Update codeql actions to 4.37.6

One was updated by Dependabot, but not the others.

.github/workflows/build.yaml

@@ -21,7 +21,8 @@ jobs:
     outputs:
       ci: ${{ steps.filter.outputs.ci }}
       code: ${{ steps.filter.outputs.code }}
-      deps: ${{ steps.filter.outputs.deps }}
+      npm: ${{ steps.filter.outputs.npm }}
+      vscode: ${{ steps.filter.outputs.vscode }}
       docs: ${{ steps.filter.outputs.docs }}
       helm: ${{ steps.filter.outputs.helm }}
     steps:
@@ -42,11 +43,12 @@ jobs:
             code:
               - "src/**"
               - "test/**"
-            deps:
-              - "lib/**"
-              - "patches/**"
+            npm:
               - "package-lock.json"
               - "test/package-lock.json"
+            vscode:
+              - "lib/**"
+              - "patches/**"
       - id: debug
         run: |
           echo "${{ toJSON(steps.filter )}}"
@@ -56,7 +58,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -73,7 +75,7 @@ jobs:
     if: needs.changes.outputs.docs == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -90,12 +92,10 @@ jobs:
     if: needs.changes.outputs.helm == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      - uses: bmuschko/setup-kubeconform@e5d264ec1eafe2314e750c429a9da7639dd5a003 # v1.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          version: "v3.19.2"
-      - run: helm plugin install https://github.com/instrumenta/helm-kubeval
-      - run: helm kubeval ci/helm-chart
+          kubeconform-version: "0.8.0"
+      - run: kubeconform ci/helm-chart
 
   lint-ts:
     name: Lint TypeScript files
@@ -104,7 +104,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -132,10 +132,10 @@ jobs:
     name: Run unit tests
     runs-on: ubuntu-22.04
     needs: changes
-    if: needs.changes.outputs.code == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -172,7 +172,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -216,11 +216,11 @@ jobs:
     env:
       LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true'
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -252,7 +252,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       LOG_LEVEL: debug
     needs: [changes, build]
-    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.deps == 'true' || needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true'
 
     steps:
       - name: Cache Caddy
@@ -270,7 +270,7 @@ jobs:
           tar -xzf caddy_2.5.2_linux_amd64.tar.gz --directory ~/.cache/caddy
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm

.github/workflows/publish.yaml

@@ -34,7 +34,7 @@ jobs:
           echo "VERSION=${TAG#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
 
@@ -112,11 +112,11 @@ jobs:
       - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
       - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release.yaml

@@ -80,7 +80,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -110,7 +110,7 @@ jobs:
       - run: |
           sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
         if: ${{ matrix.vscode_arch == 'x64' }}
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
@@ -123,7 +123,7 @@ jobs:
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
       - run: npm run package
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
@@ -174,7 +174,7 @@ jobs:
         with:
           submodules: true
       - run: quilt push -a
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
           cache: npm
@@ -189,7 +189,7 @@ jobs:
       - run: npm run test:native
 
       - run: npm run package
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
           discussion_category_name: "📣 Announcements"

.github/workflows/security.yaml

@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version-file: .node-version
 
@@ -62,7 +62,7 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           sarif_file: "trivy-repo-results.sarif"
 
@@ -80,13 +80,13 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           config-file: ./.github/codeql-config.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/trivy-docker.yaml

@@ -58,6 +58,6 @@ jobs:
           severity: "HIGH,CRITICAL"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           sarif_file: "trivy-image-results.sarif"

CHANGELOG.md

@@ -22,6 +22,16 @@ Code v99.99.999
 
 ## Unreleased
 
+## [4.133.0](https://github.com/coder/code-server/releases/tag/v4.133.0) - 2026-08-17
+
+Code v1.133.0
+
+### Changed
+
+- Update to Code 1.133.0
+
+## [4.132.0](https://github.com/coder/code-server/releases/tag/v4.132.0) - 2026-08-10
+
 Code v1.132.0
 
 ### Changed

ci/build/npm-postinstall.sh

@@ -65,8 +65,8 @@ main() {
     echo "USE AT YOUR OWN RISK!"
   fi
 
-  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-22}" ]; then
-    echo "ERROR: code-server currently requires node v22."
+  if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-24}" ]; then
+    echo "ERROR: code-server currently requires node v24."
     if [ -n "$FORCE_NODE_VERSION" ]; then
       echo "However, you have overrided the version check to use v$FORCE_NODE_VERSION."
     fi
@@ -76,20 +76,6 @@ main() {
     exit 1
   fi
 
-  # Under npm, if we are running as root, we need --unsafe-perm otherwise
-  # post-install scripts will not have sufficient permissions to do their thing.
-  if is_root; then
-    case "${npm_config_user_agent-}" in npm*)
-      if [ "${npm_config_unsafe_perm-}" != "true" ]; then
-        echo "Please pass --unsafe-perm to npm to install code-server"
-        echo "Otherwise post-install scripts will not have permissions to run"
-        echo "See https://docs.npmjs.com/misc/config#unsafe-perm"
-        echo "See https://stackoverflow.com/questions/49084929/npm-sudo-global-installation-unsafe-perm"
-        exit 1
-      fi
-      ;;
-    esac
-  fi
 
   if ! vscode_install; then
     echo "You may not have the required dependencies to build the native modules."
@@ -110,7 +96,7 @@ install_with_yarn_or_npm() {
   # end-user we want to keep using whatever package manager is in use.
   case "${npm_config_user_agent-}" in
     npm*)
-      if ! npm install --unsafe-perm --omit=dev; then
+      if ! npm install --omit=dev; then
         return 1
       fi
       ;;

ci/helm-chart/Chart.yaml

@@ -15,9 +15,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.46.0
+version: 3.48.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: 4.131.0
+appVersion: 4.133.0

ci/helm-chart/values.yaml

@@ -6,7 +6,7 @@ replicaCount: 1
 
 image:
   repository: codercom/code-server
-  tag: '4.131.0'
+  tag: '4.133.0'
   pullPolicy: Always
 
 # Specifies one or more secrets to be used when pulling images from a
@@ -34,6 +34,10 @@ serviceAccount:
 # Specifies annotations for deployment
 annotations: {}
 
+# code-server.labels -- The Deployment labels. See:
+# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+labels: {}
+
 podAnnotations: {}
 
 podSecurityContext: {}

docs/CONTRIBUTING.md

@@ -31,7 +31,7 @@ The prerequisites for contributing to code-server are almost the same as those
 for [VS Code](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites).
 Here is what is needed:
 
-- `node` v22.x
+- `node` v24.x
 - `git` v2.x or greater
 - [`git-lfs`](https://git-lfs.github.com)
 - [`npm`](https://www.npmjs.com/)

docs/android.md

@@ -11,11 +11,11 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
 ```
 
 6. Exit the terminal using `exit` and then reopen the terminal
-7. Install and use Node.js 22:
+7. Install and use Node.js 24:
 
 ```shell
-nvm install 22
-nvm use 22
+nvm install 24
+nvm use 24
 ```
 
 8. Install code-server globally on device with: `npm install --global code-server`

docs/helm.md

@@ -105,7 +105,7 @@ $ helm upgrade --install code-server \
   --set persistence.enabled=false
 ```
 
-The above command sets the the persistence storage to false.
+The above command sets the persistence storage to false.
 
 Alternatively, a YAML file that specifies the values for the above parameters
 can be provided while installing the chart. For example,

docs/npm.md

@@ -29,8 +29,7 @@ includes installing instructions based on your operating system.
 
 ## Node.js version
 
-We use the same major version of Node.js shipped with Code's remote, which is
-currently `22.x`. VS Code also [lists Node.js
+We use Node.js `24.x`. VS Code also [lists Node.js
 requirements](https://github.com/microsoft/vscode/wiki/How-to-Contribute#prerequisites).
 
 Using other versions of Node.js [may lead to unexpected
@@ -78,7 +77,7 @@ Proceed to [installing](#installing)
 ## FreeBSD
 
 ```sh
-pkg install -y git python npm-node22 pkgconf
+pkg install -y git python npm-node24 pkgconf
 pkg install -y libinotify
 ```
 

docs/termux.md

@@ -57,7 +57,7 @@ npm config set python python3
 node -v
 ```
 
-you will get Node version `v22`
+you will get Node version `v24`
 
 5. Now install code-server following our guide on [installing with npm](./npm.md)
 

install.sh

@@ -436,7 +436,7 @@ install_npm() {
     fi
     echoh "Installing with npm."
     echoh
-    "$sh_c" "$NPM_PATH" install -g "code-server@$VERSION" --unsafe-perm
+    "$sh_c" "$NPM_PATH" install -g "code-server@$VERSION"
     NPM_BIN_DIR="\$($NPM_PATH bin -g)" echo_npm_postinstall
     return
   fi

package-lock.json

@@ -20,7 +20,7 @@
         "http-proxy": "^1.18.1",
         "httpolyglot": "^0.1.2",
         "i18next": "^26.3.1",
-        "js-yaml": "^4.1.0",
+        "js-yaml": "^5.2.3",
         "limiter": "^2.1.0",
         "pem": "^1.14.8",
         "proxy-agent": "^6.3.1",
@@ -268,6 +268,29 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/@eslint/js": {
       "version": "9.39.3",
       "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.3.tgz",
@@ -953,16 +976,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@@ -1677,9 +1700,9 @@
       "license": "BSD-2-Clause"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4153,9 +4176,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
+      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
       "funding": [
         {
           "type": "github",
@@ -4171,7 +4194,7 @@
         "argparse": "^2.0.1"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
     "node_modules/json-buffer": {

package.json

@@ -76,7 +76,7 @@
     "http-proxy": "^1.18.1",
     "httpolyglot": "^0.1.2",
     "i18next": "^26.3.1",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^5.2.3",
     "limiter": "^2.1.0",
     "pem": "^1.14.8",
     "proxy-agent": "^6.3.1",

patches/display-language.diff

@@ -9,16 +9,16 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -12,7 +12,7 @@ import * as path from '../../base/common
- import { IURITransformer } from '../../base/common/uriIpc.js';
+@@ -13,7 +13,7 @@ import { IURITransformer } from '../../b
+ import { generateUuid } from '../../base/common/uuid.js';
  import { getMachineId, getSqmMachineId, getDevDeviceId } from '../../base/node/id.js';
  import { Promises } from '../../base/node/pfs.js';
 -import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
 +import { ClientConnectionEvent, IMessagePassingProtocol, IPCServer, ProxyChannel, StaticRouter } from '../../base/parts/ipc/common/ipc.js';
  import { ProtocolConstants } from '../../base/parts/ipc/common/ipc.net.js';
+ import { createRandomIPCHandle } from '../../base/parts/ipc/node/ipc.net.js';
  import { IConfigurationService } from '../../platform/configuration/common/configuration.js';
- import { ConfigurationService } from '../../platform/configuration/common/configurationService.js';
-@@ -358,6 +358,9 @@ export async function setupServerService
+@@ -417,6 +417,9 @@ export async function setupServerService
  
  		socketServer.registerChannel('mcpManagement', new McpManagementChannel(mcpManagementService, (ctx: RemoteAgentConnectionContext) => getUriTransformer(ctx.remoteAuthority)));
  

patches/integration.diff

@@ -172,7 +172,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -139,6 +140,9 @@ export class BrowserMain extends Disposa
+@@ -140,6 +141,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
  

patches/marketplace.diff

@@ -19,9 +19,9 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -49,6 +49,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
- 			version: pkg.version
- 		});
+@@ -65,6 +65,17 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+ 			Object.assign(product, { copilotVersions: { runtime, sdk } });
+ 		}
  	}
 +
 +	Object.assign(product, {

patches/telemetry.diff

@@ -12,15 +12,7 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/server/node/serverServices.ts
 +++ code-server/lib/vscode/src/vs/server/node/serverServices.ts
-@@ -4,6 +4,7 @@
-  *--------------------------------------------------------------------------------------------*/
- 
- import { hostname, release } from 'os';
-+import { promises as fs } from 'fs';
- import { Emitter, Event } from '../../base/common/event.js';
- import { DisposableStore, toDisposable } from '../../base/common/lifecycle.js';
- import { Schemas } from '../../base/common/network.js';
-@@ -65,6 +66,7 @@ import { IExtensionsScannerService } fro
+@@ -68,6 +68,7 @@ import { IExtensionsScannerService } fro
  import { ExtensionsScannerService } from './extensionsScannerService.js';
  import { IExtensionsProfileScannerService } from '../../platform/extensionManagement/common/extensionsProfileScannerService.js';
  import { IUserDataProfilesService } from '../../platform/userDataProfile/common/userDataProfile.js';
@@ -28,18 +20,18 @@ Index: code-server/lib/vscode/src/vs/server/node/serverServices.ts
  import { NullPolicyService } from '../../platform/policy/common/policy.js';
  import { OneDataSystemAppender } from '../../platform/telemetry/node/1dsAppender.js';
  import { LoggerService } from '../../platform/log/node/loggerService.js';
-@@ -176,11 +178,23 @@ export async function setupServerService
+@@ -179,11 +180,23 @@ export async function setupServerService
  	const requestService = new RequestService('remote', configurationService, environmentService, logService);
  	services.set(IRequestService, requestService);
  
 +	let isContainer = undefined;
 +	try {
-+		await fs.stat('/run/.containerenv');
++		await fs.promises.stat('/run/.containerenv');
 +		isContainer = true;
 +	} catch (error) { /* Does not exist, probably. */ }
 +	if (!isContainer) {
 +		try {
-+			const content = await fs.readFile('/proc/self/cgroup', 'utf8')
++			const content = await fs.promises.readFile('/proc/self/cgroup', 'utf8')
 +			isContainer = content.includes('docker');
 +		} catch (error) { /* Permission denied, probably. */ }
 +	}
@@ -159,7 +151,7 @@ Index: code-server/lib/vscode/src/vs/platform/product/common/product.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/platform/product/common/product.ts
 +++ code-server/lib/vscode/src/vs/platform/product/common/product.ts
-@@ -58,7 +58,8 @@ else if (globalThis._VSCODE_PRODUCT_JSON
+@@ -113,7 +113,8 @@ else {
  			resourceUrlTemplate: "https://open-vsx.org/vscode/asset/{publisher}/{name}/{version}/Microsoft.VisualStudio.Code.WebResources/{path}",
  			controlUrl: "",
  			recommendationsUrl: "",

src/node/cli.ts

@@ -97,6 +97,7 @@ export interface UserProvidedArgs extends UserProvidedCodeArgs {
   "abs-proxy-base-path"?: string
   i18n?: string
   "idle-timeout-seconds"?: number
+  "vscode-option"?: string[]
   /* Positional arguments. */
   _?: string[]
 }
@@ -322,6 +323,13 @@ export const options: Options<Required<UserProvidedArgs>> = {
       "Override the reconnection grace time in seconds. Clients who disconnect for longer than this duration will need to \n" +
       "reload the window. Defaults to 10800 (3 hours).",
   },
+  "vscode-option": {
+    type: "string[]",
+    description:
+      "Pass an option straight through to the VS Code server as flag=value, or as a bare flag for a \n" +
+      "boolean. Repeatable; repeating the same flag builds an array. Use this to reach VS Code options \n" +
+      "code-server does not model itself, e.g. --vscode-option enable-sandbox --vscode-option agents=true.",
+  },
 }
 
 export const optionDescriptions = (opts: Partial<Options<Required<UserProvidedArgs>>> = options): string[] => {
@@ -643,6 +651,15 @@ export async function setDefaults(cliArgs: UserProvidedArgs, configArgs?: Config
     args["reconnection-grace-time"] = process.env.CODE_SERVER_RECONNECTION_GRACE_TIME
   }
 
+  // Space-separated, like NODE_OPTIONS.  Appended to any flags rather than
+  // replacing them so the two can be combined.
+  if (process.env.VSCODE_OPTIONS) {
+    args["vscode-option"] = [
+      ...(args["vscode-option"] ?? []),
+      ...process.env.VSCODE_OPTIONS.split(/\s+/).filter((option) => option),
+    ]
+  }
+
   if (process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS) {
     if (isNaN(Number(process.env.CODE_SERVER_IDLE_TIMEOUT_SECONDS))) {
       logger.info("CODE_SERVER_IDLE_TIMEOUT_SECONDS must be a number")
@@ -909,17 +926,58 @@ export interface CodeArgs extends UserProvidedCodeArgs {
   log?: string[]
 }
 
+/**
+ * Expand --vscode-option entries into VS Code server arguments.
+ *
+ * An entry is `flag=value`, or a bare `flag` meaning true.  A leading `--` on
+ * the flag is optional, so both spellings people reach for work.  Repeating a
+ * flag collects the values into an array, since several VS Code options take
+ * one.
+ *
+ * `true` and `false` become booleans rather than strings.  VS Code tests these
+ * flags for truthiness and the string "false" is truthy, so passing it along
+ * verbatim would quietly do the opposite of what was asked.
+ */
+export const parseVscodeOptions = (entries: string[]): Record<string, string | boolean | string[]> => {
+  const parsed: Record<string, string | boolean | string[]> = {}
+
+  for (const entry of entries) {
+    const [flag, rawValue] = splitOnFirstEquals(entry.replace(/^--/, ""))
+    if (!flag) {
+      throw new Error(`--vscode-option requires a flag name (got "${entry}")`)
+    }
+
+    const value: string | boolean =
+      typeof rawValue === "undefined" || rawValue === "true" ? true : rawValue === "false" ? false : rawValue
+
+    const existing = parsed[flag]
+    if (typeof existing === "undefined") {
+      parsed[flag] = value
+    } else if (Array.isArray(existing)) {
+      existing.push(String(value))
+    } else {
+      parsed[flag] = [String(existing), String(value)]
+    }
+  }
+
+  return parsed
+}
+
 /**
  * Convert our arguments to equivalent VS Code server arguments.
  * Does not add any extra arguments.
  */
 export const toCodeArgs = async (args: DefaultedArgs): Promise<CodeArgs> => {
+  // The passthrough option is ours; VS Code has no idea what it is.
+  const { "vscode-option": vscodeOptions, ...rest } = args
   return {
-    ...args,
+    ...rest,
     /** Type casting. */
     help: !!args.help,
     version: !!args.version,
     port: args.port?.toString(),
     log: args.log ? [args.log] : undefined,
-  }
+    // Last, so that reaching an option code-server does model still works.
+    ...parseVscodeOptions(vscodeOptions ?? []),
+  } as CodeArgs
 }

test/package-lock.json

@@ -1498,9 +1498,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

test/unit/node/cli.test.ts

@@ -51,6 +51,7 @@ describe("parser", () => {
     delete process.env.CODE_SERVER_RECONNECTION_GRACE_TIME
     delete process.env.VSCODE_PROXY_URI
     delete process.env.CS_DISABLE_PROXY
+    delete process.env.VSCODE_OPTIONS
     console.log = jest.fn()
   })
 
@@ -413,6 +414,17 @@ describe("parser", () => {
     })
   })
 
+  it("should use env var VSCODE_OPTIONS", async () => {
+    process.env.VSCODE_OPTIONS = "--enable-sandbox agents=true"
+    const args = parse(["--vscode-option", "verbose-logging"])
+
+    const defaultArgs = await setDefaults(args)
+    expect(defaultArgs).toEqual({
+      ...defaults,
+      "vscode-option": ["verbose-logging", "--enable-sandbox", "agents=true"],
+    })
+  })
+
   it("should use env var CS_DISABLE_GETTING_STARTED_OVERRIDE", async () => {
     process.env.CS_DISABLE_GETTING_STARTED_OVERRIDE = "1"
     const args = parse([])
@@ -1006,6 +1018,44 @@ describe("toCodeArgs", () => {
       _: [file],
     })
   })
+
+  it("should pass through --vscode-option", async () => {
+    const args = parse([
+      "--vscode-option",
+      "enable-sandbox",
+      "--vscode-option",
+      "agents=true",
+      "--vscode-option",
+      "enable-smoke-test-driver=false",
+    ])
+    expect(await toCodeArgs(await setDefaults(args))).toStrictEqual({
+      ...vscodeDefaults,
+      "enable-sandbox": true,
+      agents: true,
+      "enable-smoke-test-driver": false,
+    })
+  })
+
+  it("should collect a repeated --vscode-option into an array", async () => {
+    const args = parse([
+      "--vscode-option",
+      "locate-extension=a",
+      "--vscode-option",
+      "locate-extension=b",
+      "--vscode-option",
+      "locate-extension=c",
+    ])
+    expect(await toCodeArgs(await setDefaults(args))).toStrictEqual({
+      ...vscodeDefaults,
+      "locate-extension": ["a", "b", "c"],
+    })
+  })
+
+  it("should error if --vscode-option has no flag", async () => {
+    await expect(toCodeArgs(await setDefaults(parse(["--vscode-option", "=nothing"])))).rejects.toThrow(
+      "--vscode-option requires a flag name",
+    )
+  })
 })
 
 describe("optionDescriptions", () => {