):

• requires python3 (no jq on this host)
• downloads VSIX + .sha256 into cache if not present
• verifies sha256 before install
• installs with code-server --config config/config.yaml --install-extension <abs .vsix> --force

Audit script (scripts/list-extension-versions.sh):

• runs code-server --list-extensions --show-versions
• compares against lock file
• exits non-zero on MISSING or MISMATCH
• --include-optional extends the check to mode: optional entries

Commands

# install baseline only
cd /home/loca/dev/code-server && ./scripts/install-extensions.sh
 
# install baseline + optional
./scripts/install-extensions.sh --include-optional
 
# audit baseline
./scripts/list-extension-versions.sh
 
# audit baseline + optional
./scripts/list-extension-versions.sh --include-optional

Transitively installed (expected, unpinned)

id	version	note
ms-python.vscode-python-envs	1.36.0	Python extension dependency
ms-toolsai.jupyter-keymap	1.1.2	Jupyter dependency
ms-toolsai.jupyter-renderers	1.3.0	Jupyter dependency
ms-toolsai.vscode-jupyter-cell-tags	0.1.9	Jupyter dependency
ms-toolsai.vscode-jupyter-slideshow	0.1.6	Jupyter dependency

These are not in the lock file and will vary; they are expected by-products of the baseline install.

Optional: Cody (enterprise only)

id	version	platform	reason
sourcegraph.cody-ai	1.155.0	universal	Useful only with a Cody Enterprise account; the Open VSX README states it is no longer available for non-enterprise users.

Opt-in:

./scripts/install-extensions.sh --include-optional

Exclusions (recorded in lock file)

id	reason
TabNine.tabnine-vscode	Open VSX listing marks it legacy and states it does not onboard new users.
GitHub.copilot	Microsoft-marketplace-only AI tooling; code-server cannot rely on Microsoft marketplace terms or access.

Any Microsoft-marketplace-only AI extensions fall under the same exclusion.

First-run sign-in (credentials live in data/user/ and must never be pasted into wiki or project files)

• Continue: open the Continue sidebar in the editor at https://cdsr.loca.zone, follow the provider login flow. Credentials stored in the editor profile under data/user/.
• Claude Code: click the Claude Code panel, authenticate with Anthropic account. Session lives in data/user/.
• Cody (optional): if enabled, sign in via Cody panel; requires Enterprise subscription.

"extensions.autoUpdate": "off" and "update.mode": "manual" are the deployed values in data/user/User/settings.json — code-server normalized the seeded false to the string "off" at first run, and "off" and false mean the same thing (auto-update disabled). Version drift only happens by updating config/extensions.lock.json and re-running the install script.