Extension crashes with "Unknown Error" when another extension has non-array `contributes.commands` in package.json

[apoblock]

What happened?

Agentforce Vibes (v3.36.0) fails to activate with an "Unknown Error" notification when any other installed VS Code extension has contributes.commands defined as an object instead of an array in its package.json.

The error occurs in updatePreviewAvailability() which iterates over all installed extensions and calls .some() on packageJSON.contributes.commands without verifying it's an array first.

Steps to reproduce

1. Install any VS Code extension that has a malformed package.json with contributes.commands as an object instead of an array, e.g.:

   {
     "contributes": {
       "commands": {
         "command": "extension.someCommand",
         "title": "Some Command"
       }
     }
   }

2. Open a Salesforce DX project with Agentforce Vibes installed
3. Extension fails to activate with "Unknown Error" notification

Additional context

Expected Behavior

The extension should gracefully handle malformed extensions and skip them when checking for command availability.

Actual Behavior

The extension throws:

TypeError: a.packageJSON?.contributes?.commands?.some is not a function

This error is caught by handleActivationError() but doesn't match any known error type, so it falls through to the generic "Unknown Error" message — providing no actionable information to the user.

Root Cause

In updatePreviewAvailability():

static updatePreviewAvailability() {
    const hasCommand = (command: string) =>
        vscode.extensions.all.some(
            ext => ext.packageJSON?.contributes?.commands?.some(
                (cmd: any) => cmd.command === command
            )
        );
    this.isLivePreviewAvailable.set(hasCommand(LIVE_PREVIEW_COMMAND));
    this.isDataVisualizationAvailable.set(hasCommand(DATA_VIZ_COMMAND));
}

The optional chaining (?.some) only guards against null/undefined, not against non-array values. If commands is an object (which is invalid per VS Code's schema but possible in practice), the call fails because objects don't have a .some() method.

Proposed Fix

Add an Array.isArray() check before calling .some():

static updatePreviewAvailability() {
    const hasCommand = (command: string) =>
        vscode.extensions.all.some(
            ext => Array.isArray(ext.packageJSON?.contributes?.commands) &&
                   ext.packageJSON.contributes.commands.some(
                       (cmd: any) => cmd.command === command
                   )
        );
    this.isLivePreviewAvailable.set(hasCommand(LIVE_PREVIEW_COMMAND));
    this.isDataVisualizationAvailable.set(hasCommand(DATA_VIZ_COMMAND));
}

Additional Context

• The error is particularly hard to diagnose because:
  • The debug log shows handleActivationError: Error message: with an empty value (the TypeError message doesn't match the extension's error type checks)
  • The Output panel for "Agentforce Vibes" shows no useful information
  • The actual error only appears in the Developer Tools console
• The offending extension in our case was qi-tools.core-eslint which defines contributes.commands as a single object rather than a one-element array
• This completely blocks all Vibes functionality (chat, inline completions, etc.) even though the actual feature has nothing to do with the malformed extension

Environment

• Agentforce Vibes: v3.36.0
• VS Code: latest
• OS: macOS (Darwin 25.5.0, arm64)

Salesforce Telemetry ID

Salesforce CLI ID is 361c5748e5345d0f2497ef4d0ed63054b243696c.

[mohanraj-r]

Thanks for the precise write-up — your root-cause read is correct: the extension scan iterated another installed extension's command contributions without guarding for a non-array shape, so a third-party extension declaring contributes.commands as an object made the scan throw, which surfaced as the generic error.

We've added a guard so a malformed third-party contribution is skipped instead of breaking the scan. The fix is landing in an upcoming Agentforce Vibes release on the VS Code Marketplace.

Note that 4.x is a ground-up replatform, so the activation path differs from 3.36.0 — but we reproduced the underlying crash and the guard covers it. Please update once it's out and let us know if anything remains.

Salesforce internal reference: W-23204634