HTMLShell

Run any *.vsc.html file in a VS Code panel. It can fire shell commands and read back the exit code and output. The .vsc.html extension IS the trust boundary: no per-command approval, no whitelist. Plain .html never runs.

.vsc.html files get their own icon and syntax highlighting so they're visually distinct from plain .html.

commands

• HTMLShell: Run, explorer right-click, editor-title icon, or palette.
• HTMLShell: Reload, re-reads the target file from disk.
• HTMLShell: Open Source, opens the target file beside the panel.
• HTMLShell: Show Logs, opens the Output channel.

While a panel is focused, a ? vsc.html status-bar item hovers the message contract below.

message contract

The target loads in a sandboxed iframe and talks to the extension via postMessage.

Target to extension, fires immediately in the visible integrated terminal (no PATH prefix, no user switch, no sudo):

window.parent.postMessage({cmd: 'run', text: 'ls -la'}, '*')

Extension to target, the only message a target ever receives:

window.addEventListener('message', e => {
  if (e.data.cmd !== 'result') return
  // text:     command this result is for
  // ok:       true | false | null (null = degraded)
  // exitCode: number | null
  // stdout:   string | null
  // degraded: true = no shell integration, command ran, status unknown
})

A run you don't listen for still fires; result capture uses the terminal's Shell Integration API, which isn't always active (a fresh terminal, or a shell that never injects it). Those cases still run the command, just report {ok: null, degraded: true}.