unpublish should require more confirmation than just a "y"

[alisonatwork]

Last night I accidentally made a critical mistake that destroyed 7-8 years of version history, installation count and reviews for an extension that I maintain. I was almost in tears for having destroyed so much work with a single keypress and still feel terrible today. It was my mistake and I take full responsibility, but I feel like the vsce tool didn't try hard enough to stop me from making the mistake. My workflow was this:

1. I typed vsce publish to publish a new version
2. Hit "y" twice to go past the prompts that appear every single time we need to release a version
3. Immediately after publishing I realized I was in the wrong directory (different branch) and had published the wrong code
4. Instinctively typed vsce unpublish to revert my change and reflexively hit ''y" because I have been trained to hit "y" a bunch of times for vsce to do anything

This blew away all the history of auiworks.amvim from the Marketplace. I immediately realized my mistake and tried to Ctrl-C out of it, but it was too late. For such an incredibly destructive operation, it feels like there should be more confirmation than just the short prompt and standard yes/no choice found for much more trivial confirmations in the rest of the app.

I propose that vsce follows the example of Github, where even just to delete a local fork of a repository you need to type the entire repository name out. I am quite certain that if vsce unpublish had prompted me to type the qualified name of the extension before going ahead with the removal, I would have realized my mistake and canceled out of it.

Related to microsoft/vsmarketplace#235

[joaomoreno]

That sucks, I'm so sorry you went through this. Have you reached out to the Marketplace team to restore your history? Would you like me to give you a connection? They might be able to do something about it. cc @isidorn

Your suggestion makes sense. But given that extension authors can unpublish via https://marketplace.visualstudio.com/manage why don't we simply remove this functionality from vsce instead?

[alisonatwork]

That would work too. Personally I don't see any use case for automating the (presumably very infrequent) unpublish action, so it doesn't seem particularly useful to include in this command-line application. The only use case I can come up with for automatically unpublishing an extension is the anti-abuse case, which presumably would be done via some internal Microsoft tool.

[joaomoreno]

Fixed in 2.14.0.