ALcops-Static-Dependencies

An offline companion for arthurvdv.alcops, not an official ALCops release. Its Marketplace identifier is VincentUntiedt.alcops-static-dependencies-offline; the Marketplace slug stays lowercase while the display name preserves the requested ALcops capitalization. Its VSIX contains all seven ALCops analyzer DLLs for each of net8.0, net10.0, and netstandard2.1, pinned to ALCops.Analyzers 1.3.2. There are no npm dependencies, runtime downloads, subprocesses, or update checks in this companion.

Important security boundary

The original ALCops extension downloads NuGet packages, not npm packages. VS Code does not provide an API for a companion to firewall another extension, intercept its HTTP requests, or run before its first activation.

This companion disables alcops.automaticUpdates and sets alcops.updateNotification to manual. It installs the bundled DLLs and a compatible .alcops-manifest.json, removing pending-download metadata. These settings do not disable the original extension's first-install, reinstallation, pending-install, or manual download paths. The original ALCops: Install and ALCops: Check for Updates commands remain available. There can be startup races, including after an AL extension update.

Keep external network enforcement in place for NuGet and any redirect/CDN destinations. An organizational extension-host egress allowlist is preferable to relying on this extension or a single hostname block. For a strict no-attempts policy, keep the original extension disabled; the bundled analyzers can still be used by AL directly, but its ALCops UI will be unavailable. The original extension also references an online JSON schema; this companion does not replace that schema or disable unrelated VS Code network traffic.

Hashes detect a payload differing from this reviewed release; they do not prove that an upstream release is safe, or protect against an attacker able to replace both the DLLs and this extension's lock file. Approve/sign the VSIX in your own distribution process.

Install in the restricted environment

1. Keep the network block enabled. Install AL Language (ms-dynamics-smb.al) and, if desired, the original ALCops extension from approved VSIX files.

2. Close other VS Code windows using AL. Open a trusted empty window to avoid loaded DLL file locks.

3. Use Extensions: Install from VSIX... and select alcops-static-dependencies-offline-0.2.0.vsix. Uninstall any previously installed VincentUntiedt.alcops-static-dependencies build to avoid activating both companion extensions.

4. Run ALCops Static: Install / Repair Bundled Analyzers if automatic startup has not already installed them. Reload the window, then open the AL project.

5. Use the original ALCops: Select Code Analyzers command to select rules. If the original extension is disabled, configure AL directly, for example:

   {
     "al.enableCodeAnalysis": true,
     "al.codeAnalyzers": [
       "${analyzerFolder}ALCops.Common.dll",
       "${analyzerFolder}ALCops.LinterCop.dll"
     ]
   }
   

The companion does not modify analyzer selections or enable code analysis. It changes the two update settings at User scope and replaces conflicting existing Workspace/Folder overrides, including in multi-root workspaces. Those changes persist after uninstall; restore them manually if desired. While the companion is active, changes to these settings are reapplied. Install it on the same extension host as AL and ALCops (including the remote host for SSH/WSL/containers). Web and untrusted/virtual workspaces are unsupported.

Behavior and troubleshooting

• Compatibility was inspected against ALCops 1.4.1. Other versions produce a log warning; revalidate upstream behavior before approving them.
• Detects both the legacy bin\Analyzers and newer flat bin layout from the AL compiler's location. Reads its target framework without executing DLLs. Chooses an equal or older compatible .NET payload, never a newer runtime.
• Verifies bundled and installed SHA-256 hashes. Repairs missing/changed DLLs and reapplies installation when AL is updated. Never downloads as fallback.
• Stages replacements with rollback and writes ALCops metadata last. Locked DLLs, unsupported frameworks, permissions, invalid manifests, and unknown ALCops DLLs produce errors in ALcops-Static-Dependencies output.
• An installation lock serializes companion writes across windows. After a process crash, close VS Code before removing .alcops-static.lock from the analyzer directory. If rollback fails, the error identifies retained recovery files; do not delete them until recovery is complete.
• If files are locked, close all AL windows, reopen an empty trusted window, and run the install command again. No automatic reload or download occurs.
• Do not use the original online install/update commands. The companion is not a continuous integrity monitor and does not undo a manual upstream install until its next reconciliation/repair.
• Uninstalling does not remove copied analyzers. Close AL windows and remove the DLL names listed in the lock file and .alcops-manifest.json manually if you no longer want them. Do not remove Microsoft's DLLs.

Build, test, and review

The checked-in payload\lib files make packaging fully offline. PowerShell 5.1+ and .NET's built-in ZIP support are sufficient; npm is not required.

.\scripts\Test.ps1
.\scripts\Package.ps1

If the local PowerShell execution policy prevents scripts, use your approved script-signing process or a process-scoped invocation, for example powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Test.ps1. No machine/user execution-policy changes are needed.

Tests use Node.js 22+ or, if absent, the Node runtime in a standard local VS Code installation. With Node installed, npm test also works without npm install. The package script checks every expected DLL hash and includes only an explicit allowlist of runtime files. It refuses to overwrite an existing VSIX; choose -OutputPath or explicitly remove the old artifact.

The extension manifest sets "public": true, which the packaging script includes as the VSIX Public gallery flag. The separate "private": true prevents accidental publishing of this project as an npm package; it does not publish the extension or control its Marketplace visibility.

To reproduce the payload from an approved copy of the exact NuGet package:

.\scripts\Prepare-Payload.ps1 -PackagePath C:\Approved\alcops.analyzers.1.3.2.nupkg

Only on an approved connected build machine, an explicit fetch is available:

.\scripts\Prepare-Payload.ps1 -Download

That script checks the hard-pinned archive SHA-256 and all 21 DLL hashes before writing files. It never resolves latest. No build scripts are shipped in the VSIX. payload-lock.json records the exact URL, upstream commit, and hashes. Changing release requires review of the new package, updating the lock and payload together, testing, and issuing a new companion VSIX.

The bundled DLLs are MIT licensed; see THIRD-PARTY-NOTICES.txt. The upstream license is from the exact source commit recorded by the package's nuspec. This project and its packaging code are also MIT licensed.