mirror of
https://github.com/microsoft/vscode.git
synced 2026-04-02 08:15:56 +01:00
- Adds trust confirmation dialog requiring users to explicitly trust a marketplace before installing plugins from it. Protects against accidental plugin installation from untrusted sources. - Introduces observableMemento for storing trusted marketplace canonical IDs in persistent storage (StorageScope.APPLICATION), tied to user profiles, never expiring. - Trust is scoped per-marketplace (by canonicalId), so trusting one marketplace trusts all plugins sourced from it. Reduces friction for plugins from the same trusted source. - Trust gate applies to all plugin source kinds (RelativePath, GitHub, GitUrl, npm, pip) — for npm/pip it's additive to the existing terminal command confirmation. - Expands IPluginMarketplaceService with isMarketplaceTrusted() and trustMarketplace() methods, and injects IDialogService into PluginInstallService. (Commit message generated by Copilot)