## Problem to solve The Web IDE Beta is based on the open source VS Code project. It includes a myriad of features and capabilities from the core editor, including the ability to install extensions to customize and enhance the editor's functionality. Extensions can run in two contexts: Desktop and Browser. While web extensions have [a more limited sandbox](https://code.visualstudio.com/api/extension-guides/web-extensions), both contexts provide extension authors access to potentially private or sensitive data in your project. For this reason, extensions are currently disabled in the Web IDE, but we don't want that to be the case forever. ## Goal Enable extensions for everyone in the Web IDE ## Limitations 1. The Web IDE runs entirely in the browser. This context does not provide VS Code the same level of runtime capabilities and as a result, it has a limited subset of extensions available for installation. Anything that needs to compile code must be installed in a GitLab workspace - a fully featured remote development environment. 2. Access to the "official" VS Code marketplace is restricted to Microsoft. We will have to get extensions from the [Open VSX Registry](https://open-vsx.org/). ## Out of scope The goal of this epic is to make extensions available but there is related functionality that we won't be tackling, yet. Any of these things may be included in future iterations, but are considered out of scope for this epic: 1. Syncing extensions across Desktop and Web IDE 2. Building an internal extension marketplace for your GitLab organization 3. Maintaining an allowlist or blocklist for extensions for your GitLab organization ## Details We do need to support the following scenarios: ### SaaS users 1. Extensions enabled by default 2. Show information in the Web IDE extensions tab about the risks of installing third-party extensions 4. Document the capabilities and limitations of the extensions in docs.gitlab.com and encourage users to read the terms for each extension before installation ### Self-managed users 1. Create an instance-level setting for enabling extensions, enabled by default or override the marketplace URL 3. All other use cases are the same as SaaS ## Questions 1. Should this be a user preference or a group/project preference? It seems like a decision an administrator would make on behalf of all users and any future functionality like an allowlist could conflict with a user-level decision to enable/disable extensions. 2. If we disable extensions explicitly from the instance/group/project level, should we hide the tab from the Web IDE sidebar entirely? 3. How can we ensure the same settings are applied to the remote development workspace?