[PRIVACY] Undocumented network request sends installed-extension list to the VS Marketplace

[BoxBoxJason]

Note

This issue was generated using AI, if anything lacks clarity or context, please ask for clarification before starting work.

Summary

extensionsListeners.checkOutdatedExtensions POSTs the list of the user's
installed (non-builtin) extension IDs to
https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery. This
is the only outbound network call in the extension, yet it is not surfaced to the
user and there is no dedicated opt-out.

Location

src/listeners/extensions.ts → fetchLatestExtensionVersions /
checkOutdatedExtensions

const extensionIds = nonBuiltinExtensions.map(
  (ext) => `${ext.packageJSON.publisher}.${ext.packageJSON.name}`,
);
const latestVersions = await fetchLatestExtensionVersions(extensionIds);

It runs on activation and on every vscode.extensions.onDidChange.

Why it matters

• The README markets per-listener toggles as a privacy feature ("Enable or
  disable any type of listeners for privacy"), so users reasonably expect the
  extension to be local-only. A silent network request that transmits their
  installed-extension fingerprint contradicts that expectation.
• The installed-extension set can be semi-identifying.

Suggested fix

• Document the network behavior clearly in the README and the
  achievements.listeners.extensions setting description.
• Consider gating this specific outbound call behind its own opt-in setting
  (e.g. achievements.checkOutdatedExtensions, default it conservatively), so
  disabling network access does not require disabling all extension achievements.
• Confirm onDidChange doesn't cause excessive marketplace calls (see also the
  debounce/perf issues).

Severity

Medium — privacy/expectation mismatch and transparency gap.