Modernize to v0.6.0: Node 18+, VS Code 1.85, TS 5.6, ESLint, CI

[ComfyChloe]

Overview

This PR modernizes aw-watcher-vscode to current toolchains, addresses long-standing security debt, and adds CI. It is the first release in roughly six years (the last release, 0.5.0, was never even tagged in git).

Heads-up: because aw-watcher-vscode has no git tags on upstream, the version is bumped 0.5.0 → 0.6.0. If reviewers prefer a different line (e.g. patch bump), it's trivial to change before merge.

---

Breaking changes

• Requires Node 18+ at runtime — the new aw-client-js uses global fetch.

• engines.vscode is now ^1.85.0 (was ^1.23.0, ~2018). The extension will refuse to install on older VS Code.

• aw-client-js API change — the new submodule (6093fbb) drops axios in favor of native fetch. The AWClient constructor signature is unchanged, but:

  • heartbeat() now returns Promise<void> (no wrapped response object).
  • FetchError is now thrown on non-2xx responses instead of an object with { err, httpResponse, data }.

  The extension was already using catch ({ err }) against the new shape, which would have crashed at the first failed heartbeat. Fixed.

---

What's new

Manifest

• version: 0.5.0 → 0.6.0
• engines.vscode: ^1.23.0 → ^1.85.0
• engines.node: added >=18
• activationEvents: ["*"] → ["onStartupFinished"] (no longer activates on every VS Code start)
• New settings: aw-watcher-vscode.enabled, aw-watcher-vscode.serverUrl

Dependencies

• typescript ^4.1.3 → ^5.6.0
• tslint (deprecated) → eslint ^8.57.0 + @typescript-eslint ^8 + prettier ^3.3.0
• vscode-test (deprecated) → @vscode/test-cli + @vscode/test-electron
• axios ^0.21.1 (CVE-2021-3749, CVE-2023-45857) → removed
• Added @vscode/vsce for npm run package
• mocha ^8.2.1 → ^10.7.0, @types/mocha ^2.2.42 → ^10.0.0, @types/node ^7.10.11 → ^22.0.0

Source

• src/extension.ts:
  • Heartbeat catch handler no longer destructures { err }; uses instanceof Error and reads .message.
  • initGit() is null-safe when the built-in Git extension isn't installed.
  • Honors enabled and serverUrl settings.
  • Throws away try/catch (err: any) in favor of err: unknown.
• src/test/extension.test.ts: replaced the fully-commented-out sample test with a real smoke test that verifies the compiled entry point exists.
• tsconfig.json: target es6 → es2022, added noUnusedParameters, noImplicitReturns, noFallthroughCasesInSwitch, forceConsistentCasingInFileNames, esModuleInterop. Added a paths mapping so aw-client resolves to the submodule source (aw-client-js is not published to npm).

Tooling

• tslint.json removed.
• Added .eslintrc.json, .eslintignore, .prettierrc.json.
• Added .vscode-test.js config for the new test runner.
• Added .github/workflows/ci.yml (lint + compile + test + .vsix artifact on Ubuntu).

Submodules

• aw-client-js: 11a7f066 (Jan 2021) → 6093fbb (latest master, includes Bearer-token auth support).
• media: cb597f7c (Apr 2020) → a45151 (latest master).

Docs

• CHANGELOG.md: added a full 0.6.0 section in Keep-a-Changelog format.
• README.md: documented new settings, added a "Development" section with the build/test commands, added the 0.6.0 release notes entry.

---

Verification

All run locally on Windows with Node 20:

Step	Result
npm install	311 packages, 0 errors
npm run lint	passes
npm run compile	passes
npm run test:mocha	1 passing
npm run package	produces aw-watcher-vscode-0.6.0.vsix (622 KB)

npm test (the full @vscode/test-cli integration suite) requires downloading VS Code, which the local dev environment blocks. The CI workflow runs it on Ubuntu with xvfb-run.

---

Risk assessment

• Low risk for downstream users: the bucket ID is unchanged (aw-watcher-vscode_<hostname>), the event schema is unchanged ({ language, project, file, branch }), and the only setting change is additive (new enabled/serverUrl settings default to existing behavior).
• Medium risk for binary shipping: the new aw-client-js builds work against the current aw-server API. If you have an older aw-server running, the FetchError will surface as a toast on every heartbeat — set aw-watcher-vscode.enabled: false to silence it.
• Security: axios removal is the single biggest win. npm audit still flags transitive issues in devDeps (mostly eslint's deprecation); those are dev-only and don't ship to users.

---

Checklist

• Version bumped in package.json
• CHANGELOG.md updated
• Submodules updated
• Lint + compile + tests pass
• .vsix builds
• CI workflow added
• Tag v0.6.0 after merge (no v0.5.0 tag exists upstream — adding the tag retroactively is a separate decision)
• Publish to Marketplace / Open VSX