I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.
What are you withholding from the sandbox without making it useless?
What are you withholding from the sandbox without making it useless?