The Shipmoor IDE Extension brings the same CLI-backed integrity findings you get from a scan into your editor, surfaced as native diagnostics: squiggles right under the code that earned them. It is a deliberately thin client: the shipmoor CLI is the engine for everything (scan, auth, entitlements), and the extension never re-implements detection. Because it runs the same CLI and reads the same shipmoor.scan.v1 schema as your CI, an editor squiggle maps to exactly what CI would flag, with no second linter and no second opinion to reconcile.
A deliberately thin client
The extension shells out to the local, licensed shipmoor CLI for everything and consumes the same stable JSON contracts every other Shipmoor surface uses:
| What you see | Where it comes from |
|---|---|
| Findings as diagnostics | shipmoor scan --json (shipmoor.scan.v1) |
| Which features are on | shipmoor capabilities --json |
| Identity and grace state | shipmoor whoami --json |
The CLI is the brain; the extension is a well-tested thin client. The consequence worth caring about: the editor can never disagree with the CLI, your CI, or your agent harness about what a finding is, because they all read the same engine’s output. A rule fixed in the CLI is fixed everywhere at once.
What it does
Scans automatically. Out of the box the extension scans on save (default on), on open, and on startup (default on, scanning the workspace when it opens). You can also opt into scan-on-type, debounced after a short pause and off by default because it is most comfortable with the language-server transport.
Scans on demand. Three manual commands cover the common scopes:
| Command | Scope |
|---|---|
| Shipmoor: Scan Current File | The active editor’s file. |
| Shipmoor: Scan Workspace | The whole workspace. |
| Shipmoor: Scan Changed Files | The files your change touched. |
Renders findings as diagnostics. Each finding becomes a native editor diagnostic, with severity mapped deterministically so the editor and CI agree on what is an error versus a warning:
| Shipmoor severity | Editor diagnostic |
|---|---|
critical, high | Error |
medium | Warning |
low | Information |
info | Hint |
Shows a truthful status-bar indicator. A Shipmoor integrity indicator in the status bar reports honest counts: a clean state when there is nothing to flag, or something like 3 high, 2 medium when there is. The status bar counts every finding even when a severity threshold hides the lower-severity squiggles, so the number never undersells what was found.
Offers code actions on each finding:
- Explain this finding opens a side panel with why the finding matters and how to fix it. It makes no network call and sends no source anywhere.
- Ignore this finding writes a
shipmoor:ignore <rule> reason="..."comment that the CLI honors on the next scan, so the suppression lives in the code and travels with it, and the CLI (not the editor) is what respects it.
Languages: python, typescript, javascript, and go.
Transport: language server or per-scan CLI
The extension talks to the engine over a long-lived language server (shipmoor lsp) when the CLI provides one, and otherwise falls back to per-invocation CLI scans. You control this with the shipmoor.runner setting:
shipmoor.runner | Behavior |
|---|---|
auto (default) | Use the language server when available, otherwise the per-scan CLI runner. |
lsp | Force the language server. |
cli | Force the per-scan CLI runner. |
The language-server runner is what makes scan-on-type feel instant; auto picks it up automatically and falls back on its own if it is unavailable.
Entitlement
The extension is a paid IC feature, gated on the ide_extension_pro entitlement. It is free to install from the Marketplace / Open VSX. With no entitlement it still activates, but emits no diagnostics; instead it prompts you to sign in or upgrade. It reads its entitlement state from shipmoor capabilities, the same source every other Shipmoor surface uses, so a fresh shipmoor login or an expiring grace period is reflected without reinstalling. See Capabilities & entitlements for how that state is resolved.
Agent and Claim Check awareness
On top of the structural findings every entitled user gets, the extension turns on two extra layers when your plan already carries the matching engine entitlement. There is no new tier and nothing to switch on: the affordances appear automatically when shipmoor capabilities reports the entitlement, and they disappear again if it lapses.
Agent-aware diagnostics (agent_harness). When a finding is attributed to an agent edit (through the scanner’s agent_session field or a reachable Agent Harness), it gets an amber gutter badge, and a Send this finding back to the agent code action appears. It posts a metadata-only payload (finding_id, rule, severity, range, message, file_uri, never your source) to the harness inbox at .shipmoor/agent-inbox/, where shipmoor harness inbox drains it into the repair loop. If no harness is running, the action explains how to start one instead of failing.
Claim Check in the editor (intent_scan). Claim Check findings (where a change didn’t do what the task asked, in the scanner’s intent_integrity category) get a distinct blue decoration. Set Intent records the task the current change is meant to satisfy so Claim Check can check the diff against it; Clear Intent removes it. The intent lives only in editor workspace state, never committed, logged, or transmitted, and the editor prefers the harness’s .shipmoor/intent.txt when present, so the editor and the harness check against the same task.
Privacy
The extension is local-first. Scans run on your machine through the CLI, output is scrubbed, there is no telemetry, and your source never leaves the machine. The Explain panel is computed locally with no network call, and Ignore writes a comment into your own file. The agent send-back payload is metadata only (finding id, rule, severity, range, message, and file URI, never your source), and any task intent you set stays in editor workspace state. Nothing is transmitted.
Where it fits
The same change can be checked at four moments: as the agent edits (Agent Harness), inside the agent’s own loop (Agent Skills), in your editor (this extension), and at the merge gate (CI). The extension is the human-facing one, for when you are the one editing or reviewing what an agent did.
Next
- Install & activate: Marketplace install and entitlement activation.
- Capabilities & entitlements: how the extension reads what’s on.
- Using with Claude Code: pairing the editor surface with the harness loop.