Update Code to 1.144.0 (#8087)

The --socket-fd flag never worked. The wrapper forks the process that
listens, but only the IPC channel was inherited as fd 3, so the socket
passed by the caller was not available to the child. Node then tried to
listen on the IPC pipe and failed with "listen EEXIST".

Pass the socket to the child as stdio entry 4 and tell the child to use
that fd in the handshake.

Node also reports no address for a Unix socket adopted by fd, which made
startup fail with "Server has no address". Log the listener as fd:<n>
in that case.

Add an integration test that starts the code-server binary with a Unix
or TCP socket as fd 3 and checks that /healthz answers over it.

CHANGELOG.md

@@ -22,6 +22,26 @@ Code v99.99.999
 
 ## Unreleased
 
+Code v1.144.0
+
+### Changed
+
+- Update to Code 1.144.0
+
+### Fixed
+
+- `--socket-fd` now works: the inherited socket is passed on to the process
+  that listens, and the address is logged as `fd:<n>`. Previously code-server
+  failed with `listen EEXIST` or `Server has no address`.
+- The cookie domain was not being set against the shared root host of proxy
+  domains when proxy domains contained template variables like `{{port}}`,
+  resulting in having to sign in multiple times per domain instead of only once
+  as originally intended.
+- When doing the web socket origin check, if the host does not already contain a
+  port, fall back to `X-Forwarded-Port`.
+- Fix default ports not matching in the web socket origin check (for example
+  `https://coder.com` will now match `https://coder.com:443`).
+
 ## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23
 
 Code v1.143.1

ci/build/update-vscode.sh

@@ -101,6 +101,14 @@ function update_csp() {
     echo "Calculated hash as $hash"
     # Use octothorpe as a delimiter since the hash may contain a slash.
     sed -i.bak "s#'sha256-[^']\+'#'sha256-$hash'#" "$file"
+    # For the web worker extension host iframe, there is a matching sha in the
+    # web server.
+    if [[ $file == */webWorkerExtensionHostIframe.html ]] ; then
+      quilt add ./lib/vscode/src/vs/server/node/webClientServer.ts
+      sed -i.bak \
+          "s#webWorkerExtensionHostIframeScriptSHA = 'sha256-[^']\+'#webWorkerExtensionHostIframeScriptSHA = 'sha256-$hash'#" \
+          ./lib/vscode/src/vs/server/node/webClientServer.ts
+    fi
   done
 
   quilt refresh

patches/base-path.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/base/common/network.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/base/common/network.ts
 +++ code-server/lib/vscode/src/vs/base/common/network.ts
-@@ -256,7 +256,9 @@ class RemoteAuthoritiesImpl {
+@@ -262,7 +262,9 @@ class RemoteAuthoritiesImpl {
  		return URI.from({
  			scheme: platform.isWeb ? this._preferredWebSchema : Schemas.vscodeRemoteResource,
  			authority: `${host}:${port}`,

patches/copilot.diff

@@ -2,7 +2,7 @@ Index: code-server/lib/vscode/build/gulpfile.extensions.ts
 ===================================================================
 --- code-server.orig/lib/vscode/build/gulpfile.extensions.ts
 +++ code-server/lib/vscode/build/gulpfile.extensions.ts
-@@ -294,6 +294,29 @@ export const compileCopilotExtensionBuil
+@@ -283,6 +283,29 @@ export const compileCopilotExtensionBuil
  task.task(compileCopilotExtensionBuildTask);
  
  /**

patches/csp-hashes.diff

@@ -6,8 +6,8 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index
  	<meta charset="UTF-8">
  
  	<meta http-equiv="Content-Security-Policy"
--		content="default-src 'none'; script-src 'sha256-7cKy9iQfWRXcgRS74x6I4q5cRDkv8nQz51jecqMmQ5w=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
-+		content="default-src 'none'; script-src 'sha256-FYdHnaDkSHwSK3TmWDrs/tT+X4bK+aaoa9yy432BONk=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
+-		content="default-src 'none'; script-src 'sha256-Q3Tfcw0dGu/YD4dGBrRqBeOnmRMAH8HbKxArK4YSXBc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
++		content="default-src 'none'; script-src 'sha256-BmcTt6YZr75RujSQ3gF/UQL77e1RrOx62jNeikpwtxc=' 'self'; frame-src 'self'; style-src 'unsafe-inline';">
  
  	<!-- Disable pinch zooming -->
  	<meta name="viewport"
@@ -24,3 +24,16 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/worker/webWor
  			connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*;"/>
  	</head>
  	<body>
+Index: code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+===================================================================
+--- code-server.orig/lib/vscode/src/vs/server/node/webClientServer.ts
++++ code-server/lib/vscode/src/vs/server/node/webClientServer.ts
+@@ -114,7 +114,7 @@ const APP_ROOT = dirname(FileAccess.asFi
+ const STATIC_PATH = `/static`;
+ const CALLBACK_PATH = `/callback`;
+ const WEB_EXTENSION_PATH = `/web-extension-resource`;
+-const webWorkerExtensionHostIframeScriptSHA = 'sha256-daEgfo2VIXpx2Np71KqCCbkeQwv+68vPrx54XRcbdcs=';
++const webWorkerExtensionHostIframeScriptSHA = 'sha256-gfjiOVjAlxqrivZAfTq2d83mOaz0fnAxbGaFpj5IjD8=';
+ 
+ /**
+  * Substitutes the `{{...}}` placeholders of a workbench template. Placeholders must only ever

patches/getting-started.diff

@@ -19,7 +19,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { renderFormattedText } from '../../../../base/browser/formattedTextRenderer.js';
  import { status } from '../../../../base/browser/ui/aria/aria.js';
  import { StandardKeyboardEvent } from '../../../../base/browser/keyboardEvent.js';
-@@ -55,7 +55,7 @@ import { IRecentFolder, IRecentWorkspace
+@@ -56,7 +56,7 @@ import { IRecentFolder, IRecentWorkspace
  import { OpenRecentAction } from '../../../browser/actions/windowActions.js';
  import { OpenFileFolderAction, OpenFolderAction, OpenFolderViaWorkspaceAction } from '../../../browser/actions/workspaceActions.js';
  import { EditorPane } from '../../../browser/parts/editor/editorPane.js';
@@ -28,7 +28,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  import { IEditorOpenContext, IEditorSerializer } from '../../../common/editor.js';
  import { IWebviewElement, IWebviewService } from '../../webview/browser/webview.js';
  import './gettingStartedColors.js';
-@@ -930,6 +930,72 @@ export class GettingStartedPage extends
+@@ -944,6 +944,72 @@ export class GettingStartedPage extends
  			$('p.subtitle.description', {}, localize({ key: 'gettingStarted.editingEvolved', comment: ['Shown as subtitle on the Welcome page.'] }, "Editing evolved"))
  		);
  
@@ -101,7 +101,7 @@ Index: code-server/lib/vscode/src/vs/workbench/contrib/welcomeGettingStarted/bro
  		const leftColumn = $('.categories-column.categories-column-left', {},);
  		const rightColumn = $('.categories-column.categories-column-right', {},);
  
-@@ -980,6 +1046,9 @@ export class GettingStartedPage extends
+@@ -1000,6 +1066,9 @@ export class GettingStartedPage extends
  				recentList.setLimit(5);
  				reset(leftColumn, startList.getDomElement(), recentList.getDomElement());
  			}

patches/integration.diff

@@ -169,7 +169,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -64,6 +64,7 @@ import { IOpenerService } from '../../pl
+@@ -65,6 +65,7 @@ import { IOpenerService } from '../../pl
  import { mixin, safeStringify } from '../../base/common/objects.js';
  import { IndexedDB } from '../../base/browser/indexedDB.js';
  import { WebFileSystemAccess } from '../../platform/files/browser/webFileSystemAccess.js';
@@ -177,7 +177,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IProgressService } from '../../platform/progress/common/progress.js';
  import { DelayedLogChannel } from '../services/output/common/delayedLogChannel.js';
  import { dirname, joinPath } from '../../base/common/resources.js';
-@@ -140,6 +141,9 @@ export class BrowserMain extends Disposa
+@@ -141,6 +142,9 @@ export class BrowserMain extends Disposa
  		// Startup
  		const instantiationService = workbench.startup();
  

patches/marketplace.diff

@@ -77,7 +77,7 @@ Index: code-server/lib/vscode/src/vs/platform/extensionResourceLoader/common/ext
  import { TargetPlatform } from '../../extensions/common/extensions.js';
  import { ExtensionGalleryResourceType, getExtensionGalleryManifestResourceUri, IExtensionGalleryManifest, IExtensionGalleryManifestService } from '../../extensionManagement/common/extensionGalleryManifest.js';
  import { ILogService } from '../../log/common/log.js';
-@@ -163,9 +162,9 @@ export abstract class AbstractExtensionR
+@@ -167,9 +166,9 @@ export abstract class AbstractExtensionR
  	}
  
  	protected _isWebExtensionResourceEndPoint(uri: URI): boolean {

patches/proposed-api.diff

@@ -10,7 +10,7 @@ Index: code-server/lib/vscode/src/vs/workbench/services/extensions/common/extens
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
 +++ code-server/lib/vscode/src/vs/workbench/services/extensions/common/extensions.ts
-@@ -321,6 +321,10 @@ function extensionDescriptionArrayToMap(
+@@ -324,6 +324,10 @@ function extensionDescriptionArrayToMap(
  }
  
  export function isProposedApiEnabled(extension: IExtensionDescription, proposal: ApiProposalName): boolean {

patches/remote-storage.diff

@@ -179,7 +179,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
 ===================================================================
 --- code-server.orig/lib/vscode/src/vs/workbench/browser/web.main.ts
 +++ code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
-@@ -33,6 +33,7 @@ import { ISignService } from '../../plat
+@@ -34,6 +34,7 @@ import { ISignService } from '../../plat
  import { SignService } from '../../platform/sign/browser/signService.js';
  import { IWorkbenchConstructionOptions, IWorkbench, IWorkspace, ITunnel } from './web.api.js';
  import { BrowserStorageService } from '../services/storage/browser/storageService.js';
@@ -187,7 +187,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  import { IStorageService } from '../../platform/storage/common/storage.js';
  import { toLocalISOString } from '../../base/common/date.js';
  import { isWorkspaceToOpen, isFolderToOpen } from '../../platform/window/common/window.js';
-@@ -482,7 +483,7 @@ export class BrowserMain extends Disposa
+@@ -488,7 +489,7 @@ export class BrowserMain extends Disposa
  				serviceCollection.set(IWorkbenchConfigurationService, service);
  				return service;
  			}),
@@ -196,7 +196,7 @@ Index: code-server/lib/vscode/src/vs/workbench/browser/web.main.ts
  				serviceCollection.set(IStorageService, service);
  				return service;
  			})
-@@ -604,7 +605,21 @@ export class BrowserMain extends Disposa
+@@ -610,7 +611,21 @@ export class BrowserMain extends Disposa
  		}));
  	}
  

src/node/app.ts

@@ -111,9 +111,14 @@ export const createApp = async (args: DefaultedArgs): Promise<App> => {
  *
  * The address might be a URL or it might be a pipe or socket path.
  */
-export const ensureAddress = (server: http.Server, protocol: string): URL | string => {
+export const ensureAddress = (server: http.Server, protocol: string, socketFd?: number): URL | string => {
   const addr = server.address()
 
+  // Node reports no address for a Unix socket adopted by fd.
+  if (!addr && typeof socketFd === "number") {
+    return `fd:${socketFd}`
+  }
+
   if (!addr) {
     throw new Error("Server has no address")
   }

src/node/main.ts

@@ -141,7 +141,7 @@ export const runCodeServer = async (
 
   const app = await createApp(args)
   const protocol = args.cert ? "https" : "http"
-  const serverAddress = ensureAddress(app.server, protocol)
+  const serverAddress = ensureAddress(app.server, protocol, args["socket-fd"])
   const { disposeRoutes, heart } = await register(app, args)
 
   logger.info(`Using config file ${args.config}`)

src/node/wrapper.ts

@@ -8,6 +8,9 @@ import { paths } from "./util"
 
 const timeoutInterval = 10000 // 10s, matches VS Code's timeouts.
 
+// Fd 3 in the child is the IPC channel, so the inherited socket goes to fd 4.
+const CHILD_SOCKET_FD = 4
+
 /**
  * Listen to a single message from a process. Reject if the process errors,
  * exits, or times out.
@@ -334,13 +337,14 @@ export class ParentProcess extends Process {
   }
 
   private spawn(): cp.ChildProcess {
+    const socketFd = this.args?.["socket-fd"]
     return cp.fork(path.join(__dirname, "entry"), {
       env: {
         ...process.env,
         CODE_SERVER_PARENT_PID: process.pid.toString(),
         NODE_EXEC_PATH: process.execPath,
       },
-      stdio: ["pipe", "pipe", "pipe", "ipc"],
+      stdio: typeof socketFd === "number" ? ["pipe", "pipe", "pipe", "ipc", socketFd] : ["pipe", "pipe", "pipe", "ipc"],
     })
   }
 
@@ -359,7 +363,8 @@ export class ParentProcess extends Process {
       this.logger,
     )
     this.logger.debug("got message", field("message", message))
-    this.send(child, { type: "handshake", args: this.args })
+    const args = typeof this.args["socket-fd"] === "number" ? { ...this.args, "socket-fd": CHILD_SOCKET_FD } : this.args
+    this.send(child, { type: "handshake", args })
   }
 
   /**

test/integration/socketFd.test.ts

@@ -0,0 +1,80 @@
+import { ChildProcess, spawn } from "child_process"
+import { promises as fs } from "fs"
+import * as http from "http"
+import * as net from "net"
+import * as path from "path"
+import { clean, tmpdir } from "../utils/helpers"
+
+describe("--socket-fd", () => {
+  const testName = "socketFd"
+  const codeServerPath = process.env.CODE_SERVER_PATH || path.resolve("../../release-standalone/bin/code-server")
+  let tempDir: string
+  let socketDir: string | undefined
+  let child: ChildProcess | undefined
+
+  beforeEach(async () => {
+    await clean(testName)
+    tempDir = await tmpdir(testName)
+  })
+
+  afterEach(async () => {
+    if (child?.pid && child.exitCode === null) {
+      // Kill the process group so that the wrapper's inner process also stops.
+      process.kill(-child.pid, "SIGKILL")
+    }
+    if (socketDir) {
+      await fs.rm(socketDir, { force: true, recursive: true })
+      socketDir = undefined
+    }
+  })
+
+  // Give the listener to code-server as fd 3, as systemd socket activation does.
+  const getHealthzThroughFd = async (server: net.Server, target: http.RequestOptions): Promise<number> => {
+    const fd: number = (server as any)._handle.fd
+    let output = ""
+    child = spawn(
+      codeServerPath,
+      [
+        "--socket-fd=3",
+        "--auth=none",
+        `--user-data-dir=${path.join(tempDir, "data")}`,
+        `--config=${path.join(tempDir, "config.yaml")}`,
+      ],
+      { detached: true, stdio: ["ignore", "pipe", "pipe", fd] },
+    )
+    child.stdout?.on("data", (chunk) => (output += chunk))
+    child.stderr?.on("data", (chunk) => (output += chunk))
+    await new Promise((resolve) => server.close(resolve))
+
+    const exited = new Promise<never>((_, reject) => {
+      child?.once("exit", (code) => reject(new Error(`code-server exited with code ${code}:\n${output}`)))
+    })
+    const status = new Promise<number>((resolve, reject) => {
+      http
+        .get({ ...target, path: "/healthz" }, (res) => {
+          res.resume()
+          resolve(res.statusCode ?? 0)
+        })
+        .once("error", (error) => reject(new Error(`${error.message}:\n${output}`)))
+    })
+    return Promise.race([status, exited])
+  }
+
+  it("should serve requests on a Unix socket passed as a file descriptor", async () => {
+    // macOS limits socket paths to 104 bytes, and os.tmpdir() can be too long.
+    socketDir = await fs.mkdtemp("/tmp/cs-fd-")
+    const server = net.createServer()
+    await new Promise<void>((resolve) => server.listen(path.join(socketDir!, "listen.sock"), resolve))
+    // server.close() unlinks the socket path, so connect through a hard link.
+    const socketPath = path.join(socketDir, "connect.sock")
+    await fs.link(path.join(socketDir, "listen.sock"), socketPath)
+    expect(await getHealthzThroughFd(server, { socketPath })).toBe(200)
+  }, 60000)
+
+  it("should serve requests on a TCP socket passed as a file descriptor", async () => {
+    const server = net.createServer()
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve))
+    const { port } = server.address() as net.AddressInfo
+    expect(await getHealthzThroughFd(server, { host: "127.0.0.1", port })).toBe(200)
+  }, 60000)
+})

test/unit/node/app.test.ts

@@ -152,6 +152,9 @@ describe("ensureAddress", () => {
   it("should throw and error if no address", () => {
     expect(() => ensureAddress(mockServer, "http")).toThrow("Server has no address")
   })
+  it("should describe a --socket-fd listener by its fd when node reports no address", () => {
+    expect(ensureAddress(mockServer, "http", 4)).toBe("fd:4")
+  })
   it("should return the address if it's a string", async () => {
     mockServer.address = () => "/path/to/unix.sock"
     const address = ensureAddress(mockServer, "http")