chore: bump docker/login-action from 3.7.0 to 4.1.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](c94ce9fb46...4907a6ddec)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -86,6 +86,18 @@ body:
     validations:
       required: true
 
+  - type: dropdown
+    attributes:
+      label: Does this bug reproduce in VS Code web?
+      description: If the bug reproduces in VS Code web, submit the issue upstream instead (https://github.com/microsoft/vscode). You can run VS Code web with `code serve-web` (this is not the same as vscode.dev).
+      options:
+        - Yes, this is also broken in VS Code web
+        - No, this works as expected in VS Code web
+        - This cannot be tested in VS Code web
+        - I did not test VS Code web
+    validations:
+      required: true
+
   - type: dropdown
     attributes:
       label: Does this bug reproduce in GitHub Codespaces?

.github/workflows/build.yaml

@@ -15,12 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-# Note: if: success() is used in several jobs -
-# this ensures that it only executes if all previous jobs succeeded.
-
-# if: steps.cache-node-modules.outputs.cache-hit != 'true'
-# will skip running `npm install` if it successfully fetched from cache
-
 jobs:
   changes:
     runs-on: ubuntu-latest
@@ -31,10 +25,8 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
       helm: ${{ steps.filter.outputs.helm }}
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-      - name: Check changed files
-        uses: dorny/paths-filter@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
           filters: |
@@ -62,10 +54,9 @@ jobs:
   prettier:
     name: Run prettier check
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -78,12 +69,11 @@ jobs:
   doctoc:
     name: Doctoc markdown files
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
     needs: changes
     if: needs.changes.outputs.docs == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -96,26 +86,25 @@ jobs:
   lint-helm:
     name: Lint Helm chart
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
     needs: changes
     if: needs.changes.outputs.helm == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - uses: azure/setup-helm@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          version: "v3.19.2"
       - run: helm plugin install https://github.com/instrumenta/helm-kubeval
       - run: helm kubeval ci/helm-chart
 
   lint-ts:
     name: Lint TypeScript files
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
     needs: changes
     if: needs.changes.outputs.code == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -132,22 +121,21 @@ jobs:
     if: needs.changes.outputs.ci == 'true'
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Check workflow files
         run: |
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.1
-          ./actionlint -color -shellcheck= -ignore "set-output"
+          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.9
+          ./actionlint -color -shellcheck= -ignore "softprops/action-gh-release"
         shell: bash
 
   test-unit:
     name: Run unit tests
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
     needs: changes
     if: needs.changes.outputs.code == 'true'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -156,29 +144,35 @@ jobs:
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
       - run: npm run test:unit
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
         if: success()
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
   build:
-    name: Build code-server
+    name: linux-x64
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
     env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       DISABLE_V8_COMPILE_CACHE: 1
+      VERSION: 0.0.0
+      VSCODE_TARGET: linux-x64
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      ELECTRON_SKIP_BINARY_DOWNLOAD: 1
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+
     steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: true
       - run: sudo apt update && sudo apt install -y libkrb5-dev
-      - uses: awalsh128/cache-apt-pkgs-action@latest
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
         with:
           packages: quilt
           version: 1.0
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -187,53 +181,46 @@ jobs:
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
       - run: npm run build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # Get Code's git hash.  When this changes it means the content is
       # different and we need to rebuild.
       - name: Get latest lib/vscode rev
         id: vscode-rev
         run: echo "rev=$(git rev-parse HEAD:./lib/vscode)" >> $GITHUB_OUTPUT
-      # We need to rebuild when we have a new version of Code, when any of
-      # the patches changed, or when the code-server version changes (since
-      # it gets embedded into the code).  Use VSCODE_CACHE_VERSION to
-      # force a rebuild.
-      - name: Fetch prebuilt Code package from cache
+      # We need to rebuild when we have a new version of Code, when any of the
+      # patches changed, or when the code-server version changes (since it gets
+      # embedded into the code).  Use VSCODE_CACHE_VERSION to force a rebuild.
+      - name: Fetch prebuilt linux-x64 Code package from cache
         id: cache-vscode
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: lib/vscode-reh-web-*
-          key: vscode-reh-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }}
+          path: lib/vscode-reh-web-linux-x64
+          key: vscode-linux-x64-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }}
       - name: Build vscode
-        env:
-          VERSION: "0.0.0"
         if: steps.cache-vscode.outputs.cache-hit != 'true'
         run: |
           pushd lib/vscode
           npm ci
           popd
           npm run build:vscode
-      # The release package does not contain any native modules
-      # and is neutral to architecture/os/libc version.
-      - run: npm run release
-        if: success()
-      # https://github.com/actions/upload-artifact/issues/38
+      # Push up an artifact containing the linux-x64 release.
+      - run: KEEP_MODULES=1 npm run release
       - run: tar -czf package.tar.gz release
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: npm-package
+          name: linux-x64-package
           path: ./package.tar.gz
 
   test-e2e:
     name: Run e2e tests
     runs-on: ubuntu-22.04
-    timeout-minutes: 25
+    env:
+      LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
+
     steps:
-      - uses: actions/checkout@v4
-      - run: sudo apt update && sudo apt install -y libkrb5-dev
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -241,70 +228,71 @@ jobs:
             package-lock.json
             test/package-lock.json
       - run: SKIP_SUBMODULE_DEPS=1 npm ci
-      - uses: actions/download-artifact@v4
-        with:
-          name: npm-package
-      - run: tar -xzf package.tar.gz
-      - run: cd release && npm install --unsafe-perm --omit=dev
       - name: Install Playwright OS dependencies
         run: |
           ./test/node_modules/.bin/playwright install-deps
           ./test/node_modules/.bin/playwright install
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: linux-x64-package
+      - run: tar -xzf package.tar.gz
+
       - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: failed-test-videos
           path: ./test/test-results
-      - run: rm -rf ./release ./test/test-results
 
   test-e2e-proxy:
     name: Run e2e tests behind proxy
     runs-on: ubuntu-22.04
-    timeout-minutes: 25
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
+
     steps:
-      - uses: actions/checkout@v4
-      - run: sudo apt update && sudo apt install -y libkrb5-dev
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-      - uses: actions/download-artifact@v4
-        with:
-          name: npm-package
-      - run: tar -xzf package.tar.gz
-      - run: cd release && npm install --unsafe-perm --omit=dev
-      - name: Install Playwright OS dependencies
-        run: |
-          ./test/node_modules/.bin/playwright install-deps
-          ./test/node_modules/.bin/playwright install
       - name: Cache Caddy
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: caddy-cache
         with:
           path: |
             ~/.cache/caddy
           key: cache-caddy-2.5.2
       - name: Install Caddy
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         if: steps.caddy-cache.outputs.cache-hit != 'true'
         run: |
           gh release download v2.5.2 --repo caddyserver/caddy --pattern "caddy_2.5.2_linux_amd64.tar.gz"
           mkdir -p ~/.cache/caddy
           tar -xzf caddy_2.5.2_linux_amd64.tar.gz --directory ~/.cache/caddy
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            test/package-lock.json
+      - run: SKIP_SUBMODULE_DEPS=1 npm ci
+      - name: Install Playwright OS dependencies
+        run: |
+          ./test/node_modules/.bin/playwright install-deps
+          ./test/node_modules/.bin/playwright install
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: linux-x64-package
+      - run: tar -xzf package.tar.gz
+
       - run: ~/.cache/caddy/caddy start --config ./ci/Caddyfile
       - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e:proxy
       - run: ~/.cache/caddy/caddy stop --config ./ci/Caddyfile
         if: always()
-
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: failed-test-videos-proxy

.github/workflows/installer.yaml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install code-server
         run: ./install.sh
@@ -44,7 +44,7 @@ jobs:
     container: "alpine:3.17"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install curl
         run: apk add curl
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install code-server
         run: ./install.sh

.github/workflows/publish.yaml

@@ -6,7 +6,6 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: The version to publish (include "v", i.e. "v4.9.1").
         type: string
         required: true
 
@@ -23,120 +22,74 @@ concurrency:
 jobs:
   npm:
     runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code-server
-        uses: actions/checkout@v4
+    env:
+      TAG: ${{ inputs.version || github.ref_name }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NPM_ENVIRONMENT: "production"
 
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+    steps:
+      - name: Set version to tag without leading v
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
 
-      - name: Download npm package from release artifacts
-        uses: robinraju/release-downloader@v1.12
+      - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
         with:
           repository: "coder/code-server"
-          tag: ${{ github.event.inputs.version || github.ref_name }}
+          tag: ${{ env.TAG }}
           fileName: "package.tar.gz"
           out-file-path: "release-npm-package"
 
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ github.event.inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - run: npm run publish:npm
-        env:
-          VERSION: ${{ env.VERSION }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_ENVIRONMENT: "production"
-
-  homebrew:
-    needs: npm
-    runs-on: ubuntu-latest
-    steps:
-      # Ensure things are up to date
-      # Suggested by homebrew maintainers
-      # https://github.com/Homebrew/discussions/discussions/1532#discussioncomment-782633
-      - name: Set up Homebrew
-        id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
-
-      - name: Checkout code-server
-        uses: actions/checkout@v4
-
-      - name: Configure git
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ github.event.inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - name: Bump code-server homebrew version
-        env:
-          VERSION: ${{ env.VERSION }}
-          HOMEBREW_GITHUB_API_TOKEN: ${{secrets.HOMEBREW_GITHUB_API_TOKEN}}
-
-        run: ./ci/steps/brew-bump.sh
+      - run: tar -xzf release-npm-package/package.tar.gz
+      - run: |
+          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+          pushd release
+          npm publish --tag latest --access public
 
   aur:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+      TAG: ${{ inputs.version || github.ref_name }}
 
     steps:
-      # We need to checkout code-server so we can get the version
-      - name: Checkout code-server
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          path: "./code-server"
+      - name: Set version to tag without leading v
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - name: Checkout code-server-aur repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: "cdrci/code-server-aur"
           token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
           ref: "master"
 
-      - name: Merge in master
-        run: |
-          git remote add upstream https://github.com/coder/code-server-aur.git
-          git fetch upstream
-          git merge upstream/master
-
       - name: Configure git
         run: |
           git config --global user.name cdrci
           git config --global user.email opensource@coder.com
 
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
+      - name: Fetch and reset master
         run: |
-          TAG="${{ github.event.inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+          git remote add upstream https://github.com/coder/code-server-aur.git
+          git fetch upstream
+          git reset --hard upstream/master
+          git push --force
 
       - name: Validate package
-        uses: heyhusen/archlinux-package-action@v2.4.0
-        env:
-          VERSION: ${{ env.VERSION }}
+        uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
         with:
           pkgver: ${{ env.VERSION }}
           updpkgsums: true
           srcinfo: true
 
       - name: Open PR
-        # We need to git push -u otherwise gh will prompt
-        # asking where to push the branch.
-        env:
-          VERSION: ${{ env.VERSION }}
         run: |
           git checkout -b update-version-${{ env.VERSION }}
           git add .
@@ -146,53 +99,69 @@ jobs:
 
   docker:
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      TAG: ${{ inputs.version || github.ref_name }}
+
     steps:
-      - name: Checkout code-server
-        uses: actions/checkout@v4
+      - name: Set version to tag without leading v
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
+      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ github.event.inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - name: Download deb artifacts
-        uses: robinraju/release-downloader@v1.12
+      - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
         with:
           repository: "coder/code-server"
           tag: v${{ env.VERSION }}
           fileName: "*.deb"
           out-file-path: "release-packages"
-
-      - name: Download rpm artifacts
-        uses: robinraju/release-downloader@v1.12
+      - uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
         with:
           repository: "coder/code-server"
           tag: v${{ env.VERSION }}
           fileName: "*.rpm"
           out-file-path: "release-packages"
 
-      - name: Publish to Docker
-        run: ./ci/steps/docker-buildx-push.sh
-        env:
-          VERSION: ${{ env.VERSION }}
-          GITHUB_TOKEN: ${{ github.token }}
+      - run: npm run publish:docker
+
+  repo:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+      TAG: ${{ inputs.version || github.ref_name }}
+    needs: docker
+
+    steps:
+      - name: Set version to tag without leading v
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - run: ./ci/build/update-repo.sh
+
+      - name: Open PR
+        run: |
+          git config --global user.name cdrci
+          git config --global user.email opensource@coder.com
+          git checkout -b "helm/$VERSION"
+          git add .
+          git commit -m "Update to $VERSION"
+          git push -u origin "$(git branch --show)"
+          gh pr create \
+            --repo coder/code-server \
+            --body-file .cache/checklist \
+            --title "Update to $VERSION"

.github/workflows/release.yaml

@@ -4,9 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: The version to publish (include "v", i.e. "v4.9.1").
         type: string
         required: true
+  pull_request_target:
+    types:
+      - closed
+    branches:
+      - "update/**"
 
 permissions:
   contents: write # For creating releases.
@@ -19,185 +23,153 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  package-linux-cross:
-    name: ${{ matrix.prefix }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: npm-version
-    container: "python:3.8-slim-buster"
+  package-linux:
+    name: ${{ format('linux-{0}', matrix.vscode_arch) }}
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+
     strategy:
       matrix:
         include:
-          - prefix: x86_64-linux-gnu
-            npm_arch: x64
-            apt_arch: amd64
+          - npm_arch: x64
+            vscode_arch: x64
             package_arch: amd64
-          - prefix: aarch64-linux-gnu
-            npm_arch: arm64
-            apt_arch: arm64
+          - npm_arch: arm64
+            vscode_arch: arm64
             package_arch: arm64
-          - prefix: arm-linux-gnueabihf
-            npm_arch: armv7l
-            apt_arch: armhf
+          - npm_arch: arm
+            vscode_arch: armhf
             package_arch: armv7l
 
     env:
-      AR: ${{ format('{0}-ar', matrix.prefix) }}
-      AS: ${{ format('{0}-as', matrix.prefix) }}
-      CC: ${{ format('{0}-gcc', matrix.prefix) }}
-      CPP: ${{ format('{0}-cpp', matrix.prefix) }}
-      CXX: ${{ format('{0}-g++', matrix.prefix) }}
-      FC: ${{ format('{0}-gfortran', matrix.prefix) }}
-      LD: ${{ format('{0}-ld', matrix.prefix) }}
-      STRIP: ${{ format('{0}-strip', matrix.prefix) }}
-      PKG_CONFIG_PATH: ${{ format('/usr/lib/{0}/pkgconfig', matrix.prefix) }}
-      TARGET_ARCH: ${{ matrix.apt_arch }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      ELECTRON_SKIP_BINARY_DOWNLOAD: 1
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
+      TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }}
+      # Set release package name.
+      ARCH: ${{ matrix.package_arch }}
+      # Cross-compile target.
+      VSCODE_ARCH: ${{ matrix.vscode_arch }}
       npm_config_arch: ${{ matrix.npm_arch }}
-      PKG_ARCH: ${{ matrix.package_arch }}
-      # Not building from source results in an x86_64 argon2, as if
-      # npm_config_arch is being ignored.
+      # Ensure native modules are built from source to avoid prebuilds and use
+      # the correct version of glibc.
+      npm_config_build_from_source: true
+      # Gulp target name.
+      # TODO: Pull from VSCODE_ARCH instead.
+      VSCODE_TARGET: ${{ format('linux-{0}', matrix.vscode_arch) }}
+
+    steps:
+      - run: sudo apt update && sudo apt install -y libkrb5-dev
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
+        with:
+          packages: quilt
+          version: 1.0
+      - name: Install nfpm
+        run: |
+          mkdir -p ~/.local/bin
+          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Strip update/ and v from tag
+        run: |
+          version=${TAG#update/}
+          echo "VERSION=${version#v}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: true
+      - run: quilt push -a
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            test/package-lock.json
+
+      - name: Build
+        run: |
+          cd lib/vscode/build
+          npm ci
+          cd ..
+          source ./build/azure-pipelines/linux/setup-env.sh
+          # Run preinstall script before root dependencies are installed
+          # so that v8 headers are patched correctly for native modules.
+          node build/npm/preinstall.ts
+          cd ../..
+          npm ci
+          npm run build
+          npm run build:vscode
+
+      # Platform-agnostic NPM package.
+      - run: npm run release
+        if: ${{ matrix.vscode_arch == 'x64' }}
+      - run: tar -czf package.tar.gz release
+        if: ${{ matrix.vscode_arch == 'x64' }}
+      - run: |
+          sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
+        if: ${{ matrix.vscode_arch == 'x64' }}
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        if: ${{ matrix.vscode_arch == 'x64' }}
+        with:
+          draft: true
+          discussion_category_name: "📣 Announcements"
+          files: package.tar.gz
+          tag_name: v${{ env.VERSION }}
+          name: v${{ env.VERSION }}
+          body: .cache/release-notes
+
+      # Platform-specific release.
+      - run: KEEP_MODULES=1 npm run release
+      - run: npm run package
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        with:
+          draft: true
+          discussion_category_name: "📣 Announcements"
+          files: ./release-packages/*
+          tag_name: v${{ env.VERSION }}
+          name: v${{ env.VERSION }}
+
+  package-macos:
+    name: ${{ matrix.vscode_target }}
+    runs-on: ${{ matrix.os }}
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request_merged == true
+    strategy:
+      matrix:
+        include:
+          - os: macos-15-intel
+            vscode_target: darwin-x64
+          - os: macos-latest
+            vscode_target: darwin-arm64
+    env:
+      VSCODE_TARGET: ${{ matrix.vscode_target }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      TAG: ${{ inputs.version || github.ref_name }}
+      # Ensure native modules are built from source to avoid prebuilds.
       npm_config_build_from_source: true
 
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-
-      - name: Install cross-compiler and system dependencies
-        run: |
-          dpkg --add-architecture $TARGET_ARCH
-          apt update && apt install -y --no-install-recommends \
-            crossbuild-essential-$TARGET_ARCH \
-            libx11-dev:$TARGET_ARCH \
-            libx11-xcb-dev:$TARGET_ARCH \
-            libxkbfile-dev:$TARGET_ARCH \
-            libsecret-1-dev:$TARGET_ARCH \
-            libkrb5-dev:$TARGET_ARCH \
-            ca-certificates \
-            curl wget rsync gettext-base
-
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Install nfpm
-        run: |
-          mkdir -p ~/.local/bin
-          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
-        with:
-          name: npm-release-package
-
-      - run: tar -xzf package.tar.gz
-      - run: npm run release:standalone
-
-      - name: Replace node with cross-compile equivalent
-        run: |
-          node_version=$(node --version)
-          wget https://nodejs.org/dist/${node_version}/node-${node_version}-linux-${npm_config_arch}.tar.xz
-          tar -xf node-${node_version}-linux-${npm_config_arch}.tar.xz node-${node_version}-linux-${npm_config_arch}/bin/node --strip-components=2
-          mv ./node ./release-standalone/lib/node
-
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - env:
-          VERSION: ${{ env.VERSION }}
-        run: npm run package $PKG_ARCH
-
-      - uses: softprops/action-gh-release@v1
-        with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./release-packages/*
-
-  package-macos-amd64:
-    name: x86-64 macOS build
-    runs-on: macos-13
-    timeout-minutes: 15
-    needs: npm-version
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .node-version
-          cache: npm
-          cache-dependency-path: |
-            package-lock.json
-            test/package-lock.json
-
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Install nfpm
-        run: |
-          mkdir -p ~/.local/bin
-          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
       # The version of node-gyp we use depends on distutils but it was removed
       # in Python 3.12.  It seems to be fixed in the latest node-gyp so when we
       # next update Node we can probably remove this.  For now, install
       # setuptools since it contains distutils.
-      - run: brew install python-setuptools
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
-        with:
-          name: npm-release-package
-
-      - run: tar -xzf package.tar.gz
-      - run: npm run release:standalone
-      - run: npm run test:native
-
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
+      - run: brew install python-setuptools quilt
+      - name: Install nfpm
         run: |
-          TAG="${{ inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+          mkdir -p ~/.local/bin
+          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-      - name: Build packages with nfpm
-        env:
-          VERSION: ${{ env.VERSION }}
-        run: npm run package
+      - name: Strip update/ and v from tag
+        run: |
+          version=${TAG#update/}
+          echo "VERSION=${version#v}" >> $GITHUB_ENV
 
-      - uses: softprops/action-gh-release@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./release-packages/*
-
-  package-macos-arm64:
-    name: arm64 macOS build
-    runs-on: macos-latest
-    timeout-minutes: 15
-    needs: npm-version
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
+          submodules: true
+      - run: quilt push -a
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -205,104 +177,17 @@ jobs:
             package-lock.json
             test/package-lock.json
 
-      - run: SKIP_SUBMODULE_DEPS=1 npm ci
-
-      - name: Install nfpm
-        run: |
-          mkdir -p ~/.local/bin
-          curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      # The version of node-gyp we use depends on distutils but it was removed
-      # in Python 3.12.  It seems to be fixed in the latest node-gyp so when we
-      # next update Node we can probably remove this.  For now, install
-      # setuptools since it contains distutils.
-      - run: brew install python-setuptools
-
-      - name: Download npm package
-        uses: actions/download-artifact@v4
-        with:
-          name: npm-release-package
-
-      - run: tar -xzf package.tar.gz
-      - run: npm run release:standalone
+      - run: npm ci
+      - run: npm run build
+      - run: npm run build:vscode
+      - run: KEEP_MODULES=1 npm run release
       - run: npm run test:native
 
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - name: Build packages with nfpm
-        env:
-          VERSION: ${{ env.VERSION }}
-        run: npm run package
-
-      - uses: softprops/action-gh-release@v1
+      - run: npm run package
+      - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
-
-  npm-package:
-    name: Upload npm package
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: npm-version
-    steps:
-      - name: Download npm package
-        uses: actions/download-artifact@v4
-        with:
-          name: npm-release-package
-
-      - uses: softprops/action-gh-release@v1
-        with:
-          draft: true
-          discussion_category_name: "📣 Announcements"
-          files: ./package.tar.gz
-
-  npm-version:
-    name: Modify package.json version
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Download artifacts
-        uses: dawidd6/action-download-artifact@v10
-        id: download
-        with:
-          branch: ${{ github.ref }}
-          workflow: build.yaml
-          workflow_conclusion: completed
-          name: npm-package
-          check_artifacts: false
-          if_no_artifact_found: fail
-
-      - run: tar -xzf package.tar.gz
-
-      # Strip out the v (v4.9.1 -> 4.9.1).
-      - name: Get and set VERSION
-        run: |
-          TAG="${{ inputs.version || github.ref_name }}"
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - name: Modify version
-        env:
-          VERSION: ${{ env.VERSION }}
-        run: |
-          echo "Updating version in root package.json"
-          npm version --prefix release "$VERSION"
-
-          echo "Updating version in lib/vscode/product.json"
-          tmp=$(mktemp)
-          jq ".codeServerVersion = \"$VERSION\"" release/lib/vscode/product.json > "$tmp" && mv "$tmp" release/lib/vscode/product.json
-          # Ensure it has the same permissions as before
-          chmod 644 release/lib/vscode/product.json
-
-      - run: tar -czf package.tar.gz release
-
-      - name: Upload npm package artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: npm-release-package
-          path: ./package.tar.gz
+          tag_name: v${{ env.VERSION }}
+          name: v${{ env.VERSION }}

.github/workflows/scripts.yaml

@@ -41,7 +41,7 @@ jobs:
     container: "alpine:3.17"
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install test utilities
         run: apk add bats checkbashisms
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install lint utilities
         run: sudo apt install shellcheck

.github/workflows/security.yaml

@@ -25,12 +25,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version-file: .node-version
 
@@ -46,12 +46,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5
+        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # latest
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -62,7 +62,7 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           sarif_file: "trivy-repo-results.sarif"
 
@@ -76,17 +76,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           config-file: ./.github/codeql-config.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4

.github/workflows/trivy-docker.yaml

@@ -48,10 +48,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run Trivy vulnerability scanner in image mode
-        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5
+        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # latest
         with:
           image-ref: "docker.io/codercom/code-server:latest"
           ignore-unfixed: true
@@ -60,6 +60,6 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           sarif_file: "trivy-image-results.sarif"

.github/workflows/update.yaml

@@ -0,0 +1,72 @@
+name: Update code-server
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        required: true
+  schedule:
+    - cron: "0 16,21 * * *"
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ inputs.version }}
+      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
+
+    steps:
+      - name: Fetch latest tag
+        if: env.TAG == ''
+        run: |
+          tag=$(curl -fsSLI -o /dev/null -w "%{url_effective}" https://github.com/microsoft/vscode/releases/latest)
+          tag="${tag#https://github.com/microsoft/vscode/releases/tag/}"
+          echo "TAG=$tag" >> $GITHUB_ENV
+
+      - name: Remove leading v from tag
+        run: |
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          submodules: true
+
+      - name: Check current version
+        id: check
+        run: |
+          commit="$(git -C lib/vscode rev-parse HEAD)"
+          if [[ $(git -C lib/vscode ls-remote --tags | grep "$commit") == */"$VERSION" ]] ; then
+            echo "$VERSION update has already been merged into $(git rev-parse --abbrev-ref HEAD)"
+            echo done=true >> $GITHUB_OUTPUT
+          elif git ls-remote --exit-code --heads origin "update/$VERSION" ; then
+            echo "There is already a PR for updating to $VERSION"
+            echo done=true >> $GITHUB_OUTPUT
+          else
+            echo "$VERSION update has not started yet"
+            echo done=false >> $GITHUB_OUTPUT
+          fi
+
+      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
+        if: steps.check.outputs.done == 'false'
+        with:
+          packages: quilt
+          version: 1.0
+
+      - run: ./ci/build/update-vscode.sh
+        if: steps.check.outputs.done == 'false'
+
+      - name: Open PR
+        if: steps.check.outputs.done == 'false'
+        run: |
+          git config --global user.name cdrci
+          git config --global user.email opensource@coder.com
+          git checkout -b "update/$VERSION"
+          git add .
+          git commit -m "Update VS Code to $VERSION"
+          git push -u origin "$(git branch --show)"
+          gh pr create \
+            --repo coder/code-server \
+            --title "Update VS Code to $VERSION" \
+            --body-file .cache/checklist \
+            --draft

.gitignore

@@ -2,8 +2,6 @@
 .cache
 /out*/
 release/
-release-npm-package/
-release-standalone/
 release-packages/
 release-gcp/
 release-images/
@@ -13,6 +11,7 @@ node_modules
 .home
 coverage
 **/.DS_Store
+*.bak
 
 # Code packages itself here.
 /lib/vscode-reh-web-*

.node-version

@@ -1 +1 @@
-22.15.1
+22.22.1

.prettierignore

@@ -1,6 +1,4 @@
-lib/vscode
-lib/vscode-reh-web-linux-x64
-release-standalone
+lib
 release-packages
 release
 helm-chart

CHANGELOG.md

@@ -22,7 +22,325 @@ Code v99.99.999
 
 ## Unreleased
 
-Code v1.101.1
+## [4.119.0](https://github.com/coder/code-server/releases/tag/v4.119.0) - 2026-05-07
+
+Code v1.119.0
+
+### Changed
+
+- Update to Code 1.119.0
+
+## [4.118.0](https://github.com/coder/code-server/releases/tag/v4.118.0) - 2026-05-06
+
+Code v1.118.0
+
+### Changed
+
+- Update to Code 1.118.0
+
+## [4.117.0](https://github.com/coder/code-server/releases/tag/v4.117.0) - 2026-04-22
+
+Code v1.117.0
+
+### Changed
+
+- Update to Code 1.117.0
+
+## [4.116.0](https://github.com/coder/code-server/releases/tag/v4.116.0) - 2026-04-16
+
+Code v1.116.0
+
+### Changed
+
+- Update to Code 1.116.0
+
+## [4.115.0](https://github.com/coder/code-server/releases/tag/v4.115.0) - 2026-04-08
+
+Code v1.115.0
+
+### Changed
+
+- Update to Code 1.115.0
+
+## [4.114.1](https://github.com/coder/code-server/releases/tag/v4.114.1) - 2026-04-06
+
+Code v1.114.0
+
+### Changed
+
+- Ensure native modules are built from source so they use the correct version of
+  glibc. This should bring down the requirement from 2.34 back down to 2.28.
+
+## [4.114.0](https://github.com/coder/code-server/releases/tag/v4.114.0) - 2026-04-04
+
+Code v1.114.0
+
+### Changed
+
+- Update to Code 1.114.0.
+
+## [4.113.1](https://github.com/coder/code-server/releases/tag/v4.113.1) - 2026-04-03
+
+Code v1.113.0
+
+This is a re-release of v4.113.0 but with the correct Node binaries for arm64
+and armv7l. Previously they were packaging the amd64 Node binary due to a
+mistake while refactoring CI to use more of the upstream build scripts.
+
+## [4.113.0](https://github.com/coder/code-server/releases/tag/v4.113.0) - 2026-04-02
+
+Code v1.113.0
+
+### Changed
+
+- Update to Code 1.113.0
+
+## [4.112.0](https://github.com/coder/code-server/releases/tag/v4.112.0) - 2026-03-19
+
+Code v1.112.0
+
+### Changed
+
+- Update to Code 1.112.0
+
+## [4.111.0](https://github.com/coder/code-server/releases/tag/v4.111.0) - 2026-03-11
+
+Code v1.111.0
+
+### Changed
+
+- Update to Code 1.111.0
+- `--app-name` now affects the error page title.
+
+## [4.110.1](https://github.com/coder/code-server/releases/tag/v4.110.1) - 2026-03-10
+
+Code v1.110.1
+
+### Changed
+
+- Update to Code 1.110.1
+
+## [4.110.0](https://github.com/coder/code-server/releases/tag/v4.110.0) - 2026-03-09
+
+Code v1.110.0
+
+### Changed
+
+- Update to Code 1.110.0
+
+## [4.109.5](https://github.com/coder/code-server/releases/tag/v4.109.5) - 2026-03-02
+
+Code v1.109.5
+
+### Changed
+
+- Update to Code 1.109.5
+
+## [4.109.2](https://github.com/coder/code-server/releases/tag/v4.109.2) - 2026-02-12
+
+Code v1.109.2
+
+### Changed
+
+- Update to Code 1.109.2
+
+## [4.109.0](https://github.com/coder/code-server/releases/tag/v4.109.0) - 2026-02-12
+
+Code v1.109.0
+
+### Changed
+
+- Update to Code 1.109.0
+
+## [4.108.2](https://github.com/coder/code-server/releases/tag/v4.108.2) - 2026-01-26
+
+Code v1.108.2
+
+### Changed
+
+- Update to Code 1.108.2
+
+## [4.108.1](https://github.com/coder/code-server/releases/tag/v4.108.1) - 2026-01-16
+
+Code v1.108.1
+
+### Changed
+
+- Update to Code 1.108.1
+
+## [4.108.0](https://github.com/coder/code-server/releases/tag/v4.108.0) - 2026-01-12
+
+Code v1.108.0
+
+### Changed
+
+- Update to Code 1.108.0
+
+## [4.107.1](https://github.com/coder/code-server/releases/tag/v4.107.1) - 2026-01-09
+
+Code v1.107.1
+
+### Changed
+
+- Update to Code 1.107.1
+
+## [4.107.0](https://github.com/coder/code-server/releases/tag/v4.107.0) - 2026-12-17
+
+Code v1.107.0
+
+### Changed
+
+- Update to Code 1.107.0
+
+### Added
+
+- New `--cookie-suffix` flag that can be used to add a suffix to the cookie when
+  using the built-in password authentication. You can use this to avoid
+  collisions with other instances of code-server.
+- Support a new property `authorizationHeaderToken` on the extension gallery
+  configuration. This will be added to marketplace requests as a bearer token
+  using the `Authorization` header.
+
+## [4.106.3](https://github.com/coder/code-server/releases/tag/v4.106.3) - 2025-12-01
+
+Code v1.106.3
+
+### Changed
+
+- Update to Code 1.106.3
+
+## [4.106.2](https://github.com/coder/code-server/releases/tag/v4.106.2) - 2025-11-19
+
+Code v1.106.2
+
+### Changed
+
+- Update to Code 1.106.2
+
+## [4.106.0](https://github.com/coder/code-server/releases/tag/v4.106.0) - 2025-11-19
+
+Code v1.106.0
+
+### Changed
+
+- Update to Code 1.106.0
+
+## [4.105.1](https://github.com/coder/code-server/releases/tag/v4.105.1) - 2025-10-20
+
+Code v1.105.1
+
+### Changed
+
+- Update to Code 1.105.1
+
+## [4.105.0](https://github.com/coder/code-server/releases/tag/v4.105.0) - 2025-10-17
+
+Code v1.105.0
+
+### Changed
+
+- Update to Code 1.105.0
+
+## [4.104.3](https://github.com/coder/code-server/releases/tag/v4.104.3) - 2025-10-07
+
+Code v1.104.3
+
+### Changed
+
+- Update to Code 1.104.3.
+
+## [4.104.2](https://github.com/coder/code-server/releases/tag/v4.104.2) - 2025-09-26
+
+Code v1.104.2
+
+### Changed
+
+- Update to Code 1.104.2.
+
+## [4.104.1](https://github.com/coder/code-server/releases/tag/v4.104.1) - 2025-09-19
+
+Code v1.104.1
+
+### Changed
+
+- Update to Code 1.104.1.
+
+## [4.104.0](https://github.com/coder/code-server/releases/tag/v4.104.0) - 2025-09-15
+
+Code v1.104.0
+
+### Fixed
+
+- Fix "extension not found" errors from Open VSX when trying to install the
+  latest version of an extension.
+
+### Changed
+
+- Update to Code 1.104.0.
+
+## [4.103.2](https://github.com/coder/code-server/releases/tag/v4.103.2) - 2025-08-25
+
+Code v1.103.2
+
+### Changed
+
+- Update to Code 1.103.2.
+
+## [4.103.1](https://github.com/coder/code-server/releases/tag/v4.103.1) - 2025-08-15
+
+Code v1.103.1
+
+### Changed
+
+- Update to Code 1.103.1.
+
+## [4.103.0](https://github.com/coder/code-server/releases/tag/v4.103.0) - 2025-08-12
+
+Code v1.103.0
+
+### Changed
+
+- Update to Code 1.103.0.
+
+## [4.102.2](https://github.com/coder/code-server/releases/tag/v4.102.2) - 2025-07-24
+
+Code v1.102.2
+
+### Changed
+
+- Update to Code 1.102.2.
+
+## [4.102.1](https://github.com/coder/code-server/releases/tag/v4.102.1) - 2025-07-17
+
+Code v1.102.1
+
+### Changed
+
+- Update to Code 1.102.1.
+
+## [4.102.0](https://github.com/coder/code-server/releases/tag/v4.102.0) - 2025-07-16
+
+Code v1.102.0
+
+### Changed
+
+- Update to Code 1.102.0.
+
+### Added
+
+- Custom strings can be configured using the `--i18n` flag set to a JSON
+  file. This can be used for either translation (and can be used alongside
+  `--locale`) or for customizing the strings. See
+  [./src/node/i18n/locales/en.json](./src/node/i18n/locales/en.json) for the
+  available keys.
+
+## [4.101.2](https://github.com/coder/code-server/releases/tag/v4.101.2) - 2025-06-25
+
+Code v1.101.2
+
+### Changed
+
+- Update to Code 1.101.2.
 
 ### Fixed
 
@@ -772,7 +1090,6 @@ Code v1.68.1
   would be accessible at `my.domain/proxy/8000/` without any authentication.
 
   If all of the following apply to you please update as soon as possible:
-
   - You run code-server with the built-in password authentication.
   - You run unprotected HTTP services on ports accessible by code-server.
 

ci/README.md

@@ -1,112 +0,0 @@
-# ci
-
-This directory contains scripts used for code-server's continuous integration infrastructure.
-
-Some of these scripts contain more detailed documentation and options
-in header comments.
-
-Any file or directory in this subdirectory should be documented here.
-
-- [./ci/lib.sh](./lib.sh)
-  - Contains code duplicated across these scripts.
-
-## dev
-
-This directory contains scripts used for the development of code-server.
-
-- [./ci/dev/image](./dev/image)
-  - See [./docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md) for docs on the development container.
-- [./ci/dev/fmt.sh](./dev/fmt.sh) (`npm run fmt`)
-  - Runs formatters.
-- [./ci/dev/lint.sh](./dev/lint.sh) (`npm run lint`)
-  - Runs linters.
-- [./ci/dev/test-unit.sh](./dev/test-unit.sh) (`npm run test:unit`)
-  - Runs unit tests.
-- [./ci/dev/test-e2e.sh](./dev/test-e2e.sh) (`npm run test:e2e`)
-  - Runs end-to-end tests.
-- [./ci/dev/watch.ts](./dev/watch.ts) (`npm run watch`)
-  - Starts a process to build and launch code-server and restart on any code changes.
-  - Example usage in [./docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md).
-- [./ci/dev/gen_icons.sh](./dev/gen_icons.sh) (`npm run icons`)
-  - Generates the various icons from a single `.svg` favicon in
-    `src/browser/media/favicon.svg`.
-  - Requires [imagemagick](https://imagemagick.org/index.php)
-
-## build
-
-This directory contains the scripts used to build and release code-server.
-You can disable minification by setting `MINIFY=`.
-
-- [./ci/build/build-code-server.sh](./build/build-code-server.sh) (`npm run build`)
-  - Builds code-server into `./out` and bundles the frontend into `./dist`.
-- [./ci/build/build-vscode.sh](./build/build-vscode.sh) (`npm run build:vscode`)
-  - Builds vscode into `./lib/vscode/out-vscode`.
-- [./ci/build/build-release.sh](./build/build-release.sh) (`npm run release`)
-  - Bundles the output of the above two scripts into a single node module at `./release`.
-- [./ci/build/clean.sh](./build/clean.sh) (`npm run clean`)
-  - Removes all build artifacts.
-  - Useful to do a clean build.
-- [./ci/build/code-server.sh](./build/code-server.sh)
-  - Copied into standalone releases to run code-server with the bundled node binary.
-- [./ci/build/test-standalone-release.sh](./build/test-standalone-release.sh) (`npm run test:standalone-release`)
-  - Ensures code-server in the `./release-standalone` directory works by installing an extension.
-- [./ci/build/build-packages.sh](./build/build-packages.sh) (`npm run package`)
-  - Packages `./release-standalone` into a `.tar.gz` archive in `./release-packages`.
-  - If on linux, [nfpm](https://github.com/goreleaser/nfpm) is used to generate `.deb` and `.rpm`.
-- [./ci/build/nfpm.yaml](./build/nfpm.yaml)
-  - Used to configure [nfpm](https://github.com/goreleaser/nfpm) to generate `.deb` and `.rpm`.
-- [./ci/build/code-server-nfpm.sh](./build/code-server-nfpm.sh)
-  - Entrypoint script for code-server for `.deb` and `.rpm`.
-- [./ci/build/code-server.service](./build/code-server.service)
-  - systemd user service packaged into the `.deb` and `.rpm`.
-- [./ci/build/release-github-draft.sh](./build/release-github-draft.sh) (`npm run release:github-draft`)
-  - Uses [gh](https://github.com/cli/cli) to create a draft release with a template description.
-- [./ci/build/release-github-assets.sh](./build/release-github-assets.sh) (`npm run release:github-assets`)
-  - Downloads the release-package artifacts for the current commit from CI.
-  - Uses [gh](https://github.com/cli/cli) to upload the artifacts to the release
-    specified in `package.json`.
-- [./ci/build/npm-postinstall.sh](./build/npm-postinstall.sh)
-  - Post install script for the npm package.
-  - Bundled by`npm run release`.
-
-## release-image
-
-This directory contains the release docker container image.
-
-- [./ci/steps/build-docker-buildx-push.sh](./steps/docker-buildx-push.sh)
-  - Builds the release containers with tags `codercom/code-server-$ARCH:$VERSION` for amd64 and arm64 with `docker buildx` and pushes them.
-  - Assumes debian releases are ready in `./release-packages`.
-
-## images
-
-This directory contains the images for CI.
-
-## steps
-
-This directory contains the scripts used in CI.
-Helps avoid clobbering the CI configuration.
-
-- [./steps/fmt.sh](./steps/fmt.sh)
-  - Runs `npm run fmt`.
-- [./steps/lint.sh](./steps/lint.sh)
-  - Runs `npm run lint`.
-- [./steps/test-unit.sh](./steps/test-unit.sh)
-  - Runs `npm run test:unit`.
-- [./steps/test-integration.sh](./steps/test-integration.sh)
-  - Runs `npm run test:integration`.
-- [./steps/test-e2e.sh](./steps/test-e2e.sh)
-  - Runs `npm run test:e2e`.
-- [./steps/release.sh](./steps/release.sh)
-  - Runs the release process.
-  - Generates the npm package at `./release`.
-- [./steps/release-packages.sh](./steps/release-packages.sh)
-  - Takes the output of the previous script and generates a standalone release and
-    release packages into `./release-packages`.
-- [./steps/publish-npm.sh](./steps/publish-npm.sh)
-  - Grabs the `npm-package` release artifact for the current commit and publishes it on npm.
-- [./steps/docker-buildx-push.sh](./steps/docker-buildx-push.sh)
-  - Builds the docker image and then pushes it.
-- [./steps/push-docker-manifest.sh](./steps/push-docker-manifest.sh)
-  - Loads all images in `./release-images` and then builds and pushes a multi architecture
-    docker manifest for the amd64 and arm64 images to `codercom/code-server:$VERSION` and
-    `codercom/code-server:latest`.

ci/build/build-packages.sh

@@ -1,21 +1,18 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Given a platform-specific release found in ./release-standalone, generate an
-# compressed archives and bundles (as appropriate for the platform) named after
-# the platform's architecture and OS and place them in ./release-packages and
-# ./release-gcp.
+# Given a release found in $RELEASE_PATH, generate a deb, rpm, and tarball each
+# named after $ARCH (derived from uname -m but can be overridden for
+# cross-compilation) and $OS (derived from uname and cannot be overridden) and
+# place them in ./release-packages and ./release-gcp.
 
 main() {
   cd "$(dirname "${0}")/../.."
   source ./ci/lib.sh
   source ./ci/build/build-lib.sh
 
-  # Allow us to override architecture
-  # we use this for our Linux ARM64 cross compile builds
-  if [ "$#" -eq 1 ] && [ "$1" ]; then
-    ARCH=$1
-  fi
+  VERSION=$(jq -r .version "$RELEASE_PATH/package.json")
+  export VERSION # for nfpm to use
 
   mkdir -p release-packages
 
@@ -29,9 +26,9 @@ main() {
 release_archive() {
   local release_name="code-server-$VERSION-$OS-$ARCH"
   if [[ $OS == "linux" ]]; then
-    tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^\.\/release-standalone/$release_name/" ./release-standalone
+    tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"
   else
-    tar -czf "release-packages/$release_name.tar.gz" -s "/^release-standalone/$release_name/" release-standalone
+    tar -czf "release-packages/$release_name.tar.gz" -s "/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH"
   fi
 
   echo "done (release-packages/$release_name)"
@@ -52,15 +49,13 @@ release_nfpm() {
 
   export NFPM_ARCH
 
-  PKG_FORMAT="deb"
-  NFPM_ARCH="$(get_nfpm_arch $PKG_FORMAT "$ARCH")"
+  NFPM_ARCH="$(get_nfpm_arch deb "$ARCH")"
   nfpm_config="$(envsubst < ./ci/build/nfpm.yaml)"
   echo "Building deb"
   echo "$nfpm_config" | head --lines=4
   nfpm pkg -f <(echo "$nfpm_config") --target "release-packages/code-server_${VERSION}_${NFPM_ARCH}.deb"
 
-  PKG_FORMAT="rpm"
-  NFPM_ARCH="$(get_nfpm_arch $PKG_FORMAT "$ARCH")"
+  NFPM_ARCH="$(get_nfpm_arch rpm "$ARCH")"
   nfpm_config="$(envsubst < ./ci/build/nfpm.yaml)"
   echo "Building rpm"
   echo "$nfpm_config" | head --lines=4

ci/build/build-release.sh

@@ -4,13 +4,16 @@ set -euo pipefail
 # Once both code-server and VS Code have been built, use this script to copy
 # them into a single directory (./release), prepare the package.json and
 # product.json, and add shrinkwraps.  This results in a generic NPM package that
-# we published to NPM and also use to compile platform-specific packages.
+# we can publish to NPM.
 
 # MINIFY controls whether minified VS Code is bundled. It must match the value
 # used when VS Code was built.
 MINIFY="${MINIFY-true}"
 
 # node_modules are not copied by default.  Set KEEP_MODULES=1 to copy them.
+# Note these modules will be for the platform that built them, making the result
+# no longer generic (it can still be published though as the modules will be
+# ignored when pushing).
 KEEP_MODULES="${KEEP_MODULES-0}"
 
 main() {
@@ -31,6 +34,23 @@ main() {
   rsync ./docs/README.md "$RELEASE_PATH"
   rsync LICENSE "$RELEASE_PATH"
   rsync ./lib/vscode/ThirdPartyNotices.txt "$RELEASE_PATH"
+
+  if [ "$KEEP_MODULES" = 1 ]; then
+    # Copy the code-server launcher.
+    mkdir -p "$RELEASE_PATH/bin"
+    rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server"
+    chmod 755 "$RELEASE_PATH/bin/code-server"
+
+    # Delete the extra bin scripts.
+    rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-darwin.sh"
+    rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-linux.sh"
+    rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser-darwin.sh"
+    rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser-linux.sh"
+    if [ "$OS" != windows ] ; then
+      rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code.cmd"
+      rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser.cmd"
+    fi
+  fi
 }
 
 bundle_code_server() {
@@ -48,6 +68,7 @@ bundle_code_server() {
   jq --slurp '(.[0] | del(.scripts,.jest,.devDependencies)) * .[1]' package.json <(
     cat << EOF
   {
+    "version": "$(jq -r .codeServerVersion "./lib/vscode-reh-web-$VSCODE_TARGET/product.json")",
     "commit": "$(git rev-parse HEAD)",
     "scripts": {
       "postinstall": "sh ./postinstall.sh"
@@ -57,17 +78,29 @@ EOF
   ) > "$RELEASE_PATH/package.json"
   mv npm-shrinkwrap.json "$RELEASE_PATH"
 
-  rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh"
-
   if [ "$KEEP_MODULES" = 1 ]; then
-    rsync node_modules/ "$RELEASE_PATH/node_modules"
+    local rsync_opts=(-a)
+    if [[ ${DEBUG-} = 1 ]]; then
+      rsync_opts+=(-vh)
+    fi
+    # If we build from source, exclude the prebuilds.
+    if [[ ${npm_config_build_from_source-} = true ]]; then
+      rsync_opts+=(--exclude /argon2/prebuilds)
+    fi
+    rsync "${rsync_opts[@]}" node_modules/ "$RELEASE_PATH/node_modules"
+    # Remove dev dependencies.
+    pushd "$RELEASE_PATH"
+    npm prune --production
+    popd
   fi
+
+  rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh"
 }
 
 bundle_vscode() {
   mkdir -p "$VSCODE_OUT_PATH"
 
-  local rsync_opts=()
+  local rsync_opts=(-a)
   if [[ ${DEBUG-} = 1 ]]; then
     rsync_opts+=(-vh)
   fi
@@ -76,16 +109,22 @@ bundle_vscode() {
   # npm package so exclude any .gitignore files.
   rsync_opts+=(--exclude .gitignore)
 
-  # Exclude Node as we will add it ourselves for the standalone and will not
-  # need it for the npm package.
+  # Exclude Node since we want to place it in a directory above.
   rsync_opts+=(--exclude /node)
 
-  # Exclude Node modules.
+  # Exclude Node modules.  Note that these will already only include production
+  # dependencies, so if we do keep them there is no need to do any
+  # post-processing to remove dev dependencies.
   if [[ $KEEP_MODULES = 0 ]]; then
     rsync_opts+=(--exclude node_modules)
   fi
 
-  rsync "${rsync_opts[@]}" ./lib/vscode-reh-web-*/ "$VSCODE_OUT_PATH"
+  rsync "${rsync_opts[@]}" "./lib/vscode-reh-web-$VSCODE_TARGET/" "$VSCODE_OUT_PATH"
+
+  # Copy the Node binary.
+  if [[ $KEEP_MODULES = 1 ]]; then
+    cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib"
+  fi
 
   # Merge the package.json for the web/remote server so we can include
   # dependencies, since we want to ship this via NPM.

ci/build/build-standalone-release.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Once we have an NPM package, use this script to copy it to a separate
-# directory (./release-standalone) and install the dependencies.  This new
-# directory can then be packaged as a platform-specific release.
-
-main() {
-  cd "$(dirname "${0}")/../.."
-
-  source ./ci/lib.sh
-
-  rsync "$RELEASE_PATH/" "$RELEASE_PATH-standalone"
-  RELEASE_PATH+=-standalone
-
-  # Package managers may shim their own "node" wrapper into the PATH, so run
-  # node and ask it for its true path.
-  local node_path
-  node_path="$(node <<< 'console.info(process.execPath)')"
-
-  mkdir -p "$RELEASE_PATH/bin"
-  mkdir -p "$RELEASE_PATH/lib"
-  rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server"
-  rsync "$node_path" "$RELEASE_PATH/lib/node"
-
-  chmod 755 "$RELEASE_PATH/lib/node"
-
-  pushd "$RELEASE_PATH"
-  npm install --unsafe-perm --omit=dev
-  # Code deletes some files from the extension node_modules directory which
-  # leaves broken symlinks in the corresponding .bin directory.  nfpm will fail
-  # on these broken symlinks so clean them up.
-  rm -fr "./lib/vscode/extensions/node_modules/.bin"
-  popd
-}
-
-main "$@"

ci/build/build-vscode.sh

@@ -6,33 +6,32 @@ set -euo pipefail
 # MINIFY controls whether a minified version of vscode is built.
 MINIFY=${MINIFY-true}
 
-delete-bin-script() {
-  rm -f "lib/vscode-reh-web-linux-x64/bin/$1"
-}
-
-copy-bin-script() {
-  local script="$1"
-  local dest="lib/vscode-reh-web-linux-x64/bin/$script"
-  cp "lib/vscode/resources/server/bin/$script" "$dest"
-  sed -i.bak "s/@@VERSION@@/$(vscode_version)/g" "$dest"
-  sed -i.bak "s/@@COMMIT@@/$BUILD_SOURCEVERSION/g" "$dest"
-  sed -i.bak "s/@@APPNAME@@/code-server/g" "$dest"
+fix-bin-script() {
+  local script="lib/vscode-reh-web-$VSCODE_TARGET/bin/$1"
+  sed -i.bak "s/@@VERSION@@/$(vscode_version)/g" "$script"
+  sed -i.bak "s/@@COMMIT@@/$BUILD_SOURCEVERSION/g" "$script"
+  sed -i.bak "s/@@APPNAME@@/code-server/g" "$script"
 
   # Fix Node path on Darwin and Linux.
   # We do not want expansion here; this text should make it to the file as-is.
   # shellcheck disable=SC2016
-  sed -i.bak 's/^ROOT=\(.*\)$/VSROOT=\1\nROOT="$(dirname "$(dirname "$VSROOT")")"/g' "$dest"
-  sed -i.bak 's/ROOT\/out/VSROOT\/out/g' "$dest"
+  sed -i.bak 's/^ROOT=\(.*\)$/VSROOT=\1\nROOT="$(dirname "$(dirname "$VSROOT")")"/g' "$script"
+  sed -i.bak 's/ROOT\/out/VSROOT\/out/g' "$script"
   # We do not want expansion here; this text should make it to the file as-is.
   # shellcheck disable=SC2016
-  sed -i.bak 's/$ROOT\/node/${NODE_EXEC_PATH:-$ROOT\/lib\/node}/g' "$dest"
+  sed -i.bak 's/$ROOT\/node/${NODE_EXEC_PATH:-$ROOT\/lib\/node}/g' "$script"
 
   # Fix Node path on Windows.
-  sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$dest"
-  sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$dest"
+  sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$script"
+  sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$script"
 
-  chmod +x "$dest"
-  rm "$dest.bak"
+  chmod +x "$script"
+  rm "$script.bak"
+}
+
+copy-bin-script() {
+  cp "lib/vscode/resources/server/bin/$1" "lib/vscode-reh-web-$VSCODE_TARGET/bin/$1"
+  fix-bin-script "$1"
 }
 
 main() {
@@ -108,11 +107,11 @@ main() {
 EOF
   ) > product.json
 
-  # Any platform here works since we will do our own packaging.  We have to do
-  # this because we have an NPM package that could be installed on any platform.
-  # The correct platform dependencies and scripts will be installed as part of
-  # the post-install during `npm install` or when building a standalone release.
-  npm run gulp "vscode-reh-web-linux-x64${MINIFY:+-min}"
+
+  VSCODE_QUALITY=stable npm run gulp compile-copilot-extension-full-build
+
+  npm run gulp core-ci
+  npm run gulp "vscode-reh-web-$VSCODE_TARGET${MINIFY:+-min}-ci"
 
   # Reset so if you develop after building you will not be stuck with the wrong
   # commit (the dev client will use `oss-dev` but the dev server will still use
@@ -121,7 +120,7 @@ EOF
 
   popd
 
-  pushd lib/vscode-reh-web-linux-x64
+  pushd "lib/vscode-reh-web-$VSCODE_TARGET"
   # Make sure Code took the version we set in the environment variable.  Not
   # having a version will break display languages.
   if ! jq -e .commit product.json; then
@@ -130,15 +129,28 @@ EOF
   fi
   popd
 
+  # Set vars and fix paths.
+  case $OS in
+    windows)
+      fix-bin-script remote-cli/code.cmd
+      fix-bin-script helpers/browser.cmd
+      ;;
+    *)
+      fix-bin-script remote-cli/code-server
+      fix-bin-script helpers/browser.sh
+      ;;
+  esac
+
+  # Include bin scripts for other platforms so we can use the right one in the
+  # NPM post-install.
+
   # These provide a `code-server` command in the integrated terminal to open
   # files in the current instance.
-  delete-bin-script remote-cli/code-server
   copy-bin-script remote-cli/code-darwin.sh
   copy-bin-script remote-cli/code-linux.sh
   copy-bin-script remote-cli/code.cmd
 
   # These provide a way for terminal applications to open browser windows.
-  delete-bin-script helpers/browser.sh
   copy-bin-script helpers/browser-darwin.sh
   copy-bin-script helpers/browser-linux.sh
   copy-bin-script helpers/browser.cmd

ci/build/nfpm.yaml

@@ -21,5 +21,5 @@ contents:
   - src: ./ci/build/code-server-user.service
     dst: /usr/lib/systemd/user/code-server.service
 
-  - src: ./release-standalone/*
+  - src: ./release/*
     dst: /usr/lib/code-server

ci/build/npm-postinstall.sh

@@ -23,17 +23,6 @@ symlink() {
   esac
 }
 
-# VS Code bundles some modules into an asar which is an archive format that
-# works like tar. It then seems to get unpacked into node_modules.asar.
-#
-# I don't know why they do this but all the dependencies they bundle already
-# exist in node_modules so just symlink it. We have to do this since not only
-# Code itself but also extensions will look specifically in this directory for
-# files (like the ripgrep binary or the oniguruma wasm).
-symlink_asar() {
-  symlink node_modules node_modules.asar
-}
-
 # Make a symlink at bin/$1/$3 pointing to the platform-specific version of the
 # script in $2.  The extension of the link will be .cmd for Windows otherwise it
 # will be whatever is in $4 (or no extension if $4 is not set).
@@ -145,7 +134,6 @@ vscode_install() {
     return 1
   fi
 
-  symlink_asar
   symlink_bin_script remote-cli code code-server
   symlink_bin_script helpers browser browser .sh
 

ci/build/update-repo.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+function update_helm() {
+  local current
+  current=$(yq .version ci/helm-chart/Chart.yaml)
+  local next
+  next=$(semver "$current" -i minor)
+  echo "Bumping version from $current to $next..."
+  sed -i.bak "s/^version: $current\$/version: $next/" ci/helm-chart/Chart.yaml
+
+  echo "Setting app version and image to $version..."
+  sed -i.bak "s/^appVersion: .\+\$/appVersion: $version/" ci/helm-chart/Chart.yaml
+  sed -i.bak "s/^  tag: .\+\$/  tag: '$version'/" ci/helm-chart/values.yaml
+}
+
+function update_changelog() {
+  local date
+  date=$(printf '%(%Y-%m-%d)T\n' -1)
+  local link="https://github.com/coder/code-server/releases/tag/v$version"
+  sed -i.bak "s|## Unreleased|## Unreleased\n\n## [$version]($link) - $date|" CHANGELOG.md
+}
+
+function main() {
+  cd "$(dirname "${0}")/../.."
+
+  source ./ci/lib.sh
+
+  local version=${VERSION:-$(git describe --tags)}
+  version="${version#v}"
+
+  declare -a steps
+
+  steps+=(
+    "Update Helm chart" "update_helm"
+    "Update changelog" "update_changelog"
+  )
+
+  run-steps "${steps[@]}"
+
+  # This step is always manual.
+  echo "- [ ] https://github.com/coder/code-server-aur/pulls" >> .cache/checklist
+}
+
+main "$@"

ci/build/update-vscode.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+function unapply_patches() {
+  local -i exit_code=0
+  quiet quilt pop -af || exit_code=$?
+  case $exit_code in
+    # Sucessfully unapplied.
+    0) ;;
+    # No more patches to unapply.
+    2) ;;
+    # Some error.
+    *) return $exit_code ;;
+  esac
+}
+
+function update_vscode() {
+  pushd lib/vscode
+  if ! git checkout 2>&1 "$target_vscode_version" ; then
+    echo "$target_vscode_version does not exist locally, fetching..."
+    git fetch --all --prune
+    git checkout "$target_vscode_version"
+  fi
+  popd
+}
+
+function refresh_patches() {
+  local -i exit_code=0
+  while quiet quilt push ; ! (( exit_code=$? )) ; do
+    quilt refresh
+  done
+  case $exit_code in
+    # No more patches to apply.
+    2) ;;
+    # Some error.
+    *) return $exit_code ;;
+  esac
+}
+
+function update_node() {
+  local node_version
+  node_version=$(cat .node-version)
+  if [[ $node_version == "$target_node_version" ]] ; then
+    echo "Already set to $target_node_version"
+  else
+    echo "Updating from $node_version to $target_node_version..."
+    echo "$target_node_version" > .node-version
+  fi
+}
+
+function get-webview-script-hash() {
+  local html
+  html=$(<"$1")
+  local start_tag='<script async type="module">'
+  local end_tag="</script>"
+  html=${html##*"$start_tag"}
+  html=${html%%"$end_tag"*}
+  echo -n "$html" | openssl sha256 -binary | openssl base64
+}
+
+function update_csp() {
+  local current
+  current=$(quilt top 2>/dev/null || echo "")
+  local patch_action=""
+  echo "Currently at ${current:-base}"
+  if [[ $current != */webview.diff ]] ; then
+    echo "Moving to patches/webview.diff..."
+    local -i exit_code=0
+    if quilt applied 2>/dev/null | grep --quiet webview.diff ; then
+      quiet quilt pop webview || exit_code=$?
+      patch_action=pop
+    else
+      quiet quilt push webview || exit_code=$?
+      patch_action=push
+    fi
+    case $exit_code in
+      # Successfully moved.
+      0) ;;
+      # Some error.
+      *) return $exit_code ;;
+    esac
+  fi
+
+  local file=lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
+  local hash
+  hash=$(get-webview-script-hash "$file")
+  echo "Calculated hash as $hash"
+  # Use octothorpe as a delimiter since the hash may contain a slash.
+  sed -i.bak "s#script-src 'sha256-[^']\+'#script-src 'sha256-$hash'#" "$file"
+  quilt refresh
+
+  if [[ $patch_action != "" ]] ; then
+    echo "Moving back to ${current:-base}..."
+    case $patch_action in
+      pop) quiet quilt push "$current" ;;
+      push) quiet quilt pop "${current:--a}" ;;
+    esac
+  fi
+}
+
+function add_changelog() {
+  local file=CHANGELOG.md
+  if grep --quiet "Code $target_vscode_version" "$file" ; then
+    echo "Changelog for $target_vscode_version already exists"
+  else
+    # TODO: This is not exactly robust.  In particular, it needs to handle if
+    # there is already a "changed" section.
+    sed -i.bak "s/## Unreleased/## Unreleased\n\nCode v$target_vscode_version\n\n### Changed\n\n- Update to Code $target_vscode_version/" "$file"
+  fi
+}
+
+function main() {
+  cd "$(dirname "${0}")/../.."
+
+  source ./ci/lib.sh
+
+  local target_node_version
+  target_node_version=$(grep target lib/vscode/remote/.npmrc | awk -F= '{print $2}' | tr -d '"')
+
+  declare -a steps
+
+  # If version is not set, assume we are already at the target version and the
+  # user is just trying to resolve conflics.
+  local target_vscode_version
+  if [[ ${VERSION-} ]] ; then
+    # Removing patches only needs to be done locally; in CI we start from a
+    # fresh clone each time.
+    if [[ ! ${CI-} ]] ; then
+      steps+=("Unapplying patches" "unapply_patches")
+    fi
+    target_vscode_version="${VERSION#v}"
+    steps+=(
+      "Update VS Code to $target_vscode_version" "update_vscode"
+      "Refresh VS Code patches" "refresh_patches"
+    )
+  else
+    target_vscode_version="$(git -C lib/vscode describe --tags --exact-match)"
+    echo "Detected VS Code version $target_vscode_version"
+  fi
+
+  steps+=(
+    "Set Node version to $target_node_version" "update_node"
+    "Update CSP webview hash" "update_csp"
+    "Add changelog note" "add_changelog"
+  )
+
+  run-steps "${steps[@]}"
+
+  # This step is always manual.
+  echo "- [ ] Verify changelog" >> .cache/checklist
+}
+
+main "$@"

ci/dev/gen_icons.sh

@@ -24,10 +24,20 @@ main() {
   # Generate PWA icons.  There should be enough padding to support masking.
   convert -quiet -border 60x60 -bordercolor white -background white \
           -resize 192x192 -density 192x192 \
-          favicon.svg pwa-icon-192.png
+          favicon.svg pwa-icon-maskable-192.png
   convert -quiet -border 160x160 -bordercolor white -background white \
           -resize 512x512 -density 512x512 \
-          favicon.svg pwa-icon-512.png
+          favicon.svg pwa-icon-maskable-512.png
+
+  # Generate non-maskable PWA icons.
+  magick pwa-icon-maskable-192.png \
+         \( +clone -threshold 101% -fill white -draw "roundRectangle 0,0 %[fx:int(w)],%[fx:int(h)] 50,50" \) \
+         -channel-fx "| gray=>alpha" \
+         pwa-icon-192.png
+  magick pwa-icon-maskable-512.png \
+         \( +clone -threshold 101% -fill white -draw "roundRectangle 0,0 %[fx:int(w)],%[fx:int(h)] 100,100" \) \
+         -channel-fx "| gray=>alpha" \
+         pwa-icon-512.png
 
   # The following adds dark mode support for the favicon as
   # favicon-dark-support.svg There is no similar capability for pwas or .ico so

ci/dev/test-integration.sh

@@ -2,13 +2,13 @@
 set -euo pipefail
 
 help() {
-  echo >&2 "  You can build the standalone release with 'npm run release:standalone'"
+  echo >&2 "  You can build the release with 'KEEP_MODULES=1 npm run release'"
   echo >&2 "  Or you can pass in a custom path."
   echo >&2 "  CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' npm run test:integration"
 }
 
 # Make sure a code-server release works. You can pass in the path otherwise it
-# will look for release-standalone in the current directory.
+# will look for $RELEASE_PATH in the current directory.
 #
 # This is to make sure we don't have Node version errors or any other
 # compilation-related errors.
@@ -17,7 +17,7 @@ main() {
 
   source ./ci/lib.sh
 
-  local path="$RELEASE_PATH-standalone/bin/code-server"
+  local path="$RELEASE_PATH/bin/code-server"
   if [[ ! ${CODE_SERVER_PATH-} ]]; then
     echo "Set CODE_SERVER_PATH to test another build of code-server"
   else

ci/dev/test-native.sh

@@ -2,13 +2,13 @@
 set -euo pipefail
 
 help() {
-  echo >&2 "  You can build the standalone release with 'npm run release:standalone'"
+  echo >&2 "  You can build the release with 'KEEP_MODULES=1 npm run release'"
   echo >&2 "  Or you can pass in a custom path."
   echo >&2 "  CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' npm run test:integration"
 }
 
 # Make sure a code-server release works. You can pass in the path otherwise it
-# will look for release-standalone in the current directory.
+# will look for $RELEASE_PATH in the current directory.
 #
 # This is to make sure we don't have Node version errors or any other
 # compilation-related errors.
@@ -17,7 +17,7 @@ main() {
 
   source ./ci/lib.sh
 
-  local path="$RELEASE_PATH-standalone/bin/code-server"
+  local path="$RELEASE_PATH/bin/code-server"
   if [[ ! ${CODE_SERVER_PATH-} ]]; then
     echo "Set CODE_SERVER_PATH to test another build of code-server"
   else

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.28.0
+version: 3.35.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.101.1
+appVersion: 4.116.0

ci/helm-chart/templates/deployment.yaml

@@ -3,23 +3,23 @@ kind: Deployment
 metadata:
   name: {{ include "code-server.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
+  {{- if .Values.annotations }}
+  annotations: {{- toYaml .Values.annotations | nindent 4 }}
+  {{- end }}
 spec:
-  replicas: {{ .Values.replicaCount | default 1 }}
+  {{- if ne .Values.replicaCount nil }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "code-server.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- include "code-server.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ include "code-server.name" . }}
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- include "code-server.selectorLabels" . | nindent 8 }}
       {{- if .Values.podAnnotations }}
       annotations: {{- toYaml .Values.podAnnotations | nindent 8 }}
       {{- end }}
@@ -125,14 +125,18 @@ spec:
               containerPort: {{ .port }}
               protocol: {{ .protocol }}
           {{- end }}
+          {{- if ne .Values.livenessProbe.enabled false }}
           livenessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
+          {{- end }}
+          {{- if ne .Values.readinessProbe.enabled false }}
           readinessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
+          {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}

ci/helm-chart/templates/pvc.yaml

@@ -9,10 +9,7 @@ metadata:
 {{ toYaml . | indent 4 }}
 {{- end }}
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
 spec:
   accessModes:
     - {{ .Values.persistence.accessMode | quote }}

ci/helm-chart/templates/secrets.yaml

@@ -6,10 +6,7 @@ metadata:
   annotations:
     "helm.sh/hook": "pre-install"
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
 type: Opaque
 data:
   {{- if .Values.password }}

ci/helm-chart/templates/service.yaml

@@ -3,10 +3,7 @@ kind: Service
 metadata:
   name: {{ include "code-server.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.service.type }}
   ports:

ci/helm-chart/templates/serviceaccount.yaml

@@ -3,9 +3,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
   name: {{ template "code-server.serviceAccountName" . }}
 {{- end -}}

ci/helm-chart/templates/tests/test-connection.yaml

@@ -3,16 +3,13 @@ kind: Pod
 metadata:
   name: "{{ include "code-server.fullname" . }}-test-connection"
   labels:
-    app.kubernetes.io/name: {{ include "code-server.name" . }}
-    helm.sh/chart: {{ include "code-server.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "code-server.labels" . | nindent 4 }}
   annotations:
-    "helm.sh/hook": test-success
+    "helm.sh/hook": test
 spec:
   containers:
     - name: wget
       image: busybox
       command: ['wget']
-      args:  ['{{ include "code-server.fullname" . }}:{{ .Values.service.port }}']
+      args:  ['{{ include "code-server.fullname" . }}:{{ .Values.service.port }}/healthz']
   restartPolicy: Never

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.101.1'
+  tag: '4.116.0'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a
@@ -31,6 +31,9 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name: ""
 
+# Specifies annotations for deployment
+annotations: {}
+
 podAnnotations: {}
 
 podSecurityContext: {}
@@ -75,8 +78,9 @@ extraArgs: []
 extraVars: []
 #  - name: DISABLE_TELEMETRY
 #    value: "true"
+# if dind is desired:
 #  - name: DOCKER_HOST
-#    value: "tcp://localhost:2375"
+#    value: "tcp://localhost:2376"
 
 ##
 ## Init containers parameters:
@@ -107,6 +111,12 @@ resources: {}
   #  cpu: 100m
   #  memory: 1000Mi
 
+livenessProbe:
+  enabled: true
+
+readinessProbe:
+  enabled: true
+
 nodeSelector: {}
 
 tolerations: []
@@ -139,25 +149,39 @@ lifecycle:
   #      - -c
   #      - curl -s -L SOME_SCRIPT | bash
 
+  # for dind, the following may be helpful
+  # postStart:
+  #   exec:
+  #     command:
+  #       - /bin/sh
+  #       - -c
+  #       - |
+  #         sudo apt-get update \
+  #           && sudo apt-get install -y docker.io
+
 ## Enable an Specify container in extraContainers.
 ## This is meant to allow adding code-server dependencies, like docker-dind.
 extraContainers: |
 # If docker-dind is used, DOCKER_HOST env is mandatory to set in "extraVars"
-#- name: docker-dind
-#  image: docker:19.03-dind
-#  imagePullPolicy: IfNotPresent
-#  resources:
-#    requests:
-#      cpu: 250m
-#      memory: 256M
-#  securityContext:
-#    privileged: true
-#    procMount: Default
-#  env:
-#  - name: DOCKER_TLS_CERTDIR
-#    value: ""
-#  - name: DOCKER_DRIVER
-#    value: "overlay2"
+# - name: docker-dind
+#   image: docker:28.3.2-dind
+#   imagePullPolicy: IfNotPresent
+#   resources:
+#     requests:
+#       cpu: 1
+#       ephemeral-storage: "50Gi"
+#       memory: 10Gi
+#   securityContext:
+#     privileged: true
+#     procMount: Default
+#   env:
+#     - name: DOCKER_TLS_CERTDIR
+#       value: "" # disable TLS setup
+#   command:
+#     - dockerd
+#     - --host=unix:///var/run/docker.sock
+#     - --host=tcp://0.0.0.0:2376
+
 
 extraInitContainers: |
 # - name: customization

ci/lib.sh

@@ -44,11 +44,78 @@ rsync() {
   command rsync -a --del "$@"
 }
 
-ARCH="$(arch)"
-export ARCH
-OS=$(os)
-export OS
+if [[ ! ${ARCH-} ]]; then
+  ARCH=$(arch)
+  export ARCH
+fi
+
+if [[ ! ${OS-} ]]; then
+  OS=$(os)
+  export OS
+fi
 
 # RELEASE_PATH is the destination directory for the release from the root.
 # Defaults to release
-RELEASE_PATH="${RELEASE_PATH-release}"
+if [[ ! ${RELEASE_PATH-} ]]; then
+  RELEASE_PATH="release"
+  export RELEASE_PATH
+fi
+
+nodeOS() {
+  osname=$OS
+  case $osname in
+    macos) osname=darwin ;;
+    windows) osname=win32 ;;
+  esac
+  echo "$osname"
+}
+
+nodeArch() {
+  cpu=$ARCH
+  case $cpu in
+    amd64) cpu=x64 ;;
+  esac
+  echo "$cpu"
+}
+
+run-steps() {
+  local -i failed=0
+  rm -f .cache/checklist
+  while (( $# )) ; do
+    local name=$1 ; shift
+    local fn=$1 ; shift
+    # Only run if an earlier step has not failed.
+    if [[ $failed == 0 ]] ; then
+      echo "$name..."
+      if $fn | indent ; then
+        echo "- [X] $name" >> .cache/checklist
+      else
+        ((failed++))
+      fi
+    fi
+    # For all failed steps, write out an empty checkbox.
+    if [[ $failed != 0 ]] ; then
+      echo "- [ ] $name" >> .cache/checklist
+    fi
+  done
+  if [[ $failed != 0 ]] ; then
+    return 1
+  fi
+}
+
+quiet() {
+  "$@" >/dev/null
+}
+
+indent() {
+  local count=2
+  local space
+  space=$(printf "%${count}s")
+  sed "s/^/$space| /g"
+}
+
+# See gulpfile.reh.ts for available targets.
+if [[ ! ${VSCODE_TARGET-} ]]; then
+  VSCODE_TARGET="$(nodeOS)-$(nodeArch)"
+  export VSCODE_TARGET
+fi

ci/release-image/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:experimental
 
-ARG BASE=debian:12
+ARG BASE=debian:13
 FROM scratch AS packages
 COPY release-packages/code-server*.deb /tmp/
 

ci/release-image/docker-bake.hcl

@@ -16,9 +16,11 @@ variable "GITHUB_REGISTRY" {
 
 group "default" {
     targets = [
+        "code-server-debian-13",
         "code-server-debian-12",
         "code-server-ubuntu-focal",
         "code-server-ubuntu-noble",
+        "code-server-ubuntu-resolute",
         "code-server-fedora-39",
         "code-server-opensuse-tumbleweed",
     ]
@@ -48,20 +50,30 @@ function "gen_tags_for_docker_and_ghcr" {
     )
 }
 
-target "code-server-debian-12" {
+target "code-server-debian-13" {
     dockerfile = "ci/release-image/Dockerfile"
     tags = concat(
         gen_tags_for_docker_and_ghcr(""),
         gen_tags_for_docker_and_ghcr("debian"),
+        gen_tags_for_docker_and_ghcr("trixie"),
+    )
+    platforms = ["linux/amd64", "linux/arm64"]
+}
+
+target "code-server-debian-12" {
+    dockerfile = "ci/release-image/Dockerfile"
+    tags = concat(
         gen_tags_for_docker_and_ghcr("bookworm"),
     )
+    args = {
+        BASE = "debian:12"
+    }
     platforms = ["linux/amd64", "linux/arm64"]
 }
 
 target "code-server-ubuntu-focal" {
     dockerfile = "ci/release-image/Dockerfile"
     tags = concat(
-        gen_tags_for_docker_and_ghcr("ubuntu"),
         gen_tags_for_docker_and_ghcr("focal"),
     )
     args = {
@@ -74,6 +86,7 @@ target "code-server-ubuntu-noble" {
     dockerfile = "ci/release-image/Dockerfile"
     tags = concat(
         gen_tags_for_docker_and_ghcr("noble"),
+        gen_tags_for_docker_and_ghcr("ubuntu"),
     )
     args = {
         BASE = "ubuntu:noble"
@@ -81,6 +94,17 @@ target "code-server-ubuntu-noble" {
     platforms = ["linux/amd64", "linux/arm64"]
 }
 
+target "code-server-ubuntu-resolute" {
+    dockerfile = "ci/release-image/Dockerfile"
+    tags = concat(
+        gen_tags_for_docker_and_ghcr("resolute"),
+    )
+    args = {
+        BASE = "ubuntu:resolute"
+    }
+    platforms = ["linux/amd64", "linux/arm64"]
+}
+
 target "code-server-fedora-39" {
     dockerfile = "ci/release-image/Dockerfile.fedora"
     tags = concat(

ci/steps/brew-bump.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-main() {
-  # Only sourcing this so we get access to $VERSION
-  source ./ci/lib.sh
-  source ./ci/steps/steps-lib.sh
-
-  echo "Checking environment variables"
-
-  # We need VERSION to bump the brew formula
-  if ! is_env_var_set "VERSION"; then
-    echo "VERSION is not set"
-    exit 1
-  fi
-
-  # We need HOMEBREW_GITHUB_API_TOKEN to push up commits
-  if ! is_env_var_set "HOMEBREW_GITHUB_API_TOKEN"; then
-    echo "HOMEBREW_GITHUB_API_TOKEN is not set"
-    exit 1
-  fi
-
-  # Find the docs for bump-formula-pr here
-  # https://github.com/Homebrew/brew/blob/master/Library/Homebrew/dev-cmd/bump-formula-pr.rb#L18
-  local output
-  if ! output=$(brew bump-formula-pr --version="${VERSION}" code-server --no-browse --no-audit --message="PR opened by @${GITHUB_ACTOR}" 2>&1); then
-    if [[ $output == *"Duplicate PRs should not be opened"* ]]; then
-      echo "$VERSION is already submitted"
-      exit 0
-    else
-      echo "$output"
-      exit 1
-    fi
-  fi
-}
-
-main "$@"

ci/steps/publish-npm.sh

@@ -1,149 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-main() {
-  cd "$(dirname "$0")/../.."
-  source ./ci/lib.sh
-  source ./ci/steps/steps-lib.sh
-
-  ## Authentication tokens
-  # Needed to publish on NPM
-  if ! is_env_var_set "NPM_TOKEN"; then
-    echo "NPM_TOKEN is not set. Cannot publish to npm without credentials."
-    exit 1
-  fi
-
-  ## Publishing Information
-  # All the variables below are used to determine how we should publish
-  # the npm package. We also use this information for bumping the version.
-  # This is because npm won't publish your package unless it's a new version.
-  # i.e. for development, we bump the version to <current version>-<pr number>-<commit sha>
-  # example: "version": "4.0.1-4769-ad7b23cfe6ffd72914e34781ef7721b129a23040"
-  # We use this to grab the PR_NUMBER
-  if ! is_env_var_set "GITHUB_REF"; then
-    echo "GITHUB_REF is not set. Are you running this locally? We rely on values provided by GitHub."
-    exit 1
-  fi
-
-  # We use this when setting NPM_VERSION
-  if ! is_env_var_set "GITHUB_SHA"; then
-    echo "GITHUB_SHA is not set. Are you running this locally? We rely on values provided by GitHub."
-    exit 1
-  fi
-
-  # We use this to determine the NPM_ENVIRONMENT
-  if ! is_env_var_set "GITHUB_EVENT_NAME"; then
-    echo "GITHUB_EVENT_NAME is not set. Are you running this locally? We rely on values provided by GitHub."
-    exit 1
-  fi
-
-  # Check that we're using at least v7 of npm CLI
-  if ! command -v jq &> /dev/null; then
-    echo "Couldn't find jq"
-    echo "We need this in order to modify the package.json for dev builds."
-    exit 1
-  fi
-
-  # This allows us to publish to npm in CI workflows
-  if [[ ${CI-} ]]; then
-    echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-  fi
-
-  ## Environment
-  # This string is used to determine how we should tag the npm release.
-  # Environment can be one of three choices:
-  # "development" - this means we tag with the PR number, allowing
-  # a developer to install this version with `npm install code-server@<pr-number>`
-  # "staging" - this means we tag with `beta`, allowing
-  # a developer to install this version with `npm install code-server@beta`
-  # "production" - this means we tag with `latest` (default), allowing
-  # a developer to install this version with `npm install code-server@latest`
-  if ! is_env_var_set "NPM_ENVIRONMENT"; then
-    echo "NPM_ENVIRONMENT is not set."
-    echo "Determining in script based on GITHUB environment variables."
-
-    if [[ "$GITHUB_EVENT_NAME" == 'push' && "$GITHUB_REF" == 'refs/heads/main' ]]; then
-      NPM_ENVIRONMENT="staging"
-    else
-      NPM_ENVIRONMENT="development"
-    fi
-
-  fi
-
-  # NOTE@jsjoeio - this script assumes we have the artifact downloaded on disk
-  # That happens in CI as a step before we run this.
-  # https://github.com/actions/upload-artifact/issues/38
-  tar -xzf release-npm-package/package.tar.gz
-
-  # We use this to set the name of the package in the
-  # package.json
-  PACKAGE_NAME="code-server"
-
-  # NOTES:@jsjoeio
-  # We only need to run npm version for "development" and "staging".
-  # This is because our release:prep script automatically bumps the version
-  # in the package.json and we commit it as part of the release PR.
-  if [[ "$NPM_ENVIRONMENT" == "production" ]]; then
-    NPM_VERSION="$VERSION"
-    # This means the npm version will be published as "stable"
-    # and installed when a user runs `npm install code-server`
-    NPM_TAG="latest"
-  else
-    COMMIT_SHA="$GITHUB_SHA"
-
-    if [[ "$NPM_ENVIRONMENT" == "staging" ]]; then
-      NPM_VERSION="$VERSION-beta-$COMMIT_SHA"
-      # This means the npm version will be tagged with "beta"
-      # and installed when a user runs `npm install code-server@beta`
-      NPM_TAG="beta"
-      PACKAGE_NAME="@coder/code-server-pr"
-    fi
-
-    if [[ "$NPM_ENVIRONMENT" == "development" ]]; then
-      # Source: https://github.com/actions/checkout/issues/58#issuecomment-614041550
-      PR_NUMBER=$(echo "$GITHUB_REF" | awk 'BEGIN { FS = "/" } ; { print $3 }')
-      NPM_VERSION="$VERSION-$PR_NUMBER-$COMMIT_SHA"
-      PACKAGE_NAME="@coder/code-server-pr"
-      # This means the npm version will be tagged with "<pr number>"
-      # and installed when a user runs `npm install code-server@<pr number>`
-      NPM_TAG="$PR_NUMBER"
-    fi
-
-    echo "- tag: $NPM_TAG"
-    echo "- version: $NPM_VERSION"
-    echo "- package name: $PACKAGE_NAME"
-    echo "- npm environment: $NPM_ENVIRONMENT"
-
-    # We modify the version in the package.json
-    # to be the current version + the PR number + commit SHA
-    # or we use current version + beta + commit SHA
-    # Example: "version": "4.0.1-4769-ad7b23cfe6ffd72914e34781ef7721b129a23040"
-    # Example: "version": "4.0.1-beta-ad7b23cfe6ffd72914e34781ef7721b129a23040"
-    pushd release
-    npm version "$NPM_VERSION"
-    # Use the development package name
-    # This is so we don't clutter the code-server versions on npm
-    # with development versions.
-    # jq can't edit in place so we must store in memory and echo
-    local contents
-    contents="$(jq ".name |= \"$PACKAGE_NAME\"" package.json)"
-    echo "${contents}" > package.json
-    popd
-  fi
-
-  # We need to make sure we haven't already published the version.
-  # If we get error, continue with script because we want to publish
-  # If version is valid, we check if we're publishing the same one
-  local hasVersion
-  if hasVersion=$(npm view "$PACKAGE_NAME@$NPM_VERSION" version 2> /dev/null) && [[ $hasVersion == "$NPM_VERSION" ]]; then
-    echo "$NPM_VERSION is already published under $PACKAGE_NAME"
-    return
-  fi
-
-  # Since the dev builds are scoped to @coder
-  # We pass --access public to ensure npm knows it's not private.
-  cd release
-  npm publish --tag "$NPM_TAG" --access public
-}
-
-main "$@"

docs/CONTRIBUTING.md

@@ -9,7 +9,6 @@
   - [Version updates to Code](#version-updates-to-code)
   - [Patching Code](#patching-code)
   - [Build](#build)
-    - [Creating a Standalone Release](#creating-a-standalone-release)
   - [Troubleshooting](#troubleshooting)
     - [I see "Forbidden access" when I load code-server in the browser](#i-see-forbidden-access-when-i-load-code-server-in-the-browser)
     - ["Can only have one anonymous define call per script"](#can-only-have-one-anonymous-define-call-per-script)
@@ -94,17 +93,20 @@ commits first if you are doing this).
 
 ### Version updates to Code
 
-1. Remove any patches with `quilt pop -a`.
-2. Update the `lib/vscode` submodule to the desired upstream version branch.
-   1. `cd lib/vscode && git checkout release/1.66 && cd ../..`
-   2. `git add lib && git commit -m "chore: update to Code <version>"`
-3. Apply the patches one at a time (`quilt push`). If the application succeeds
-   but the lines changed, update the patch with `quilt refresh`. If there are
-   conflicts, then force apply with `quilt push -f`, manually add back the
-   rejected code, then run `quilt refresh`.
-4. From the code-server **project root**, run `npm install`.
-5. Check the Node.js version that's used by Electron (which is shipped with VS
-   Code. If necessary, update our version of Node.js to match.
+PRs will be automatically created with updates to VS Code. If a patch cannot be
+automatically resolved, it will be necessary to clone the branch, resolve the
+conflicts manually, and finish the update. To do this:
+
+1. Apply as many patches as possible `quilt push -a`.
+2. Once you hit a conflict, force apply with `quilt push -f`, manually add back
+   the rejected code, then run `quilt refresh`.
+3. Once all patches have been resolved, run `./ci/build/update.sh` to finish the
+   update process.
+4. Commit all changes, push them up to the branch, and update the checklist in
+   the PR description.
+
+Once the PR is ready, manually verify that the unreleased changelog section
+contains all the changes going into this version before merging.
 
 ### Patching Code
 
@@ -122,7 +124,7 @@ commits first if you are doing this).
 
 ### Build
 
-You can build a full production as follows:
+You can build a full production release as follows:
 
 ```shell
 git submodule update --init
@@ -130,26 +132,32 @@ quilt push -a
 npm install
 npm run build
 VERSION=0.0.0 npm run build:vscode
-npm run release
+KEEP_MODULES=1 npm run release
 ```
 
-This does not keep `node_modules`. If you want them to be kept, use
-`KEEP_MODULES=1 npm run release`
+You can omit `KEEP_MODULES` if you intend to use this in a platform-agnostic way
+(like for publishing to NPM), but since the VS Code build process does
+post-processing deletion of the modules, it is recommended to keep the modules
+when possible, since if you install them later you will have more than is
+required. `KEEP_MODULES` will also bundle Node and the code-server entry script.
 
 Run your build:
 
+```shell
+./release/bin/code-server
+```
+
+Or if you omitted `KEEP_MODULES`:
+
 ```shell
 cd release
-npm install --omit=dev # Skip if you used KEEP_MODULES=1
-# Runs the built JavaScript with Node.
+npm install --omit=dev
 node .
 ```
 
-Then, to build the release package:
+Then, to package the release:
 
 ```shell
-npm run release:standalone
-npm run test:integration
 npm run package
 ```
 
@@ -158,22 +166,6 @@ npm run package
 > If you need your builds to support older distros, run the build commands
 > inside a Docker container with all the build requirements installed.
 
-#### Creating a Standalone Release
-
-Part of the build process involves creating standalone releases. At the time of
-writing, we do this for the following platforms/architectures:
-
-- Linux amd64 (.tar.gz, .deb, and .rpm)
-- Linux arm64 (.tar.gz, .deb, and .rpm)
-- Linux arm7l (.tar.gz)
-- Linux armhf.deb
-- Linux armhf.rpm
-- macOS arm64.tar.gz
-
-Currently, these are compiled in CI using the `npm run release:standalone`
-command in the `release.yaml` workflow. We then upload them to the draft release
-and distribute via GitHub Releases.
-
 ### Troubleshooting
 
 #### I see "Forbidden access" when I load code-server in the browser

docs/FAQ.md

@@ -22,6 +22,7 @@
 - [How do I debug issues with code-server?](#how-do-i-debug-issues-with-code-server)
 - [What is the healthz endpoint?](#what-is-the-healthz-endpoint)
 - [What is the heartbeat file?](#what-is-the-heartbeat-file)
+- [How do I change the reconnection grace time?](#how-do-i-change-the-reconnection-grace-time)
 - [How do I change the password?](#how-do-i-change-the-password)
 - [Can I store my password hashed?](#can-i-store-my-password-hashed)
 - [Is multi-tenancy possible?](#is-multi-tenancy-possible)
@@ -31,6 +32,7 @@
 - [What's the difference between code-server and Theia?](#whats-the-difference-between-code-server-and-theia)
 - [What's the difference between code-server and OpenVSCode-Server?](#whats-the-difference-between-code-server-and-openvscode-server)
 - [What's the difference between code-server and GitHub Codespaces?](#whats-the-difference-between-code-server-and-github-codespaces)
+- [What's the difference between code-server and VS Code web?](#whats-the-difference-between-code-server-and-vs-code-web)
 - [Does code-server have any security login validation?](#does-code-server-have-any-security-login-validation)
 - [Are there community projects involving code-server?](#are-there-community-projects-involving-code-server)
 - [How do I change the port?](#how-do-i-change-the-port)
@@ -322,12 +324,18 @@ As long as there is an active browser connection, code-server touches
 `~/.local/share/code-server/heartbeat` once a minute.
 
 If you want to shutdown code-server if there hasn't been an active connection
-after a predetermined amount of time, you can do so by checking continuously for
-the last modified time on the heartbeat file. If it is older than X minutes (or
-whatever amount of time you'd like), you can kill code-server.
+after a predetermined amount of time, you can use the --idle-timeout-seconds flag
+or set an `CODE_SERVER_IDLE_TIMEOUT_SECONDS` environment variable.
 
-Eventually, [#1636](https://github.com/coder/code-server/issues/1636) will make
-this process better.
+## How do I change the reconnection grace time?
+
+Pass `--reconnection-grace-time <seconds>` to `code-server`, set
+`CODE_SERVER_RECONNECTION_GRACE_TIME=<seconds>`, or add
+`reconnection-grace-time: <seconds>` to
+`~/.config/code-server/config.yaml`.
+
+The default is `10800` (3 hours). If a client stays disconnected longer than
+this, it must reload the window.
 
 ## How do I change the password?
 
@@ -383,6 +391,9 @@ mount into `/home/coder/myproject` from inside the `code-server` container. You
 need to make sure the Docker daemon's `/home/coder/myproject` is the same as the
 one mounted inside the `code-server` container, and the mount will work.
 
+If you want Docker enabled when deploying on Kubernetes, look at the `values.yaml`
+file for the 3 fields: `extraVars`, `lifecycle.postStart`, and `extraContainers`.
+
 ## How do I disable telemetry?
 
 Use the `--disable-telemetry` flag to disable telemetry.
@@ -440,6 +451,8 @@ Specific changes include:
 - The ability to use your own marketplace and collect your own telemetry
 - Built-in proxy for accessing ports on the remote machine integrated into
   VS Code's ports panel
+- Settings are stored on disk like desktop VS Code, instead of in browser
+  storage (note that state is still stored in browser storage).
 - Wrapper process that spawns VS Code on-demand and has a separate CLI
 - Notification when updates are available
 - [Some other things](https://github.com/coder/code-server/tree/main/patches)
@@ -448,6 +461,12 @@ Some of these changes appear very unlikely to ever be adopted by Microsoft.
 Some may make their way upstream, further closing the gap, but at the moment it
 looks like there will always be some subtle differences.
 
+## What's the difference between code-server and VS Code web?
+
+VS Code web (which can be ran using `code serve-web`) has the same differences
+as the Codespaces section above. VS Code web can be a better choice if you need
+access to the official Microsoft marketplace.
+
 ## Does code-server have any security login validation?
 
 code-server supports setting a single password and limits logins to two per

docs/MAINTAINING.md

@@ -7,7 +7,6 @@
     - [Release Candidates](#release-candidates)
     - [AUR](#aur)
     - [Docker](#docker)
-    - [Homebrew](#homebrew)
     - [nixpkgs](#nixpkgs)
     - [npm](#npm)
 - [Testing](#testing)
@@ -27,20 +26,18 @@ Most of the work is keeping on top of issues and discussions.
 
 1. Check that the changelog lists all the important changes.
 2. Make sure the changelog entry lists the current version of VS Code.
-3. Update the changelog with the release date.
-4. Go to GitHub Actions > Draft release > Run workflow on the commit you want to
-   release. Make sure CI has finished the build workflow on that commit or this
-   will fail. For the version we match VS Code's minor and patch version. The
+3. Go to GitHub Actions > Draft release > Run workflow on the commit you want to
+   release. For the version we match VS Code's minor and patch version. The
    patch number may become temporarily out of sync if we need to put out a
    patch, but if we make our own minor change then we will not release it until
    the next minor VS Code release.
-5. CI will automatically grab the build artifact on that commit (which is why CI
-   has to have completed), inject the provided version into the `package.json`,
-   put together platform-specific packages, and upload those packages to a draft
-   release.
-6. Update the resulting draft release with the changelog contents.
-7. Publish the draft release after validating it.
-8. Bump the Helm chart version once the Docker images have published.
+4. CI will build an NPM package and platform-specific packages, and upload those
+   to a draft release.
+5. Update the resulting draft release with the changelog contents.
+6. Publish the draft release after validating it.
+7. Update the changelog with the release date and bump the Helm chart version
+   once the Docker images have published.
+8. Merge the PR submitted to coder/code-server-aur repo.
 
 #### Release Candidates
 
@@ -55,38 +52,34 @@ full-blown release. To do this follow the same steps as above but:
 
 #### AUR
 
-We publish to AUR as a package [here](https://aur.archlinux.org/packages/code-server/). This process is manual and can be done by following the steps in [this repo](https://github.com/coder/code-server-aur).
+We publish to AUR as a package
+[here](https://aur.archlinux.org/packages/code-server/). This process is manual
+and can be done by following the steps in [this
+repo](https://github.com/coder/code-server-aur).
 
 #### Docker
 
-We publish code-server as a Docker image [here](https://hub.docker.com/r/codercom/code-server), tagging it both with the version and latest.
+We publish code-server as a Docker image
+[here](https://hub.docker.com/r/codercom/code-server), tagging it both with the
+version and latest.
 
 This is currently automated with the release process.
 
-#### Homebrew
-
-We publish code-server on Homebrew [here](https://github.com/Homebrew/homebrew-core/blob/master/Formula/code-server.rb).
-
-This is currently automated with the release process (but may fail occasionally). If it does, run this locally:
-
-```shell
-# Replace VERSION with version
-brew bump-formula-pr --version="${VERSION}" code-server --no-browse --no-audit
-```
-
 #### nixpkgs
 
 We publish code-server in nixpkgs but it must be updated manually.
 
 #### npm
 
-We publish code-server as a npm package [here](https://www.npmjs.com/package/code-server/v/latest).
+We publish code-server as a npm package
+[here](https://www.npmjs.com/package/code-server/v/latest).
 
 This is currently automated with the release process.
 
 ## Testing
 
-Our testing structure is laid out under our [Contributing docs](https://coder.com/docs/code-server/latest/CONTRIBUTING#test).
+Our testing structure is laid out under our [Contributing
+docs](https://coder.com/docs/code-server/latest/CONTRIBUTING#test).
 
 If you're ever looking to add more tests, here are a few ways to get started:
 

docs/README.md

@@ -1,6 +1,6 @@
 # code-server
 
-[!["GitHub Discussions"](https://img.shields.io/badge/%20GitHub-%20Discussions-gray.svg?longCache=true&logo=github&colorB=purple)](https://github.com/coder/code-server/discussions) [!["Join us on Slack"](https://img.shields.io/badge/join-us%20on%20slack-gray.svg?longCache=true&logo=slack&colorB=brightgreen)](https://coder.com/community) [![Twitter Follow](https://img.shields.io/twitter/follow/CoderHQ?label=%40CoderHQ&style=social)](https://twitter.com/coderhq) [![codecov](https://codecov.io/gh/coder/code-server/branch/main/graph/badge.svg?token=5iM9farjnC)](https://codecov.io/gh/coder/code-server) [![See latest](https://img.shields.io/static/v1?label=Docs&message=see%20latest&color=blue)](https://coder.com/docs/code-server/latest)
+[!["GitHub Discussions"](https://img.shields.io/badge/%20GitHub-%20Discussions-gray.svg?longCache=true&logo=github&colorB=purple)](https://github.com/coder/code-server/discussions) [!["Join us on Slack"](https://img.shields.io/badge/join-us%20on%20slack-gray.svg?longCache=true&logo=slack&colorB=brightgreen)](https://coder.com/community) [![Twitter Follow](https://img.shields.io/twitter/follow/CoderHQ?label=%40CoderHQ&style=social)](https://twitter.com/coderhq) [![Discord](https://img.shields.io/discord/747933592273027093)](https://discord.com/invite/coder) [![codecov](https://codecov.io/gh/coder/code-server/branch/main/graph/badge.svg?token=5iM9farjnC)](https://codecov.io/gh/coder/code-server) [![See latest](https://img.shields.io/static/v1?label=Docs&message=see%20latest&color=blue)](https://coder.com/docs/code-server/latest)
 
 Run [VS Code](https://github.com/Microsoft/vscode) on any machine anywhere and
 access it in the browser.

docs/android.md

@@ -14,8 +14,8 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
 7. Install and use Node.js 22:
 
 ```shell
-nvm install 18
-nvm use 18
+nvm install 22
+nvm use 22
 ```
 
 8. Install code-server globally on device with: `npm install --global code-server`

docs/coder.md

@@ -33,7 +33,7 @@ resource "coder_app" "code-server" {
 }
 ```
 
-Or use our official [`code-server`](https://registry.coder.com/modules/code-server) module from the Coder [module registry](htpps://registry.coder.com/modules):
+Or use our official [`code-server`](https://registry.coder.com/modules/code-server) module from the Coder [module registry](https://registry.coder.com/modules):
 
 ```terraform
 module "code-server" {

docs/guide.md

@@ -22,6 +22,9 @@
   - [Proxying to a Svelte app](#proxying-to-a-svelte-app)
   - [Prefixing `/absproxy/<port>` with a path](#prefixing-absproxyport-with-a-path)
   - [Preflight requests](#preflight-requests)
+- [Internationalization and customization](#internationalization-and-customization)
+  - [Available keys and placeholders](#available-keys-and-placeholders)
+  - [Legacy flag](#legacy-flag)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 <!-- prettier-ignore-end -->
@@ -458,3 +461,52 @@ By default, if you have auth enabled, code-server will authenticate all proxied
 requests including preflight requests. This can cause issues because preflight
 requests do not typically include credentials. To allow all preflight requests
 through the proxy without authentication, use `--skip-auth-preflight`.
+
+## Internationalization and customization
+
+code-server allows you to provide a JSON file to configure certain strings. This
+can be used for both internationalization and customization.
+
+Create a JSON file with your custom strings:
+
+```json
+{
+  "WELCOME": "Welcome to {{app}}",
+  "LOGIN_TITLE": "{{app}} Access Portal",
+  "LOGIN_BELOW": "Please log in to continue",
+  "PASSWORD_PLACEHOLDER": "Enter Password"
+}
+```
+
+Then reference the file:
+
+```shell
+code-server --i18n /path/to/custom-strings.json
+```
+
+Or this can be done in the config file:
+
+```yaml
+i18n: /path/to/custom-strings.json
+```
+
+You can combine this with the `--locale` flag to configure language support for
+both code-server and VS Code in cases where code-server has no support but VS
+Code does. If you are using this for internationalization, please consider
+sending us a pull request to contribute it to `src/node/i18n/locales`.
+
+### Available keys and placeholders
+
+Refer to [../src/node/i18n/locales/en.json](../src/node/i18n/locales/en.json)
+for a full list of the available keys for translations. Note that the only
+placeholders supported for each key are the ones used in the default string.
+
+The `--app-name` flag controls the `{{app}}` placeholder in templates. If you
+want to change the name, you can either:
+
+1. Set `--app-name` (potentially alongside `--i18n`)
+2. Use `--i18n` and hardcode the name in your strings
+
+### Legacy flag
+
+The `--welcome-text` flag is now deprecated. Use the `WELCOME` key instead.

docs/install.md

@@ -82,13 +82,11 @@ _exact_ same commands presented in the rest of this document.
 - For Arch Linux, code-server will install the AUR package.
 - For any unrecognized Linux operating system, code-server will install the
   latest standalone release into `~/.local`.
-
   - Ensure that you add `~/.local/bin` to your `$PATH` to run code-server.
 
 - For macOS, code-server will install the Homebrew package (if you don't have
   Homebrew installed, code-server will install the latest standalone release
   into `~/.local`).
-
   - Ensure that you add `~/.local/bin` to your `$PATH` to run code-server.
 
 - For FreeBSD, code-server will install the [npm package](#npm) with `npm`

package.json

@@ -14,7 +14,6 @@
     "build:vscode": "./ci/build/build-vscode.sh",
     "doctoc": "./ci/dev/doctoc.sh",
     "release": "./ci/build/build-release.sh",
-    "release:standalone": "./ci/build/build-standalone-release.sh",
     "release:prep": "./ci/build/release-prep.sh",
     "test:e2e": "VSCODE_IPC_HOOK_CLI= ./ci/dev/test-e2e.sh",
     "test:e2e:proxy": "USE_PROXY=1 ./ci/dev/test-e2e.sh",
@@ -56,34 +55,33 @@
     "@types/ws": "^8.5.5",
     "doctoc": "^2.2.1",
     "eslint": "^9.12.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-import-resolver-typescript": "^3.6.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.28.1",
     "eslint-plugin-prettier": "^5.0.0",
     "globals": "^16.1.0",
-    "prettier": "3.4.2",
-    "prettier-plugin-sh": "^0.14.0",
+    "prettier": "3.6.2",
+    "prettier-plugin-sh": "^0.18.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.6.2",
     "typescript-eslint": "^8.8.0"
   },
   "dependencies": {
     "@coder/logger": "^3.0.1",
-    "argon2": "^0.31.1",
+    "argon2": "^0.44.0",
     "compression": "^1.7.4",
     "cookie-parser": "^1.4.6",
     "env-paths": "^2.2.1",
     "express": "^5.0.1",
     "http-proxy": "^1.18.1",
     "httpolyglot": "^0.1.2",
-    "i18next": "^23.5.1",
+    "i18next": "^25.8.3",
     "js-yaml": "^4.1.0",
     "limiter": "^2.1.0",
     "pem": "^1.14.8",
     "proxy-agent": "^6.3.1",
-    "qs": "6.14.0",
+    "qs": "^6.15.0",
     "rotating-file-stream": "^3.1.1",
-    "safe-buffer": "^5.2.1",
     "safe-compare": "^1.1.4",
     "semver": "^7.5.4",
     "ws": "^8.14.2",

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -220,7 +220,9 @@ class RemoteAuthoritiesImpl {
+@@ -245,7 +245,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,
@@ -99,19 +99,19 @@ Index: code-server/lib/vscode/src/vs/platform/remote/browser/browserSocketFactor
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
 +++ code-server/lib/vscode/src/vs/platform/remote/browser/browserSocketFactory.ts
-@@ -281,6 +281,7 @@ export class BrowserSocketFactory implem
+@@ -282,6 +282,7 @@ export class BrowserSocketFactory implem
  	connect({ host, port }: WebSocketRemoteConnection, path: string, query: string, debugLabel: string): Promise<ISocket> {
  		return new Promise<ISocket>((resolve, reject) => {
  			const webSocketSchema = (/^https:/.test(mainWindow.location.href) ? 'wss' : 'ws');
 +			path = (mainWindow.location.pathname + "/" + path).replace(/\/\/+/g, "/")
  			const socket = this._webSocketFactory.create(`${webSocketSchema}://${(/:/.test(host) && !/\[/.test(host)) ? `[${host}]` : host}:${port}${path}?${query}&skipWebSocketFrames=false`, debugLabel);
- 			const errorListener = socket.onError(reject);
- 			socket.onOpen(() => {
+ 			const disposables = new DisposableStore();
+ 			disposables.add(socket.onError(reject));
 Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -245,7 +245,9 @@ export class WebClientServer {
+@@ -265,7 +265,9 @@ export class WebClientServer {
  		};
  
  		// Prefix routes with basePath for clients
@@ -122,7 +122,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  
  		const queryConnectionToken = parsedUrl.query[connectionTokenQueryName];
  		if (typeof queryConnectionToken === 'string') {
-@@ -284,10 +286,14 @@ export class WebClientServer {
+@@ -304,10 +306,14 @@ export class WebClientServer {
  		};
  
  		const useTestResolver = (!this._environmentService.isBuilt && this._environmentService.args['use-test-resolver']);
@@ -138,7 +138,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		);
  		if (!remoteAuthority) {
  			return serveError(req, res, 400, `Bad request.`);
-@@ -334,6 +340,7 @@ export class WebClientServer {
+@@ -354,6 +360,7 @@ export class WebClientServer {
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
@@ -146,7 +146,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  			embedderIdentifier: 'server-distro',
  			extensionsGallery: this._webExtensionResourceUrlTemplate && this._productService.extensionsGallery ? {
  				...this._productService.extensionsGallery,
-@@ -387,7 +394,9 @@ export class WebClientServer {
+@@ -407,7 +414,9 @@ export class WebClientServer {
  			WORKBENCH_AUTH_SESSION: authSessionInfo ? asJSON(authSessionInfo) : '',
  			WORKBENCH_WEB_BASE_URL: staticRoute,
  			WORKBENCH_NLS_URL,
@@ -157,7 +157,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		};
  
  		// DEV ---------------------------------------------------------------------------------------
-@@ -424,7 +433,7 @@ export class WebClientServer {
+@@ -444,7 +453,7 @@ export class WebClientServer {
  			'default-src \'self\';',
  			'img-src \'self\' https: data: blob:;',
  			'media-src \'self\';',
@@ -166,7 +166,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  			'child-src \'self\';',
  			`frame-src 'self' https://*.vscode-cdn.net data:;`,
  			'worker-src \'self\' data: blob:;',
-@@ -497,3 +506,70 @@ export class WebClientServer {
+@@ -517,3 +526,70 @@ export class WebClientServer {
  		return void res.end(data);
  	}
  }
@@ -241,7 +241,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -57,6 +57,7 @@ export type ExtensionVirtualWorkspaceSup
+@@ -66,6 +66,7 @@ export type ExtensionVirtualWorkspaceSup
  
  export interface IProductConfiguration {
  	readonly codeServerVersion?: string
@@ -253,7 +253,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 +++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
-@@ -332,7 +332,8 @@ class LocalStorageURLCallbackProvider ex
+@@ -339,7 +339,8 @@ class LocalStorageURLCallbackProvider ex
  			this.startListening();
  		}
  
@@ -263,7 +263,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
  	}
  
  	private startListening(): void {
-@@ -579,17 +580,6 @@ class WorkspaceProvider implements IWork
+@@ -584,17 +585,6 @@ class WorkspaceProvider implements IWork
  	}
  }
  
@@ -281,7 +281,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
  (function () {
  
  	// Find config by checking for DOM
-@@ -598,8 +588,8 @@ function readCookie(name: string): strin
+@@ -604,8 +594,8 @@ function readCookie(name: string): strin
  	if (!configElement || !configElementAttribute) {
  		throw new Error('Missing web configuration element');
  	}

patches/cli-window-open.diff

@@ -17,7 +17,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTe
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTerminalBackend.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTerminalBackend.ts
-@@ -106,10 +106,14 @@ class RemoteTerminalBackend extends Base
+@@ -108,10 +108,14 @@ class RemoteTerminalBackend extends Base
  			}
  			const reqId = e.reqId;
  			const commandId = e.commandId;

patches/clipboard.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/browser/mainThreadCLICommands
  import { CommandsRegistry, ICommandService } from '../../../platform/commands/common/commands.js';
  import { IExtensionGalleryService, IExtensionManagementService } from '../../../platform/extensionManagement/common/extensionManagement.js';
  import { ExtensionManagementCLI } from '../../../platform/extensionManagement/common/extensionManagementCLI.js';
-@@ -95,6 +96,11 @@ CommandsRegistry.registerCommand('_remot
+@@ -96,6 +97,11 @@ CommandsRegistry.registerCommand('_remot
  
  });
  
@@ -39,8 +39,8 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 +export type PipeCommand = OpenCommandPipeArgs | StatusPipeArgs | OpenExternalCommandPipeArgs | ExtensionManagementPipeArgs | ClipboardPipeArgs;
  
  export interface ICommandsExecuter {
- 	executeCommand<T>(id: string, ...args: any[]): Promise<T>;
-@@ -106,6 +111,9 @@ export class CLIServerBase {
+ 	executeCommand<T>(id: string, ...args: unknown[]): Promise<T>;
+@@ -110,6 +115,9 @@ export class CLIServerBase {
  					case 'extensionManagement':
  						returnObj = await this.manageExtensions(data);
  						break;
@@ -50,7 +50,7 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
  					default:
  						sendResponse(404, `Unknown message type: ${data.type}`);
  						break;
-@@ -173,6 +181,10 @@ export class CLIServerBase {
+@@ -180,6 +188,10 @@ export class CLIServerBase {
  		return await this._commands.executeCommand<string | undefined>('_remoteCLI.getSystemStatus');
  	}
  
@@ -59,26 +59,26 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostCLIServer.ts
 +	}
 +
  	dispose(): void {
- 		this._server.close();
- 
+ 		this._disposed = true;
+ 		this._server?.close();
 Index: code-server/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTerminalBackend.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTerminalBackend.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/terminal/browser/remoteTerminalBackend.ts
-@@ -97,7 +97,7 @@ class RemoteTerminalBackend extends Base
+@@ -99,7 +99,7 @@ class RemoteTerminalBackend extends Base
  			}
- 		});
+ 		}));
  
 -		const allowedCommands = ['_remoteCLI.openExternal', '_remoteCLI.windowOpen', '_remoteCLI.getSystemStatus', '_remoteCLI.manageExtensions'];
 +		const allowedCommands = ['_remoteCLI.openExternal', '_remoteCLI.windowOpen', '_remoteCLI.getSystemStatus', '_remoteCLI.manageExtensions', '_remoteCLI.setClipboard'];
- 		this._remoteTerminalChannel.onExecuteCommand(async e => {
+ 		this._register(this._remoteTerminalChannel.onExecuteCommand(async e => {
  			// Ensure this request for for this window
  			const pty = this._ptys.get(e.persistentProcessId);
 Index: code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/argv.ts
-@@ -122,6 +122,7 @@ export interface NativeParsedArgs {
+@@ -149,6 +149,7 @@ export interface NativeParsedArgs {
  	'disable-chromium-sandbox'?: boolean;
  	sandbox?: boolean;
  	'enable-coi'?: boolean;
@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/node/argv.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/node/argv.ts
-@@ -91,6 +91,7 @@ export const OPTIONS: OptionDescriptions
+@@ -115,6 +115,7 @@ export const OPTIONS: OptionDescriptions
  	'user-data-dir': { type: 'string', cat: 'o', args: 'dir', description: localize('userDataDir', "Specifies the directory that user data is kept in. Can be used to open multiple distinct instances of Code.") },
  	'profile': { type: 'string', 'cat': 'o', args: 'profileName', description: localize('profileName', "Opens the provided folder or workspace with the given profile and associates the profile with the workspace. If the profile does not exist, a new empty one is created.") },
  	'help': { type: 'boolean', cat: 'o', alias: 'h', description: localize('help', "Print usage.") },
@@ -110,7 +110,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.cli.ts
  			return true;
  		default:
  			return false;
-@@ -295,6 +296,22 @@ export async function main(desc: Product
+@@ -300,6 +301,22 @@ export async function main(desc: Product
  			}
  		}
  	} else {

patches/copilot.diff

@@ -0,0 +1,163 @@
+Index: code-server/lib/vscode/build/gulpfile.extensions.ts
+===================================================================
+--- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
++++ code-server/lib/vscode/build/gulpfile.extensions.ts
+@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
+ gulp.task(compileCopilotExtensionBuildTask);
+ 
+ /**
++ * Compiles the built-in copilot extension with proper `.vscodeignore` filtering
++ * and materializes native dependency shims (`node-pty`, `ripgrep`).
++ * Produces output equivalent to what CI ships from the pre-built VSIX.
++ *
++ * The result is placed in `.build/extensions/copilot/` and can be copied
++ * directly into a VS Code Insiders installation at:
++ *   `<insiders>/resources/app/extensions/copilot/`
++ */
++export const compileCopilotExtensionFullBuildTask = task.define('compile-copilot-extension-full-build', task.series(
++	// Step 1: Clean previous copilot build output
++	task.define('clean-copilot-build', util.rimraf('.build/extensions/copilot')),
++	// Step 2: Build and package with proper `.vscodeignore` filtering
++	task.define('package-copilot-extension-full', () => ext.packageCopilotExtensionFullStream().pipe(gulp.dest('.build'))),
++	// Step 3: Materialize native dependency shims (`node-pty`, `ripgrep`)
++	task.define('copilot-extension-native-shims', () => {
++		const copilotExtDir = path.join(root, '.build', 'extensions', 'copilot');
++		ext.prepareCopilotExtensionNativeShims(copilotExtDir);
++		return Promise.resolve();
++	})
++));
++gulp.task(compileCopilotExtensionFullBuildTask);
++
++/**
+  * Compiles the extensions for the build.
+  * This is essentially a helper task that combines {@link cleanExtensionsBuildTask}, {@link compileNonNativeExtensionsBuildTask} and {@link compileNativeExtensionsBuildTask}
+  */
+Index: code-server/lib/vscode/build/lib/extensions.ts
+===================================================================
+--- code-server.orig/lib/vscode/build/lib/extensions.ts
++++ code-server/lib/vscode/build/lib/extensions.ts
+@@ -24,6 +24,7 @@ import { getProductionDependencies } fro
+ import { type IExtensionDefinition, getExtensionStream } from './builtInExtensions.ts';
+ import { fetchUrls, fetchGithub } from './fetch.ts';
+ import { createTsgoStream, spawnTsgo } from './tsgo.ts';
++import { prepareBuiltInCopilotRipgrepShim } from './copilot.ts';
+ import vzip from 'gulp-vinyl-zip';
+ 
+ import { createRequire } from 'module';
+@@ -487,6 +488,116 @@ export function packageCopilotExtensionS
+ 	).pipe(util2.setExecutableBit(['**/*.sh']));
+ }
+ 
++/**
++ * Package the built-in copilot extension as a properly filtered VSIX-equivalent.
++ * Unlike {@link packageCopilotExtensionStream}, this uses vsce.listFiles with
++ * PackageManager.Npm so that .vscodeignore is respected for dependency filtering,
++ * producing output equivalent to what CI ships from the pre-built VSIX.
++ */
++export function packageCopilotExtensionFullStream(): Stream {
++	const vsce = require('@vscode/vsce') as typeof import('@vscode/vsce');
++	const extensionPath = path.join(root, 'extensions', 'copilot');
++	if (!fs.existsSync(extensionPath)) {
++		return es.readArray([]);
++	}
++
++	const esbuildConfigFileName = '.esbuild.mts';
++	const esbuildScript = path.join(extensionPath, esbuildConfigFileName);
++	if (!fs.existsSync(esbuildScript)) {
++		throw new Error(`Copilot esbuild script not found at ${esbuildScript}`);
++	}
++
++	const result = es.through();
++
++	// Step 1: Run esbuild to compile the extension
++	new Promise<void>((resolve, reject) => {
++		const proc = cp.execFile(process.argv[0], [esbuildScript], { cwd: extensionPath }, (error, _stdout, stderr) => {
++			if (error) {
++				return reject(error);
++			}
++			const matches = (stderr || '').match(/\> (.+): error: (.+)?/g);
++			fancyLog(`Bundled extension: ${ansiColors.yellow(path.join('copilot', esbuildConfigFileName))} with ${matches ? matches.length : 0} errors.`);
++			for (const match of matches || []) {
++				fancyLog.error(match);
++			}
++			return resolve();
++		});
++		proc.stdout!.on('data', (data) => {
++			fancyLog(`${ansiColors.green('esbuilding copilot')}: ${data.toString('utf8')}`);
++		});
++	}).then(() => {
++		// Step 2: Use `vsce.listFiles` with Npm package manager so `.vscodeignore`
++		// is applied to both source files AND `node_modules` dependencies.
++		// This is the key difference from `packageCopilotExtensionStream` which
++		// uses `PackageManager.None` and then blindly merges all production deps.
++		return vsce.listFiles({ cwd: extensionPath, packageManager: vsce.PackageManager.Npm });
++	}).then(fileNames => {
++		const files = fileNames
++			.map(fileName => path.join(extensionPath, fileName))
++			.map(filePath => new File({
++				path: filePath,
++				stat: fs.statSync(filePath),
++				base: extensionPath,
++				contents: fs.createReadStream(filePath)
++			}));
++
++		es.readArray(files).pipe(result);
++	}).catch(err => {
++		console.error('Failed to package copilot extension:', err);
++		result.emit('error', err);
++	});
++
++	// Apply the same package.json cleanup as bundled extensions get
++	const cleaned = updateExtensionPackageJSON(
++		result.pipe(rename(p => p.dirname = `extensions/copilot/${p.dirname}`)),
++		(data: any) => {
++			delete data.scripts;
++			delete data.dependencies;
++			delete data.devDependencies;
++			if (data.main) {
++				data.main = data.main.replace('/out/', '/dist/');
++			}
++			return data;
++		}
++	);
++
++	return minifyExtensionResources(cleaned)
++		.pipe(util2.setExecutableBit(['**/*.sh']));
++}
++
++/**
++ * Materializes native dependency shims (`node-pty`, `ripgrep`) into the copilot
++ * extension output at {@link outputDir}. Uses the root `node_modules` as the
++ * source for native binaries, targeting the current platform/arch.
++ *
++ * This is the equivalent of what {@link copyCopilotNativeDepsTask} in
++ * `gulpfile.vscode.ts` does during a full product build, but scoped to
++ * just the standalone copilot extension output.
++ *
++ * Failures are logged as warnings rather than throwing, since the copilot
++ * extension can still create shims at runtime if they are missing.
++ */
++export function prepareCopilotExtensionNativeShims(outputDir: string): void {
++	const platform = process.platform;
++	const arch = process.arch;
++	const appNodeModulesDir = path.join(root, 'node_modules');
++
++	if (!fs.existsSync(outputDir)) {
++		fancyLog.warn('[prepareCopilotExtensionNativeShims] Copilot extension not found at', outputDir, '- skipping shims');
++		return;
++	}
++
++	try {
++		prepareBuiltInCopilotRipgrepShim(platform, arch, outputDir, appNodeModulesDir);
++		fancyLog(`[prepareCopilotExtensionNativeShims] Materialized native shims for ${platform}-${arch}`);
++	} catch (err) {
++		// Downgrade to a warning for local builds since the extension
++		// can still function without shims (it creates them at runtime).
++		fancyLog.warn(`[prepareCopilotExtensionNativeShims] Failed to materialize shims: ${err}`);
++		fancyLog.warn('[prepareCopilotExtensionNativeShims] The extension will still work but will create shims at runtime.');
++	}
++}
++
+ export function packageMarketplaceExtensionsStream(forWeb: boolean): Stream {
+ 	const marketplaceExtensionsDescriptions = [
+ 		...builtInExtensions.filter(({ name }) => (forWeb ? !marketplaceWebExtensionsExclude.has(name) : true)),

patches/disable-builtin-ext-update.diff

@@ -7,8 +7,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsWorkbenchService.ts
-@@ -340,6 +340,10 @@ export class Extension implements IExten
- 			if (this.type === ExtensionType.System && this.productService.quality === 'stable') {
+@@ -342,6 +342,10 @@ export class Extension implements IExten
+ 			if (this.type === ExtensionType.System && this.productService.quality === 'stable' && !this.productService.builtInExtensionsEnabledWithAutoUpdates?.some(id => id.toLowerCase() === this.identifier.id.toLowerCase())) {
  				return false;
  			}
 +			// Do not update builtin extensions.

patches/display-language.diff

@@ -11,16 +11,16 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
 @@ -12,7 +12,7 @@ import * as path from '../../base/common
  import { IURITransformer } from '../../base/common/uriIpc.js';
- import { getMachineId, getSqmMachineId, getdevDeviceId } from '../../base/node/id.js';
+ import { getMachineId, getSqmMachineId, getDevDeviceId } from '../../base/node/id.js';
  import { Promises } from '../../base/node/pfs.js';
 -import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
 +import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, ProxyChannel, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
  import { ConfigurationService } from '../../platform/configuration/common/configurationService.js';
-@@ -255,6 +255,9 @@ export async function setupServerService
- 		const channel = new ExtensionManagementChannel(extensionManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority));
- 		socketServer.registerChannel('extensions', channel);
+@@ -301,6 +301,9 @@ export async function setupServerService
+ 
+ 		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
  
 +		const languagePackChannel = ProxyChannel.fromService<RemoteAgentConnectionContext>(accessor.get(ILanguagePackService), disposables);
 +		socketServer.registerChannel('languagePacks', languagePackChannel);
@@ -32,7 +32,7 @@ Index: code-server/lib/vscode/src/vs/platform/environment/common/environmentServ
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/environment/common/environmentService.ts
 +++ code-server/lib/vscode/src/vs/platform/environment/common/environmentService.ts
-@@ -101,7 +101,7 @@ export abstract class AbstractNativeEnvi
+@@ -112,7 +112,7 @@ export abstract class AbstractNativeEnvi
  			return URI.file(join(vscodePortable, 'argv.json'));
  		}
  
@@ -161,7 +161,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  import { CharCode } from '../../base/common/charCode.js';
  import { IExtensionManifest } from '../../platform/extensions/common/extensions.js';
  import { ICSSDevelopmentService } from '../../platform/cssDev/node/cssDevService.js';
-@@ -385,14 +386,22 @@ export class WebClientServer {
+@@ -405,14 +406,22 @@ export class WebClientServer {
  		};
  
  		const cookies = cookie.parse(req.headers.cookie || '');
@@ -190,7 +190,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -19,6 +19,7 @@ export const serverOptions: OptionDescri
+@@ -22,6 +22,7 @@ export const serverOptions: OptionDescri
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
@@ -198,7 +198,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -107,6 +108,7 @@ export interface ServerParsedArgs {
+@@ -116,6 +117,7 @@ export interface ServerParsedArgs {
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
@@ -244,10 +244,10 @@ Index: code-server/lib/vscode/src/vs/platform/languagePacks/browser/languagePack
 +		return this.languagePackService.getInstalledLanguages()
  	}
  }
-Index: code-server/lib/vscode/src/vs/workbench/services/localization/electron-sandbox/localeService.ts
+Index: code-server/lib/vscode/src/vs/workbench/services/localization/electron-browser/localeService.ts
 ===================================================================
---- code-server.orig/lib/vscode/src/vs/workbench/services/localization/electron-sandbox/localeService.ts
-+++ code-server/lib/vscode/src/vs/workbench/services/localization/electron-sandbox/localeService.ts
+--- code-server.orig/lib/vscode/src/vs/workbench/services/localization/electron-browser/localeService.ts
++++ code-server/lib/vscode/src/vs/workbench/services/localization/electron-browser/localeService.ts
 @@ -51,7 +51,8 @@ class NativeLocaleService implements ILo
  		@IProductService private readonly productService: IProductService
  	) { }
@@ -272,7 +272,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extensionsActions.ts
-@@ -475,9 +475,6 @@ export class InstallAction extends Exten
+@@ -474,9 +474,6 @@ export class InstallAction extends Exten
  		if (this.extension.isBuiltin) {
  			return;
  		}
@@ -282,7 +282,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		if (this.extension.state !== ExtensionState.Uninstalled) {
  			return;
  		}
-@@ -782,7 +779,7 @@ export abstract class InstallInOtherServ
+@@ -781,7 +778,7 @@ export abstract class InstallInOtherServ
  		}
  
  		if (isLanguagePackExtension(this.extension.local.manifest)) {
@@ -291,7 +291,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		}
  
  		// Prefers to run on UI
-@@ -2073,17 +2070,6 @@ export class SetLanguageAction extends E
+@@ -2284,17 +2281,6 @@ export class SetLanguageAction extends E
  	update(): void {
  		this.enabled = false;
  		this.class = SetLanguageAction.DisabledClass;
@@ -309,7 +309,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  	}
  
  	override async run(): Promise<any> {
-@@ -2100,7 +2086,6 @@ export class ClearLanguageAction extends
+@@ -2311,7 +2297,6 @@ export class ClearLanguageAction extends
  	private static readonly DisabledClass = `${this.EnabledClass} disabled`;
  
  	constructor(
@@ -317,7 +317,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  		@ILocaleService private readonly localeService: ILocaleService,
  	) {
  		super(ClearLanguageAction.ID, ClearLanguageAction.TITLE.value, ClearLanguageAction.DisabledClass, false);
-@@ -2110,17 +2095,6 @@ export class ClearLanguageAction extends
+@@ -2321,17 +2306,6 @@ export class ClearLanguageAction extends
  	update(): void {
  		this.enabled = false;
  		this.class = ClearLanguageAction.DisabledClass;
@@ -335,28 +335,16 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/extensions/browser/extens
  	}
  
  	override async run(): Promise<any> {
-Index: code-server/lib/vscode/build/gulpfile.reh.js
+Index: code-server/lib/vscode/src/vs/workbench/workbench.web.main.ts
 ===================================================================
---- code-server.orig/lib/vscode/build/gulpfile.reh.js
-+++ code-server/lib/vscode/build/gulpfile.reh.js
-@@ -58,6 +58,7 @@ const serverResourceIncludes = [
- 
- 	// NLS
- 	'out-build/nls.messages.json',
-+	'out-build/nls.keys.json', // Required to generate translations.
- 
- 	// Process monitor
- 	'out-build/vs/base/node/cpuUsage.sh',
-Index: code-server/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
-===================================================================
---- code-server.orig/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
-+++ code-server/lib/vscode/src/vs/workbench/workbench.web.main.internal.ts
-@@ -53,7 +53,7 @@ import './services/dialogs/browser/fileD
- import './services/host/browser/browserHostService.js';
+--- code-server.orig/lib/vscode/src/vs/workbench/workbench.web.main.ts
++++ code-server/lib/vscode/src/vs/workbench/workbench.web.main.ts
+@@ -55,7 +55,7 @@ import './services/host/browser/browserH
+ import '../platform/meteredConnection/browser/meteredConnectionService.js';
  import './services/lifecycle/browser/lifecycleService.js';
  import './services/clipboard/browser/clipboardService.js';
 -import './services/localization/browser/localeService.js';
-+import './services/localization/electron-sandbox/localeService.js';
++import './services/localization/electron-browser/localeService.js';
  import './services/path/browser/pathService.js';
  import './services/themes/browser/browserHostColorSchemeService.js';
  import './services/encryption/browser/encryptionService.js';

patches/external-file-actions.diff

@@ -27,7 +27,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -303,6 +303,16 @@ export interface IWorkbenchConstructionO
+@@ -312,6 +312,16 @@ export interface IWorkbenchConstructionO
  	 */
  	readonly userDataPath?: string
  
@@ -90,7 +90,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -16,6 +16,8 @@ export const serverOptions: OptionDescri
+@@ -19,6 +19,8 @@ export const serverOptions: OptionDescri
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
  	'auth': { type: 'string' },
@@ -99,7 +99,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -101,6 +103,8 @@ export interface ServerParsedArgs {
+@@ -110,6 +112,8 @@ export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
  	'auth'?: string;
@@ -112,7 +112,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -369,6 +369,8 @@ export class WebClientServer {
+@@ -389,6 +389,8 @@ export class WebClientServer {
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
  			userDataPath: this._environmentService.userDataPath,
@@ -125,13 +125,12 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
-@@ -7,11 +7,11 @@ import { Event } from '../../base/common
- import { Disposable, DisposableStore } from '../../base/common/lifecycle.js';
+@@ -6,10 +6,10 @@
+ import { Disposable } from '../../base/common/lifecycle.js';
  import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
- import { InputFocusedContext, IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
--import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext } from '../common/contextkeys.js';
-+import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, IsEnabledFileDownloads, IsEnabledFileUploads } from '../common/contextkeys.js';
- import { trackFocus, addDisposableListener, EventType, onDidRegisterWindow, getActiveWindow, isEditableElement } from '../../base/browser/dom.js';
+ import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
+-import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext } from '../common/contextkeys.js';
++import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext, IsEnabledFileDownloads, IsEnabledFileUploads } from '../common/contextkeys.js';
  import { preferredSideBySideGroupDirection, GroupDirection, IEditorGroupsService } from '../services/editor/common/editorGroupsService.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
 -import { IWorkbenchEnvironmentService } from '../services/environment/common/environmentService.js';
@@ -139,7 +138,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
  import { WorkbenchState, IWorkspaceContextService, isTemporaryWorkspace } from '../../platform/workspace/common/workspace.js';
  import { IWorkbenchLayoutService, Parts, positionToString } from '../services/layout/browser/layoutService.js';
  import { getRemoteName } from '../../platform/remote/common/remoteHosts.js';
-@@ -70,7 +70,7 @@ export class WorkbenchContextKeysHandler
+@@ -69,7 +69,7 @@ export class WorkbenchContextKeysHandler
  		@IContextKeyService private readonly contextKeyService: IContextKeyService,
  		@IWorkspaceContextService private readonly contextService: IWorkspaceContextService,
  		@IConfigurationService private readonly configurationService: IConfigurationService,
@@ -148,9 +147,9 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
  		@IProductService private readonly productService: IProductService,
  		@IEditorGroupsService private readonly editorGroupService: IEditorGroupsService,
  		@IEditorService private readonly editorService: IEditorService,
-@@ -197,6 +197,10 @@ export class WorkbenchContextKeysHandler
- 		this.auxiliaryBarVisibleContext = AuxiliaryBarVisibleContext.bindTo(this.contextKeyService);
- 		this.auxiliaryBarVisibleContext.set(this.layoutService.isVisible(Parts.AUXILIARYBAR_PART));
+@@ -201,6 +201,10 @@ export class WorkbenchContextKeysHandler
+ 		this.auxiliaryBarMaximizedContext = AuxiliaryBarMaximizedContext.bindTo(this.contextKeyService);
+ 		this.auxiliaryBarMaximizedContext.set(this.layoutService.isAuxiliaryBarMaximized());
  
 +		// code-server
 +		IsEnabledFileDownloads.bindTo(this.contextKeyService).set(this.environmentService.isEnabledFileDownloads ?? true)
@@ -167,8 +166,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/fileActions
  import { AutoSaveAfterShortDelayContext } from '../../../services/filesConfiguration/common/filesConfigurationService.js';
  import { WorkbenchListDoubleSelection } from '../../../../platform/list/browser/listService.js';
  import { Schemas } from '../../../../base/common/network.js';
--import { DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
-+import { IsEnabledFileDownloads, IsEnabledFileUploads, DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
+-import { DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
++import { IsEnabledFileDownloads, IsEnabledFileUploads, DirtyWorkingCopiesContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsSessionsWindowContext, WorkbenchStateContext, WorkspaceFolderCountContext, SidebarFocusContext, ActiveEditorCanRevertContext, ActiveEditorContext, ResourceContextKey, ActiveEditorAvailableEditorIdsContext, MultipleEditorsSelectedInGroupContext, TwoEditorsSelectedInGroupContext, SelectedEditorsInGroupFileOrUntitledResourceContextKey } from '../../../common/contextkeys.js';
  import { IsWebContext } from '../../../../platform/contextkey/common/contextkeys.js';
  import { ServicesAccessor } from '../../../../platform/instantiation/common/instantiation.js';
  import { ThemeIcon } from '../../../../base/common/themables.js';
@@ -208,9 +207,9 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -36,6 +36,9 @@ export const HasWebFileSystemAccess = ne
+@@ -41,6 +41,9 @@ export const EmbedderIdentifierContext =
  
- export const EmbedderIdentifierContext = new RawContextKey<string | undefined>('embedderIdentifier', undefined, localize('embedderIdentifier', 'The identifier of the embedder according to the product service, if one is defined'));
+ export const InAutomationContext = new RawContextKey<boolean>('inAutomation', false, localize('inAutomation', "Whether VS Code is running under automation/smoke test"));
  
 +export const IsEnabledFileDownloads = new RawContextKey<boolean>('isEnabledFileDownloads', true, true);
 +export const IsEnabledFileUploads = new RawContextKey<boolean>('isEnabledFileUploads', true, true);
@@ -231,7 +230,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
  import { IRemoteAgentService } from '../../remote/common/remoteAgentService.js';
  import { IContextKeyService, IContextKey, RawContextKey } from '../../../../platform/contextkey/common/contextkey.js';
  import { equalsIgnoreCase, format, startsWithIgnoreCase } from '../../../../base/common/strings.js';
-@@ -144,7 +144,7 @@ export class SimpleFileDialog extends Di
+@@ -161,7 +161,7 @@ export class SimpleFileDialog extends Di
  		@IFileDialogService private readonly fileDialogService: IFileDialogService,
  		@IModelService private readonly modelService: IModelService,
  		@ILanguageService private readonly languageService: ILanguageService,
@@ -240,13 +239,14 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
  		@IRemoteAgentService private readonly remoteAgentService: IRemoteAgentService,
  		@IPathService protected readonly pathService: IPathService,
  		@IKeybindingService private readonly keybindingService: IKeybindingService,
-@@ -310,20 +310,22 @@ export class SimpleFileDialog extends Di
- 			this.filePickBox.ignoreFocusOut = true;
+@@ -392,21 +392,23 @@ export class SimpleFileDialog extends Di
+ 			this.filePickBox.placeholder = nls.localize('remoteFileDialog.placeholder', "Folder path");
  			this.filePickBox.ok = true;
  			this.filePickBox.okLabel = typeof this.options.openLabel === 'string' ? this.options.openLabel : this.options.openLabel?.withoutMnemonic;
 -			if ((this.scheme !== Schemas.file) && this.options && this.options.availableFileSystems && (this.options.availableFileSystems.length > 1) && (this.options.availableFileSystems.indexOf(Schemas.file) > -1)) {
 -				this.filePickBox.customButton = true;
 -				this.filePickBox.customLabel = nls.localize('remoteFileDialog.local', 'Show Local');
+-				this.filePickBox.customButtonSecondary = true;
 -				let action;
 -				if (isSave) {
 -					action = SaveLocalFileCommand;
@@ -262,6 +262,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/dialogs/browser/simpleFi
 +				if ((this.scheme !== Schemas.file) && this.options && this.options.availableFileSystems && (this.options.availableFileSystems.length > 1) && (this.options.availableFileSystems.indexOf(Schemas.file) > -1)) {
 +					this.filePickBox.customButton = true;
 +					this.filePickBox.customLabel = nls.localize('remoteFileDialog.local', 'Show Local');
++					this.filePickBox.customButtonSecondary = true;
 +					let action;
 +					if (isSave) {
 +						action = SaveLocalFileCommand;
@@ -289,7 +290,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  import { WorkbenchCompressibleAsyncDataTree } from '../../../../../platform/list/browser/listService.js';
  import { ISearchService, QueryType, getExcludes, ISearchConfiguration, ISearchComplete, IFileQuery } from '../../../../services/search/common/search.js';
  import { CancellationToken } from '../../../../../base/common/cancellation.js';
-@@ -1601,7 +1602,8 @@ export class FileDragAndDrop implements
+@@ -1587,7 +1588,8 @@ export class FileDragAndDrop implements
  		@IConfigurationService private configurationService: IConfigurationService,
  		@IInstantiationService private instantiationService: IInstantiationService,
  		@IWorkspaceEditingService private workspaceEditingService: IWorkspaceEditingService,
@@ -299,7 +300,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/files/browser/views/explo
  	) {
  		const updateDropEnablement = (e: IConfigurationChangeEvent | undefined) => {
  			if (!e || e.affectsConfiguration('explorer.enableDragAndDrop')) {
-@@ -1826,15 +1828,17 @@ export class FileDragAndDrop implements
+@@ -1812,15 +1814,17 @@ export class FileDragAndDrop implements
  
  			// External file DND (Import/Upload file)
  			if (data instanceof NativeDragAndDropData) {
@@ -330,7 +331,7 @@ Index: code-server/lib/vscode/src/vs/platform/files/node/diskFileSystemProviderS
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/files/node/diskFileSystemProviderServer.ts
 +++ code-server/lib/vscode/src/vs/platform/files/node/diskFileSystemProviderServer.ts
-@@ -92,6 +92,7 @@ export abstract class AbstractDiskFileSy
+@@ -99,6 +99,7 @@ export abstract class AbstractDiskFileSy
  
  	private async readFile(uriTransformer: IURITransformer, _resource: UriComponents, opts?: IFileAtomicReadOptions): Promise<VSBuffer> {
  		const resource = this.transformIncoming(uriTransformer, _resource, true);
@@ -338,7 +339,7 @@ Index: code-server/lib/vscode/src/vs/platform/files/node/diskFileSystemProviderS
  		const buffer = await this.provider.readFile(resource, opts);
  
  		return VSBuffer.wrap(buffer);
-@@ -110,6 +111,7 @@ export abstract class AbstractDiskFileSy
+@@ -117,6 +118,7 @@ export abstract class AbstractDiskFileSy
  			}
  		});
  
@@ -346,7 +347,7 @@ Index: code-server/lib/vscode/src/vs/platform/files/node/diskFileSystemProviderS
  		const fileStream = this.provider.readFileStream(resource, opts, cts.token);
  		listenStream(fileStream, {
  			onData: chunk => emitter.fire(VSBuffer.wrap(chunk)),
-@@ -130,7 +132,7 @@ export abstract class AbstractDiskFileSy
+@@ -137,7 +139,7 @@ export abstract class AbstractDiskFileSy
  
  	private writeFile(uriTransformer: IURITransformer, _resource: UriComponents, content: VSBuffer, opts: IFileWriteOptions): Promise<void> {
  		const resource = this.transformIncoming(uriTransformer, _resource);

patches/getting-started.diff

@@ -17,8 +17,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
 -import { $, Dimension, addDisposableListener, append, clearNode, reset } from '../../../../base/browser/dom.js';
 +import { $, Dimension, addDisposableListener, append, clearNode, reset, prepend } from '../../../../base/browser/dom.js';
  import { renderFormattedText } from '../../../../base/browser/formattedTextRenderer.js';
+ import { status } from '../../../../base/browser/ui/aria/aria.js';
  import { StandardKeyboardEvent } from '../../../../base/browser/keyboardEvent.js';
- import { Button } from '../../../../base/browser/ui/button/button.js';
 @@ -54,7 +54,7 @@ import { IRecentFolder, IRecentWorkspace
  import { OpenRecentAction } from '../../../browser/actions/windowActions.js';
  import { OpenFileFolderAction, OpenFolderAction, OpenFolderViaWorkspaceAction } from '../../../browser/actions/workspaceActions.js';
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -876,6 +876,72 @@ export class GettingStartedPage extends
+@@ -925,6 +925,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -911,6 +977,9 @@ export class GettingStartedPage extends
+@@ -974,6 +1040,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}
@@ -135,7 +135,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -313,6 +313,11 @@ export interface IWorkbenchConstructionO
+@@ -322,6 +322,11 @@ export interface IWorkbenchConstructionO
  	 */
  	readonly isEnabledFileUploads?: boolean
  
@@ -181,7 +181,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -18,6 +18,7 @@ export const serverOptions: OptionDescri
+@@ -21,6 +21,7 @@ export const serverOptions: OptionDescri
  	'auth': { type: 'string' },
  	'disable-file-downloads': { type: 'boolean' },
  	'disable-file-uploads': { type: 'boolean' },
@@ -189,7 +189,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -105,6 +106,7 @@ export interface ServerParsedArgs {
+@@ -114,6 +115,7 @@ export interface ServerParsedArgs {
  	'auth'?: string;
  	'disable-file-downloads'?: boolean;
  	'disable-file-uploads'?: boolean;
@@ -201,7 +201,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -373,6 +373,7 @@ export class WebClientServer {
+@@ -393,6 +393,7 @@ export class WebClientServer {
  			userDataPath: this._environmentService.userDataPath,
  			isEnabledFileDownloads: !this._environmentService.args['disable-file-downloads'],
  			isEnabledFileUploads: !this._environmentService.args['disable-file-uploads'],
@@ -213,16 +213,16 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/contextkeys.ts
-@@ -7,7 +7,7 @@ import { Event } from '../../base/common
- import { Disposable, DisposableStore } from '../../base/common/lifecycle.js';
+@@ -6,7 +6,7 @@
+ import { Disposable } from '../../base/common/lifecycle.js';
  import { IContextKeyService, IContextKey, setConstant as setConstantContextKey } from '../../platform/contextkey/common/contextkey.js';
- import { InputFocusedContext, IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
--import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, IsEnabledFileDownloads, IsEnabledFileUploads } from '../common/contextkeys.js';
-+import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, IsEnabledFileDownloads, IsEnabledFileUploads, IsEnabledCoderGettingStarted, } from '../common/contextkeys.js';
- import { trackFocus, addDisposableListener, EventType, onDidRegisterWindow, getActiveWindow, isEditableElement } from '../../base/browser/dom.js';
+ import { IsMacContext, IsLinuxContext, IsWindowsContext, IsWebContext, IsMacNativeContext, IsDevelopmentContext, IsIOSContext, ProductQualityContext, IsMobileContext } from '../../platform/contextkey/common/contextkeys.js';
+-import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext, IsEnabledFileDownloads, IsEnabledFileUploads } from '../common/contextkeys.js';
++import { SplitEditorsVertically, InEditorZenModeContext, AuxiliaryBarVisibleContext, SideBarVisibleContext, PanelAlignmentContext, PanelMaximizedContext, PanelVisibleContext, EmbedderIdentifierContext, EditorTabsVisibleContext, IsMainEditorCenteredLayoutContext, MainEditorAreaVisibleContext, DirtyWorkingCopiesContext, EmptyWorkspaceSupportContext, EnterMultiRootWorkspaceSupportContext, HasWebFileSystemAccess, IsMainWindowFullscreenContext, OpenFolderWorkspaceSupportContext, RemoteNameContext, VirtualWorkspaceContext, WorkbenchStateContext, WorkspaceFolderCountContext, PanelPositionContext, TemporaryWorkspaceContext, TitleBarVisibleContext, TitleBarStyleContext, IsAuxiliaryWindowFocusedContext, ActiveEditorGroupEmptyContext, ActiveEditorGroupIndexContext, ActiveEditorGroupLastContext, ActiveEditorGroupLockedContext, MultipleEditorGroupsContext, EditorsVisibleContext, AuxiliaryBarMaximizedContext, InAutomationContext, IsSessionsWindowContext, IsEnabledFileDownloads, IsEnabledFileUploads, IsEnabledCoderGettingStarted, } from '../common/contextkeys.js';
  import { preferredSideBySideGroupDirection, GroupDirection, IEditorGroupsService } from '../services/editor/common/editorGroupsService.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
-@@ -200,6 +200,7 @@ export class WorkbenchContextKeysHandler
+ import { IBrowserWorkbenchEnvironmentService } from '../services/environment/browser/environmentService.js';
+@@ -204,6 +204,7 @@ export class WorkbenchContextKeysHandler
  		// code-server
  		IsEnabledFileDownloads.bindTo(this.contextKeyService).set(this.environmentService.isEnabledFileDownloads ?? true)
  		IsEnabledFileUploads.bindTo(this.contextKeyService).set(this.environmentService.isEnabledFileUploads ?? true)
@@ -234,7 +234,7 @@ Index: code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/common/contextkeys.ts
 +++ code-server/lib/vscode/src/vs/workbench/common/contextkeys.ts
-@@ -38,6 +38,7 @@ export const EmbedderIdentifierContext =
+@@ -43,6 +43,7 @@ export const InAutomationContext = new R
  
  export const IsEnabledFileDownloads = new RawContextKey<boolean>('isEnabledFileDownloads', true, true);
  export const IsEnabledFileUploads = new RawContextKey<boolean>('isEnabledFileUploads', true, true);

patches/integration.diff

@@ -48,7 +48,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 -[REMOTE_DATA_FOLDER, args['extensions-dir'], USER_DATA_PATH, APP_SETTINGS_HOME, MACHINE_SETTINGS_HOME, GLOBAL_STORAGE_HOME, LOCAL_HISTORY_HOME].forEach(f => {
 -	try {
 -		if (!fs.existsSync(f)) {
--			fs.mkdirSync(f, { mode: 0o700 });
+-			fs.mkdirSync(f, { mode: 0o700, recursive: true });
 -		}
 -	} catch (err) { console.error(err); }
 -});
@@ -68,7 +68,7 @@ Index: code-server/lib/vscode/src/vs/server/node/server.main.ts
 +	[REMOTE_DATA_FOLDER, args['extensions-dir'], USER_DATA_PATH, APP_SETTINGS_HOME, MACHINE_SETTINGS_HOME, GLOBAL_STORAGE_HOME, LOCAL_HISTORY_HOME].forEach(f => {
 +		try {
 +			if (!fs.existsSync(f)) {
-+				fs.mkdirSync(f, { mode: 0o700 });
++				fs.mkdirSync(f, { mode: 0o700, recursive: true });
 +			}
 +		} catch (err) { console.error(err); }
 +	});
@@ -109,24 +109,6 @@ Index: code-server/lib/vscode/src/vs/base/common/processes.ts
  	];
  	const envKeys = Object.keys(env);
  	envKeys
-Index: code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandler.ts
-===================================================================
---- code-server.orig/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandler.ts
-+++ code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialogHandler.ts
-@@ -78,8 +78,11 @@ export class BrowserDialogHandler extend
- 
- 	async about(): Promise<void> {
- 		const detailString = (useAgo: boolean): string => {
--			return localize('aboutDetail',
--				"Version: {0}\nCommit: {1}\nDate: {2}\nBrowser: {3}",
-+			return localize('aboutCodeServerDetail',
-+				"code-server: {0}",
-+				this.productService.codeServerVersion ? `v${this.productService.codeServerVersion}` : 'Unknown'
-+			) + '\n' + localize('aboutDetail',
-+				"Code: {0}\nCommit: {1}\nDate: {2}\nBrowser: {3}",
- 				this.productService.version || 'Unknown',
- 				this.productService.commit || 'Unknown',
- 				this.productService.date ? `${this.productService.date}${useAgo ? ' (' + fromNow(new Date(this.productService.date), true) + ')' : ''}` : 'Unknown',
 Index: code-server/lib/vscode/src/vs/workbench/browser/client.ts
 ===================================================================
 --- /dev/null
@@ -182,7 +164,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -64,6 +64,7 @@ import { IOpenerService } from '../../pl
+@@ -65,6 +65,7 @@ import { IOpenerService } from '../../pl
  import { mixin, safeStringify } from '../../base/common/objects.js';
  import { IndexedDB } from '../../base/browser/indexedDB.js';
  import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js';
@@ -190,7 +172,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -130,6 +131,9 @@ export class BrowserMain extends Disposa
+@@ -140,6 +141,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
  
@@ -204,7 +186,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -56,6 +56,8 @@ export type ExtensionVirtualWorkspaceSup
+@@ -65,6 +65,8 @@ export type ExtensionVirtualWorkspaceSup
  };
  
  export interface IProductConfiguration {
@@ -269,7 +251,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -333,6 +333,7 @@ export class WebClientServer {
+@@ -353,6 +353,7 @@ export class WebClientServer {
  		} : undefined;
  
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
@@ -281,9 +263,9 @@ Index: code-server/lib/vscode/src/server-main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/server-main.ts
 +++ code-server/lib/vscode/src/server-main.ts
-@@ -25,6 +25,9 @@ const __dirname = path.dirname(fileURLTo
+@@ -22,6 +22,9 @@ import { IServerAPI } from './vs/server/
  perf.mark('code/server/start');
- (globalThis as any).vscodeServerStartTime = performance.now();
+ (globalThis as { vscodeServerStartTime?: number }).vscodeServerStartTime = performance.now();
  
 +// This is not indented to make the diff less noisy.  We need to move this out
 +// of the top-level so it will not run immediately and we can control the start.
@@ -291,15 +273,15 @@ Index: code-server/lib/vscode/src/server-main.ts
  // Do a quick parse to determine if a server or the cli needs to be started
  const parsedArgs = minimist(process.argv.slice(2), {
  	boolean: ['start-server', 'list-extensions', 'print-ip-address', 'help', 'version', 'accept-server-license-terms', 'update-extensions'],
-@@ -153,6 +156,7 @@ if (shouldSpawnCli) {
+@@ -150,6 +153,7 @@ if (shouldSpawnCli) {
  		}
  	});
  }
 +}
  
- function sanitizeStringArg(val: any): string | undefined {
+ function sanitizeStringArg(val: unknown): string | undefined {
  	if (Array.isArray(val)) { // if an argument is passed multiple times, minimist creates an array
-@@ -286,3 +290,22 @@ function prompt(question: string): Promi
+@@ -283,3 +287,22 @@ function prompt(question: string): Promi
  		});
  	});
  }
@@ -310,7 +292,7 @@ Index: code-server/lib/vscode/src/server-main.ts
 +		osLocale: 'en',
 +		commit: product.commit,
 +		userDataPath: '',
-+		nlsMetadataPath: __dirname,
++		nlsMetadataPath: import.meta.dirname,
 +	});
 +	return loadCode(nlsConfiguration);
 +}
@@ -322,3 +304,21 @@ Index: code-server/lib/vscode/src/server-main.ts
 +if (!process.env.CODE_SERVER_PARENT_PID) {
 +	start();
 +}
+Index: code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
++++ code-server/lib/vscode/src/vs/workbench/browser/parts/dialogs/dialog.ts
+@@ -47,8 +47,11 @@ export function createWorkbenchDialogOpt
+ 
+ export function createBrowserAboutDialogDetails(productService: IProductService): { title: string; details: string; detailsToCopy: string } {
+ 	const detailString = (useAgo: boolean): string => {
+-		return localize('aboutDetail',
+-			"Version: {0}\nCommit: {1}\nDate: {2}\nBrowser: {3}",
++		return localize('aboutCodeServerDetail',
++			"code-server: {0}",
++			productService.codeServerVersion ? `v${productService.codeServerVersion}` : 'Unknown'
++		) + '\n' + localize('aboutDetail',
++			"Code: {0}\nCommit: {1}\nDate: {2}\nBrowser: {3}",
+ 			productService.version || 'Unknown',
+ 			productService.commit || 'Unknown',
+ 			productService.date ? `${productService.date}${useAgo ? ' (' + fromNow(new Date(productService.date), true) + ')' : ''}` : 'Unknown',

patches/local-storage.diff

@@ -18,7 +18,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -364,6 +364,7 @@ export class WebClientServer {
+@@ -384,6 +384,7 @@ export class WebClientServer {
  			remoteAuthority,
  			serverBasePath: basePath,
  			webviewEndpoint: staticRoute + '/out/vs/workbench/contrib/webview/browser/pre',
@@ -30,9 +30,9 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.api.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.api.ts
-@@ -298,6 +298,11 @@ export interface IWorkbenchConstructionO
+@@ -307,6 +307,11 @@ export interface IWorkbenchConstructionO
  	 */
- 	readonly configurationDefaults?: Record<string, any>;
+ 	readonly configurationDefaults?: Record<string, unknown>;
  
 +	/**
 +	 * Path to the user data directory.
@@ -66,7 +66,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/configuration/browser/configurationService.ts
-@@ -147,8 +147,10 @@ export class WorkspaceService extends Di
+@@ -148,8 +148,10 @@ export class WorkspaceService extends Di
  		this.workspaceConfiguration = this._register(new WorkspaceConfiguration(configurationCache, fileService, uriIdentityService, logService));
  		this._register(this.workspaceConfiguration.onDidUpdateConfiguration(fromCache => {
  			this.onWorkspaceConfigurationChanged(fromCache).then(() => {
@@ -79,7 +79,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/configuration/browser/co
  			});
  		}));
  
-@@ -555,6 +557,12 @@ export class WorkspaceService extends Di
+@@ -561,6 +563,12 @@ export class WorkspaceService extends Di
  			previousFolders = this.workspace.folders;
  			this.workspace.update(workspace);
  		} else {

patches/logout.diff

@@ -8,7 +8,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -59,6 +59,7 @@ export interface IProductConfiguration {
+@@ -68,6 +68,7 @@ export interface IProductConfiguration {
  	readonly codeServerVersion?: string
  	readonly rootEndpoint?: string
  	readonly updateEndpoint?: string
@@ -20,7 +20,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -15,6 +15,7 @@ import { URI } from '../../base/common/u
+@@ -18,6 +18,7 @@ import { ProtocolConstants } from '../..
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
  	/* ----- code-server ----- */
  	'disable-update-check': { type: 'boolean' },
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -99,6 +100,7 @@ export const serverOptions: OptionDescri
+@@ -108,6 +109,7 @@ export const serverOptions: OptionDescri
  export interface ServerParsedArgs {
  	/* ----- code-server ----- */
  	'disable-update-check'?: boolean;
@@ -40,7 +40,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -341,6 +341,7 @@ export class WebClientServer {
+@@ -361,6 +361,7 @@ export class WebClientServer {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,

patches/marketplace.diff

@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -49,6 +49,16 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -49,6 +49,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
  			version: pkg.version
  		});
  	}
@@ -28,6 +28,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 +		extensionsGallery: env.EXTENSIONS_GALLERY ? JSON.parse(env.EXTENSIONS_GALLERY) : (product.extensionsGallery || {
 +			serviceUrl: "https://open-vsx.org/vscode/gallery",
 +			itemUrl: "https://open-vsx.org/vscode/item",
++			extensionUrlTemplate: "https://open-vsx.org/vscode/gallery/{publisher}/{name}/latest",
 +			resourceUrlTemplate: "https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}",
 +			controlUrl: "",
 +			recommendationsUrl: "",
@@ -40,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -326,7 +326,6 @@ export class WebClientServer {
+@@ -346,7 +346,6 @@ export class WebClientServer {
  
  		const staticRoute = posix.join(basePath, this._productPath, STATIC_PATH);
  		const callbackRoute = posix.join(basePath, this._productPath, CALLBACK_PATH);
@@ -48,7 +49,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  
  		const resolveWorkspaceURI = (defaultLocation?: string) => defaultLocation && URI.file(resolve(defaultLocation)).with({ scheme: Schemas.vscodeRemote, authority: remoteAuthority });
  
-@@ -342,14 +341,7 @@ export class WebClientServer {
+@@ -362,14 +361,7 @@ export class WebClientServer {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
  			embedderIdentifier: 'server-distro',
@@ -89,3 +90,18 @@ Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/ext
  	}
  
  }
+Index: code-server/lib/vscode/src/vs/platform/externalServices/common/marketplace.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/platform/externalServices/common/marketplace.ts
++++ code-server/lib/vscode/src/vs/platform/externalServices/common/marketplace.ts
+@@ -26,6 +26,10 @@ export async function resolveMarketplace
+ 		'User-Agent': `VSCode ${version} (${productService.nameShort})`
+ 	};
+ 
++	if (productService.extensionsGallery?.authorizationHeaderToken) {
++		headers['Authorization'] = `Bearer ${productService.extensionsGallery.authorizationHeaderToken}`;
++	}
++
+ 	if (supportsTelemetry(productService, environmentService) && getTelemetryLevel(configurationService) === TelemetryLevel.USAGE) {
+ 		const serviceMachineId = await getServiceMachineId(environmentService, fileService, storageService);
+ 		headers['X-Market-User-Id'] = serviceMachineId;

patches/proposed-api.diff

@@ -10,14 +10,14 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/common/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
-@@ -314,10 +314,7 @@ function extensionDescriptionArrayToMap(
+@@ -321,10 +321,7 @@ function extensionDescriptionArrayToMap(
  }
  
  export function isProposedApiEnabled(extension: IExtensionDescription, proposal: ApiProposalName): boolean {
 -	if (!extension.enabledApiProposals) {
 -		return false;
 -	}
--	return extension.enabledApiProposals.includes(proposal);
+-	return true;// extension.enabledApiProposals.includes(proposal);
 +	return true
  }
  

patches/proxy-uri.diff

@@ -30,7 +30,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -60,6 +60,7 @@ export interface IProductConfiguration {
+@@ -69,6 +69,7 @@ export interface IProductConfiguration {
  	readonly rootEndpoint?: string
  	readonly updateEndpoint?: string
  	readonly logoutEndpoint?: string
@@ -71,7 +71,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -342,6 +342,7 @@ export class WebClientServer {
+@@ -362,6 +362,7 @@ export class WebClientServer {
  			rootEndpoint: rootBase,
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
@@ -83,7 +83,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/terminal/common/terminalE
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/contrib/terminal/common/terminalEnvironment.ts
 +++ code-server/lib/vscode/src/vs/workbench/contrib/terminal/common/terminalEnvironment.ts
-@@ -291,7 +291,7 @@ export async function createTerminalEnvi
+@@ -292,7 +292,7 @@ export async function createTerminalEnvi
  
  		// Sanitize the environment, removing any undesirable VS Code and Electron environment
  		// variables
@@ -96,7 +96,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/code/browser/workbench/workbench.ts
 +++ code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
-@@ -19,6 +19,7 @@ import { ISecretStorageProvider } from '
+@@ -20,6 +20,7 @@ import { ISecretStorageProvider } from '
  import { isFolderToOpen, isWorkspaceToOpen } from '../../../platform/window/common/window.js';
  import type { IWorkbenchConstructionOptions, IWorkspace, IWorkspaceProvider } from '../../../workbench/browser/web.api.js';
  import { AuthenticationSessionInfo } from '../../../workbench/services/authentication/browser/authenticationService.js';
@@ -104,7 +104,7 @@ Index: code-server/lib/vscode/src/vs/code/browser/workbench/workbench.ts
  import type { IURLCallbackProvider } from '../../../workbench/services/url/browser/urlService.js';
  import { create } from '../../../workbench/workbench.web.main.internal.js';
  
-@@ -600,6 +601,39 @@ class WorkspaceProvider implements IWork
+@@ -606,6 +607,39 @@ class WorkspaceProvider implements IWork
  		settingsSyncOptions: config.settingsSyncOptions ? { enabled: config.settingsSyncOptions.enabled, } : undefined,
  		workspaceProvider: WorkspaceProvider.create(config),
  		urlCallbackProvider: new LocalStorageURLCallbackProvider(config.callbackRoute),

patches/series

@@ -22,3 +22,4 @@ clipboard.diff
 display-language.diff
 trusted-domains.diff
 signature-verification.diff
+copilot.diff

patches/service-worker.diff

@@ -6,7 +6,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -61,6 +61,10 @@ export interface IProductConfiguration {
+@@ -70,6 +70,10 @@ export interface IProductConfiguration {
  	readonly updateEndpoint?: string
  	readonly logoutEndpoint?: string
  	readonly proxyEndpointTemplate?: string
@@ -54,7 +54,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -343,6 +343,10 @@ export class WebClientServer {
+@@ -363,6 +363,10 @@ export class WebClientServer {
  			updateEndpoint: !this._environmentService.args['disable-update-check'] ? rootBase + '/update/check' : undefined,
  			logoutEndpoint: this._environmentService.args['auth'] && this._environmentService.args['auth'] !== "none" ? rootBase + '/logout' : undefined,
  			proxyEndpointTemplate: process.env.VSCODE_PROXY_URI ?? rootBase + '/proxy/{{port}}/',

patches/sourcemaps.diff

@@ -1,43 +1,25 @@
-Make sourcemaps self-hosted
+Remove sourcemaps URL
 
-Normally source maps get removed as part of the build process so prevent that
-from happening.  Also avoid using the windows.net host since obviously we can
-not host our source maps there and want them to be self-hosted even if we could.
+These will not work since we patch VS Code.
 
-To test try debugging/browsing the source of a build in a browser.
-
-Index: code-server/lib/vscode/build/gulpfile.reh.js
+Index: code-server/lib/vscode/build/gulpfile.reh.ts
 ===================================================================
---- code-server.orig/lib/vscode/build/gulpfile.reh.js
-+++ code-server/lib/vscode/build/gulpfile.reh.js
-@@ -256,8 +256,7 @@ function packageTask(type, platform, arc
+--- code-server.orig/lib/vscode/build/gulpfile.reh.ts
++++ code-server/lib/vscode/build/gulpfile.reh.ts
+@@ -261,10 +261,15 @@ function packageTask(type: string, platf
+ 	const destination = path.join(BUILD_ROOT, destinationFolderName);
  
+ 	return () => {
++		const jsFilterMain = util.filter(data => !data.isDirectory() && /\.js$/.test(data.path));
++
  		const src = gulp.src(sourceFolderName + '/**', { base: '.' })
- 			.pipe(rename(function (path) { path.dirname = path.dirname.replace(new RegExp('^' + sourceFolderName), 'out'); }))
--			.pipe(util.setExecutableBit(['**/*.sh']))
--			.pipe(filter(['**', '!**/*.js.map']));
-+			.pipe(util.setExecutableBit(['**/*.sh']));
+ 			.pipe(rename(function (path) { path.dirname = path.dirname!.replace(new RegExp('^' + sourceFolderName), 'out'); }))
+ 			.pipe(util.setExecutableBit(['**/*.sh']))
+-			.pipe(filter(['**', '!**/*.{js,css}.map']));
++			.pipe(filter(['**', '!**/*.{js,css}.map']))
++			.pipe(jsFilterMain)
++			.pipe(util.stripSourceMappingURL())
++			.pipe(jsFilterMain.restore);
  
  		const workspaceExtensionPoints = ['debuggers', 'jsonValidation'];
- 		const isUIExtension = (manifest) => {
-@@ -296,9 +295,9 @@ function packageTask(type, platform, arc
- 			.map(name => `.build/extensions/${name}/**`);
- 
- 		const extensions = gulp.src(extensionPaths, { base: '.build', dot: true });
--		const extensionsCommonDependencies = gulp.src('.build/extensions/node_modules/**', { base: '.build', dot: true });
--		const sources = es.merge(src, extensions, extensionsCommonDependencies)
-+		const extensionsCommonDependencies = gulp.src('.build/extensions/node_modules/**', { base: '.build', dot: true })
- 			.pipe(filter(['**', '!**/*.js.map'], { dot: true }));
-+		const sources = es.merge(src, extensions, extensionsCommonDependencies);
- 
- 		let version = packageJson.version;
- 		const quality = product.quality;
-@@ -451,7 +450,7 @@ function tweakProductForServerWeb(produc
- 	const minifyTask = task.define(`minify-vscode-${type}`, task.series(
- 		bundleTask,
- 		util.rimraf(`out-vscode-${type}-min`),
--		optimize.minifyTask(`out-vscode-${type}`, `https://main.vscode-cdn.net/sourcemaps/${commit}/core`)
-+		optimize.minifyTask(`out-vscode-${type}`, ``)
- 	));
- 	gulp.task(minifyTask);
- 
+ 		const isUIExtension = (manifest: { extensionKind?: string; main?: string; contributes?: Record<string, unknown> }) => {

patches/store-socket.diff

@@ -25,13 +25,13 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extHostExtensionService.
  import { createApiFactoryAndRegisterActors } from '../common/extHost.api.impl.js';
 @@ -18,6 +19,7 @@ import { ExtensionRuntime } from '../com
  import { CLIServer } from './extHostCLIServer.js';
- import { realpathSync } from '../../../base/node/extpath.js';
+ import { realpathSync } from '../../../base/node/pfs.js';
  import { ExtHostConsoleForwarder } from './extHostConsoleForwarder.js';
 +import { IExtHostWorkspace } from '../common/extHostWorkspace.js';
  import { ExtHostDiskFileSystemProvider } from './extHostDiskFileSystemProvider.js';
  import nodeModule from 'node:module';
  import { assertType } from '../../../base/common/types.js';
-@@ -226,6 +228,52 @@ export class ExtHostExtensionService ext
+@@ -175,6 +177,52 @@ export class ExtHostExtensionService ext
  
  		performance.mark('code/extHost/didInitAPI');
  
@@ -94,9 +94,9 @@ Index: code-server/lib/vscode/src/vs/workbench/api/node/extensionHostProcess.ts
  
 +import * as _http from 'http';
  import minimist from 'minimist';
- import * as nativeWatchdog from 'native-watchdog';
+ import * as nativeWatchdog from '@vscode/native-watchdog';
  import * as net from 'net';
-@@ -437,7 +438,28 @@ async function startExtensionHostProcess
+@@ -469,7 +470,28 @@ async function startExtensionHostProcess
  	);
  
  	// rewrite onTerminate-function to be a proper shutdown

patches/telemetry.diff

@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { NullPolicyService } from '../../platform/policy/common/policy.js';
  import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
  import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -158,11 +160,23 @@ export async function setupServerService
+@@ -174,11 +176,23 @@ export async function setupServerService
  	const requestService = new RequestService('remote', configurationService, environmentService, logService);
  	services.set(IRequestService, requestService);
  
@@ -134,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -347,6 +347,8 @@ export class WebClientServer {
+@@ -367,6 +367,8 @@ export class WebClientServer {
  				scope: vscodeBase + '/',
  				path: rootBase + '/_static/out/browser/serviceWorker.js',
  			},
@@ -147,7 +147,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -65,6 +65,7 @@ export interface IProductConfiguration {
+@@ -74,6 +74,7 @@ export interface IProductConfiguration {
  		readonly path: string;
  		readonly scope: string;
  	}
@@ -159,7 +159,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -57,7 +57,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -58,7 +58,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
  			resourceUrlTemplate: "https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}",
  			controlUrl: "",
  			recommendationsUrl: "",

patches/trusted-domains.diff

@@ -4,7 +4,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -20,6 +20,7 @@ export const serverOptions: OptionDescri
+@@ -23,6 +23,7 @@ export const serverOptions: OptionDescri
  	'disable-file-uploads': { type: 'boolean' },
  	'disable-getting-started-override': { type: 'boolean' },
  	'locale': { type: 'string' },
@@ -12,7 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -109,6 +110,7 @@ export interface ServerParsedArgs {
+@@ -118,6 +119,7 @@ export interface ServerParsedArgs {
  	'disable-file-uploads'?: boolean;
  	'disable-getting-started-override'?: boolean,
  	'locale'?: string
@@ -24,7 +24,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -338,6 +338,14 @@ export class WebClientServer {
+@@ -358,6 +358,14 @@ export class WebClientServer {
  			scopes: [['user:email'], ['repo']]
  		} : undefined;
  
@@ -39,7 +39,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
-@@ -352,6 +360,7 @@ export class WebClientServer {
+@@ -372,6 +380,7 @@ export class WebClientServer {
  			telemetryEndpoint: this._productService.telemetryEndpoint,
  			embedderIdentifier: 'server-distro',
  			extensionsGallery: this._productService.extensionsGallery,

patches/unique-db.diff

@@ -21,7 +21,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/storage/browser/storageS
  
  export class BrowserStorageService extends AbstractStorageService {
  
-@@ -300,7 +301,11 @@ export class IndexedDBStorageDatabase ex
+@@ -328,7 +329,11 @@ export class IndexedDBStorageDatabase ex
  	}
  
  	static async createWorkspaceStorage(workspaceId: string, logService: ILogService): Promise<IIndexedDBStorageDatabase> {

patches/update-check.diff

@@ -93,7 +93,7 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/product.ts
 +++ code-server/lib/vscode/src/vs/base/common/product.ts
-@@ -58,6 +58,7 @@ export type ExtensionVirtualWorkspaceSup
+@@ -67,6 +67,7 @@ export type ExtensionVirtualWorkspaceSup
  export interface IProductConfiguration {
  	readonly codeServerVersion?: string
  	readonly rootEndpoint?: string
@@ -101,11 +101,19 @@ Index: code-server/lib/vscode/src/vs/base/common/product.ts
  
  	readonly version: string;
  	readonly date?: string;
+@@ -119,6 +120,7 @@ export interface IProductConfiguration {
+ 		readonly resourceUrlTemplate: string;
+ 		readonly nlsBaseUrl: string;
+ 		readonly accessSKUs?: string[];
++		readonly authorizationHeaderToken?: string;
+ 	};
+ 
+ 	readonly mcpGallery?: {
 Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -340,6 +340,7 @@ export class WebClientServer {
+@@ -360,6 +360,7 @@ export class WebClientServer {
  		const productConfiguration: Partial<Mutable<IProductConfiguration>> = {
  			codeServerVersion: this._productService.codeServerVersion,
  			rootEndpoint: rootBase,
@@ -117,8 +125,8 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
-@@ -13,6 +13,8 @@ import { memoize } from '../../base/comm
- import { URI } from '../../base/common/uri.js';
+@@ -16,6 +16,8 @@ import { join } from '../../base/common/
+ import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
  
  export const serverOptions: OptionDescriptions<Required<ServerParsedArgs>> = {
 +	/* ----- code-server ----- */
@@ -126,7 +134,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverEnvironmentService.ts
  
  	/* ----- server setup ----- */
  
-@@ -95,6 +97,8 @@ export const serverOptions: OptionDescri
+@@ -104,6 +106,8 @@ export const serverOptions: OptionDescri
  };
  
  export interface ServerParsedArgs {

patches/webview.diff

@@ -41,7 +41,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/environment/browser/envi
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/environment/browser/environmentService.ts
-@@ -220,7 +220,7 @@ export class BrowserWorkbenchEnvironment
+@@ -223,7 +223,7 @@ export class BrowserWorkbenchEnvironment
  
  	@memoize
  	get webviewExternalEndpoint(): string {
@@ -54,7 +54,7 @@ Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
 +++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
-@@ -360,6 +360,7 @@ export class WebClientServer {
+@@ -380,6 +380,7 @@ export class WebClientServer {
  		const workbenchWebConfiguration = {
  			remoteAuthority,
  			serverBasePath: basePath,
@@ -70,21 +70,21 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-gEAyFzmkyqMoTTnN+3KReFUYoHsK4RAJEb+6eiul+UY=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-Oi71Tq4Buohx0KDH3yEbVJUzABnqYv9iVLo420HZXqI=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-q+WTr+fBXpLLE3++yWNaxT6BTWQtsKscoeIlynBRk4E=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-m1DlJtsIJd46QuWYNcsaYIG1xI+9FyjKQu+cfp+zq5Q=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"
-@@ -238,7 +238,7 @@
+@@ -253,7 +253,7 @@
  			}
  
  			const swPath = encodeURI(`service-worker.js?v=${expectedWorkerVersion}&vscode-resource-base-authority=${searchParams.get('vscode-resource-base-authority')}&remoteAuthority=${searchParams.get('remoteAuthority') ?? ''}`);
--			navigator.serviceWorker.register(swPath, { type: 'module' })
+-			navigator.serviceWorker.register(swPath, { type: 'module', updateViaCache: 'none' })
 +			navigator.serviceWorker.register(swPath)
  				.then(async registration => {
- 					/**
- 					 * @param {MessageEvent} event
-@@ -351,6 +351,12 @@
+ 					if (navigator.serviceWorker.controller) {
+ 						// A previous SW is already controlling. Force an update
+@@ -332,6 +332,12 @@
  
  				const hostname = location.hostname;
  

src/browser/pages/error.html

@@ -11,7 +11,7 @@
       content="style-src 'self'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
     />
     <meta name="color-scheme" content="light dark" />
-    <title>{{ERROR_TITLE}} - code-server</title>
+    <title>{{ERROR_TITLE}} - {{APP_NAME}}</title>
     <link rel="icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon-dark-support.svg" />
     <link rel="alternate icon" href="{{CS_STATIC_BASE}}/src/browser/media/favicon.ico" />
     <link rel="manifest" href="/manifest.json" crossorigin="use-credentials" />

src/browser/pages/global.css

@@ -15,7 +15,8 @@ body {
   color: #111;
   color: light-dark(#111, #ddd);
   margin: 0;
-  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji",
+  font-family:
+    -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji",
     "Segoe UI Emoji", "Segoe UI Symbol";
   overflow: hidden;
 }

src/common/http.ts

@@ -24,6 +24,6 @@ export class HttpError extends Error {
   }
 }
 
-export enum CookieKeys {
-  Session = "code-server-session",
+export function getCookieSessionName(suffix?: string): string {
+  return suffix ? `code-server-session-${suffix.replace(/[^a-zA-Z0-9-]/g, "-")}` : "code-server-session"
 }

src/node/cli.ts

@@ -52,7 +52,9 @@ export interface UserProvidedCodeArgs {
   "disable-workspace-trust"?: boolean
   "disable-getting-started-override"?: boolean
   "disable-proxy"?: boolean
+  "reconnection-grace-time"?: string
   "session-socket"?: string
+  "cookie-suffix"?: string
   "link-protection-trusted-domains"?: string[]
   // locale is used by both VS Code and code-server.
   locale?: string
@@ -93,6 +95,8 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
   "app-name"?: string
   "welcome-text"?: string
   "abs-proxy-base-path"?: string
+  i18n?: string
+  "idle-timeout-seconds"?: number
   /* Positional arguments. */
   _?: string[]
 }
@@ -170,6 +174,12 @@ export const options: Options<Required<UserProvidedArgs>> = {
   "session-socket": {
     type: "string",
   },
+  "cookie-suffix": {
+    type: "string",
+    description:
+      "Adds a suffix to the cookie. This can prevent a collision of cookies for subdomains, making them explixit. \n" +
+      "Without this flag, no suffix is used. This can also be set with CODE_SERVER_COOKIE_SUFFIX set to any string.",
+  },
   "disable-file-downloads": {
     type: "boolean",
     description:
@@ -284,17 +294,34 @@ export const options: Options<Required<UserProvidedArgs>> = {
   "app-name": {
     type: "string",
     short: "an",
-    description: "The name to use in branding. Will be shown in titlebar and welcome message",
+    description:
+      "Will replace the {{app}} placeholder in any strings, which by default includes the title bar and welcome message",
   },
   "welcome-text": {
     type: "string",
     short: "w",
     description: "Text to show on login page",
+    deprecated: true,
   },
   "abs-proxy-base-path": {
     type: "string",
     description: "The base path to prefix to all absproxy requests",
   },
+  i18n: {
+    type: "string",
+    path: true,
+    description: "Path to JSON file with custom translations. Merges with default strings and supports all i18n keys.",
+  },
+  "idle-timeout-seconds": {
+    type: "number",
+    description: "Timeout in seconds to wait before shutting down when idle.",
+  },
+  "reconnection-grace-time": {
+    type: "string",
+    description:
+      "Override the reconnection grace time in seconds. Clients who disconnect for longer than this duration will need to \n" +
+      "reload the window. Defaults to 10800 (3 hours).",
+  },
 }
 
 export const optionDescriptions = (opts: Partial<Options<Required<UserProvidedArgs>>> = options): string[] => {
@@ -388,6 +415,10 @@ export const parse = (
         throw new Error("--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN")
       }
 
+      if (key === "idle-timeout-seconds" && Number(value) <= 60) {
+        throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
+      }
+
       const option = options[key]
       if (option.type === "boolean") {
         ;(args[key] as boolean) = true
@@ -495,6 +526,7 @@ export interface DefaultedArgs extends ConfigArgs {
   "extensions-dir": string
   "user-data-dir": string
   "session-socket": string
+  "app-name": string
   /* Positional arguments. */
   _: string[]
 }
@@ -599,10 +631,28 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
     usingEnvPassword = false
   }
 
+  if (process.env.CODE_SERVER_COOKIE_SUFFIX) {
+    args["cookie-suffix"] = process.env.CODE_SERVER_COOKIE_SUFFIX
+  }
+
   if (process.env.GITHUB_TOKEN) {
     args["github-auth"] = process.env.GITHUB_TOKEN
   }
 
+  if (process.env.CODE_SERVER_RECONNECTION_GRACE_TIME) {
+    args["reconnection-grace-time"] = process.env.CODE_SERVER_RECONNECTION_GRACE_TIME
+  }
+
+  if (process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS) {
+    if (isNaN(Number(process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS))) {
+      logger.info("CODE_SERVER_IDLE_TIMEOUT_SECONDS must be a number")
+    }
+    if (Number(process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS) <= 60) {
+      throw new Error("--idle-timeout-seconds must be greater than 60 seconds.")
+    }
+    args["idle-timeout-seconds"] = Number(process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS)
+  }
+
   // Ensure they're not readable by child processes.
   delete process.env.PASSWORD
   delete process.env.HASHED_PASSWORD
@@ -627,6 +677,10 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
   }
   args["proxy-domain"] = finalProxies
 
+  if (!args["app-name"]) {
+    args["app-name"] = "code-server"
+  }
+
   args._ = getResolvedPathsFromArgs(args)
 
   return {

src/node/heart.ts

@@ -1,5 +1,6 @@
 import { logger } from "@coder/logger"
 import { promises as fs } from "fs"
+import { Emitter } from "../common/emitter"
 
 /**
  * Provides a heartbeat using a local file to indicate activity.
@@ -8,6 +9,9 @@ export class Heart {
   private heartbeatTimer?: NodeJS.Timeout
   private heartbeatInterval = 60000
   public lastHeartbeat = 0
+  private readonly _onChange = new Emitter<"alive" | "expired" | "unknown">()
+  readonly onChange = this._onChange.event
+  private state: "alive" | "expired" | "unknown" = "expired"
 
   public constructor(
     private readonly heartbeatPath: string,
@@ -17,6 +21,13 @@ export class Heart {
     this.alive = this.alive.bind(this)
   }
 
+  private setState(state: typeof this.state) {
+    if (this.state !== state) {
+      this.state = state
+      this._onChange.emit(this.state)
+    }
+  }
+
   public alive(): boolean {
     const now = Date.now()
     return now - this.lastHeartbeat < this.heartbeatInterval
@@ -28,6 +39,7 @@ export class Heart {
    */
   public async beat(): Promise<void> {
     if (this.alive()) {
+      this.setState("alive")
       return
     }
 
@@ -36,7 +48,22 @@ export class Heart {
     if (typeof this.heartbeatTimer !== "undefined") {
       clearTimeout(this.heartbeatTimer)
     }
-    this.heartbeatTimer = setTimeout(() => heartbeatTimer(this.isActive, this.beat), this.heartbeatInterval)
+
+    this.heartbeatTimer = setTimeout(async () => {
+      try {
+        if (await this.isActive()) {
+          this.beat()
+        } else {
+          this.setState("expired")
+        }
+      } catch (error: unknown) {
+        logger.warn((error as Error).message)
+        this.setState("unknown")
+      }
+    }, this.heartbeatInterval)
+
+    this.setState("alive")
+
     try {
       return await fs.writeFile(this.heartbeatPath, "")
     } catch (error: any) {
@@ -53,20 +80,3 @@ export class Heart {
     }
   }
 }
-
-/**
- * Helper function for the heartbeatTimer.
- *
- * If heartbeat is active, call beat. Otherwise do nothing.
- *
- * Extracted to make it easier to test.
- */
-export async function heartbeatTimer(isActive: Heart["isActive"], beat: Heart["beat"]) {
-  try {
-    if (await isActive()) {
-      beat()
-    }
-  } catch (error: unknown) {
-    logger.warn((error as Error).message)
-  }
-}

src/node/http.ts

@@ -1,11 +1,10 @@
 import { field, logger } from "@coder/logger"
 import * as express from "express"
-import * as expressCore from "express-serve-static-core"
 import * as http from "http"
 import * as net from "net"
-import * as qs from "qs"
+import qs from "qs"
 import { Disposable } from "../common/emitter"
-import { CookieKeys, HttpCode, HttpError } from "../common/http"
+import { HttpCode, HttpError } from "../common/http"
 import { normalize } from "../common/util"
 import { AuthType, DefaultedArgs } from "./cli"
 import { version as codeServerVersion } from "./constants"
@@ -41,6 +40,7 @@ declare global {
       heart: Heart
       settings: SettingsProvider<CoderSettings>
       updater: UpdateProvider
+      cookieSessionName: string
     }
   }
 }
@@ -125,7 +125,7 @@ export const authenticated = async (req: express.Request): Promise<boolean> => {
       const passwordMethod = getPasswordMethod(hashedPasswordFromArgs)
       const isCookieValidArgs: IsCookieValidArgs = {
         passwordMethod,
-        cookieKey: sanitizeString(req.cookies[CookieKeys.Session]),
+        cookieKey: sanitizeString(req.cookies[req.cookieSessionName]),
         passwordFromArgs: req.args.password || "",
         hashedPasswordFromArgs: req.args["hashed-password"],
       }
@@ -185,12 +185,7 @@ export const constructRedirectPath = (req: express.Request, query: qs.ParsedQs,
  * preserved.  `to` should be a simple path without any query parameters
  * `override` will merge with the existing query (use `undefined` to unset).
  */
-export const redirect = (
-  req: express.Request,
-  res: express.Response,
-  to: string,
-  override: expressCore.Query = {},
-): void => {
+export const redirect = (req: express.Request, res: express.Response, to: string, override: qs.ParsedQs = {}): void => {
   const query = Object.assign({}, req.query, override)
   Object.keys(override).forEach((key) => {
     if (typeof override[key] === "undefined") {
@@ -356,6 +351,25 @@ export function ensureOrigin(req: express.Request, _?: express.Response, next?:
   }
 }
 
+/**
+ * Return true if the origin matches any trusted origin.  Entries are matched
+ * as exact strings, the special wildcard `"*"`, or `*.example.com`-style
+ * domain wildcards (same as --proxy-domain).
+ */
+export function isTrustedOrigin(origin: string, trustedOrigins: string[]): boolean {
+  return trustedOrigins.some((trusted) => {
+    if (trusted === "*" || trusted === origin) {
+      return true
+    }
+    // *.example.com style: match origin if it is the domain or a subdomain
+    if (trusted.startsWith("*.")) {
+      const domain = trusted.slice(2).toLowerCase()
+      return origin === domain || origin.endsWith("." + domain)
+    }
+    return false
+  })
+}
+
 /**
  * Authenticate the request origin against the host.  Throw if invalid.
  */
@@ -375,7 +389,7 @@ export function authenticateOrigin(req: express.Request): void {
   }
 
   const trustedOrigins = req.args["trusted-origins"] || []
-  if (trustedOrigins.includes(origin) || trustedOrigins.includes("*")) {
+  if (isTrustedOrigin(origin, trustedOrigins)) {
     return
   }
 

src/node/i18n/index.ts

@@ -1,3 +1,4 @@
+import { promises as fs } from "fs"
 import i18next, { init } from "i18next"
 import * as en from "./locales/en.json"
 import * as ja from "./locales/ja.json"
@@ -5,29 +6,55 @@ import * as th from "./locales/th.json"
 import * as ur from "./locales/ur.json"
 import * as zhCn from "./locales/zh-cn.json"
 
+const defaultResources = {
+  en: {
+    translation: en,
+  },
+  "zh-cn": {
+    translation: zhCn,
+  },
+  th: {
+    translation: th,
+  },
+  ja: {
+    translation: ja,
+  },
+  ur: {
+    translation: ur,
+  },
+}
+
+export async function loadCustomStrings(filePath: string): Promise<void> {
+  try {
+    // Read custom strings from file path only
+    const fileContent = await fs.readFile(filePath, "utf8")
+    const customStringsData = JSON.parse(fileContent)
+
+    // User-provided strings override all languages.
+    Object.keys(defaultResources).forEach((locale) => {
+      i18next.addResourceBundle(locale, "translation", customStringsData)
+    })
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      throw new Error(`Custom strings file not found: ${filePath}\nPlease ensure the file exists and is readable.`)
+    } else if (error instanceof SyntaxError) {
+      throw new Error(`Invalid JSON in custom strings file: ${filePath}\n${error.message}`)
+    } else {
+      throw new Error(
+        `Failed to load custom strings from ${filePath}: ${error instanceof Error ? error.message : String(error)}`,
+      )
+    }
+  }
+}
+
 init({
   lng: "en",
   fallbackLng: "en", // language to use if translations in user language are not available.
   returnNull: false,
   lowerCaseLng: true,
   debug: process.env.NODE_ENV === "development",
-  resources: {
-    en: {
-      translation: en,
-    },
-    "zh-cn": {
-      translation: zhCn,
-    },
-    th: {
-      translation: th,
-    },
-    ja: {
-      translation: ja,
-    },
-    ur: {
-      translation: ur,
-    },
-  },
+  resources: defaultResources,
+  showSupportNotice: false,
 })
 
 export default i18next

src/node/i18n/locales/en.json

@@ -2,7 +2,7 @@
   "LOGIN_TITLE": "{{app}} login",
   "LOGIN_BELOW": "Please log in below.",
   "WELCOME": "Welcome to {{app}}",
-  "LOGIN_PASSWORD": "Check the config file at {{configFile}} for the password.",
+  "LOGIN_PASSWORD": "Check the config file for the password.",
   "LOGIN_USING_ENV_PASSWORD": "Password was set from $PASSWORD.",
   "LOGIN_USING_HASHED_PASSWORD": "Password was set from $HASHED_PASSWORD.",
   "SUBMIT": "SUBMIT",

src/node/i18n/locales/ja.json

@@ -2,7 +2,7 @@
   "LOGIN_TITLE": "{{app}} ログイン",
   "LOGIN_BELOW": "以下によりログインしてください。",
   "WELCOME": "ようこそ {{app}} へ！",
-  "LOGIN_PASSWORD": "パスワードは設定ファイル（ {{configFile}} ）を確認してください。",
+  "LOGIN_PASSWORD": "パスワードは設定ファイルを確認してください。",
   "LOGIN_USING_ENV_PASSWORD": "パスワードは環境変数 $PASSWORD で設定されています。",
   "LOGIN_USING_HASHED_PASSWORD": "パスワードは環境変数 $HASHED_PASSWORD で設定されています。",
   "SUBMIT": "実行",

src/node/i18n/locales/th.json

@@ -2,7 +2,7 @@
   "LOGIN_TITLE": "เข้าสู่ระบบ {{app}}",
   "LOGIN_BELOW": "กรุณาเข้าสู่ระบบด้านล่าง",
   "WELCOME": "ยินดีต้อนรับสู่ {{app}}",
-  "LOGIN_PASSWORD": "ตรวจสอบไฟล์กำหนดค่าที่ {{configFile}} เพื่อดูรหัสผ่าน",
+  "LOGIN_PASSWORD": "ตรวจสอบไฟล์กำหนดค่าเพื่อดูรหัสผ่าน",
   "LOGIN_USING_ENV_PASSWORD": "รหัสผ่านถูกกำหนดเป็น $PASSWORD",
   "LOGIN_USING_HASHED_PASSWORD": "รรหัสผ่านถูกกำหนดเป็น $HASHED_PASSWORD",
   "SUBMIT": "ส่ง",

src/node/i18n/locales/ur.json

@@ -2,7 +2,7 @@
   "LOGIN_TITLE": "{{app}} لاگ ان کریں",
   "LOGIN_BELOW": "براہ کرم نیچے لاگ ان کریں۔",
   "WELCOME": "میں خوش آمدید {{app}}",
-  "LOGIN_PASSWORD": "پاس ورڈ کے لیے {{configFile}} پر کنفگ فائل چیک کریں۔",
+  "LOGIN_PASSWORD": "پاس ورڈ کے لیے کنفگ فائل چیک کریں۔",
   "LOGIN_USING_ENV_PASSWORD": "پاس ورڈ $PASSWORD سے سیٹ کیا گیا تھا۔",
   "LOGIN_USING_HASHED_PASSWORD": "پاس ورڈ $HASHED_PASSWORD سے سیٹ کیا گیا تھا۔",
   "SUBMIT": "جمع کرائیں",

src/node/i18n/locales/zh-cn.json

@@ -2,7 +2,7 @@
   "LOGIN_TITLE": "{{app}} 登录",
   "LOGIN_BELOW": "请在下面登录。",
   "WELCOME": "欢迎来到 {{app}}",
-  "LOGIN_PASSWORD": "查看配置文件 {{configFile}} 中的密码。",
+  "LOGIN_PASSWORD": "查看配置文件中的密码。",
   "LOGIN_USING_ENV_PASSWORD": "密码在 $PASSWORD 中设置。",
   "LOGIN_USING_HASHED_PASSWORD": "密码在 $HASHED_PASSWORD 中设置。",
   "SUBMIT": "提交",

src/node/main.ts

@@ -7,9 +7,11 @@ import { plural } from "../common/util"
 import { createApp, ensureAddress } from "./app"
 import { AuthType, DefaultedArgs, Feature, toCodeArgs, UserProvidedArgs } from "./cli"
 import { commit, version, vsRootPath } from "./constants"
+import { loadCustomStrings } from "./i18n"
 import { register } from "./routes"
 import { VSCodeModule } from "./routes/vscode"
 import { isDirectory, open } from "./util"
+import { wrapper } from "./wrapper"
 
 /**
  * Return true if the user passed an extension-related VS Code flag.
@@ -122,6 +124,12 @@ export const runCodeServer = async (
 ): Promise<{ dispose: Disposable["dispose"]; server: http.Server }> => {
   logger.info(`code-server ${version} ${commit}`)
 
+  // Load custom strings if provided
+  if (args.i18n) {
+    await loadCustomStrings(args.i18n)
+    logger.info("Loaded custom strings")
+  }
+
   logger.info(`Using user-data-dir ${args["user-data-dir"]}`)
   logger.debug(`Using extensions-dir ${args["extensions-dir"]}`)
 
@@ -134,7 +142,7 @@ export const runCodeServer = async (
   const app = await createApp(args)
   const protocol = args.cert ? "https" : "http"
   const serverAddress = ensureAddress(app.server, protocol)
-  const disposeRoutes = await register(app, args)
+  const { disposeRoutes, heart } = await register(app, args)
 
   logger.info(`Using config file ${args.config}`)
   logger.info(`${protocol.toUpperCase()} server listening on ${serverAddress.toString()}`)
@@ -159,6 +167,27 @@ export const runCodeServer = async (
     logger.info("  - Not serving HTTPS")
   }
 
+  if (args["idle-timeout-seconds"]) {
+    logger.info(`  - Idle timeout set to ${args["idle-timeout-seconds"]} seconds`)
+
+    let idleShutdownTimer: NodeJS.Timeout | undefined
+    const startIdleShutdownTimer = () => {
+      idleShutdownTimer = setTimeout(() => {
+        logger.warn(`Idle timeout of ${args["idle-timeout-seconds"]} seconds exceeded`)
+        wrapper.exit(0)
+      }, args["idle-timeout-seconds"]! * 1000)
+    }
+
+    startIdleShutdownTimer()
+
+    heart.onChange((state) => {
+      clearTimeout(idleShutdownTimer)
+      if (state === "expired") {
+        startIdleShutdownTimer()
+      }
+    })
+  }
+
   if (args["disable-proxy"]) {
     logger.info("  - Proxy disabled")
   } else if (args["proxy-domain"].length > 0) {

src/node/routes/errors.ts

@@ -28,6 +28,12 @@ export const errorHasCode = (error: any): error is ErrorWithCode => {
 
 const notFoundCodes = [404, "ENOENT", "EISDIR"]
 
+/**
+ * Final HTTP error handler.
+ *
+ * Note: This handler intentionally does not call `next()` even though it
+ * accepts it as an argument; it is expected to be mounted last.
+ */
 export const errorHandler: express.ErrorRequestHandler = async (err, req, res, next) => {
   let statusCode = 500
 
@@ -51,7 +57,8 @@ export const errorHandler: express.ErrorRequestHandler = async (err, req, res, n
       replaceTemplates(req, content)
         .replace(/{{ERROR_TITLE}}/g, statusCode.toString())
         .replace(/{{ERROR_HEADER}}/g, statusCode.toString())
-        .replace(/{{ERROR_BODY}}/g, escapeHtml(err.message)),
+        .replace(/{{ERROR_BODY}}/g, escapeHtml(err.message))
+        .replace(/{{APP_NAME}}/g, req.args["app-name"]),
     )
   } else {
     res.json({
@@ -61,6 +68,12 @@ export const errorHandler: express.ErrorRequestHandler = async (err, req, res, n
   }
 }
 
+/**
+ * Final WebSocket error handler.
+ *
+ * Note: This handler intentionally does not call `next()` even though it
+ * accepts it as an argument; it is expected to be mounted last.
+ */
 export const wsErrorHandler: express.ErrorRequestHandler = async (err, req, res, next) => {
   let statusCode = 500
   if (errorHasStatusCode(err)) {

src/node/routes/index.ts

@@ -5,7 +5,7 @@ import { promises as fs } from "fs"
 import * as path from "path"
 import * as tls from "tls"
 import { Disposable } from "../../common/emitter"
-import { HttpCode, HttpError } from "../../common/http"
+import { getCookieSessionName, HttpCode, HttpError } from "../../common/http"
 import { plural } from "../../common/util"
 import { App } from "../app"
 import { AuthType, DefaultedArgs } from "../cli"
@@ -28,7 +28,10 @@ import * as vscode from "./vscode"
 /**
  * Register all routes and middleware.
  */
-export const register = async (app: App, args: DefaultedArgs): Promise<Disposable["dispose"]> => {
+export const register = async (
+  app: App,
+  args: DefaultedArgs,
+): Promise<{ disposeRoutes: Disposable["dispose"]; heart: Heart }> => {
   const heart = new Heart(path.join(paths.data, "heartbeat"), async () => {
     return new Promise((resolve, reject) => {
       // getConnections appears to not call the callback when there are no more
@@ -58,6 +61,8 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
   const settings = new SettingsProvider<CoderSettings>(path.join(args["user-data-dir"], "coder.json"))
   const updater = new UpdateProvider("https://api.github.com/repos/coder/code-server/releases/latest", settings)
 
+  const cookieSessionName = getCookieSessionName(args["cookie-suffix"])
+
   const common: express.RequestHandler = (req, _, next) => {
     // /healthz|/healthz/ needs to be excluded otherwise health checks will make
     // it look like code-server is always in use.
@@ -72,6 +77,7 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
     req.heart = heart
     req.settings = settings
     req.updater = updater
+    req.cookieSessionName = cookieSessionName
 
     next()
   }
@@ -173,8 +179,11 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
   app.router.use(errorHandler)
   app.wsRouter.use(wsErrorHandler)
 
-  return () => {
-    heart.dispose()
-    vscode.dispose()
+  return {
+    disposeRoutes: () => {
+      heart.dispose()
+      vscode.dispose()
+    },
+    heart,
   }
 }

src/node/routes/login.ts

@@ -2,7 +2,6 @@ import { Router, Request } from "express"
 import { promises as fs } from "fs"
 import { RateLimiter as Limiter } from "limiter"
 import * as path from "path"
-import { CookieKeys } from "../../common/http"
 import { rootPath } from "../constants"
 import { authenticated, getCookieOptions, redirect, replaceTemplates } from "../http"
 import i18n from "../i18n"
@@ -30,9 +29,10 @@ const getRoot = async (req: Request, error?: Error): Promise<string> => {
   const content = await fs.readFile(path.join(rootPath, "src/browser/pages/login.html"), "utf8")
   const locale = req.args["locale"] || "en"
   i18n.changeLanguage(locale)
-  const appName = req.args["app-name"] || "code-server"
-  const welcomeText = req.args["welcome-text"] || (i18n.t("WELCOME", { app: appName }) as string)
-  let passwordMsg = i18n.t("LOGIN_PASSWORD", { configFile: req.args.config })
+  const welcomeText = req.args["welcome-text"] || (i18n.t("WELCOME", { app: req.args["app-name"] }) as string)
+
+  // Determine password message using i18n
+  let passwordMsg = i18n.t("LOGIN_PASSWORD")
   if (req.args.usingEnvPassword) {
     passwordMsg = i18n.t("LOGIN_USING_ENV_PASSWORD")
   } else if (req.args.usingEnvHashedPassword) {
@@ -42,7 +42,7 @@ const getRoot = async (req: Request, error?: Error): Promise<string> => {
   return replaceTemplates(
     req,
     content
-      .replace(/{{I18N_LOGIN_TITLE}}/g, i18n.t("LOGIN_TITLE", { app: appName }))
+      .replace(/{{I18N_LOGIN_TITLE}}/g, i18n.t("LOGIN_TITLE", { app: req.args["app-name"] }))
       .replace(/{{WELCOME_TEXT}}/g, welcomeText)
       .replace(/{{PASSWORD_MSG}}/g, passwordMsg)
       .replace(/{{I18N_LOGIN_BELOW}}/g, i18n.t("LOGIN_BELOW"))
@@ -93,7 +93,7 @@ router.post<{}, string, { password?: string; base?: string } | undefined, { to?:
     if (isPasswordValid) {
       // The hash does not add any actual security but we do it for
       // obfuscation purposes (and as a side effect it handles escaping).
-      res.cookie(CookieKeys.Session, hashedPassword, getCookieOptions(req))
+      res.cookie(req.cookieSessionName, hashedPassword, getCookieOptions(req))
 
       const to = (typeof req.query.to === "string" && req.query.to) || "/"
       return redirect(req, res, to, { to: undefined })

src/node/routes/logout.ts

@@ -1,5 +1,4 @@
 import { Router } from "express"
-import { CookieKeys } from "../../common/http"
 import { getCookieOptions, redirect } from "../http"
 import { sanitizeString } from "../util"
 
@@ -7,7 +6,7 @@ export const router = Router()
 
 router.get<{}, undefined, undefined, { base?: string; to?: string }>("/", async (req, res) => {
   // Must use the *identical* properties used to set the cookie.
-  res.clearCookie(CookieKeys.Session, getCookieOptions(req))
+  res.clearCookie(req.cookieSessionName, getCookieOptions(req))
 
   const to = sanitizeString(req.query.to) || "/"
   return redirect(req, res, to, { to: undefined, base: undefined, href: undefined })

src/node/routes/pathProxy.ts

@@ -13,7 +13,8 @@ const getProxyTarget = (
 ): string => {
   // If there is a base path, strip it out.
   const base = (req as any).base || ""
-  const port = parseInt(req.params.port, 10)
+  // Cast since we only have one port param.
+  const port = parseInt(req.params.port as string, 10)
   if (isNaN(port)) {
     throw new HttpError("Invalid port", HttpCode.BadRequest)
   }

src/node/routes/vscode.ts

@@ -172,7 +172,6 @@ router.get("/", ensureVSCodeLoaded, async (req, res, next) => {
 })
 
 router.get("/manifest.json", async (req, res) => {
-  const appName = req.args["app-name"] || "code-server"
   res.writeHead(200, { "Content-Type": "application/manifest+json" })
 
   res.end(
@@ -180,18 +179,28 @@ router.get("/manifest.json", async (req, res) => {
       req,
       JSON.stringify(
         {
-          name: appName,
-          short_name: appName,
+          name: req.args["app-name"],
+          short_name: req.args["app-name"],
           start_url: ".",
           display: "fullscreen",
           display_override: ["window-controls-overlay"],
           description: "Run Code on a remote server.",
-          icons: [192, 512].map((size) => ({
-            src: `{{BASE}}/_static/src/browser/media/pwa-icon-${size}.png`,
-            type: "image/png",
-            sizes: `${size}x${size}`,
-            purpose: "maskable",
-          })),
+          icons: [192, 512]
+            .map((size) => [
+              {
+                src: `{{BASE}}/_static/src/browser/media/pwa-icon-${size}.png`,
+                type: "image/png",
+                sizes: `${size}x${size}`,
+                purpose: "any",
+              },
+              {
+                src: `{{BASE}}/_static/src/browser/media/pwa-icon-maskable-${size}.png`,
+                type: "image/png",
+                sizes: `${size}x${size}`,
+                purpose: "maskable",
+              },
+            ])
+            .flat(),
         },
         null,
         2,

src/node/settings.ts

@@ -1,5 +1,5 @@
 import { logger } from "@coder/logger"
-import { Query } from "express-serve-static-core"
+import type { ParsedQs } from "qs"
 import { promises as fs } from "fs"
 
 export type Settings = { [key: string]: Settings | string | boolean | number }
@@ -52,5 +52,5 @@ export interface UpdateSettings {
  * Global code-server settings.
  */
 export interface CoderSettings extends UpdateSettings {
-  query?: Query
+  query?: ParsedQs
 }

src/node/vscodeSocket.ts

@@ -2,8 +2,9 @@ import { logger } from "@coder/logger"
 import express from "express"
 import * as http from "http"
 import * as path from "path"
-import { HttpCode } from "../common/http"
+import { HttpCode, HttpError } from "../common/http"
 import { listen } from "./app"
+import { errorHandler } from "./routes/errors"
 import { canConnect } from "./util"
 
 export interface EditorSessionEntry {
@@ -44,24 +45,18 @@ export async function makeEditorSessionManagerServer(
     async (req, res) => {
       const filePath = req.query.filePath
       if (!filePath) {
-        res.status(HttpCode.BadRequest).send("filePath is required")
-        return
-      }
-      try {
-        const socketPath = await editorSessionManager.getConnectedSocketPath(filePath)
-        const response: GetSessionResponse = { socketPath }
-        res.json(response)
-      } catch (error: unknown) {
-        res.status(HttpCode.ServerError).send(error)
+        throw new HttpError("filePath is required", HttpCode.BadRequest)
       }
+      const socketPath = await editorSessionManager.getConnectedSocketPath(filePath)
+      const response: GetSessionResponse = { socketPath }
+      res.json(response)
     },
   )
 
   router.post<{}, string, AddSessionRequest | undefined>("/add-session", async (req, res) => {
     const entry = req.body?.entry
     if (!entry) {
-      res.status(400).send("entry is required")
-      return
+      throw new HttpError("entry is required", HttpCode.BadRequest)
     }
     editorSessionManager.addSession(entry)
     res.status(200).send("session added")
@@ -70,13 +65,14 @@ export async function makeEditorSessionManagerServer(
   router.post<{}, string, DeleteSessionRequest | undefined>("/delete-session", async (req, res) => {
     const socketPath = req.body?.socketPath
     if (!socketPath) {
-      res.status(400).send("socketPath is required")
-      return
+      throw new HttpError("socketPath is required", HttpCode.BadRequest)
     }
     editorSessionManager.deleteSession(socketPath)
     res.status(200).send("session deleted")
   })
 
+  router.use(errorHandler)
+
   const server = http.createServer(router)
   try {
     await listen(server, { socket: codeServerSocketPath })

test/e2e/models/CodeServer.ts

@@ -77,11 +77,14 @@ export class CodeServer {
    */
   private async createWorkspace(): Promise<string> {
     const dir = await this.workspaceDir
-    await fs.mkdir(path.join(dir, "Machine"), { recursive: true })
+    await fs.mkdir(path.join(dir, "User"), { recursive: true })
     await fs.writeFile(
-      path.join(dir, "Machine/settings.json"),
+      path.join(dir, "User/settings.json"),
       JSON.stringify({
         "workbench.startupEditor": "none",
+        // Disable the welcome popup so we can avoid having to click through it
+        // on every test.
+        "workbench.welcomePage.experimentalOnboarding": false,
       }),
       "utf8",
     )