The mandatory extension arrives as a POST

Every team has tooling it needs everyone to run: the license-header checker, the security linter, the internal snippet pack that never made it to a marketplace. Hoody Code exposes extension management as HTTP. POST /api/v1/code/extensions/install with a VSIX URL and the instance installs it, straight from wherever you host the file; set asBuiltin: true and it lands as a built-in that users can't uninstall. GET /extensions/list turns compliance into a loop: twelve dev containers, twelve requests, one report of who's missing what.

The old distribution mechanism was a wiki page and hope. The new one is a for-loop over the fleet, including extensions that exist only on your own server.