fix: properly parse JSONC in extensions.json and batch extension installs

[rodmk]

Fixes #708.

Summary

• Replace broken sed | jq JSONC parsing with a proper state-machine parser using the bundled Node.js binary
• Batch extension installs into a single invocation (repeated --install-extension flags) instead of one process per extension

Problem

.vscode/extensions.json is JSONC (JSON with Comments), not strict JSON. The sed 's|//.*||g' | jq pipeline fails on block comments, trailing commas, and mangles URLs in strings.

Fix

• JSONC parser (parse_jsonc_extensions.js) — uses the node binary already bundled with code-server/vscode-web, no new dependencies
• Batched installs — repeated --install-extension flags in one call instead of N separate processes

Note on duplication

parse_jsonc_extensions.js is duplicated in both code-server/ and vscode-web/. The repo structure validator requires every subdirectory under modules/ to be a full module, so a shared lib/ directory isn't possible. This matches existing patterns (e.g. JFrog .tftpl duplication). Happy to refactor if there's a preferred way to share code across modules.

Test plan

• Unit tests (parse_jsonc_extensions.test.ts): comments, trailing commas, URL safety, .code-workspace format
• Verified batched --install-extension works with code-server
• End-to-end: JSONC extensions.json (with //, /* */, trailing commas) parsed and extensions installed in single batched call using code-server's bundled node

🤖 Generated with Claude Code

[matifali]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a418556ae4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve string contents when removing trailing commas

The trailing-comma pass result.replace(/,(\s*[\]}])/g, "$1") is not string-aware, so it also rewrites valid string data that happens to contain ,] or ,}. In extensions.json, a recommendation like https://example.com/a,].vsix is mutated to https://example.com/a].vsix before JSON.parse, which leads to installing the wrong extension ID/URL (or a failed install); the same parser logic is duplicated for vscode-web, so both modules are affected.

Useful? React with 👍 / 👎.

[rodmk]

This is a non-issue for valid inputs. The recommendations array in extensions.json only accepts extension identifiers in publisher.extensionName format, and both components are validated by vsce's nameRegex:

/^[a-z0-9][a-z0-9\-]*$/i

Only letters, digits, and hyphens are allowed — no commas, brackets, or braces. The characters ,] / ,} that would trigger this regex bug cannot appear in any valid extension identifier. The example https://example.com/a,].vsix is not a valid extensions.json entry (VSIX URLs are a CLI-only feature for --install-extension, not supported in recommendations[]).

That said, making the trailing-comma removal string-aware would be a nice hardening improvement — happy to do it if reviewers prefer, but it's not a correctness issue for this use case.

Generated with Claude Code

[rodmk]

Update: string-aware trailing-comma removal

Addressed the Codex review feedback by making the trailing-comma removal string-aware. Instead of a separate regex pass (result.replace(/,(\s*[\]}])/g, "$1")), trailing commas are now handled inside the existing state-machine loop using a pendingComma buffer — the comma and any following whitespace are buffered, then dropped if the next meaningful token is ]/}, or flushed otherwise. This eliminates the possibility of modifying characters inside quoted strings.

Also added a regression test for the edge case with a comment noting it's hardening only (extension IDs are restricted to [a-z0-9-] by vsce's nameRegex, so ,]/,} can't appear in valid input).

All CI checks pass on the fork: rodmk#2

Generated with Claude Code