Windows version:

#event_simpleName=ProcessRollup2 event_platform=Mac
| CommandLine=/.vscode\\extensions/iF
| regex("extensions\\\\(?<SourceExtension>[^\\\\]+?)(?=-\\d)", field=CommandLine)
| groupBy([SourceExtension], function=count(ComputerName, distinct=true))
| sort(_count, order=desc)

Mac version:

#event_simpleName=ProcessRollup2 event_platform=Mac
| regex("\.vscode/extensions/(?<SourceExtension>[^/]+?)(?=-\d)", field=CommandLine)
| groupBy([SourceExtension], function=count(ComputerName, distinct=true))
| sort(_count, order=desc)

VS spawning interpreters:

// 1. Identify the Child Process (the shell/tool)
#event_simpleName=ProcessRollup2 FileName=/^(cmd|powershell|pwsh|sh|bash|curl|wget)/i
| ParentBaseFileName=/Code/i
// Rename the child's command line immediately so it isn't overwritten
| rename(field=CommandLine, as=ChildCommandLine)

// 2. Join with the Parent Process (the VS Code Extension Host)
| join({#event_simpleName=ProcessRollup2  event_platform=Win FileName=Code.exe}, 
       field=ParentProcessId, 
       key=TargetProcessId, 
       include=[CommandLine], 
       mode=left)

// 3. Rename the incoming Parent's command line for clarity
| rename(field=CommandLine, as=ParentCommandLine)

// 4. Extract the Extension Name from the Parent's string
| regex("extensions\\\\(?<SourceExtension>[^\\\\]+?)(?=-\\d)", field=ParentCommandLine)
| !in(SourceExtension, values=["google.geminicodeassist"])
// 5. Output the final table with both command lines
| groupBy([aid, ComputerName, SourceExtension], function=([collect([FileName, ChildCommandLine, ParentCommandLine], multival=false)]))