Bump typescript from 5.9.3 to 7.0.2

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yaml

@@ -9,6 +9,8 @@ updates:
     cooldown:
       default-days: 7
     labels: []
+    commit-message:
+      prefix: "chore"
 
   - package-ecosystem: "npm"
     directory: "/"

.github/semantic.yaml

@@ -0,0 +1,66 @@
+###############################################################################
+# This file configures "Semantic Pull Requests", which is documented here:
+# https://github.com/zeke/semantic-pull-requests
+###############################################################################
+
+# Scopes are optionally supplied after a 'type'. For example, in
+#
+# feat(docs): autostart ui
+#
+# '(docs)' is the scope. Scopes are used to signify where the change occurred.
+scopes:
+  # docs: changes to the code-server documentation.
+  - docs
+
+  # vendor: changes to vendored dependencies.
+  - vendor
+
+  # deps: changes to code-server's dependencies.
+  - deps
+
+  # cs: changes to code specific to code-server.
+  - cs
+
+  # cli: changes to the command-line interface.
+  - cli
+
+# We only check that the PR title is semantic. The PR title is automatically
+# applied to the "Squash & Merge" flow as the suggested commit message, so this
+# should suffice unless someone drastically alters the message in that flow.
+titleOnly: true
+
+# Types are the 'tag' types in a commit or PR title. For example, in
+#
+# chore: fix thing
+#
+# 'chore' is the type.
+types:
+  # A build of any kind.
+  - build
+
+  # A user-facing change that corrects a defect in code-server.
+  - fix
+
+  # Any code task that is ignored for changelog purposes. Examples include
+  # devbin scripts and internal-only configurations.
+  - chore
+
+  # Any work performed on CI.
+  - ci
+
+  # Work that directly implements or supports the implementation of a feature.
+  - feat
+
+  # A refactor changes code structure without any behavioral change.
+  - refactor
+
+  # A git revert for any style of commit.
+  - revert
+
+  # Adding tests of any kind. Should be separate from feature or fix
+  # implementations. For example, if a commit adds a fix + test, it's a fix
+  # commit. If a commit is simply bumping coverage, it's a test commit.
+  - test
+
+  # A new release.
+  - release

.github/workflows/build.yaml

@@ -21,13 +21,12 @@ jobs:
     outputs:
       ci: ${{ steps.filter.outputs.ci }}
       code: ${{ steps.filter.outputs.code }}
-      npm: ${{ steps.filter.outputs.npm }}
-      vscode: ${{ steps.filter.outputs.vscode }}
+      deps: ${{ steps.filter.outputs.deps }}
       docs: ${{ steps.filter.outputs.docs }}
       helm: ${{ steps.filter.outputs.helm }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
@@ -43,12 +42,11 @@ jobs:
             code:
               - "src/**"
               - "test/**"
-            npm:
-              - "package-lock.json"
-              - "test/package-lock.json"
-            vscode:
+            deps:
               - "lib/**"
               - "patches/**"
+              - "package-lock.json"
+              - "test/package-lock.json"
       - id: debug
         run: |
           echo "${{ toJSON(steps.filter )}}"
@@ -58,7 +56,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -75,7 +73,7 @@ jobs:
     if: needs.changes.outputs.docs == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -92,19 +90,21 @@ jobs:
     if: needs.changes.outputs.helm == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: bmuschko/setup-kubeconform@e5d264ec1eafe2314e750c429a9da7639dd5a003 # v1.1.0
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          kubeconform-version: "0.8.0"
-      - run: kubeconform ci/helm-chart
+          token: ${{ secrets.GITHUB_TOKEN }}
+          version: "v3.19.2"
+      - run: helm plugin install https://github.com/instrumenta/helm-kubeval
+      - run: helm kubeval ci/helm-chart
 
   lint-ts:
     name: Lint TypeScript files
     runs-on: ubuntu-22.04
     needs: changes
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.ci == 'true' || needs.changes.outputs.npm == 'true'
+    if: needs.changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -132,10 +132,10 @@ jobs:
     name: Run unit tests
     runs-on: ubuntu-22.04
     needs: changes
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true'
+    if: needs.changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -172,7 +172,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -216,11 +216,11 @@ jobs:
     env:
       LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -252,7 +252,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
 
     steps:
       - name: Cache Caddy
@@ -270,7 +270,7 @@ jobs:
           tar -xzf caddy_2.5.2_linux_amd64.tar.gz --directory ~/.cache/caddy
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm

.github/workflows/publish.yaml

@@ -34,7 +34,7 @@ jobs:
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
 
@@ -83,7 +83,7 @@ jobs:
           git push --force
 
       - name: Validate package
-        uses: heyhusen/archlinux-package-action@3f7aaada28c782497bfe02d6d6ea365b25fdea12 # v3.0.1
+        uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
         with:
           pkgver: ${{ env.VERSION }}
           updpkgsums: true
@@ -109,14 +109,14 @@ jobs:
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release.yaml

@@ -80,7 +80,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -110,7 +110,7 @@ jobs:
       - run: |
           sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
         if: ${{ matrix.vscode_arch == 'x64' }}
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
@@ -123,7 +123,7 @@ jobs:
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
       - run: npm run package
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
@@ -174,7 +174,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -189,156 +189,7 @@ jobs:
       - run: npm run test:native
 
       - run: npm run package
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
-        with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./release-packages/*
-          tag_name: v${{ env.VERSION }}
-          name: v${{ env.VERSION }}
-
-  package-windows:
-    name: win32-x64
-    runs-on: windows-2022
-    if: >-
-      (github.event_name == 'workflow_dispatch') ||
-      (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/'))
-
-    defaults:
-      run:
-        shell: bash
-
-    env:
-      VSCODE_TARGET: win32-x64
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }}
-      # Ensure native modules are built from source to avoid prebuilds.
-      npm_config_build_from_source: true
-      OS: windows
-
-    steps:
-      # Git rewrites line endings on windows by default, which turns every
-      # shell script the build is made of into one bash cannot read, and
-      # every name in patches/series into one with a stray return.
-      - name: Keep line endings as they are in the repository
-        run: git config --global core.autocrlf false
-
-      - name: Strip update/ and v from tag and set major version
-        run: |
-          version=${TAG#update/}
-          version=${version#v}
-          version=4${version:1}
-          echo "VERSION=$version" >> $GITHUB_ENV
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          submodules: true
-
-      # quilt has no windows build. The patches are ordinary -p1 diffs
-      # against the repository root, so git applies them in series order.
-      - name: Apply patches
-        run: |
-          while read -r patch; do
-            case "$patch" in '' | '#'*) continue ;; esac
-            echo "applying $patch"
-            git apply --whitespace=nowarn "patches/$patch"
-          done < patches/series
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-
-      # npm hands every script it runs to cmd, which cannot run the shell
-      # scripts this repository is built out of. Point it at the same bash
-      # the steps here use rather than at a path, which moves between
-      # images.
-      - name: Let npm run shell scripts
-        run: echo "npm_config_script_shell=$(cygpath -w "$(command -v bash)")" >> $GITHUB_ENV
-
-      # The build merges json by handing jq a process substitution, which
-      # bash presents as a file under /dev/fd. The jq on this image is a
-      # windows program and cannot open those, so it reads the second input
-      # as nothing and the merge fails. Both the product and the package
-      # merge go through here.
-      - name: Let jq read what bash hands it
-        run: |
-          mkdir -p "$RUNNER_TEMP/shim"
-          cat > "$RUNNER_TEMP/shim/jq" <<'SHIM'
-          #!/usr/bin/env bash
-          set -euo pipefail
-          args=()
-          for arg in "$@"; do
-            case $arg in
-              /dev/fd/* | /proc/*/fd/*)
-                copy=$(mktemp)
-                cat "$arg" > "$copy"
-                args+=("$copy")
-                ;;
-              *) args+=("$arg") ;;
-            esac
-          done
-          exec jq.exe "${args[@]}"
-          SHIM
-          chmod +x "$RUNNER_TEMP/shim/jq"
-          echo "$RUNNER_TEMP/shim" >> $GITHUB_PATH
-
-      # Stamping version details into the native binaries clears any
-      # signature they arrived with and asks signtool whether there is one.
-      # That only reads and removes, so it wants no certificate and signs
-      # nothing. It just has to be findable, and the sdk carrying it is not
-      # on the path.
-      - name: Put signtool on the path
-        run: |
-          sdk=$(ls -d "/c/Program Files (x86)/Windows Kits/10/bin"/*/x64 | sort -V | tail -1)
-          test -x "$sdk/signtool.exe"
-          cygpath -w "$sdk" >> $GITHUB_PATH
-
-      # build-release.sh copies the tree with rsync, which neither windows
-      # nor the git bash on this image has. MSYS2 is already here, just not
-      # on the path.
-      - name: Install rsync
-        shell: cmd
-        run: C:\msys64\usr\bin\pacman -Sy --noconfirm --needed rsync
-
-      # Only rsync crosses over. Putting msys2's /usr/bin in front instead
-      # breaks the release step: npm on the path is a shell script whose
-      # shebang reads /usr/bin/env bash, so with msys2 first it is msys2's
-      # bash that runs it, and crossing into a second msys runtime does not
-      # carry the environment. npm then sees no script-shell and falls back
-      # to cmd, which cannot run ./ci/build/build-release.sh, and
-      # KEEP_MODULES is dropped on the way. A forwarder avoids the whole
-      # class: rsync is a native exe that loads its runtime from beside
-      # itself, and nothing else on the path moves.
-      - name: Reach rsync without moving the path
-        run: |
-          cat > "$RUNNER_TEMP/shim/rsync" <<'SHIM'
-          #!/usr/bin/env bash
-          exec /c/msys64/usr/bin/rsync.exe "$@"
-          SHIM
-          chmod +x "$RUNNER_TEMP/shim/rsync"
-
-      - run: npm ci
-      - run: npm run build
-      - run: npm run build:vscode
-      - run: KEEP_MODULES=1 npm run release
-
-      # Of the two tars on this image it is git bash's GNU one that can
-      # rename the tree's top directory as it archives; the windows bsdtar
-      # is built without substitution support. Asserted rather than
-      # assumed, since the two are interchangeable everywhere except here.
-      - name: Package
-        run: |
-          case "$(tar --version | head -1)" in
-            *GNU*) ;;
-            *) echo "expected GNU tar for --transform, got $(tar --version | head -1)" >&2; exit 1 ;;
-          esac
-          npm run package
-
-      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           draft: true
           discussion_category_name: "📣 Announcements"

.github/workflows/security.yaml

@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
 
@@ -62,7 +62,7 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           sarif_file: "trivy-repo-results.sarif"
 
@@ -80,13 +80,13 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           config-file: ./.github/codeql-config.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4

.github/workflows/trivy-docker.yaml

@@ -58,6 +58,6 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
         with:
           sarif_file: "trivy-image-results.sarif"

.node-version

@@ -1 +1 @@
-24.18.1
+24.18.0

CHANGELOG.md

@@ -22,60 +22,6 @@ Code v99.99.999
 
 ## Unreleased
 
-## [4.136.2](https://github.com/coder/code-server/releases/tag/v4.136.2) - 2026-09-08
-
-Code v1.136.1
-
-### Changed
-
-- Update to Code 1.136.1
-
-### Fixed
-
-- 4.136.2 replaces a removed 4.136.1 release that had the data path incorrectly
-  being set to `~/.vscode-server-oss/data`.
-
-## [4.135.0](https://github.com/coder/code-server/releases/tag/v4.135.0) - 2026-08-27
-
-Code v1.135.0
-
-### Changed
-
-- Update to Code 1.135.0
-
-## [4.134.0](https://github.com/coder/code-server/releases/tag/v4.134.0) - 2026-08-24
-
-Code v1.134.0
-
-### Added
-
-- New `--socket-fd` flag that can be used to listen on a file descriptor. In
-  particular, this allows using code-server with systemd's socket activation.
-- New `--vscode-option` repeatable flag that can be used to pass through options
-  to VS Code. It requires `flag=value` or simply `flag` for booleans. For
-  example: `--vscode-option enable-sandbox --vscode-option agents=true`. The
-  `VSCODE_OPTIONS` environment variable may also be used. For example:
-  `VSCODE_OPTIONS="enable-sandbox agents=true"`. Note that code-server simply
-  splits this variable on spaces and is not aware of quoting.
-
-### Changed
-
-- Update to Code 1.134.0
-- Remove `--unsafe-perm` from installation scripts. This flag results in an
-  error when used with npm since v12 and has been a no-op since v7. If you are
-  installing with a version of npm older than v7 as root, installation may not
-  work correctly.
-
-## [4.133.0](https://github.com/coder/code-server/releases/tag/v4.133.0) - 2026-08-17
-
-Code v1.133.0
-
-### Changed
-
-- Update to Code 1.133.0
-
-## [4.132.0](https://github.com/coder/code-server/releases/tag/v4.132.0) - 2026-08-10
-
 Code v1.132.0
 
 ### Changed

ci/build/build-packages.sh

@@ -25,7 +25,7 @@ main() {
 
 release_archive() {
   local release_name="code-server-$VERSION-$OS-$ARCH"
-  if [[ $OS == "linux" || $OS == "windows" ]]; then
+  if [[ $OS == "linux" ]]; then
     tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"
   else
     tar -czf "release-packages/$release_name.tar.gz" -s "/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"

ci/build/build-release.sh

@@ -41,11 +41,6 @@ main() {
     rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server"
     chmod 755 "$RELEASE_PATH/bin/code-server"
 
-    # Windows cannot run the shell launcher, so it gets one of its own.
-    if [ "$OS" = windows ]; then
-      rsync ./ci/build/code-server.cmd "$RELEASE_PATH/bin/code-server.cmd"
-    fi
-
     # Delete the extra bin scripts.
     rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-darwin.sh"
     rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-linux.sh"
@@ -116,7 +111,6 @@ bundle_vscode() {
 
   # Exclude Node since we want to place it in a directory above.
   rsync_opts+=(--exclude /node)
-  rsync_opts+=(--exclude /node.exe)
 
   # Exclude Node modules.  Note that these will already only include production
   # dependencies, so if we do keep them there is no need to do any
@@ -129,11 +123,7 @@ bundle_vscode() {
 
   # Copy the Node binary.
   if [[ $KEEP_MODULES = 1 ]]; then
-    if [ "$OS" = windows ]; then
-      cp "./lib/vscode-reh-web-$VSCODE_TARGET/node.exe" "$RELEASE_PATH/lib"
-    else
-      cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib"
-    fi
+    cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib"
   fi
 
   # Merge the package.json for the web/remote server so we can include

ci/build/build-vscode.sh

@@ -24,7 +24,6 @@ fix-bin-script() {
   # Fix Node path on Windows.
   sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$script"
   sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$script"
-  sed -i.bak 's/%ROOT_DIR%\\node.exe/%ROOT_DIR%\\lib\\node.exe/g' "$script"
 
   chmod +x "$script"
   rm "$script.bak"
@@ -133,7 +132,7 @@ EOF
   # Set vars and fix paths.
   case $OS in
     windows)
-      fix-bin-script remote-cli/code-server.cmd
+      fix-bin-script remote-cli/code.cmd
       fix-bin-script helpers/browser.cmd
       ;;
     *)

ci/build/code-server.cmd

@@ -1,8 +0,0 @@
-@echo off
-
-rem This script is intended to be bundled into the standalone releases.
-rem Runs code-server with the bundled node binary.
-
-setlocal
-set "ROOT=%~dp0.."
-"%ROOT%\lib\node.exe" "%ROOT%" %*

ci/build/npm-postinstall.sh

@@ -18,7 +18,7 @@ symlink() {
   dest="$2"
   rm -rf "$dest"
   case $OS in
-    windows) cmd //c mklink //J "$dest" "$source" ;;
+    windows) mklink /J "$dest" "$source" ;;
     *) ln -s "$source" "$dest" ;;
   esac
 }
@@ -65,9 +65,9 @@ main() {
     echo "USE AT YOUR OWN RISK!"
   fi
 
-  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-24}" ]; then
-    echo "ERROR: code-server currently requires node v24."
-    if [ -n "${FORCE_NODE_VERSION:-}" ]; then
+  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-22}" ]; then
+    echo "ERROR: code-server currently requires node v22."
+    if [ -n "$FORCE_NODE_VERSION" ]; then
       echo "However, you have overrided the version check to use v$FORCE_NODE_VERSION."
     fi
     echo "We have detected that you are on node v$major_node_version"
@@ -76,6 +76,20 @@ main() {
     exit 1
   fi
 
+  # Under npm, if we are running as root, we need --unsafe-perm otherwise
+  # post-install scripts will not have sufficient permissions to do their thing.
+  if is_root; then
+    case "${npm_config_user_agent-}" in npm*)
+      if [ "${npm_config_unsafe_perm-}" != "true" ]; then
+        echo "Please pass --unsafe-perm to npm to install code-server"
+        echo "Otherwise post-install scripts will not have permissions to run"
+        echo "See https://docs.npmjs.com/misc/config#unsafe-perm"
+        echo "See https://stackoverflow.com/questions/49084929/npm-sudo-global-installation-unsafe-perm"
+        exit 1
+      fi
+      ;;
+    esac
+  fi
 
   if ! vscode_install; then
     echo "You may not have the required dependencies to build the native modules."
@@ -96,7 +110,7 @@ install_with_yarn_or_npm() {
   # end-user we want to keep using whatever package manager is in use.
   case "${npm_config_user_agent-}" in
     npm*)
-      if ! npm install --omit=dev; then
+      if ! npm install --unsafe-perm --omit=dev; then
         return 1
       fi
       ;;

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.51.1
+version: 3.46.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.136.2
+appVersion: 4.131.0

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.136.2'
+  tag: '4.131.0'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a
@@ -34,10 +34,6 @@ serviceAccount:
 # Specifies annotations for deployment
 annotations: {}
 
-# code-server.labels -- The Deployment labels. See:
-# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-labels: {}
-
 podAnnotations: {}
 
 podSecurityContext: {}

ci/lib.sh

@@ -49,10 +49,7 @@ if [[ ! ${ARCH-} ]]; then
   export ARCH
 fi
 
-# Windows predefines OS as Windows_NT for every process, so on a windows shell
-# the check below would always find a value and never call os(). That is not a
-# name this build knows, so it does not count as one the caller chose.
-if [[ ! ${OS-} || ${OS-} == "Windows_NT" ]]; then
+if [[ ! ${OS-} ]]; then
   OS=$(os)
   export OS
 fi

docs/CONTRIBUTING.md

@@ -31,7 +31,7 @@ The prerequisites for contributing to code-server are almost the same as those
 for [VS Code](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites).
 Here is what is needed:
 
-- `node` v24.x
+- `node` v22.x
 - `git` v2.x or greater
 - [`git-lfs`](https://git-lfs.github.com)
 - [`npm`](https://www.npmjs.com/)

docs/FAQ.md

@@ -41,7 +41,6 @@
 - [How do I disable the proxy?](#how-do-i-disable-the-proxy)
 - [How do I disable file download?](#how-do-i-disable-file-download)
 - [Why do web views not work?](#why-do-web-views-not-work)
-- [Can I run code-server with systemd socket activation?](#can-i-run-code-server-with-systemd-socket-activation)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 <!-- prettier-ignore-end -->
@@ -561,41 +560,3 @@ To fix this, you must either:
   create and trust a certificate manually).
 - Disable security if your browser allows it. For example, in Chromium see
   `chrome://flags/#unsafely-treat-insecure-origin-as-secure`
-
-## Can I run code-server with systemd socket activation?
-
-Yes. Pass the inherited socket to code-server with `--socket-fd`. systemd
-passes the first listening socket as file descriptor `3`.
-
-Create a socket unit, `~/.config/systemd/user/code-server.socket`:
-
-```ini
-[Socket]
-ListenStream=8080
-
-[Install]
-WantedBy=sockets.target
-```
-
-And a matching service unit, `~/.config/systemd/user/code-server.service`:
-
-```ini
-[Service]
-ExecStart=/usr/bin/code-server --socket-fd 3
-```
-
-Then enable and start the socket:
-
-```bash
-systemctl --user enable --now code-server.socket
-```
-
-code-server will start on the first connection and listen on the socket
-systemd created. `--socket-fd` takes precedence over `--socket` and
-`--bind-addr`/`--port`/`--host`, and `--socket-mode` is ignored because
-systemd owns the socket's permissions.
-
-Socket activation only changes how code-server binds; your usual
-authentication still applies (it keeps prompting for the configured password
-unless you set `--auth none`), so keep authentication enabled when exposing the
-server.

docs/android.md

@@ -11,11 +11,11 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
 ```
 
 6. Exit the terminal using `exit` and then reopen the terminal
-7. Install and use Node.js 24:
+7. Install and use Node.js 22:
 
 ```shell
-nvm install 24
-nvm use 24
+nvm install 22
+nvm use 22
 ```
 
 8. Install code-server globally on device with: `npm install --global code-server`

docs/helm.md

@@ -105,7 +105,7 @@ $ helm upgrade --install code-server \
   --set persistence.enabled=false
 ```
 
-The above command sets the persistence storage to false.
+The above command sets the the persistence storage to false.
 
 Alternatively, a YAML file that specifies the values for the above parameters
 can be provided while installing the chart. For example,

docs/npm.md

@@ -29,7 +29,8 @@ includes installing instructions based on your operating system.
 
 ## Node.js version
 
-We use Node.js `24.x`. VS Code also [lists Node.js
+We use the same major version of Node.js shipped with Code's remote, which is
+currently `22.x`. VS Code also [lists Node.js
 requirements](https://github.com/microsoft/vscode/wiki/How-to-Contribute#prerequisites).
 
 Using other versions of Node.js [may lead to unexpected
@@ -77,7 +78,7 @@ Proceed to [installing](#installing)
 ## FreeBSD
 
 ```sh
-pkg install -y git python npm-node24 pkgconf
+pkg install -y git python npm-node22 pkgconf
 pkg install -y libinotify
 ```
 

docs/termux.md

@@ -57,7 +57,7 @@ npm config set python python3
 node -v
 ```
 
-you will get Node version `v24`
+you will get Node version `v22`
 
 5. Now install code-server following our guide on [installing with npm](./npm.md)
 

install.sh

@@ -436,7 +436,7 @@ install_npm() {
     fi
     echoh "Installing with npm."
     echoh
-    "$sh_c" "$NPM_PATH" install -g "code-server@$VERSION"
+    "$sh_c" "$NPM_PATH" install -g "code-server@$VERSION" --unsafe-perm
     NPM_BIN_DIR="\$($NPM_PATH bin -g)" echo_npm_postinstall
     return
   fi

package.json

@@ -62,7 +62,7 @@
     "prettier": "3.9.4",
     "prettier-plugin-sh": "^0.18.0",
     "ts-node": "^10.9.1",
-    "typescript": "^5.6.2",
+    "typescript": "^7.0.2",
     "typescript-eslint": "^8.8.0"
   },
   "dependencies": {
@@ -76,7 +76,7 @@
     "http-proxy": "^1.18.1",
     "httpolyglot": "^0.1.2",
     "i18next": "^26.3.1",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^4.1.0",
     "limiter": "^2.1.0",
     "pem": "^1.14.8",
     "proxy-agent": "^6.3.1",

patches/app-name.diff

@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -40,6 +40,7 @@ export const serverOptions: OptionDescri
+@@ -24,6 +24,7 @@ export const serverOptions: OptionDescri
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
  	'link-protection-trusted-domains': { type: 'string[]' },
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -140,6 +141,7 @@ export interface ServerParsedArgs {
+@@ -124,6 +125,7 @@ export interface ServerParsedArgs {
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
  	'link-protection-trusted-domains'?: string[],
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -407,8 +407,11 @@ export class WebClientServer {
+@@ -366,8 +366,11 @@ export class WebClientServer {
  			linkProtectionTrustedDomains.push(...this._productService.linkProtectionTrustedDomains);
  		}
  

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -251,7 +251,9 @@ class RemoteAuthoritiesImpl {
+@@ -245,7 +245,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,
@@ -36,8 +36,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -29,9 +29,9 @@
- 		<meta id="vscode-workbench-css-modules" data-settings="{{WORKBENCH_DEV_CSS_MODULES}}">
+@@ -27,9 +27,9 @@
+ 		<meta id="vscode-workbench-builtin-extensions" data-settings="{{WORKBENCH_BUILTIN_EXTENSIONS}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
 -		<link rel="icon" href="/_static/src/browser/media/favicon-dark-support.svg" />
@@ -49,15 +49,15 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  		<style id="vscode-css-modules" type="text/css" media="screen"></style>
  
  	</head>
-@@ -41,7 +41,7 @@
+@@ -39,7 +39,7 @@
  
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
--		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
-+		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
+ 	<script>
+-		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
++		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+ 	<script>
 Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.html
@@ -73,7 +73,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -25,9 +25,9 @@
+@@ -24,9 +24,9 @@
  		<meta id="vscode-workbench-auth-session" data-settings="{{WORKBENCH_AUTH_SESSION}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
@@ -86,15 +86,15 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  		<link rel="stylesheet" href="{{WORKBENCH_WEB_BASE_URL}}/out/vs/code/browser/workbench/workbench.css">
  
  	</head>
-@@ -37,7 +37,7 @@
+@@ -36,7 +36,7 @@
  
  	<!-- Startup (do not modify order of script tags!) -->
- 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
--		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location.origin).toString();
-+		const baseUrl = new URL(document.getElementById('vscode-workbench-web-base-url').getAttribute('data-settings'), window.location).toString();
+ 	<script>
+-		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location.origin).toString();
++		const baseUrl = new URL('{{WORKBENCH_WEB_BASE_URL}}', window.location).toString();
  		globalThis._VSCODE_FILE_ROOT = baseUrl + '/out/';
  	</script>
- 	<script nonce="{{WORKBENCH_SCRIPT_NONCE}}">
+ 	<script>
 Index: code-server/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
@@ -111,31 +111,21 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -146,7 +146,7 @@ export function createWorkbenchContentSe
- 		'default-src \'self\';',
- 		'img-src \'self\' https: data: blob:;',
- 		'media-src \'self\';',
--		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
-+		`script-src 'self' 'unsafe-eval' ${nlsBaseUrl ?? ''} blob: 'nonce-${scriptNonce}' '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
- 		'child-src \'self\';',
- 		`frame-src 'self' https://*.vscode-cdn.net data:;`,
- 		'worker-src \'self\' data: blob:;',
-@@ -307,8 +307,10 @@ export class WebClientServer {
+@@ -265,7 +265,9 @@ export class WebClientServer {
  		};
  
  		// Prefix routes with basePath for clients
+-		const basePath = getFirstHeader('x-forwarded-prefix') || this._basePath;
 +		const rootBase = relativeRoot(getOriginalUrl(req))
 +		const vscodeBase = relativePath(getOriginalUrl(req))
- 		const forwardedPrefix = getFirstHeader('x-forwarded-prefix');
--		const basePath = forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath;
-+		const basePath = vscodeBase || (forwardedPrefix && isSafeBasePath(forwardedPrefix) ? forwardedPrefix : this._basePath);
++		const basePath = vscodeBase || getFirstHeader('x-forwarded-prefix') || this._basePath;
  
- 		const queryConnectionTokens = parsedUrl.searchParams.getAll(connectionTokenQueryName);
- 		if (queryConnectionTokens.length === 1) {
-@@ -345,10 +347,14 @@ export class WebClientServer {
+ 		const queryConnectionToken = parsedUrl.query[connectionTokenQueryName];
+ 		if (typeof queryConnectionToken === 'string') {
+@@ -304,10 +306,14 @@ export class WebClientServer {
  		};
  
- 		const useTestResolver = (!this._environmentService.isBuilt && !!this._environmentService.args['use-test-resolver']);
+ 		const useTestResolver = (!this._environmentService.isBuilt && this._environmentService.args['use-test-resolver']);
 +		// For now we are getting the remote authority from the client to avoid
 +		// needing specific configuration for reverse proxies to work.  Set this to
 +		// something invalid to make sure we catch code that is using this value
@@ -148,7 +138,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		);
  		if (!remoteAuthority) {
  			return serveError(req, res, 400, `Bad request.`);
-@@ -395,6 +401,7 @@ export class WebClientServer {
+@@ -354,6 +360,7 @@ export class WebClientServer {
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
@@ -156,18 +146,27 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,
  			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
-@@ -446,7 +453,9 @@ export class WebClientServer {
+@@ -403,7 +410,9 @@ export class WebClientServer {
+ 			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
  			WORKBENCH_WEB_BASE_URL: staticRoute,
  			WORKBENCH_NLS_URL,
- 			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
--			WORKBENCH_SCRIPT_NONCE: scriptNonce
-+			WORKBENCH_SCRIPT_NONCE: scriptNonce,
+-			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`
++			WORKBENCH_NLS_FALLBACK_URL: `${staticRoute}/out/nls.messages.js`,
 +			BASE: rootBase,
 +			VS_BASE: basePath,
  		};
  
  		// DEV ---------------------------------------------------------------------------------------
-@@ -542,3 +551,70 @@ export class WebClientServer {
+@@ -440,7 +449,7 @@ export class WebClientServer {
+ 			'default-src \'self\';',
+ 			'img-src \'self\' https: data: blob:;',
+ 			'media-src \'self\';',
+-			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : `http://${remoteAuthority}`};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
++			`script-src 'self' 'unsafe-eval' ${WORKBENCH_NLS_BASE_URL ?? ''} blob: 'nonce-1nline-m4p' ${this._getScriptCspHashes(data).join(' ')} '${webWorkerExtensionHostIframeScriptSHA}' 'sha256-/r7rqQ+yrxt57sxLuQ6AMYcy/lUpvAIzHjIJt/OeLWU=' ${useTestResolver ? '' : ``};`,  // the sha is the same as in src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html
+ 			'child-src \'self\';',
+ 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
+ 			'worker-src \'self\' data: blob:;',
+@@ -513,3 +522,70 @@ export class WebClientServer {
  		return void res.end(data);
  	}
  }

patches/clipboard.diff

@@ -78,7 +78,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
-@@ -147,6 +147,7 @@ export interface NativeParsedArgs {
+@@ -146,6 +146,7 @@ export interface NativeParsedArgs {
  	'disable-chromium-sandbox'?: boolean;
  	sandbox?: boolean;
  	'enable-coi'?: boolean;
@@ -102,7 +102,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/server.cli.ts
 +++ code-server/lib/vscode/src/vs/server/node/server.cli.ts
-@@ -78,6 +78,7 @@ const isSupportedForPipe = (optionId: ke
+@@ -77,6 +77,7 @@ const isSupportedForPipe = (optionId: ke
  		case 'verbose':
  		case 'remote':
  		case 'locate-shell-integration-path':
@@ -110,7 +110,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
  			return true;
  		default:
  			return false;
-@@ -307,6 +308,22 @@ export async function main(desc: Product
+@@ -300,6 +301,22 @@ export async function main(desc: Product
  			}
  		}
  	} else {

patches/display-language.diff

@@ -9,16 +9,16 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -13,7 +13,7 @@ import { IURITransformer } from '../../b
- import { generateUuid } from '../../base/common/uuid.js';
+@@ -12,7 +12,7 @@ import * as path from '../../base/common
+ import { IURITransformer } from '../../base/common/uriIpc.js';
  import { getMachineId, getSqmMachineId, getDevDeviceId } from '../../base/node/id.js';
  import { Promises } from '../../base/node/pfs.js';
 -import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
 +import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, ProxyChannel, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
- import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -418,6 +418,9 @@ export async function setupServerService
+ import { ConfigurationService } from '../../platform/configuration/common/configurationService.js';
+@@ -358,6 +358,9 @@ export async function setupServerService
  
  		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
  
@@ -153,7 +153,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -24,6 +24,7 @@ import { URI } from '../../base/common/u
+@@ -25,6 +25,7 @@ import { URI } from '../../base/common/u
  import { streamToBuffer } from '../../base/common/buffer.js';
  import { IProductConfiguration } from '../../base/common/product.js';
  import { isString, Mutable } from '../../base/common/types.js';
@@ -161,7 +161,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  import { CharCode } from '../../base/common/charCode.js';
  import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
  import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -442,14 +443,22 @@ export class WebClientServer {
+@@ -401,14 +402,22 @@ export class WebClientServer {
  		};
  
  		const cookies = cookie.parse(req.headers.cookie || '');
@@ -171,7 +171,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		let WORKBENCH_NLS_URL: string;
  		if (!locale.startsWith('en') && this._productService.nlsCoreBaseUrl) {
  			WORKBENCH_NLS_BASE_URL = this._productService.nlsCoreBaseUrl;
- 			WORKBENCH_NLS_URL = createNlsUrl(WORKBENCH_NLS_BASE_URL, this._productService.commit, this._productService.version, locale);
+ 			WORKBENCH_NLS_URL = `${WORKBENCH_NLS_BASE_URL}${this._productService.commit}/${this._productService.version}/${locale}/nls.messages.js`;
  		} else {
 -			WORKBENCH_NLS_URL = ''; // fallback will apply
 +			try {
@@ -181,16 +181,16 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 +					: '';
 +			} catch (error) {
 +				console.error("Failed to generate translations", error);
-+				WORKBENCH_NLS_URL = ''; // fallback will apply
++				WORKBENCH_NLS_URL = '';
 +			}
  		}
  
- 		const scriptNonce = createScriptNonce();
+ 		const values: { [key: string]: string } = {
 Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -38,6 +38,7 @@ export const serverOptions: OptionDescri
+@@ -22,6 +22,7 @@ export const serverOptions: OptionDescri
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
@@ -198,7 +198,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -136,6 +137,7 @@ export interface ServerParsedArgs {
+@@ -120,6 +121,7 @@ export interface ServerParsedArgs {
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,

patches/external-file-actions.diff

@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -35,6 +35,8 @@ export const serverOptions: OptionDescri
+@@ -19,6 +19,8 @@ export const serverOptions: OptionDescri
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
  	'auth': { type: 'string' },
@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -130,6 +132,8 @@ export interface ServerParsedArgs {
+@@ -114,6 +116,8 @@ export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
  	'auth'?: string;
@@ -112,7 +112,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -425,6 +425,8 @@ export class WebClientServer {
+@@ -384,6 +384,8 @@ export class WebClientServer {
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
  			userDataPath: this._environmentService.userDataPath,
@@ -207,7 +207,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -42,6 +42,9 @@ export const EmbedderIdentifierContext =
+@@ -40,6 +40,9 @@ export const EmbedderIdentifierContext =
  
  export const InAutomationContext = new RawContextKey<boolean>('inAutomation', false, localize('inAutomation', "Whether VS Code is running under automation/smoke test"));
  

patches/getting-started.diff

@@ -181,7 +181,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -37,6 +37,7 @@ export const serverOptions: OptionDescri
+@@ -21,6 +21,7 @@ export const serverOptions: OptionDescri
  	'auth': { type: 'string' },
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
@@ -189,7 +189,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -134,6 +135,7 @@ export interface ServerParsedArgs {
+@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
  	'auth'?: string;
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
@@ -201,7 +201,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -429,6 +429,7 @@ export class WebClientServer {
+@@ -388,6 +388,7 @@ export class WebClientServer {
  			userDataPath: this._environmentService.userDataPath,
  			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
  			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],
@@ -234,7 +234,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -44,6 +44,7 @@ export const InAutomationContext = new R
+@@ -42,6 +42,7 @@ export const InAutomationContext = new R
  
  export const IsEnabledFileDownloads = new RawContextKey<boolean>('isEnabledFileDownloads', true, true);
  export const IsEnabledFileUploads = new RawContextKey<boolean>('isEnabledFileUploads', true, true);

patches/integration.diff

@@ -19,19 +19,20 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
  import { parseArgs, ErrorReporter } from '../../platform/environment/node/argv.js';
  import { join, dirname } from '../../base/common/path.js';
  import { performance } from 'perf_hooks';
--import { agentHostBridgeConnectionTokenEnvironmentVariable, serverOptions } from './serverEnvironmentService.js';
-+import { agentHostBridgeConnectionTokenEnvironmentVariable, serverOptions, ServerParsedArgs } from './serverEnvironmentService.js';
+-import { serverOptions } from './serverEnvironmentService.js';
++import { serverOptions, ServerParsedArgs } from './serverEnvironmentService.js';
  import product from '../../platform/product/common/product.js';
  import * as perf from '../../base/common/performance.js';
  
-@@ -34,40 +34,49 @@ const errorReporter: ErrorReporter = {
+@@ -34,38 +34,47 @@ const errorReporter: ErrorReporter = {
  	}
  };
  
 -const args = parseArgs(process.argv.slice(2), serverOptions, errorReporter);
--const agentHostBridgeConnectionToken = process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
--delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
--
++function parse(): ServerParsedArgs {
++	return parseArgs(process.argv.slice(2), serverOptions, errorReporter);
++}
+ 
 -const REMOTE_DATA_FOLDER = args['server-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
 -const USER_DATA_PATH = join(REMOTE_DATA_FOLDER, 'data');
 -const APP_SETTINGS_HOME = join(USER_DATA_PATH, 'User');
@@ -51,10 +52,6 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 -		}
 -	} catch (err) { console.error(err); }
 -});
-+function parse(): ServerParsedArgs {
-+	return parseArgs(process.argv.slice(2), serverOptions, errorReporter);
-+}
-+
 +function createDirs(args: ServerParsedArgs): string {
 +	const REMOTE_DATA_FOLDER = args['server-data-dir'] || args['user-data-dir'] || process.env['VSCODE_AGENT_FOLDER'] || join(os.homedir(), product.serverDataFolderName || '.vscode-remote');
 +	const USER_DATA_PATH = args['user-data-dir'] || join(REMOTE_DATA_FOLDER, 'data');
@@ -83,7 +80,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
   */
 -export function spawnCli() {
 -	runCli(args, REMOTE_DATA_FOLDER, serverOptions);
-+function spawnCli(args = parse()) {
++function spawnCli(args = parse()): Promise<void> {
 +	return runCli(args, createDirs(args), serverOptions);
  }
  
@@ -91,11 +88,9 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
   * invoked by server-main.js
   */
 -export function createServer(address: string | net.AddressInfo | null): Promise<IServerAPI> {
--	return doCreateServer(address, args, REMOTE_DATA_FOLDER, agentHostBridgeConnectionToken);
+-	return doCreateServer(address, args, REMOTE_DATA_FOLDER);
 +function createServer(address: string | net.AddressInfo | null, args = parse()): Promise<IServerAPI> {
-+	const agentHostBridgeConnectionToken = process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
-+	delete process.env[agentHostBridgeConnectionTokenEnvironmentVariable];
-+	return doCreateServer(address, args, createDirs(args), agentHostBridgeConnectionToken);
++	return doCreateServer(address, args, createDirs(args));
  }
 +
 +// The aliases prevent the names getting mangled during minification which would
@@ -177,7 +172,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -140,6 +141,9 @@ export class BrowserMain extends Disposa
+@@ -139,6 +140,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
  
@@ -214,8 +209,8 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench-dev.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -28,8 +29,9 @@
- 		<meta id="vscode-workbench-css-modules" data-settings="{{WORKBENCH_DEV_CSS_MODULES}}">
+@@ -26,8 +27,9 @@
+ 		<meta id="vscode-workbench-builtin-extensions" data-settings="{{WORKBENCH_BUILTIN_EXTENSIONS}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
 -		<link rel="icon" href="{{WORKBENCH_WEB_BASE_URL}}/resources/server/favicon.ico" type="image/x-icon" />
@@ -240,7 +235,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.html
  
  		<!-- Disable pinch zooming -->
  		<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no">
-@@ -24,8 +25,9 @@
+@@ -23,8 +24,9 @@
  		<meta id="vscode-workbench-auth-session" data-settings="{{WORKBENCH_AUTH_SESSION}}">
  
  		<!-- Workbench Icon/Manifest/CSS -->
@@ -256,7 +251,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -394,6 +394,7 @@ export class WebClientServer {
+@@ -353,6 +353,7 @@ export class WebClientServer {
  		} : undefined;
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
@@ -331,7 +326,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
-@@ -54,8 +54,11 @@ export function createWorkbenchDialogOpt
+@@ -47,8 +47,11 @@ export function createWorkbenchDialogOpt
  
  export function createBrowserAboutDialogDetails(productService: IProductService): { title: string; details: string; detailsToCopy: string } {
  	const detailString = (useAgo: boolean): string => {

patches/local-storage.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -420,6 +420,7 @@ export class WebClientServer {
+@@ -379,6 +379,7 @@ export class WebClientServer {
  			remoteAuthority,
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',

patches/logout.diff

@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -34,6 +34,7 @@ export function getRedactedServerParsedA
+@@ -18,6 +18,7 @@ import { ProtocolConstants } from '../..
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -128,6 +129,7 @@ export const serverOptions: OptionDescri
+@@ -112,6 +113,7 @@ export const serverOptions: OptionDescri
  export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
@@ -40,7 +40,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -402,6 +402,7 @@ export class WebClientServer {
+@@ -361,6 +361,7 @@ export class WebClientServer {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,

patches/marketplace.diff

@@ -19,9 +19,9 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -65,6 +65,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
- 			Object.assign(product, { copilotVersions: { runtime, sdk } });
- 		}
+@@ -49,6 +49,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+ 			version: pkg.version
+ 		});
  	}
 +
 +	Object.assign(product, {
@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -387,7 +387,6 @@ export class WebClientServer {
+@@ -346,7 +346,6 @@ export class WebClientServer {
  
  		const staticRoute = posix.join(basePath, this._productPath, STATIC_PATH);
  		const callbackRoute = posix.join(basePath, this._productPath, CALLBACK_PATH);
@@ -49,7 +49,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  
  		const resolveWorkspaceURI = (defaultLocation?: string) => defaultLocation && URI.file(resolve(defaultLocation)).with({ scheme: Schemas.vscodeRemote, authority: remoteAuthority });
  
-@@ -404,14 +403,7 @@ export class WebClientServer {
+@@ -363,14 +362,7 @@ export class WebClientServer {
  			rootEndpoint: rootBase,
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,

patches/proxy-uri.diff

@@ -71,7 +71,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -403,6 +403,7 @@ export class WebClientServer {
+@@ -362,6 +362,7 @@ export class WebClientServer {
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,

patches/service-worker.diff

@@ -54,7 +54,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -404,6 +404,10 @@ export class WebClientServer {
+@@ -363,6 +363,10 @@ export class WebClientServer {
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
  			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? rootBase + '/proxy/{{port}}/',

patches/telemetry.diff

@@ -12,7 +12,15 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -68,6 +68,7 @@ import { IExtensionsScannerService } fro
+@@ -4,6 +4,7 @@
+  *--------------------------------------------------------------------------------------------*/
+ 
+ import { hostname, release } from 'os';
++import { promises as fs } from 'fs';
+ import { Emitter, Event } from '../../base/common/event.js';
+ import { DisposableStore, toDisposable } from '../../base/common/lifecycle.js';
+ import { Schemas } from '../../base/common/network.js';
+@@ -65,6 +66,7 @@ import { IExtensionsScannerService } fro
  import { ExtensionsScannerService } from './extensionsScannerService.js';
  import { IExtensionsProfileScannerService } from '../../platform/extensionManagement/common/extensionsProfileScannerService.js';
  import { IUserDataProfilesService } from '../../platform/userDataProfile/common/userDataProfile.js';
@@ -20,18 +28,18 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { NullPolicyService } from '../../platform/policy/common/policy.js';
  import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
  import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -179,11 +180,23 @@ export async function setupServerService
+@@ -176,11 +178,23 @@ export async function setupServerService
  	const requestService = new RequestService('remote', configurationService, environmentService, logService);
  	services.set(IRequestService, requestService);
  
 +	let isContainer = undefined;
 +	try {
-+		await fs.promises.stat('/run/.containerenv');
++		await fs.stat('/run/.containerenv');
 +		isContainer = true;
 +	} catch (error) { /* Does not exist, probably. */ }
 +	if (!isContainer) {
 +		try {
-+			const content = await fs.promises.readFile('/proc/self/cgroup', 'utf8')
++			const content = await fs.readFile('/proc/self/cgroup', 'utf8')
 +			isContainer = content.includes('docker');
 +		} catch (error) { /* Permission denied, probably. */ }
 +	}
@@ -126,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -408,6 +408,8 @@ export class WebClientServer {
+@@ -367,6 +367,8 @@ export class WebClientServer {
  				scope: vscodeBase + '/',
  				path: rootBase + '/_static/out/browser/serviceWorker.js',
  			},
@@ -151,7 +159,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -74,7 +74,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -58,7 +58,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
  			resourceUrlTemplate: "https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}",
  			controlUrl: "",
  			recommendationsUrl: "",

patches/trusted-domains.diff

@@ -4,7 +4,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -39,6 +39,7 @@ export const serverOptions: OptionDescri
+@@ -23,6 +23,7 @@ export const serverOptions: OptionDescri
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -138,6 +139,7 @@ export interface ServerParsedArgs {
+@@ -122,6 +123,7 @@ export interface ServerParsedArgs {
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
@@ -24,7 +24,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -399,6 +399,14 @@ export class WebClientServer {
+@@ -358,6 +358,14 @@ export class WebClientServer {
  			scopes: [['user:email'], ['repo']]
  		} : undefined;
  
@@ -39,7 +39,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
-@@ -414,6 +422,7 @@ export class WebClientServer {
+@@ -373,6 +381,7 @@ export class WebClientServer {
  			embedderIdentifier: 'server-distro',
  			voiceWsUrl: this._productService.voiceWsUrl,
  			extensionsGallery: this._productService.extensionsGallery,

patches/update-check.diff

@@ -113,7 +113,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -401,6 +401,7 @@ export class WebClientServer {
+@@ -360,6 +360,7 @@ export class WebClientServer {
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
@@ -125,8 +125,8 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -32,6 +32,8 @@ export function getRedactedServerParsedA
- }
+@@ -16,6 +16,8 @@ import { join } from '../../base/common/
+ import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
 +	/* ----- code-server ----- */
@@ -134,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -124,6 +126,8 @@ export const serverOptions: OptionDescri
+@@ -108,6 +110,8 @@ export const serverOptions: OptionDescri
  };
  
  export interface ServerParsedArgs {

patches/webview.diff

@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -416,6 +416,7 @@ export class WebClientServer {
+@@ -375,6 +375,7 @@ export class WebClientServer {
  		const workbenchWebConfiguration = {
  			remoteAuthority,
  			serverBasePath: basePath,

src/node/app.ts

@@ -13,8 +13,7 @@ import { EditorSessionManager, makeEditorSessionManagerServer } from "./vscodeSo
 import { handleUpgrade } from "./wsRouter"
 
 type SocketOptions = { socket: string; "socket-mode"?: string }
-type FdOptions = { "socket-fd": number }
-type ListenOptions = DefaultedArgs | SocketOptions | FdOptions
+type ListenOptions = DefaultedArgs | SocketOptions
 
 export interface App extends Disposable {
   /** Handles regular HTTP requests. */
@@ -31,12 +30,8 @@ const isSocketOpts = (opts: ListenOptions): opts is SocketOptions => {
   return !!(opts as SocketOptions).socket || !(opts as DefaultedArgs).host
 }
 
-export const isFdOpts = (opts: ListenOptions): opts is FdOptions => {
-  return typeof (opts as FdOptions)["socket-fd"] === "number"
-}
-
 export const listen = async (server: http.Server, opts: ListenOptions) => {
-  if (!isFdOpts(opts) && isSocketOpts(opts)) {
+  if (isSocketOpts(opts)) {
     try {
       await fs.unlink(opts.socket)
     } catch (error: any) {
@@ -51,9 +46,7 @@ export const listen = async (server: http.Server, opts: ListenOptions) => {
       server.on("error", (err) => util.logError(logger, "http server error", err))
       resolve()
     }
-    if (isFdOpts(opts)) {
-      server.listen({ fd: opts["socket-fd"] }, onListen)
-    } else if (isSocketOpts(opts)) {
+    if (isSocketOpts(opts)) {
       server.listen(opts.socket, onListen)
     } else {
       // [] is the correct format when using :: but Node errors with them.
@@ -63,7 +56,7 @@ export const listen = async (server: http.Server, opts: ListenOptions) => {
 
   // NOTE@jsjoeio: we need to chmod after the server is finished
   // listening. Otherwise, the socket may not have been created yet.
-  if (!isFdOpts(opts) && isSocketOpts(opts)) {
+  if (isSocketOpts(opts)) {
     if (opts["socket-mode"]) {
       await fs.chmod(opts.socket, opts["socket-mode"])
     }

src/node/cli.ts

@@ -1,5 +1,4 @@
 import { field, Level, logger } from "@coder/logger"
-import * as crypto from "crypto"
 import { promises as fs } from "fs"
 import { load } from "js-yaml"
 import * as path from "path"
@@ -84,7 +83,6 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
   open?: boolean
   "bind-addr"?: string
   socket?: string
-  "socket-fd"?: number
   "socket-mode"?: string
   "trusted-origins"?: string[]
   version?: boolean
@@ -99,7 +97,6 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
   "abs-proxy-base-path"?: string
   i18n?: string
   "idle-timeout-seconds"?: number
-  "vscode-option"?: string[]
   /* Positional arguments. */
   _?: string[]
 }
@@ -238,10 +235,6 @@ export const options: Options<Required<UserProvidedArgs>> = {
   port: { type: "number", description: "" },
 
   socket: { type: "string", path: true, description: "Path to a socket (bind-addr will be ignored)." },
-  "socket-fd": {
-    type: "number",
-    description: "File descriptor of a pre-bound, listening socket to use (for systemd socket activation).",
-  },
   "socket-mode": { type: "string", description: "File mode of the socket." },
   "trusted-origins": {
     type: "string[]",
@@ -329,13 +322,6 @@ export const options: Options<Required<UserProvidedArgs>> = {
       "Override the reconnection grace time in seconds. Clients who disconnect for longer than this duration will need to \n" +
       "reload the window. Defaults to 10800 (3 hours).",
   },
-  "vscode-option": {
-    type: "string[]",
-    description:
-      "Pass an option straight through to the VS Code server as flag=value, or as a bare flag for a \n" +
-      "boolean. Repeatable; repeating the same flag builds an array. Use this to reach VS Code options \n" +
-      "code-server does not model itself, e.g. --vscode-option enable-sandbox --vscode-option agents=true.",
-  },
 }
 
 export const optionDescriptions = (opts: Partial<Options<Required<UserProvidedArgs>>> = options): string[] => {
@@ -562,7 +548,7 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
   }
 
   if (!args["session-socket"]) {
-    args["session-socket"] = defaultSessionSocket(args["user-data-dir"])
+    args["session-socket"] = path.join(args["user-data-dir"], "code-server-ipc.sock")
   }
   process.env.CODE_SERVER_SESSION_SOCKET = args["session-socket"]
 
@@ -657,15 +643,6 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
     args["reconnection-grace-time"] = process.env.CODE_SERVER_RECONNECTION_GRACE_TIME
   }
 
-  // Space-separated, like NODE_OPTIONS.  Appended to any flags rather than
-  // replacing them so the two can be combined.
-  if (process.env.VSCODE_OPTIONS) {
-    args["vscode-option"] = [
-      ...(args["vscode-option"] ?? []),
-      ...process.env.VSCODE_OPTIONS.split(/\s+/).filter((option) => option),
-    ]
-  }
-
   if (process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS) {
     if (isNaN(Number(process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS))) {
       logger.info("CODE_SERVER_IDLE_TIMEOUT_SECONDS must be a number")
@@ -711,25 +688,6 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
   } as DefaultedArgs // TODO: Technically no guarantee this is fulfilled.
 }
 
-/**
- * The session socket to use when one was not given.
- *
- * Windows has no Unix sockets, so there it is a named pipe, which lives in its
- * own namespace rather than on disk and so cannot be placed inside the user
- * data directory. The name is derived from that directory anyway, so that two
- * instances with separate data directories do not collide and a later
- * invocation with the same one finds the first. Windows paths are compared
- * without regard to case, so the name is folded before it is hashed; otherwise
- * the same directory typed two ways would produce two pipes.
- */
-export function defaultSessionSocket(userDataDir: string, platform: NodeJS.Platform = process.platform): string {
-  if (platform !== "win32") {
-    return path.join(userDataDir, "code-server-ipc.sock")
-  }
-  const name = crypto.createHash("sha256").update(path.resolve(userDataDir).toLowerCase()).digest("hex").slice(0, 16)
-  return String.raw`\\.\pipe\code-server-ipc-${name}`
-}
-
 export function getResolvedPathsFromArgs(args: UserProvidedArgs): string[] {
   return (args._ ?? []).map((p) => path.resolve(p))
 }
@@ -951,58 +909,17 @@ export interface CodeArgs extends UserProvidedCodeArgs {
   log?: string[]
 }
 
-/**
- * Expand --vscode-option entries into VS Code server arguments.
- *
- * An entry is `flag=value`, or a bare `flag` meaning true.  A leading `--` on
- * the flag is optional, so both spellings people reach for work.  Repeating a
- * flag collects the values into an array, since several VS Code options take
- * one.
- *
- * `true` and `false` become booleans rather than strings.  VS Code tests these
- * flags for truthiness and the string "false" is truthy, so passing it along
- * verbatim would quietly do the opposite of what was asked.
- */
-export const parseVscodeOptions = (entries: string[]): Record<string, string | boolean | string[]> => {
-  const parsed: Record<string, string | boolean | string[]> = {}
-
-  for (const entry of entries) {
-    const [flag, rawValue] = splitOnFirstEquals(entry.replace(/^--/, ""))
-    if (!flag) {
-      throw new Error(`--vscode-option requires a flag name (got "${entry}")`)
-    }
-
-    const value: string | boolean =
-      typeof rawValue === "undefined" || rawValue === "true" ? true : rawValue === "false" ? false : rawValue
-
-    const existing = parsed[flag]
-    if (typeof existing === "undefined") {
-      parsed[flag] = value
-    } else if (Array.isArray(existing)) {
-      existing.push(String(value))
-    } else {
-      parsed[flag] = [String(existing), String(value)]
-    }
-  }
-
-  return parsed
-}
-
 /**
  * Convert our arguments to equivalent VS Code server arguments.
  * Does not add any extra arguments.
  */
 export const toCodeArgs = async (args: DefaultedArgs): Promise<CodeArgs> => {
-  // The passthrough option is ours; VS Code has no idea what it is.
-  const { "vscode-option": vscodeOptions, ...rest } = args
   return {
-    ...rest,
+    ...args,
     /** Type casting. */
     help: !!args.help,
     version: !!args.version,
     port: args.port?.toString(),
     log: args.log ? [args.log] : undefined,
-    // Last, so that reaching an option code-server does model still works.
-    ...parseVscodeOptions(vscodeOptions ?? []),
-  } as CodeArgs
+  }
 }

test/e2e/downloads.test.ts

@@ -32,6 +32,7 @@ describe("Downloads (enabled)", ["--disable-workspace-trust"], {}, async () => {
     await codeServerPage.page.waitForSelector(`text=${fileName}`)
 
     await codeServerPage.openFile(fileName)
+    await codeServerPage.page.click(".tab")
     await codeServerPage.navigateMenus(["File", "Auto Save"])
     await codeServerPage.page.keyboard.type("Making some edits.")
     await codeServerPage.navigateMenus(["File", "Save As..."])
@@ -84,8 +85,8 @@ describe("Downloads (disabled)", ["--disable-workspace-trust", "--disable-file-d
     // Action
     await codeServerPage.page.waitForSelector(`text=${fileName}`)
     await codeServerPage.openFile(fileName)
+    await codeServerPage.page.click(".tab")
     await codeServerPage.navigateMenus(["File", "Save As..."])
-    await codeServerPage.page.waitForSelector(".quick-input-widget")
     await expect(codeServerPage.page.locator("text=Show Local")).not.toBeVisible()
   })
 

test/e2e/settings.test.ts

@@ -1,19 +0,0 @@
-import { promises as fs } from "fs"
-import * as path from "path"
-import { clean } from "../utils/helpers"
-import { describe, test, expect } from "./baseFixture"
-
-describe("settings", ["--disable-workspace-trust"], {}, () => {
-  const testName = "settings-local"
-  test.beforeAll(async () => {
-    await clean(testName)
-  })
-
-  test("should see startup editor set to none", async ({ codeServerPage }) => {
-    await codeServerPage.navigateMenus(["File", "Preferences", "Settings"])
-    await codeServerPage.page.waitForSelector(".settings-editor")
-    await codeServerPage.page.keyboard.type("startupEditor")
-    const el = codeServerPage.page.getByLabel("workbench.startupEditor")
-    await expect(el).toHaveValue("none")
-  })
-})

test/package-lock.json

@@ -1497,23 +1497,10 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/baseline-browser-mapping": {
-      "version": "2.11.21",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz",
-      "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "baseline-browser-mapping": "dist/cli.cjs"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1542,9 +1529,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/browserslist": {
-      "version": "4.28.9",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz",
-      "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==",
+      "version": "4.24.0",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.24.0.tgz",
+      "integrity": "sha512-Rmb62sR1Zpjql25eSanFGEhAxcFwfA1K0GuQcLoaJBAcENegrQut3hYdhXFF1obQfiDyqIW/cLM5HSJ/9k884A==",
       "dev": true,
       "funding": [
         {
@@ -1562,11 +1549,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.11.20",
-        "caniuse-lite": "^1.0.30001810",
-        "electron-to-chromium": "^1.5.420",
-        "node-releases": "^2.0.54",
-        "update-browserslist-db": "^1.3.2"
+        "caniuse-lite": "^1.0.30001663",
+        "electron-to-chromium": "^1.5.28",
+        "node-releases": "^2.0.18",
+        "update-browserslist-db": "^1.1.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1650,9 +1636,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001810",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
-      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
+      "version": "1.0.30001667",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001667.tgz",
+      "integrity": "sha512-7LTwJjcRkzKFmtqGsibMeuXmvFDfZq/nzIjnmgCGzKKRVzjD72selLDK1oPF/Oxzmt4fNcPvTDvGqSDG4tCALw==",
       "dev": true,
       "funding": [
         {
@@ -1994,9 +1980,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.422",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.422.tgz",
-      "integrity": "sha512-UvA/32XqrLDdZSn7Jllo1AYNcWji/G0d5M0GTViE7KoGBiMunw3a34Sb2KO4ZZyrSEhqsxFoVhWWJshdyfKqJA==",
+      "version": "1.5.32",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.32.tgz",
+      "integrity": "sha512-M+7ph0VGBQqqpTT2YrabjNKSQ2fEl9PVx6AK3N558gDH9NO8O6XN9SXXFWRo9u9PbEg/bWq+tjXQr+eXmxubCw==",
       "dev": true,
       "license": "ISC"
     },
@@ -3866,14 +3852,11 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.54",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
-      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
+      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
+      "license": "MIT"
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
@@ -4041,9 +4024,9 @@
       "license": "MIT"
     },
     "node_modules/picocolors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.0.tgz",
+      "integrity": "sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==",
       "dev": true,
       "license": "ISC"
     },
@@ -4757,9 +4740,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
-      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz",
+      "integrity": "sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==",
       "dev": true,
       "funding": [
         {
@@ -4778,7 +4761,7 @@
       "license": "MIT",
       "dependencies": {
         "escalade": "^3.2.0",
-        "picocolors": "^1.1.1"
+        "picocolors": "^1.1.0"
       },
       "bin": {
         "update-browserslist-db": "cli.js"

test/unit/node/app.test.ts

@@ -3,7 +3,7 @@ import { promises } from "fs"
 import * as http from "http"
 import * as https from "https"
 import * as path from "path"
-import { createApp, ensureAddress, handleArgsSocketCatchError, isFdOpts, listen } from "../../../src/node/app"
+import { createApp, ensureAddress, handleArgsSocketCatchError, listen } from "../../../src/node/app"
 import { OptionalString, setDefaults } from "../../../src/node/cli"
 import { generateCertificate } from "../../../src/node/util"
 import { clean, mockLogger, getAvailablePort, tmpdir } from "../../utils/helpers"
@@ -261,47 +261,3 @@ describe("listen", () => {
     }
   })
 })
-
-describe("listen (socket-fd)", () => {
-  // Wrap a bound-but-not-yet-listening TCP socket so we get a real file
-  // descriptor that listen({ fd }) can adopt, mirroring the systemd socket
-  // activation case where the process inherits an fd and calls listen(2) on it.
-  // Using a live net.Server's fd instead fails with EEXIST because the socket
-  // is already listening in-process.
-  // eslint-disable-next-line @typescript-eslint/no-var-requires
-  const { TCP, constants: TCPConstants } = (process as any).binding("tcp_wrap")
-
-  let inherited: any
-  let httpServer: http.Server
-  let unlinkSpy: jest.SpyInstance
-
-  beforeEach(async () => {
-    mockLogger()
-    unlinkSpy = jest.spyOn(promises, "unlink")
-    inherited = new TCP(TCPConstants.SERVER)
-    inherited.bind("127.0.0.1", 0)
-    httpServer = http.createServer()
-  })
-
-  afterEach(() => {
-    httpServer.close()
-    try {
-      inherited.close()
-    } catch {
-      // The fd is adopted by httpServer.close() above; ignore double-close.
-    }
-    jest.clearAllMocks()
-  })
-
-  it("isFdOpts detects a numeric socket-fd", () => {
-    expect(isFdOpts({ "socket-fd": 3 })).toBe(true)
-    expect(isFdOpts({ socket: "/tmp/x.sock" } as any)).toBe(false)
-  })
-
-  it("listens on an inherited fd without unlinking", async () => {
-    const fd = inherited.fd as number
-    await listen(httpServer, { "socket-fd": fd })
-    expect(httpServer.address()).not.toBeNull()
-    expect(unlinkSpy).not.toHaveBeenCalled()
-  })
-})

test/unit/node/cli.test.ts

@@ -5,7 +5,6 @@ import {
   UserProvidedArgs,
   bindAddrFromArgs,
   defaultConfigFile,
-  defaultSessionSocket,
   parse,
   parseConfigFile,
   setDefaults,
@@ -38,7 +37,7 @@ const defaults = {
   usingEnvHashedPassword: false,
   "extensions-dir": path.join(paths.data, "extensions"),
   "user-data-dir": paths.data,
-  "session-socket": defaultSessionSocket(paths.data),
+  "session-socket": path.join(paths.data, "code-server-ipc.sock"),
   "app-name": "code-server",
   _: [],
 }
@@ -52,7 +51,6 @@ describe("parser", () => {
     delete process.env.CODE_SERVER_RECONNECTION_GRACE_TIME
     delete process.env.VSCODE_PROXY_URI
     delete process.env.CS_DISABLE_PROXY
-    delete process.env.VSCODE_OPTIONS
     console.log = jest.fn()
   })
 
@@ -415,17 +413,6 @@ describe("parser", () => {
     })
   })
 
-  it("should use env var VSCODE_OPTIONS", async () => {
-    process.env.VSCODE_OPTIONS = "--enable-sandbox agents=true"
-    const args = parse(["--vscode-option", "verbose-logging"])
-
-    const defaultArgs = await setDefaults(args)
-    expect(defaultArgs).toEqual({
-      ...defaults,
-      "vscode-option": ["verbose-logging", "--enable-sandbox", "agents=true"],
-    })
-  })
-
   it("should use env var CS_DISABLE_GETTING_STARTED_OVERRIDE", async () => {
     process.env.CS_DISABLE_GETTING_STARTED_OVERRIDE = "1"
     const args = parse([])
@@ -978,26 +965,6 @@ describe("bindAddrFromArgs", () => {
   })
 })
 
-describe("defaultSessionSocket", () => {
-  const dataDir = path.join("/home/coder/.local/share", "code-server")
-
-  it("should put the socket in the user data directory", () => {
-    expect(defaultSessionSocket(dataDir, "linux")).toBe(path.join(dataDir, "code-server-ipc.sock"))
-  })
-
-  it("should use a named pipe on windows", () => {
-    expect(defaultSessionSocket(dataDir, "win32")).toMatch(/^\\\\\.\\pipe\\code-server-ipc-[0-9a-f]{16}$/)
-  })
-
-  it("should give separate data directories separate pipes", () => {
-    expect(defaultSessionSocket(dataDir, "win32")).not.toBe(defaultSessionSocket(dataDir + "-other", "win32"))
-  })
-
-  it("should give one data directory one pipe however it is spelled", () => {
-    expect(defaultSessionSocket(dataDir.toUpperCase(), "win32")).toBe(defaultSessionSocket(dataDir, "win32"))
-  })
-})
-
 describe("defaultConfigFile", () => {
   it("should return the default config file as a string", async () => {
     const password = await generatePassword()
@@ -1039,44 +1006,6 @@ describe("toCodeArgs", () => {
       _: [file],
     })
   })
-
-  it("should pass through --vscode-option", async () => {
-    const args = parse([
-      "--vscode-option",
-      "enable-sandbox",
-      "--vscode-option",
-      "agents=true",
-      "--vscode-option",
-      "enable-smoke-test-driver=false",
-    ])
-    expect(await toCodeArgs(await setDefaults(args))).toStrictEqual({
-      ...vscodeDefaults,
-      "enable-sandbox": true,
-      agents: true,
-      "enable-smoke-test-driver": false,
-    })
-  })
-
-  it("should collect a repeated --vscode-option into an array", async () => {
-    const args = parse([
-      "--vscode-option",
-      "locate-extension=a",
-      "--vscode-option",
-      "locate-extension=b",
-      "--vscode-option",
-      "locate-extension=c",
-    ])
-    expect(await toCodeArgs(await setDefaults(args))).toStrictEqual({
-      ...vscodeDefaults,
-      "locate-extension": ["a", "b", "c"],
-    })
-  })
-
-  it("should error if --vscode-option has no flag", async () => {
-    await expect(toCodeArgs(await setDefaults(parse(["--vscode-option", "=nothing"])))).rejects.toThrow(
-      "--vscode-option requires a flag name",
-    )
-  })
 })
 
 describe("optionDescriptions", () => {