[GH-ISSUE #3687] [Feature] VS Code extension reverse engineering: VSIX packages, activation events, contribution points, webviews and extension-host graph reconstruction #1400

New issue

Open

opened 2026-10-16 21:05:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:07 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3687

Problem Statement & Context

Visual Studio Code is the world's most widely adopted developer environment (>70% market share according to developer surveys), with over 80,000 extensions published on the Visual Studio Marketplace. Extensions range from simple syntax highlighters to complex, multi-process distributed systems featuring embedded language servers, debug adapters, custom webview GUIs, native Node.js C++ addons, WebAssembly modules, and AI agent / Model Context Protocol (MCP) bridges.

When auditing or reverse engineering an extension (.vsix package or installed extension directory), analysts lack a dedicated tool that comprehends VS Code's extension-host contract:

Manifest Architecture (package.json): activationEvents, contributes points (commands, menus, views, keybindings, custom editors, languages, debuggers).
Extension Lifecycle & Activation: activate(context: vscode.ExtensionContext) entrypoint and registered disposables.
Webview IPC: Communication channels (postMessage, onDidReceiveMessage) between the extension host and embedded webview HTML panels.
Language Server & Debug Adapter Boundaries: Custom LSP (Language Server Protocol) and DAP (Debug Adapter Protocol) subprocesses spawned by the extension.
AI & Agentic Integrations: Modern extensions integrating language model tools, Chat Participant APIs (vscode.chat.createChatParticipant), and MCP servers.

REA already possesses engines for ZIP archives, JavaScript/Node.js ASTs, native modules, and MCP protocols (#3672). A dedicated VS Code extension engine will unify these into a high-level extension architecture reconstruction.

Proposed Architecture

flowchart TD
    A[".vsix Package / Extension Directory"] --> B["VS Code Extension Reconstruction Engine"]
    B --> C["Manifest & Contribution Point Parser"]
    B --> D["Extension Host Lifecycle & Command Mapper"]
    B --> E["Webview & Subprocess Boundary Analyzer"]
    B --> F["AI Chat & MCP Tool Inspector"]
    
    C --> C1["activationEvents & triggers"]
    C --> C2["contributes (commands, menus, views, languages)"]
    
    D --> D1["activate() Entrypoint Decompilation"]
    D --> D2["vscode.commands.registerCommand Handlers"]
    D --> D3["Configuration & Secret Storage Usage"]
    
    E --> E1["WebviewPanel & HTML / postMessage IPC"]
    E --> E2["Spawned Language Servers (LSP) & Debug Adapters (DAP)"]
    E --> E3["Native .node Addons & WASM Binaries"]
    
    F --> F1["ChatParticipant & LanguageModelTool Registrations"]
    F --> F2["MCP (Model Context Protocol) Server Spawns"]
    
    C & D & E & F --> G["Synthesized VS Code Extension Specification & Capability Map"]

Technical Capabilities & Modules

VSIX Package Ingestion & Manifest Validation:
- Unpack .vsix Open Packaging Conventions (OPC) ZIP containers.
- Parse extension/package.json to extract extension identity, version, dependencies, engines, activationEvents, and contributes.
- Validate contribution points: commands, views, configuration settings, keybindings, menus, and custom editors.
Command Registration & Handler Correlation:
- Decompile extension entrypoint (main or browser).
- Correlate contributes.commands IDs with vscode.commands.registerCommand(id, handler) implementations in bundled JavaScript/TypeScript.
- Map menu clicks and keyboard shortcuts directly to backend handler functions.
Webview IPC & Frontend Reconstruction:
- Detect vscode.window.createWebviewPanel and WebviewViewProvider.
- Extract inline or external webview HTML, scripts, and CSS.
- Map bidirectional webview.postMessage and webview.onDidReceiveMessage protocol flows.
Language Server & Subprocess Architecture:
- Detect Language Server Client (vscode-languageclient) and Debug Adapter (vscode.DebugAdapterDescriptorFactory) instantiations.
- Trace executable paths for spawned backend language servers (e.g., Python binaries, Rust LSPs, Java daemons).
- Identify native Node.js binary addons (.node) and WebAssembly modules (.wasm).
AI Tools & MCP Protocol Integration:
- Inspect vscode.chat.createChatParticipant registrations and prompt handling logic.
- Detect language model tool definitions (vscode.lm.registerTool).
- Identify bundled MCP servers, stdio command configurations, and remote tool bridge endpoints.

Acceptance Criteria

Ingest .vsix packages or installed extension directories and extract all assets.
Map 100% of declared contribution points (package.json) to their runtime JavaScript handlers.
Reconstruct webview IPC messaging channels and extract rendered webview HTML/assets.
Identify spawned LSP/DAP subprocesses, native .node addons, and embedded WASM binaries.
Detect modern AI chat participants, prompt handlers, and MCP server integrations (#3672).

Complements #3672 (AI agent protocol reverse engineering: MCP, A2A, tool calling)
Complements #3608 (React Semantic Reconstruction & Decompiler Engine)
Complements #117 (Full-stack reconstruction)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3687 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Visual Studio Code is the world's most widely adopted developer environment (>70% market share according to developer surveys), with over 80,000 extensions published on the Visual Studio Marketplace. Extensions range from simple syntax highlighters to complex, multi-process distributed systems featuring embedded language servers, debug adapters, custom webview GUIs, native Node.js C++ addons, WebAssembly modules, and AI agent / Model Context Protocol (MCP) bridges. When auditing or reverse engineering an extension (`.vsix` package or installed extension directory), analysts lack a dedicated tool that comprehends VS Code's extension-host contract: 1. **Manifest Architecture (`package.json`)**: `activationEvents`, `contributes` points (commands, menus, views, keybindings, custom editors, languages, debuggers). 2. **Extension Lifecycle & Activation**: `activate(context: vscode.ExtensionContext)` entrypoint and registered disposables. 3. **Webview IPC**: Communication channels (`postMessage`, `onDidReceiveMessage`) between the extension host and embedded webview HTML panels. 4. **Language Server & Debug Adapter Boundaries**: Custom LSP (Language Server Protocol) and DAP (Debug Adapter Protocol) subprocesses spawned by the extension. 5. **AI & Agentic Integrations**: Modern extensions integrating language model tools, Chat Participant APIs (`vscode.chat.createChatParticipant`), and MCP servers. REA already possesses engines for ZIP archives, JavaScript/Node.js ASTs, native modules, and MCP protocols (#3672). A dedicated VS Code extension engine will unify these into a high-level extension architecture reconstruction. ### Proposed Architecture ```mermaid flowchart TD A[".vsix Package / Extension Directory"] --> B["VS Code Extension Reconstruction Engine"] B --> C["Manifest & Contribution Point Parser"] B --> D["Extension Host Lifecycle & Command Mapper"] B --> E["Webview & Subprocess Boundary Analyzer"] B --> F["AI Chat & MCP Tool Inspector"] C --> C1["activationEvents & triggers"] C --> C2["contributes (commands, menus, views, languages)"] D --> D1["activate() Entrypoint Decompilation"] D --> D2["vscode.commands.registerCommand Handlers"] D --> D3["Configuration & Secret Storage Usage"] E --> E1["WebviewPanel & HTML / postMessage IPC"] E --> E2["Spawned Language Servers (LSP) & Debug Adapters (DAP)"] E --> E3["Native .node Addons & WASM Binaries"] F --> F1["ChatParticipant & LanguageModelTool Registrations"] F --> F2["MCP (Model Context Protocol) Server Spawns"] C & D & E & F --> G["Synthesized VS Code Extension Specification & Capability Map"] ``` ### Technical Capabilities & Modules 1. **VSIX Package Ingestion & Manifest Validation:** - Unpack `.vsix` Open Packaging Conventions (OPC) ZIP containers. - Parse `extension/package.json` to extract extension identity, version, dependencies, engines, `activationEvents`, and `contributes`. - Validate contribution points: commands, views, configuration settings, keybindings, menus, and custom editors. 2. **Command Registration & Handler Correlation:** - Decompile extension entrypoint (`main` or `browser`). - Correlate `contributes.commands` IDs with `vscode.commands.registerCommand(id, handler)` implementations in bundled JavaScript/TypeScript. - Map menu clicks and keyboard shortcuts directly to backend handler functions. 3. **Webview IPC & Frontend Reconstruction:** - Detect `vscode.window.createWebviewPanel` and `WebviewViewProvider`. - Extract inline or external webview HTML, scripts, and CSS. - Map bidirectional `webview.postMessage` and `webview.onDidReceiveMessage` protocol flows. 4. **Language Server & Subprocess Architecture:** - Detect Language Server Client (`vscode-languageclient`) and Debug Adapter (`vscode.DebugAdapterDescriptorFactory`) instantiations. - Trace executable paths for spawned backend language servers (e.g., Python binaries, Rust LSPs, Java daemons). - Identify native Node.js binary addons (`.node`) and WebAssembly modules (`.wasm`). 5. **AI Tools & MCP Protocol Integration:** - Inspect `vscode.chat.createChatParticipant` registrations and prompt handling logic. - Detect language model tool definitions (`vscode.lm.registerTool`). - Identify bundled MCP servers, stdio command configurations, and remote tool bridge endpoints. ### Acceptance Criteria - [ ] Ingest `.vsix` packages or installed extension directories and extract all assets. - [ ] Map 100% of declared contribution points (`package.json`) to their runtime JavaScript handlers. - [ ] Reconstruct webview IPC messaging channels and extract rendered webview HTML/assets. - [ ] Identify spawned LSP/DAP subprocesses, native `.node` addons, and embedded WASM binaries. - [ ] Detect modern AI chat participants, prompt handlers, and MCP server integrations (#3672). ### Related Issues & Dependencies - Complements #3672 (AI agent protocol reverse engineering: MCP, A2A, tool calling) - Complements #3608 (React Semantic Reconstruction & Decompiler Engine) - Complements #117 (Full-stack reconstruction)

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:11:05 +00:00

[PR #1400] [MERGED] fix(electron): support packaged app.asar pages and rewritten unpacked companions #2857

bsakaguchi referenced this issue

2026-10-31 00:41:52 +00:00

[GH-ISSUE #5872] [Bug] Electron file targets reject encoded separators in query or fragment #3559