VSCodium¶

ID: vscodium
Home page: https://vscodium.com
Version requirement: >= 1.60
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · install · remove
purl types: pkg:vscodium
CLI name: codium
Issues and PRs: 📦 manager: vscode-based
Source: meta_package_manager/managers/vscodium.toml

VSCodium is the telemetry-free community build of Visual Studio Code; its codium CLI exposes the exact same extension command surface as code, so this definition mirrors vscode.toml.

Homebrew Bundle has no vscodium entry type, and its vscode entry installs to VS Code only, so mpm dump --brewfile skips VSCodium extensions rather than silently misrouting them (see brewfile_skip_warning below).

No version_regexes: codium --version prints the bare version, then the commit hash and the arch on their own lines, and the default regex picks the first token up.

What `mpm` adds to `vscodium`¶

mpm reaches across every manager at once, not vscodium alone: mpm installed and mpm outdated cover vscodium alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `vscodium` commands, in `mpm`¶

You already know vscodium: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `vscodium`	With `mpm`
List what’s installed	`codium --list-extensions --show-versions`	`mpm --vscodium installed`
Install a package	`codium --install-extension <package_id>`	`mpm install pkg:vscodium/<package_id>`
Remove a package	`codium --uninstall-extension <package_id>`	`mpm remove pkg:vscodium/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`
`orphans`
`search`
`install`	✓
`upgrade`
`upgrade_all`
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `vscodium`¶

Deselect vscodium for a single run with --no-vscodium, or persist the choice in your configuration:

[mpm]
vscodium = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.vscodium]
timeout = 900

mpm config-template vscodium prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around vscodium, one mpm command each:

Snapshot and clone a machine: mpm --vscodium dump vscodium.toml, then mpm restore vscodium.toml on the next one.
Export a compliance SBOM: mpm --vscodium sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of VSCodium’s release-age gating, from the cooldown support table:

Status: 🚧 Proposed
Mechanism: proposed enterprise policy
Reference: microsoft/vscode#316867

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: VS Code Marketplace
Retraction: Unpublish, uniquely with client-side remediation: “the extension is removed from the Marketplace and added to a block list. If the extension has been installed, it’s automatically uninstalled by VS Code” (runtime security), against a public ledger of removals (RemovedPackages.md)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ codium --version
1.60.2
7f6ab5485bbc008386c4386d08766667e155244e
x64

and extracted with:

r"(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know VSCodium well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ codium --list-extensions --show-versions
tamasfe.even-better-toml@0.14.2

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --vscodium installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

5.19.0 (2024-11-14)
- Add support for VSCodium plugins.